Resmack Fuzz Test

This project is an exploration of a feedback-driven fuzzer that uses:

• ptrace for instrumentation
  • with dynamic memory breakpoints specified by the target process
• process snapshotting/restoring
  • using /proc/pid/map, /proc/pid/clear_refs, and /proc/pid/pagemap
  • using process_vm_writev
• performance counters as a feedback mechanism
• corpus management

Successful code and concepts implemented here will be absorbed into resmack to make it a full fuzzer instead of only grammar-based data generator.

Features/Experiments

See the blog post Resmack: Fuzzing Thoughts - Part 2 for a full writeup on what is done in this project.

Usage

Dependencies

This project requires:

• Rust
• Linux
• linux-tools-common
• linux-tools-generic
• linux-tools-$(uname -r)
• gcc

A perf_event_paranoid level of <= 2:

echo 2 | sudo tee /proc/sys/kernel/perf_event_paranoid

Building

Building the test target:

gcc target.c -o a.out

Building the fuzzer

cargo build --release

Running the fuzzer

cargo run --release ./a.out

All together now ♪ ♫

gcc target.c -o a.out && cargo run --release ./a.out AAAAAAAAA

Running Tests

cargo test

Running Benchmarks

cargo bench --bench snapshots -- --verbose