11–20 of 86 posts
This is INSANELY COOL. If it's smart enough to learn how to build a JPEG in a day, use it with netcat and it could probably send quite a lot of things down in flames. Who needs static analysis :) ?
Yeah, netcat would be fun. Although, it seems that it also straces (or similar?) the app it tests. > it triggers a slightly different internal code path in the tested app This would be impossible on the network.
This is totally amazing! Wondering if it would be possible to go the other way around: from generated JPG to a string. If yes, what a cool way to send your password as a... JPG over email.
Earlier quoted context omitted.
The original string is not in any way part of the image that's generated. The fuzzer notices that the initial codepath being triggered with the "hello" file would be different if the first byte were 0xff, instead of 0x68. So it changes the file and tries it. The 'h' has gone - it wouldn't matter what it was originally, the fuzzer would always have chosen 0xff. All the fuzzer is doing is exploring the possible codepat…
thank you very much for explaining that! So it is really quasi-random image generator with the initial string being a seed?
This is totally amazing! Wondering if it would be possible to go the other way around: from generated JPG to a string. If yes, what a cool way to send your password as a... JPG over email.
Along similar lines, I wonder if this fuzzer can be used to bruteforce passwords for applications. Would it do any better than standard "try all the combinations" method?
If it's not, better attacks exist than trying every single password.
If you're trying to crack the application - not the password - maybe, but I kinda doubt it.
Regarding >if (strcmp(header.magic_password, "h4ck3d by p1gZ")) goto terminate_now; How impossible would it be to look at the branching instruction, perform a taint analysis on its input and see if there is any part of the input we can tweak to make it branch/not branch. Like, we jumped because the zero flag was set. And the zero flags was set because these two bytes were equal. Hmm that byte is hardcoded. This other…
Quite possible. More commonly done with higher-level languages rather than machine code, but certainly possible with machine code. A good fuzzer could do this too.
The fuzzer from the article, american-fuzzy-lop (https://code.google.com/p/american-fuzzy-lop/), does something similar to this as it moves forward in execution, trying to find interesting inputs that cause the program to take a different code path. Symbolic execution could accelerate that process, allowing afl to immediately identify the relevant things to fuzz, rather than randomly mutating and looking for interestingness. On the other hand, unless the program in question runs very slowly, or uses many complex compound instructions before a single conditional branch, random mutation seems likely to produce results rapidly from sheer speed.
Symbolic execution does seem like it would work well if you want to reach a specific point in the program, and you have rather complex conditionals required to get there. But it would still have trouble with complex cases. Consider a file format with a SHA256 hash in it, where the header must have a valid hash to parse. Symbolic execution would have a very hard time figuring out the input relationship required to get past that hash check.
This is INSANELY COOL. If it's smart enough to learn how to build a JPEG in a day, use it with netcat and it could probably send quite a lot of things down in flames. Who needs static analysis :) ?
Earlier quoted context omitted.
Yeah, netcat would be fun. Although, it seems that it also straces (or similar?) the app it tests. > it triggers a slightly different internal code path in the tested app This would be impossible on the network.
Why impossible? (Hint: 127/8 is a network, too.)