From 7db87ec74b62c4cd59c27e177903b6bd4dac4880 Mon Sep 17 00:00:00 2001 From: Kjell Braden Date: Sat, 21 Dec 2019 20:21:07 +0100 Subject: argvfuzz preload for fuzzing binaries' argv --- experimental/argv_fuzzing/README.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 experimental/argv_fuzzing/README.md (limited to 'experimental/argv_fuzzing/README.md') diff --git a/experimental/argv_fuzzing/README.md b/experimental/argv_fuzzing/README.md new file mode 100644 index 00000000..fa8cad80 --- /dev/null +++ b/experimental/argv_fuzzing/README.md @@ -0,0 +1,16 @@ +# argvfuzz + +afl supports fuzzing file inputs or stdin. When source is available, +`argv-fuzz-inl.h` can be used to change `main()` to build argv from stdin. + +`argvfuzz` tries to provide the same functionality for binaries. When loaded +using `LD_PRELOAD`, it will hook the call to `__libc_start_main` and replace +argv using the same logic of `argv-fuzz-inl.h`. + +A few conditions need to be fulfilled for this mechanism to work correctly: + +1. As it relies on hooking the loader, it cannot work on static binaries. +2. If the target binary does not use the default libc's `_start` implementation + (crt1.o), the hook may not run. +3. The hook will replace argv with pointers to `.data` of `argvfuzz.so`. If the + target binary expects argv to be living on the stack, things may go wrong. -- cgit 1.4.1