Technical Summary: Agent-Based Vulnerability Analysis in Windows COM Binaries

Problem Statement

Windows Component Object Model (COM) services represent a critical attack surface for local privilege escalation (LPE). Hundreds of privileged COM classes run within Windows service processes and are frequently accessible to authenticated users via Remote Procedure Call (RPC). Race conditions in these binaries arise when concurrent RPC threads access shared object state without synchronization, leading to Use-after-Free (UAF) and Double-Free (DF) vulnerabilities that enable arbitrary code execution at the service's privilege level.

Detecting these vulnerabilities in closed-source binaries is exceptionally difficult. Analysis requires tracking thread interleavings, object lifetimes, and locking protocols across functions, where optimizing compilers have removed type and symbol information. Existing approaches face fundamental limitations:

• Coverage-guided fuzzers lack control over thread scheduling to trigger specific race interleavings.
• Static analyzers (e.g., COMRace) rely on exhaustive pair enumeration, suffer from high false-positive rates due to incorrect aliasing and unmodeled input conditions, and frequently miss vulnerabilities due to structural assumptions about register usage and vtable layouts.
• Manual reverse engineering does not scale to production COM services due to the volume of entry points and the complexity of tracking accesses to shared state.

While Large Language Models (LLMs) demonstrate strong semantic reasoning over decompiled code, they lack the structured pipeline and specific tools required to progress from vulnerability detection to the verified generation of a Proof-of-Concept (PoC) in a live environment.

Methodology: The Slyp Pipeline

The authors present Slyp, an end-to-end agent pipeline designed to discover race condition vulnerabilities in Windows COM binaries and generate debugger-verified PoC code. Slyp utilizes a standard ReAct loop (Reason-Act-Observe) extended with engineering features for long-horizon binary analysis, operating in two interconnected, distinct stages linked by a structured vulnerability report.

1. Architecture and Agent Design

Slyp employs a model-agnostic agent architecture that can be integrated with any MCP-compatible agent. Key engineering features include:

• Context Management: To manage the massive token counts resulting from decompiling dozens of entry points, Slyp uses a pre-compaction checkpointing method. This preserves cross-function results and analytical state in external files before the active context window is compressed, allowing the agent to resume analysis without losing critical context.
• Memory System: A file-based memory system, organized as a compact index and topic files, enables the agent to store persistent insights (function summaries, vulnerability patterns) and retrieve them via BM25 search, eliminating the need to re-read full interaction histories.
• Task Verification: A middleware verifier inspects the agent's trajectory to prevent premature termination. It ensures the agent has performed meaningful tool usage and generated actionable artifacts before ending the session, anchoring control decisions in execution status rather than the model's self-assessment.

2. Tool Interfaces (MCP)

Slyp provides three categories of reusable Model Context Protocol (MCP) tool interfaces that supply the agent with necessary static context, metadata, and dynamic feedback:

• Binary Exploration (Stage 1): Based on IDA Pro, these tools offer decompilation with integrated virtual dispatch resolution (crucial for resolving vtable pointers in COM), disassembly, cross-references, and navigation through call graphs. This enables the agent to track data flows of shared state and identify candidates for race conditions.
• COM Inspection (Stage 2): Based on OleViewDotNet, these tools provide on-demand access to live COM metadata, including registration data, interface declarations, security descriptors (start/access permissions), and method signatures (IDL/C++). This enables the agent to understand activation requirements and generate skeleton code.
• Dynamic Debugging (Stage 2): Based on WinDbg and MSVC, these tools support an iterative loop of compiling, executing, and debugging. The agent compiles C++ PoC code, executes it against a live COM service in an isolated QEMU VM, and captures crash dumps, call stacks, and register states. This loop refines the PoC until a debugger-verified crash is captured.

3. Workflow

• Stage 1 (Discovery): The agent uses binary exploration tools to navigate decompiled code, resolve virtual dispatches, track data flows, and identify race condition vulnerabilities across target entry points.
• Stage 2 (PoC Generation): Using the vulnerability report from Stage 1, the agent employs COM inspection tools to retrieve activation metadata and generate a skeleton PoC. It then enters an iterative loop with dynamic debugging tools to refine the code, adjust thread timing, and verify the vulnerability through actual crashes.

Main Contributions

1. Reusable MCP Tool Interfaces: The authors developed three categories of tools (Binary Exploration, COM Inspection, Dynamic Debugging) that can be integrated with any MCP-compatible agent, serving as primary drivers for both discovery and PoC generation.
2. End-to-End Agent Pipeline (Slyp): A system that combines a ReAct loop with specific engineering features (checkpointing, memory, verification) for long-horizon binary analysis. It outperforms production coding agents in both vulnerability detection and PoC generation.
3. Benchmark Construction: A dataset of 20 COM objects covering 40 vulnerability cases with manually verified ground-truth labels, including 8 independently discovered 1-day CVEs for circulation-free validation.
4. Real-World Impact: The discovery of 28 previously unknown zero-day vulnerabilities across 9 production Windows services, all confirmed by the Microsoft Security Response Center (MSRC).

Experimental Results

The authors evaluated Slyp against state-of-the-art production coding agents (Codex and Claude Code) across six backbone models and against a reproduction of the state-of-the-art static analyzer (COMRace++).

• Vulnerability Detection: On a benchmark of 20 COM objects (40 cases), Slyp achieved an F1-score of 0.973 (using GPT-5.4). This outperformed production agents with standard minimal tools (0.724–0.910 F1) and the state-of-the-art static analyzer COMRace++ (0.299 F1) by a factor of 3.3×. Even with minimal tooling, production agents lagged behind Slyp, with gaps of up to 0.208 F1.
• PoC Generation: Production agents without Slyp's specific COM inspection and dynamic debugging tools solved essentially 0% of cases. With the full toolset, the best Slyp configuration (Opus 4.6) achieved a verification rate of 67.5% (27/40 cases). The top four configurations collectively solved 34 out of 40 cases (85.0%).
• Real-World Deployment: Deployed on production Windows services, Slyp discovered 28 zero-day vulnerabilities. The MSRC confirmed all 28, awarded 16 CVEs, and granted $140,000 in bounties. The vulnerabilities enabled local privilege escalation from Low/Medium to System integrity.

Significance and Claims

The work claims that Slyp represents the first end-to-end agent pipeline capable of autonomously discovering zero-day race condition vulnerabilities in production binaries and generating debugger-verified PoCs without access to source code.

The authors emphasize that while LLMs possess strong semantic reasoning capabilities, they require structured scaffolding and domain-specific tools to be effective for complex binary analysis tasks. Slyp demonstrates that an agent approach combining semantic reasoning with iterative validation and dynamic debugging significantly outperforms both traditional static analysis (which struggles with false positives and structural limitations in binaries) and unguided production coding agents.

The work highlights that the combination of binary exploration, COM-specific metadata inspection, and dynamic debugging is critical to bridging the gap between vulnerability detection and actionable exploitation proofs. The pipeline is designed to be generalizable, suggesting applicability to other commercial, off-the-shelf (COTS) binaries beyond Windows COM services.