Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
Search - "fuzzing"
-
New Phrack article. Given they release like one a year, figured it warranted posting a link.
Title : Hypervisor Necromancy; Reanimating Kernel Protectors
Author: Aris Thallas
Date: 2020 Feb 14
"In this (rather long) article we will be investigating methods to emulate proprietary hypervisors under QEMU, which will allow researchers to interact with them in a controlled manner and debug them. Specifically, we will be presenting a minimal framework developed to bootstrap Samsung S8+
proprietary hypervisor as a demonstration, providing details and insights on key concepts on ARM low level development and virtualization extensions for interested readers to create their own frameworks and Actually Compile And Boot them ;). Finally, we will be investigating fuzzing implementations under this setup."
http://phrack.org/papers/...2 -
Let's face it: I am and will always be a tinkerer. Yes, I know my ways around, I can sneak into legacy code bases easily and throw new stuff in there, I've seen software stacks. But scarcely sound design, really modular. Even from the cleverer, experienced ones. They can master more complexity, so they can handle more spaghetti. Some essay from the 80's had this grand idea to organically 'grow' software. That's how it looks like most of the times: cancerous, parasitic super fungi (armillaria). Yeah, we all know have to fight bit-rot and entropy, but it was all lost before already. We'll never get rid of legacy protocols, legacy code.
And even when we go green field, start a fresh. Yeah, take a great design, make everything new, after some months of throwing features and outer constraints at the thing, it's the same old mud again.
But we can still dream on: some day I will design great APIs, I will have great test coverage, documentation, UML design, autometed tests, fuzzing, memchecking, I'll work professionally, clean coder style.
Pfft forget it. Maybe change for consulting, because we'll continue to dream of the 'clean' code, so you can sell the next 'recipe', development method. It's like diets. As effective. For the one selling.2 -
i hate to admit it, but android chrome new tab sometimes provides some amazing programming news.
like this one about rust fuzzing.
https://fuzzit.dev/2019/10/...
i know little about rust and nothing about fuzzing (although I did know about a similar concept used for videogame testing).
damn, this is the type of thing that makes me want to become excited to learn a lang.3 -
TL;DR: I should just stick to Python. I'm not touching front-end stuffs.
I got promoted to moderator of the subreddit of the game I play. Got greeted by a list of task involving tweaking the stylesheet (CSS). I said fine, I screwed around with CSS before I can screw with this again. So now I'm in charge of the whole op. Alone. Yay /s.
The objective is just dark-theme-ing the thing because white hurts (we all know that). So I fired up Firefox, made a test subreddit, cloned the whole stylesheet and sprites and started screwing around with my editor and Inspector Tool. And it hit me: One element refused to render (I don't if that's the correct technical term), and I don't even know why the fuck it didn't render. 15 minutes fuzzing through and it still gave a middle finger. Fine. Fuck you. Full revert, back to original. Then I changed the original sheet one change at a time, reloading after every changes. After changing everything, it suddenly work. What the fuck. Why the fuck. How the fuck. How the bloody fuck. How in the bloody fuck.
(""Fucks" per minute" sure is an effective measure of code quality)2 -
If I want to develop a fuzzer for an open source software, do I need to code it in the same language as the open source software is written?
-
I kid you not, last night had a weird dream. In it, as I walked into my place my girlfriend came up to me with a smile and guess what.... She turned into a terminal.. With green fonts. The vividness of the dream is still fuzzing my mind.3
-
I think anything from Domas (moveaxeaxeax) is beautiful, but project:rosenbridge is just a new level.
The amount of work, weeks of fuzzing and no documentation to find an entirely secret CPU that acts as a backdoor, and then watching him explain it all. It's purely amazing! -
You can have the best test coverage - even building your own fuzzing framework on the way.
You can have top notch devs adhering to state of the art development processes.
You can have as big a community and as well-funded a bugbounty program as you want...
All of that doesn't matter if you have chosen the wrong language:
https://googleprojectzero.blogspot.com/...
This would just have been an out-of-bounds exception instead of a buffer overflow using an attacker-controlled payload in any memory-safe language.
Language choice matters!
Choose wisely!13