0knowledge fuzzing slides
TRANSCRIPT
-
7/28/2019 0knowledge Fuzzing Slides
1/71
0-KnowledgeFuzzingVincenzoIozzo
-
7/28/2019 0knowledge Fuzzing Slides
2/71
-
7/28/2019 0knowledge Fuzzing Slides
3/71
Mo5va5ons
-
7/28/2019 0knowledge Fuzzing Slides
4/71
Ques5ons!
-
7/28/2019 0knowledge Fuzzing Slides
5/71
Fuzzing
-
7/28/2019 0knowledge Fuzzing Slides
6/71
Howitusedtobe
-
7/28/2019 0knowledge Fuzzing Slides
7/71
Howitistoday
(akathereasonofthistalk)
-
7/28/2019 0knowledge Fuzzing Slides
8/71
Dumbfuzzing
-
7/28/2019 0knowledge Fuzzing Slides
9/71
SmartFuzzing
-
7/28/2019 0knowledge Fuzzing Slides
10/71
Evolu5onaryBasedFuzzing
-
7/28/2019 0knowledge Fuzzing Slides
11/71
Theidea
-
7/28/2019 0knowledge Fuzzing Slides
12/71
Thesurface
-
7/28/2019 0knowledge Fuzzing Slides
13/71
Weneedafilter
-
7/28/2019 0knowledge Fuzzing Slides
14/71
-
7/28/2019 0knowledge Fuzzing Slides
15/71
Thisone
-
7/28/2019 0knowledge Fuzzing Slides
16/71
Notthisone
-
7/28/2019 0knowledge Fuzzing Slides
17/71
Originalformula
M=EN+2P
Numberofedges Numberofnodes Connected
components
-
7/28/2019 0knowledge Fuzzing Slides
18/71
Why?Cycloma5cnumber
M=EN+P
-
7/28/2019 0knowledge Fuzzing Slides
19/71
Simplify
-
7/28/2019 0knowledge Fuzzing Slides
20/71
Formula
M=EN+2
-
7/28/2019 0knowledge Fuzzing Slides
21/71
-
7/28/2019 0knowledge Fuzzing Slides
22/71
Loopdetec5on
-
7/28/2019 0knowledge Fuzzing Slides
23/71
Dominatortree
-
7/28/2019 0knowledge Fuzzing Slides
24/71
Dominators
-
7/28/2019 0knowledge Fuzzing Slides
25/71
Func5on
-
7/28/2019 0knowledge Fuzzing Slides
26/71
Dominatortree
-
7/28/2019 0knowledge Fuzzing Slides
27/71
Dominators
-
7/28/2019 0knowledge Fuzzing Slides
28/71
Implicitloops
-
7/28/2019 0knowledge Fuzzing Slides
29/71
REIL
-
7/28/2019 0knowledge Fuzzing Slides
30/71
Thisone
-
7/28/2019 0knowledge Fuzzing Slides
31/71
tothisone
-
7/28/2019 0knowledge Fuzzing Slides
32/71
Isthatenough?
-
7/28/2019 0knowledge Fuzzing Slides
33/71
-
7/28/2019 0knowledge Fuzzing Slides
34/71
Addyourown
Forsta5canalysisweuse
-
7/28/2019 0knowledge Fuzzing Slides
35/71
-
7/28/2019 0knowledge Fuzzing Slides
36/71
Ques5ons!
-
7/28/2019 0knowledge Fuzzing Slides
37/71
DataTain5ng
-
7/28/2019 0knowledge Fuzzing Slides
38/71
Example
Taint
SourceTaint
mark
movl 0x4[eax], ebx
-
7/28/2019 0knowledge Fuzzing Slides
39/71
Dytan
-
7/28/2019 0knowledge Fuzzing Slides
40/71
PIN
-
7/28/2019 0knowledge Fuzzing Slides
41/71
Taintsources
-
7/28/2019 0knowledge Fuzzing Slides
42/71
Markingsgranularity
-
7/28/2019 0knowledge Fuzzing Slides
43/71
-
7/28/2019 0knowledge Fuzzing Slides
44/71
Output
Registers Memoryloca5ons
-
7/28/2019 0knowledge Fuzzing Slides
45/71
DEMO
-
7/28/2019 0knowledge Fuzzing Slides
46/71
Ques5ons!
-
7/28/2019 0knowledge Fuzzing Slides
47/71
In-memoryfuzzing
-
7/28/2019 0knowledge Fuzzing Slides
48/71
Example
rep movs
esi=0x30f064
esi=0x30f0A4
Originalloc
Fuzzedloc
-
7/28/2019 0knowledge Fuzzing Slides
49/71
Why?
-
7/28/2019 0knowledge Fuzzing Slides
50/71
Problems
-
7/28/2019 0knowledge Fuzzing Slides
51/71
Exper5seandpa5ence
M i bili
-
7/28/2019 0knowledge Fuzzing Slides
52/71
Memoryinstability
-
7/28/2019 0knowledge Fuzzing Slides
53/71
Falseposi5ves
-
7/28/2019 0knowledge Fuzzing Slides
54/71
Falsenega5ves
-
7/28/2019 0knowledge Fuzzing Slides
55/71
Muta5onloopinser5on
-
7/28/2019 0knowledge Fuzzing Slides
56/71
Snapshotmuta5onrestora5on
-
7/28/2019 0knowledge Fuzzing Slides
57/71
Whatdowedo?
Hookimage Hookfunc5ons Hookinstruc5ons Hook
-
7/28/2019 0knowledge Fuzzing Slides
58/71
Firstapproach
-
7/28/2019 0knowledge Fuzzing Slides
59/71
Forinstance
30f064-30f068
ABCD 0x8aY0x00
K
-
7/28/2019 0knowledge Fuzzing Slides
60/71
Secondapproach
-
7/28/2019 0knowledge Fuzzing Slides
61/71
Example
30f064-30f068
ABCD
30f084-30f098
0x89KDF0x96
0x00KUYW0xA7
0xB80x000x10ATN
0x000xD3
-
7/28/2019 0knowledge Fuzzing Slides
62/71
Codecoverage
-
7/28/2019 0knowledge Fuzzing Slides
63/71
Score
BBexecuted/BBtotal
BasicBlocks
executedTotalBasic
Blocks
-
7/28/2019 0knowledge Fuzzing Slides
64/71
Hal5ng
Cevil=Cgood+t
Codecoverage
evilsample
Codecoverage
goodsample
User-supplied
threshold
-
7/28/2019 0knowledge Fuzzing Slides
65/71
How??
Goodsample
Score
Evilsample
ScoreCompare
-
7/28/2019 0knowledge Fuzzing Slides
66/71
Whatdoweuse?
Codecoverage Faultsmonitor
-
7/28/2019 0knowledge Fuzzing Slides
67/71
DEMO
-
7/28/2019 0knowledge Fuzzing Slides
68/71
FutureAreasoner
-
7/28/2019 0knowledge Fuzzing Slides
69/71
Thanks
-
7/28/2019 0knowledge Fuzzing Slides
70/71
Ques5ons!
-
7/28/2019 0knowledge Fuzzing Slides
71/71
MoreInfo
viozzo.wordpress.com
@_snagg