Changes between Version 3 and Version 4 of zzuf/tutorial


Ignore:
Timestamp:
05/18/08 05:54:33 (5 years ago)
Author:
sam
Comment:

seed ranges, ratio ranges

Legend:

Unmodified
Added
Removed
Modified

  • zzuf/tutorial

    v3 v4  
    33Warning: this tutorial requires `zzuf` version 0.11 or later. 
    44 
    5 = Basic `zzuf` usage = 
     5= 1. Basic `zzuf` usage = 
    66 
    77`zzuf`’s behaviour is configured through the command line. A comprehensive list of flags and their meaning is given in the `zzuf` manual page. Just run '''`man zzuf`''' on your system to see it. 
    88 
    9 == Launching `zzuf` == 
     9== 1.1. Launching `zzuf` == 
    1010 
    1111Let’s start with a simple command that reads data from a file. We choose `hd`, the hexadecimal dump command, so that we get a chance to observe what exactly happens to the data. 
    1212 
    13 We tell `hd` to read 32 bytes from `/dev/zero`: 
     13This is how to tell `hd` to read 32 bytes from `/dev/zero`: 
    1414 
    1515{{{ 
    … …  
    3131}}} 
    3232 
    33 We see that two `00` values have been changed to `02`s. `zzuf` '''intercepted''' `hd`'s opening of `/dev/zero` and automatically '''corrupted''' the bytes it read at random. Let’s do it again: 
     33We see that two `00` values have been changed to `02`s. `zzuf` '''intercepted''' `hd`'s opening of `/dev/zero` and automatically '''corrupted''' the bits it read at random. Let’s do it again: 
    3434 
    3535{{{ 
    … …  
    4343We get exactly the same output. This is a very important property of `zzuf`: its behaviour is '''reproducible'''. 
    4444 
    45 == Invoking different programs == 
     45== 1.2. Invoking different programs == 
    4646 
    4747Let’s fuzz the `cat` utility instead of `hd`, but read the final output with `hd` nonetheless: 
    … …  
    6868This is another very important property of `zzuf`: '''data is fuzzed the same way regardless of the fuzzed application'''. 
    6969 
    70 == The fuzzing ratio == 
     70== 1.3. The fuzzing ratio == 
    7171 
    7272The '''fuzzing ratio''' is the proportion of bits that `zzuf` changes. It is specified with the '''`-r` flag'''. The default fuzzing ratio is 0.004, meaning "fuzz 0.4% of the bits". 32 bytes is 256 bits, and 0.4% of 256 bits is approximately 1. `zzuf` should have fuzzed 1 bit, but since it fuzzes bits at random, 2 bits is not surprising. 
    … …  
    106106}}} 
    107107 
    108 == The random seed == 
     108== 1.4. The random seed == 
    109109 
    110110`zzuf`’s behaviour is reproducible, but we might not be satisfied with the output. Or we may simply want to fuzz in several different ways, but still using the same fuzzing ratio. This is done by changing the '''random seed''' with the '''`-s` flag'''. The random seed is the initial value of `zzuf`’s random number generator. The default seed is 0, so let’s try with other values: 
    … …  
    124124As can be seen, each seed value initiates a different behaviour of the random number generator. 
    125125 
    126 == Creating fuzzed files == 
     126== 1.5. Creating fuzzed files == 
    127127 
    128128It is possible to fuzz files directly, without calling applications at all. 
    … …  
    154154This may be used if a given application is not supported by `zzuf`, but it is especially useful to generate files that reproduce `zzuf`’s behaviour without requiring `zzuf` at all. 
    155155 
    156 = `zzuf` as a batch testing tool = 
     156= 2. `zzuf` as a batch testing tool = 
    157157 
    158158The most useful aspect of `zzuf` is its use as an automated tool, testing thousands of different fuzzing combinations and analysing the fuzzed application’s behaviour in each situation. 
    159159 
    160 == Debug mode == 
     160== 2.1. Debug mode == 
    161161 
    162162Consider this invocation of `zzuf` with the `file` utility: 
    … …  
    195195We see that `file` opens at least `/etc/magic`, `/usr/share/file/magic.mgc` and `/usr/share/file/magic`. Since they are installed in trusted directories, it is useless to fuzz these files, unless of course we wish to test `file`’s robustness against corruption of these files. 
    196196 
    197 One way to ignore these files is to '''exclude''' them, using the '''`-E` flag'''. This flag specifies that files matching a given regular expression should not be fuzzed: 
     197== 2.2. Include and exclude patterns == 
     198 
     199One way to make `zzuf` ignore files is to '''exclude''' them, using the '''`-E` flag''' as many times as necessary. This flag specifies that files matching a given regular expression should not be fuzzed: 
    198200 
    199201{{{ 
    … …  
    207209}}} 
    208210 
    209 Another way to avoid the issue is to only '''include''' the file or directories we want to fuzz, using the '''`-I` flag''': 
     211Another way to avoid the issue is to only '''include''' the files or directories we want to fuzz, using the '''`-I` flag''' as many times as necessary: 
    210212 
    211213{{{ 
    … …  
    219221}}} 
    220222 
    221 Yet another way is to tell `zzuf` to only fuzz files that appear on the fuzzed application’s '''commandline''', using the '''`-c` flag''': 
     223Yet another way is to tell `zzuf` to only fuzz files that appear on the fuzzed application’s commandline, using the '''`-c` flag''': 
    222224 
    223225{{{ 
    … …  
    232234 
    233235We can now properly fuzz the `file` application. 
     236 
     237== 2.3. Seed ranges == 
     238 
     239Instead of specifying a random seed with the `-s` flag, one can specify a whole range by separating values with a colon. `zzuf` will simply run the program several times, each time with another seed in the range: 
     240 
     241{{{ 
     242% zzuf -c -s 0:5 file /bin/ls          
     243/bin/ls: data 
     244/bin/ls: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped 
     245/bin/ls: ELF 64-bit LSB executable, x86-64, (SYSV), statically linked (uses shared libs), stripped 
     246/bin/ls: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), for GNU/Linux 2.6.8388616, statically linked (uses shared libs), corrupted section header size 
     247/bin/ls: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked (uses shared libs), stripped 
     248% 
     249}}} 
     250 
     251As can be seen, the file analysed by `file` is slightly corrupted in a different way each time. 
     252 
     253Using the '''`-v` flag''' for more verbosity helps understanding what is going on, especially with large seed ranges: 
     254 
     255{{{ 
     256% zzuf -vc -s 0:5 file /bin/ls 
     257zzuf[s=0,r=0.004]: launched file 
     258/bin/ls: data 
     259zzuf[s=1,r=0.004]: launched file 
     260/bin/ls: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped 
     261zzuf[s=2,r=0.004]: launched file 
     262/bin/ls: ELF 64-bit LSB executable, x86-64, (SYSV), statically linked (uses shared libs), stripped 
     263zzuf[s=3,r=0.004]: launched file 
     264/bin/ls: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), for GNU/Linux 2.6.8388616, statically linked (uses shared libs), corrupted section header size 
     265zzuf[s=4,r=0.004]: launched file 
     266/bin/ls: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked (uses shared libs), stripped 
     267% 
     268}}} 
     269 
     270== 2.4. Ratio ranges == 
     271 
     272When a seed range is being used with `-s`, a ratio range can be used with `-r`. Instead of using the same bit fuzzing ratio for each seed, `zzuf` will pick one at random within the specified interval: 
     273 
     274{{{ 
     275% zzuf -vc -s 0:5 -r 0.0001:0.01 file /bin/ls 
     276zzuf[s=0,r=0.0001:0.01]: launched file 
     277/bin/ls: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), for GNU/Linux 2.6.8, dynamically linked (uses shared libs), stripped 
     278zzuf[s=1,r=0.0001:0.01]: launched file 
     279/bin/ls: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked (uses shared libs), stripped 
     280zzuf[s=2,r=0.0001:0.01]: launched file 
     281/bin/ls: ERROR: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), for GNU/Linux 2.6.8, dynamically linked (uses shared libs)error reading 
     282zzuf[s=3,r=0.0001:0.01]: launched file 
     283/bin/ls: ERROR: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linkedCannot allocate memory for note (Cannot allocate memory) 
     284zzuf[s=4,r=0.0001:0.01]: launched file 
     285/bin/ls: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped 
     286% 
     287}}}