Prologue
Where MUGEN came from
The idea, the 4 reasons behind it, and a plan much bigger than what survived. Background, before any code.
April 2026
The engine with no blueprint
What it even means to find a flaw in a program you can't read: sources, sinks, taint, and where the decompiler quits.
Confidently wrong
The first thing I was sure of, measured, and had to throw out the same day. On distrusting a benchmark that agrees with you.
The work you don't do
Parallelism failed, so the real speedup came from not analyzing the binaries that don't matter, then running the rest in isolated processes. 20 hours to one.
Teaching it to follow data
Interprocedural taint, vtable resolution from 0 to over 900, and the 5 places a stock taint tracker goes blind.
Three layers that check each other
Ghidra, a constraint solver, and me. Why each layer exists mainly to keep the next one honest.
New kinds of wrong
Time-of-check races, taint that finally crosses whole call graphs, the first look at kernel drivers, and the tool learning to talk to an AI reviewer.
Poking back
Confirming findings by running them, a UI deleted and rebuilt twice, and the pivot from watching a target to poking it.
afd.sys, zero to twelve
The first real target, a Windows kernel driver, and what "surfaced" honestly does and doesn't mean.
May 2026
The month I kept inventing bugs
Plausible, well-formed vulnerabilities that did not exist, and the machinery built to disbelieve me.
June 2026
A new name
Tsukuyomi becomes Mugen, and why both names describe the same thing: a tool that dreams up exploits.
The night the numbers came back
A blind test on real binaries with the answers hidden. Where "found the function" and "found the bug" came apart.
July 2026
The finding that wasn't
A beautiful, confident finding that was refuted in one move, and the reviewer we built to kill the rest.
CVE-2026-3008: the right bug, the wrong name
MUGEN nailed CVE-2026-3008 in a stripped Notepad++, at the exact published address. I labeled it CVE-2026-5525, the bug we were hunting. The engine was right; the wrong CVE was mine.
August 2026
A live bug in dead code
MUGEN found the vulnerable network parser in VLC (CVE-2025-51602), correctly, then buried it as unreachable dead code. The blind spot where a tool disbelieves its own answer.