glaurung

Research

papers, driver bugs, and dead ends

Glaurung has been used on 27,087 signed Windows drivers and all 523 functions in Notepad. Two papers are on arXiv. None of the three driver reports received a CVE.

Preprints

two IOCTL censuses

arXiv:2606.07732 submitted 2026-06-05 · cs.CR

The Windows IOCTL Census: A Corpus-Scale, Multi-Architecture Database of the Driver Control-Code Surface

The paper maps control-code dispatch in 27,087 signed Windows drivers. One deterministic pass recovers the data without symbolic execution. Glaurung supplies the disassembly, lifting, and intermediate representation.

Dispatch recovery reads an architecture-neutral IR, so the same recognizer works on x86 and x64. The scanners compared in the paper abort on 32-bit drivers.

27,087

signed drivers in the corpus

tab_corpus.tex

80.1%

had a dispatch surface recovered (21,708)

tab_corpus.tex

3.09M

decoded control codes, x64 and x86

tab_corpus.tex

15.95M

call edges (x64 lane only)

tab_corpus.tex

abstract ↗ dataset ↗

arXiv:2606.10290 submitted 2026-06-09 · cs.CR

The Linux IOCTL Census: A Source-Derived Database of the Linux Kernel Control-Code Surface

A companion study built from kernel source instead of binaries.

abstract ↗

Both are preprints. Neither has been through peer review, and neither carries a DOI.

MSRC

three reports; no CVEs

MSRC declined two reports and ruled the third out of scope.

driver class privilege required CVSS 3.1 outcome
ndfltr.sys CWE-190 → CWE-125unprivileged5.5 mediumdeclined
NDKPing.sys CWE-476administrator4.4 mediumdeclined
KovaPlusFltr.sys CWE-121 → CWE-787unprivileged7.8 highout of scope (third-party)

The reports included real-byte emulation, a live bugcheck under QEMU, or a saved-RIP overwrite. MSRC found no crossed privilege boundary in the two reports it declined. The public catalog includes one false positive caught before disclosure and corrects an older claim that all three reports had been verified.

notepad.exe

523 functions in 1.9 seconds

523

functions in notepad.exe, all lifted

published 2026-05-30

1.9 s

to lift all of them, about 4 ms per function

published 2026-05-30

466

named from the PDB

published 2026-05-30

An LLM pass over all 523 functions took about ninety seconds and roughly 791,000 tokens on a small model, and surfaced a 32-bit integer overflow in Replace All. It was confirmed by Unicorn emulation and then reproduced on shipping Notepad in QEMU with a differential control.

The write-up concludes that the overflow is not a vulnerability. It crosses no security boundary and was not disclosed.

benchmarks

Four tags per number

Record the build, metric version, population, and compiler version. One compiler change already reversed a result.

deleted patch

11% fewer gotos, worse graph

A goto-sinking pass removed 11% of emitted gotos. It also moved one fixture's graph-edit distance from 10 to 35, so the patch was deleted.

withdrawn

the measured effect was zero

An A/B test found no effect on the path the metric scores. The design document now carries a signed, dated withdrawal.