4 ms·
I'm one of the engineers behind Jazzer and happy to answer any questions about it. We also have a blogpost that talks about the most interesting technical aspe
by fhenneke 6y ago
I'm one of the engineers behind Jazzer and happy to answer any questions about it.
We also have a blogpost that talks about the most interesting technical aspects of Jazzer: https://blog.code-intelligence.com/engineering-jazzer https://blog.code-intelligence.com/engineering-jazzer
- layer8 6y agoI couldn’t find any information on what specific kinds of errors are recognized (except JNI memory handling), or how (mechanism) one specifies to the tool what constitutes an error. Can you shed some light on that, or give a pointer to relevant documentation?
- fhenneke 6y agoBy default, uncaught exceptions and memory issues in JNI libraries are reported as "crashes". Additionally, Jazzer provides a hooking framework that can be used to implement domain-specific sanitizers for logic bugs. See https://blog.code-intelligence.com/engineering-jazzer#user-content-custom-method-hooks https://blog.code-intelligence.com/engineering-jazzer#user-c... for an example. Part of the reason for open-sourcing Jazzer has been to get the discussion started on what kind of "sanitizers" are needed to unlock the full potential of Java fuzzing.
- layer8 6y agoThanks!
- fhenneke 6y agoIf you want to fuzz a Java web app, our commercial platform CI Fuzz (of which Jazzer is one part) has built-in detectors for the typical vulnerabilities such as SQL injections: https://blog.code-intelligence.com/sql-fuzzing https://blog.code-intelligence.com/sql-fuzzing
- saagarjha 6y agoPsst… > The trampoline first pushes an address pointing to the addr & 0xFFF-th entry in a "sled" of 0xFFF=4096 ASM ret instructions to the (native) stack and then performs a direct jump (also called a "tail call") to the sanitizer callback. 0xFFF=4095 ;)
- fhenneke 6y agoGood catch, thanks ;-) I will update the post.