Sergej Schumilo

Security Researcher sh -c ‘﹤&$1’

[Sergej Schumilo @ms_s3c]

@is_eqv and I just published the source code of our hypervisor-based snapshot fuzzer for complex network targets (+ vulns in firefox): https://t.co/zSv3EKey0t. Check it out!

[Thorsten Holz @thorstenholz]

Congratulations Dr. @m_u00d8! 🎉

[TyphoonCon🌪️ @typhooncon]

📷We’re excited to announce the second training session for #TyphoonCon24: “Fuzzing & Attacking Deeply Embedded Devices” by Tobias Scharnowski (@ScepticCtf) & Marius Muench (@nSinusR).

Learn more and register: https://t.co/OCuzVSfpSc

[Moritz Schloegel @m_u00d8]

Fuzzing is hard, evaluating fuzzing is harder 🔥

For our new @IEEESSP paper, we studied 150 fuzzing evals and found issues such as lackluster documentation, bad experiment setups, or questionable CVEs

📄 Paper https://t.co/wmVgzVuCCI

🔧 Help us fix this https://t.co/efNjsJf4kR

[Christian Holler @mozdeco]

I know I'm late for Christmas presents but I've added dynamic instrumentation filtering to AFL++. You can now select which parts of the (llvmnative) instrumentation you want to use at runtime, without rebuilding: https://t.co/LA8grDAK3S #fuzzing

[h0mbre @h0mbre_]

starting a new fuzzer project on the blog that is based on an old @gamozolabs idea. in the first post, we load a statically built Bochs emulator ELF into our fuzzer process and execute it. there is some code and the humble beginnings of a repo. lets gooo https://t.co/MrJEAHHO5E

[Mathieu Tarral @mtarral]

🚀 kAFL release v0.8

1⃣ New Linux tutorial based on the Damned Vulnerable Kernel Module (DVKM) by @hardik05
2⃣ Docs how to use the kAFL "https://t.co/rxel295DQo" and sharedir based workflow to fuzz Linux targets
3⃣ A simplified kAFL agent in the Linux kernel !

[Mathieu Tarral @mtarral]

It's been a while since I've given updates here, especially since I started at Intel one year ago !

I've taken over the maintainership of kAFL 🛠️🚀

kAFL is a HW assisted feedback fuzzer for x86 VMs ✨
https://t.co/O6dEFMrVo9

⬇️ (1/x)

[Sergej Schumilo @ms_s3c]

@australeo @byte_how @is_eqv We did exactly that with kAFL / Nyx. The second trace buffer is required since the interrupt signal is somewhat imprecise according to the documentation:

https://t.co/e2GIyq3Noh

[Sergej Schumilo @ms_s3c]

@australeo @byte_how @is_eqv There is another reason to use a ToPA: By utilizing ToPA Entry Fields, you can basically configure the CPU in a way to get notified as soon as a specific buffer has been filled (basically to avoid any data loss during tracing without frequently checking its state).

[Sergej Schumilo @ms_s3c]

@dvyukov @is_eqv So basically, with these and some other useful capabilities, Nyx enables fuzzing of complex targets (like browsers or games) or can accelerate any other target by creating the snapshot just before the input is read the first time (to avoid the startup routine after each exec).

[Sergej Schumilo @ms_s3c]

@dvyukov @is_eqv Before the actual fuzzing starts, the guest requests the hypervisor to create a root snapshot, which is later used to restore the VM state after each execution (and also in case the fuzzer uncovers a bug, which leads to a crash, kernel panic, or any other corruption of the VM).

[Omar @byte_how]

Every paper from them is gold. (@is_eqv, @ms_s3c, @mr_phrazer et al)

Every. Single. One.

https://t.co/jVV3xvoIj7

[Christopher @Kharosx0]

Nyx fuzzing a Windows x64 kernel driver w/ full-system snapshot fuzzing.
Lots of components, but it works pretty well.

[dmnk.bsky.social @domenuk]

We just released FitM, the Fuzzer in the Middle!🎉🎉
Together with @derpst3b, @JB_Liikt and @_mmunier we added snapshotting and a network emulator to qemuafl.
It fuzzes multiple stages of client-server interactions independently.
Paper @ BAR'22, Code here: https://t.co/PoG8kCYni7

[Richard Johnson @richinseattle]

@expend20 @is_eqv @ms_s3c Here is Nyx backend powering the familiar AFL++ frontend. This is still using intelpt + full system snapshots and achieving similar to inlined source instrumentation performance.

[Richard Johnson @richinseattle]

Full system, hypervisor accelerated, incremental snapshot fuzzing with Intel PT coverage engine enabling full protocol stateful fuzzing via Nyx-Net! Getting roughly 1000 exec/s/core on dnsmasq. This is followup work to kAFL/RedQueen. Kudos to the authors @is_eqv and @ms_s3c!

[Sergej Schumilo @ms_s3c]

Want to fuzz complex targets with AFL++ and snapshots? @is_eqv and I now got you covered: there is a Nyx implementation for AFL++ available here https://t.co/Ghcd8K3JoZ

[Thorsten Holz @thorstenholz]

Except from the @MozillaSecurity Firefox Security Newsletter/FSN-2021-Q3 (https://t.co/gYXb5rKY3O): "Now, we have received and successfully evaluated a research prototype for fuzzing the IPC Layer. " - Congratulations @ms_s3c and @is_eqv!