Make Static Instrumentation Great Again: High Performance Fuzzing for Windows System
No ratings
Presented at BlueHatIL 2019 by
AFL is a famous and successful feedback-driven fuzzer, originally developed for Linux targets. To increase code coverage, AFL uses execution feedback, with code instrumentation added on compilation. Sadly, this approach is not applicable for most Windows targets, due to the lack of source code. The common solution to this problem is dynamic instrumentation, which hurts performance (like WinAFL). Other solutions require private PDBs for binaries, or support for hardware features that increase cost and decrease scale.Our approach to this problem uses Static Binary Instrumentation (SBI), or “binary rewriting”. The combination of AFL and an SBI framework we developed for this use resulted in pe-afl: a new highly performant feedback-driven fuzzer. pe-afl does not require source code, private PDB, or specific hardware. It works on user space binaries, kernel drivers, and even the NTOS kernel. Moreover, the benefit from SBI is not only for highly efficient fuzzing, but also for bug detection and optimization.In this talk, we’ll explain our approach to build a high-performance fuzzer for Windows. We will cover the implementation and the problems we had along the way, demo the SBI framework and pe-afl, as well as talk about some of the vulnerabilities that were already found in CLFS, CNG, and other components.