search

hunter-ht-2018 / ptfuzzer

Improving AFL by using Intel PT to collect branch information
291 stars 56 forks source link

lean more about its work principle #9

Closed leoaccount closed 5 years ago

leoaccount commented 5 years ago

Interesting project!

There has been a long time since the release of ptfuzzer, and the work principle is still unclear. Seems close to "Harnessing Intel Processor Trace for Vulnerability Discovery" (2016), instead that integrate itself into AFL, if I grasped the README. I've got two questions:

  1. Did it avoid all modifications to the binary as well as the OS, just run and fuzz the raw binary at run time reside in the original OS?

  2. If say, we had the source code of the binary, could the coverage info it collected for blackbox fuzzing compete with the code coverage collected from the source code itself for a whitebox fuzzing?

zhanggenex commented 5 years ago
  1. Modifications refer to? Please give some details
  2. PTfuzzer aims to fuzz binaries without source code. Of course you can get much higher code coverage in white-box since you can use a wide varity of program analysis technologies such as control flow or data flow analysis.