I’ll explain how PolyTracker can detect files affected by the vulnerability even without specific file format knowledge, which parts of a file can become subject to recovery using acropalypse.app, and how Google and Microsoft could have caught this bug by using our tools. # parse the screenshot with an instrumented version of pngtest $ ./pngtest.instrumented re3eot.png.png out_re3eot.png.png # ask polytracker to identify any blindspots in the file $ polytracker cavities polytracker.tdag Re3eot.png,697120,1044358 # found a blind spot starting at offset 697120 (size ~300KiB), it is ignored and contains the cropped out image data that could be retrieved Having almost no knowledge of the PNG file format, we were able to use PolyTracker instrumentation on an existing PNG processing application…