![AFL 101
• Instrument each basic block on compile-time (afl-gcc)
• Record code coverage on execution-time (afl-fuzz)
13
instrumented
lea rsp,[rsp-0x98]
mov QWORD PTR [rsp],rdx
mov QWORD PTR [rsp+0x8],rcx
mov QWORD PTR [rsp+0x10],rax
mov rcx,0x5c80
call 4009a8 <__afl_maybe_log>
mov rax,QWORD PTR [rsp+0x10]
mov rcx,QWORD PTR [rsp+0x8]
mov rdx,QWORD PTR [rsp]
lea rsp,[rsp+0x98]](https://image.slidesharecdn.com/slide-190215033229/85/Make-static-instrumentation-great-again-High-performance-fuzzing-for-Windows-system-13-320.jpg)
![Implementation – pe-afl
• Expand code and update jump
• short jump to long jump
15
jmp loc_123
loc_456:
…
[Instrumented code]
…
jmp loc_456
loc_123:
+ size of instrumented code
- size of instrumented code](https://image.slidesharecdn.com/slide-190215033229/85/Make-static-instrumentation-great-again-High-performance-fuzzing-for-Windows-system-15-320.jpg)
![Challenge for SBI
• The mix of DATA and CODE in executable section is the source of
problems
• Confuse between DATA and CODE
• Assume DATA as CODE, DATA may be corrupted
eg. CreateFile(“ABC”) -> CreateFile(“[instrumented code]ABC”)
• Assume CODE as DATA, coverage is missed or the execution may fail
eg. jmp [old loc] -> jmp [old loc]
21](https://image.slidesharecdn.com/slide-190215033229/85/Make-static-instrumentation-great-again-High-performance-fuzzing-for-Windows-system-21-320.jpg)
![Case study (3)
• Registry Hive
• Parsing un-document registry hive format in ntoskrnl.exe
• Entry point
RegLoadAppKey(“input.dat”)
• Have to instrument around 7MB ntoskrnl.exe
• Support and use partial instrument here
RE = ’_?Cm|_Hv[^il]’
• No CVE
• Global state in registry brings the non-deterministic on fuzzing
37](https://image.slidesharecdn.com/slide-190215033229/85/Make-static-instrumentation-great-again-High-performance-fuzzing-for-Windows-system-37-320.jpg)
Make static instrumentation great again, High performance fuzzing for Windows system
- 1. Make static instrumentation great again High performance fuzzing for Windows system Lucas Leong (@_wmliang_) 1
- 2. #whoami • Security researcher from Trend Micro • Interested in • vulnerability discovery • binary exploitation • reverse engineering • symbolic execution • MSRC TOP 100 • HITCON CTF team 2
- 3. Agenda • Motivation • Related works • AFL 101 • Implementation • Benchmark • Demo • Case study CLFS, CNG, Registry • Conclusion 3
- 4. Motivation • 2014 Nov, AFL is released • I want to fuzz windows target 4
- 5. Motivation • 2014 Nov, AFL is released • I want to fuzz windows target • 2016 Jul, WinAFL is committed • I want a better performance, support kernel 5
- 6. Motivation • 2014 Nov, AFL is released • I want to fuzz windows target • 2016 Jul, WinAFL is committed • I want a better performance, support kernel • 2017 Jul, Static binary instrumentation via syzygy is merged • I don’t have full PDB • And I want more, scale up, etc 6
- 7. Motivation 7
- 8. Related works – static • WinAFL • Use dynamic binary instrumentation via DynamoRIO • Support static binary instrumentation via syzygy • Require full PDB 8
- 9. Related works – dynamic • DARKO • Static analysis via Capstone • Dynamic binary rewriting via Keystone • Cross platforms and architectures • KFUZZ • Focus on windows kernel driver • Dynamic binary rewriting • Use interrupt instead of hook to solve the tiny basic block problem 9
- 10. Related works – hardware • winafl-intelpt • Use the built-in Intel PT driver (ipt.sys) in RS5 • kAFL • Combine QEMU/KVM and Intel PT • Scale-up and cross platform fuzzing • Filter with vCPU/Supervisor/CR3/IP-Range 10
- 11. Related works – virtualization • applepie • Combine Bochs and WHVP API • Get code coverage at the hypervisor level • Restore snapshot with the modified pages only 11
- 12. AFL 101 12 initialize mutate input choose input from queue new coverage ? crash ? run targetsave in queue save Yes No Yes No
- 13. AFL 101 • Instrument each basic block on compile-time (afl-gcc) • Record code coverage on execution-time (afl-fuzz) 13 instrumented lea rsp,[rsp-0x98] mov QWORD PTR [rsp],rdx mov QWORD PTR [rsp+0x8],rcx mov QWORD PTR [rsp+0x10],rax mov rcx,0x5c80 call 4009a8 <__afl_maybe_log> mov rax,QWORD PTR [rsp+0x10] mov rcx,QWORD PTR [rsp+0x8] mov rdx,QWORD PTR [rsp] lea rsp,[rsp+0x98]
- 14. Implementation – pe-afl • Do the similar thing statically 14 coverage bitmap instrumented
- 15. Implementation – pe-afl • Expand code and update jump • short jump to long jump 15 jmp loc_123 loc_456: … [Instrumented code] … jmp loc_456 loc_123: + size of instrumented code - size of instrumented code
- 16. Implementation – pe-afl • Duplicate executable section • Some DATA still remains on the original section • Append .coverage for coverage bitmap • Update • PE header • section table • export table • SEH handle table • relocation table 16 HEADER .text .data PAGE INIT .reloc HEADER .text .data PAGE INIT .text2 PAGE2 INIT2 .coverage .reloc Before instrument After instrument
- 17. Implementation – pe-afl • All the static information is from IDA pro • basic block • branch • target address • op code • operand • stack frame • … 17
- 18. Implementation – pe-afl • Reason to collect stack frame information 18 Before stack frame poisoning After stack frame poisoning
- 19. Implementation – pe-afl 19 • Oops
- 20. Challenge for SBI • The mix of DATA and CODE in executable section is the source of problems • Take care of DATA in executable section • 2-byte alignment for unicode string argument in WIN32 API • 4-byte alignment for SEHandlerTable 20
- 21. Challenge for SBI • The mix of DATA and CODE in executable section is the source of problems • Confuse between DATA and CODE • Assume DATA as CODE, DATA may be corrupted eg. CreateFile(“ABC”) -> CreateFile(“[instrumented code]ABC”) • Assume CODE as DATA, coverage is missed or the execution may fail eg. jmp [old loc] -> jmp [old loc] 21
- 22. Challenge for SBI • The mix of DATA and CODE in executable section is the source of problems • Confuse between DATA and CODE • Assume DATA as CODE, DATA may be corrupted • Assume CODE as DATA, the execution may fail 22
- 23. Challenge for SBI • The mix of DATA and CODE in executable section is the source of problems • Confuse between DATA and CODE • Public symbol can solve 23
- 24. Challenge for SBI • The mix of DATA and CODE in executable section is the source of problems • Confuse between DATA and CODE • Public symbol can solve, otherwise … • IDA pro is improving 24
- 25. Challenge for SBI • The mix of DATA and CODE in executable section is the source of problems • Confuse between DATA and CODE • Public symbol can solve, otherwise … • IDA pro is improving, otherwise … • Assume DATA as CODE, DATA may be corrupted • Instrument before branch instead of basic block • Validate the branch, otherwise alert it • Assume CODE as DATA, the execution may fail • Look for valid branch in suspicious data • Filter with known data type and alert it 25
- 26. Challenge for SBI • The mix of DATA and CODE in executable section is the source of problems • Confuse between DATA and CODE • Workaround 26 Instrumenting mspaint.exe without PDB
- 27. Implementation – pe-afl • Fuzz on user-mode 27 kernel user test_wrapper.exe afl-fuzz.exe afl_shm_XXX afl_shm_XXX mapped target.dll .coverage pipe
- 28. Implementation – pe-afl • Fuzz on kernel-mode 28 kernel user target.sys .coverage test_wrapper.exe .coverage mapped afl-fuzz.exe afl_shm_XXX afl_shm_XXX mapped helper.sys pipe
- 29. Implementation – pe-afl • Type of instrument on fuzzing • PID filtering • multi-thread different afl_prev_loc for each thread • inline-mode in assembly vs. callback-mode in C 29
- 30. Benchmark • Test on gdiplus.dll • Win10, 1 vm, 4GB ram, i7-7600, 1 core • WINAFL states that “This approach has been found to introduce an overhead about 2x compared to the native execution speed” 30 pe-afl (w/o instrument) 522 exec/s pe-afl 508 exec/s winafl (edge mode) 236 exec/s
- 31. Demo 31
- 32. Case study (1) • CLFS • First try on kernel driver • Well-known attack vector • Btw, it was sandboxed • Parsing un-document BLF binary format in kernel • Entry point CreateTransactionManager(“input.blf”) • Patch checksum • 2 weeks, 8 vms • 2 CVE + won’t fix case • CVE-2018-0844, pool overflow • CVE-2018-0846, UAF 32
- 33. Case study (2) • CNG • Entry point IOCTL • Applicable on any kind of IOCTL fuzzing • Coverage is stuck at the beginning • Try to figure out the root cause 33
- 34. Case study (2) • CNG • Entry point IOCTL • Applicable on any kind of IOCTL fuzzing • Coverage is stuck at the beginning • Benefit from SBI, it is easy to dump execution trace 34 Import into lighthouse
- 35. Case study (2) • CNG • Entry point IOCTL • Applicable on any kind of IOCTL fuzzing • Coverage is stuck at the beginning • Benefit from SBI, it is easy to dump execution trace • It needs valid object eg. CreateEvent() • It needs magic header eg. 0x1a2b3c4d • 1 week, 8 vms • 1 CVE • CVE-2018-8207, pool OOB read 35
- 36. Case study (3) • Registry Hive • Parsing un-document registry hive format in ntoskrnl.exe • Entry point RegLoadAppKey(“input.dat”) • Have to instrument around 7MB ntoskrnl.exe • Support and use partial instrument here 36
- 37. Case study (3) • Registry Hive • Parsing un-document registry hive format in ntoskrnl.exe • Entry point RegLoadAppKey(“input.dat”) • Have to instrument around 7MB ntoskrnl.exe • Support and use partial instrument here RE = ’_?Cm|_Hv[^il]’ • No CVE • Global state in registry brings the non-deterministic on fuzzing 37
- 38. Case study (3) – post story • Full instrumentation on ntoskrnl.exe • Everything works except one • Self-modifying branch 38
- 39. Case study (3) – post story • Full instrumentation on ntoskrnl.exe • Everything works except one • Self-modifying branch • Detectable • Skip with partial instrumentation • Workaround 39
- 40. Conclusion • Show the possibility and limitation of SBI on PE file and fuzzing • Not so reliable and elegant, but it works and high performance • Benefit from SBI • Not only feedback code coverage, but also data, stack depth … • Not only for fuzzing, but also for bug detection, tracing … • Open source • https://github.com/wmliang/pe-afl 40
- 41. Thanks • Thanks • AFL, WINAFL • Lays, Steward Fu, Serena Lin • Bluehat IL conference team • Contact • https://twitter.com/_wmliang_ • lucas_leong@trendmicro.com 41