Hourglass Fuzz: A Quick Bug Hunting Method
summary
Hourglass Fuzz is a system that funnels normal user activity through an hourglass bottleneck to force inputs into deep kernel and user-mode paths. It runs on real devices (tested on Pixel 3 Android 9), deploys a user-space agent, a controller/monitor, kernel interceptors, ADB logging, and KASAN to collect crashes and tombstones. The pipeline produces reproducible crashes: several 0day bugs in graphics and Bluetooth are found and replayed, and an automated reproducer saves the exact input streams.
AI-written summary · about
chapters (31)
- 0:00Intro
- 2:34Pain point
- 5:32Hourglass Fuzzing Philosophy
- 9:00User Space Fuzzing
- 9:42Attack Interface --- selection
- 11:14Bluetooth - Architecture in brief
- 11:46Bluetooth -- Module View
- 12:48Bluetooth -- Source Tree
- 14:03Bluetooth -- Architecture in detail
- 15:55Bluetooth -- Startup work flow
- 20:14Bluetooth ----Packet Structure & Common Dispatcher
- 27:32Bluetooth --- Target functions
- 27:50Sanitizer Support
- 28:45Fuzzer Overview
- 29:47Fuzzing Strategy
- 33:49Best Practice
- 35:48Kernel Space Fuzzing
- 36:09Introduction
- 36:51How to achieve passive fuzz
- 38:16How to transfer the filter list
- 39:31Fuzzing strategies
- 40:40What do we need to prepare
- 41:58Build kernel issues
- 46:49KGSL in detail
- 50:04Solution Overview
- 52:22Panic call stack
- 52:39How to make it automatic
- 52:55Fuzz status statistics
- 54:21Install and run different kinds of 3D games
- 55:32add a for loop
- 56:40Case 1
related talks
45mFuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In Android
13mFully Automated Functional Fuzzing of Android Apps for Detecting Non-Crashing Logic Bugs
31m“Fuzz or lose..."
50mWhat the Fuzz
25mHow fuzzing helps to find bugs
44mOSS-Fuzz - Google's continuous fuzzing service for open source software
39mFuzzing Session: Finding Bugs and Vulnerabilities Automatically
29mEvent-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug