analysis pass

Concept

In Mishegos, an analysis pass is a named, declarative pipeline that composes a set of language-agnostic filters to detect and classify discrepancies between x86_64 instruction decoders. Passes are defined in `passes.yml`, order their internal filters by dependency graph or by filter cost, and consume/produce streaming cohorts on stdin/stdout.

First seen 6/9/2026

Last seen 6/9/2026

Evidence 1 chunks

Wiki v1

WIKI

Definition

An analysis pass is the unit of analysis in the Mishegos differential-fuzzing tool. A pass groups together a set of language-agnostic filters that operate on decoder cohort data so that, when chained, they surface a particular class of disagreement between the decoders under test (e.g., libbfd, capstone, zydis, xed). Passes are modeled conceptually after LLVM passes: they are configurable, ordered compositions of small, composable transformations over a common input/output stream.

Structure

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

4 connections

Mishegos ← uses 90% 1e

Mishegos's analysis tool organizes filters into passes to process output cohorts.

passes.yml ← implements 90% 1e

passes.yml defines the analysis passes used by Mishegos to filter and process output cohorts.

analysis filter ← part of 95% 1e

Analysis passes are composed of multiple analysis filters applied in sequence.

cohort output uses → 90% 1e

Analysis passes process cohort outputs from the fuzzer to identify discrepancies.

LINKED ENTITIES

4 links

Mishegos USES Extracted graph relationship

passes.yml IMPLEMENTS Extracted graph relationship

analysis filter PART_OF Extracted graph relationship

cohort output USES Extracted graph relationship

CITATIONS

6 sources

6 citations — click to expand

[1] An analysis pass is a collection of language-agnostic filters into 'passes' (think LLVM), defined in ./src/analysis/passes.yml. Destroying x86_64 instruction decoders with differential fuzzing (Trail of Bits)

[2] Passes order their internal filters either via a dependency graph or based on perceived performance requirements (largest filters first). Destroying x86_64 instruction decoders with differential fuzzing (Trail of Bits)

[3] The `same-size-different-decodings` pass is an example composed of filter-any-failure, filter-ndecoded-different, filter-same-effects, minimize-input, and normalize. Destroying x86_64 instruction decoders with differential fuzzing (Trail of Bits)

[4] Individual filters are scripts that read cohorts on STDIN and conditionally emit them on STDOUT, as illustrated by the `filter-ndecoded-different` Ruby script. Destroying x86_64 instruction decoders with differential fuzzing (Trail of Bits)

[5] Mutating filters such as `minimize-input` chop the instruction candidate to the longest `ndecoded` field, and `normalize` removes extra whitespace to prepare cohorts for further analysis. Destroying x86_64 instruction decoders with differential fuzzing (Trail of Bits)

[6] Passes are run as a whole via the analysis command-line and their output is visualized with `mishmat`, optionally with a row cap such as `mishmat -l 10000`. Destroying x86_64 instruction decoders with differential fuzzing (Trail of Bits)