Earlier quoted context omitted.
Interestingly, Radamsa is implemented in Scheme, then transpiled to C. Originally I played around with invoke Radamsa as a server (it's normal usage model), but this wasn't ideal because I wanted to use it at varying granularities, which would have meant multiple invocations per mutate/execute cycle. What I ended up doing was to take the compiled Scheme, get rid of all the syscalls, link it directly into the fuzzer p…
Badass tech and fuzzing results in your main comment. :) What Scheme or transpiler did you use, though?
Ask HN: What is the emerging state of the art in fuzzing techniques?
41–50 of 54 posts
Re: Ask HN: What is the emerging state of the art in fuzzing techniques?
#42I've started using clojure.spec[0] in my regular day programming with an eye on using generative testing, which I understand is a form of fuzzing. I'm very new to this, but it feels incredibly practical in terms of bang for buck - like the 'cutting edge' of practical use. I'm not sure what it's academic background is, but I'd highly recommend reading and listening to what Rich Hickey has to say about it. He's a smart…
I'll definitely second this one, I'm still getting comfortable with Clojure Spec and the hooks into test.check (it's brand new, and I'm unfortunately no longer doing Clojure for my day job) but it's already great and I'm only at the beginner/intermediate stage.
Re: Ask HN: What is the emerging state of the art in fuzzing techniques?
#43There is a 30 seconds video based on 90 minutes of a collaborative experiment by 22 fuzzing practitioners. Aim was to write down couple of points about fuzzing state of the art.
Video: https://www.youtube.com/watch?v=UrhRUKgeDQI
Text: https://github.com/ouspg/ouspg-open/blob/master/presentation...
Updates e.g. as pull requests most welcome. :)
Re: Ask HN: What is the emerging state of the art in fuzzing techniques?
#44Earlier quoted context omitted.
We ran three versions of our system, because in the last few weeks/days before the quals we had a bunch of regressions. One of those regressions was caused by a single line change in my fuzzer :-p On the twitter account we used to track our progress, we used rapper names for each version. One version was two weeks old, one was up-to-date with the fixed fuzzer, and one had an experimental version of one of our symboli…
You didn't approach us, either; bummer! I doubt we'd have been down to team up outright, but maybe some of you guys could have done an internship in our lab if you really wanted to work on the CGC? I guess it's ancient history now, though. Resource utilization is definitely tricky. But man, the amount of resources you had is just mind-boggling! I just realized it's even more cores than DARPA gave us for the final eve…
Hey Zardus, I'm sure the info reached you. What team are you? We approached everyone either indirectly through broadcast emails or directly through me calling/emailing.
I'm not sure an internship would have been what we were looking for. If I had to guess, that's probably why we didn't pursue it further.
Re: Ask HN: What is the emerging state of the art in fuzzing techniques?
#45in general, have a poke around https://fuzzing.info/papers/ First, I think the next big step in fuzzing will actually be a complement to fuzzing - solving. AFL and friends can bitbang their way to massive code coverage, but can still fail on fairly simple testcases. Some recent research[1] by the authors of Angr[2] show that by pairing the brute-force coverage and exception discovery of a tool like AFL with constrain…
Has anyone tried combining fuzzing with 'all-pairs'/'pairwise' test case generation? The idea of pairwise testing is that individual features in a program are commonly tested, but combinations of them are often poorly tested. However, trying to test all features with each other soon becomes a combinatorial nightmare. To deal with this, you use an algorithm (e.g. see the code for 'allpairs' at http://www.satisfice.com…
NIST has done some research on combinatorial software testing and has a pretty good package [1] I've used before for generating test cases given N dimensions.
The idea behind their software is to maximize the effectiveness of test time because testing those N dimensions exhaustively is infeasible.
Re: Ask HN: What is the emerging state of the art in fuzzing techniques?
#46in general, have a poke around https://fuzzing.info/papers/ First, I think the next big step in fuzzing will actually be a complement to fuzzing - solving. AFL and friends can bitbang their way to massive code coverage, but can still fail on fairly simple testcases. Some recent research[1] by the authors of Angr[2] show that by pairing the brute-force coverage and exception discovery of a tool like AFL with constrain…
I'm the second author on [1], if anyone has any questions.
Re: Ask HN: What is the emerging state of the art in fuzzing techniques?
#47in general, have a poke around https://fuzzing.info/papers/ First, I think the next big step in fuzzing will actually be a complement to fuzzing - solving. AFL and friends can bitbang their way to massive code coverage, but can still fail on fairly simple testcases. Some recent research[1] by the authors of Angr[2] show that by pairing the brute-force coverage and exception discovery of a tool like AFL with constrain…
I'm the second author on [1], if anyone has any questions.
Thank you. Things like this are what make HN awesome :)
Re: Ask HN: What is the emerging state of the art in fuzzing techniques?
#48shameless self plug: https://www.nccgroup.trust/us/about-us/newsroom-and-events/b... allows you to run AFL on arbitrary VMs. so far we've used it to find some Linux vulnerabilities, and are starting to find stuff in other operating systems too. and we're just getting started :)
I read this recently via HN. Congrats, this is impressive.
Re: Ask HN: What is the emerging state of the art in fuzzing techniques?
#49Checkout TriforceAFL as well, which allows using AFL (American Fuzzy Lop) inside a qemu virtual machine.
This is a pretty interesting writeup on it: https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...
Re: Ask HN: What is the emerging state of the art in fuzzing techniques?
#50AFL for Windows: https://github.com/ivanfratric/winafl