Bug Hunter Diary

I performed the following steps when searchingthe iPhone audio libraries for a bug:• Step 1: Research the iPhone’s audiocapabilities.• Step 2: Build a simple fuzzer and fuzz thephone.← I used a firstgenerationiPhonewith firmware 2.2.1(5H11) as platformfor all the followingsteps.NoteI installed all the necessary tools—like the Bash, OpenSSH, and theGNU debugger—on the iPhone using Cydia. 2Step 1: Research the iPhone’s Audio CapabilitiesThe iPhone, with its iPod-based roots, is a powerful audio-capabledevice. Three frameworks available on the phone provide differentlevels of sound functionality: the Core Audio, 3 Celestial, and AudioToolbox 4 frameworks. In addition, the iPhone runs an audio daemoncalled mediaserverd, which aggregates the sound output of all applicationsand governs events such as volume and ringer-switch changes.Step 2: Build a Simple Fuzzer and Fuzz the PhoneThe iPhone’s audio system with all its different frameworks seemeda bit complicated, so I decided to start by building a simple fuzzer tosearch for obvious bugs. The fuzzer that I built does the following:1. On a Linux host: Prepares the test cases by mutating a sampletarget file.2. On a Linux host: Serves these test cases via a web server.3. On the iPhone: Opens the test cases in MobileSafari.4. On the iPhone: Monitors mediaserverd for faults.5. On the iPhone: In the event a fault is uncovered, logs thefindings.6. Repeats these steps.I created the following simple, mutation-based file fuzzer to preparethe test cases on a Linux host:01 #include 02 #include 03 #include 04 #include 05 #include 06 #include 07134 Chapter 8