SCJ / finding the validation outside the function
Research settingIBM
Shadow Clone Jutsu studies structural relationships in code to prioritize human investigation. Three merged F Prime contributions make the results inspectable: two local size checks and a reusable CodeQL query. The security research setting is IBM; F Prime is the upstream software examined.
From the research record
Inspect the work
Original figures, recorded values, and explicit model details. Each exhibit identifies its source and what the comparison means.
How architectural triage changed the candidate queue
Scroll horizontally to inspect the full table →
| Compound rule | v0.7 | v0.8 | v0.9 | v0.9b | v0.9c |
|---|---|---|---|---|---|
| module_load_with_cmd_filename | 0 | 1 | 0 | 0 | 0 |
| psp_write_from_sb | 0 | 7 | 0 | 0 | 0 |
| sb_memcpy_unbounded | 0 | 12 | 1 | 0 | 0 |
| sb_tbl_load_dispatch | 0 | 3 | 3 | 1 | 1 |
| tbl_load_no_validate | 0 | 3 | 3 | 1 | 1 |
| tbl_address_deref_no_check | 0 | 8 | 8 | 6 | 6 |
| cds_restore_unvalidated | 0 | 2 | 2 | 2 | 2 |
| fs_header_no_magic_check | 0 | 1 | 1 | 1 | 1 |
| Total | 0 | 29 | 18 | 11 | 11 |
| High-severity slice (weight ≥ 5) | 0 | 20 | 1 | 0 | 0 |
Five cFS bundles, approximately 650 functions. These counts are rule hits, not confirmed vulnerabilities. The manuscript explains the surviving v0.9c patterns as correct by design or guarded by another function. Zero high-severity hits does not prove the software is vulnerability-free.
Read the technical figure
Source: SCJ manuscript, inter-procedural reachability and cFS triage sections. The service relationships and hit counts are reported source material; candidates are not confirmed defects.
Source: SCJ manuscript, inter-procedural reachability and cFS triage sections. The service relationships and hit counts are reported source material; candidates are not confirmed defects.
Supporting detail
Accepted contributions to F Prime
FileUplink #5262, merged 9 June 2026, adds a local destination-path length check before copying. The existing U8 length already constrained valid inputs; this is defense in depth, not a demonstrated overflow under the existing type contract.
DpCompressProc #5518, merged 4 August 2026, rejects undersized packet buffers before container construction, emits a dedicated event, and adds an off-nominal regression test. A reviewer reproduced the failure without the guard and reported ten passing component tests on an intermediate revision; the final event refinement was subsequently approved and merged.
CodeQL #5544, merged 5 August 2026, generalizes the investigation into a query for unchecked unsigned size subtraction. Its guard matching distinguishes the object being checked from other buffers in the same function. Following maintainer review, assertions count as valid checks. The rule is a scoped heuristic, not a proof of path safety.
What the search actually represents
Davis identifies the 2025 NASA Gemini Drift paper as the precursor to SCJ. Gemini Drift searches for related code after a patch; the later SCJ work develops this into a broader source-code investigation workflow. The NASA origin and the later IBM research setting are distinct.
The SCJ manuscript describes a function-level corpus in GIGI. Functions are ranked using sink reach, interprocedural reachability, and combinations of guard primitives. The engineering work extends binary ingestion from Ghidra exports to C and C++ source ingestion using tree-sitter, and adds compositional AND–AND–NOT patterns and a forward breadth-first reachability pass.
Per-target profiles matter because the same apparent pattern can be safe in one architecture and unsafe in another. A missing local check can be supplied by a caller; a dangerous sink can be unreachable from the relevant input. The ranking narrows an investigation—it does not settle it.
Eliminating false positives is part of the contribution
The paper describes a cFS investigation in which apparently severe findings were reduced through architectural explanation and triage. That is a useful outcome on a mature codebase: the detector becomes more informative when it learns which guards and calling conventions it initially missed.
Other reported investigations led to manually examined findings and upstream pull requests. A filed fix, a maintainer-confirmed defect, and a published advisory are different stages. This account does not describe every submitted candidate as a confirmed vulnerability or claim that structural similarity finds every instance of a bug.
Keep network anomaly detection separate
The older catalog also lists behavioral network anomaly detection. That work has a different unit of observation and needs time-stamped traffic labels and false-alert accounting. The SCJ code-review record cannot supply its precision or false-positive rate.
Sources, scope, and next question
June investigation report and three verified upstream merges: F Prime #5262, #5518 and #5544. Public merge records checked 15 October 2026.
The next useful report should retain the full funnel: all ranked candidates, exclusions with reasons, analyst time, reproducible triggers where appropriate, and maintainer dispositions. That would measure how much useful investigation the representation enables.
- SCJ research companion.
- F Prime contribution atlas.
- Merged FileUplink contribution #5262.
- Merged DpCompressProc contribution #5518.
- Merged CodeQL contribution #5544.
- Gemini Drift: the NASA precursor to SCJ.
- SRCV: build/runtime concordance.
- SCJ project report (PDF).
Additional source versions reviewed
-
shadow_clone_jutsu/papers/paper.texLocal project manuscript or report · not republished here -
shadow_clone_jutsu/papers/README.mdLocal project manuscript or report · not republished here