RDP and The Power of Deterministic Snapshot Fuzzing

on YouTube ↗41m

" summary

SNAFUzz uses a custom emulator and VM snapshot workflow to run deterministic snapshot fuzzing, reliably reproducing crashes and producing reprofiles that replay identically. It adds extra-permission address sanitizer hooks and allocation tracking inside the guest to catch out‑of‑bounds, use‑after‑free and double‑free. The system finds a simple kernel arbitrary‑increment bug (CVE‑2025‑[Undisclosed_0] reported), a heap metadata leak in Microsoft RDP (CVE‑2025‑32715), and an RCE in a pre‑release RDP client; SNAFUzz is now open source.

AI-written summary · about

" chapters (6)

1. 0:00Introduction to snapshot fuzzing
2. 14:24Simple kernel vulnerability demo
3. 22:35Information disclosure in RDP
4. 25:45Remote code execution in RDP
5. 37:52Summary and open source release
6. 38:39Q&A session

" related talks

• 39mFuzzing and Exploiting Virtual Channels in Microsoft Remote Desktop Protocol for Fun and ProfitYeongjin Jang, Chun Sung Park, Seungjoo Kim, Ki Taek Lee · Black Hat Europe 2019
• 46mFor The Win: The Art Of The Windows Kernel FuzzingGuangming Liu · HITBSecConf 2019 Amsterdam
• 50mWhat the FuzzCornelius Aschermann, Sergej Schumilo · Black Hat Europe 2019
• 34m1-Click-Fuzz：Systematically Fuzzing the Windows Kernel Driver with Symbolic Execution.Sangjun Park, Yunjin Park, Jongseong Kim · CODE BLUE 2024
• 39mDiving into Windows Remote Access Service for Pre-Auth BugsYuki Chen · Black Hat USA 2023
• 28mFuzzing Malware for Fun & ProfitMaksim Shudrak · BSidesSF 2019
• 44mFor the Greater Good: Leveraging VMware's RPC Interface for fun and profitJasiel Spelman · CODE BLUE 2017
• 39mEL3XIR: Fuzzing COTS Secure MonitorsMarcel Busch, Christian Lindenmeier · Hardwear.io Netherlands 2024