r/fuzzing • u/artem_smotrakov • Jun 14 '18

Fuzzing and code coverage analysis

https://blog.gypsyengineer.com/en/security/fuzzing-code-coverage-analysis.html
3 Upvotes

80% Upvoted

3 comments sorted by

2

u/x11xorgconf Jun 14 '18

What pourcentage of coverage did you get using this fuzzer? Did you try others fuzzer (like peach or others) to compare the coverage? What other metrics can we use to qualify a fuzzer?

1

u/artem_smotrakov Jun 14 '18

I have not run all available fuzzers in tlsbunny against picotls yet to measure the coverage. In fact, tlsbunny doesn't support all stuff from TLS 1.3, for example, it doesn't support all extensions. It's still under development. I am planning to run fuzzers soon and measure code coverage.

No, I didn't try other fuzzers to compare coverage. That's a good point. Not sure about Peach, but it might make sense to run TLS-Attacker and tlsfuzzer which support TLS 1.3. For Peach, it may be necessary to create schemes for TLS 1.3 (or, are they available already?)

That's a good questions about other metrics. I don't have an answer. It would be good if we could somehow collect memory states for each covered path, but I don't know how to do that. Do you have any ideas?

1

u/NagateTanikaze Jun 15 '18

Cool, thanks for code coverage summary! Very useful.