No source? No problem! High speed binary fuzzing Nspace & - PowerPoint PPT Presentation

No source? No problem! High speed binary fuzzing Nspace & @gannimo

About this talk ● Fuzzing binaries is hard! ◦ Few tools, complex setup ● Fuzzing binaries in the kernel is even harder! ● New approach based on static rewriting High Speed Binary Fuzzing - HexHive - 36C3 2

Kernel + ≈ 100M LoC Libc Desktop High Speed Binary Fuzzing - HexHive - 36C3 3

Fuzzing 101 OK Bug! Input generation Target High Speed Binary Fuzzing - HexHive - 36C3 4

Efgective fuzzing 101 ● Test cases must trigger bugs ◦ Coverage-guided fuzzing ● The fuzzer must detect bugs ◦ Sanitization ● Speed is key (zero sum game)! High Speed Binary Fuzzing - HexHive - 36C3 5

Fuzzing with source code ● Add instrumentation at compile time ● Short snippets of code for coverage tracking, sanitization, ... Instrumented Compiler Source code binary Coverage tracking, sanitization, ... High Speed Binary Fuzzing - HexHive - 36C3 6

Application Application Libraries Source No source Kernel Drivers High Speed Binary Fuzzing - HexHive - 36C3 7

Rewriting binaries ● Approach 0: black box fuzzing ● Approach 1: rewrite dynamically ◦ Translate target at runtime ◦ Terrible performance (10-100x slower) ● Approach 2: rewrite statically ◦ More complex analysis ◦ ...but much better performance! High Speed Binary Fuzzing - HexHive - 36C3 8

Static rewriting challenges ● Simply adding code breaks the target mov [rax + rbx*8], rdi mov [rax + rbx*8], rdi < n e w c o d e > dec rbx dec rbx jnz -7 jnz -7 ● Need to fjnd all references and adjust them High Speed Binary Fuzzing - HexHive - 36C3 9

Static rewriting challenges ● Scalars and references are indistinguishable ◦ Getting it wrong breaks the target m o v [ r b p - 0 x 8 ] , 0 x 4 0 0 a a e ? l o n g ( * f o o ) ( l o n g ) = & b a r ; l o n g f o o = 0 x 4 0 0 a a e ; High Speed Binary Fuzzing - HexHive - 36C3 10

Instrumenting binaries in the kernel Sanitization Coverage-guided fuzzing Instrumenting binaries High Speed Binary Fuzzing - HexHive - 36C3 11

Instrumenting binaries in the kernel Sanitization Coverage-guided fuzzing Instrumenting binaries High Speed Binary Fuzzing - HexHive - 36C3 12

RetroWrite [Oakland ‘20] ● System for static binary instrumentation ● Symbolized assembly fjles easy to instrument ● Implements coverage tracking and binary ASan High Speed Binary Fuzzing - HexHive - 36C3 13

Position-independent code ● Code that can be loaded at any address ● Required for: ASLR, shared libraries ● Cannot use hardcoded static addresses ◦ Must use relative addressing instead High Speed Binary Fuzzing - HexHive - 36C3 14

Position-independent code ● On x86_64, PIC leverages RIP-relative addressing ◦ l e a r a x , [ r i p + 0 x 1 2 3 4 ] ● Distinguish references from constants in PIE binaries ◦ RIP-relative = reference, everything else = constant High Speed Binary Fuzzing - HexHive - 36C3 15

Symbolization ● Symbolization replaces references with assembler labels lea rax, [rip + 0x1234] call 0x1337 dec rcx jnz -15 High Speed Binary Fuzzing - HexHive - 36C3 16

Symbolization ● Symbolization replaces references with assembler labels loop1: lea rax, [rip + 0x1234] call func1 1) Relative jumps/calls dec rcx jnz loop1 High Speed Binary Fuzzing - HexHive - 36C3 17

Symbolization ● Symbolization replaces references with assembler labels loop1: lea rax, [data1] call func1 1) Relative jumps/calls dec rcx 2) PC-relative addresses jnz loop1 High Speed Binary Fuzzing - HexHive - 36C3 18

Symbolization ● Symbolization replaces references with assembler labels loop1: lea rax, [data1] call func1 1) Relative jumps/calls dec rcx 2) PC-relative addresses jnz loop1 3) Data relocations High Speed Binary Fuzzing - HexHive - 36C3 19

Symbolization ● Symbolization replaces references with assembler labels loop1: lea rax, [data1] < n e w c o d e > 1) Relative jumps/calls call func1 2) PC-relative addresses dec rcx 3) Data relocations jnz loop1 High Speed Binary Fuzzing - HexHive - 36C3 20

Instrumenting binaries in the kernel Sanitization Coverage-guided fuzzing Instrumenting binaries High Speed Binary Fuzzing - HexHive - 36C3 21

Coverage-guided fuzzing ● Record test coverage (e.g. input[0] == ‘P’ with instrumentation) input[1] == ‘N’ ● Inputs that trigger new paths are “interesting” input[2] == ‘G’ ● Mutate interesting inputs to do_something() fail() discover new paths High Speed Binary Fuzzing - HexHive - 36C3 22

Coverage-guided fuzzing https://lcamtuf.blogspot.com/2014/11/pulling-jpegs-out-of-thin-air.html High Speed Binary Fuzzing - HexHive - 36C3 23

Instrumenting binaries in the kernel Sanitization Coverage-guided fuzzing Instrumenting binaries High Speed Binary Fuzzing - HexHive - 36C3 24

Address Sanitizer (ASan) ● Instrumentation catches memory corruption at runtime ◦ Arguably most dangerous class of bugs ● Very popular sanitizer ◦ Thousands of bugs in Chrome and Linux ● About 2x slowdown High Speed Binary Fuzzing - HexHive - 36C3 25

ASan red zones Red zone char buf[4]; buf strcpy (buf, “AAAAA”); Red zone High Speed Binary Fuzzing - HexHive - 36C3 26

Instrumenting binaries in the kernel Sanitization Coverage-guided fuzzing Instrumenting binaries High Speed Binary Fuzzing - HexHive - 36C3 27

RetroWrite instrumentation ● Coverage tracking: instrument basic block starts ● Binary ASan: instrument all memory accesses, link with libASan High Speed Binary Fuzzing - HexHive - 36C3 28

Kernel vs. userspace fuzzing Crash Tooling Determinism handling OS handles Single-threaded Easy to use and Userspace crashes code usually widely available gracefully deterministic Need VM to keep More complex Interrupts, many Kernel the system setup, fewer concurrent stable tools threads High Speed Binary Fuzzing - HexHive - 36C3 29

Kernel binary fuzzing ● Approach 0: black box fuzzing ● Approach 1: dynamic translation ◦ Slow! (10x +) ◦ No sanitization like ASan ● Approach 2: Intel Processor Trace (or similar) ◦ Requires hardware support ◦ Still no sanitization ● Approach 3: static rewriting High Speed Binary Fuzzing - HexHive - 36C3 30

kRetroWrite ● Apply RetroWrite to the kernel ● Implemented so far: support for Linux modules ● Demonstrates that RetroWrite applies to the kernel High Speed Binary Fuzzing - HexHive - 36C3 31

kRetroWrite ● Kernel modules are always position-independent ● Linux modules are ELF fjles ◦ Reuse RetroWrite’s symbolizer ● Implemented code coverage and binary ASan High Speed Binary Fuzzing - HexHive - 36C3 32

kRetroWrite coverage ● Idea: use kCov infrastructure ◦ Can interoperate with source-based kCov ● Call coverage collector at the start of each basic block ● Integrates with, e.g., syzkaller, or debugfs High Speed Binary Fuzzing - HexHive - 36C3 33

kRetroWrite coverage cmp rbx, 1234 jz block1 mov [rax], rbx mov [rax], 1234 High Speed Binary Fuzzing - HexHive - 36C3 34

kRetroWrite coverage c a l l t r a c e _ p c cmp rbx, 1234 jz block1 c a l l t r a c e _ p c c a l l t r a c e _ p c mov [rax], rbx mov [rax], 1234 High Speed Binary Fuzzing - HexHive - 36C3 35

kRetroWrite binary ASan ● In userspace: link with libASan ● In kernel: build kernel with KASan (kernel ASan) ● Reuse modifjed userspace instrumentation pass High Speed Binary Fuzzing - HexHive - 36C3 36

kRetroWrite binary ASan ● Instrument each memory access with a check ● Failed checks print a bug report ● Compatible with source-based kASan High Speed Binary Fuzzing - HexHive - 36C3 37

Fuzzing with kRetroWrite ● Rewritten modules can be loaded and fuzzed with standard kernel fuzzers ● So far: tested with syzkaller High Speed Binary Fuzzing - HexHive - 36C3 38

Instrumenting binaries in the kernel Sanitization Coverage-guided fuzzing Instrumenting binaries High Speed Binary Fuzzing - HexHive - 36C3 39

Our experiments ● Userspace: SPEC2006 runtime performance ◦ RetroWrite ASan ◦ Source ASan ◦ Valgrind memcheck ● Kernel: fuzz fjlesystems/drivers with syzkaller ◦ Source KASan + kCov ◦ kRetroWrite KASan + kCov High Speed Binary Fuzzing - HexHive - 36C3 40

Results - Userspace High Speed Binary Fuzzing - HexHive - 36C3 41

Preliminary results - kernel Exec/s - BTRFS Source kRetroWrite High Speed Binary Fuzzing - HexHive - 36C3 42

Demo

Let’s test kRetroWrite on a fjlesystem High Speed Binary Fuzzing - HexHive - 36C3 44

Instrumenting binaries in the kernel Sanitization Coverage-guided fuzzing Instrumenting binaries High Speed Binary Fuzzing - HexHive - 36C3 45