Bugs can only be found dur­ring fuzzing code, which is exe­cut­ed. But which parts of the code of a tar­get sys­tem is exe­cut­ing dur­ing a fuzzing ses­sion? And how we can improve our fuzzer to include also tests for code blocks which weren’t cov­ered before?

Dynamorio

We’ll use now Dynamor­io — a run­time code manip­u­la­tion sys­tem — to analyse which code we have exe­cut­ed in a first run. Then, we’ll analyse how we can trig­ger more code. We could use this infor­ma­tion to improve our Fuzzer.

As test appli­ca­tion, we’re using a sim­ple Go web serv­er, which deliv­ers a sta­t­ic string for requests to /foundme and a error mes­sage else. Here is the code:

package main

import (
    "fmt"
    "log"
    "net/http"
)

func helloHandler(w http.ResponseWriter, r *http.Request) {
    if r.URL.Path != "/foundme" {
        http.Error(w, "404 not found.", http.StatusNotFound)
        return
    }
    fmt.Fprintf(w, "You found me!")
}


func main() {
    http.HandleFunc("/foundme", helloHandler)

    fmt.Printf("Starting server at port 8080\n")
    if err := http.ListenAndServe(":8080", nil); err != nil {
        log.Fatal(err)
    }
}

Pre­req­ui­sites:

1. Build the web­serv­er with go build webserver.go to get an executeable.
2. Down­load Dynamor­io
3. Down­load Dynap­stalk­er
4. Down­load IDA free

Ok, let’s go:

1. Start drrun from Dynamor­io and exe­cute the pre­vi­ous­ly com­piled web­serv­er with­in with
   /opt/DynamoRIO-Linux-8.0.0-1/bin64/drrun -t drcov -dump_text -- webserver
   and per­form some requests. Exit the process via CTRL+C.
   
2. The direc­to­ry now con­tains a log file like drcov.webserver.01693.0000.proc.log.
3. Con­vert this file with Dynap­stalk­er into a IDC script file IDA can read:
   python /opt/dynapstalker/dynapstalker.py drcov.webserver.01693.0000.proc.log webserver webserver.idc 0x00ffff
4. Open the exe­cutable in IDA and load the gen­er­at­ed IDC file via File -> Script com­mand. The blocks are now in the giv­en color.
5. Think how to genare input which would go into oth­er code parse and repeat.