Implementing network fuzzing

[googleprojectzero]

Implementing network fuzzing

[ifratric]

Hi Dario,

You are correct, with the current Jackalope architecture, there is no guarantee that the target process exists when SampleDelivery is called. Another problem is that in Jackalope, the fuzzing thread is blocked while the target runs (as (a) Jackalope serves as a debugger for the target process and waits for events while the target runs and (b) everything happens on a single thread).

So then, the "correct" (IMHO) way to implement network fuzzing is to add a custom SampleDelivery that spawns a new thread and sends the sample from that thread. It could then wait for the target process to spawn (or simply repeatedly retry sending the sample until it succeeds).

In Jackalope, coverage is collected when the target function returns (or when the target process exits in case the target function is not defined).

[dms1lva]

Thank you! That strategy worked out!