Fuzzing Malware for Fun & Profit
summary
Coverage-guided fuzzing against malware binaries proves practical: a patched WinAFL built on DynamoRIO (netAFL on WinAFL + DynamoRIO) feeds forged C2 responses back into unpacked code and returns coverage, running ~20–30 execs/sec in a VM. Against Mirai it finds 42 unique crashes and ~430 paths from one malformed relative-URL bug after ~24 hours. Tests on Dexter show a stack buffer overflow over 255 bytes in cookie-based commands; TinyNuke hangs via infinite recursion from ~7,000 opening brackets. Tool and exploits work end-to-end.
AI-written summary · about
chapters (8)
- 0:00Introduction to bug hunting
- 3:24Fuzzing concepts
- 6:14Challenges with malware
- 9:31BinAFL and instrumentation
- 12:17Fuzzing demonstration
- 16:24Case study: Mirai
- 20:24Additional malware samples
- 23:28Q&A session
related talks
01h 15mMake your programs more reliable with Fuzzing
53mFuzz Testing for Fun and Profit
45mFuzzing with AFL
26mWhen Models Write Malware: Defending Against On-demand Exploits
20mAFL++ : Combining Incremental Steps of Fuzzing Research
52mStructure aware fuzzing
42mCPU Fuzzing: Automatic Discovery of...
45mAutomatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing