Linux Hardening

A variety of methods are employed for input generation, each with its own set of techniques and strategies. Here, we explore some of the key approaches :

• Corpus-based mutation :

  This method takes existing inputs from a corpus and applies mutations to generate new inputs. The corpus can be minimized to remove redundant inputs while preserving code coverage. For example, FitM uses afl-cmin to reduce the corpus size.

  Mutations range from simple techniques like bit flipping to more sophisticated operations such as input extension (combining an input with fragments of other inputs or dictionary tokens), recursive replacement (replacing parts of an input with other fragments), and string replacement (replacing substrings with other strings from a dictionary). Take the GRIMOIRE fuzzer, it generalizes inputs by identifying and replacing constant values with placeholders, and then applies these mutations to the generalized forms to produce more meaningful variations.

  The choice and combination of mutation operators depend on factors such as the input type, desired complexity, and past coverage information.

• Generation from specifications :

  This method utilizes a specification of the input format, like a bytecode program, to generate inputs adhering to a specific protocol, this is particularly useful for fuzzing interactive interfaces like hypervisors. These generated inputs can be further mutated to explore edge cases or unexpected interactions.

  For instance, NYX uses this method with bytecode programs expressed as directed acyclic graphs (DAGs), enabling it to fuzz complex systems like hypervisors and operating systems. NYX also supports fuzzing ring-3 applications by handling environment variables, command-line arguments, standard input, and multiple files as inputs.

• Pseudo-random instruction generation :

  This technique generates sequences of instructions using a PRNG and feeds them to the target program. It is particularly suited for systems with well-defined instruction sets, such as emulators and virtual machines. So, by initializing the PRNG with a specific seed, deterministic fuzzing campaigns can be conducted, e.g : HYPER-CUBE employs this method with a fast non-cryptographic PRNG to create a potentially infinite stream of instructions. To make generated instructions more realistic, arguments like region IDs and offsets are interpreted modulo the available range.

• Input-to-State correspondence (Redqueen) :

  Redqueen is a fuzzing technique, not directly a method for generating inputs, but it influences the input generation process. It observes the correspondence between input values and their representation in the program state during execution. This knowledge is then exploited to overcome common fuzzing obstacles like magic bytes and checksums, guiding the mutation process to generate inputs that satisfy these constraints.

  This technique is integrated into the kAFL fuzzer, uses lightweight program tracing and state inspection to achieve this, offering significant performance advantages over computationally expensive alternatives like taint tracking and symbolic execution. It has proven effective in fuzzing both kernel-space and userland targets without requiring source code or platform-specific knowledge. It is also optionally integrated in Snapchange.

Observed snapshot fuzzers often utilize a combination of these methods and techniques to maximize their effectiveness in uncovering vulnerabilities.