3

Are there any tools capable of automatically fuzzing Linux shared libraries, by automatically I mean detect exported function, determine function signature and finally inject random data ?

Can frameworks like Sulley or Peach perform this type fuzzing if we provide it information like function signature ?

  • I doubt the usefulness. You can easily fuzz and "break" a bunch of standard library functions, because many assume the input will be in some specified form and will just not work with arbitrary input. – domen Feb 28 '14 at 16:30
  • Indeed, in several cases it won't be useful, I'm however faced with a situation where it is useful, for example libraries that handle video file decoding. The argument is for instance a FILE in memory. – 3asm_ Feb 28 '14 at 16:40
  • You can't make it generic then, since at least one argument is not just a random value, but a FILE in memory, as you said. – domen Feb 28 '14 at 16:49
  • Using something like caca.zoy.org/wiki/zzuf would probably be much easier in your case. You could set it up to just corrupt the files as they are read. – domen Feb 28 '14 at 16:49
2

No, or at least not in a way that gives any useful information.

The problem lies in step 2, "determine function signature". The vast majority of shared libraries are written in C, or are written in other languages but still use the cdecl calling convention. In such a case, the function signature contains no information about the types or even number of parameters -- the type and number aren't even fixed (consider printf()). You could try deducing it by static analysis, but variable argument counts, type-punning, and overly-clever assembly-language programmers will tend to thwart the analysis.

You could certainly crash a library function by placing random data on the stack and then calling the function, but this won't usually give you any useful information about vulnerabilities: the random data will almost never correspond to a situation that could be set up in real-world use. You'll wind up deducing things like "if I pass two random pointers to strcpy(), it crashes", or "If I don't pass enough parameters to printf(), it crashes".

3

LLVM's LibFuzzer might be helpful. It is a toolkit to help with in-process fuzzing of libraries.

It does not solve the problem of automatically identifying function signatures of each exported function and injecting random data of the appropriate type to each. Instead, it expects you to write a small test harness of your own that invokes the exported function with data of the appropriate type, so that part you have to do manually. However, if you do that part manually, it automates the rest of the fuzzing job, using techniques similar to American Fuzzy Lop (the AFL fuzzer).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.