{"id":3270,"date":"2021-07-01T13:01:37","date_gmt":"2021-07-01T11:01:37","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=3270"},"modified":"2023-12-24T12:47:14","modified_gmt":"2023-12-24T11:47:14","slug":"analyze-code-coverage-to-improve-fuzzing","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=3270","title":{"rendered":"Analyze code coverage to improve fuzzing"},"content":{"rendered":"\n

Bugs can only be found dur\u00adring fuzzing code, which is exe\u00adcut\u00aded. But which parts of the code of a tar\u00adget sys\u00adtem is exe\u00adcut\u00ading dur\u00ading a fuzzing ses\u00adsion? And how we can improve our fuzzer to include also tests for code blocks which weren\u2019t cov\u00adered before?<\/p>\n\n\n\n

Dynamorio<\/h2>\n\n\n\n

We\u2019ll use now Dynamor\u00adio<\/a> \u2014 a run\u00adtime code manip\u00adu\u00adla\u00adtion sys\u00adtem \u2014 to analyse which code we have exe\u00adcut\u00aded in a first run. Then, we\u2019ll analyse how we can trig\u00adger more code. We could use this infor\u00adma\u00adtion to improve our Fuzzer<\/a>.<\/p>\n\n\n\n

As test appli\u00adca\u00adtion, we\u2019re using a sim\u00adple Go web serv\u00ader, which deliv\u00aders a sta\u00adt\u00adic string for requests to \/foundme and a error mes\u00adsage else. Here is the code:<\/p>\n\n\n\n

package main\n\nimport (\n    \"fmt\"\n    \"log\"\n    \"net\/http\"\n)\n\nfunc helloHandler(w http.ResponseWriter, r *http.Request) {\n    if r.URL.Path != \"\/foundme\" {\n        http.Error(w, \"404 not found.\", http.StatusNotFound)\n        return\n    }\n    fmt.Fprintf(w, \"You found me!\")\n}\n\n\nfunc main() {\n    http.HandleFunc(\"\/foundme\", helloHandler)\n\n    fmt.Printf(\"Starting server at port 8080\\n\")\n    if err := http.ListenAndServe(\":8080\", nil); err != nil {\n        log.Fatal(err)\n    }\n}<\/pre>\n\n\n\n
Pre\u00adreq\u00adui\u00adsites:<\/p>\n\n\n\n
    \n
  1. Build the web\u00adserv\u00ader with go build webserver.go<\/code> to get an executeable.<\/li>\n\n\n\n
  2. Down\u00adload Dynamor\u00adio<\/a><\/li>\n\n\n\n
  3. Down\u00adload Dynap\u00adstalk\u00ader<\/a><\/li>\n\n\n\n
  4. Down\u00adload IDA<\/span> free<\/a><\/li>\n<\/ol>\n\n\n\n
    Ok, let\u2019s go:<\/p>\n\n\n\n
      \n
    1. Start drrun from Dynamor\u00adio and exe\u00adcute the pre\u00advi\u00adous\u00adly com\u00adpiled web\u00adserv\u00ader with\u00adin with
      \/opt\/DynamoRIO-Linux-8.0.0-1\/bin64\/drrun -t drcov -dump_text -- webserver<\/code>
      and per\u00adform some requests. Exit the process via CTRL<\/span>+C.
      <\/li>\n\n\n\n
    2. The direc\u00adto\u00adry now con\u00adtains a log file like drcov.webserver.01693.0000.proc.log<\/code>.<\/li>\n\n\n\n
    3. Con\u00advert this file with Dynap\u00adstalk\u00ader into a IDC<\/span> script file IDA<\/span> can read:
      python \/opt\/dynapstalker\/dynapstalker.py drcov.webserver.01693.0000.proc.log webserver webserver.idc 0x00ffff<\/code><\/li>\n\n\n\n
    4.  Open the exe\u00adcutable in IDA<\/span> and load the gen\u00ader\u00adat\u00aded IDC<\/span> file via File -> Script com\u00admand<\/em>. The blocks are now in the giv\u00aden color.<\/li>\n\n\n\n
    5. Think how to genare input which would go into oth\u00ader code parse and repeat.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"
      Bugs can only be found dur\u00adring fuzzing code, which is exe\u00adcut\u00aded. But which parts of the code of a tar\u00adget sys\u00adtem is exe\u00adcut\u00ading dur\u00ading a fuzzing ses\u00adsion? And how we can improve our fuzzer to include also tests for code blocks which weren\u2019t cov\u00adered before? Dynamor\u00adio We\u2019ll use now Dynamor\u00adio \u2014 a run\u00adtime code manipulation [\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[470],"tags":[413,412,231],"class_list":["post-3270","post","type-post","status-publish","format-standard","hentry","category-active-enum","tag-code-coverage","tag-dynamorio","tag-fuzzing"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/3270","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3270"}],"version-history":[{"count":10,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/3270\/revisions"}],"predecessor-version":[{"id":3787,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/3270\/revisions\/3787"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3270"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3270"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3270"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}