Talos Vulndev

Recommendations

Info

Evolutionary Fuzzing • Incrementally better mutational dumb fuzzing • Trace while fuzzing and provide feedback signal • Evolutionary algorithms – Assess fitness of current input – Manage a pool of possible inputs • Focused on security bugs
Evolutionary Fuzzing • From previous research, these are the required components – Fast tracing engine • Block based granularity – Fast logging • Memory resident coverage map – Fast evolutionary algorithm • Minimum of global population map, pool diversity
Page 3: • Research Manager • Cisco Talo
Page 8 and 9: • CPUID with leaf 0x7 can detect
Page 10 and 11: EAX = 0x14 - Intel Processor Trace
Page 12 and 13: • Implemented entirely in hardwar
Page 14 and 15: • OS should allocate a contiguous
Page 19 and 20: • We have decided to write a Wind
Page 21 and 22: • Processor Trace works with phys
Page 24 and 25: Vulnerability Discovery • Now we
Page 28 and 29: Amercian Fuzzy Lop • Michal Zalew
Page 30 and 31: • Trace Logging - Each block gets
Page 32 and 33: WinAFL • Ivan Fratric 2016 - Firs
Page 34 and 35: WinAFL • Ivan Fratric 2016 - Firs
Page 36 and 37: WinAFL IntelPT • Richard Johnson
Page 38 and 39: • Performance - Trace enabled - N
Page 41 and 42: • Tracing is used very often in f

Talos Vulndev

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?