The Day I Fell in Love with Fuzzing

#1

Post by eaguyhn » Mon, Jan 28, 2019, 5:03 PM UTC

The Day I Fell in Love with Fuzzing
nullprogram.com

Re: The Day I Fell in Love with Fuzzing

#2

Post by Quarrelsome » Mon, Jan 28, 2019, 6:19 PM UTC

The fuzzing is interesting but whats the deal with storing config files as binaries in 2019? Paradox has tons of text configs and doesn't even bother minifying them.

Am I underestimating the quantity or smth?

Re: The Day I Fell in Love with Fuzzing

#3

Post by ulysses » Mon, Jan 28, 2019, 6:30 PM UTC

Quarrelsome wrote: post #2

The fuzzing is interesting but whats the deal with storing config files as binaries in 2019? Paradox has tons of text configs and doesn't even bother minifying them. Am I underestimating the quantity or smth?

The config files are for a game that was announced in 1999 and released in 2003.

Re: The Day I Fell in Love with Fuzzing

#4

Post by Quarrelsome » Mon, Jan 28, 2019, 6:33 PM UTC

ulysses wrote: post #3

Quarrelsome wrote: post #2

The fuzzing is interesting but whats the deal with storing config files as binaries in 2019? Paradox has tons of text configs and doesn't even bother minifying them. Am I underestimating the quantity or smth?

The config files are for a game that was announced in 1999 and released in 2003.

he's talking about reworking it in 2018.

> That’s the way things were until mid-2018 when I revisited the project.

Re: The Day I Fell in Love with Fuzzing

#5

Post by c256 » Mon, Jan 28, 2019, 6:35 PM UTC

Quarrelsome wrote: post #4

ulysses wrote: post #3

Earlier quoted context omitted.

The config files are for a game that was announced in 1999 and released in 2003.

he's talking about reworking it in 2018. > That’s the way things were until mid-2018 when I revisited the project.

Yes, because retro-gaming is a thing.

Re: The Day I Fell in Love with Fuzzing

#6

Post by ergothus » Mon, Jan 28, 2019, 6:36 PM UTC

> When I got started, I had just learned how to use yacc (really Bison) and lex (really flex)

I've dug into parsers a few times, but everything I encountered seemed to think that once I had a parsed tree of commands it was obvious how to consume it...and it wasn't (for me). I've never had the free time to dedicate to experimenting that abstractly, so anytime I'm tempted to write a DSL or similar for a current problem I punt and do something else.

Does anyone have advice on how to find nice ways to use parsers/lexers in a practical way that doesn't involve a massive investment of time or assume I have a lot of abstract comp sci background? Every thing I've seen has been more of a compilers course, which seems overkill.

Re: The Day I Fell in Love with Fuzzing

#7

Post by hyper_reality » Mon, Jan 28, 2019, 6:37 PM UTC

This is a great introduction to fuzzing, I love the section about minimising the corpus of fuzzed inputs and turning that into a test suite. That's something that should be done with all parsing software!

Re: The Day I Fell in Love with Fuzzing

#8

Post by jerf » Mon, Jan 28, 2019, 6:43 PM UTC

ergothus wrote: post #6

> When I got started, I had just learned how to use yacc (really Bison) and lex (really flex) I've dug into parsers a few times, but everything I encountered seemed to think that once I had a parsed tree of commands it was obvious how to consume it...and it wasn't (for me). I've never had the free time to dedicate to experimenting that abstractly, so anytime I'm tempted to write a DSL or similar for a current problem…

What skills/languages do you have? It can help tune the suggestions.

Barring that, you can google "compiler tutorial" and just start looking for one you like. One nice thing about compilers is they consist of a lot of stages and while the whole is arguably greater than the sum of its parts, the parts are all pretty darned useful on their own, too.

Re: The Day I Fell in Love with Fuzzing

#9

Post by ergothus » Mon, Jan 28, 2019, 6:52 PM UTC

jerf wrote: post #8

ergothus wrote: post #6

> When I got started, I had just learned how to use yacc (really Bison) and lex (really flex) I've dug into parsers a few times, but everything I encountered seemed to think that once I had a parsed tree of commands it was obvious how to consume it...and it wasn't (for me). I've never had the free time to dedicate to experimenting that abstractly, so anytime I'm tempted to write a DSL or similar for a current problem…

What skills/languages do you have? It can help tune the suggestions. Barring that, you can google "compiler tutorial" and just start looking for one you like. One nice thing about compilers is they consist of a lot of stages and while the whole is arguably greater than the sum of its parts, the parts are all pretty darned useful on their own, too.

Javascript is my strongest, and I have enough Python to be comfortable - I had a lot of Perl back in the day but that knowledge is fairly rusty (though Parse::RecDescent was my first exposure to parsers). I did Java for a few years, but I refer to those as my Dark Times and wouldn't want to venture back there. (Experienced Perl dev doing Java is NOT a good time for either the dev or the code)

I can't argue about the broad applicability of compilers, but the main reason I've avoided such tutorials is that I'm looking for something I can get the basics of in hours/days rather than a weeks/months.

Re: The Day I Fell in Love with Fuzzing

#10

Post by Quarrelsome » Mon, Jan 28, 2019, 6:53 PM UTC

c256 wrote: post #5

Quarrelsome wrote: post #4

Earlier quoted context omitted.

he's talking about reworking it in 2018. > That’s the way things were until mid-2018 when I revisited the project.

Yes, because retro-gaming is a thing.

Right. I'm just saying why not rip it out now? Why bother fuzzing parsers if the parsers themselves aren't really adding value anymore? The ability to edit your configs in a text editor is pretty valuable isn't it?

Maybe he's just got used to it.