certcc / certfuzz Goto Github PK

just a quick info that the installer fails on windows xp 32 bits to download files.
it s working fine if you install the package manually though

Hi,
Wondering how to tackle a target which saves its supported file format in a folder along with other project files. The prime target could be the main *.xyz file but wouldn't load well without other supported files.

Thanks

Good day

I have been using FOE for a few weeks and I realized that some crashes that are found (minimized and msec verification) are unable to be verified when I try to do it manually even though FOE2 found the crash.

Is that normal or how can I fix it? If anyone has come across this?

Thanks

Hi

The binary that I want to test, reads the specific file name from the directory.

Therefore, cannot use the input using certfuzz.

Can I use the certfuzz without modifying the source code?

for example:

ls directory/
1.txt 3.txt 5.txt
cat 1.txt
Hello
./a.out -d directory/
Hello

Binary does not input file entries.

Read the file in the directory of the hardcoded address.

#0 0x00007ff086456cc9 in raise () from /lib/x86_64-linux-gnu/libc.so.6 (SIGNAL Re-raised from crash handler)
#1 0x00007ff08863b182 in KCrash::defaultCrashHandler(int) () from /usr/lib/libkdeui.so.5 (Crash handler spawned)
#2
#3 0x00007ff072ebb937 in ?? () from /usr/lib/kde4/okularGenerator_xps.so (Crash happened here with SIGSEGV)
#4 0x00007ff072ec220c in ?? () from /usr/lib/kde4/okularGenerator_xps.so
#5 0x00007ff072ec2b00 in ?? () from /usr/lib/kde4/okularGenerator_xps.so
#6 0x00007ff0773d23b1 in ?? () from /usr/lib/libokularcore.so.4
#7 0x00007ff0773d2905 in Okular::Document::openDocument(QString const&, KUrl const&, KSharedPtr const&) ()

from /usr/lib/libokularcore.so.4
#8 0x00007ff077695cac in Okular::Part::openFile() () from /usr/lib/kde4/okularpart.so
#9 0x00007ff0890ecc47 in ?? () from /usr/lib/libkparts.so.4
#10 0x00007ff0890ee22e in KParts::ReadOnlyPart::openUrl(KUrl const&) () from /usr/lib/libkparts.so.4
#11 0x00007ff07768b10b in Okular::Part::openUrl(KUrl const&) () from /usr/lib/kde4/okularpart.so
#12 0x000000000040f117 in _start ()

The signal was handled from the code and "KDE Handler process" was spawned and signal raised again from there (Re-raising signal for Apport handling.) which will make it impossible for BFF to trigger.
Set $KDE_DEBUG to avoid KDE applications from crash-handling

I would like to know if there is a form / support / workaround so that the winapp can be fuzzed as edge, which will not be directly.

Thank you

Hi,

I am trying to learn certfbff and therefore created a simple GUI application that takes a command line argument txt file. It crashes if any other type is given. Now when I try to fuzz it with BFF, any corrupt input given to it causes application to crash but MS visual C++ Runtime library handles crashes and BFF doesn't log anything as crash.

What is good way to learn this fuzzer? Is there any problem of managed code here that wont BFF to detect crashes? How can I fuzz such applications?

Hi,
Is there a way to fuzz Edge with BFF?
Edge uses 3 exe's : \MicrosoftEdge.exe, RuntimeBroker.exe & MicrosoftEdgeCP.exe.
In the configs of BFF, I have tried to add the 3 exe separated by ',' but it doesn't work. Neither added 2 more cmdline templates so that my config is like this : cmdline_template: $PROGRAM $PROGRAMRun $PROGRAMCP $SEEDFILE.

How can this be done?
Thanks in advance

Hi there,

First of all a big thanks to the team behind development of BFF!
It's working great for me. I am just failing to make it work with applications which are sandboxed.
Seems it's monitoring the main app and not child process and hence failing to catch the crash.

I am sure there would be some setting which I am missing.

To be more precise, when we use WinDbg, we see option for "Debug child process also". Possible to achieve that with BFF?

Thanks in advance!
b0nd

Hi,

I was wondering if you (or anyone) really had any suggestions on how I might accelerate the fuzzing process by introducing some sort of parallel workflow without repeating tests?

Thanks for the great product!

Hi,

I run BFF 2.8, bff.py from the command line in a Windows 10 VM (x64) with at least 8192 MB of memory and I have at least 5.81 GB of hard drive space. I run the program in administrator permission and after fuzzing a project, I got the following error:

2017-04-05 13:54:52,088 WARNING certfuzz.iteration.iteration_windows - WindowsIteration terminating abnormally due to AttributeError: winmgmts:.Win32_PerfRawData_PerfProc_Process
Traceback (most recent call last):
  File "C:\BFF\bff.py", line 51, in <module>
    main()
  File "C:\BFF\certfuzz\bff\windows.py", line 62, in main
    bff()
  File "C:\BFF\certfuzz\bff\common.py", line 169, in go
    campaign.go()
  File "C:\BFF\certfuzz\campaign\campaign_base.py", line 577, in go
    self._do_interval()
  File "C:\BFF\certfuzz\campaign\campaign_base.py", line 552, in _do_interval
    self._do_iteration(sf, r, seednum)
  File "C:\BFF\certfuzz\campaign\campaign_windows.py", line 213, in _do_iteration
    iteration()
  File "C:\BFF\certfuzz\iteration\iteration_base.py", line 296, in go
    self.construct_testcase()
  File "C:\BFF\certfuzz\iteration\iteration_base.py", line 235, in construct_testcase
    self._construct_testcase()
  File "C:\BFF\certfuzz\iteration\iteration_windows.py", line 155, in _construct_testcase
    copy_fuzzedfile=self.fuzzer.fuzzed_changes_input) as testcase:
  File "C:\BFF\certfuzz\testcase\testcase_base.py", line 117, in __enter__
    self.update_crash_details()
  File "C:\BFF\certfuzz\testcase\testcase_windows.py", line 152, in update_crash_details
    self.debug()
  File "C:\BFF\certfuzz\testcase\testcase_windows.py", line 220, in debug
    self.debug_once()
  File "C:\BFF\certfuzz\testcase\testcase_windows.py", line 164, in debug_once
    self.parsed_outputs.append(debugger.go())
  File "C:\BFF\certfuzz\debuggers\msec.py", line 212, in go
    self.run_with_timer()
  File "C:\BFF\certfuzz\debuggers\msec.py", line 177, in run_with_timer
    for proc in self.wmiInterface.Win32_PerfRawData_PerfProc_Process(IDProcess=child_pid):
  File "C:\Python27\lib\site-packages\wmi.py", line 1147, in __getattr__
    return getattr (self._namespace, attribute)
  File "C:\Python27\lib\site-packages\win32com\client\dynamic.py", line 527, in __getattr__
    raise AttributeError("%s.%s" % (self._username_, attr))
AttributeError: winmgmts:.Win32_PerfRawData_PerfProc_Process

The version of python I use is 2.7.12. The BFF 2.8 configuration use the default configuration (bytemut fuzzer), except that I removed the NUL option in the cmdline_template in bff.yaml.

The issue is not consistent and sometimes I can get an error only after two minutes, but sometimes it can run for a about day without complaining. Here is an example of a MemoryError I got recently:

  File "C:\BFF\bff.py", line 51, in <module>
    main()
  File "C:\BFF\certfuzz\bff\windows.py", line 62, in main
    bff()
  File "C:\BFF\certfuzz\bff\common.py", line 169, in go
    campaign.go()
  File "C:\BFF\certfuzz\campaign\campaign_base.py", line 577, in go
    self._do_interval()
  File "C:\BFF\certfuzz\campaign\campaign_base.py", line 552, in _do_interval
    self._do_iteration(sf, r, seednum)
  File "C:\BFF\certfuzz\campaign\campaign_windows.py", line 213, in _do_iteration
    iteration()
  File "C:\BFF\certfuzz\iteration\iteration_base.py", line 297, in go
    self.process_testcases()
  File "C:\BFF\certfuzz\iteration\iteration_base.py", line 288, in process_testcases
    pipeline.go()
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 339, in go
    self.analysis_pipeline.send(testcase)
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 161, in verify
    target.send(testcase)
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 171, in minimize
    self._minimize(testcase)	
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 267, in _minimize
    m.go()
  File "C:\BFF\certfuzz\minimizer\minimizer_base.py", line 734, in go
    self.swap_bytes()
  File "C:\BFF\certfuzz\minimizer\minimizer_base.py", line 892, in swap_bytes
    self.seed, self.fuzzed_content)
  File "C:\BFF\certfuzz\minimizer\minimizer_base.py", line 918, in bytewise_swap2
    append(a)
MemoryError

Any ideas to solve these issues?

Hi!

by default, FOE selects a seedfile, open the program with the seedfile as parameter, wait X seconds and close the program, its ok, but is one by one, so very slow :(

Is posible to configure the forks to improve the speed of FOE?, i mean, configure FOE to select 50 seedfiles at once and run the program simultaneously # #

When doing a stand-alone minimization run, if the starting crasher results in total stack corruption, BFF ends up using Pin to get a calltrace to hash, but for the purposes of minimization it considers that to not be a crash:

_hashable_backtrace_string:
using debugger timeout: 2.63620
confidence level: 0.50000
starting Hamming Distance is 901173
Unable to minimize: No crash
Traceback (most recent call last):
File "tools/minimize.py", line 19, in
main()
File "/home/fuzz/bff/certfuzz/tools/linux/minimize.py", line 180, in main
keep_uniq_faddr=options.keep_uniq_faddr) as minimize:
File "/home/fuzz/bff/certfuzz/minimizer/unix_minimizer.py", line 29, in enter
return MinimizerBase.enter(self)
File "/home/fuzz/bff/certfuzz/minimizer/minimizer_base.py", line 217, in enter
self._raise(msg)
File "/home/fuzz/bff/certfuzz/minimizer/minimizer_base.py", line 247, in _raise
raise MinimizerError(description)
certfuzz.minimizer.errors.MinimizerError: Unable to minimize: No crash

Hi,

I want to look for a fuzzer which can fuzz a GUI based application and read that BFF can do this. But does it only work for File input? If I have a simple two field form like login and password, will I can use this fuzzer to fuzz both fields?
Hope to get in time response.

Regards.

Forgive me if this functionality is already in FOE; perhaps this should be a request for better documentation.

While 'minimize' is useful for creating a file that has minimal differences between the failing test case and the seed file; a more interesting ability would be to prune the minimal-seed file to the minimum number of bytes required to create the same crash.

I'm currently using FOE to run a fuzzing campaign over a third party compiler using our production code base, with all comments and irrelevant white-space stripped out, as the seed files. FOE has yielded several interesting results with this very rudimentary usage; however when filing a bug report it is not always desirable to publicly post such source files. Furthermore several of the files are long (bad for fuzzing) but are also difficult for the vendor to get to the crux of the issue.

If FOE had the ability to return the minimal number of bytes required to reproduce the same crash, in theory, would result in a fairly targeted version of these source files. In all likely-hood would be unrecognizable from the original source files which would be a bonus as well.

Think of it almost as a "infinite monkeys at keyboards" version of "C-Reduce" (https://embed.cs.utah.edu/creduce/) while not optimal CPU cycles are cheap and the problem space might be reasonable especially because there would be no need to understand the domain. Reading more on their Page it seems like "Delta" (http://delta.tigris.org/ and https://www.st.cs.uni-saarland.de/dd/) is close to what I'd want; I don't see a Windows Port however.

Fuzzing process randomly dies with the following Python exception:

2019-02-01 09:13:19,769 INFO certfuzz.minimizer.minimizer_base - start=79 min=79 target_guess=1 curr=39 chance=0.50000 miss=0/11 total_misses=0/1 u_crashes=0
2019-02-01 09:13:38,473 INFO certfuzz.minimizer.minimizer_base - testcase=0x3c7553b8.0xd8e24aea signal=None
2019-02-01 09:13:45,084 INFO certfuzz.minimizer.minimizer_base - start=79 min=39 target_guess=1 curr=21 chance=0.50000 miss=0/11 total_misses=0/2 u_crashes=1
2019-02-01 09:14:11,051 WARNING certfuzz.iteration.iteration_windows - WindowsIteration terminating abnormally due to MemoryError:
Traceback (most recent call last):
  File "bff.py", line 51, in <module>
    main()
  File "C:\BFF\certfuzz\bff\windows.py", line 22, in main
    bff()
  File "C:\BFF\certfuzz\bff\common.py", line 131, in go
    campaign.go()
  File "C:\BFF\certfuzz\campaign\campaign_base.py", line 537, in go
    self._do_interval()
  File "C:\BFF\certfuzz\campaign\campaign_base.py", line 512, in _do_interval
    self._do_iteration(sf, r, seednum)
  File "C:\BFF\certfuzz\campaign\campaign_windows.py", line 186, in _do_iteration
    iteration()
  File "C:\BFF\certfuzz\iteration\iteration_base.py", line 269, in go
    self.process_testcases()
  File "C:\BFF\certfuzz\iteration\iteration_base.py", line 260, in process_testcases
    pipeline.go()
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 299, in go
    self.analysis_pipeline.send(testcase)
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 121, in verify
    target.send(testcase)
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 131, in minimize
    self._minimize(testcase)
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 227, in _minimize
    m.go()
  File "C:\BFF\certfuzz\minimizer\minimizer_base.py", line 723, in go
    self.swap_bytes()
  File "C:\BFF\certfuzz\minimizer\minimizer_base.py", line 881, in swap_bytes
    self.seed, self.fuzzed_content)
  File "C:\BFF\certfuzz\minimizer\minimizer_base.py", line 907, in bytewise_swap2
    append(a)
MemoryError

What would you suggest to troubleshoot?

The code assumes that there are no directory names that contain a '.'
This assumption breaks mtsp_enum.py

Hi,
On windows prompt, quite often I see 'Too many crash hashes seen to minimize. Is memory randomization disabled?' and I see it comes from module minimizer_base.py.
May I know the draw backs of it? Anyway I could improve upon?
I am on platform Windows7 x86.

Thanks in advance!

I'm trying to run BFF on windows. Trying the magic example first .. after moving certain files (bff.yaml) to where they should be
bff.py starts running, seedfiles get generated, target file executes correctly but then when the campaign attempts to start I get the following error :
2020-11-15 18:08:00,210 WARNING certfuzz.iteration.iteration_windows - WindowsIteration terminating abnormally due to WindowsError: [Error 2] The system cannot find the file specified
BFF log file :
2020-11-15 18:07:49,930 INFO certfuzz.campaign.campaign_base - No cached campaign data found, will proceed as new campaign: [Errno 2] No such file or directory: 'C:\\BFF\\src\\fuzzdir\\campaign_convert_v5_5_7.json' 2020-11-15 18:07:49,930 INFO certfuzz.campaign.campaign_windows - Invoking ['C:\\BFF\\imagemagick\\convert.exe', 'C:\\BFF\\src\\fuzzdir\\campaign_w6wubz\\seedfiles\\sf_b96c20e313b20e917bc0de2efacfec48.tim'] 2020-11-15 18:07:50,075 INFO certfuzz.campaign.campaign_windows - Please ensure that the target program has just executed successfully 2020-11-15 18:08:00,075 INFO certfuzz.bff.common - Starting campaign 2020-11-15 18:08:00,115 INFO certfuzz.campaign.campaign_base - Selected seedfile: sf_482b40a36e377b5cba922535fe4db5df.xpm 2020-11-15 18:08:00,210 WARNING certfuzz.iteration.iteration_windows - WindowsIteration terminating abnormally due to WindowsError: [Error 2] The system cannot find the file specified

I did not notice " campaign_convert_v5_5_7.json " getting created in fuzzdir, the seedfiles do and then get deleted as it's a temp directory I assume. I don't think that's the issue but which file is the system unable to find exactly ?

Hey there,

I've been fuzzing a program that sometimes crashes with a Read Access Violation on Instruction Pointer . (ECX sometimes controls EIP). This sometimes causes !exploitable to be unable to disassemble the faulting instruction . See below as an example.

eax=03dfb3d0 ebx=03d6a6e0 ecx=9801a089 edx=e9529e5a esi=9801a089 edi=03d6a670
eip=9801a089 esp=08f0f8c4 ebp=08f0f8e8 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
9801a089 ??              ???
HostMachine\HostUser
Executing Processor Architecture is x86
Debuggee is in User Mode
Debuggee is a live user mode debugging session on the local machine
Event Type: Exception
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\SysWOW64\KERNELBASE.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\SysWOW64\KERNEL32.DLL - 
Exception Faulting Address: 0x9801a089
Second Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
Exception Sub-Type: Read Access Violation

Error: Unable to disassemble the faulting instruction.
Error: Gather Rule #23 in !exploitable failed
quit:

These .msec entries will cause drillresults.py to crash . I've implemented a local fix to let drillresults.py to fail gracefully , letting me know which entries to remove. I can put in a pull request if you'd like.

done.

hello friends,
After I installed the FOE2.1, I finished and run the foe2. But I get the error as follows.
I read the readme.txt and change a software still get the same error. Now I know little about the implement, hope to give me some advice about how to deal with the error.
(I have tried to install it on xp-32bit and xp-64bit)

2016-10-21 09:29:00,042 INFO certfuzz.file_handlers.seedfile_set - Adding file t
o set: C:\FOE2\fuzzdir\campaign_rcjfiz\seedfiles\sf_fcd1633dfbd46b7429060fa918ee
38ef.eps
Traceback (most recent call last):
File "C:\FOE2\foe2.py", line 171, in
main()
File "C:\FOE2\foe2.py", line 164, in main
with WindowsCampaign(config_file=options.configfile, result_dir=options.resu
ltdir, debug=options.debug) as campaign:
File "C:\FOE2\certfuzz\campaign\campaign.py", line 453, in enter
self._cache_app()
File "C:\FOE2\certfuzz\campaign\campaign.py", line 465, in _cache_app
p = Popen(self.prog, cwd=targetdir)
File "C:\Python27\lib\subprocess.py", line 711, in init
errread, errwrite)
TypeError: _execute_child() takes exactly 17 arguments (18 given)

Fuzzing process randomly dies with the following Python exception:

2019-02-02 00:41:13,835 INFO certfuzz.minimizer.minimizer_base - Bytemap: ['0x23ab5a', '0x28c7ca']
2019-02-02 00:41:14,915 INFO certfuzz.testcase.testcase_base - crasher=0xd47e2db0.0xef1fa811 bitwise_hd=8
2019-02-02 00:41:14,917 INFO certfuzz.testcase.testcase_base - crasher=0xd47e2db0.0xef1fa811 bytewise_hd=2
2019-02-02 00:41:16,368 WARNING certfuzz.iteration.iteration_windows - WindowsIteration terminating abnormally due to error:
unpack requires a string argument of length 8
Traceback (most recent call last):
  File "bff.py", line 51, in <module>
    main()
  File "C:\BFF\certfuzz\bff\windows.py", line 22, in main
    bff()
  File "C:\BFF\certfuzz\bff\common.py", line 131, in go
    campaign.go()
  File "C:\BFF\certfuzz\campaign\campaign_base.py", line 537, in go
    self._do_interval()
  File "C:\BFF\certfuzz\campaign\campaign_base.py", line 512, in _do_interval
    self._do_iteration(sf, r, seednum)
  File "C:\BFF\certfuzz\campaign\campaign_windows.py", line 186, in _do_iteration
    iteration()
  File "C:\BFF\certfuzz\iteration\iteration_base.py", line 269, in go
    self.process_testcases()
  File "C:\BFF\certfuzz\iteration\iteration_base.py", line 260, in process_testcases
    pipeline.go()
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 299, in go
    self.analysis_pipeline.send(testcase)
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 121, in verify
    target.send(testcase)
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 135, in minimize
    target.send(testcase)
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 259, in recycle
    target.send(testcase)
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 149, in analyze
    self._analyze(testcase)
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 275, in _analyze
    analyzer_instance.go()
  File "C:\BFF\certfuzz\analyzers\drillresults\drillresults.py", line 83, in go
    tcb.go()
  File "C:\BFF\certfuzz\analyzers\drillresults\testcasebundle_base.py", line 69, in go
    self._parse_testcase()
  File "C:\BFF\certfuzz\analyzers\drillresults\testcasebundle_base.py", line 183, in _parse_testcase
    efaptr = struct.unpack('<Q', binascii.a2b_hex(faultaddr))
struct.error: unpack requires a string argument of length 8

I will try to add try/catch there to see if that helps

See #2 and #3 for related commentary. The msec snippet in #2 should be detected by drillresults as interesting (probably a score of 20), but currently it doesn't because it counts on the !exploitable output to make that determination (and this example is missing the !exploitable output).

Hello.

If run the fuzzer for more than 3 days, an error occurs on the way.

It is as follows.

What is the solution?

Thanks.

crash log:

2018-11-22 06:02:11,719 INFO certfuzz.minimizer.minimizer_base - testcase=0x5133
7628.0x71717171.0x77aa2f50 signal=None
2018-11-22 06:03:18,996 WARNING certfuzz.iteration.iteration_windows - WindowsIt
eration terminating abnormally due to error: can't start new thread
Traceback (most recent call last):
  File "C:\BFF\bff.py", line 51, in <module>
    main()
  File "C:\BFF\certfuzz\bff\windows.py", line 62, in main
    bff()
  File "C:\BFF\certfuzz\bff\common.py", line 169, in go
    campaign.go()
  File "C:\BFF\certfuzz\campaign\campaign_base.py", line 577, in go
    self._do_interval()
  File "C:\BFF\certfuzz\campaign\campaign_base.py", line 552, in _do_interval
    self._do_iteration(sf, r, seednum)
  File "C:\BFF\certfuzz\campaign\campaign_windows.py", line 213, in _do_iteratio
n
    iteration()
  File "C:\BFF\certfuzz\iteration\iteration_base.py", line 297, in go
    self.process_testcases()
  File "C:\BFF\certfuzz\iteration\iteration_base.py", line 288, in process_testc
ases
    pipeline.go()
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 339, in go
    self.analysis_pipeline.send(testcase)
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 161, in verify
    target.send(testcase)
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 171, in minimize
    self._minimize(testcase)
  File "C:\BFF\certfuzz\tc_pipeline\tc_pipeline_base.py", line 267, in _minimize

    m.go()
  File "C:\BFF\certfuzz\minimizer\minimizer_base.py", line 798, in go
    if self.is_same_crash():
  File "C:\BFF\certfuzz\minimizer\minimizer_base.py", line 586, in is_same_crash

    newcrash = self._crash_builder()
  File "C:\BFF\certfuzz\minimizer\minimizer_base.py", line 517, in _crash_builde
r
    new_testcase.update_crash_details()
  File "C:\BFF\certfuzz\testcase\testcase_windows.py", line 152, in update_crash
_details
    self.debug()
  File "C:\BFF\certfuzz\testcase\testcase_windows.py", line 228, in debug
    self.debug_once()
  File "C:\BFF\certfuzz\testcase\testcase_windows.py", line 164, in debug_once
    self.parsed_outputs.append(debugger.go())
  File "C:\BFF\certfuzz\debuggers\msec.py", line 212, in go
    self.run_with_timer()
  File "C:\BFF\certfuzz\debuggers\msec.py", line 172, in run_with_timer
    self.t.start()
  File "C:\Python27\lib\threading.py", line 736, in start
    _start_new_thread(self.__bootstrap, ())
thread.error: can't start new thread

The MSEC.dll included with BFF requires the Visual C++ runtime 2010. However, the runtime that comes with the ISO is Visual C++ 2013. As such, if somebody installs BFF via the ISO on a machine that doesn't already have the 2010 runtime, it won't record any unique crashes.

Hi,
I am trying to understand how to properly define the range_list parameter in order to fuzz only a certain bytes offset of the seedfiles.

In the README is mentioned that the bytes range should be one per line (in HEX or DECIMAL).
range_list: byte ranges to be fuzzed. One range per line, hex or decimal

My idea is too instruct BFF to fuzz only the first 30KB of each seedfile.
Therefore should I place something like this in the BFF.yaml?

##############################################################################
fuzzer:
    fuzzer: bytemut
    fuzz_zip_container: False
    range_list: 0x0000
    range_list: 0x7530

Or should I use min_ratio & max_ratio as mentioned in bytemut.py? (which looks like the option, to instruct BFF how many bytes fuzz at the same time for each iteration)

class ByteMutFuzzer(MinimizableFuzzer):
    '''
    This fuzzer module randomly selects bytes in an input file and assigns
    them random values. The percent of the selected bytes can be tweaked by
    min_ratio and max_ratio. range_list specifies a range in the file to fuzz.
    Roughly similar to cmiller's 5 lines o' python, except clearly less space
    efficient.
    '''

https://github.com/CERTCC-Vulnerability-Analysis/certfuzz/tree/master/src/seedfiles/examples contains sample files for each of the formats. Under what license are these files released?

Hello im trying to hack into your fuzzer to make it fuzz files read statically by binaries.
For instance: Binary.exe loads C:\staticpath\intro.mp3

I m trying to fuzz the file in place using hardlinks and similar but it seems not straight forward with BFF. How would you achieve that quickly ? Can it be a feature ?

Dear!

A problem is happening to me recently.

At first I thought it was my PC or the application I analyzed but something strange happens.

I could validate it with the option to verify the BFF.

I know that a file causes a crash in an application, before when I executed bff I captured it but at time it jumps the windbg or any postmorten debug but it does not capture the bff I do not know why.

I really do not know if it's my pc, I have windows 10 x64 and the process is x64 but I also try it with x32 always worked fine but at the time it's like the error is captured by the debuger and not by the bff.

I hope that someone knows the solution!