MindshaRE: Using Binary Ninja API to Detect Potential Use-After-Free Vulnerabilities

This document describes an inter-procedural static analysis approach to detect use-after-free and double-free conditions by analyzing reachability between “Free” and “Use” basic blocks within the last common function on the call stack, while mitigating loop-induced false positives by removing incoming edges to allocator blocks. It also presents a method to automatically discover allocator and deallocator wrappers (e.g., around malloc/free) using Binary Ninja’s dataflow (EntryValue) and def–use chains, enabling enrichment of a JSON-driven configuration and demonstrating results on OpenSLP.