@ms_s3c

Security Researcher sh -c ‘﹤&$1’

 Bochum, Germany
schumilo.de
Joined February 2014
  • Tweets219
  • Following360
  • Followers1.2K
5Media
Replying to @is_eqv
@is_eqv and I just published the source code of our hypervisor-based snapshot fuzzer for complex network targets (+ vulns in firefox): github.com/RUB-SysSec/nyx-ne…. Check it out!
3
101
5
299
Sergej Schumilo retweeted
Thorsten Holz@thorstenholz7 May 2024
Congratulations Dr. @m_u00d8! 🎉
10
3
3
49
9,963
Sergej Schumilo retweeted
TyphoonCon🌪️
@typhooncon11 Feb 2024
📷We’re excited to announce the second training session for #TyphoonCon24: “Fuzzing & Attacking Deeply Embedded Devices” by Tobias Scharnowski (@ScepticCtf) & Marius Muench (@nSinusR). Learn more and register: eventbrite.com/e/typhooncon-…
2
81
2
529
574,082
Sergej Schumilo retweeted
Moritz Schloegel@m_u00d89 Feb 2024
Fuzzing is hard, evaluating fuzzing is harder 🔥 For our new @IEEESSP paper, we studied 150 fuzzing evals and found issues such as lackluster documentation, bad experiment setups, or questionable CVEs 📄 Paper mschloegel.me/paper/schloege… 🔧 Help us fix this github.com/fuzz-evaluator/gu…
3
47
6
183
23,427
Sergej Schumilo retweeted
Christian Holler@mozdeco26 Jan 2024
I know I'm late for Christmas presents but I've added dynamic instrumentation filtering to AFL++. You can now select which parts of the (llvmnative) instrumentation you want to use at runtime, without rebuilding: github.com/AFLplusplus/AFLpl… #fuzzing
9
27
4,058
Sergej Schumilo retweeted
h0mbre@h0mbre_5 Nov 2023
starting a new fuzzer project on the blog that is based on an old @gamozolabs idea. in the first post, we load a statically built Bochs emulator ELF into our fuzzer process and execute it. there is some code and the humble beginnings of a repo. lets gooo h0mbre.github.io/New_Fuzzer_…

Fuzzer Development 1: The Soul of a New Machine

Introduction && Credit to Gamozolabs For a long time I’ve wanted to develop a fuzzer on the blog during my weekends and freetime, but for one reason or another, I could never really conceptualize a...

h0mbre.github.io
6
101
3
347
82,391
Sergej Schumilo retweeted
Mathieu Tarral@mtarral31 Oct 2023
🚀 kAFL release v0.8 1⃣ New Linux tutorial based on the Damned Vulnerable Kernel Module (DVKM) by @hardik05 2⃣ Docs how to use the kAFL "agent.sh" and sharedir based workflow to fuzz Linux targets 3⃣ A simplified kAFL agent in the Linux kernel !
1
18
1
74
7,975
Sergej Schumilo retweeted
Mathieu Tarral@mtarral21 Apr 2023
It's been a while since I've given updates here, especially since I started at Intel one year ago ! I've taken over the maintainership of kAFL 🛠️🚀 kAFL is a HW assisted feedback fuzzer for x86 VMs ✨ github.com/IntelLabs/kAFL ⬇️ (1/x)

GitHub - IntelLabs/kAFL: A fuzzer for full VM kernel/driver targets

A fuzzer for full VM kernel/driver targets. Contribute to IntelLabs/kAFL development by creating an account on GitHub.

github.com
5
47
1
160
20,713
Sergej Schumilo retweeted
Omar@byte_how19 Sep 2022
Every paper from them is gold. (@is_eqv, @ms_s3c, @mr_phrazer et al) Every. Single. One. nyx-fuzz.com/papers/
1
4
1
30
Sergej Schumilo retweeted
Christopher
@Kharosx030 Mar 2022
Nyx fuzzing a Windows x64 kernel driver w/ full-system snapshot fuzzing. Lots of components, but it works pretty well.
1
26
165
Sergej Schumilo retweeted
dmnk.bsky.social@domenuk20 Mar 2022
We just released FitM, the Fuzzer in the Middle!🎉🎉 Together with @derpst3b, @JB_Liikt and @_mmunier we added snapshotting and a network emulator to qemuafl. It fuzzes multiple stages of client-server interactions independently. Paper @ BAR'22, Code here: github.com/FGSect/FitM
4
80
3
285
Replying to @richinseattle @expend20 @is_eqv @ms_s3c
Here is Nyx backend powering the familiar AFL++ frontend. This is still using intelpt + full system snapshots and achieving similar to inlined source instrumentation performance.
4
25
Full system, hypervisor accelerated, incremental snapshot fuzzing with Intel PT coverage engine enabling full protocol stateful fuzzing via Nyx-Net! Getting roughly 1000 exec/s/core on dnsmasq. This is followup work to kAFL/RedQueen. Kudos to the authors @is_eqv and @ms_s3c!
3
48
1
251
Want to fuzz complex targets with AFL++ and snapshots? @is_eqv and I now got you covered: there is a Nyx implementation for AFL++ available here github.com/nyx-fuzz/Nyx/blob…
45
140
Sergej Schumilo retweeted
Thorsten Holz@thorstenholz2 Dec 2021
Except from the @MozillaSecurity Firefox Security Newsletter/FSN-2021-Q3 (wiki.mozilla.org/Firefox_Sec…): "Now, we have received and successfully evaluated a research prototype for fuzzing the IPC Layer. " - Congratulations @ms_s3c and @is_eqv!
1
8
36
Sergej Schumilo retweeted
Code Intelligence@CI_Fuzz15 Nov 2021
Remember when @ms_s3c and @is_eqv showed us how to fuzz Super Mario Bros. at FuzzCon Europe 2020? -> youtu.be/jkNao0SjBAA They just published the source code to their hypervisor-based snapshot fuzzer. Feel free to check it out! ->github.com/RUB-SysSec/nyx-ne… #Fuzzing #SuperMario
Sergej Schumilo@ms_s3c14 Nov 2021
Replying to @is_eqv
@is_eqv and I just published the source code of our hypervisor-based snapshot fuzzer for complex network targets (+ vulns in firefox): github.com/RUB-SysSec/nyx-ne…. Check it out!
6
21
Sergej Schumilo retweeted
is-eqv.bsky.social@is_eqv14 Nov 2021
Replying to @ms_s3c
@ms_s3c and I also just published the most recent version of the codebase here: nyx-fuzz.com/ (the homepage even has gifs, check it out!!!)
1
7
30
Our (@is_eqv, Andrea Jemmett, @bl4ckic3 and @thorstenholz) paper on robust snapshot based network fuzzing has landed on ArXiv, check it out here: arxiv.org/abs/2111.03013

Nyx-Net: Network Fuzzing with Incremental Snapshots

Coverage-guided fuzz testing ("fuzzing") has become mainstream and we have observed lots of progress in this research area recently. However, it is still challenging to efficiently test network...

arxiv.org
1
39
3
109
Sergej Schumilo retweeted
is-eqv.bsky.social@is_eqv26 Aug 2021
Replying to @ms_s3c
@ms_s3c and I just published the code of our snapshot based hypervisor fuzzer Nyx github.com/RUB-SysSec/Nyx. Paper and talk: usenix.org/conference/usenix…. Stay tuned for a much more polished version at nyx-fuzz.com
3
53
5
166
Sergej Schumilo retweeted
is-eqv.bsky.social@is_eqv25 Mar 2021
sneak peak time! Stuff that @klautcomputing, @ms_s3c and I have been working on. What if your debugger has a fuzzing harness and can run the target 100s to 10000s of times per second? Why bother with breakpoints? Watch expressions get evaluated live as you type.
Rohan Padhye@moarbugs25 Mar 2021
Replying to @mboehme_ @normaldeviate @jeanqasaur
I don't think annotations will catch on, but we need some introspection. As an example, I think gdb has a fantastic UI. The ability to express breakpoints, single step, and evaluate inline is 💯. You can build fancy viz on top of this. How can we interact similarly with fuzzers?
3
9
56
Sergej Schumilo retweeted
is-eqv.bsky.social@is_eqv23 Mar 2021
Turns out, libxdc is still by far the fastest PT decoder out there! Find more infos on why libxdc outperforms honeybee: github.com/nyx-fuzz/libxdc. Thanks to @ms_s3c for investigating this and to @ezhes_ for the fresh ideas and helping us understand the performance of honeybee!
is-eqv.bsky.social@is_eqv19 Mar 2021
blog.trailofbits.com/2021/03… <- incredible cool approach to speed up Intel PT decoding for fuzzing by @ezhes_. Hope to see this end up in libxdc!
1
7
2
29
Load more