From 2fe7889912c9bb340f302a037585b7b1836ac94f Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Mon, 3 Feb 2020 13:11:10 +0100 Subject: move custom and pythoon mutators examples into examples/ --- examples/argv_fuzzing/README.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 examples/argv_fuzzing/README.md (limited to 'examples/argv_fuzzing/README.md') diff --git a/examples/argv_fuzzing/README.md b/examples/argv_fuzzing/README.md new file mode 100644 index 00000000..fa8cad80 --- /dev/null +++ b/examples/argv_fuzzing/README.md @@ -0,0 +1,16 @@ +# argvfuzz + +afl supports fuzzing file inputs or stdin. When source is available, +`argv-fuzz-inl.h` can be used to change `main()` to build argv from stdin. + +`argvfuzz` tries to provide the same functionality for binaries. When loaded +using `LD_PRELOAD`, it will hook the call to `__libc_start_main` and replace +argv using the same logic of `argv-fuzz-inl.h`. + +A few conditions need to be fulfilled for this mechanism to work correctly: + +1. As it relies on hooking the loader, it cannot work on static binaries. +2. If the target binary does not use the default libc's `_start` implementation + (crt1.o), the hook may not run. +3. The hook will replace argv with pointers to `.data` of `argvfuzz.so`. If the + target binary expects argv to be living on the stack, things may go wrong. -- cgit 1.4.1