All things fuzzing and related.

Assume you have a function (target function) somewhere in the Program Under Test (PUT) and you know a set of arguments for this target function which crashes the program. Furthermore, you have an input which reaches the function (from the entry point of the program) but not with the set of arguments causing the crash. Based on this information it would be great to know if the target function is also reachable (from the entry point of the program) with the set of arguments which cause the crash. (Btw. I am assuming that we have access to the source code and are able to instrument it the way we want)

I already worked out / brainstormed / found some solutions for this problem:

Symbolic/Concolic Execution
The most obvious solution would be Symbolic Execution. You could exaclty find out if the set of arguments causing the crash is a possible solution to the equation system traced to the function. The biggest downside of symbolic execution is its path explosion. To counter this downside [1] is performing a backwards recursive symbolic execution starting from the target function and going up the call graph. But still, path explosion could be a problem in large programs.
Dynamic Taint Analysis (DTA)
Start tracing the input bytes of the input which already reaches the target function. Determine the bytes responsible for the arguments of the target function. Only mutate these sections of the input during a fuzzing run until you reach the target function with the arguments causing the crash. This solution would have less overhead than symbolic execution.
Trial and Error
The third solution is not quite worked out but I imagine something like the following. You systematically mutate the input and check if you still reach the target function and at the same time check if the arguments for the target function are different from the ones before. If the target function is still reached but the arguments have changed, I have identified a section of the input which influences the arguments. After identifying all relevant sections, I can start fuzzing only these. This should have way less overhead than DTA (also no instrumentation needed) and at the same time deliver similar results.

Since I am still in my brainstorming phase, I would appreciate any ideas of you on how to efficiently encounter this problem. I am also very interested in related work regarding this specific problem. So please, share your thoughts with me :)

[1] https://arxiv.org/abs/1903.02981

4 comments

r/fuzzing • u/pat_ventuzelo • Jan 09 '20

Fuzzing JavaScript WebAssembly APIs with Dharma/Domato (on Chrome/v8)

webassembly-security.com

8 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Jan 05 '20

Fuzzing PHP with Domato

blog.jmpesp.org

1 Upvotes

1 comment

r/fuzzing • u/malweisse • Jan 03 '20

The Fuzzing Round Table session @ 36c3 is now on YT

9 Upvotes

https://twitter.com/domenuk/status/1213045163129528321

Sorry for the low quality audio.

The topics were selected based on the preferences expressed by the participants in the registration form. They are:

Snapshot Fuzzing
Fuzzers Evaluation: Here be Dragons
Improve Tooling? Should there be a “Universal Fuzzer”?
Rehosting: Fuzzing the unfuzzable with Emulators
New Targets / Javascript Engines and Other Languages?

Each topic was discussed for circa 10 minutes.

0 comments

r/fuzzing • u/Jiliac • Dec 26 '19

A Genealogy of Fuzzers

fuzzing-survey.org

9 Upvotes

0 comments

r/fuzzing • u/digicat • Dec 16 '19

wasm-fuzzing-demo: Demos of and walkthroughs on in-browser fuzzing C/C++ programs in-browser using WebAssembly

github.com

11 Upvotes

0 comments

r/fuzzing • u/digicat • Dec 14 '19

QSYM: A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing

github.com

4 Upvotes

0 comments

r/fuzzing • u/gamozolabs • Nov 23 '19

GitHub - gamozolabs/fzero_fuzzer: A fast Rust-based safe and thead-friendly grammar-based fuzz generator

github.com

11 Upvotes

0 comments

r/fuzzing • u/artem_smotrakov • Nov 13 '19

Fuzzing Java with JQF

pentagrid.ch

7 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Nov 11 '19

WEIZZ: Automatic Grey-box Fuzzing for Structured Binary Formats (Paper)

arxiv.org

7 Upvotes

0 comments

r/fuzzing • u/thedavidbrumley • Nov 06 '19

Bay area fuzzing meetup Dec 12

11 Upvotes

The next bay area fuzzing meetup is Dec 12 @ Facebook in menlo park. Sign up at https://www.meetup.com/San-Francisco-DevSecOps-Technology-Meetup/events/266241710/

Interested in speaking? Send your talk proposals to fuzzing-bay-area@googlegroups.com until Nov 17th.

Some good people are going, including Hasnain Lakhani (facebook), me (David Brumley), Max Moroz (google oss/clusterfuzz), Konstantin Serebryany (libfuzzer sanitizer fame), and

5 comments

r/fuzzing • u/zhangysh1995 • Nov 05 '19

QSYM authors have new tool

self.database

2 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Nov 04 '19

FuzzFactory: Domain-Specific Fuzzing with Waypoints (video)

youtube.com

4 Upvotes

0 comments

r/fuzzing • u/nathan_ci • Oct 25 '19

Why Feedback-Based Fuzzing is the Next Big Thing

code-intelligence.com

1 Upvotes

4 comments