6 ms·
I wish someone would release something like Fuzzing At Home. I've got computer power to throw at it, but I don't really have the expertise to do the setup work.
by epmatsw 10y ago
I wish someone would release something like Fuzzing At Home. I've got computer power to throw at it, but I don't really have the expertise to do the setup work...
- runeks 10y agoThe last time I tried to compile an executable using all the afl fuzzer magic-compile-time stuff, I gave up, so I have the impression that CPU time isn't the bottleneck here.
- quentusrex 10y agoIt took me a day to understand the tooling required to get AFL working. Now I can spin up a new test case for a library within a couple hours. Once you have the test case, then it is CPU bound. I had on one series of tests, of the baresip sip library libre, running across 4 machines(24 cores each) for a day before it was 100% sure it had tested every code path looking for a SIP protocol decoding error through fuzzing.
- voltagex_ 10y agoHow did you split up the work across the machines?
- justinclift 10y agoAFL has documentation on how to setup that up. eg: https://github.com/mcarpenter/afl/blob/master/docs/parallel_fuzzing.txt
- epmatsw 10y agoThis is part of my problem. The other part is that I just don't know where to look. I'd much rather have some board choose submitted areas of open source projects, have the submitter/community create a harness, and then run something like Folding@home in a Docker container.
- hannob 10y agoComputing power isn't the bottleneck of fuzzing. It's being smart about choosing your targets, tools and seeds. My rule of thumb: It's very rare that I see any results beyond running a fuzzing job on an average machine for a day.