3

I wonder if the tools like AddressSanitizer exist for blackbox analysis.

For instance I've fuzzer that can probe some 100 variants per second and after a few seconds crash was detected. Maybe some tool can say exactly is this vulnerability or just a bug and distinguish the vulns from each other?

This tools are now known to me:

  1. !exploitable - it's ok, but maybe standalone tool for such purpose exists?
  2. AddressSanitizer - unfortunately no blackbox testing support(as far as I understood app must be linked with AddressSanitizer and specific routines should be invoked)
1
  • !exploitable is really awful.. It has LOADS of false postives and negatives. Best is to try by hand.
    – Stolas
    Oct 22 '14 at 6:32
2

Peach Fuzzer performs automated exploitability analysis. Though I haven't used it myself and can't say whether or not it's any better than !exploitable.

If neither Peach Fuzzer nor !exploitable meets your needs and you can't find anything else, you're best off grouping crashes by exception code and exception address (RVA if the program uses ASLR). Then if you have ten variants that share the same exception code and exception address, you only need to manually analyze one of them instead of all ten.

1
  • Thanks for idea, I'll try. FYI Peach ships with !exploitable from Peach v2.3.5 as far as I know.
    – see ya
    Oct 23 '14 at 7:57
0

On Windows you may use GFlags that is distributed with Windbg. It allows you to detect heap corruption early but also can be useful in detecting other class of errors. Simple example can be found here.

This is a real-life example to use GFlags.

1
  • Thank you. Seems like this tool can do part of needed job.
    – see ya
    Oct 23 '14 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.