My Fuzzy Driver
summary
Shows how researchers combined the kAFL fuzzer with Intel Processor Trace (PT) and a driver-specific input grammar to fuzz kernel drivers (Linux/Android/Windows/Solaris) without needing source code, aiming to find high-privilege driver vulnerabilities.
AI-written summary · about
chapters (25)
- 0:00Intro
- 3:29Windows' privilege level architecture
- 4:26Windows Drivers 101
- 5:45WDM Drivers
- 6:40Driver Bug Hunting 101
- 8:42Driver's Anatomy II
- 10:03Dispatch Routine
- 11:50IOCTL Code
- 12:04Required Access
- 12:37Transfer Type
- 12:53METHOD_NEITHER = Mother of all evil
- 14:05Probing
- 20:29Bug Example III
- 22:38Discovering Accessible Devices
- 24:21Harness Generation
- 26:11Grammar 101
- 27:06Grammar Approaches
- 29:48Fuzzing Concepts
- 31:56KAFL Feedback
- 39:06KAFL Virtualization Infra
- 42:40Setup Story
- 43:06Harness: Initialization
- 43:31Harness: Fuzzing Loop
- 46:26What's Next?
- 46:44Takeaways
related talks
28mkAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
34m1-Click-Fuzz：Systematically Fuzzing the Windows Kernel Driver with Symbolic Execution.
53mDIFUZE: Android Kernel Driver Fuzzing
50mWhat the Fuzz
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
01mFun and Practice for exercising your ARM(64)
46mBypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL
21mFUZE: Towards Facilitating Exploit Generation for Kernel UAF Vulnerabilities