What the Fuzz
summary
A binary-only, coverage-guided hypervisor fuzzer uses Intel PT traces and implements Fast VM reloads to reach up to 6,000 VM reloads/sec and sustain as many as 145 executions/sec on a Windows workload; this approach yields faster binary fuzzing without source instrumentation. A floppy-boot live demo exercises a custom agent and uncovers roughly 50 bugs with about 40 CVEs assigned. Framework components (KFL/Red Queen and agents), demos and code are slated for release.
AI-written summary · about
chapters (19)
- 0:00Intro
- 3:11How do Fuzzer Work?
- 9:26Architecture
- 14:08Intel Processor Trace
- 15:07Nyx - One Input
- 16:20Nyx - Performance
- 17:46Reset Device State
- 18:15Reset Memory
- 18:34Reset Hard Disk
- 22:26Harnesses
- 26:31Specify Test Scenarios
- 27:33Interactive Targets
- 34:07Fuzzing
- 36:57A Better Tool...
- 39:18Root Cause Analysis
- 40:27Heap Feng Shui
- 41:27Code that doesn't run?
- 42:52AntiFuzz
- 44:45Key Takeaways
related talks
28mkAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
29mVirtual Device Fuzzing Support in QEMU
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
46mFor The Win: The Art Of The Windows Kernel Fuzzing
42mCPU Fuzzing: Automatic Discovery of...
34m1-Click-Fuzz：Systematically Fuzzing the Windows Kernel Driver with Symbolic Execution.
46mBypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL
01h 15mMake your programs more reliable with Fuzzing