Baby-Naptime Cheat Sheet
** Verwundbarkeiten beim Schlafen finden!* - Eine Open-Source-Implementierung von Google's Project Naptime zur automatisierten Verwundbarkeitsentdeckung mit Large Language Models.
Schneller Start
Installation
```bash
Clone the repository
git clone https://github.com/faizann24/baby-naptime.git cd baby-naptime
Install dependencies
pip install -r requirements.txt
Install system dependencies (Ubuntu/Debian)
sudo apt-get install gdb g++ colorama
Set up OpenAI API key
export OPENAI_API_KEY='your-openai-key-here' ```_
Basisnutzung
```bash
Analyze a C/C++ file
python run.py -c code/vulnerable.cpp
Use specific LLM model
python run.py -c code/test.cpp -l gpt-4o
Advanced analysis with custom settings
python run.py -c code/test.cpp -l o3-mini -k 15 -m 50 ```_
Kommandozeilenoptionen
Erforderliche Parameter
```bash
Specify source code file to analyze
python run.py -c
Optionale Parameter
```bash
Set code directory for additional source files
python run.py -c main.cpp -d /path/to/source/
Set maximum analysis iterations
python run.py -c main.cpp -m 100
Choose LLM model
python run.py -c main.cpp -l gpt-4o python run.py -c main.cpp -l gpt-4o-mini python run.py -c main.cpp -l o3-mini python run.py -c main.cpp -l o1-preview
Set entry function for analysis
python run.py -c main.cpp -f main
Control conversation history
python run.py -c main.cpp -k 14 ```_
LLM Modelloptionen
Verfügbare Modelle
```bash
GPT-3.5 Turbo (fastest, basic analysis)
python run.py -c code.cpp -l gpt-3.5-turbo
GPT-4o (balanced performance and accuracy)
python run.py -c code.cpp -l gpt-4o
GPT-4o Mini (cost-effective option)
python run.py -c code.cpp -l gpt-4o-mini
O3 Mini (optimized for code analysis)
python run.py -c code.cpp -l o3-mini
O1 Preview (advanced reasoning)
python run.py -c code.cpp -l o1-preview ```_
Analyse-Workflow
Schritt für Schritt Prozess
```bash
1. Prepare your vulnerable code
echo '#include
2. Run baby-naptime analysis
python run.py -c vulnerable.c -l gpt-4o
3. Check results
ls results/ cat results/vulnerable_summary.md ```_
Erweiterte Analyse
```bash
Analyze complex project with multiple files
python run.py -c main.cpp -d ./src/ -m 200 -k 20
Focus on specific function
python run.py -c auth.cpp -f authenticate_user -l o3-mini
Extended analysis with detailed history
python run.py -c network.cpp -k 30 -m 150 ```_
Umwelt Setup
API Schlüsselkonfiguration
```bash
Set OpenAI API key (required)
export OPENAI_API_KEY='sk-your-api-key-here'
Verify API key is set
echo $OPENAI_API_KEY
Alternative: Create .env file
echo "OPENAI_API_KEY=sk-your-api-key-here" > .env ```_
Systemabhängigkeiten
```bash
Ubuntu/Debian
sudo apt-get update sudo apt-get install gdb g++ python3-pip
CentOS/RHEL
sudo yum install gdb gcc-c++ python3-pip
macOS (with Homebrew)
brew install gdb xcode-select --install ```_
Debugging und Analyse
GDB Integration
```bash
Baby-naptime automatically uses GDB for:
- Memory layout analysis
- Crash reproduction
- Exploit validation
- Stack trace generation
Manual GDB debugging (if needed)
gdb ./compiled_binary (gdb) run (gdb) bt (gdb) info registers ```_
Binary Compilation
```bash
Baby-naptime compiles with security mitigations disabled:
-fno-stack-protector (disable stack canaries)
-z execstack (enable executable stack)
-no-pie (disable position independent executable)
Manual compilation for testing
gcc -fno-stack-protector -z execstack -no-pie vulnerable.c -o vulnerable ```_
Ausgabe und Reporting
Ergebnisse
```bash
Check generated reports
ls results/ cat results/[filename]_summary.md
View detailed analysis
less results/[filename]_summary.md
Copy results to another location
cp results/*.md /path/to/reports/ ```_
Bericht Struktur
```bash
Each report contains:
- Executive summary
- Technical analysis
- Exploitation methodology
- Working payload
- Proof of concept
```_
Allgemeine Anwendungsfälle
Pufferüberlaufanalyse
```bash
Analyze buffer overflow vulnerabilities
python run.py -c buffer_overflow.c -l gpt-4o
Focus on memory corruption
python run.py -c heap_overflow.cpp -l o3-mini -k 20 ```_
Format String Schwachstellen
```bash
Analyze format string bugs
python run.py -c format_string.c -l gpt-4o-mini
Extended analysis for complex cases
python run.py -c printf_vuln.c -m 100 -k 25 ```_
Verwendung nach freier Erkennung
```bash
Analyze memory management issues
python run.py -c use_after_free.cpp -l o1-preview
Focus on heap analysis
python run.py -c heap_vuln.c -l gpt-4o -k 30 ```_
Fehlerbehebung
Gemeinsame Themen
```bash
API key not set
export OPENAI_API_KEY='your-key-here'
Missing dependencies
pip install -r requirements.txt sudo apt-get install gdb g++
Permission issues
chmod +x run.py sudo chown $USER:$USER -R baby-naptime/
Python version issues
python3 --version # Should be 3.7+ pip3 install -r requirements.txt ```_
Debug Mode
```bash
Enable verbose output
python run.py -c code.cpp -l gpt-4o --verbose
Check system compatibility
python -c "import sys; print(sys.version)" gdb --version gcc --version ```_
Leistungsoptimierung
Effiziente Analyse
```bash
Use faster models for initial screening
python run.py -c code.cpp -l gpt-3.5-turbo
Optimize context history for speed
python run.py -c code.cpp -k 10 -m 50
Use targeted analysis
python run.py -c code.cpp -f vulnerable_function ```_
Ressourcenmanagement
```bash
Limit iterations for large codebases
python run.py -c large_project.cpp -m 75
Manage memory usage
python run.py -c code.cpp -k 8
Batch processing multiple files
for file in *.cpp; do python run.py -c "$file" -l gpt-4o-mini done ```_
Integrationsbeispiele
CI/CD Pipeline
```bash
Add to GitHub Actions
name: Security Analysis run:| export OPENAI_API_KEY=$\\{\\{ secrets.OPENAI_API_KEY \\}\\} python run.py -c src/main.cpp -l gpt-4o-mini
Jenkins integration
sh 'python run.py -c $\\{WORKSPACE\\}/src/main.cpp' ```_
Automatisches Scannen
```bash
Scan all C/C++ files in project
find . -name ".cpp" -o -name ".c"|while read file; do echo "Analyzing $file" python run.py -c "$file" -l gpt-4o-mini done
Generate combined report
cat results/*summary.md > combined_security_report.md ```
Best Practices
Effektive Nutzung
```bash
Start with faster models for initial assessment
python run.py -c code.cpp -l gpt-3.5-turbo
Use advanced models for detailed analysis
python run.py -c critical_code.cpp -l o1-preview -k 25
Maintain reasonable iteration limits
python run.py -c code.cpp -m 100 # Good balance
Focus analysis on specific functions
python run.py -c auth.cpp -f login_handler ```_
Sicherheitsüberlegungen
```bash
Always test in isolated environment
Never run on production systems
Obtain proper authorization before testing
Review generated exploits carefully
Use for educational/research purposes only
```_
--
** Projektarchiv: (https://github.com/faizann24/baby-naptime](https://github.com/faizann24/baby-naptime) License: GPL-3.0 Sprache: Python (94,7%), C++ (4,6%), C (0.7%) Stars: 151+|Forks:** 19+