offensive-fuzzing

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Offensive Fuzzing

攻击性模糊测试

Fuzzer Types

Fuzzer 类型

Type	Coverage	Speed	Tools
BlackBox	Poor	Fast	Peach, Boofuzz
GreyBox	Good	Fast	AFL++, Honggfuzz, libFuzzer, WinAFL
Snapshot	Good	Fastest	Nyx, wtf, Snapchange
WhiteBox	Best	Slow	KLEE, QSYM, SymSan
Ensemble	Best	Fast	AFL++ + Honggfuzz + libFuzzer

GreyBox sub-variants: Directed (AFLGo, UAFuzz), Grammar (AFLSmart, Tlspuffin), Concolic (QSYM, Driller), Kernel (syzkaller, kAFL, wtf).

类型	覆盖率	速度	工具
BlackBox	较差	快	Peach、Boofuzz
GreyBox	良好	快	AFL++、Honggfuzz、libFuzzer、WinAFL
Snapshot	良好	最快	Nyx、wtf、Snapchange
WhiteBox	最佳	慢	KLEE、QSYM、SymSan
Ensemble	最佳	快	AFL++ + Honggfuzz + libFuzzer

GreyBox 子变体： Directed（AFLGo、UAFuzz）、Grammar（AFLSmart、Tlspuffin）、Concolic（QSYM、Driller）、Kernel（syzkaller、kAFL、wtf）。

Core Workflow

核心工作流

Research target → Choose analyses → Build harness → Seed corpus → Instrument → Fuzz → Triage crashes → Report

Research target → Choose analyses → Build harness → Seed corpus → Instrument → Fuzz → Triage crashes → Report

1. Research Target

1. 研究目标

Map all input surfaces (files, network, IPC, syscalls, IOCTL)
Identify high-value areas: previously patched code, complex parsers, newly added code, input ingestion points
For kernel modules: look beyond
```
copy_from_user
```
— DMA-BUF ops, page fault handlers, VM operation structs, allocation callbacks

梳理所有输入入口（文件、网络、IPC、系统调用、IOCTL）
确定高价值区域：过去打过补丁的代码、复杂解析器、新增代码、输入接入点
对于内核模块：不要局限于
```
copy_from_user
```
——还要关注 DMA-BUF 操作、缺页处理程序、VM 操作结构体和分配回调

2. Instrument and Build

2. 插桩与构建

bash

undefined

bash

undefined

AFL++ (preferred for GreyBox)

CC=afl-clang-fast CXX=afl-clang-fast++ cmake -DCMAKE_BUILD_TYPE=Release .. && make -j

libFuzzer + ASan/UBSan (C/C++)

cmake -DCMAKE_CXX_FLAGS="-fsanitize=fuzzer,address,undefined -O1 -g" ..

CmpLog build for hard compares

AFL_LLVM_CMPLOG=1 CC=afl-clang-fast CXX=afl-clang-fast++ make clean all


**Windows (MSVC):** `Project Properties → C/C++ → Address Sanitizer: Yes (/fsanitize=address)`

AFL_LLVM_CMPLOG=1 CC=afl-clang-fast CXX=afl-clang-fast++ make clean all


**Windows（MSVC）：** `Project Properties → C/C++ → Address Sanitizer: Yes (/fsanitize=address)`

3. Write Harness

3. 编写 Harness

libFuzzer (C++):

cpp

#include <cstdint>
#include <cstddef>
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
    parse_or_process(data, size);
    return 0;
}

Honggfuzz HF_ITER (persistent mode — preferred for large targets):

cpp

#include "honggfuzz.h"
int main(int argc, char** argv) {
    initialize_target(); // runs once
    for (;;) {
        size_t len; uint8_t *buf;
        HF_ITER(&buf, &len);
        FILE* s = fmemopen(buf, len, "r");
        target_function(s);
        fclose(s);
        reset_target_state();
    }
}

AFL++ persistent mode (
__AFL_LOOP
):

cpp

while (__AFL_LOOP(10000)) {
    // re-read input and process
}

macOS IPC (Mach message fuzzing):

void *lib_handle = dlopen("libexample.dylib", RTLD_LAZY);
pFunction = dlsym(lib_handle, "DesiredFunction");

libFuzzer（C++）：

cpp

#include <cstdint>
#include <cstddef>
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
    parse_or_process(data, size);
    return 0;
}

Honggfuzz HF_ITER（persistent mode——大型目标首选）：

cpp

#include "honggfuzz.h"
int main(int argc, char** argv) {
    initialize_target(); // runs once
    for (;;) {
        size_t len; uint8_t *buf;
        HF_ITER(&buf, &len);
        FILE* s = fmemopen(buf, len, "r");
        target_function(s);
        fclose(s);
        reset_target_state();
    }
}

AFL++ persistent mode（
__AFL_LOOP
）：

cpp

while (__AFL_LOOP(10000)) {
    // re-read input and process
}

macOS IPC（Mach 消息 fuzzing）：

void *lib_handle = dlopen("libexample.dylib", RTLD_LAZY);
pFunction = dlsym(lib_handle, "DesiredFunction");

4. Build Seed Corpus

4. 构建种子语料库

Pull from target's test suite, bug reports, and real-world samples
Web-crawl (Common Crawl) for file formats; filter by MIME type

Minimize:

afl-cmin -i raw_corpus -o seeds -- ./target @@

Trim inputs:

afl-tmin -i crash -o crash.min -- ./target @@

从目标的测试套件、漏洞报告和真实样本中获取输入
针对文件格式进行网络爬取（Common Crawl）；按 MIME 类型筛选

最小化：

afl-cmin -i raw_corpus -o seeds -- ./target @@

裁剪输入：

afl-tmin -i crash -o crash.min -- ./target @@

5. Launch Fuzzing

5. 启动 fuzzing

AFL++ parallel (primary + secondary with cmplog):

bash

afl-fuzz -M f1 -i seeds -o findings -x dict.txt -- ./target @@
afl-fuzz -S s1 -i seeds -o findings -c 0 -- ./target @@

libFuzzer:

bash

./target_libfuzzer corpus/ -max_total_time=3600 -workers=4

Binary-only (QEMU):

bash

afl-fuzz -Q -i seeds -o findings -- target.exe @@

Snapshot (AFL++ Nyx):

bash

NYX_MODE=1 AFL_MAP_SIZE=1048576 afl-fuzz -i seeds -o findings -- ./target_nyx @@

Ensemble (AFL++ + Honggfuzz sharing corpus):

bash

undefined

AFL++ 并行模式（主实例 + 使用 cmplog 的辅助实例）：

bash

afl-fuzz -M f1 -i seeds -o findings -x dict.txt -- ./target @@
afl-fuzz -S s1 -i seeds -o findings -c 0 -- ./target @@

libFuzzer：

bash

./target_libfuzzer corpus/ -max_total_time=3600 -workers=4

Binary-only（QEMU）：

bash

afl-fuzz -Q -i seeds -o findings -- target.exe @@

Snapshot（AFL++ Nyx）：

bash

NYX_MODE=1 AFL_MAP_SIZE=1048576 afl-fuzz -i seeds -o findings -- ./target_nyx @@

Ensemble（AFL++ + Honggfuzz 共享语料库）：

bash

undefined

Terminal 1

afl-fuzz -M fuzzer1 -i seeds -o sync_dir -- ./target @@

Terminal 2

../honggfuzz/honggfuzz -i sync_dir/fuzzer1/queue -W sync_dir/hfuzz
--linux_perf_ipt_block -t 10 -- ./target FILE

undefined

../honggfuzz/honggfuzz -i sync_dir/fuzzer1/queue -W sync_dir/hfuzz
--linux_perf_ipt_block -t 10 -- ./target FILE

undefined

6. Monitor and Unstick

6. 监控并解除卡滞

If progress stalls:

Enable CmpLog:
```
-c 0
```
on AFL++ secondaries
Add dictionary:
```
-x dict.txt
```
or
```
AFL_TOKEN_FILE
```
Switch to directed fuzzing (AFLGo) targeting specific BBs/functions
Use concolic assistance (QSYM, Driller) on hard branches
Snapshot the target to increase exec/s
```
AFL_MAP_SIZE=1048576
```
,
```
-L 0
```
for MOpt scheduler

如果进展停滞：

启用 CmpLog：在 AFL++ 辅助实例上使用
```
-c 0
```
添加字典：使用
```
-x dict.txt
```
或
```
AFL_TOKEN_FILE
```
切换到定向 fuzzing（AFLGo），针对特定 BB/函数
对难以探索的分支使用 concolic 辅助（QSYM、Driller）
为目标创建快照，以提高 exec/s
使用
```
AFL_MAP_SIZE=1048576
```
，并为 MOpt 调度器设置
```
-L 0
```

7. Triage Crashes

7. 崩溃分诊

bash

undefined

bash

undefined

1. Minimize

afl-tmin -i crash -o crash.min -- ./target @@

2. Symbolize

ASAN_OPTIONS=abort_on_error=1:symbolize=1 ./target crash.min 2>asan.log

3. Hash + bucket

./cov-tool --bbids ./target crash.min > cov.hash ./bucket.py --key "$(cat cov.hash)" --log asan.log --out triage/


**Sanitizer env quick reference:**

ASAN_OPTIONS=abort_on_error=1:symbolize=1:detect_stack_use_after_return=1 UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1 TSAN_OPTIONS=halt_on_error=1:history_size=7 MSAN_OPTIONS=poison_in_dtor=1:track_origins=2

undefined

./cov-tool --bbids ./target crash.min > cov.hash ./bucket.py --key "$(cat cov.hash)" --log asan.log --out triage/


**Sanitizer 环境变量快速参考：**

undefined

Oracle Selection

Oracle 选择

Bug Class	Oracle
Memory safety	ASan, HWASan (AArch64, lower overhead)
Uninitialized reads	MSan
Concurrency	TSan
Undefined behavior	UBSan
Type safety	TypeSan
Heap hardening	Scudo Hardened Allocator
Logic bugs	Differential / idempotency oracles
Kernel memory	KASAN, KMSAN, KCSAN
Kernel UB	KUBSan ( `CONFIG_UBSAN_TRAP=y` )
CFI	KCFI ( `-fsanitize=kcfi` , Clang 18)
Binary-only	QASAN (QEMU+ASan), DynamoRIO

Property oracle patterns:

Idempotency:
```
f(x) == f(f(x))
```
Differential: compare two impls, bucket on output mismatch
Invariants: monotonic lengths, checksum equality, schema validation post-parse

漏洞类别	Oracle
内存安全	ASan、HWASan（AArch64，开销更低）
未初始化读取	MSan
并发问题	TSan
未定义行为	UBSan
类型安全	TypeSan
堆加固	Scudo Hardened Allocator
逻辑漏洞	差分 / 幂等性 Oracle
内核内存	KASAN、KMSAN、KCSAN
内核 UB	KUBSan（ `CONFIG_UBSAN_TRAP=y` ）
CFI	KCFI（ `-fsanitize=kcfi` ，Clang 18）
Binary-only	QASAN（QEMU+ASan）、DynamoRIO

属性 Oracle 模式：

幂等性：
```
f(x) == f(f(x))
```
差分：比较两个实现，按输出不匹配情况分桶
不变量：长度单调性、校验和相等、解析后进行 schema 验证

Specialized Targets

专项目标

Kernel (Linux) — syzkaller

内核（Linux）——syzkaller

json

{
  "target": "linux/arm64",
  "http": ":56700",
  "workdir": "/path/to/workdir",
  "kernel_obj": "/path/to/kernel",
  "image": "/path/to/rootfs.ext3",
  "sshkey": "/path/to/id_rsa",
  "procs": 8,
  "enable_syscalls": ["openat$module_name", "ioctl$IOCTL_CMD", "mmap"],
  "type": "qemu",
  "vm": { "count": 4, "cpu": 2, "mem": 2048 }
}

Limit
```
enable_syscalls
```
to deepen coverage on specific subsystems
Use
```
syz-extract
```
to pull constants for custom modules

Enable

CONFIG_KASAN=y

CONFIG_KCFI=y

CONFIG_DEBUG_INFO_BTF=y

Use
```
kcov
```
filters and
```
syz_cover_filter
```
to direct coverage
Network fuzzing: inject via
```
TUN/TAP
```
+ pseudo-syscalls (
```
syz_emit_ethernet
```
)

Crash decode:

./scripts/decode_stacktrace.sh vmlinux ... < dmesg.log

syzkaller repro:

bash

syz-execprog -repeat=0 -procs=1 -cover=0 -debug target.repro

json

{
  "target": "linux/arm64",
  "http": ":56700",
  "workdir": "/path/to/workdir",
  "kernel_obj": "/path/to/kernel",
  "image": "/path/to/rootfs.ext3",
  "sshkey": "/path/to/id_rsa",
  "procs": 8,
  "enable_syscalls": ["openat$module_name", "ioctl$IOCTL_CMD", "mmap"],
  "type": "qemu",
  "vm": { "count": 4, "cpu": 2, "mem": 2048 }
}

将
```
enable_syscalls
```
限制在特定子系统内，以加深对应子系统的覆盖深度
使用
```
syz-extract
```
提取自定义模块所需的常量

启用

CONFIG_KASAN=y

、

CONFIG_KCFI=y

、

CONFIG_DEBUG_INFO_BTF=y

使用
```
kcov
```
过滤器和
```
syz_cover_filter
```
引导覆盖率
网络 fuzzing：通过
```
TUN/TAP
```
+ 伪系统调用（
```
syz_emit_ethernet
```
）注入

崩溃解码：

./scripts/decode_stacktrace.sh vmlinux ... < dmesg.log

syzkaller 复现：

bash

syz-execprog -repeat=0 -procs=1 -cover=0 -debug target.repro

EDR / Windows Scanning Engines

EDR / Windows 扫描引擎

WTF snapshot harness skeleton (mpengine.dll / mini-filter):

cpp

g_Backend->SetBreakpoint("nt!KeBugCheck2", [](Backend_t *Backend) {
    const uint64_t BCode = Backend->GetArg(0);
    Backend->Stop(Crash_t(fmt::format("crash-{:#x}", BCode)));
});

FilterConnectionPort fuzzing:

cpp

HANDLE hPort;
FilterConnectCommunicationPort(L"\\PortName", 0, NULL, 0, NULL, &hPort);
FilterSendMessage(hPort, fuzzData, sizeof(fuzzData), NULL, 0, &bytesReturned);

IOCTL fuzzing pattern:

cpp

HANDLE hDev = CreateFile(L"\\\\.\\DeviceName", GENERIC_READ|GENERIC_WRITE, ...);
DeviceIoControl(hDev, ioctlCode, inputBuf, inputLen, outBuf, outLen, &ret, NULL);

Take snapshots after initialization, right before parse/dispatch loop
Use IDA Lighthouse for coverage visualization

Monitor:

DRIVER_VERIFIER_DETECTED_VIOLATION (0xc4)

IRQL_NOT_LESS_OR_EQUAL (0xa)

WinDbg:

.symfix; !analyze -v; k; !heap -p -a @rax

Cross-platform mpengine.dll on Linux (loadlibrary + HF_ITER + Intel PT):

cpp

// Bypass Lua VM to avoid stability issues
insert_function_redirect((void*)luaV_execute_address, my_lua_exec, HOOK_REPLACE_FUNCTION);
for (;;) {
    HF_ITER(&buf, &len);
    ScanDescriptor.UserPtr = fmemopen(buf, len, "r");
    __rsignal(&KernelHandle, RSIG_SCAN_STREAMBUFFER, &ScanParams, sizeof ScanParams);
}

WTF 快照 Harness 骨架（mpengine.dll / mini-filter）：

cpp

g_Backend->SetBreakpoint("nt!KeBugCheck2", [](Backend_t *Backend) {
    const uint64_t BCode = Backend->GetArg(0);
    Backend->Stop(Crash_t(fmt::format("crash-{:#x}", BCode)));
});

FilterConnectionPort fuzzing：

cpp

HANDLE hPort;
FilterConnectCommunicationPort(L"\\PortName", 0, NULL, 0, NULL, &hPort);
FilterSendMessage(hPort, fuzzData, sizeof(fuzzData), NULL, 0, &bytesReturned);

IOCTL fuzzing 模式：

cpp

HANDLE hDev = CreateFile(L"\\\\.\\DeviceName", GENERIC_READ|GENERIC_WRITE, ...);
DeviceIoControl(hDev, ioctlCode, inputBuf, inputLen, outBuf, outLen, &ret, NULL);

在初始化完成后、进入解析/分派循环前拍摄快照
使用 IDA Lighthouse 可视化覆盖率

监控：

DRIVER_VERIFIER_DETECTED_VIOLATION (0xc4)

、

IRQL_NOT_LESS_OR_EQUAL (0xa)

WinDbg：

.symfix; !analyze -v; k; !heap -p -a @rax

Linux 上的跨平台 mpengine.dll（loadlibrary + HF_ITER + Intel PT）：

cpp

// Bypass Lua VM to avoid stability issues
insert_function_redirect((void*)luaV_execute_address, my_lua_exec, HOOK_REPLACE_FUNCTION);
for (;;) {
    HF_ITER(&buf, &len);
    ScanDescriptor.UserPtr = fmemopen(buf, len, "r");
    __rsignal(&KernelHandle, RSIG_SCAN_STREAMBUFFER, &ScanParams, sizeof ScanParams);
}

Rust

bash

undefined

bash

undefined

Full Rust fuzzing pipeline

cargo test # 1. property tests cargo +nightly miri test # 2. UB via interpreter cargo +nightly careful test # 3. runtime bounds checks cargo fuzz run fuzz_target_1 -- -max_total_time=3600 # 4. libFuzzer crashes RUSTFLAGS="--cfg loom" cargo test --release # 5. concurrency (if needed) cargo fuzz coverage fuzz_target_1 # 6. coverage report


Focus unsafe blocks on: `Vec::from_raw_parts`, unchecked indexing, `transmute` size mismatches, pointer arithmetic, FFI integer truncation.


重点检查 unsafe 代码块中的以下问题：`Vec::from_raw_parts`、未经检查的索引、`transmute` 尺寸不匹配、指针运算和 FFI 整数截断。

Embedded / Binary-Only

嵌入式 / Binary-only

LibAFL: Modular Rust framework; Unicorn engine, snapshot module, LBRFeedback (zero-instrumentation on Intel), SAND decoupled sanitization
Retrowrite / QASAN: Binary rewriting for coverage + ASan without source
Nautilus: Grammar-based fuzzing for structured formats

LibAFL：模块化 Rust 框架；Unicorn 引擎、snapshot 模块、LBRFeedback（Intel 零插桩）、SAND 解耦式 sanitizer
Retrowrite / QASAN：在没有源码的情况下通过二进制重写实现覆盖率 + ASan
Nautilus：面向结构化格式的基于语法的 fuzzing

Language Ecosystems

语言生态

Go 1.18+:
```
go test -fuzz=Fuzz -run=^$ ./...
```
Python: Atheris (CPython native extension fuzzing)
Rust:
```
cargo-fuzz
```
or
```
honggfuzz-rs
```
JS engines: Fuzzilli with extended instrumentation (
```
__builtin_return_address(0)
```
for PC tracking)
Wasm runtimes:
```
wasmtime-fuzz
```
,
```
wafl
```
for differential fuzzing across V8/Wasmer/Wasmtime
Smart contracts: Echidna, Foundry-fuzz (Solidity); Move-Fuzz (Aptos/Sui)

Go 1.18+：
```
go test -fuzz=Fuzz -run=^$ ./...
```
Python：Atheris（CPython 原生扩展 fuzzing）
Rust：
```
cargo-fuzz
```
或
```
honggfuzz-rs
```
JS 引擎：Fuzzilli，配备扩展插桩（
```
__builtin_return_address(0)
```
用于 PC 跟踪）
Wasm 运行时：
```
wasmtime-fuzz
```
、
```
wafl
```
，用于跨 V8/Wasmer/Wasmtime 的差分 fuzzing
智能合约：Echidna、Foundry-fuzz（Solidity）；Move-Fuzz（Aptos/Sui）

CI/CD Integration

CI/CD 集成

yaml

- name: Build with afl-clang-fast
  run: CC=afl-clang-fast make -j
- name: Fuzz (smoke, 15 min)
  run: timeout 15m afl-fuzz -i seeds -o findings -- ./target @@ || true
- name: Upload crashes
  if: always()
  uses: actions/upload-artifact@v4
  with:
    path: findings/**/crashes/*

Use ClusterFuzzLite for persistent continuous fuzzing; cache corpora between runs.

yaml

- name: Build with afl-clang-fast
  run: CC=afl-clang-fast make -j
- name: Fuzz (smoke, 15 min)
  run: timeout 15m afl-fuzz -i seeds -o findings -- ./target @@ || true
- name: Upload crashes
  if: always()
  uses: actions/upload-artifact@v4
  with:
    path: findings/**/crashes/*

使用 ClusterFuzzLite 执行持久化持续 fuzzing；在多次运行之间缓存语料库。

Crash Analysis Quick Reference

崩溃分析快速参考

Linux:

bash

ulimit -c unlimited && sysctl -w kernel.core_pattern=core.%e.%p
gdb -q ./target core.* -ex 'bt' -ex 'info reg' -ex q
addr2line -e ./target 0xDEADBEEF

Windows:

powershell

undefined

Linux：

bash

ulimit -c unlimited && sysctl -w kernel.core_pattern=core.%e.%p
gdb -q ./target core.* -ex 'bt' -ex 'info reg' -ex q
addr2line -e ./target 0xDEADBEEF

Windows：

powershell

undefined

Enable local dumps

New-Item 'HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps' -Force

PageHeap

gflags /p /enable target.exe /full


**Kernel KASAN/KMSAN:**
```bash
dmesg -T | egrep -i 'kasan|kmsan' -A 60
./scripts/decode_stacktrace.sh vmlinux /lib/modules/$(uname -r)/build < dmesg.log

Reproducibility: pin CPU governor, disable ASLR only where safe, fix RNG seeds, save input sequences in persistent mode, record binary hashes and sanitizer options with every crash.

gflags /p /enable target.exe /full


**Kernel KASAN/KMSAN：**
```bash
dmesg -T | egrep -i 'kasan|kmsan' -A 60
./scripts/decode_stacktrace.sh vmlinux /lib/modules/$(uname -r)/build < dmesg.log

**可复现性：**固定 CPU governor，仅在安全的情况下禁用 ASLR，固定 RNG 种子，在 persistent mode 下保存输入序列，并为每个崩溃记录二进制文件哈希和 sanitizer 选项。

Tool Index

工具索引

Tool	Use Case
AFL++	General GreyBox, CmpLog, MOpt, Nyx
Honggfuzz	Intel PT, crash detection, HF_ITER
libFuzzer	In-process, source available
syzkaller	Linux/Windows kernel syscall fuzzing
wtf	Snapshot fuzzing, Windows targets
Nyx	AFL++ snapshot mode (Intel PT)
Snapchange	AWS snapshot fuzzing
LibAFL	Custom Rust fuzzing framework
AFLGo	Directed fuzzing to target BB/function
kAFL	Kernel + OS fuzzing
Jackalope	Binary coverage-guided (Windows/macOS)
cargo-fuzz	Rust libFuzzer integration
Atheris	Python fuzzing
Nautilus	Grammar-based fuzzing
AFLTriage	Automated crash triage
afl-cov	Coverage analysis for AFL++
ClusterFuzz	Distributed fuzzing infrastructure

工具	用途
AFL++	通用 GreyBox、CmpLog、MOpt、Nyx
Honggfuzz	Intel PT、崩溃检测、HF_ITER
libFuzzer	进程内、源码可用
syzkaller	Linux/Windows 内核系统调用 fuzzing
wtf	快照 fuzzing、Windows 目标
Nyx	AFL++ 快照模式（Intel PT）
Snapchange	AWS 快照 fuzzing
LibAFL	自定义 Rust fuzzing 框架
AFLGo	面向特定 BB/函数的定向 fuzzing
kAFL	内核 + OS fuzzing
Jackalope	二进制覆盖率引导（Windows/macOS）
cargo-fuzz	Rust libFuzzer 集成
Atheris	Python fuzzing
Nautilus	基于语法的 fuzzing
AFLTriage	自动化崩溃分诊
afl-cov	AFL++ 覆盖率分析
ClusterFuzz	分布式 fuzzing 基础设施