Skip to content
/ Kleenex Public

C++ wrapper around KLEE and AFL for intelligent, coverage guided fuzzing. Developed while doing research at MWR Infosecurity

Notifications You must be signed in to change notification settings

svv232/Kleenex

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Description

While fuzzing the probability of finding a crash increases as code coverage increases. The premise of my research was to develop an intelligent, white box method of fuzzing to elicit memory corruption. White box program fuzzing can be described as sending payloads that verify all code paths are hit. Simply put, the process during this research was using program path analysis to generate test cases, and applying mutation based fuzzing techniques on these initial test cases. For path analysis Klee, a symbolic virtual machine, generated unique input for each discoverable path within a program; this process will be further described in the implementation section of the post. AFL , American Fuzzy Lop, applies it's genetic algorithms and semantic analysis on the generated Klee output to fuzz programs. With this in mind I developed Kleenex a wholistic C++ wrapper around Klee and AFL that can spin up different types of afl-fuzz threads using initial Klee analysis.

KLEENEX

Path information currently is hard coded in the Makefile and the #define statements in the header files. These must be modified for use on another machine.

Change:

fuzzer.h

  • afl_fuzz /path/to/afl-fuzz
  • myoutput /path/to/tissue_box/output
  • myfuzzerdict /path/to/engine/klee.dict
  • myprogram /path/to/engine/a.out

ktest_to_afldict.h

  • filepath /path/to/tissue_box/klee-last
  • myinput /path/to/tissue_box/input

Makefile

  • TISSUE_BOX /path/to/tissue_box
  • AFL_CC /path/to/preferred/afl-compiler

For Use

  • Place the desired C file in tissue_box under the name bacteria.c
  • run make in the engine

Dependencies

  • KLEE
  • AFL (American Fuzzy Lop)
  • C++17

Set up Details are coming soon!

About

C++ wrapper around KLEE and AFL for intelligent, coverage guided fuzzing. Developed while doing research at MWR Infosecurity

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published