drakvuf
drakvuf copied to clipboard
Fuzzing using libinjector
Currently libinjector
is focused on setting up the stack for a single call to CreateProcessA
in ntdll.dll. The API for libinjector
should be extended to allow injecting calls to arbitrary libraries (ie. any exported functions) or arbitrary code-locations (ie. non-exported or internal-only functions). The library should continue to catch the return value of the injected call.
The fuzzer application using this updated API should additionally monitor for OS and process crashes. In case such a crash is detected, a VM reset is necessary to ensure that fuzzing starts from the same start position. Furthermore, the fuzzer could utilize memory sharing to deploy multiple instances of the fuzzing target, speeding up the fuzzing process and the deployment of new VMs in case of an OS or process crash.