search

0dayResearchLab / msFuzz

Targeting Windows Kernel Driver Fuzzer
https://today-0day.gitbook.io/docs_kor/
MIT License
132 stars 22 forks source link

Harness used #5

Open 0xDivyanshu-new opened 1 month ago

0xDivyanshu-new commented 1 month ago

Hi,

I have been going through the repository and wanted to understand more about the harness that was used to capture the callstacks during a crash.

I see that the Harness inside the kafl.fuzzer Util's is using callbacks to capture the stack trace on KeBugCheck. I reversed the driver and so far it seems like the driver has been taken from https://github.com/SafeBreach-Labs/hAFL2/blob/main/drivers/CrashMonitoringDriver/CrashMonitoringDriver/main.c repository.

I wanted to know if there are couple of more additions that you did for the fuzzer to reliably capture the crash or this is all the code is really ?

Thanks

5angjun commented 1 month ago

You are correct. The Driver is from hAFL2.

As my best knowledge, I changed the hypercall used in hAFL2 for our framework and CallStack depth Log Level. Also, in our kafl.fuzzer, matching call stack with each payload for usability.

Best regards

0xDivyanshu-new commented 3 weeks ago

Hi @5angjun, Is it possible for you to share the code of the harness driver as part of the repo?

5angjun commented 3 weeks ago

I hope so. But unfotunately i cant. Because the code i wrote are in my former computer that i removed all data.

Why don't you to understand their Code? If you fully undetstand, you can figure out what to do for your work.