Date: Wed, 18 Mar 2015 15:12:07 +0300 From: Alexander Cherepanov <ch3root@...nwall.com> To: john-dev@...ts.openwall.com Subject: Re: Extend AFL to fuzz as you want On 2015-03-15 02:55, Kai Zhao wrote: >> XML is sure not convenient but it is powerful > > Sorry I forgot to describe why XML is powerful. XML can handle > complex formats, such as 7z format. The 7z format is as follow: > > $7z$0$19$0$1122$8$d1f50227759415890000000000000000$1412385885$ data_length > $112$ data > > The valid() function require strlen(data) == data_length * 2. > > Complex hash formats like 7z can be handled with XML. But it's > impossible for the expression like "$siemens-s7$1$%40h$%40h". I think > the expression is good but it can handle complex hash format. > > If we want to fuzz valid(), the expression like > "$siemens-s7$1$%40h$%40h" is ok. If we want to fuzz functions after > valid(), the expression can not do that. Neither bare XML nor scanf-like format strings can express such relations. But you can add support for it on top of both of them. E.g., add to format strings something like numbered groups from regexes: "...$%1l%...$(%B)" where %1l means the length of the 1st group. It's theoretically possible but I don't say that we should support it. I think that, for a start, we should review which building blocks we have in our hashes (hex, base64 etc.). Then we have to decide which we want to support. I'm leaning to the idea that we don't want to support such complex relations between parts of a hash at all. I think this is a general question to be discussed in john-dev, not limited by the needs of fuzzing or security in general. Talking specifically about fuzzing, when you want to fuzz functions behind the valid() it's easier to patch this specific check out of valid() for now. -- Alexander Cherepanov
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.