Upload
lmehyaoui-talal
View
230
Download
0
Embed Size (px)
Citation preview
7/28/2019 0knowledge Fuzzing Slides
1/71
0-KnowledgeFuzzingVincenzoIozzo
7/28/2019 0knowledge Fuzzing Slides
2/71
7/28/2019 0knowledge Fuzzing Slides
3/71
Mo5va5ons
7/28/2019 0knowledge Fuzzing Slides
4/71
Ques5ons!
7/28/2019 0knowledge Fuzzing Slides
5/71
Fuzzing
7/28/2019 0knowledge Fuzzing Slides
6/71
Howitusedtobe
7/28/2019 0knowledge Fuzzing Slides
7/71
Howitistoday
(akathereasonofthistalk)
7/28/2019 0knowledge Fuzzing Slides
8/71
Dumbfuzzing
7/28/2019 0knowledge Fuzzing Slides
9/71
SmartFuzzing
7/28/2019 0knowledge Fuzzing Slides
10/71
Evolu5onaryBasedFuzzing
7/28/2019 0knowledge Fuzzing Slides
11/71
Theidea
7/28/2019 0knowledge Fuzzing Slides
12/71
Thesurface
7/28/2019 0knowledge Fuzzing Slides
13/71
Weneedafilter
7/28/2019 0knowledge Fuzzing Slides
14/71
7/28/2019 0knowledge Fuzzing Slides
15/71
Thisone
7/28/2019 0knowledge Fuzzing Slides
16/71
Notthisone
7/28/2019 0knowledge Fuzzing Slides
17/71
Originalformula
M=EN+2P
Numberofedges Numberofnodes Connected
components
7/28/2019 0knowledge Fuzzing Slides
18/71
Why?Cycloma5cnumber
M=EN+P
7/28/2019 0knowledge Fuzzing Slides
19/71
Simplify
7/28/2019 0knowledge Fuzzing Slides
20/71
Formula
M=EN+2
7/28/2019 0knowledge Fuzzing Slides
21/71
7/28/2019 0knowledge Fuzzing Slides
22/71
Loopdetec5on
7/28/2019 0knowledge Fuzzing Slides
23/71
Dominatortree
7/28/2019 0knowledge Fuzzing Slides
24/71
Dominators
7/28/2019 0knowledge Fuzzing Slides
25/71
Func5on
7/28/2019 0knowledge Fuzzing Slides
26/71
Dominatortree
7/28/2019 0knowledge Fuzzing Slides
27/71
Dominators
7/28/2019 0knowledge Fuzzing Slides
28/71
Implicitloops
7/28/2019 0knowledge Fuzzing Slides
29/71
REIL
7/28/2019 0knowledge Fuzzing Slides
30/71
Thisone
7/28/2019 0knowledge Fuzzing Slides
31/71
tothisone
7/28/2019 0knowledge Fuzzing Slides
32/71
Isthatenough?
7/28/2019 0knowledge Fuzzing Slides
33/71
7/28/2019 0knowledge Fuzzing Slides
34/71
Addyourown
Forsta5canalysisweuse
7/28/2019 0knowledge Fuzzing Slides
35/71
7/28/2019 0knowledge Fuzzing Slides
36/71
Ques5ons!
7/28/2019 0knowledge Fuzzing Slides
37/71
DataTain5ng
7/28/2019 0knowledge Fuzzing Slides
38/71
Example
Taint
SourceTaint
mark
movl 0x4[eax], ebx
7/28/2019 0knowledge Fuzzing Slides
39/71
Dytan
7/28/2019 0knowledge Fuzzing Slides
40/71
PIN
7/28/2019 0knowledge Fuzzing Slides
41/71
Taintsources
7/28/2019 0knowledge Fuzzing Slides
42/71
Markingsgranularity
7/28/2019 0knowledge Fuzzing Slides
43/71
7/28/2019 0knowledge Fuzzing Slides
44/71
Output
Registers Memoryloca5ons
7/28/2019 0knowledge Fuzzing Slides
45/71
DEMO
7/28/2019 0knowledge Fuzzing Slides
46/71
Ques5ons!
7/28/2019 0knowledge Fuzzing Slides
47/71
In-memoryfuzzing
7/28/2019 0knowledge Fuzzing Slides
48/71
Example
rep movs
esi=0x30f064
esi=0x30f0A4
Originalloc
Fuzzedloc
7/28/2019 0knowledge Fuzzing Slides
49/71
Why?
7/28/2019 0knowledge Fuzzing Slides
50/71
Problems
7/28/2019 0knowledge Fuzzing Slides
51/71
Exper5seandpa5ence
M i bili
7/28/2019 0knowledge Fuzzing Slides
52/71
Memoryinstability
7/28/2019 0knowledge Fuzzing Slides
53/71
Falseposi5ves
7/28/2019 0knowledge Fuzzing Slides
54/71
Falsenega5ves
7/28/2019 0knowledge Fuzzing Slides
55/71
Muta5onloopinser5on
7/28/2019 0knowledge Fuzzing Slides
56/71
Snapshotmuta5onrestora5on
7/28/2019 0knowledge Fuzzing Slides
57/71
Whatdowedo?
Hookimage Hookfunc5ons Hookinstruc5ons Hook
7/28/2019 0knowledge Fuzzing Slides
58/71
Firstapproach
7/28/2019 0knowledge Fuzzing Slides
59/71
Forinstance
30f064-30f068
ABCD 0x8aY0x00
K
7/28/2019 0knowledge Fuzzing Slides
60/71
Secondapproach
7/28/2019 0knowledge Fuzzing Slides
61/71
Example
30f064-30f068
ABCD
30f084-30f098
0x89KDF0x96
0x00KUYW0xA7
0xB80x000x10ATN
0x000xD3
7/28/2019 0knowledge Fuzzing Slides
62/71
Codecoverage
7/28/2019 0knowledge Fuzzing Slides
63/71
Score
BBexecuted/BBtotal
BasicBlocks
executedTotalBasic
Blocks
7/28/2019 0knowledge Fuzzing Slides
64/71
Hal5ng
Cevil=Cgood+t
Codecoverage
evilsample
Codecoverage
goodsample
User-supplied
threshold
7/28/2019 0knowledge Fuzzing Slides
65/71
How??
Goodsample
Score
Evilsample
ScoreCompare
7/28/2019 0knowledge Fuzzing Slides
66/71
Whatdoweuse?
Codecoverage Faultsmonitor
7/28/2019 0knowledge Fuzzing Slides
67/71
DEMO
7/28/2019 0knowledge Fuzzing Slides
68/71
FutureAreasoner
7/28/2019 0knowledge Fuzzing Slides
69/71
Thanks
7/28/2019 0knowledge Fuzzing Slides
70/71
Ques5ons!
7/28/2019 0knowledge Fuzzing Slides
71/71
MoreInfo
viozzo.wordpress.com
@_snagg