EXAMPLES

Twelve demos, zero setup.

Everything below lives in examples/ in the repo, self-contained, with its own runner. Build retrace once; the examples assume build/src/v2/libretrace.so (or the .dylib — the runners find either).

id-redirection

Bypass a root check by rewriting getuid()/geteuid() return values — the classic interposition demo.

$ cd examples/id-redirection && gcc root-check.c -o root-check && ./test-id-redirection.sh

getenv-fuzzing

Feed garbage, overflow-length, and format-string values into getenv consumers — buffer-overflow hunting without writing a fuzzer.

$ cd examples/getenv-fuzzing && ./run.sh

net-fuzzing

Mutate connect() targets and garbage into recv() — protocol confusion and SSRF-path discovery.

$ cd examples/net-fuzzing && ./run.sh

dns-fuzz

Serve malformed DNS answers through the resolver path — parser robustness from the outside.

$ cd examples/dns-fuzz && ./run.sh

http-server-overflow

Long-request injection against a small http server — find the crash before the internet does.

$ cd examples/http-server-overflow && make && ./run.sh

unsafe-system

Watch every system()/popen() invocation with full argument capture — command-injection surface mapping.

$ cd examples/unsafe-system && ./run.sh

stringinject

Rewrite string arguments mid-flight (paths, hosts, options) — behavioral A/B without recompiling.

$ cd examples/stringinject && ./run.sh

escape-hunting

Does the app stay in its sandbox? Trace every path touch and diff against the declared world.

$ cd examples/escape-hunting && ./run-posix.sh

trace-profile-quickstart

The 10-minute tour: capture → profile → jail → harden, with kernel-truth grading on five platforms.

$ cd examples/trace-profile-quickstart && ./run-posix.sh   # also: run-macos.sh, run-windows.ps1, run-openbsd.sh

packaging-audit

Audit Snap/Flatpak declared-file sets against observed access — the compliance workflow as one script.

$ cd examples/packaging-audit && ./audit.sh app.snap

fuzz-workbench

Corpus → clustered crash report → per-cluster reproducers → minimized corpus, with the drift oracle.

$ cd examples/fuzz-workbench && ./run-posix.sh

fuzz-target

A libFuzzer template wired to retrace seeds — continuous fuzzing with deterministic reproduction.

$ cd examples/fuzz-target && make && ./fuzz corpus/