Date: Sat, 07 Mar 2015 15:50:26 +0100 From: Frank Dittrich <frank.dittrich@...lbox.org> To: john-dev@...ts.openwall.com Subject: Re: Any advice on how to fuzz john jumbo by AFL On 03/07/2015 02:30 PM, Solar Designer wrote: > On Sat, Mar 07, 2015 at 09:22:30PM +0800, Kai Zhao wrote: >> john jumbo is robust > > I wish this were the case, but it definitely is not. > > I'd like Alexander Cherepanov to comment on this, as he'd need to > (co-)mentor this project. His custom fuzzer was spewing bugs in jumbo > before, and there's no indication we ran out of those - in fact, we > certainly introduced new bugs since then. 1.8.0-jumbo-1 definitely had several issues. But after the 1.8.0-jumbo-1 release, I discovered and reported lots of such issues, and Jim fixed them all, IIRC. See, for instance, https://github.com/magnumripper/JohnTheRipper/search?q=segfault&type=Issues&utf8=%E2%9C%93 I used Alexander's fuzzing scripts, or slightly modified versions of his scripts. So, I think, the situation is now (latest bleeding-jumbo) way better than it has been for 1.8.0-jumbo-1. There might have been new bugs introduced meanwhile, and the GPU formats didn't get tested that much, so these might still have some more bugs, even though there was some effort to unify the CPU and GPU format implementations of valid(), prepare(), etc. Plus, LUKS format is probably still buggy, but there are more important things to be addressed for this format, see https://github.com/magnumripper/JohnTheRipper/issues/557 Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.