Re:This shouldn't have happened: A vulnerability postmortem
by moring on Thursday December 02, 2021 @12:54AM
(#29412991)
Is it possible to feed a fuzzer with information from static analysis to limit the search space? Such as, if you have a check like "someParameter > 0" in the code, have the fuzzer generate a positive, negative, and zero value for someParameter, but not thousands of them -- at least not based on this check alone -- because they will all behave the same.
[ Parent
| on HN ]
Re:This shouldn't have happened: A vulnerability postmortem
by baby on Thursday December 02, 2021 @01:46AM
(#29413247)
There's whitebox fuzzing that's starting to become a thing, when your fuzzer gets stuck you give the non-giving corpus to an SMT solver and it'll try to see if there exists an input that could uncover a new path. I'm really excited about these but haven't really followed the advances.