3 ms·
How does the fuzzer actually work? Is the data really just a completely random string (array of bytes) over and over again, or is there something else? Does it
by krick 10y ago
How does the fuzzer actually work? Is the data really just a completely random string (array of bytes) over and over again, or is there something else? Does it just chose random byte random number of times for each input, or there is some more sophisticated logic in how exactly does it chose the "random input"?
- deleted 10y ago[deleted]
- chongli 10y agoIt helps to have a bunch of pre-defined strings that you know are problematic, such as extremely long strings or strings that use ASCII codes or escape characters in weird ways. Trying all of those before moving on to purely random strings can help. Taking things a bit further, you can log the purely random strings that are known to cause problems and then add them to the list of things to try in the future.
- komon 10y agoNot super sure on the actual workings of cargo's fuzzing, but IIRC, afl-fuzz works by analyzing the memory of the fuzz-ee and using evolutionary algorithms to evolve the input in order to create as many new memory states as it can
- lbrandy 10y agolibfuzzer (and many of the fuzzers used widely today) is a coverage (as in, code-coverage) directed fuzzer. So it's not just randomly mutating the input, but "selecting" for random inputs that happen to light up new code paths. It works with a (or generates a random) corpus, and prefers the sample inputs that light up new code paths in subsequent mutations of the population.
- Manishearth 10y agoIt looks at the codepaths taken and tries to trigger new ones. It's an evolutionary algorithm where it prefers to use new interesting strings that trigger new codepaths as a base for subsequent mutation.