phed.org » Tool

Using Code Coverage to Select Fuzzing Sample Files

meddington — Mon, 01 Nov 2010 21:39:54 +0000

Note: This article covers features in Peach 2.3.7 which is currently in SVN.

Selecting good sample files to use when performing file fuzzing can make all the difference. However, simply tossing several thousand files into a folder and calling it a day doesn’t make allot of sense. Instead we can use code coverage to select the minimum number of files to get the most coverage from our target. Peach includes a tool called “minset” to perform this task for us.

The minset tool is located in “c:\peach\tools\minset” and contains a test setup that can be run by saying “test.bat”.

Minset has several modes of operation, from simple to more complex. We will first cover the simplest usage.

Simple Usage Example

Syntax:

minset [-k] –s samples -m minset command.exe %s

-k Optional argument when using graphical programs that do not automatically close
-s samples This is the folder containing sample files to get coverage of
-m minset This is the folder to place the minimum set of files into
command.exe The target executable to run
%s Any arguments and also a placeholder for the filename (%s)

This usage will try all files specified by “samples” and place the minimum set of them into the folder “minset”. The target command will get run as “command.exe filename”.

Example Usage – Command Line Target:

minset -s samples\*.png -m minset bin\pngcheck.exe %s

Example Usage – Graphical Target:

minset –k -s docs\*.doc -m minset "C:\Program Files (x86)\Microsoft Office
Office14\winword.exe" %s

Depending on the complexity of the target program, this type of code coverage can take a while.

Separated Tracing and Coverage Analysis

For complex programs, or when performing coverage on a large set of files you may want to distribute the task across several machines. To support this minset is able to run just the coverage trace separate from the analysis portion. This allows running coverage traces on multiple machines then running the analysis on the results.

Running Minset in Coverage Trace Mode

minset [-k] –s samples –t traces command.exe args %s

This command line will perform coverage traces using the sample files in “samples” and place the resulting traces into the folder “traces”. This is the part you will want to distribute.

Running Minset in Analysis Mode

minset –s samples –t traces –m minset

All of your generated traces must be in “traces” and all of the sample files in “samples”. Minset will perform the coverage analysis and place the minimum set of files into “minset”.

Normally the analysis process is not distributed, however for especially large sets of sample files you may wan to run the analysis after collecting traces on every node then combining the resulting minsets for a final pass.

Peach Fuzzing Framework 1.0

meddington — Wed, 31 Jan 2007 11:52:14 +0000

Peach has been stable for quite some time, but I finally feel it’s time to label a release as the 1.0. I have forked the code as development on Peach 2.0 is in full swing. Several Generators have been updated and a few bugs fixed since the last release.

From here on out, only fix releases in the 1.0 branch will occur, new features will end up in the 2.0 series.

Download Peach Fuzzing Framework 1.0

New and notable in 1.0:

PeachShark — Convert WireShark captures into Peach Fuzzers!
StringTokenFuzzer — Tokenizes input string and performs string mutations and fuzzing of each token in the string.
BadDerEncodedOctetString and BadBerEncodedOctetString — For testing ASN.1 based data
Flags2 — Better handling/fuzzing of bit flags

WMI Tool 0.1

meddington — Wed, 31 Jan 2007 06:46:00 +0000

Found myself reviewing some WMI stuff and needing to set values and see properties and all that good stuff. WMI Explorer got me partway there, but I still needed to set values. Sooo… 15min later there is a small .net tool for this. Enjoy.

HTTP Authentication Brute Forcer

meddington — Sun, 07 Jan 2007 00:31:08 +0000

Found myself writing a simple brute forcer yesterday for windows integrated web authentication (NTLM and Kerberose) that worked over SSL. An easy task with .NET, but was surprised when asked for a tool to do this. Seems most of the tools out there don’t have SSL integrated (easy to fix), poor domain support, and limited Kerberos support. Anyway’s, since others may find this simple tool of some value I figured I’d post it up on ye old blog.

Source or Installer

Peach 2.0 Technology Preview

meddington — Sat, 30 Jan 1999 08:00:00 +0000

Prior to heading down for Blackhat/Defcon I wanted to post a public preview of the next version of Peach. Consider this an alpha/development release with limited documentation, missing features, and no doubt many bugs.

Over the next days/weeks I’ll be posting up looks at different features in Peach 2.0. For now this will be the only tutorial/docs for the 2.0 series until we are closer to a full release.

Download Peach 2.0 Technology Preview

Here is whats new in Peach 2.0:

Separation between data generation/mutation and data modeling
Data modeling performed in XML creating lower bar of entry
Ability to create fuzzers w/o writing Python.
Built ontop of existing framework, can fully reuse any custom written Generators, Transformers, and Publishers
Assisted Data Modeling easier with XML specification
Convert WireShark packet captures to XML data models
Cracking of data based on data models

To come in Peach 2.0 as we approach release:

Inclusion of several simple state models
Expansion of Agent abilities
More complex data generation based on data modeling
Expose new features through language bindings (Peach.NET, .C, .J, etc)

What hasnt changed?

Fuzzers based on Peach 1.0 will continue to work with Peach 2.0
Instrumentation of clients to hook for fuzzing still very easy
Still customizable and extendable, built on-top of existing framework and interfaces so you can re-use existing code

VMware control from Python

meddington — Sat, 30 Jan 1999 08:00:00 +0000

Peach 2.0 development is blazing along, at some point I needed a python module to control a vmware server to allow for automatic start, stop and reverting. I figured I’d release this useful bit of code as a python module.

Available here

from vix import Vix
import time

vm = Vix()

print "Connecting"
vm.Connect()

print "Opening vm"
vm.Open("E:\\VMs\\Windows XP\\Windows XP Professional.vmx")

#print "Powering On vm"
#vm.PowerOn()
#print "Waiting a bit..."
#time.sleep(10)
#print "Powering off vm"
#vm.PowerOff()

print "Reverting to snapshot 0"
vm.GetRootSnapshot()
vm.RevertToSnapshot()

print "Sleeping"
time.sleep(10)

print "Disconnecting"
vm.Disconnect()

Python GDB Wrapper

meddington — Sat, 30 Jan 1999 08:00:00 +0000

The first beta release of pygdb has been posted up. This is a pure python wrapper around GDB using the machine interface (MI). This allows control of GDB from python and was created as part of the effort to get Peach 2.1 running nice on Linux and OS X. Additionally, a new monitor UnixGdb has been checked into the 2.1 code tree for the brave.

pygdb can be found here