Icicle: Icicle is an experimental fuzzing-specific, multi-architecture emulation framework. - https://github.com/icicle-emu/icicle-emu
GitHub
GitHub - icicle-emu/icicle-emu: Core emulator components for Icicle
Core emulator components for Icicle. Contribute to icicle-emu/icicle-emu development by creating an account on GitHub.
❤2
Sanitize your C++ containers: ASan annotations step-by-step - https://blog.trailofbits.com/2024/09/10/sanitize-your-c-containers-asan-annotations-step-by-step/
The Trail of Bits Blog
Sanitize your C++ containers: ASan annotations step-by-step
AddressSanitizer (ASan) is a compiler plugin that helps detect memory errors like buffer overflows or use-after-frees. In this post, we explain how to equip your C++ code with ASan annotations to find more bugs. We also show our work on ASan in GCC and LLVM.…
❤1
Look Ma, No Input Samples! Mining Input Grammars from Code with Symbolic Parsing - https://dl.acm.org/doi/10.1145/3663529.3663790
ACM Conferences
Look Ma, No Input Samples! Mining Input Grammars from Code with Symbolic Parsing | Companion Proceedings of the 32nd ACM International…
❤1
Reasons for the unreasonable success of fuzzing - https://docs.google.com/presentation/d/1vw9lywrMnNojiOIu-xU5KXZz7WzE0MYNQF6V7n6vyY8/edit#slide=id.g2768ca7ef44_0_65
Google Docs
The unreasonable success of Fuzzing
Reasons for the unreasonable success of fuzzing Does ML’s “bitter lesson” apply to bug discovery?
❤1
Hunting Bugs in Linux Kernel With KASAN: How to Use it & What's the Benefit? - https://slavamoskvin.com/hunting-bugs-in-linux-kernel-with-kasan-how-to-use-it-whats-the-benefit/
❤1
FUZZING'24 Keynote: "Is 'AI' useful for fuzzing?" - https://www.youtube.com/watch?v=4BPJXmrdmls
❤1
FUZZING'24 Keynote: "Reasons for the Unreasonable Success of Fuzzing" - https://www.youtube.com/watch?v=Jd1hItbf52k
YouTube
FUZZING'24 Keynote: "Reasons for the Unreasonable Success of Fuzzing" by Thomas Dullien
FUZZING'24 Keynote: "Reasons for the Unreasonable Success of Fuzzing" by Thomas Dullien
Abstract: The hacker culture of my youth (90s) was a very typical male-centric teenage subculture, with norms and value systems that were at odds with broader society.…
Abstract: The hacker culture of my youth (90s) was a very typical male-centric teenage subculture, with norms and value systems that were at odds with broader society.…
❤2
Fuzzing from First Principles - https://zerodayengineering.com/research/slides/FuzzingFromFirstPrinciples.pdf
❤1
Securing the software commons: Standards, Automation, and AI for a Resilient Open Source Future - https://drive.google.com/file/d/186iq3Yo8OJaMKLwtANfXgxYKYxcgq3ZR/view / https://www.youtube.com/watch?v=NwI2MkANdtk
YouTube
Keynote: Securing the Software Commons: Standards, Automation, and AI for a Resilie... Abhishek Arya
Keynote: Securing the Software Commons: Standards, Automation, and AI for a Resilient Open Source Future - Abhishek Arya, Principal Engineer, Google Open Source and Supply Chain Security, Google
Open source software forms a critical component of our modern…
Open source software forms a critical component of our modern…
❤1🔥1
LLM-based Fuzz Harness generation with OSS-Fuzz-gen - https://youtu.be/RR7CUyOtYXY?si=AvoF950UA0s7ReaK
YouTube
LLM-based Fuzz Harness generation with OSS-Fuzz-gen
This video is a short introduction on how to use OSS-Fuzz-gen to generate fuzzing harnesses.
🔥1
Lessons from the buzz: What have we learned from fuzzing the eBPF verifier - https://lpc.events/event/18/contributions/1946/attachments/1473/3119/Lessons%20from%20the%20buzz%20-%20LPC.pdf / https://www.youtube.com/live/mfMbtQYasB0?t=4035s
❤3
Google & Arm - Raising The Bar on GPU Security - https://security.googleblog.com/2024/09/google-arm-raising-bar-on-gpu-security.html
Google Online Security Blog
Google & Arm - Raising The Bar on GPU Security
Posted by Xuan Xing, Eugene Rodionov, Jon Bottarini, Adam Bacchus - Android Red Team;
Amit Chaudhary, Lyndon Fawcett, Joseph Artgole - ...
Amit Chaudhary, Lyndon Fawcett, Joseph Artgole - ...
😁1
DarthShader: Fuzzing WebGPU Shader Translators & Compilers - https://web3.arxiv.org/pdf/2409.01824
🔥1😁1
Differential fuzzing for cryptography - https://blog.quarkslab.com/differential-fuzzing-for-cryptography.html
Quarkslab
Differential fuzzing for cryptography - Quarkslab's blog
Following a brief introduction to differential fuzzing, this blog post reviews the leading tools that leverage it for testing cryptographic primitives. In the second half, we present a method for creating a differential fuzzer along with the results we obtained.
🔥3
Understanding and Improving Coverage Tracking with AFL++ - https://dl.acm.org/doi/pdf/10.1145/3678722.3685537
Effective Fuzzing: A Dav1d Case Study - https://googleprojectzero.blogspot.com/2024/10/effective-fuzzing-dav1d-case-study.html
projectzero.google
Effective Fuzzing: A Dav1d Case Study - Project Zero
Guest post by Nick Galloway, Senior Security Engineer, 20% time on Project Zero Late in 2023, while working on a 20% project with Project Zero, I found an i...
CVR: The Mines of Kakadûm (Kakadu JPEG 2000 library) - https://bughunters.google.com/blog/6220757425586176/cvr-the-mines-of-kakad-m
Google
Blog: CVR: The Mines of Kakadûm
In this document, Google's Cloud Vulnerability Research team (CVR) presents vulnerabilities in a third-party JPEG 2000 image library called Kakadu. Exploiting memory corruption vulnerabilities typically requires knowledge about the target environment; however…
SockFuzzer v3 is out. (SockFuzzer: XNU Kernel Fuzzing Framework) - https://github.com/googleprojectzero/SockFuzzer
GitHub
GitHub - googleprojectzero/SockFuzzer
Contribute to googleprojectzero/SockFuzzer development by creating an account on GitHub.
👍4
Fuzzing confused dependencies with Depfuzzer - https://www.synacktiv.com/publications/fuzzing-confused-dependencies-with-depfuzzer
Synacktiv
Fuzzing confused dependencies with Depfuzzer
👍3
Tango: Extracting Higher-Order Feedback through State Inference - https://nebelwelt.net/files/24RAID.pdf
👍2🤯1
Fuzzing EV charging protocols: A deep dive into electric vehicle charging protocols (V2G) and a FOSS tool to find vulnerabilities in them — all in one research. - https://github.com/Cr0wTom/Conference-Talks/blob/main/2024/TROOPERS24%20-%20V2GEvil%20-%20Ghost%20in%20the%20wires.pdf / https://github.com/khuntpav/V2GEvil
GitHub
Conference-Talks/2024/TROOPERS24 - V2GEvil - Ghost in the wires.pdf at main · Cr0wTom/Conference-Talks
A list of my slides from past conference talks. . Contribute to Cr0wTom/Conference-Talks development by creating an account on GitHub.
🤩2👍1