4 ms·
I wonder, instead of an AST-generating fuzzer, if they could have used AFL on an instrumented binary that may find more possibilities since it just works on pat
by kodablah 8y ago
I wonder, instead of an AST-generating fuzzer, if they could have used AFL on an instrumented binary that may find more possibilities since it just works on paths and bytes without being constrained by what this fuzzer knows are certain constructs.
- ygra 8y agoCan you easily run AFL on .NET (or jitted) code? My understanding was that AFL works by instrumenting paths taken and kinda needed a gcc-produced binary with normal Linux debug symbol stuff.
- 0xad 8y agoWhat AFL needs is _instrumentation_ and of course the easiest way is to get that at compilation step, however you are not constrained by anything to get that part via other means. Check https://github.com/ivanfratric/winafl https://github.com/ivanfratric/winafl that uses DynamoRIO. So, to answer your question -- it wouldn't be easy but it can be done.
- matthewwarren 8y agoThe .NET Profiling API gives you a way to modify IL code before it's JITted, so that could be one way to do this. See http://mattwarren.org/2018/08/21/Monitoring-and-Observability-in-the-.NET-Runtime/#profiling http://mattwarren.org/2018/08/21/Monitoring-and-Observabilit... for a bit more info ('SetILFunctionBody() API')
- kodablah 8y agoI think there are Windows and VM-based approaches, but it probably isn't to difficult to mimic what AFL does on the CLR.