Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 16 Mar 2015 17:38:18 +0100
From: magnum <john.magnum@...hmail.com>
To: john-dev@...ts.openwall.com
Subject: Re: Change john to fuzz fast with AFL

On 2015-03-16 17:02, Kai Zhao wrote:
> I am trying to make it fast to fuzz with AFL. I changed something like
> encryption and
> decryption. But I wonder should I change the function below ?

> I found the s7_set_key() invoked frequently, and the memcpy() wastes time.
> So can I pass the
> memcpy() ? Such as below:
> 
> static void s7_set_key(char *key, int index)
> {
>     int saved_key_length = strlen(key);
>     if (saved_key_length > PLAINTEXT_LENGTH)
>     saved_key_length = PLAINTEXT_LENGTH;
> 
> #ifndef AFL_FUZZING
> 
>     memcpy(saved_key[index], key, saved_key_length);
> 
> #endif
> 
>     saved_key[index][saved_key_length] = 0;
>     new_keys = 1;
> }
> 
> If I can do this and finally find a segment fault bug, Is that a really bug
> ? ( I am not sure because the source code are different when fuzzing )

This does not make any sense to me!

You'll get low-hanging fruit by constructing input files with broken
syntax, that should be rejected by valid() but isn't, and then causes
more or less trouble. You already did this so you know the drill. I
suspect the vast majority of our formats has problems like that, but the
possible consequences vary.

Other routes include finding command-line options or options' arguments
that cause problems. Or any other form of input that does, for example
john.conf settings.

magnum

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ