# testing handbook

Published articles for testing handbook.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Rust-proof your code with our new Testing Handbook chapter

DevFeed: [Rust-proof your code with our new Testing Handbook chapter](<https://devfeed.tech/articles/rust-proof-your-code-with-our-new-testing-handbook-chapter-7658.md>)

Original publisher: [Read original article](<https://blog.trailofbits.com/2026/07/13/rust-proof-your-code-with-our-new-testing-handbook-chapter/>)

Author: "Paweł Płatek"

Published: 2026-07-13T11:00:00Z

Content type: tutorial

Language: en

Sources: [The Trail of Bits Blog](<https://devfeed.tech/sources/the-trail-of-bits-blog.md>), [The Trail of Bits Blog](<https://devfeed.tech/sources/the-trail-of-bits-blog-2.md>)

Topics: [Rust](<https://devfeed.tech/topics/rust.md>), [Security](<https://devfeed.tech/topics/security.md>), [mutation-testing](<https://devfeed.tech/topics/mutation-testing.md>), [Tooling](<https://devfeed.tech/topics/tooling.md>), [Test coverage](<https://devfeed.tech/topics/coverage.md>), [Memory Safety](<https://devfeed.tech/topics/memory-safety.md>), [Rust formal verification](<https://devfeed.tech/topics/rust-formal-verification.md>), [Concurrency](<https://devfeed.tech/topics/concurrency.md>), [Claude Code](<https://devfeed.tech/topics/claude-code.md>), [Claude](<https://devfeed.tech/topics/claude.md>)

Tags: [application-security](<https://devfeed.tech/tags/application-security.md>), [claude-code](<https://devfeed.tech/tags/claude-code.md>), [concurrency](<https://devfeed.tech/tags/concurrency.md>), [measurement](<https://devfeed.tech/tags/measurement.md>), [memory-safety](<https://devfeed.tech/tags/memory-safety.md>), [mutation-testing](<https://devfeed.tech/tags/mutation-testing.md>), [rust](<https://devfeed.tech/tags/rust.md>), [security](<https://devfeed.tech/tags/security.md>), [testing](<https://devfeed.tech/tags/testing.md>), [testing-handbook](<https://devfeed.tech/tags/testing-handbook.md>), [tooling](<https://devfeed.tech/tags/tooling.md>)

### AI overview

A new Testing Handbook chapter presents techniques for security testing Rust programs and systems. It covers Rust security limitations, dynamic and static analysis, undefined-behavior detection with Miri, property testing, coverage and mutation testing, Clippy, manual code review, memory zeroization, model checking with Kani, and dependency supply-chain vetting. The article also announces rust-review, a Claude Code plugin for automated Rust security reviews.

### Source excerpt

We've added a new chapter to our Testing Handbook: a comprehensive guide to security testing Rust programs. This chapter covers the tools and techniques we use at Trail of Bits to validate the security of Rust programs and systems. fn main() {(|f:&dyn Fn(u128)->Box< dyn Iterator<Item= char>+'static>|f(*[&( 0x7B736D70683F73u128<<64| 0x7A6A6D7C3F7A667D),&(0x7B736Du128 <<64|0x70683F7073737A77)][((std::hint:: black_box(0.0f64)/0.0).to_bits()>>63)as usize]) .for_each(|c|print!("{c}")))(Box::leak(Box::new(|n: u128|Box::new(std::iter::successors(Some(n),|&n|Some(n>>8) ).take_while(|&n|n>0).map(|n|((n as u8)^0x1F)as char))as _)))} What's in the chapter The chapter starts with a security overview of what Rust's guarantees do and don't cover, including underappreciated issues like unwind safety, nondeterminism, and arithmetic errors. This leads into an overview of dynamic analysis, which covers a range of boosters for unit tests, how to use Miri to detect undefined behavior, property testing with proptest, coverage measurement, and mutation testing. The static analysis section then covers Clippy in depth, including a list of our favorite lints. Beyond tooling, the chapter also covers what we've learned from auditing Rust codebases directly. Our gotchas and footguns checklist is a great reference for manual code reviews, and will help you find subtle issues like a & b == c having different operator precedence than in C. The memory zeroization section offers three solutions to the tricky problem of guaranteeing that secrets are erased from memory. Finally, the specialized testing sections cover tools like Kani (a model checker), and the supply chain section covers the full toolchain for vetting dependencies. Still oxidizing We've also released rust-review, a Claude Code plugin for automated Rust security reviews. Co-built with Aptos Labs, it targets over a dozen bug classes, from memory safety and concurrency hazards to FFI pitfalls and async cancellation issues. It's a fast wa

## Escalating a Windows driver registry bug to a kernel write primitive

DevFeed: [Escalating a Windows driver registry bug to a kernel write primitive](<https://devfeed.tech/articles/escalating-a-windows-driver-registry-bug-to-a-kernel-write-primitive-7649.md>)

Original publisher: [Read original article](<https://blog.trailofbits.com/2026/05/05/c/c-checklist-challenges-solved/>)

Author: "Graham Sutherland"; "Paweł Płatek"

Published: 2026-05-05T11:00:00Z

Content type: article

Language: en

Sources: [The Trail of Bits Blog](<https://devfeed.tech/sources/the-trail-of-bits-blog.md>), [The Trail of Bits Blog](<https://devfeed.tech/sources/the-trail-of-bits-blog-2.md>)

Topics: [C++](<https://devfeed.tech/topics/c-plus-plus.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Code](<https://devfeed.tech/topics/code.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [blog](<https://devfeed.tech/tags/blog.md>), [bug](<https://devfeed.tech/tags/bug.md>), [c-c-plus-plus](<https://devfeed.tech/tags/c-c-plus-plus.md>), [c-plus-plus](<https://devfeed.tech/tags/c-plus-plus.md>), [large-language-models](<https://devfeed.tech/tags/large-language-models.md>), [linux](<https://devfeed.tech/tags/linux.md>), [security](<https://devfeed.tech/tags/security.md>), [testing-handbook](<https://devfeed.tech/tags/testing-handbook.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

This Trail of Bits article walks through two C/C++ security challenges: a Linux ping program with command injection and an inet_ntoa global-buffer pointer bug, and a Windows driver registry type-confusion issue that can escalate from local denial of service to a kernel write primitive. It also introduces the c-review Claude skill, which turns the security checklist into platform- and threat-model-aware LLM prompts for finding bugs in codebases.

### Source excerpt

We recently added a C/C++ security checklist to the Testing Handbook and challenged readers to spot the bugs in two code samples: a deceptively simple Linux ping program and a Windows driver registry handler. If you found the inet_ntoa global buffer gotcha or the missing RTL_QUERY_REGISTRY_TYPECHECK flag, nice work. If not, here's a full walkthrough of both challenges, plus a deep dive into how the Windows registry type confusion escalates from a local denial of service to a kernel write primitive. Since we first released the new C/C++ security checklist, we also developed a new Claude skill, c-review. It turns the checklist into bug-finding prompts that an LLM can run against a codebase. It's also platform and threat-model aware. Run these commands to install the skill: claude skills add-marketplace https://github.com/trailofbits/skills claude skills enable c-review --marketplace trailofbits/skills The Linux ping program challenge The Linux warmup challenge we showed you in the last blog post has an obvious command injection issue. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <arpa/inet.h> #define ALLOWED_IP "127.3.3.1" int main() { char ip_addr[128]; struct in_addr to_ping_host, trusted_host; // get address if (!fgets(ip_addr, sizeof(ip_addr), stdin)) return 1; ip_addr[strcspn(ip_addr, "\n")] = 0; // verify address if (!inet_aton(ip_addr, &to_ping_host)) return 1; char *ip_addr_resolved = inet_ntoa(to_ping_host); // prevent SSRF if ((ntohl(to_ping_host.s_addr) >> 24) == 127) return 1; // only allowed if (!inet_aton(ALLOWED_IP, &trusted_host)) return 1; char *trusted_resolved = inet_ntoa(trusted_host); if (strcmp(ip_addr_resolved, trusted_resolved) != 0) return 1; // ping char cmd[256]; snprintf(cmd, sizeof(cmd), "ping '%s'", ip_addr); system(cmd); return 0; } There are three validations that have to be bypassed before the system call can be reached with malicious inputs: The inet_aton function "converts the Internet host address from the IPv