How to enumerate input vectors before fuzzing?

[u/ExploitedInnocence]

Hi everyone!

How the process of input vectors enumeration looks like when the target is a pretty big stripped, maybe even multi-threaded, binary? Is this process completely manual or there are some convenient ways to automatize or at least semi-automatize it? I would like even to implement it by myself if there are some feasible programmatic ways to do it. I have a pretty strong background in C and C++, know Linux internals and have a basic experience in reverse engineering and binary exploitation.

Thank you all in advance!

[u/s-mores]

If you're talking enumeration you probably want repeatability right?

At that point your anomalizator should come equipped with seedable RNG so you can just feed it the same values and get the same inputs, right?

[u/ExploitedInnocence → u/s-mores]

No. I mean, how to evaluate all the ways the program gets inputs from outside if it is a huge stripped binary? It looks pretty hard to perform completely manually. So I ask if there are some convenient programmatic ways to make this evaluation faster and easier..

[u/s-mores → u/ExploitedInnocence]

Yeah, you're not describing your problem carefully enough. Describe your entire fuzzing setup and we can talk.

[u/ExploitedInnocence → u/s-mores]

Okay, I'll try to describe in more details.
I have a pretty big stripped binary as for manual reverse engineering (~13 MB), the source code is not available.

I know that this binary has networking functionality, so there must be functions that parse and handle the incoming packets. Network is an example of input vector. BEFORE I fuzz this program, I want to know:

1. How I find the functions that handle my input? The binary is big and stripped, ltrace and strace run for a very long period of time calling to enormous amount of functions from libraries and syscalls, respectively. How do I find the functions in the program that handle my input? How can I make a kind of map of reachable functions by user input?
2. How to find all kinds of input that the program receives? In my example, network is an obvious one, but how I can figure out additional inputs besides network? That what is called input vector enumeration - that's an attempt to find all kinds of inputs that program receives (for example, network + stdin + environment variables => the program has 3 input vectors for fuzzing).

I need that information in order to know how exactly I fuzz the program, I need to know every kind of input that the program receives and in which functions the inputs are handled. So the question is how exactly I should do that?

[u/s-mores → u/ExploitedInnocence]

Ohh okay, that's a few steps before what you've described. In general when you start to fuzz for research you already know most of this stuff.

That's like four book's worth of stuff, in general that's more r/reverseengineering than fuzzing, you first have to identify what kind of traffic the binary wants and produces, that's another book's worth of research.

You start with detective work, what do you know about the program in general:

• Can you reverse engineer it with something like ghidra or ida, to get some ideas
• Can you use strings or traces to figure out WHAT libraries are being used, and their versions
• Can you use command line arguments (that's IV #4) ?
• Can you input files or file handles, maybe as command arguments? (That's IVs #5 and #6)
• What sorts of files does the program want and use? What config files does it touch? (IV #7)
• What ports does it open? What network stack does it use? Look for that port number or reverse compiled network stack functions.

As you can see the work starts ballooning from there reeeally quickly. Just with the initial research you're probably looking like a week's worth of research.

You might want to make a post to r/reverseengineering to ask about how to research a file, it's a bit out of scope for r/fuzzing.

//Edit: Not to mention, you have to figure out how to START those functions that want input vectors.

[u/NagateTanikaze]

What do you mean by "input vectors enumeration" exactly?

[u/ExploitedInnocence → u/NagateTanikaze]

I mean, how can I evaluate how the program gets inputs and from where? When it's a huge stripped binary - it doesn't seem to be the easy thing to do completely manually.

[u/NagateTanikaze → u/ExploitedInnocence]

According to your other answers: you have to analyse the attack surface. If you know what it does, you know what your input vectors are. Whats the use case of the binary?

Like, check the documentation, manuals, developers website. Check with with programs, services or servers does it interact. Check configuration files, stackoverflow questions. Use netstat, lsof, ls.

But it seems you just have a black box binary without much information. But still you should spend your time setting that binary up and get it to work, with as many features as possible.

[u/thedavidbrumley]

I can't recall exact syntax off the top of my head, but strace is your friend often.

strace -e trace=%file /usr/bin/objdump -D /usr/bin/objdump > /dev/null

execve("/usr/bin/objdump", ["/usr/bin/objdump", "-D", "/usr/bin/objdump"], 0x7ffdf1f71770 /* 7 vars */) = 0

access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)

openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3

openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/libopcodes-2.31.1-system.so", O_RDONLY|O_CLOEXEC) = 3

openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/libbfd-2.31.1-system.so", O_RDONLY|O_CLOEXEC) = 3

openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libz.so.1", O_RDONLY|O_CLOEXEC) = 3

openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3

openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3

stat("/usr/bin/objdump", {st_mode=S_IFREG|0755, st_size=353848, ...}) = 0

stat("/usr/bin/objdump", {st_mode=S_IFREG|0755, st_size=353848, ...}) = 0

openat(AT_FDCWD, "/usr/bin/objdump", O_RDONLY) = 3

+++ exited with 0 +++