1-Click-Fuzz：Systematically Fuzzing the Windows Kernel Driver with Symbolic Execution.
summary
1-Click-Fuzz combines a static analyzer plus symbolic execution with angr to extract IRP field constraints and global-variable dependencies, then generates randomized IRPs and sequence mutations to reach hidden code paths. A demo finds a stack overflow in an EDR kernel driver in seconds; the pipeline discovers over 100 unique vulnerabilities across vendors (Microsoft, AMD, antivirus). It supports snapshot-based, stateful fuzzing but currently targets WDM drivers and hits path-explosion and un-emulated API limitations.
AI-written summary · about
chapters (13)
- 0:00Introduction to kernel fuzzing
- 1:25Importance of driver security
- 2:54Windows driver architecture
- 5:30Handling I/O control requests
- 8:31Challenges in fuzzing drivers
- 10:23Demo of msFuzz framework
- 13:44Design and static analysis
- 16:44Managing global dependencies
- 18:26Real-world vulnerability cases
- 20:59Automating crash analysis
- 22:42Research results and findings
- 24:03Future work and conclusion
- 26:04Q&A session
related talks
46mFor The Win: The Art Of The Windows Kernel Fuzzing
50mWhat the Fuzz
54mMy Fuzzy Driver
42mCPU Fuzzing: Automatic Discovery of...
32mEnhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis
21mFUZE: Towards Facilitating Exploit Generation for Kernel UAF Vulnerabilities
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
53mThree Colours of Fuzzing: Reflections and Open Challenges