[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 07 Mar 2015 15:50:26 +0100
From: Frank Dittrich <frank.dittrich@...lbox.org>
To: john-dev@...ts.openwall.com
Subject: Re: Any advice on how to fuzz john jumbo by AFL
On 03/07/2015 02:30 PM, Solar Designer wrote:
> On Sat, Mar 07, 2015 at 09:22:30PM +0800, Kai Zhao wrote:
>> john jumbo is robust
>
> I wish this were the case, but it definitely is not.
>
> I'd like Alexander Cherepanov to comment on this, as he'd need to
> (co-)mentor this project. His custom fuzzer was spewing bugs in jumbo
> before, and there's no indication we ran out of those - in fact, we
> certainly introduced new bugs since then.
1.8.0-jumbo-1 definitely had several issues.
But after the 1.8.0-jumbo-1 release, I discovered and reported lots of
such issues, and Jim fixed them all, IIRC.
See, for instance,
https://github.com/magnumripper/JohnTheRipper/search?q=segfault&type=Issues&utf8=%E2%9C%93
I used Alexander's fuzzing scripts, or slightly modified versions of his
scripts.
So, I think, the situation is now (latest bleeding-jumbo) way better
than it has been for 1.8.0-jumbo-1.
There might have been new bugs introduced meanwhile, and the GPU formats
didn't get tested that much, so these might still have some more bugs,
even though there was some effort to unify the CPU and GPU format
implementations of valid(), prepare(), etc.
Plus, LUKS format is probably still buggy, but there are more important
things to be addressed for this format, see
https://github.com/magnumripper/JohnTheRipper/issues/557
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
