Project Triforce: Run AFL on Everything

CGamesPlay wrote: post #3

I really want AFL to be able to run on arbitrary VMs (specifically, I want to run AFL on my rails application). Are there plans to add pluggable tracing modules to AFL?

checkout the details of the project, the idea is that you can run AFL on arbitrary VMs (like your rails VM)! just need to have your test cases, your userland harness, and the addresses to monitor for "panics"

Re: Project Triforce: Run AFL on Everything

#6

Post by CGamesPlay » Mon, Jun 27, 2016, 8:44 PM UTC

mytummyhertz wrote: post #5

CGamesPlay wrote: post #3

I really want AFL to be able to run on arbitrary VMs (specifically, I want to run AFL on my rails application). Are there plans to add pluggable tracing modules to AFL?

checkout the details of the project, the idea is that you can run AFL on arbitrary VMs (like your rails VM)! just need to have your test cases, your userland harness, and the addresses to monitor for "panics"

AFL can fuzz ruby by running ruby on arbitrary inputs. This tests that paths through the ruby interpreter are being stressed.

AFL cannot fuzz ruby code using the same mechanism, because it does not have the right level of insight. AFL can't detect if a branch in my ruby code was tested, only that the code for `if` in the core ruby interpreter has been tested both ways. For this reason, in order to properly test interpreted code, you need to add the AFL instrumentation at the ruby layer, not the native layer.

I don't think AFL currently supports this, and I don't think this project actually enables it. But I would be happy to be corrected!

Re: Project Triforce: Run AFL on Everything

#7

Post by 616c » Mon, Jun 27, 2016, 8:49 PM UTC

So I am still reading through their Linux container security paper, and I like their stuff, but who are these NCC people? In the last few months I have seen multiple postings on their papers and blog posts, seemingly out of nowhere, never having heard of them pry to the container paper.

Re: Project Triforce: Run AFL on Everything

#8

Post by mytummyhertz » Mon, Jun 27, 2016, 8:52 PM UTC

616c wrote: post #7

So I am still reading through their Linux container security paper, and I like their stuff, but who are these NCC people? In the last few months I have seen multiple postings on their papers and blog posts, seemingly out of nowhere, never having heard of them pry to the container paper.

NCC = matasano + iSec + intrepidus group

:D

Re: Project Triforce: Run AFL on Everything

#9

Post by 616c » Mon, Jun 27, 2016, 8:54 PM UTC

mytummyhertz wrote: post #8

616c wrote: post #7

So I am still reading through their Linux container security paper, and I like their stuff, but who are these NCC people? In the last few months I have seen multiple postings on their papers and blog posts, seemingly out of nowhere, never having heard of them pry to the container paper.

NCC = matasano + iSec + intrepidus group :D

Thanks. That explains some things.

Re: Project Triforce: Run AFL on Everything

#10

Post by lunixbochs » Mon, Jun 27, 2016, 8:55 PM UTC

CGamesPlay wrote: post #6

mytummyhertz wrote: post #5

Earlier quoted context omitted.

checkout the details of the project, the idea is that you can run AFL on arbitrary VMs (like your rails VM)! just need to have your test cases, your userland harness, and the addresses to monitor for "panics"

AFL can fuzz ruby by running ruby on arbitrary inputs. This tests that paths through the ruby interpreter are being stressed. AFL cannot fuzz ruby code using the same mechanism, because it does not have the right level of insight. AFL can't detect if a branch in my ruby code was tested, only that the code for `if` in the core ruby interpreter has been tested both ways. For this reason, in order to properly test inter…

AFL usually requires you to write a "driver" for the program you want to fuzz. The driver does two main things:

1. Take a binary blob of input and pass it to the program somehow.

2. Record execution path traces into a shared memory section.

You could likely modify the Ruby VM to record path traces, and handle the binary blob in Ruby code.