Keynote SSTIC 2009 – Fuzzgrind: an automatic fuzzing tool

Presentation : Gabriel CAMPANA

Main purpose of the tool: To make fuzzing completely automatic.
Starting from a single symbolic execution, It is capable of extrapolating other tests, by reversing each condition of the data path.
However, it is not feasible to check all the conditions, since the number of possibilities quickly becomes too large. Compromises will have to be found.

The tool is based on Valgrind And PLEASE.
Valgrind for real-time code analysis.
STP is a constraint solver. It takes as input a query composed of one or more constraints. The output indicates whether the query is satisfactory or not (providing a counterexample if necessary). In this way, the conditions for reaching a specific point in the execution path can be found.

Valgrind (using a plugin) will filter the data (taint data) related to our input, then the intermediate representation will be analyzed, and possibly new inputs will be calculated for the following tests, and so on until all data paths have been checked.

The tool found many known vulnerabilities in just a few minutes. It is particularly powerful for libraries.