fuzzing | research proposals , and other resources | Animation library

To answer my own question:

Yes, that's how API fuzzing can be done. For consuming the data bytewise the functions provided by libFuzzer #include (C++) could be used. Problem with this: The crash dump and fuzzer corpus won't be human readable.

For a more readable fuzzer, implementing a structure aware custom data mutator for libFuzzer is beneficial.

I used the premade data mutator libprotobuf-mutator (C++) to fuzz the example API. It generates valid input data based on a protocol buffer definition and not just (semi) random bytes. It does make the fuzzing a bit slower though. The bug in the given contrived example API was found after ~2min, compared to ~30secs with the basic byte consuming setup. But I do think that it would scale much better for larger (real) API's.

You can use the --seed parameter when calling minitest or the SEED environment variable, [source code](https://github.com/seattlerb/minitest/blob/fe3992e85b40792cf7bff2a876887d8d9e392068/lib/minitest.rb#L190

Whitebox fuzzing can be done not only with symbolic execution. SAGE from Microsoft Research is an example of a whitebox fuzzer that uses concolic execution, also called dynamic symbolic execution, see NDSS08.

Yes, Whitebox Fuzzers get some seed/seeds (initial input/inputs) and symbolically execute the code with these. Concolic fuzzers also run the code with these inputs in parallel with symbolic execution.

KLEE is a whitebox fuzzer that uses symbolic execution.

AFL is a greybox fuzzer - it uses internal structure information only to calculate coverage and not to get new paths. There are tools for AFL that get constants from comparisions in the code and add these to AFLs dictionaries, but this is still not whitebox fuzzing.

The syn crate made a breaking change in version 1.0.58, when it renamed a module that was not meant to be used by other crates. The enum_dispatch crate was one that erroneously was using this module and thus was broken but later fixed in version 0.3.5 (see the relevant issue).

I don't know where exactly in your dependency tree syn and enum_dispatch sit, but I recommend updating enum_dispatch to a newer version.

You've tried to upgrade the version of QEMU that afl-qemu uses. Because afl-qemu makes modifications to QEMU's source, this is not a trivial thing to do. In particular, these commands that you commented out:

This sounds like you're using an old version of python, specifically a version 3.5 or earlier.

What does python3 --version say?

If possible, you should upgrade to a version of python 3.6 or higher, as python 3.5 is no longer supported.

If that isn't possible, don't use f-string syntax. Instead, you could do something like this:

How would I be able to find the function that reads from stdin?

In general, your question is equivalent to the halting problem. Consider this function:

All the threads run to completion. That's the point of the lesson. When multiple threads access the same variable simultaneously, you can get unexpected results.

I've modified the code slightly to print less distracting stuff and also a thread id. I think this should help clarify what is happening:

Lets say you read bytes (uint8_t) from a stream and want to pass the data to your function foo.

The steps to follow:

• are you sure you read serialized information of your datatype A?
• are you sure to have read at least sizeof(A) bytes?
• are you sure your type A is (trivially) serializable? (e.g. what if A contains a pointer to another object)

then