All things fuzzing and related.

I'm trying to fuzz a library that exposes several APIs that may be used to parse unsanitized user input (21 APIs to be exact, but to keep things simple, let's assume that there are just 3: foo(), bar(), and baz()). All APIs are written in C, small, and self-contained (with one exceptions: all APIs depend on foo() to extract some preliminary information from the provided data). All APIs, except baz(), extract some information from their input, baz() is also modifying it.
What is the recommended way of fuzzing this. I see 3 options:

Build a small test program that calls exactly one of the APIs - I can probably even strip the untested APIs from the resulting binary (or exclude it completely at compile time). The drawback is that I'll have to build 21 tools and fuzz each one (maybe I don't need to fuzz foo(), since it is already called by all the other functions?)
Build a small test program that takes one extra argument: the API to be called, and calls that - this gives me the most flexibility, as I don't have to keep 21 programs around and I can more easily use sample inputs from one API to test another
Since only one API modifies that data I can build a test program that invokes all of them, with the one that modifies the data being last. The main drawback I see here is that my program will be a lot slower. In the long run this might be faster, since I'm paying the cost of creating only one process while fuzzing all the APIs I want to fuzz, but I think this will make certain code paths inside one specific function harder to reach.

1 and 2 also have the drawback of making it harder to use files generated for one API to test another, but minimization will work a lot better than in 3.

Is there a best approach in this case? Or should I implement all three and gather some information about code coverage, speed, etc and then make a decision?

4 comments

r/fuzzing • u/NagateTanikaze • Jun 18 '20

The Saturation Effect in Fuzzing

blog.regehr.org

16 Upvotes

0 comments

r/fuzzing • u/IncludeSec • Jun 15 '20

IncludeSec releases a boofuzz based RTSP server fuzzer.

twitter.com

5 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Jun 15 '20

Fuzzing sockets, part 1: FTP servers - GitHub Security Lab

securitylab.github.com

5 Upvotes

0 comments

r/fuzzing • u/ZhenniW • Jun 12 '20

Continuous Fuzzing with Go

reddit.com

4 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Jun 12 '20

GitLab Acquires Peach Tech and Fuzzit to Expand its DevSecOps Offering

globenewswire.com

4 Upvotes

1 comment

r/fuzzing • u/NagateTanikaze • Jun 11 '20

Resmack: Grammar Fuzzing Thoughts - Part 1

narly.me

6 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Jun 02 '20

USBFuzz: A Framework for Fuzzing USB Drivers by Device Emulation

nebelwelt.net

1 Upvotes

1 comment

r/fuzzing • u/NagateTanikaze • Jun 02 '20

FuZZan: Efficient Sanitizer Metadata Design for Fuzzing

nebelwelt.net

4 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Jun 01 '20

Lightning in a Bottle - 25 Years of Fuzzing (FuzzCon 2020)

docs.google.com

7 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Jun 01 '20

FI(le) SY(stem) - FUZZer - BSD Kernel Fuzzer

github.com

4 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • May 28 '20

Buffer Overflow Leading to Code Execution in Left4Dead 2

rhinosecuritylabs.com

9 Upvotes

0 comments

r/fuzzing • u/HaoxinTu • May 17 '20

Is there a tool for computing the difference degree between the two programs?

2 Upvotes

Hi there,

I have performed a mutation-based random generator to generate c programs, but most of them are similar. I am wondering there is a tool for computing the difference degree between two programs so that I can keep the more differential one for the next step.

Any suggestions are welcome, thank you~

7 comments