3 ms·
I wonder if you could use AFL to try to fuzz your way to a shorter executable? There may be undocumented glitches or assumptions in how exactly the loader works
by gwern 3y ago
I wonder if you could use AFL to try to fuzz your way to a shorter executable? There may be undocumented glitches or assumptions in how exactly the loader works which would shave some bytes off (and given how fundamental this is, any hits might also be major security vulnerabilities).
- LegionMammal978 3y agoWell, I've already gone through every undocumented assumption possible in the kernel's loader. It's simple enough that there really are some hard, clear requirements you can establish for what it will refuse to load (or at least, usefully load; there are several combinations that will make the loader succeed but not actually map any executable memory, or that map memory but fail to place the entry point into it, resulting in an instant segfault). Showing that these requirements rule out anything smaller than offset 0xc for the program header is the subject of my unpublished longer article. As for the program itself, 36+ free bytes is quite a lot of space to search exhaustively, and I haven't been able to find any x86 emulator that implements every actual behavior, or allows very rapidly resetting the state. Fuzzing might be more useful for something like the dynamic loader, which has far more features than the kernel loader, and is far more eager to read user-supplied data.