From 05799697e23abb321fd26f4aa7d63696606b8d8a Mon Sep 17 00:00:00 2001 From: cwshugg Date: Mon, 21 Mar 2022 14:17:46 -0400 Subject: [PATCH] added new gurthang documentation --- sfi/{sfi_after_fuzzing.md => after_fuzzing.md} | 2 +- sfi/{sfi_concepts_afl.md => concepts_afl.md} | 0 ...concepts_fuzzing.md => concepts_fuzzing.md} | 0 sfi/concepts_gurthang.md | 17 +++++++++++++++++ sfi/{sfi_how_to_fuzz.md => how_to_fuzz.md} | 0 sfi/images/img_sockfuzz_code1.png | Bin 16706 -> 0 bytes sfi/images/img_sockfuzz_diagram1.png | Bin 3062 -> 0 bytes sfi/images/img_sockfuzz_example1.png | Bin 16203 -> 0 bytes sfi/{sfi_overview.md => overview.md} | 12 ++++++------ sfi/sfi_concepts_sockstorm.md | 17 ----------------- 10 files changed, 24 insertions(+), 24 deletions(-) rename sfi/{sfi_after_fuzzing.md => after_fuzzing.md} (89%) rename sfi/{sfi_concepts_afl.md => concepts_afl.md} (100%) rename sfi/{sfi_concepts_fuzzing.md => concepts_fuzzing.md} (100%) create mode 100644 sfi/concepts_gurthang.md rename sfi/{sfi_how_to_fuzz.md => how_to_fuzz.md} (100%) delete mode 100644 sfi/images/img_sockfuzz_code1.png delete mode 100644 sfi/images/img_sockfuzz_diagram1.png delete mode 100644 sfi/images/img_sockfuzz_example1.png rename sfi/{sfi_overview.md => overview.md} (80%) delete mode 100644 sfi/sfi_concepts_sockstorm.md diff --git a/sfi/sfi_after_fuzzing.md b/sfi/after_fuzzing.md similarity index 89% rename from sfi/sfi_after_fuzzing.md rename to sfi/after_fuzzing.md index 8709dbd..96e9131 100644 --- a/sfi/sfi_after_fuzzing.md +++ b/sfi/after_fuzzing.md @@ -4,7 +4,7 @@ Once you've completed a fuzzing run, you'll most likely have a few output files ![](./images/img_fuzz_results_screenshot1.png) -The `LD_PRELOAD` library ("sockstorm") developed for this purpose uses a special file format to represent several connections' data in a single run. Because of this, sending the file straight to your server won't reproduce the exact behavior found by the fuzzer. +The `LD_PRELOAD` library ("gurthang") developed for this purpose uses a special file format to represent several connections' data in a single run. Because of this, sending the file straight to your server won't reproduce the exact behavior found by the fuzzer. (If you'd like to see the details of one of these **comux** files, run `~cs3214/bin/comux -s -i PATH_TO_FILE [-v]` on one to show a summary of how many connections are represented in the file, and what data will be sent to the server.) diff --git a/sfi/sfi_concepts_afl.md b/sfi/concepts_afl.md similarity index 100% rename from sfi/sfi_concepts_afl.md rename to sfi/concepts_afl.md diff --git a/sfi/sfi_concepts_fuzzing.md b/sfi/concepts_fuzzing.md similarity index 100% rename from sfi/sfi_concepts_fuzzing.md rename to sfi/concepts_fuzzing.md diff --git a/sfi/concepts_gurthang.md b/sfi/concepts_gurthang.md new file mode 100644 index 0000000..aba7ccd --- /dev/null +++ b/sfi/concepts_gurthang.md @@ -0,0 +1,17 @@ +# Concepts: What is gurthang? + +AFL and AFL++ are excellent at what they do, but they have limitations. One such limitation is how AFL feeds input to the target program: it only works with programs that read from STDIN or from a file. In many cases, this is sufficient; lots of C programs take their input from STDIN or a file. + +However, this project is about creating a HTTP server. Servers don't read input through a file or STDIN - they read from network sockets. So, the question becomes: how can we force a HTTP server to read input from STDIN, so we can fuzz it with AFL? Additionally, how can we do this without modifying your source code? + +Gurthang is a C library I developed to solve this problem. It works by "overloading" the `accept` system call and running some extra code to establish an internal connection to your server. Using the special `LD_PRELOAD` environment variable, it can convince your server to use gurthang's copy of `accept`, rather than the actual system call. + +## Connection Multiplexing + +Once called, gurthang's version of the `accept` system call spawns a controller thread. This controller threads reads input via stdin, expecting a specific file format (dubbed the **comux** file format). These comux files are designed to specify the data to be sent to the target server across multiple connections. The controller thread parses the input file, then spawns individual threads to send "chunks" of data to the target server across specific connections. + +This approach allows for multiple internal client connections to be made to your server, increasing the probability of finding multithreading-related bugs. As a bonus, it requires *zero* modification to your source code. All you have to do is prepend `LD_PRELOAD=/path/to/gurthang-preload.so` to your command-line invocation of your server, then pipe one of these comux files to your process via stdin. + +## AFL++ Custom Mutator + +The other half of gurthang is an AFL++ custom mutator. AFL++ does great when fuzzing many programs on its own, but for more complex file formats (such as the **comux** files being used here), a custom mutator can be implemented to ensure the file's structure doesn't get overwritten during fuzzing. Gurthang's mutator (`gurthang-mutator.so`) does just that; it maintains the structure of each comux file while also randomly modifying (fuzzing) the connection data to be sent to the target server. diff --git a/sfi/sfi_how_to_fuzz.md b/sfi/how_to_fuzz.md similarity index 100% rename from sfi/sfi_how_to_fuzz.md rename to sfi/how_to_fuzz.md diff --git a/sfi/images/img_sockfuzz_code1.png b/sfi/images/img_sockfuzz_code1.png deleted file mode 100644 index 010bc909d44e8a20b57d9d54107fa848a2d01f2a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 16706 zcmdtKXH-*Bw>GLGD4>8yF9HJ6doR)zrAn93rJ7Kr6Dbh{k&bkb0D{sJnxQvQdKU;C zga8pCAfZUl-T1!e+;h%&zjN;R#vR`s43@=@}0=;zUvhnpRz@5peme;_?Wp6`GwM)n$mUZCbsZMCn3FN1C#K1M_ zi$~_(mo8C!z4*J_?NRJ->5|IiV+~c~0Bc;!{R)TvszMp+y~~%e_@TKfm+v1`U0kx? zxQsNDTz+|F%k!tT%2gLh_8Y9`ci+}t?aLzi{x17+ysEZ4(O%bfTRS1YXk(D|Haznk z3XKHqSDge`KIw_2Wn^T`6v#J)Zz&PhnC)Z5x>%wh2(c~(Z$Tugi@|=NsvgY*-0ofm zK`t6&{+~78Rth;iocCWu#fx~*u9oe)k7V26~56RF={DV2i= zXMYg89hh#rUw&_RH1no4M1E^og31rwlv_TUCnmVlB@ zirw1QhF8_-q@IA}u?Y>H9(Tf_NUnFb`{=`rRE+!y9fLCs-Vglx^*zMuwBG6Rmj-P6 z4qpR5uYOEpCd1ue)NAH%p?jm2M|-4{@AtHirVm$GK88-y%ez#WO&l7-bpau8_2x<&vtrrdu*hhUkbDF^nY~%Rgi!hfb8RR4Ytmsh1+7XTc3y z(+GQNoZ5lx@r~%C4|nh8k{VIgi^h-LHct@yJY4nW zX8V=8Cln{uB?s1YG4KV$%p1^eRHSuW11M9sbst5&?8}2shOm{<-rSQ@l`Kkm145Gf za#q@FF0g|zxH?9};e)TXXKOG(y{`pUd)OixjfW`gcUP_L)wNJGN*<-6B3!aYn_ zo~R6AeV$vTuxm@gX9Df2pt#KEEFTx;!*>#dVoemGq-*j~frSSG?zf%a4Vro)SMWw| z*I`$kW&LHmvXy7w!3!|TrsR!P!f%DY+H({z8;w**pN$@@Mtk-oXKB}4ARINPJ7N#& zUuG2HN3Rzbu1Q>N(6&DwFgE)7VNovQbHlk;VfSvFht~a=!=A9T#ZX1%=g}65#`H>h z<>{*%;QZTTvO#pMr|#J$%Z!}?4q(`q51u(W&ZI{vdOBvkp^r1waM~j@j9k=sKDfm( zQDm2mkJQ7BUktmi=iaWG-ECnz(<(kLQYoz_K7pi5>$R}f%Y%;Ahb6(J&9BxX^fAB9 z>ub=~t1Z&r8rh5t$98mufMnV?bv_($D`qKYaxRM`hGWBo`w+=*qilWb$&S5FsNHKW zc2=RV4Js6Z2Jvb7-+a#$IPf9rKAMj);Q_bv=H9@n#Q1$K@d;MGr`e^L<-}f!k+;r< z6xahvitp)Ha+6{_AAQrLWOyW8ALDRil!-1UW>J#D5piaJ;%)d-f}f=C`mOW1qol}a z3EVmqxop{cOK*7BS~P$N#t^Z#;O(Vx`khC-cTO5R4S@4AIo@ln=}9CY^g{4>z#puh_RZprm1 z;8y728bl{zxR?2%%|}qTWh?}DwJQXr{QjpuSKHisDGz*hWj>#cv$XBf{C4je^@1xx z3Q+TRu1m><%8=r^sfZAI=~Jv*jvXe{-gUHSjEL#<2zAkpf5SP z|NL?}BZzX)p-O`r>xDhq#Off332oPae>1dYZ7w=s@Fx9V7$;n4(CMKVfjs^Enn;}3 z+Q!N`DvgZG{U|*qBZhIYC2;Z>J5@$`WBvU1!O5TPKTPJk$u@+obl6eg1{eQPPaW)# zIZOHczzhM4$LzrlW|a#{%A%+PvBAV*3f@wq`}LuO3fq1;^X(WhCr*DP%3ihcrdbJ! zO)2QdAj-G(V`Jwtu?cy4brK%hTD|%jQ7-zke zI+mHzF(z+w6PW*8Y-AbASOlCgGZ$U=xW$~rV1*w_-1YufI>FzX#E|u998sKNbS8LX z8DZu(erIXIFDP}g8BueSe{RpDJjp-r;lVgyoQku!OqG0NYFB`-#%epZR#Vo~*EN#K ztnKy1FVJB6I+bP@58*_EL$_~;qh?AUi<=Bu^a>CRGP)S$jbi2_lUoY>M=4c)NbI}`WQR*9t|wrlna*qRbF&FPS}byFu;EpR)Vi_qlnWc3U(ey3 z8+@tk;Ut1#0`2+AeZiKW?W|&xGhs=xv^`ps*&>fxRzCL07)L^?mM(7pr6!?<^=D&O zMm$d$YA&l)+!P<}T!Ct$J`4NXGgVZG!+1ASQV<+PnVMZvB8-rb80wtzYa&4*jmt43 zgUrUjJo-XHY(Cz?@!8QC&4gJ(^!aaw&lv_i<1lxdZ0*Pf4HMooCl*z>Um2;W#SY(PDzUz=kjZ`_kUe{I#TFiE6d z3z7OF`=ym`Q7Xe3u8ckRVME_PUYCJZB&`974vyO8mR5Eu>8#E_4b?@Wr*9NC_TBQ! z2y22O*PEa8+U>PPOT^)%1P7k+PlA|yFrq8d_SU*g_|BJhd&+xpViv$lwOdqqy#@;| zX)~0s(x!%(Kqe1LvUHC>Wed~R`L>2z%qOY(b%YXYMcC_Atk804eHyQqtS!Bq+RBdb z$7|V`ThQN*X#Tz^z~=F|9*}B>osghw)K_aLt#c=r&G*deV$>@K$qqpdV;xj$QJ z;awSgz#;ZX?HulZ3E6()ThZtJrktr)(x`Xv_J^?aGNr)AKXqjG14PT9K$`J!WVs&f zEuD*LoqVGui?P?P#?J`xZO-|CGpQ~`5swamidyJH76#ZNni;p;ww+ZG zy(Qy753*k%3Hk5T-amEjzt)NWry6&ijyiLd&Q>PdAguNS7At^iJTX#Sqcng-(d>ZX z8r*H!9)#aAf`r3a8`L>Q6@EDFL70=*@0mYyj)9$@wABt_Jo^vl@N&-#9{EU(Mrm0a zbUIhSqg%Q$t=J>qBk*Larg3Ij)WPtHys|{a)MD=WS^~Y^OXfTI=xX&bZ_8d0=a=^~ zVt7h@-Fti%PLyWTy=@4T^L;H{+pTSNgrU;CN%<%(rRw-$KLy%=EfBNu=#;{?F>HJH zO5h)QY-XeHoz#;_khD`HJoQx8+VdW=|rIZD^UVo`&o0cOQY* zGr~tb%ct$*de&y~L{(&R>EXQH-z8tLMn@>i4ONNoa<-i+nt67y1^qCpE}`N)YR zv4~xWMVTBET|$3uOJ}#y>{CNQA=>P#H-h6z=sJT4sczPq8{=;TW>SiUhvU|VLTB=4 zwL_UKrsT1ahHC^o?R#9RCBav z@$$X*OW@e~CTrX4W*gZf8e_gfrFNq~_R9`?zT!N8AZgh9Yg!K;;H-uUSRQKd z^yWAp^l5qp;Txz6SewbZeaw!T1QZxkd>^^El0HJ&Otcoa1hY-9Fm}?x@U8mTiT15$ zDdV;$&CgOUjm6!v?zWQ`0fVu=#5Wk7p}bp`kg`i|H!O>*ZqCRtZ7#2`!5sT*$i^hZ z93^`;<;kA@9MUj-FAlG(R)39L8S&K=72mf5^K?)PuWH`yId@PF6@EC*a5hZz;G1rU z)^!d|+2d(>VlnArv@beW%$@3?wD?4BS7hy4DvMty$80ZIQkl@nm~UKmaBJc4tNu!nOGk(C zPwF)4Y@V;oC@xsDuO zPFZhGWn}{W5MXB)8y(jR=eB(I){tcWxnfQ3E6d@5af0HLaHd>)_bYpUko3x5O$-o_ zC4CadIBGiwPNOqL13#iAq^zy;96hpGxOZa6XCv#bg3I#Lkk)T|a$zm_cPwnSH1-zG zmB~cB&txeygT#{{wzZZ9IQlr2MB8m8BqK(8KT?2&ykTYoTGqsjHKBhPtdeU0z!5XK zC2-mBv6~N+hVW13YS7fx&&TEQZ3v&D}2Fj!2%)IyDGX zj4>+QHT8SizsI<6<+hzEt_1${x{-FWl-A87$(-q72I5pgPm!lOv=Ld73&D$bKC?{30xmXDBU+b|D7pyltLl6_9^BaTCU1}LCZ!bH@!p|qA)iY$?@8$E?g7ij;fW9 ziID)`Nj%-WPf>4tKe;P|=To2bIKI1r$-fLWF`3v+c==2`!5k9mJZv))3zaao$-|hH zUBl)OTF}jx@6@8Nv>pY%7aP_)y*htv6Q)QQI<5R4&@SuH1UBW6KlAnwu{oH2O zu8c^)ijapKE?pDfZ}Q&;!H8}gou6!5V6T3n=ls3&HS(U;Pdd@cr~wlw;r#y6JSqx^ zUwDxy8&L!*MW@dhfF}ZC8q4nXl})&S1qVDb9?Zqx^ZNqCWS1vrb_KyC6Df7YXgSsB z$qhjhzjD;0)|_0K?WYjhAVQLBER<@?9I{W%XPkRggj@I6u&mhmC8tJMA&K7u;n(** z50R#DZuiH(^@*Lncf4mqc%CG9BR|OLedwE!ALv7HCjxmXj}9_i(IF>Gb=w3_JhmT3 zW;pT@r8pbK{^Qj$dxNwiYh85n=eMM>yW-@1Nd+aLS@J)GKM#@PYXDDi&2$cdPP$v< z8+Q8Wm$3!kdy?nI<|fpQ=5AL}Tkek-$T>E}Me4dNV?nF@pY_y8?>k-2#66i-XFM_N zM@dW2s&NkoS>s$=vIN|TQx&f%&i2OOPAitB9dE5n!mouFs6uDu0ci;UbM&^Rpensi z>YHk@F0MuDGl0nKsrjiL*Y%XXY37oc!M%I9cJVq8mRRzgJz#(2L3$h6D#|nuVVB4Q zCIEk-m3_9mMU4GPuflM_`?G6}OD42+e7p&e$o1wbT`^*%+lk3q>M<7)XM@0>)0^h& zCXdug-OjE?`D(ilCOUt56F)xUEEwk*oxNzEucI>)>NtHv%_z#+%Jr8p`#>tulk1#J zsb@>*&v+C3J8(-a zuU$b??DdWpi-j-o_6vS3(27F|-Rm=!B2uu^%44+dHFl13uag&)(83L|HI6|Aj#9ua zhtqN*{6{|nyeo87`%v{gf)0VTkQ9DFBO=Dax+@M`t`vd*>kHp-vH*R=l7?9MwP$CsS zR0b6e${RsDl-9@T#Kr8SDSoVyrR0rWWLTjr04*}uyLYHJPb!JL+h_wlJts;-{wm98 z9rUqD0JfluB}615TS<4rhLrLt1cUGohnKnoL-SPhM{s-SF~SrTX?_jHId8i3->DBZ zYXZA@Lw+=dJbQ840`mB5bCf{Ul@Yk~=U>4e|KGae{|b-c0ORyS&YEn_SGN(##Vd6y z^swW-n#J=5U+U{Sx@NbzThG2OCjNEKLv$Sp8xDbU$bQ_P{*zX?W)IQB-ycs;|G?bf zL_N^dnC`0|C{!#D*;ld49AKfU_iJ#i5RR#FI(Iwx?F*oy`VS(xK6oqSF5S-Jow^Ni zxc@J#z`+K{uN6d5ii+`e;SVr8K+jltKFs6;4j${P0L7|? zPs0atd@n&YT$|uh(?e;&1IL!Spkz!t>Nl)Pg#6&x=H1yGbL0zr2Xt31^O$IW)=QYw zAif=Jo6)G1%@{U~hN^Z8QVzH)l3$Ep%;N>1UET(4#??yCuxOwZ3hQLcJ*{h4;ZE~R zbu3U9r-#s0{aPFI{ya{{o)FU>ECV&w=eO_ICK~x+{7_l~*t%Hl@^tmo2A0O@24{Y< zj*!mToK(e>V^Oqo=eVq34*852SCC4F5NVXCS0}UrPPX+%t+s}nLS7pT7*(cG>uaF5@%?m83-&(KkLsCNJ zwM~tUkH`ZB5B(Q@+q>xesMZw~nOtS~5c+W}zAx7mrf3MM{proS@9NMM%3|4IaAef` zd?b}6Ujc4rdkq3)S*+%)m#`_adN)QnwK$t(=DSOBo7QNXHb3s3f%3dUQ5*QKD{|+(|MJUVqo_&ha=7Cs10JR z0v$I$G`io$%Z{xfw_4?~tu(S`SH>h!7UbeT_~wKwOoEna^&b@``BR-Wi#0y8U66kK z&1YNFXl5p;@WX~UeHJ1)qp#@P;k89hX5TQ`-Aq=xtYTliyh3}cBZ<_6p%;ATV^CtR za@0_|k7r;+uF;c`*c;gV(07~GD4T+dY0TmTmm4lAd=TvIpy-Qkzb+3VZ+(2^>sJ_C z_zcNUVR*e^hF0#VOE@9f>w#jX|6F?XXv*CC}K%D`%p2dpp>e zrgJYf2x>6cE%Deo2WA_f7aY5Y-{k6lyAQ$Dj{*3X>g_W$pRF0*N&nBC$F9~3z%(vH zl^i}7Ax*vBo%J4cb4nQ=nTy>|!L+|9z!xQrT-Gdi7}8J=_EuxEClfw^gcM?nO(#W7z4XMc}L84;kwsB zEieVMor*Q$`K(6x{ab-&<%vpkPrlkUn!~c`3q!Wx^nTMN%MHZ$I?88KS??h>F>ioy z@dvG6VP(5$fBRDp+Q>xh9$!N~)ysqE$HwPheQfwg=2l_E$IinNHygob=i6|Z zP`jzPSYX&@o7G00-hFD&mobmumEF&O;xF(r0{-sToT=vziM@$5y$IK}viYZPT!8J; zaxU^D(N}6TU2R79<+ERe1t`60#xcv1`8d4Jnl{;V|b_;@G-2v<(v`GtjRAfw^` z1+mmOtFweGD*i7p^ncI(T4w&6v%4Drq;S{Y%}cE5dSO8)`moc{Ho~y-aU@}+@!sK5 zBwH)t`~;n;+C}3cJxcCixB`GIl6XR|W=J_#YFs3-TLt zjje%}i2KEfiuC^mq&s+Ss38OIJaKxo0i+4AnIY$0$m5e(-HJOZt)rJ2fxIWLDs|QkJF+zLjgjssXPKO?v-^IV^nnJ5Lp$l_ zQHrATL$AzmsBzQ_5`CYqaIbGuS#sUvi>r*tJJRm@h%mKu zdh+7OMM)wVUDpbC$`8ttzWOZMWv8ds>fL?Q(>jy6iN$1J+j{dwW#>5nn(f!`1`2&j zDV>(*F?KY0*3{Ir0O{4tlYX3dBR{*?HQ)F>gb2#BmufgMbX?5|CAKdMSJ>B7>Iorn z{G`TY_k>6x#i52!UE&wf<@As(th4!$?y+*W#9wb&aQXH|YM{6Y&WyX_pe2jGRH%yv zaK_O+La&k&yqOV1Jrr$_G1ZSEB)En&HYWPfAoo_hw&uaI~U7vHV< za^);m)eF_?-8UQ@MzV^|ekuX4OXSYd!)=HU1xhOk+Lf~a_N;J+ktaI9^xPQl{$Lb7 zBv2_apYogI^+#`7x^uJL{8!n-5O`$C2!l73M*|vg^FHx2$zj799q#Wb7?YN=w5R}% zboFnZB-d+R<{5NcD^srUbQ{*MRYK4AYSu-j4UeAm?{>&5&1IR!YblAx4d2a4RW_0v z`T2yUH2Ct$QwUr`>Z+Z@*(0nSzhoE7w@JJ;bBQ$8Qbo5n=HZa3YHCxR%7L+=_2KQu zwd!6sS;in(T-w}A+D53|Ew)Bbh$eTgc$~h>t#Ia4<99v|AS49A_jby1ou(wSANew3>(Zi_{KH${fosm@3V-I+JJI`-P-Qic_PPld>;z^o@@iDDSm!%x>CW=VV zsL#?_V!k7!meV=WM{IlwomnNLM1I7O>#B&%mRF!Vu4c1f+r8`1oApk>c|lC+Zol_w zO?KI1=km$aVeIr-OAJBP`7+&k?8Y;CD)7P-d@74?lhbVDM$e;-0WhKv0#{|zUEk#+ z^+ue9K39}V)bFi%*W$SVX;WKb#Zg^Faaul7lMs%m%JQ#(^KC#In6=+RZ&9-i_N4kt zbPMUr$MLu>rtdcvdWH}Kj`zeBY2jGWDmO&($oeQ97>hq(*ZeNeQ+*!b@9>h2n^FPO z%;}=V_<0ppJ}6!bf!J*X8y8O$&m@Weg_J{lAngT<*Zw_ zpyfl%Hyh272XwVlx#Ikl@;7a!RFS&94#9aFSeYJ@2Zy_40QBw|{Blp=h{i1ec`pn8 zVJ_|?m2ser!FmOj)h z52jfq%MvXYko47Qv%oJuv9eT)=tbYHpUQb}yf(5kj*Sok@w(ypWf2fbMTL<;B-Gw2 z4{G5&GVH0MM^r&mM|QI}{f++c`;<>qUMK;-X)}L^Y~JO{%GZ|flX{P-=3D&evf(nb zni>92UXVv@y&S;$f4L8FqYaDuz{o*%tGqe=)tA%Q2Zq;6TPlk8CU@iW*xvj1HcS50 z%6WIiNR&)pR=@}q|8K+IDs73l828d)`4zIU2z%#PWi!90UMTw55I^$B&4Uz$V@iym z5v&EFO=DGu`ULgcnT?SF4Jr{*r{NA8)6fO$u(X6a`!$*Yn-OIgnWaayOxdU&eq z>>#9g^1j-Cy!)n1rEB3KqCI?N?pkqX8)Sz zXX6#8sy)R`{*J*u1UWnyCk(kL;(&QLTi)!&h z>tNwXdOKg+MxnIdjaXPC@;Pv3=fQ5YV-L#x-~GX-%|R9dcTkAQjJojL#rK|dpnm_W ztwWyyKFD?_>OlI?Txt!vvl}R}b+ibf{7-lOdp6EL?N}OMTaKFsF7Ti9f;KubFeEMmM}FoBHw<>EM)ccM%8Xsfi>q?sJjQ0-GS*;2UQ#cLAQx4}e7ztDJVfc%|Dj zm5J1>>gx=&-xVH;q>D!xeeGrtkFL6iCA_t_Y#@&}#%%chkvF|kAYZh^&u?iUm#E#r zP3mB0X%Jm0K~_|b`=Nf_Q>TN>w2F61=Q9#D*NJ=kFfa7q`zY(E`NST_&A}yENtOD> zFGTla+(%z)+n%Qj#ZSc|TuWPQ!PhwLG;1pQrTs^jm~>SIjbc$o?*8DsUmF)R)w-1- zlwZ&eb!s!`c)s*V-axUc+)=rYT11hrb*a@x^Q#V7K5)Z||2$s-ysFms+}MRZosL#i zda`4*^@7QyNCB_{xO}Q%e-m+1>LxdXCrH4tU_fN9xP0F)DeQvnhId(pOEYEX3aHQ%s4RcKxrbv2T13?yKORC)ET z#l#tWt^1k5*ff1*nqHfQm6_4=?)gnvZOwr*>wUoYX#!5tC(#u=l`)=7OKm)A4p|!E zgHOfgpT^?d--bg9{dhe%Qa-AoBy4b9{sNuz?1zIvHF8^oJ)_?WyW_Z>x-3g1qf2=k#>N+k` zC5VgeY#_aY%aLp$F8LTcVW*%!TUHy&9D++H+if234Nr8rGKgCu+rqigghU}EDrMYxB|ZWfiQ!?udh)G# zh6o4dgS6)YPM*Wds*z+HXI{W|4sG$oSp0bTR&1@|f^C8-SSvxWe5}*=V#KjWKjW@w z4=~c579xLLqrALY^3|Coj||TTMZR5mMygu&@H@9l+^4F_+w!azd3*2AsUt+B1{CR% z7a=3vr9FKTCf&x|lH3^C6{vj;-7#$fqs&D}xB&)2!rd3SAZ-%kkX~NKce-~UbEqnz zn@gzpkKVGl!09v6r!BB7snyjV41*5XqQcvs4(h#b7W{DiaqU;<1HY^Y0azuSQBVBo zJC7y9SJkm&*IzSDeK=E-+w3o#2|U_d9T?`%fiAq|5nPsDwZn8xjfx?V7ozw&);vk# zP%Jj4%AK3fH6<@%{MZt9TYf^5I4m(_oLzH@V#;&43AF;hh%sKTDV83vQ(hSmTuA+W){Vw-kW)u56u~J{_#1|EOJI-l~=j`(o(e_2`GP68p$g=z#8H4iwY9v zZ85Xv88Vw@=f%N3bC)1XD($?Ibrn4fyX=aV2=0Vz@nL5#Bv<<53z`!oxY{Cl>+{%0 zk?AKI%Osy{Rg+dFPDJ2y@s>B_D8k&+2L)j4O#lnETAQ82?`~)RaQ4o+@PRfC2oRU2 z8$e?FHPJje>CN%8J@#EU6MfWGc4CQ{>~kU%CTHq2hxWU_&{!=&b&S)b(KCE?QP=`i z-A@5^dTNVzgrkbY)`aWP)|u}oNW69=S(Rx5WLv9n%L3)7Hx9a#PnPs}-TqXrS)Jd|ZI0LEGWR$X~u*iNw z>7!ZE5!X|6!(i>xhm@AL>IZTv;>R^lMQU8~DQFUR~(OkgRonXm>_i%H4^s9!Ue!yacIHjhdM};WC#}5%w=^gKwEt zh@3yRy(P+mMqm0M_?jzb-}GT(f5%=7xtDA0P=9_$m1kp|;AwW3_lX+Hfkq=VjG_M=<7 zc>;h(Y^*ZvAXzF=vO%1Hc$eb!3q{0PG_aeQEzs*oO#(T(!Yw$eA(A*h6X)&M2nFgs zFrVM=aTAj#3Fc12)>r&ip7nTA`82s&9}!Kwtoi?qHURv~|IH$!|JR;e5NtafE6P1R z_DAdv%Cw#KFM3Y`Ip;3*agaDWv=Z=rPN_oxGPu2w*=>07N+3s@eW|Z73FL6h`QWeppm58fW1MT`);15}K6N91`ve`bk$ExSCoKpzHu zKLTF`4VQ??tO1!-$^jypmr6 zXp|oqW_ERp+&y83enN=uJ;s~r+Qdxf%LFG7Wc%mvZMdQRH-Oeh`TLMTox6=}qNZ_! zF=vg5tH%N>Ua9WZ{z;J>x8*DJH4z8&M2My0vw%Wq;#V;x<#H-?_G4cE3Z=5>ev-aG;d$ zZg@*QzpSld!~8APUubqTpKhZwd1|D2KJ_euV1ysn^$|YzJZ$Kw;~U7icE#S)0>=^= zgj68{B2(IH44CHwxCR(v_43aP=2$|_@H)JQ(~6o=Rmd4|saLr1Aj}fSlG_)uO2{f%8_z9yp?YBBYLz)kEp8Mh)Uxcq!T2(U$~nVCwNsX-3#rw`H#?1D@m0HCz4z=VYUKe>oW-r+MC zHF-QQ!~WNnlHe)Y(0D~Flt^kb`6C~1#ZciprEx*A%9Q{qLS3(RNE+W*ySbglCz|Bj zfdyc7|Hg$rU?88`oL=%5p1UjvNk5QQQy8*y+VkEk0@24^XZNuJ_A=lWCzyU5(&1){ z;`;t2xyw7XV*f%)DcSeJ)+LnXzoM*dt<9zk?B5A8B-NPQa6MaD7+1ns-FoHuyxIuY zZ>+?$WEkY7$l?Dyb|(@H{?J*gr;9>%o@;TefX!^Vwo@2*R-?Vet+vP6W&p1KdPQbV zbcymS%bW!D!f?u`F`e-rdP3sQbta{lmZJG$8@Mmnfm$<3rB|r?_U=bHi>%n|Wv)>G z{FA~4r{jUKLRB+-jiA@nxJu;?M7EtHK&@PNwF3@7UbHtLob1psV71f^NyiR}fcmBD zZ}c^NjW_zv!!37G)Bs53rysxV4@nBqzvD?g(}E4|8S9+&QnjPPRBjr{CZ|5v$A~-x zAezxUfd(=E6#!dt=DSm*1GvgX?m^j9T{W8Dqn!11yssJK`3$!VP4)*cUnT$Oe(_5G z_)NB|Dk^M6GXLfr&Z$>Uo1)BMni3wDrx;hW84K*Auc7fQ`b^VqnZK4PF~7u__03So zP5p(%e^yGbN%xh3D{m(Bk5E}dlo^jZ^#}}~*>6w9_-%a;5dL&Cch`h71LOq>bW@P_M ztmcQ|Pwnc;MdIX`^^X#tqP_iNw1Mi2u|o%J_qY39HY1K{=p$-(gc(;Uu=D$!f0hZs zqu2GKp0j+bUr_WoD5`Fg%{7vDmOmTKjo2ms+&}F_OXy=$QvZ(F0Ej={RzO@>W?9*z zx+cIi`35KIAUL4n_Iq8tYc2;EY^$xFjR=3kkv!B2K@0|)neLa4U+}op{|1k8{bdj# zQE8Y*!N{5oA5f*^^god9vgU!Jo}H%cRtW1Z3co(a!$xE;4KVUKm4GTCcWT|e>{FnS zbP+}f-mpxlakAJ{3RbI$vS!C{dccW_H`(rcbaJ0t?y$7N2zNNQ7g`{}_Bw+S6Eg&i z4dH~aO*r=eVdV^7g5jDGJ_GL|03mM~9Z?R!9U~!#sjXqu5XXD*kbSYP*n0Fr3Q*D^ zJ4_A2mX??C?HWD;Isf>X7wyMtJvV3;AW#?Z=4`0~AD>A;JcXuzfxWJ7**G z6HYwp&vOa8ZEiBHM zeIVhDQ9Y+iuvF`5`{)Qwf8)1W-xp7932^j+e(_AuI0Fs{tt6qH;TzR@8Jy#u?*15$ zpyYZwzUCYYD!Zr|75jkoRZZS1iuQJd@!Mo4x6HNYuFDPhp|M9U#q}THL z;;WtK$oQeFMb#hnq@=$KfU6b;_(~4UQHD<6Gt$jFLRNYD#Pv9DfNihQ)kkp zbkHp6#Oph@B|$a=^bWk3VJ?w{J%0G+r*Eq;yehJHF2!Ah%<~YpjiB9|`zGACIk=6~ zdgjf>LA@NCX2-O0+n0{6lim#fC{6ldgKV|6*iLlN)VbHMCyE_fm}C}`bQ49TYIa1E zm@s|&8IG}&r{Y#uME6vm{)JZyZ?qtGh$=KXp{||0D;BKv*qGl z>bD|%M6Nv|PB;#SqN9=?6VYbg6|pyYMt|O~mU4OnZ%O(Yd3}?6J%s6R73WmNN_+m( zu$lBcKJiCfD@O9^Cu4B+>2-$TsLgJlyZYeRl7Mm$IZa!@J6u3Eh(x_)qB|MmyRrrTQU5!`9oI$@zglY%0al-yekg&WEJRIc#*B)0d?`;QZfZpm0r zJbEr%E&cBV;{{`%S0&}nWgljG^TuThJCa1gC43emD53(^wq;#g`U zyYx3Gw(PhL9+NdY5RmJ5p50k+lF*QVFRV{c^C+w43_-1&S`Q4EziH z{WgZpAfCG4xBm}FUX* z$9_SC_cO5N3P1|`Hm<*^(T9HNO;V(t?*YFZ;LCKzhysu;e4DqgmfyYZhH9H$dhFFZ z-MQ{eVjE)?IvuAYpZHry>QJGsxe@cU(4!@n-K{5OCXD4C>W)FT|ez9^ck^?%B1Z3$)Jc z$3F>_ON*CG`h#rB*&Qefl!uI8hoGL$1fqL<}fr$S>TQdRQ k{%?ORKodVGLr~^rnG_eFK@;N(c|y z4r3P!OLtnjS|1CYLW>Hsltp1fUdJh-wZ)XB5L^t3Q@#Q!7)l7)bKeW0v~)Z(@7;6X z`P}or@6@)fvA#Y*J^ZqLm{$I5~&r`APG_}u(_SMqPFT9)d~sjYsE`FhIin4GfJ=SWrG zz83kbJgEvKs$x(UODS5a5`d~$2*pwnAUO;&H!t6w*cLi@&vr=h+~NprMYgu10+j2% zNc5-JiPhi_B{~XVHzNRw7A*l#Ci>FR(T+9hLyzCGIfk-lChd(d^h2iO;Z^PLZXMY? zVn79n&fAm{bT6Yj{s1&C2toh}hoGlWxd|@H{@ZrOmu@?reXz>lF^Ya<&Ck`Mmps%&0L{wSS4Tg{e!jF_ z5in@L<&3oarA35JYQzN#T6ba*_}>%sjPGW;25nCfP8rcW$4irM2uhGZXU`sG#?s2R zeuIVdaMHF==fNUc574(eI6y5)prhv zo!!zc>XYqZ6X_u#flZ!Hld;M8pRXpKBks|_mZ%7u1d2FYvB)n&<&3F|ia2G1O6N1+g7P0=rYz(oo*k{#-mz|A1o zonFUk_uW{577}Ti@SqNF^aNGncB4Yn5GCcv1t0RV{7(9%K>5y%!twL!oLU9->eK_h z&zxrT7wzE>D&8QVtx@_ny8Z;ajpt4r2MIPSQn8QmB#es){%#t$Rw9CjAa6MJnSH4H z*$^geWQg|#U~LU?PIm)s*5zX80VR0Yd?Q9cZ-N`=bSa^_DD4GXt09snvwa?f1sNB@ zB!dnlaxUVEUUJC+`5i7WL=eMc%HNSH)I1B8-ufW0Sglv+_)N}Zp58J_?BhV`T5FtF z3>Rf`KXCxuqe`b_;b$PrTFLb*ahQi6jI)@#lONx@rwAfDRv;$C=H2*Ol0eWR^5S4t zL%&EMZUP+>Ozq4urYhES-PaR3%`tH=r5kP5xKM15062e3xGEhx3BBb4DCMKXauY=3V` zT0^iy-`za=d2g(?I;$#V%SQX27tB`+x7L{bt{l@>58-g*azjizy4h_jY+62tFY|-- zsmbdb*lI83_-T57jx)6{bZYu`w>0CVxx?8n?7BZ{p~q~O&wO8|4YiNDC7VMyRO$ZU zMt&WbTBoKPvz^1OjPcq!yS`J{DTZ>t5CL76!(`8twZ_&z;Ht|lvM|z;z-~zs20EPW zVdiwx-&zkAz47$63;EPelll6vXO;c*;f9Y)2ezGvh+bHJ{@3D@9=eSs`_sNH9)H9N zNn$V`Tw=JmlGsZr_OiHnSY3#703`e@AqnEMgID39B?VQ%s%O?i5h)TPz|R8O(*v`H z3@GL5dspvr`ITVfWt1~7z@^_~zmj%;{a^z-nT5wikvtvL5$k7`|&V{h2yyn|>vPF|NMYWn=KJ`-V&ZrrF5raw+KJZW}ae ztsGw%TZGB?qjC!k=MFN_C#gioOe4csdXEKdDqA_$@3|%z%uLQ>+gDyZFDLMeFZwQ3 z6iNMIm#)kjofW9d0F8a7IxTcmKqtW2CJ|nNhXokXCqlm;J*=iJ;+T4@(T^DOXmmr5 zmMY!Vo+jLoMFlyWgW~?fpoz|Tq9(#1c|G}y(WDKeJMnN5LHy{Nw~39SqbJ^bzjv?V zwe%2XIA3KEUh0r3uijd`(xrP|Q{FD)<`*ILWKzn}{DJc`(`Lo>PiGuuY0ET@sfY5? z&U|WLbo_yd)B4XM&y&IL0?8~g@49S}v4c?g@7LD`fw{NMS7+{fK1-kB!4BtNOZJf1 z_k?3{xPjc)KLZ+c6Ee0tRkPzrn`J-|km$SaLbtHfu_dZ@rT(vyIexe4Ke_Z(*9ESz zMG72?lPj}ub!LUtdyB!3pYk-JA@H|q90}uJJ{(K3Cf)Yr3LEEiJo!i(R)u_=BJ5lu zg<&Us;BH~A1dxH~!;Z$;xtehD7i0h&7~T{8M;NOi%}!Y6|1OXQP=2j8lvDIpuiB3< zA;XVHH@U{*pfuAzVQhu!x8H@n3HU!uRB(-tf5^UXvU#Dnf_y&`un;)YR029usf)+o sX~K^aBaXDbM1{(bt7z^wJ90p~I;Znrlhr%#A}gp~*&1{4WnJF?0o>aP6951J diff --git a/sfi/images/img_sockfuzz_example1.png b/sfi/images/img_sockfuzz_example1.png deleted file mode 100644 index 21dadea690abb6d95aa84b881e25c6aff9f76f43..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 16203 zcmb`uby$>L-!3dAT_QDfBRzz4m(oa=ICKuua#M;jAPglSAl*m|4FU=%okOQ1N)1RT zjMA~M@xI@^-{;u-c%OIg@B0I|hFNP}E6;VV-+8W=Mh4pCBp{L-H*S#Mzo+rw#tmH6 z8#i!Nh;V`bNKPq#0{-CmKhRdYff#4r20q}ss_FwN>XS$>AOyf?;>Y)_{BPW#=)wNr z4ER(y-MFFj^}dFx>63?hxyn@m_bocjjHn)JXkPNb9N1l+KXP(&TP=wq(h~1qCFM=! z&(!C1ld0eC-Ncw(P;~8VcZ~Zf{`Q&wf-1k>?G(MMKU-;5Wj?F)Vc#`h7KIV)669i)?{~W5%SFBY&498kpr1wl;a>D( zSXIf%OpdhrJV~-TpdY=sgwX)K;Ca`ss^lsxjHD%3?{+ZhT?}NW4W1UGn=(6Na|&(J zo=;b@pIh#6nyY`>pOX%h|4c9!zaMHwi1G5h!Y|f!L(om*R!^X78w^UTK%jl9rj-sCI`K&-I*fUj{q( z4W|b;JFo1_)0aia zl4~LUUBjo(<5<4chE58savoRr6*nI(Nzml)Pw0%oFEG_}oOSC}mR)7PCp~%P-Arq< zb|(_!hB-i4kGB#*jpLQD$pSB&XgzgQrNCyfaGOk=ZM=VUX^QUSS?^{Y)1wxrRBs_^ z&U`JckB#r*QX+M;4ZkQ&?B}_9x^fn3bo>=MUZh_TU*_2*7i8WFYYvDpcW_zHcWtI~ z>k+XwU#&h#n?-UjgwO$>#j()Fyi@WK&s!s(KPOHkg-n(xfhk zBj^wZGP8hxihvnr3>WTnt>R^SGEO^}L8jogzbov&CstNwCYd+I;kMDCNpznhc7;16 zy^0v^9uIEFPq-{krbLdoC|MT;+^Pw0NZH2@BK5nCe8TqBWiUEV%F_pBJLJ9EV-%SF zOtDu;suIDViP+_89gR!smay;ptMGdqEgQpPLYBm|*w<}t3u&G8F)29Dl4}9BA9;4U z4~t+p2ac0LX(FalcF=S%`n99le3z~uNBZrA@y2Eg8i@?YePz!?Nis)gK3rXmP(RVT zZLVWWHqsV;*(aZ!JY@$<6x-tl2r+tW*EyU8;+VihvVdRLOnG#;;=;Z9oV^|PG5 zip>@ywyb4yq-}f^iSGJHR5XHmUAX~I_qGXFsCWZ(J5ptKj*3c~&txM@`r#?PXAg@c z{40ui2{U;~+hB^OGEo~%^hLgrvi7W1lsIS`n)6FeKN2zLHCIC2X*~pQiYA2sfI;-6N=6H#PnNeVbpTj8-ij`Za@`B_Y|nF z_X`W?l*ykB`$~n%qYpY`EE|kR!;q;x*mn@bVTE=e^Be%(q;FTvhGsJM&R^B;YT2OT z6s%=m@KA0X$%U5dU1+P@oquj)VfjzxjLkbY`DF$d1`_Gcnmgv&nedJm7b3!^+x!^* zC6(gcH+zD6ftjUMzXtTew19%*FcsdTm)PFFT1uQ%WTKU$}f24A-K8dU%W8NB%yc91N4;NW@3|9av5ts({Tz+6zg@bG3 zfSuHFv%dHR*84uH_gzovOKhN7fX~=m^g`>;&~|Ef{Qj6&5GsCLC!>22=z@ z9FQvbTTm5B;r8EyP1_g()%ucUI9ZqRC<8XssF+M9cl%6osxl?F4&NgCq|Fl!cIovc zpYC~0#FgN1c1G`@cd_5`4ma0!W`^2 z-Uex%ri~Ml*vPSUnZmiG`WYlv3t$I2HvM$N!6L)#v&L4);u+6vl8M-(SZ2QR475P! z?yIVMQk$Q`NbTA|yhG1~301=8b6Ij*Tv#}7kC7=V^5TPI%%v2%X}#3*+ls2BWtl_ ziB^%04L_*XW8G=6?YDG4g9&)L&Nhu8kS<&xm(nO+hb+jQ!P}T%`_o_E~4Yv)xdi!nk;WeJ^)$RdlwV7W2{j1Os2c6H5 zE?^ZeJ_lON*Jb4mJY|dKu z*i%YqVCa-48L?ZxNbIFCUSuiS1iHHz=&nx5{LX3fnStj@nDXhDZ+z2DUPq!cynM#;UEhu3r@(6f~|j#DQJU14w>ABMr+WBUO4@;b^!d zTyHfbTB`{yX7`Hyc3pr7mG*<)qIfXDc#7*t5v)0e_(aSJ0GUjn2Ti<7%^w)Ln}F~9 z5_sz|Qd3zoQG-f-vwW81Ass(Ow?oT}Ht+HKRL@)+DkU^tSQ<((u~bF&d{VZ1T_FLy zslPB+SCMV1S8z4e&(NGM$Es9h)8RY{Roy|Vp_cTEZFbO2jj?P?sTM0$kT>!=Z?XBU znmYEkm{nBU(Jw#9H_b!gV8d~}o~Kh=p!LV!6qJ|^g%$*R!+n@kwE4NTA<{etccrd_&CPZ=FY*_e%51<^WlaJUjG{0@1n-mkW9lJL0*wW}LX!1{|jlsm^f zgh)Qy%Uo|(&_=N)M`xG{^WaJ*OOrrozLdtluYlRr_>ZUh_G$DR{$Y z)O}%2?88`vP;i8!p2t}Z#(lxH$Jf`b)Ste|1obxM=6ZY1P;;opmlR2#&W|6i1W%LL zBaK2!AgHjJ*bTqdomvDK?PAmOq@(2rTQU#-Tz&4b2e?!QKSOR95&0a`Z!S#(9BSB? z3oQrWhb2mMCIa{<1->ALjYWj~q7Q5P=#_HNhAf{pRb>qWEuW`Whe*|!5#Pxva*7Oa4by#dG{2aF4xzG3VF0*LB7@UbSDQ?6g8|aj%MjPS+Kj zyWWxQ6)R}(s0DX%YSV>cb~$56#GUTRYAZF-Hg+IDdXqx!A?Gxe@(({!`RbtYUN6A) zaAo~@reP#UXN1KUfdDMw;X1rvw&J53lo^T+MT3Fr!ee&~d_|Wjl+2V?h}j z&b0AD1+?iRuIgc2oU*m_RB?@P-N1=)me^48w(PSTju$WBM*0@!OZ1ak0~Dc`&+lK+ z5K)w-c2@`+9zulSoXiwxpHbq439&C^s5hB=SqR0h1KcluWCveHuG)ZO$dbct?I50; z!zO#wD23&h#-x4@r_Aj^1;&M!iR0u;mp26rOa1wgvhThD+ZmDC=+x<>CTI!0P4|L< z52N$oFGRSX24nPCUaDgZc3`e$&ko#N?*Lnw*CvfG-DQF-j|BO2b_u6PeVj|*;JC&Y z_tMm_2^lM1)NFO=*3zy1w{cNlrvB~%YC_HrIj%uWi|$P!pSHpZI_xKB>+C|t-5Ys` z-o73uEDrRkg5bMjs23cA{eQyQxETn@j?UttSJ`kE=W`vUQ`VXjCVw3lP=7~JW#xO< zUoDV|b0x+_M+Z$rn=wwbnwihS;=sZV`xFW4 zP)yErnMU%YZ0nBJb1Rt%nQ91$lx+UgDQGu&E%~Xqafi<4Uy)!rh#EvR7ZwI%EPD~2 zNBMXrWLrNHKvlh-Cw#rxI_q*pLF`=cT@Ar9Qt|I7kyU+$y1y88edeLeTDsS(Lsh#p zS|OWhaoY~N9zBB;Cjz#==5ZpQe0(@wu3K_f$Hy_ME-I5mFg zHn-Ef(eG)7!Nw&up~5ur2KzPTVf(FE9kiNK({9$9lY9Usi(8fvh#`1g9M>UX$2K#z z0C2g`{|iVRVk0dKjuZgX{NE_!a0~46(*C;t`eMFz>#R}va?Bw-{OWuq(k%N78F||5 zAP!`CAmqM)Ham^HxQx77UOA7M+CHeg{-GT3%}P&tBmZiDKHs+I*GIFHgB?TiYsr%Z zFZ%1ta`0xFLNm-;;Pda#_C2d3Lgp&1?e?b66eWoXVVf%hzA8OI8zE1Ti9YZU!aVDq zCl_a!m8d-d|{Q z8U>ZTl)a78>4`Wcyr!cd`=(;K6k;s$d0nD`a0f)UqD^Q;xg;u!?@m_RpzD)a3U%2y zC)1o0i=L7`fmBC~Ekse8IFJsPhd=E}Fxw0XIwmc~xMvL@eJg7vcN=y(zdp^aYuNd` zw{vtT*0#EIqQn8n@?Qnqt@{rz0nj(d}{5P|>dzdAWG6N8FAp zU@sn|HAZqdXf#+9@m8`bL1IscwxNfAh8O?kClX^7VoN1kwf?dIKl(=PG~T-LsFKx;+fv1vUmLcDi&;7jHG(Qx;f?oVO@t46P#fPkzme zyj@QDbxc5o3}QtYL1R5EYD!OiTQhAps$`QJ3R8#Z< z%}Ql*V_2f$ROMqzOt2wMqbQD}bb(^ZVa!fC`WF zwF->s)e8K^mu+=UJE<2T^}acJIx*;My-i(XU7C${?qF(`2VMycKN(8tTH(652=!?-{aUT3I+D_7#UTG{Uyn#@+H>2JA_?lG&-( z(sNDn;z!1Y&mBHYuso15?U)iP&>LagTr$bIW%@nHjTPVTRZX|p5(pT=;I33m)QE@<_2+D<(M)+DLI0Y?Icsb(iFWF;HYf@jT~(@! zFgC*69Vj$gr|Rq}I$M=QhiO+-6|n2QUm0`fzH0r$EssoA3jB>~%dQp^SLYIAJ^O(| zlAS6qsoVCiiDW6fbaaF507`-q9j{O3)#Beh#8HY;m&;7+K~Su@@z?cq$U_X67<3bR0{hXXmHz#;3$U)OBY; zkL+$Wrof!rwYHY%rSxVcGAhZADy@y3ipM=9huh=)GVUf;mduS6-yV+5p9g`hrIBMH ziAV7gx>YH7n_=7>9z9_rj0#+_MDY$K4~X4Isz{X;qltfjHUEhmhm}o>80G7Faix< z$4^HOnlzzrq5}Csf*4O}WN&px*$re~I$JC=VD2+t+Z8$KWeDA(ZI0&FNtnnZ3)0*o zAv>}I^&45-(GIelsjGA|HJZ71ctQV{9I_lPv<;pPf{q=MaKuyv!(v}MESjj9tn2vR=y!^XV67^S_@|tgjq&e^}5PNmxg|TedI=pa9zvrPq-)Ftw`DPU~*J? z`QJkd%Na4VA>-2>4?{PV)=#)cm4iWRP0g>4xU=-JI4}#%Ao5PdtA((+!xf4fkdqNv zQOY>m9;-OyJBZNx{tV^L>&oq-kPK=Ok^W315aQtAenn;1_ZJT1&Qj@vStB=wpHHI| zl@XIQl0qfA>hE>(E5q*YeJp}K^KfA2B0&67jxD+`D_CYaC~)n-GQc>i1NS3cmvCqj z3BbIVj8MmQA@|HK%<*DHM1~uVME`rf z4~oDjRH+JI8XA8LO}kR>#%fha^Y+t)v_d3Yc(9$)R2Iir?m)zhE^sa=mlbiVwq zDdolE?>MUa*tRD*|3uS1EJML5)V$!rEXG#cg?ze~ISyJ1>0%D^34fR-*!ld46D6G# z{L^sPXR{rSYg~crap94tI*~@zc#*60CWl^K&3Bbm;B#X^{Bw7fEbxsjyp6h(Iok_R z!XBAD1u3=mmIGmy{}3m6v5 zEFzd^^0<)vVI?WSm6`9S$PEirEudVn&$GulYF{0jZM;-8r_?&%lS`U7Fn1%3%L=Z^ zv67sd4LG!Te&>y*boo315}KD9J_*HO=}9|*9P)!NT$cRb(vuEAXA>#aFU5C6tWB1d zJ%wkbbQ$>y<&sw4B8Ux|c?%rZ%8fOdI1J6y*~#h5#N+zgmkhjY2_)x0DV`$yLJ99{ zzgHg`8P(9*<@j&LH)RPLY=?Q#f%v^xF`E-<}h9LHMLlE1LMfPcR4GYHck+hT=h;r<$D=SH5=_@j|#(Ak`sCT z8dERRpYxpQLZ9%kpuED|RLxIqRKRJz*SsGH_t}*igB#*Kfp8ujN)F**A@?$+D|R)L zgQ7}8(BcTnJS$EsiuY zH;a#^X|nyeRgun{4{A~}Jhk&61>l!e*+~;^U_qZF6=uirkK~eMd&DUP)Yj1~2}652 z$?Q$~6zTA0lb`6KX93`0TF~p|tQ0%jw-APop!BwuYWRib?E!ctEwKtXVQnz=W+Tz8 z)($7yw%R{;kIrq|xfSZd$ySguf}rE^qt%E>PJK2K6ocl?%v>{cli+KGhT%4ZH?Qq$ za0SgM7E#M0M_S})v`=qjNw5&|m#G8OhmcT;j3ed6mcSh8pyj+sdL>M)=P9Ak?x}AA zun0NqK&xhFrW=j!l!zIzZUaryxZlN71buQpYvD$hn63sD>BJJv3gPqEAiF69tmv!D z?J$!bzl*yR#i+0M)Ur~8P$-}Icf@(|pqp}G93wd7+3SleZ#Ei_9UX44SUnw)#=#lc* zU%Z?T$(ielesM6AFYIg{7Iebg_nnlu-qPofRHQq0h06Zz1^hdQ6WI1}B(_5Bx0toPhX% zub|RX@IC5#M0Kgh7hW;kRw}aSxPAQ3zjhhMF)}rg^!mLf$b#-5An78|Jv2XsKw8oQ z5fi)`r3l9H1iIuC*RhaS<#_1r4W&;0S`4i~xSn!3_sZ{e0_Hgm7spv&ytS*Z?6QPvYOLoQKcf)O7mjOP1I2X)%SA{*F>j3N#qEly<2G@ z&$N!I+P~^m6x^~tRq5sP6G}sA1%c|d7yqL)$A}EeXA(S}0k^zy?bcrtuzRY|_#KE;bmUKRrz(iQ_*kEn%g%kB~Pa4V&(sjQd%Y7ZicsjKoH|I_XP&xI0= zKYoBJcDv2j26%1Xj5sa}Ci}Baf`>pVl6MpR-4?bKHp-58u|-5Y1mFC;L=&;8UrM5l&k@l?jU=vMvNSIp4^quiUDSZAh*n3jZ6+?!t5fJ@~ z8`qs@2|v~d)4oaGY;hEg=smvsjaik5A*j#7*(aJ$;3^K*ckJvoClTqDSj^rtmDS)k zzG?hVZXL6keGBd#BNu0Tz1{J?dzQ_!$*-D0WoA!Mr4XaQ{DeSq8(G)CTjk}((05x0 z?a9Ak%1^zKJsfW*#q!JNar%4P)%qBP>H*?=#E#o=4iMDtGILjuVT`BV194a_NhY1S zp3L#}UJsEPe!ZVklk*E^iDfP}y4C%k0-Hllq<-WKu0) zr2A=@(kb&%9_3LGFiB!lc~tq{wl&z>b^`Bxj~LAJZwjwySn3cJA{(m69FFv1P6Y%` znz~DA7OLyKge86X`HihjIouigbk>K(1rv$wjnd;HX)SSf^s*|Y_oFnqkT*!LN-?S( zR8SpD0_h+1q%jztBvM}^6=`I`{#KY%ZHvNvQBU<9UhDIA7!aDDKRcBL+(7=guO;;= z{EWFwGX#JA_-t!0@Y9&3gaHTwcz>%+elGw&Z^{IP;7 z{_ccWI@v4{$T&kHbxC#7Db31w<(o>59aX+jsRa8E!BkH^~jx3?Zcz0SPRiHcteLA@sh zL0k(xf@MF+o#u!xFSXV(U0pChfK~OV3?kr>CI0vs$hex`DQBL-gDTIgMwz)hpk=Vb zh$VklH$~ID!$HTbNr&}N=-q>!NAsrvxtd?B!QmeeiJHOM0z8kunjHmo&7wvX_K-=` z*sc#!h+%a6gH8W)llp&q03dz3JfP1r94Z-UBpq8@C8Ky2>$^=hfzHqb3l}8O8Y-c@ z9^ztghY3_B$FQQP%C!_)XnQ4jIo_>F(Hm0f&GZN0)hMmF$k18ndupr1vZ|Dj8 z_zRsL(*}$N-7C}Jd0Lc0^aY@FfAODCe|*8j*)E8FYN+>Os8faTfgIa<*y`10sWUa^ zWK$M9@d4e9cC1o{gqy=umDUJa=^y|xb1u06Tg$N-@pC19FJ1~=8-?gpbH+Y3_VzZ} zdk_6`#cx<>RobX2eQg}J!A?9Rt1fLo)!6H1UnB?V=5%#CUOq#g>{WyqV5bZ7WZj&> zrCG>WV2j_*oGr88+l2iuGX9wl+$|}hBAzaV*cDW@D-2_9pf30hc!;gmd)JvWACM;; z@oZL_@-!VUH_}yiv4-l}2qUcqRfk z$z3g4Tv6yiRUnQ)=!RK=8y;Hfpr7x{5?xgNYCjjq&Esvp(?_kklaFV9Jfa|sof>zq z%APx<#pk-ko2J#>7w#FaSi+&W^(yXz@1|Jkl$c6Dy-DI42iakJcl)j9#(9KWo60Y1 z*O#qOG6idZf~|Fa%T7Pe@$EQZML~Cij=Uag2c&meJyP%C*K7MSX(T@{BV;_u+pGsQ zb1#-_{f-NCCx>ZA+$V=}AXrn2l_@eLlk2lb0h5YshBU(_NS6 z--0Q>G$U;W`XR7ublOk92JT^F=e)2xP#z2?C&x?YPKhrjY2`1gvF;BzRbMdU#ABrF z%~GjAs6DE#4EbUzH8W=7X1*;{_k`kA+;`?fttFZFTJjQ07R~%_h}U%7-Br6>kq!p? z86gG;(Kp`s^s7B5TZ#2G5I$auhm+P1Nnas3>EEAqj=KJ21l>gR4g73lSqqnfzsbwL z*IPCJ7wgj}WCFRsw%_zwzvn-Ua8-l-?<7rASgiBKV9(oy7gd%18gq&X3dj|puwZ+j1$>Tl0&t-=O;KA65w_qx4fWIC*qGj7^M{$prJqI51Ka8UPcGw7F zBWwC?olmF>+lRXeYcx%dQf$h0QWIk4t?NyN5Y6$YpB;-AJEtNv0d4;Moq77&u?Mlf z0klb!o5gkRyK*YdJ}9jej9E3CY4NE5>vCA>ocJ1%Jf05FpyL z0-jrgZoM8}`!70yH=9doj5~^*Mk0Jqah;`g9;i>YJuely#E2LXTR!M@2f{IH%|FCsabW(_kjCXbDLP$O6ph53%X-tD$em7$+F6V5R15?x^`q25{K7 z3s|tR^4Y3nVYWQ(_Fv$?#;ZHyj#|Z7pY>O#L_-b)BoabESWH=EXqIt{_emoe8@*AHWRenDGShfg-W>v;hRQV0tJ3lQtw*z)Ai;@#z1Sg=kP-*TV4e)csA}umVNFfl9Q)DWoqx6vBVxKX^Gd3C zhowr?sXOnk+kLQI@_|Z@$kbE4t&fO6@UU=lk{c!qU0W=ednY5={$pYtdfgf9B8tVq z7O7Eo<$Id3Z0sBnzreNQ`jT+=(^s16Ke|zOnfR)8U+)`*>WAGfbXc91Qftu;4R9Z> zse^eJ6TYp61gwEaGU+$YJf^fx;GDllKf5+!{1IAwC=a4KQwl+)(%({$TINj@;Dr`8 zz7(0n1;#ji)=BbmQ}cUPTaSx0vdu3upri0E%cBg#4Y3~&0q2=7#1xyv0VDa45+!RfhFus_hqbZ+xZ>^0Va@dT1HzlPQFa67StCK* zoQD+2R7!d*Q`%SepHiN}S0D71$YWimHKjb~0bGE?^gz{9c9eU@ZHu>x&60le&KOPn zWJvPskOiQd7%^pG4}6Cp^BI;0Ioh3j*71632{35$*|QVO9Zau70Beae>k&Zo0L-$W z%SeCI{BWKwHN|HBbknmYS=|gWkI4dvD|bXNKa+(6;>1bo$Od3nK$RQbiG4_TJc?`Q z82?#oyw%P#n%TqoH=eG9vqg@by4lZ4L2JkP@+J_kx-?*N2O!SbcQW7)6to#i4V&G( zIm+UfGuH^(5Wuq#qoggS$(MbT{(Nvs{NOEYRRC}!80P;||A$s!tbz0Y;w1F{SK?90 z-5AnR|8L7aU6n@mtS6gH8vap@Ke+KmEPO71^gDT16eKosmW$q z1NH~+^+2PfMs5F;z(XFdH7Azm#XrG$8yD%I(=5+~_y1_K$_&J^D8M#9n+h9NBu{@r z{x)y8V)AL>Fz&lM*19{jl{Gwv{8cfCiP#`|{pw`fjW)lLH=vLya|*7KAg=tJ5WveG zzJX!R#RE)RnY4eG2FI-t7!ss?EfQz~dTq>tMB<>9K3Mepw2&VdKtxeUYT*cG8YE9` z^Nj8{G1tnb)+K$FT*4!6N8hOVFf7(y?0;i7ep$LK9@|~OwE%Fbo=MQ1H&Gk{chs}a z-59cZF(e6YNJu-kD*vNxTlU0~SWS9Ik{mANYfW-bN}8XLL6D0QC6?6ve>7ZK0dv%# zy9K6+DsjO5opHCnqGsmcCpBtG*fEIII+E`D92A7IRxZ!gyqL&)fA)}k`m?bP%Kz!y zco8a48-0UhO3`o^Rrn$3@52q&V(6V_-29tNW4ojVSAf6aeI@RLSZ6Xn=TSpr|7+vD zIcvt#(T_FhjIWLG`O7XrH&6Lh`X@Vi(I(_WGLvF%NRz=SXh%p@S=9qw zRQ`nkl0o86ZU3|LYE%R}An#wnRDXA9kY-|yforgVdQ80YTNL(i)Uzh%MY1vx~@mn?G9b*^Wz$xg=tG>GHM}*VDFkH_8=yvHnaSnjbzro=@?m$RCm!T$2Rpz^MRm~r zPXx$2gyWGAoDC(74Q5dP5r%J7KN>rI))D|DQH-}L|5X?P^{XRNRiwzc97$>+LzU4VY9cDDpP#UunGdHfnS8T<5& z<^PgE0XbrdiYKqdgE5-xdvw^0xs>}3YS6yo2@v#jf4+2ENXx86%eTQ!w&DZsxSoX# z7>|)JnGd>DJ7<znt{&E5`8E!R(C?s^Z*b=!Mmw5T3YmfH2ls3rSBx+hubMiZ;xmq$j>wux&uJCPF^ z$Q!~xc&Z-YTUI02X+TSUyF5T?znDURFhdclU7~a4OWF=UtQLO>m1YCg7cJFq0jIh@ z)%kZaDWE_+*=8H0twfhMQj^Jw8PtmeweVjbAC4BcEj-f^;k9mFNIcN3BpWj6eb+(@pg$3AVALka{ z&mqRH87N?$7<`^rWNl15L=3J` zs>iEs4?28J*Gx|egvabm{rRl!7`)iKRmAht!kb{juvLxM{Swda4f_zJ1kliJ-t0g~RWbDXIXt{9s%Y2zbrXJB1F1gVbD@e$g z9!}rd!A-CYN+(`4uX5Yg0coEPi-8C7C!h(R+Yg8tLg5`$2@8`V>Q&&E?-_VDa3q`j0d?O zo>}Xq2(w@$vG`C2v+7aGcoGXn!mv2NLyif)dV|+nOQO4?!1xa%W$@R*&M6@Ihr)of zzg|^+zV%0NXp8_e-@9tDRE9e zJ-ZdpI`ifHezCDqehOOGWZdC2a@qIkyQD%$zQqQ{72VP6`sF~VEc=i*fAJmqoPYkA z|HK?}-ofW8ziGvrJo|RDvB3cWq4YB|wbsON>!38G{vmh1U4G=!PFDurf$X=FvQp$) zh@_XvHw3yyDfr3q@p&x$Y~9fLL8`|YYHKs{`to5ZgbR8iF$Tl5$g(_m5X$1Yz)bNB z*H|vUALGW5WWQ$-{DsbQVN5n3miy}b$8iA+f=1uJZBleDfx7g2uW!k(%=uVO=f1CH z1)1I&u&jwFFvEG29FN>TEOPE`C0=aIMPI(+uJs!~_r@qt*?*neZwjT5i)?Nd?aN=! z`a${#I655CbZy07YvcUUerezQi}rhQO?6mgdw`nb3avvxPIK103ePccyr5hKG5X>N zI3}T=RXJh@2#i=@4dMLHrcMjaF?bzEqyX5;xum&D=T9Q{R+0YWjdmHRbOSY$!wKi3 z>v};X)6~AMGV8)datG>yayPi4HjIMGy~*}BbN?$1(OeBrzUQ&UmlYp~^G?YNP##qw z=^+=t6^L*7O1_EI>!@S4N*^a|Um4CZ4s(h@T*ppE@P!}-=6gvt6yoxaixgqGLD{aI zqKD<+$^Yb6(bmQKRj&7M{EgMKtp+=>qxpB079=HNYkSK6@>lGm|HTC}nDrk5@EdN7Y`#K7_2`d;SizE@}}Nyj2C zoL{^Xec!KN&Z6uWx(5F`@b0f4u5&Be*1_Rji-TZ)5A+jr5Nm_xDp;cxf(Y-xvV}+{~tL1%{|o z!-=Q5AIQBFh^+6lXV{CkYpmFnEJAGoEp<`d9JundH=q37?`!?_*g5W8!D81DH2-99tpBoZ$vJ-Mkna*2# zTkZEWSL<-5{|LBnN7U3Gjh=$cl(D~`LTNv+YO~}^D;Z)k$ z=;1EQP`x9-e5KggU4t@}R+^047LT^*W828Oob3l#^9zkzMOBuf?2dLFrj;NPay-_$ zI`n`P!2O~F++!`aP12ENih#drD7#2r@-Jl)lz48~V|D}jOH)E|^N$?nKdvqUQmIje zKs$1vc@tx=X1F7zGCZrrPd`rl4t(kQ%sc_OPzqdt12!zc kO7vgcWP5Y5N`KAv@R&{6hS-4xxB!3SzNUc&5X+7FACR!KdH?_b diff --git a/sfi/sfi_overview.md b/sfi/overview.md similarity index 80% rename from sfi/sfi_overview.md rename to sfi/overview.md index 090b02e..e7bdc55 100644 --- a/sfi/sfi_overview.md +++ b/sfi/overview.md @@ -4,7 +4,7 @@ The security of computer systems is extremely important. If vulnerabilities exis Web servers are one such type of computer system, and since most are directly connected to the internet, they're tested (and often deliberately attacked) every day by thousands of users. How can we be sure a web server can gracefully handle any sort of input? -Some may argue that it's impossible to uncover _every_ bug in a system. But, we as computer scientists and computer engineers can use some effective techniques to catch most of them. Fuzzing is one such technique. This "fuzzing interface" allows you to utilize AFL++ (an advanced fuzzer) along with a special `LD_PRELOAD` library (called "sockstorm") to fuzz your pserv implementation. This will help you uncover any bugs in your code that cause your server to crash or hang. +Some may argue that it's impossible to uncover _every_ bug in a system. But, we as computer scientists and computer engineers can use some effective techniques to catch most of them. Fuzzing is one such technique. This "fuzzing interface" allows you to utilize AFL++ (an advanced fuzzer) along with a special `LD_PRELOAD` library (called "gurthang") to fuzz your pserv implementation. This will help you uncover any bugs in your code that cause your server to crash or hang. A quick crash-course on how to get started is below. However, many more useful details can be found throughout the documentation. @@ -12,14 +12,14 @@ A quick crash-course on how to get started is below. However, many more useful d ### **Concepts** -- [What is fuzzing?](./sfi_concepts_fuzzing.md) -- [What is AFL++?](./sfi_concepts_afl.md) -- [What is sockstorm?](./sfi_concepts_sockstorm.md) +- [What is fuzzing?](./concepts_fuzzing.md) +- [What is AFL++?](./concepts_afl.md) +- [What is gurthang?](./concepts_gurthang.md) ### **Fuzzing Interface** -- [How do I fuzz my server?](./sfi_how_to_fuzz.md) (`fuzz-pserv.py`) -- [What do I do after fuzzing?](./sfi_after_fuzzing.md) +- [How do I fuzz my server?](./how_to_fuzz.md) (`fuzz-pserv.py`) +- [What do I do after fuzzing?](./after_fuzzing.md) ## Quickstart: Fuzzing your Server diff --git a/sfi/sfi_concepts_sockstorm.md b/sfi/sfi_concepts_sockstorm.md deleted file mode 100644 index b9b14a6..0000000 --- a/sfi/sfi_concepts_sockstorm.md +++ /dev/null @@ -1,17 +0,0 @@ -# Concepts: What is sockfuzz? - -AFL and AFL++ are excellent at what they do, but they have limitations. One such limitation is how AFL feeds input to the target program: it only works with programs that read from STDIN or from a file. In many cases, this is sufficient; lots of C programs take their input from STDIN or a file. - -However, this project is about creating a HTTP server. Servers don't read input through a file or STDIN - they read from network sockets. So, the question becomes: how can we force a HTTP server to read input from STDIN, so we can fuzz it with AFL? Additionally, how can we do this without modifying your source code? - -Sockstorm is a C library I developed to solve this problem. It works by "overloading" the `accept` system call and running some extra code to establish an internal connection to your server. Using the special `LD_PRELOAD` environment variable, it can convince your server to use sockfuzz's copy of `accept`, rather than the actual system call. - -## Connection Multiplexing - -Once called, sockstorm's version of the `accept` system call spawns a controller thread. This controller threads reads input via stdin, expecting a specific file format (dubbed the **comux** file format). These comux files are designed to specify the data to be sent to the target server across multiple connections. The controller thread parses the input file, then spawns individual threads to send "chunks" of data to the target server across specific connections. - -This approach allows for multiple internal client connections to be made to your server, increasing the probability of finding multithreading-related bugs. As a bonus, it requires *zero* modification to your source code. All you have to do is prepend `LD_PRELOAD=/path/to/sockstorm-preload.so` to your command-line invocation of your server, then pipe one of these comux files to your process via stdin. - -## AFL++ Custom Mutator - -The other half of sockstorm is an AFL++ custom mutator. AFL++ does great when fuzzing many programs on its own, but for more complex file formats (such as the **comux** files being used here), a custom mutator can be implemented to ensure the file's structure doesn't get overwritten during fuzzing. Sockstorm's mutator (`sockstorm-mutator.so`) does just that; it maintains the structure of each comux file while also randomly modifying (fuzzing) the connection data to be sent to the target server.