search

idkwim / ouspg

Automatically exported from code.google.com/p/ouspg
3 stars 0 forks source link

Feature request: format string mutator (%n, %s) #95

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
Introducing sequences of printf format string specifiers, principally %n and 
%s, would be a useful mutator that would help expose insecure use of functions 
from the printf family.

Original issue reported on code.google.com by MMacn...@gmail.com on 29 Oct 2014 at 7:07

GoogleCodeExporter commented 9 years ago 
Thanks for the suggestion :) 

I'll probably have time to add these tomorrow. At least null termination issues 
and aaaaaaaaaaaaaaaaaaa's should also be added to stringish data change 
heuristics.

Original comment by aohelin on 29 Oct 2014 at 7:16

GoogleCodeExporter commented 9 years ago 
Currently in trunk:
$ echo 'foooooooooooo' | radamsa -n 10000 | grep "%" | head -n 1
foooooooo%s%n%s%s%noooo

ab mutation now partitions the data to stringish things, within binary or 
delimited ones in textual data, and inserts extra null termination or inserts 
or overwrites a sequence of format string parameters somewhere in there. It is 
enabled by default with a low priority, since the set of changes it can make is 
relatively low, but definitely worth including.

Original comment by aohelin on 31 Oct 2014 at 3:16

GoogleCodeExporter commented 9 years ago 
Excellent, thanks.

Original comment by MMacn...@gmail.com on 31 Oct 2014 at 3:59