Eu 19 Aschermann What The Fuzz

What the Fuzz
Cornelius Aschermann
Researcher at Ruhr University Bochum

Verification & Automated Bug Finding
Security Consultant
@is_eqv
github.com/eqv
cornelius.aschermann@rub.de
Sergej Schumilo
Researcher at Ruhr University Bochum

Automated Bug Finding & Everything Low Level
Security Consultant
@ms_s3c
github.com/schumilo
sergej.schumilo@rub.de
Manual Analysis
(doesn't scale that well)
Verification
Verification
Fuzzers
Fuzzing
Fuzzing
Fuzzing
Fuzzers are dumb?
Demo
8 min
How do Fuzzer Work?
How do Fuzzer Work?
How do Fuzzer Work?
How do Fuzzer Work?
... ...
0
...
...
1
0 1
How do Fuzzer Work?
... ...
0
...
...
1
0 1
How do Fuzzer Work?
... ...
0
...
...
1
0 1
How do Fuzzer Work?
... ...
0
...
...
1
0 1
How do Fuzzer Work?
How do Fuzzer Work?
... ...
0
...
...
1
0 1
How do Fuzzer Work?
... ...
0
...
...
1
0 1
How do Fuzzer Work?
... ...
0
...
...
1
0 1
How do Fuzzer Work?
How do Fuzzer Work?
...
0
...
...
...
1
0 1
How do Fuzzer Work?
...
0
...
...
...
1
0 1
How do Fuzzer Work?
Fuzzers
Artificial Intelligence for Testcase Generation
Key Takeaways:
Key Takeaways:
The Rest of this Talk
Past Research
Goal
But as a Fuzzer
Objective C
C
Pascal
Haskell
C++
x86 Ada
Go Rust
Delphi
Fortran
D
nim
Objective C
C
Pascal
Haskell
C++
x86 Ada
Go Rust
Delphi
Fortran
D
nim
R in g 3
Ring 0
Ring -1
VMM
Ker I
n el / U E F
U s er l a n d
R in g 3
Ring 0
Ring -1
VMM
Ker I
n el / U E F
U s er l a n d
N y x
Architecture
Coverage
Inputs Target
Fuzzer
Architecture
Kernel
Target
Coverage
Inputs
Fuzzer
Userland
Architecture
Kernel
Target
Coverage
Inputs
Fuzzer
Userland
Architecture
BOO
Kernel
Target
Coverage
Inputs
M
Fuzzer
Userland
Architecture
Kernel
Target
Coverage
Inputs
Fuzzer
Userland
Architecture
Kernel
Target
Coverage
Inputs
Fuzzer
VM Userland
Architecture
Kernel
Target
Coverage
Inputs
Fuzzer
VM Userland
Architecture
Kernel
BO OM
Target
Coverage
Inputs
Fuzzer
VM Userland
Target in a VM:
+ Fault Tolerance
Target in a VM:
+ Fault Tolerance
+ Parallelization
Architecture
Coverage
Inputs Target
Fuzzer
VM
Architecture
Target
Coverage
Inputs
Agent
Fuzzer
VM
Architecture
Coverage
Agent OS
Inputs
Fuzzer Target VM
VM
Key Takeaways:
Key Takeaways:
Architecture
Coverage
Agent OS
Inputs
Fuzzer Target VM
VM
Architecture
Intel PT
Coverage
Agent OS
Inputs
Fuzzer Target VM
VM
Intel Processor Trace
Intel PT Data
Taken
Not Taken
Target IP (0x1009)
Target IP (0x1055)
Memory Dump
Intel PT Data
Taken
Not Taken
Target IP (0x1009)
Target IP (0x1055)
Memory Dump
Intel PT Data Traces

Taken 0x1000
Not Taken 0x1004
Target IP (0x1009) 0x1009
Memory Dump
Intel PT Data Traces Transitions

Taken 0x1000 0x0000 -> 0x1000
Not Taken 0x1004 0x1000 -> 0x1004
Target IP (0x1009) 0x1009 0x1004 -> 0x1009
Memory Dump
Intel PT Data Traces Transitions Bitmap

Taken 0x1000 0x0000 -> 0x1000 10010010100101
Not Taken 0x1004 0x1000 -> 0x1004
Target IP (0x1009) 0x1009 0x1004 -> 0x1009
Nyx - One Input
QEMU-PT
Nyx
Nyx - One Input
QEMU-PT
Nyx
Nyx - One Input
QEMU-PT
Nyx
Nyx - One Input
QEMU-PT
Nyx
Nyx - One Input
QEMU-PT
Nyx
Nyx - One Input
QEMU-PT
Nyx
Nyx - Performance
Nyx AFL laf-Intel
execs/s 4000
3000
2000
1000
cxxfilt nm-new readelf size strings objdump as-new

Key Takeaways:
What if I told you
...
What if I told you
We can be even faster!

Super Fast VM Reloads
~6000
times per second
Reset Device State
Flatten Qemu VMState Tree

A
A B C D E
B C
D E
memcpy
Reset Memory
Dirty Page Logging

VM-Memory
Reset Memory
Dirty Page Logging

VM-Memory
Dirty Stack
Reset Memory
Dirty Page Logging

VM-Memory
Dirty Stack
Reset Memory
Dirty Page Logging

VM-Memory
Dirty Stack
Reset Hard Disk
Custom In-Memory
Copy-On-Write
Block Device Layer
O(1) Reset
Performance
Test: gdiplus_test.exe
Performance
Just Spawing Processes

~80 execs/sec
Performance

~80 execs/sec
Spawn & File Write

~40 execs/sec
Performance

~80 execs/sec
Spawn & File Write

~40 execs/sec
Nyx w. Intel PT & File Writes & Full System Reloads

~145 execs/sec!!!
Performance

~80 execs/sec
Spawn & File Write

~40 execs/sec
Nyx w. Intel PT & File Writes & Full System Reloads

~145 execs/sec!!!
Faster than Lihht

Light
Snapshots:
Avoid Startup Time
Snapshots:
Avoid Startup Time
+ Noise free
Snapshots:
Avoid Startup Time
+ Noise free
+ Statefulness
Bugs
Key Takeaways:
The Future of
Fuzzing
Harnesses
Harnesses
Harnesses
Harnesses
Harnesses
Harnesses
Harnesses
Harnesses
Harnesses
Harnesses
Harnesses
Harnesses
Harnesses
Harnesses
Harnesses
Harnesses
Harnesses
OS
Server Main Process
(uid: root)
IPC
Server Connection
(uid: nobody) Network
Harnesses
OS
Browser Process Network
IPC
Render Process
Harnesses
OS
Database IPC
Webserver
Subprocess
Network
Harnesses
Database
Subprocess
Webserver
Key Takeaways:
Improve
Usability
Interactive Targets
Interactive Targets
Time
recv recv recv recv
Specify Test Scenarios
img = Data(0x00, 0x23, 0x54, ... )

mnt = mount(img);
dat = "";
path = "/a"
mnt.create_file(path, data);
mnt.cwd(path);
mnt.umount();
img = Data(0x00, 0x23, 0x54, ... )

mnt = mount(img);
dat = "";
path = "/a"
Grammar
mnt.cwd(path);
Fuzzing?
mnt.umount();
Mutated
img = Data(0x00, 0x23, 0x54, ... )
mnt = mount(img); AFL-Style
dat = "";
path = "/a"
mnt.cwd(path);
mnt.umount();
img = NtfsImg(headers, clusters, ...)

mnt = mount(img);
dat = ""; Structural
path = "/a"
mnt.create_file(path, data); Mutations
mnt.cwd(path);
mnt.umount();
img = Data(0x00, 0x23, 0x54, ... )

mnt = mount(img);
dat = "";
path = "/a"
mnt.cwd(path);
mnt.umount();
Not reused
Interactive Targets
Time
recv recv recv recv
Focus Mutations
Interactive Targets
Snapshot Time
recv recv recv recv
Interactive Targets
Snapshot Time
recv recv recv recv
recv recv
Interactive Targets
Snapshot Time
recv recv recv recv
recv recv
recv recv
Interactive Targets
Snapshot Time
recv recv recv recv
Up to 99% recv recv
of time saved!
recv recv
Interactive Targets
Kernel Testing
meets
Feedback Fuzzing
[1] https://github.com/google/syzkaller
Interactive Targets
Network Protocol
meets
Feedback Fuzzing
Interactive Targets
Webcrawler
meets
Feedback Fuzzing
Key Takeaways:
We need
Bigger Guns
Key Takeaways:
We need
Better Specs
Using Fuzzers
Fuzzing
Fuzzing
Fuzzing
Fuzzing
Fuzzing
Fuzzing
Demo
Fuzzing
Create Analysis Tools that

Abstract away Inputs
From http://worrydream.com/LadderOfAbstraction/
Fuzzing
Fuzzing
Fuzzing
Debugger (gdb, olly, ... )
Fuzzing
Fuzzing
Fuzzing
Fuzzing
Fuzzing
Abstract away Time

Time traveling Debugger
(rr, REVEN, ... )
Fuzzing
Abstract away Time

(rr, REVEN, ... )

Fuzzing Debugger
????
Fuzzing
Abstract away Time

(rr, REVEN, ... )

Fuzzing Debugger
????
Fuzzing
Abstract away Time

(rr, REVEN, ... )

Fuzzing Debugger
????
Fuzzing
Abstract away Time

(rr, REVEN, ... )

Fuzzing Debugger
????
Fuzzing
Abstract away Time

(rr, REVEN, ... )

Fuzzing Debugger
????
A Better Tool...
id:000008,src:000001,op:havoc,rep:8,+cov Watch Points

00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70......
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...

00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70......
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...
Add Watch Point
...
00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70......
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...
Add Watch Point
...
00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70......
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...
Expr
OK

00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70......
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...
Expr
edx
OK

00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70......
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...
Expr
edx
OK

00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70......
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...

00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70...... 0804d050: edx
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...

00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70...... 0804d050: edx
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...

00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70...... 0804d050: edx Analyze Input
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
...
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...

00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70...... 0804d050: edx Analyze Input
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
...
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...

00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70...... 0804d050: edx
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...
if changed, we don't reach

the breakpoint

00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70...... 0804d050: edx
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...
directly affects the value

00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70...... 0804d050: edx
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...
doesn't matter
00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70...... 0804d050: edx
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...
id:000008,src:000001,op:havoc,rep:8,+cov affects the number how

Watch Points
00000000: 0000 1337 0000 0000 3730 0000 0000 0000 often the BP 0804d050:
...7....70...... was hit edx
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...

00000000: 0000 1337 0000 0000 3730 0000 0000 0000 ...7....70...... 0804d050: edx
00000010: 3df8 0600 0000 0000 0204 000f a85d 492b =............]I+
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...
FA KE
id:000008,src:000001,op:havoc,rep:8,+cov
00000000:
00000010:
0000
3df8
1337
0600
0000
0000
0000
0000
3730
0204
0000
000f
0000
a85d
0000
492b
...7....70......
=............]I+
Watch Points
0804d050: edx
00000020: 0404 004d c0bb e574 0708 00dc a741 0c05 ...M...t.....A..
00000030: aa10 361b 040c 00da bf00 9138 3a50 1ba2 ..6........8:P..
00000040: c381 a37b 0908 00ff 9853 25c5 15cd 5991 ...{.....S%...Y.
00000050: 0e08 005f 30b5 89fd 294f 454f ..._0...)OEO
A Better Tool...
Root Cause Analysis
Root Cause Analysis
Root Cause Analysis
val.type != MRB_TT_EXCEPTION
Root Cause Analysis
val.type < 123
Root Cause Analysis
val.type < 123
...
Root Cause Analysis
val.type < 123
...
Root Cause Analysis
val.type < 123
...
Heap Feng Shui
https://sean.heelan.io/heaplayout/
Heap Feng Shui
Heap Feng Shui
Heap Feng Shui
Overflow
Key Takeaways:
printf
Debugger
Time Traveling
Debugger
Fuzzer + Debugger
Unfuzzable Code
Code that doesn't run?
Firmware
Firmware
IO
Firmware
IO
?
? ?
Firmware
IO
Firmware
IO
P2IM [1]
[1] https://arxiv.org/pdf/1909.06472.pdf HALucinator [2]
[2] https://nebelwelt.net/publications/files/20SEC2.pdf
Key Takeaways:
You underestimate
the fuzzer
zz
n tiFu
A
AntiFuzz
AntiFuzz
AntiFuzz
Pick Path by hash(input)

AntiFuzz

AntiFuzz

AntiFuzz
SLOW
DOWN!
AntiFuzz
if(parse_error){
SLOW printf("couldn't parse\n");
exit(1);
DOWN! }
AntiFuzz
if(parse_error){
delay(1); //expensive calc
DOWN! exit(1);
}
AntiFuzz
if(parse_error){
delay(1); //expensive calc
DOWN! exit(1);
}
Signal Handler!
AntiFuzz
Symbolic Execution? Taint Tracking?

AntiFuzz
Symbolic Execution? Taint Tracking?
input = enc(dec(input));
AntiFuzz
objdump
Plain ob jd um p Protected
6000
# Branches covered
5000
4000
3000
2000
1000
Vuzzer AFL Hongg QSYM Vuzzer AFL Hongg QSYM

Key Takeaways:
Key Takeaways:
Fuzzers
As Building Blocks for a
New Generation of Tools
Let's Build Better Tools
github.com/RUB-SysSec/kAFL
github.com/RUB-SysSec/nautilus
github.com/RUB-SysSec/grimoire
github.com/RUB-SysSec/antifuzz
github.com/eqv/fuzz_ui
@is_eqv
github.com/eqv
cornelius.aschermann@rub.de
@ms_s3c
github.com/schumilo
sergej.schumilo@rub.de
Special Thanks to:

Ali Abbasi, Tim Blazytko, Robert Gawlik,
Emre Güler, Thorsten Holz, Moritz Schlögel,
Daniel Teuchert, Simone Wörner, and all the
others that made this research possible.

Eu 19 Aschermann What The Fuzz

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Eu 19 Aschermann What The Fuzz

Uploaded by

Copyright:

Available Formats

What the Fuzz

Researcher at Ruhr University Bochum

Researcher at Ruhr University Bochum

Intel PT Data Traces

Intel PT Data Traces Transitions

Intel PT Data Traces Transitions Bitmap

Nyx AFL laf-Intel

cxxﬁlt nm-new readelf size strings objdump as-new

We can be even faster!

Flatten Qemu VMState Tree

Dirty Page Logging

Dirty Page Logging

Dirty Page Logging

Dirty Page Logging

Just Spawing Processes

Just Spawing Processes

Spawn & File Write

Just Spawing Processes

Spawn & File Write

Nyx w. Intel PT & File Writes & Full System Reloads

Just Spawing Processes

Spawn & File Write

Nyx w. Intel PT & File Writes & Full System Reloads

Faster than Lihht

img = Data(0x00, 0x23, 0x54, ... )

img = Data(0x00, 0x23, 0x54, ... )

img = NtfsImg(headers, clusters, ...)

img = Data(0x00, 0x23, 0x54, ... )

Up to 99% recv recv

Create Analysis Tools that

Abstract away Time

Abstract away Time

Abstract away Inputs

Abstract away Time

Abstract away Inputs

Abstract away Time

Abstract away Inputs

Abstract away Time

Abstract away Inputs

Abstract away Time

Abstract away Inputs

id:000008,src:000001,op:havoc,rep:8,+cov Watch Points

id:000008,src:000001,op:havoc,rep:8,+cov Watch Points

Add Watch Point

Add Watch Point

id:000008,src:000001,op:havoc,rep:8,+cov Watch Points

id:000008,src:000001,op:havoc,rep:8,+cov Watch Points

id:000008,src:000001,op:havoc,rep:8,+cov Watch Points

id:000008,src:000001,op:havoc,rep:8,+cov Watch Points

id:000008,src:000001,op:havoc,rep:8,+cov Watch Points

id:000008,src:000001,op:havoc,rep:8,+cov Watch Points

id:000008,src:000001,op:havoc,rep:8,+cov Watch Points

id:000008,src:000001,op:havoc,rep:8,+cov Watch Points

if changed, we don't reach

id:000008,src:000001,op:havoc,rep:8,+cov Watch Points

directly aﬀects the value

id:000008,src:000001,op:havoc,rep:8,+cov aﬀects the number how

id:000008,src:000001,op:havoc,rep:8,+cov Watch Points

Pick Path by hash(input)

Pick Path by hash(input)

Pick Path by hash(input)

Symbolic Execution? Taint Tracking?

Symbolic Execution? Taint Tracking?