update binary_fuzzing doc
MODIFY
docs/binaryonly_fuzzing.md
docs/binaryonly_fuzzing.md
@@ -15,10 +15,11 @@ TL;DR: try DYNINST with afl-dyninst. If it produces too many crashes then
## QEMU
+
Qemu is the "native" solution to the program.
It is available in the ./qemu_mode/ directory and once compiled it can
be accessed by the afl-fuzz -Q command line option.
-The speed decrease is at about 50%
+ The speed decrease is at about 50%.
It is the easiest to use alternative and even works for cross-platform binaries.
Note that there is also honggfuzz: [https://github.com/google/honggfuzz](https://github.com/google/honggfuzz)
@@ -28,6 +29,7 @@ As it is included in afl++ this needs no URL.
## WINE+QEMU
+
Wine mode can run Win32 PE binaries with the QEMU instrumentation.
It needs Wine, python3 and the pefile python package installed.
@@ -35,6 +37,7 @@ As it is included in afl++ this needs no URL.
## UNICORN
+
Unicorn is a fork of QEMU. The instrumentation is, therefore, very similar.
In contrast to QEMU, Unicorn does not offer a full system or even userland
emulation. Runtime environment and/or loaders have to be written from scratch,
@@ -46,10 +49,11 @@ As it is included in afl++ this needs no URL.
## DYNINST
-Dyninst is a binary instrumentation framework similar to Pintool and Dynamorio
-(see far below). However whereas Pintool and Dynamorio work at runtime, dyninst
-instruments the target at load time, and then let it run - or save the
-binary with the changes.
+
+ Dyninst is a binary instrumentation framework similar to Pintool and
+ Dynamorio (see far below). However whereas Pintool and Dynamorio work at
+ runtime, dyninst instruments the target at load time, and then let it run -
+ or save the binary with the changes.
This is great for some things, e.g. fuzzing, and not so effective for others,
e.g. malware analysis.
@@ -64,13 +68,14 @@ crash when they are run.
The speed decrease is about 15-35%, depending on the optimization options
used with afl-dyninst.
-So if dyninst works, it is the best option available. Otherwise it just doesn't
-work well.
+ So if Dyninst works, it is the best option available. Otherwise it just
+ doesn't work well.
[https://github.com/vanhauser-thc/afl-dyninst](https://github.com/vanhauser-thc/afl-dyninst)
## INTEL-PT
+
If you have a newer Intel CPU, you can make use of Intels processor trace.
The big issue with Intel's PT is the small buffer size and the complex
encoding of the debug information collected through PT.
@@ -92,6 +97,7 @@ But its IPT performance is just 6%!
## CORESIGHT
+
Coresight is ARM's answer to Intel's PT.
There is no implementation so far which handle coresight and getting
it working on an ARM Linux is very difficult due to custom kernel building
@@ -99,11 +105,11 @@ on embedded systems is difficult. And finding one that has coresight in
the ARM chip is difficult too.
My guess is that it is slower than Qemu, but faster than Intel PT.
-If anyone finds any coresight implementation for afl please ping me:
-vh@thc.org
+ If anyone finds any coresight implementation for afl please ping me: vh@thc.org
## FRIDA
+
Frida is a dynamic instrumentation engine like Pintool, Dyninst and Dynamorio.
What is special is that it is written Python, and scripted with Javascript.
It is mostly used to reverse binaries on mobile phones however can be used
@@ -113,6 +119,7 @@ There is a WIP fuzzer available at [https://github.com/andreafioraldi/frida-fuzz
## PIN & DYNAMORIO
+
Pintool and Dynamorio are dynamic instrumentation engines, and they can be
used for getting basic block information at runtime.
Pintool is only available for Intel x32/x64 on Linux, Mac OS and Windows
@@ -138,6 +145,7 @@ Pintool solutions:
## Non-AFL solutions
+
There are many binary-only fuzzing frameworks.
Some are great for CTFs but don't work with large binaries, others are very
slow but have good path discovery, some are very hard to set-up ...
@@ -145,7 +153,7 @@ slow but have good path discovery, some are very hard to set-up ...
* QSYM: [https://github.com/sslab-gatech/qsym](https://github.com/sslab-gatech/qsym)
* Manticore: [https://github.com/trailofbits/manticore](https://github.com/trailofbits/manticore)
* S2E: [https://github.com/S2E](https://github.com/S2E)
-* <please send me any missing that are good>
+ * ... please send me any missing that are good
## Closing words

update binary_fuzzing doc