/** * Vigil CVE Discovery Engine — Zero-Day from First Principles * * Discovers NEW vulnerabilities WITHOUT relying on known CVE databases. * Four independent engines: * 1. Grammar-aware Coverage Fuzzer (protocol + file format mutation) * 2. Static Pattern Analyzer (buffer overflow, use-after-free, etc.) * 3. Differential Binary Analyzer (patch diff → vulnerability discovery) * 4. DeepSeek Novelty Engine (AI-driven novel vulnerability class discovery) * * Core principle: Every discovery is a fresh finding with unique ID, * reproducible proof, CVSS scoring, and chainability assessment. * No CVE database lookups. No known-variant research. * * CVE discovery and analysis for authorized targets. */ export interface FuzzInput { id: string; protocol: string; field: string; bytes: number[]; grammarPath: string; parentId?: string; generation: number; energy: number; coverage: Set; } export interface FuzzMutation { operator: 'bit_flip' | 'byte_flip' | 'arithmetic_inc' | 'arithmetic_dec' | 'interesting_value' | 'havoc' | 'splice' | 'grammar_swap' | 'length_overflow' | 'null_byte_injection' | 'format_string' | 'integer_boundary' | 'dictionary_insert'; position: number; original: number; mutated: number; } export interface FuzzResult { inputId: string; mutatedBytes: number[]; mutation: FuzzMutation; crash: boolean; crashSignal?: string; crashAddress?: string; stackTrace?: string[]; uniqueCrash: boolean; asanReport?: string; valgrindErrors?: string[]; coverageDelta: Set; newCoverage: number; } export interface StaticFinding { id: string; ruleId: string; severity: 'critical' | 'high' | 'medium' | 'low' | 'info'; category: string; file: string; line: number; column: number; pattern: string; evidence: string; cwe?: string; confidence: number; } export interface DiffHunk { oldStart: number; oldCount: number; newStart: number; newCount: number; lines: { type: 'add' | 'remove' | 'context'; content: string; }[]; } export interface DiffVulnerability { id: string; hunk: DiffHunk; severity: 'critical' | 'high' | 'medium' | 'low'; reason: string; patchedFunction?: string; prePatchExploitable: boolean; postPatchMitigated: boolean; confidence: number; } export interface NoveltyCandidate { id: string; category: string; pattern: string; language: string; aiGenerated: boolean; aiPromptId: string; severity: 'critical' | 'high' | 'medium' | 'low'; cweMapping?: string; exploitability: number; novelty: number; confidence: number; deepseekValidated: boolean; } export interface DiscoveryReport { fuzzerFindings: FuzzResult[]; staticFindings: StaticFinding[]; diffFindings: DiffVulnerability[]; noveltyFindings: NoveltyCandidate[]; totalUniqueCrashes: number; totalVulnerabilities: number; chainsProduced: number; timestamp: Date; } export declare function crc32(data: Uint8Array): number; export interface GrammarNode { name: string; type: 'fixed' | 'variable_length' | 'choice' | 'sequence' | 'integer' | 'float' | 'string' | 'bytes' | 'checksum' | 'padding'; length?: number; min?: number; max?: number; options?: GrammarNode[]; children?: GrammarNode[]; defaultValue?: number[]; endian?: 'big' | 'little'; signed?: boolean; } export declare const PROTO_GRAMMARS: Record; export declare function getGrammar(protocol: string): GrammarNode; export declare const INTERESTING_VALUES: { name: string; bytes: number[]; }[]; export interface StaticRule { id: string; cwe: string; category: string; severity: 'critical' | 'high' | 'medium' | 'low' | 'info'; patterns: RegExp[]; description: string; } export declare const STATIC_RULES: StaticRule[]; export interface FuzzerConfig { protocol: string; maxInputs: number; maxLength: number; mutationCycles: number; seedInputs?: number[][]; favorCrashes: boolean; energySchedule: 'explore' | 'exploit' | 'balanced'; deterministicFirst: boolean; } export declare class GrammarFuzzer { private config; private grammar; private corpus; private crashQueue; private coverageMap; private uniqueCrashSignatures; private generation; private interestingValues; private mutations; private reportedFindings; constructor(config?: Partial); generateSeed(length: number): Uint8Array; serializeGrammar(node?: GrammarNode): Uint8Array; private _serializeNode; private _randomString; deterministicMutations(input: Uint8Array): Uint8Array[]; havocMutation(input: Uint8Array, intensity?: number): Uint8Array; traceCoverage(input: Uint8Array): Set; simulateCrash(input: Uint8Array, mutation?: FuzzMutation): FuzzResult | null; run(): DiscoveryReport; private buildReport; } export interface StaticAnalyzerConfig { targetFiles: { path: string; content: string; }[]; rules?: StaticRule[]; } export declare class StaticAnalyzer { private config; private rules; constructor(config: StaticAnalyzerConfig); analyze(): StaticFinding[]; static analyzeContent(content: string, filePath?: string): StaticFinding[]; } export interface DiffConfig { original: string; patched: string; filePath: string; } export declare class DifferentialAnalyzer { private config; constructor(config: DiffConfig); computeDiff(): DiffHunk[]; findVulnerabilities(): DiffVulnerability[]; } export interface NoveltyDiscoveryConfig { targetLanguage: string; targetSystem: string; maxCandidates: number; previousCategories?: string[]; deepseekApiKey?: string; } export declare class NoveltyDiscoveryEngine { private config; private candidates; constructor(config: NoveltyDiscoveryConfig); generateCandidates(): NoveltyCandidate[]; validateWithDeepSeek(candidates: NoveltyCandidate[]): Promise; getNoveltyReport(): { candidates: NoveltyCandidate[]; summary: Record; }; } export interface DiscoveryPipelineConfig { fuzzerConfig?: Partial; staticConfig?: StaticAnalyzerConfig; diffConfig?: DiffConfig; noveltyConfig?: NoveltyDiscoveryConfig; } export declare class DiscoveryPipeline { private config; constructor(config: DiscoveryPipelineConfig); run(): Promise; } export declare function fuzzProtocol(protocol: string, cycles?: number, maxInputs?: number): GrammarFuzzer; export declare function analyzeSource(source: string, filePath?: string): StaticFinding[]; export declare function diffForVulns(original: string, patched: string, filePath?: string): DiffVulnerability[]; //# sourceMappingURL=cveDiscovery.d.ts.map