carlosgprado / nafl Goto Github PK

View Code? Open in Web Editor NEW

74.0 15.0 19.0 4.45 MB

A clone (of the basic core) of AFL fuzzer

Python 79.86% C++ 20.14%

nafl's Introduction

NaFl

FAQ

Why NaFl?
- NaFl means sarcastically: "It is totally Not AFL"
- NOTE: when I say AFL, I mean AFL v.0.1 alpha ;)
What is it?
- It is a prototype of a code coverage fuzzer. I wanted to have something like AFL to use in Windows. Unfortunately everything looked very *NIX centric (AFAIK) so I decided to implement the core principles from the ground up (and learned something on the way)
- It leverages dynamic binary instrumentation (DBI) to measure code coverage in blackbox Windows binaries.
  - "Fun" fact: adding support for Intel PIN to AFL was actually my original research project but mothran beat me to it, see his (her?) fantastic work here
  - NaFl can be thought as this with some Python core implementing a simple fuzzing logic
Why does the code suck so much?
- Don't let physicists do computer science. Or anything else for that matter :)

Installation

NaFl is written in Python (Core) and C/C++ (the DBI core). Most of the installation is straightforward:

Clone the project
There are two major directories:
- NaFlCore: nothing to do here at installation time
- PinTool: contains a single file "MyPinTool.cpp"
- Compiling your own PinTool is kind of a pain so most of the people I know use this little trick:
  - cd to Pin_directory\source\tools\MyPinTool
  - Overwrite the MyPinTool.cpp file with yours
  - Open the project in Visual Studio (I used VS Community 2013, very recommended to use this one)
  - Build the project
    - NOTE: if you get errors complaining about SafeSEH just deactivate it in the linker options.
    - Right click -> Properties -> Configuration Properties -> Linker -> All Options
    - Search for "Image Has Safe Exception Handlers" and set it to "NO (/SAFESEH: NO)"
  - Move the resulting DLL to a directory of your choice (you can rename it as well)
That should do it.

Dependencies

Python 2.7.x (grab it here)
- Recommended Python 2.7.9+ (includes pip)
Intel PIN (download it here)

These Python modules are part of the client's core:

Winappdbg (pip install winappdbg)
- This is awesome sauce, check more here
SQLAlchemy (pip install sqlalchemy)

The following Python modules are needed for the server:

Tornado (pip install tornado)
Twisted (pip install twisted)

Running

Once currently installed, running is pretty straightforward.

Run the server for collecting information and crash files
- python server\xmlrpc-server.py
Edit the config file
- Location of PIN and the corresponding PinTool
- Location of the ~~victim~~ binary to analyze
Run the core
- python NaFlCore.py

Tested on

At this moment NaFl has been tested in the following configurations:

Windows 7 x64

Future Enhancements

SO MANY…

Regularly evaluate the quality of mutations in the queue
- Remove ones not yielding anything interesting in a long time?
- Trim mutations?
Static analysis of the victim binary itself
- Cannibalize strings
- Check proximity to str(n)cmp and alike…
  - Maybe implement in JARVIS?
Pre-analysis of the samples
- Find high entropy regions (uninteresting)
- Find ASCII regions
- Compare samples to find fixed tokens (PNG, etc.)

Thanks

This was done during my work time and therefore paid by my current employer, Siemens AG

Yes we do more than washing machines! ;)

Thanks for allowing this public release.

nafl's People

Contributors

Stargazers

Watchers

Forkers

d4nnyk h0wl suto secretnonempty lucabongiorni chubbymaggie synap5e kiritoc8 sececter zhuyue1314 labba wflk pla93 bwry peterclemenko fatgrass

nafl's Issues

Pytest tests

At least for the most complicated parts, like implementing mutations or alike.

Select desired mutations in the config file

For convenience.
Alternatively, blacklist some of them.

is_interesting_input is returning too early

I'm not sure if the project is still alive, but I was reading the code saw a little improvement.
The function is_interesting_input in NaFlCore.py is returning directly after the first difference
I think it would be better to save the return value and return after the loop has finish.
Otherwise the history_bitmap is not updated correctly and more testcase must be created.

Add Travis CI

It's completely for free:

https://travis-ci.org/

The idea is that you'd be getting feedback everytime your build/tests fail on any of the platforms you decide to support. Also, it's a simple way to describe to the users how to actually run your program.

fail on copying and plugin of zip

windows 7 x64
download all with PIP as required and done the PIN as needed and done the config file but when executing the core:

C:\Python27\lib\site-packages\sqlalchemy\sql\base.py:291: SAWarning: Can't validate argument 'drizzle_engine'; can't locate any SQLAlchemy dialect nam
ed 'drizzle'
(k, dialect_name))
=== [] Registering node on the server...
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
X Node registered successfully :)
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
=== [] Restoring saved bitmap from saved_bitmap.p...

=== Initializing Cthulhu... ===
=== THE BRINGER OF DEATH... ===

=== Initializing plugins... ===
=== Loading plugin example...
=== Loading plugin unzip...
=== [*] Copying all files from C:\Work\Tools\NaFl\NaFlCore\samples to C:\Work\Tools\NaFl\NaFlCore\mutations

Preprocessing input...
Traceback (most recent call last):
File "C:\Work\Tools\NaFl\NaFlCore\NaFlCore.py", line 267, in
main()
File "C:\Work\Tools\NaFl\NaFlCore\NaFlCore.py", line 249, in main
fuzzing_loop() # never returns
File "C:\Work\Tools\NaFl\NaFlCore\NaFlCore.py", line 173, in fuzzing_loop
mutation_filename = filegen.write_test_case()
File "C:\Work\Tools\NaFl\NaFlCore\helpers\mutator.py", line 77, in write_test_case
mutated_contents = self.gen_mutation()
File "C:\Work\Tools\NaFl\NaFlCore\helpers\mutator.py", line 68, in gen_mutation
m = self.cthulhu.yield_mutation(original_contents)
File "C:\Work\Tools\NaFl\NaFlCore\helpers\mutator.py", line 186, in yield_mutation
buf = self.apply_pre_processing(file_contents)
File "C:\Work\Tools\NaFl\NaFlCore\helpers\mutator.py", line 150, in apply_pre_processing
data, self.data_to_post = plugin.pre(data)
File "./plugins\unzip__init.py", line 36, in pre
zin = zipfile.ZipFile(file_like_object, mode = 'r')
File "C:\Python27\lib\zipfile.py", line 793, in init
self._RealGetContents()
File "C:\Python27\lib\zipfile.py", line 835, in _RealGetContents
raise BadZipfile, "File is not a zip file"
zipfile.BadZipfile: File is not a zip file