fuzzer/stress.py

I wrote a fuzzer specific to hachoir-metadata: fuzzer.

Algorithm:

  1. Load first n kilobytes of a valid byte
  2. Replace some bytes (1..250) with random value
  3. Try to extract metadata on this buggy file

To detect an error, stress.py is connected to Hachoir logs. It only watchs error messages and filter them.

Features:

  • Set memory limit to avoid crash of the fuzzer
  • Read extraction time to catch "timeout" error
  • Use directly hachoir-metadata library

First version of the program was a shell script written by Krunch using mangle.c written by Ilja van Sprundel.

hachoir-fuzzer

The idea

Writting a fuzzer needs a good knowledge about file format and structure. Hachoir have this knowledge, so it can be used to write powerful fuzzer.

What is fuzzing? Ask Wikipedia ;-)

Length fuzzer

Most developers don't check field length, eg. GDI+ JPEG secure hole for comment with nul size. So test:

  • content bigger than announced length
  • content smaller than announced length
  • nul length
  • very big length

Contraints

Types of constraints:

  • List of valid values: valid=[5, 4, 20] for Int8
  • List of invalid values: invalid=[0, 15] for Bits(4)
  • Simple condition: (value % 4) == 0
  • Complex condition: ((value | 6) + (value % 4)) & 7 == 1

Now, another problem: how to produce invalid value? Simple algorithm: generate a random value and test if it valid.

  • valid=[5, 4, 20] for Int8 ==> invalid=[0, 1, 2, 3, 6, 7, 8, ..., 19, 21, 22, ..., 255]
  • (value % 4) == 0 ==> maybe randint(0, max) * 4 + randint(0, 3) with max=max(type)/4

Operations

  • delete a field
  • insert a field
  • move a field

Known attacks

  • String: Format string attack
  • Integer: negative number, zero, one, 0xFFFF and other "special" values
  • Bytes: Random content

Type of attack

Attack class:

  • Attack on one parameter
  • Attack on file structure (field position and value)
  • Attack on linked parameters (one parameter which depends on another one)
  • Attack on length fields

Program functions

fuzzing module will also need:

  • loggin features: to keep historic of attacks

hachoir-valid

This program will check that a file is valid against the format standart.

Problems:

  • Learn format using many files or use static rules (XML schema)?
  • May be very slow (depends on quantity of field that are checked)

Recent attacks

Other:

See also