Hot answers tagged

20

Correct disassembly of an executable is known to be undecidable in the general case (this problem can obviously be related to the famous halting problem of a Turing machine). So, extracting all the basic blocks of a binary program is a very difficult problem. Yet, there are several techniques to try to approach a best effort coverage of the instructions. ...


16

If you need null bytes, you can write them to a file and use the file as input for the program, e.g.: echo -e -n "\x00\xFF\xAB" > file.bin program < file.bin You can use also use xxd to convert hex to binary: echo "00 FF AB" | xxd -r -p | program


9

Use echo -e and pipe to your program's input. Example: echo -e "\x41\x42\x43\x44" | <executable> Will write ABCD as input. edit: You can pass null-bytes


9

This is code from the vDSO which is mapped by the kernel into every process, not from the wget binary. You could probably figure it out by inspecting the /proc/<pid>/maps file. Here's what I have in IDA for gettimeofday from it: .text:FFFFFFFFFF700D17 mov rbx, 0FFFFFFFFFFDFF000h .text:FFFFFFFFFF700D1E lsl r11d, eax .text:FFFFFFFFFF700D22 ...


7

Peach is excellent at fuzzing smaller embedded systems. The configuration and detection is the big difference for embedded systems. This tends to change device to device, but one of my most used tools is the Cana Kit Relay Controller (http://www.canakit.com/4-port-usb-relay-controller.html). Peach has a monitor module that is able to trigger the relays. ...


5

Not sure how it fares against application with JIT compiled code, but peach has a minset utility to make a minimal set of files with highest code coverage: This tool will run each sample file through a target program and determine code coverage. It will then find the least number of files needed to cover the most code. This will be the minimum set of ...


5

Although it is heavily coupled with GCC, the gcov project is popular as a Linux code coverage tool. It however requires compiling your program with the -fprofile-arcs -ftest-coverage flags, which may not be an option if targeting closed source software. More information may be found here: http://gcc.gnu.org/onlinedocs/gcc/Gcov.html


5

You can write an IDA script or create an IDA plugin to gather all basic blocks in a program. Sample plugin code to gather all basic blocks can be found in http://www.hexblog.com/ida_pro/files/coverit.zip - ... // Find all basic blocks in the specified area static bool gather_basic_blocks(ea_t ea1, ea_t ea2) { show_wait_box("Finding basic blocks"); ea_t ...


3

it is not clear if you are using windbg and you have a bunch of .dmp files that you want to auto analyze for access-violation if that is the case you could check this out original contents of directory :\>ls -l total 96 -rw-rw-rw- 1 HP 0 96698 2016-01-29 21:27 CRASH.DMP duplicating the same file 10 times to simulate a bunch of crash dumps :\>for /...


3

Adobe Reader uses the following two methods to determine if another instance is running: CreateSemaphoreW(NULL, 0, 1, L"Acrobat Viewer") followed by GetLastError() == ERROR_ALREADY_EXISTS FindWindowW(L"Acrobat Viewer", NULL) != NULL So as long as you hook those two functions appropriately or patch the code that performs those checks, you will be able to ...


3

When dealing with multi-threaded program, you may end up getting instructions from different threads. You can for example check the current thread ID to make sure you're getting what you need. Even if the program itself does not use threads, they may be created by system libraries. One of the most common examples is the TppWaiterpThread. RPC functions also ...


3

Some time ago I wrote minblox for that exact purpose. It relies on DynamoRIO. Compared to minset which uses pin tool, there isn't much of a difference. Tho I think actual set minimization part works faster than minset. Minblox tool is comprised of two parts. A DynamoRIO instrumentation part (libbbcoverage) tasked with recording all basic block executed ...


3

There are good answers to your question here. However, I wanted to give you my opinion. Root cause analysis, over all, is best done half-manually. One of the reasons is that techniques like Dynamic Taint Analysis, using SMT solvers, etc... are good tools for small or specific problems but almost unusable for whole projects + real targets, for the average ...


3

Don't know about the state of the art , but some advances have been in the direction of combining symbolic execution as with SAGE from MS Research (there should be a better paper, but I think it's paywalled). Also A Taint Based Approach for Smart Fuzzing shows how to combine taint analysis for advanced fuzzing (there should be some non-paywalled version ...


3

There are three types of fuzzers: mutation fuzzers, which start with a large list of diverse, good input files and a list of mutations. Then, each file is mutated in some way and passed to the application to see if the app can handle the mutated input. Charlie Miller's 2010 CanSecWest talk covers this approach nicely. Generally it's straightforward to roll ...


3

I haven't used either, but Peach Fuzzer, on which HotFuzz is based, has a "Peach Fuzz Bang" GUI for fuzzing files. Keep in mind, though, that fuzzers try to generate invalid inputs that crash a program, not determine the exact grammar that describes all valid input. Furthermore, strictly speaking, it isn't mathematically possible to do what you're asking. ...


2

You seem to be on the right track. As @Michael Eddington pointed out Peach is excellent at fuzzing embedded systems (not just to smaller simple ones in my experience). I have similar experience using it with a variety of methods to check if the device is still alive such as a simple ICMP message if it's networked, JTAG responses, or just a change in serial ...


2

Page 4 of https://www.nccgroup.com/media/190706/usb_driver_vulnerabilities_whitepaper_january_2013.pdf gives a good introduction to setting up a USB-fuzzing test platform. Testing USB drivers on host machines is not a straightforward process, because you either need to emulate a USB device or proxy the traffic between a device and the host. As a ...


2

Apart from the FaceDancer from Goodspeed, I have never been able to find anything similar. I personally use the FaceDancer[11 & 21] and now I built my own emulator (not that easy if your electronics skills are rusty). But depending on the kind of analysis you want to perform you could find different other types of hardware, or software for that matter. ...


2

The best thing you can do is to learn how to read assembly. Start at the crash, see what type of memory is being used, values in registers, and previous instructions. Learn how to use windbg. Taint analysis and smt solving is intended for pure binary data, it sucks for interpreters or abstract state machines. In other words, its great when the ...


2

First of all you should write script to lower the difference between your mutated(fuzzed) file and original in order to know the main byte/bytes that make program crash. This would be a byte by byte compare,change,check to make sure you have the minimal difference needed to crash the app.(It's possible that you found new crashes this way. believe me!) ...


2

Binary-level code coverage analysis can be done either statically or dynamically. Static instrumentation can, among other things, offer drastic performance improvements over dynamic tools like Pin. However, it is considered, somewhat traditionally, to be brittle, i.e., it breaks binaries. For example, see the last note on static rewriting in afl-qemu. Hence, ...


2

CreateToolhelp32Snapshot() would help for creating a snapshot of program state, especially fuzzing a la this paper Also, Peter Van Eeckhoutte covered what you're attempting to do in (in-memory fuzzing) in this blogpost Both are outlined step by step


2

Peach Fuzzer performs automated exploitability analysis. Though I haven't used it myself and can't say whether or not it's any better than !exploitable. If neither Peach Fuzzer nor !exploitable meets your needs and you can't find anything else, you're best off grouping crashes by exception code and exception address (RVA if the program uses ASLR). Then if ...


1

try reading this book to get some answers:- iOS Hacker's Handbook http://eu.wiley.com/WileyCDA/WileyTitle/productCd-1118204123.html Covers iOS security architecture, vulnerability hunting, exploit writing, and how iOS jailbreaks work Explores iOS enterprise and encryption, code signing and memory protection, sandboxing, iPhone fuzzing, exploitation, ROP ...


1

Thanks to @julian's comment, I was able to search for more relevant terms. For this particular case, I decided to use AFL's dictionary mode, where you can give it a list of words that make up the target application's accepted syntax. For example, let's pretend the target application is an interactive calculator, which supports all basic mathmatical ...


1

Great tool to achieve this in Windows is Application Verifier. The general idea is that you run your program with different heap inspections, using the verifier. For example - each allocation made on a separate memory page, Freed memory is not just returned to the pool but marked as freed, and any later access to it will cause an excpetion and so on. This ...


1

This is not a question about reverse engineering, but you can use the DARPA Cyber Grand Challenge binaries that have been ported to Linux, Mac OS and Windows by the Trail of Bits team: The DARPA Challenge Binaries (CBs) are custom-made programs specifically designed to contain vulnerabilities that represent a wide variety of crashing software flaws. They ...


1

If you want to discover new test cases (or check that a test case is valuable) on a binary, the good way to go is to use tools such as KLEE (see this small tutorial). The point is too use symbolic execution to try to cover a maximum of the possible execution paths which are in the binary. So, I would advise you to take a deeper look at the symbolic ...


1

Just find points of interest and reverse the flow back to find if there is something in the environment you can manipulate to your will alter the poi. Eg, if you find a memcpy(a, b, c); check where b and c are coming from, are they from user generated input or system generated input, maybe they are statics. If it they are generated from user input you can ...


Only top voted, non community-wiki answers of a minimum length are eligible