Hooking sandboxed application about certfuzz HOT 3 CLOSED

Hey b0nd,

BFF on Windows does by default use the option to debug child processes. As long as the relationship is a true parent-child relationship, BFF will see the crashes. For example, OpenOffice or LibreOffice.

Where BFF does not see crashes in helper applications is where the code processing happens in something other than a child process. For example, some applications use DCOM to have another non-child process perform processing of files. Crashes in those processes aren't visible to BFF in its current architecture.

One way to see the hierarchy of launched processes is to use Procexp from Sysinternals. Or you could mention the program you're looking at here for a second opinion.

from certfuzz.

Hi Will,

I was trying it with iexplore.exe. I used just one seed which I know crashes iexplore. When BFF opens up the application first time, I see app crashing. But when regular fuzzing starts, no crash is visible.

Thanks

from certfuzz.

If you want to confirm that BFF can see crashes in cases known to crash, you'd want to make sure that you're using "verify" mode as opposed to the default bytemut. If you're using a known crasher and you have BFF fuzz with it, it'll be modifying the file with each iteration. When you mutate a crasher, you will very well end up with a non-crasher.

from certfuzz.