Changes between Version 2 and Version 3 of zzuf/tutorial Tweet

Timestamp:

05/18/2008 02:36:02 AM (16 years ago)

Author:

Sam Hocevar

Comment:

debug mode

zzuf/tutorial

@@ -138 +138 @@
 }}}
 
-`zzuf` can be used to create files:
+`zzuf` can be used to create files. Again, the behaviour is entirely reproducible:
 
 {{{
@@ -152 +152 @@
 }}}
 
-This may be useful if a given application is not supported by `zzuf`, but it is especially useful to generate files that reproduce `zzuf`’s behaviour without requiring `zzuf`.
-
+This may be used if a given application is not supported by `zzuf`, but it is especially useful to generate files that reproduce `zzuf`’s behaviour without requiring `zzuf` at all.
+
+= `zzuf` as a batch testing tool =
+
+The most useful aspect of `zzuf` is its use as an automated tool, testing thousands of different fuzzing combinations and analysing the fuzzed application’s behaviour in each situation.
+
+== Debug mode ==
+
+Consider this invocation of `zzuf` with the `file` utility:
+
+{{{
+% zzuf file /bin/ls
+/etc/magic, 4: Warning: using regular magic file `/usr/share/file/magic'
+/usr/share/file/magic, 33: Warning: Printf format `d' is not valid for type `string' in description `RISC OS outline font data,>5      byte            x       varsion %d'
+/usr/share/file/magic, 47: Warning: type `stri?g        \x02\x01\x13\x13\x13\x01\x0d\x10        Digital Symphony sound sample (RISC OS),' invalid
+[...]
+}}}
+
+This is not the expected behaviour at all. What happens exactly? The problem is that `file` also opens its own configuration files to gather information about file formats, and of course `zzuf` fuzzes these files, since no one told it that they were special.
+
+We may use the '''debug mode''' to learn more about what happens, using the '''`-d` flag''':
+
+{{{
+% zzuf -d file /bin/ls
+** zzuf debug ** libzzuf initialised for PID 29526
+** zzuf debug ** fopen("/etc/magic", "r") = [3]
+** zzuf debug ** fgets(0x7fffc46e04b0, 8192, [3]) = 0x7fffc46e04b0
+** zzuf debug ** fgets(0x7fffc46e04b0, 8192, [3]) = 0x7fffc46e04b0
+** zzuf debug ** fgets(0x7fffc46e04b0, 8192, [3]) = 0x7fffc46e04b0
+** zzuf debug ** fgets(0x7fffc46e04b0, 8192, [3]) = NULL
+** zzuf debug ** fclose([3]) = 0
+** zzuf debug ** open("/usr/share/file/magic.mgc", 0) = 3
+** zzuf debug ** mmap(NULL, 1636608, 3, 2, 3, 0) = 0x2acce776e000 "\x1c\x04\x1c\xf1...
+** zzuf debug ** close(3) = 0
+** zzuf debug ** fopen("/usr/share/file/magic", "r") = [3]
+** zzuf debug ** fgets(0x7fffc46e04b0, 8192, [3]) = 0x7fffc46e04b0
+** zzuf debug ** fgets(0x7fffc46e04b0, 8192, [3]) = 0x7fffc46e04b0
+** zzuf debug ** fgets(0x7fffc46e04b0, 8192, [3]) = 0x7fffc46e04b0
+[...]
+}}}
+
+We see that `file` opens at least `/etc/magic`, `/usr/share/file/magic.mgc` and `/usr/share/file/magic`. Since they are installed in trusted directories, it is useless to fuzz these files, unless of course we wish to test `file`’s robustness against corruption of these files.
+
+One way to ignore these files is to '''exclude''' them, using the '''`-E` flag'''. This flag specifies that files matching a given regular expression should not be fuzzed:
+
+{{{
+% zzuf -d -E /etc/ -E /usr/share/ file /bin/ls
+** zzuf debug ** libzzuf initialised for PID 30541
+** zzuf debug ** open("/bin/ls", 0) = 3
+** zzuf debug ** read(3, 0x60a590, 98304) = 98304 "\x7fENF...
+** zzuf debug ** close(3) = 0
+/bin/ls: data
+%
+}}}
+
+Another way to avoid the issue is to only '''include''' the file or directories we want to fuzz, using the '''`-I` flag''':
+
+{{{
+% zzuf -d -I /bin/ file /bin/ls
+** zzuf debug ** libzzuf initialised for PID 30550
+** zzuf debug ** open("/bin/ls", 0) = 3
+** zzuf debug ** read(3, 0x606c20, 98304) = 98304 "\x7fENF...
+** zzuf debug ** close(3) = 0
+/bin/ls: data
+%
+}}}
+
+Yet another way is to tell `zzuf` to only fuzz files that appear on the fuzzed application’s '''commandline''', using the '''`-c` flag''':
+
+{{{
+% zzuf -d -c file /bin/ls
+** zzuf debug ** libzzuf initialised for PID 30555
+** zzuf debug ** open("/bin/ls", 0) = 3
+** zzuf debug ** read(3, 0x608de0, 98304) = 98304 "\x7fENF...
+** zzuf debug ** close(3) = 0
+/bin/ls: data
+%
+}}}
+
+We can now properly fuzz the `file` application.