Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [fuzzing]

A software testing technique that involves providing invalid, unexpected, or random data to the inputs of a computer system, then monitoring for exceptions, failed assertions, or memory leaks.

3
votes
1answer
83 views

Questions about enabling special pool on win32k

So there is win32k.sys, win32kbase.sys, win32kfull.sys in Windows 10 Does verifier /driver win32k.sys /flags 0x1 enable special pool on all three drivers? (win32k.sys is kinda like stub to other ...
2
votes
1answer
81 views

Detect interesting testcases

Suppose I have a ton of test cases and my target is closed-source. Well, I need to know which test cases discover new path in the execution of my target and which are duplicated. I know I have to use ...
0
votes
1answer
197 views

Is it possible to programmatically determine if a crash resulted from a buffer overflow?

Crash analysis: Given a large set of crashes, all resulting from access violations, is it possible to (with or without access to symbols and source code) programmatically determine whether the ...
1
vote
1answer
216 views

iOS exploit hunting environment

Suppose, I have a new iPhone 6s with latest iOS, and I want to find vulnerabilities in iOS itself. iPhone is not jailbroken. How do I set up the proper environment for this? What software and/or ...
9
votes
1answer
225 views

Saving program execution state for fuzzing

Suppose I have a program that has two functions, functionA and functionB called sequentially. functionA requires a significant amount of processing in order to execute, and in the course of the ...
1
vote
1answer
209 views

Getting started with dynamic reverse engineering

I have been doing a lot of reading into how to find vulnerabilities in closed source applications. And the term that comes up a lot is "fuzzing". I want to get started with fuzzing and I looking for ...
3
votes
2answers
176 views

blackbox vulnerability assessment

I wonder if the tools like AddressSanitizer exist for blackbox analysis. For instance I've fuzzer that can probe some 100 variants per second and after a few seconds crash was detected. Maybe some ...
1
vote
1answer
182 views

Run multiple instances of same application - Adobe Reader

I have been fuzzing Adobe Reader for a while now. One of the issue that I face is running multiple instances of same application. If I'm able to run multiple instances of same application, I will be ...
12
votes
2answers
4k views

Code Coverage - Fuzzing

I have been fuzzing Adobe Reader lately. One of the issues that I face is Code coverage. How do I determine that I have covered all the basic blocks in Adobe Reader and it's libraries. Is there any ...
4
votes
2answers
859 views

Corpus Distillation

Anyone know of any tools or scripts that can help in corpus distillation ? I know of Peach Minset, but not other than that. Appreciate if anyone could share.
9
votes
2answers
1k views

Setting an USB Emulation and Fuzzing Platform?

I would like to analyze (and fuzz) a USB device and I need a bit of guidance to setup a full platform to discuss with the device. First, I would like to know what are the most used hardware cards to ...
6
votes
3answers
2k views

Fuzzing Adobe Reader - Exploit Development

I have been fuzzing Adobe Reader lately. I found couple of bugs. One of the major issues that I'm facing are listed below. How to identify the root cause of the issue? I mean, the PoC has a large ...
1
vote
0answers
174 views

Is there distributed fuzz testing platform against modern proprietary CPU like SETI@HOME? [closed]

My idea is near what SETI Institute does. Distributed fuzz testing against modern Intel and Amd Central processing units(CPU). To find similar to Blue Pill bugs. Is there?
2
votes
1answer
109 views

Strange behavior in the reverse execution of traces

In fuzzing applications with Pin (the Pintool source code is hosted here, I am sorry for the self-advertisement), I get a very bizarre situation in tracing executed instructions, the following trace: ...
3
votes
1answer
286 views

Weird instructions

In fuzzing (with Pintool) to get examining execution traces of the program, here it is wget. I get some weird instructions, following is a piece extracted from a (very long) trace: RIP register ...
1
vote
0answers
289 views

Where can i find unix/linux tool for fuzzing for kill-switches? [closed]

I'm looking for linux/unix open-source tools for fuzzing ethernet card for kill-switch packets. https://en.wikipedia.org/wiki/Fuzzing I can imagine how it would be long to brute full of range on ...
14
votes
3answers
3k views

Where can I learn more about black-box fuzzing of small embedded systems?

Fuzzing has become a very common place technique used for software testing and is heavily used to find security problems. There are many frameworks (sully, Peach Fuzzer etc.) that are geared up for ...
9
votes
1answer
831 views

Context-Free Grammar from Samples

Is there a tool available that will generate a grammar from a corpus of sample inputs, similar to what HotFuzz does for network protocols? For example, given a collection of MP3 files, I'm looking ...
11
votes
2answers
740 views

How do I determine code coverage when fuzzing

Let's say I'd like to begin fuzzing Acme Corp's PDF Reader. I'd like to try to follow what Miller did by downloading a bunch of benign PDFs and mutate them. Miller began by reducing his corpus of ...
6
votes
2answers
2k views

State of the Art Fuzzing Framework [closed]

I've previously rolled my own Fuzzing Framework, and tried a few others like Peach Fuzzer. It's been awhile since I've looked at vulnerability hunting, what is the state of the art with regard to ...