Trapfuzzer - Coverage-Guided Binary Fuzzing with Breakpoints

This course presents trapfuzzer, a Python and C tool for coverage-guided binary fuzzing using breakpoint-based instrumentation through GDB and Windows debuggers. It covers corpus distillation, tracing, fuzz scheduling, debugger integration, and applying the workflow to WPS Office.

Syllabus

Intro
What is Fuzzing?
What is Coverage-Guided Fuzzing?
Background
Inspiration
Overview
binary patcher - basic-block-info-file example
binary patcher - example
Seed Mutation
Fuzzer Module - Corpus Distillation
Trace module - Theory
Lets Fuzz WPS - Find Target Module
Lets Fuzz WPS - Linux Version of FileMon
GDB Python API
Workflow
Code - GDB Plugin
Code - Tracer Part
Speed up Instrument - accelerated mode
Lets Fuzz WPS Again!
Initial Results
GDB Internals
Modify GDB
Code for SIGTRAP
Architecture
Windows Support #2 - DbgEngTracer
Dialog Box
Preparing the Environment
Future Plans