drakvuf icon indicating copy to clipboard operation
drakvuf copied to clipboard

Fuzzing using libinjector

Open tklengyel opened this issue 7 years ago • 0 comments

Currently libinjector is focused on setting up the stack for a single call to CreateProcessA in ntdll.dll. The API for libinjector should be extended to allow injecting calls to arbitrary libraries (ie. any exported functions) or arbitrary code-locations (ie. non-exported or internal-only functions). The library should continue to catch the return value of the injected call.

The fuzzer application using this updated API should additionally monitor for OS and process crashes. In case such a crash is detected, a VM reset is necessary to ensure that fuzzing starts from the same start position. Furthermore, the fuzzer could utilize memory sharing to deploy multiple instances of the fuzzing target, speeding up the fuzzing process and the deployment of new VMs in case of an OS or process crash.

tklengyel avatar Aug 02 '17 18:08 tklengyel