Overcoming Fuzzing Obstacles

Overview

• Verify checksums or cryptographic hashes before processing input
• Rely on global state (e.g., system time, environment variables)
• Use non-deterministic random number generators
• Perform complex validation that makes it difficult for the fuzzer to generate valid inputs

1. Checksums: The fuzzer must guess correct hash values (astronomically unlikely)
2. Global state: Same input produces different behavior across runs (breaks determinism)
3. Complex validation: The fuzzer spends effort hitting validation failures instead of exploring deeper code

Key Concepts

When to Apply

• The fuzzer gets stuck at checksum or hash verification
• Coverage reports show large blocks of unreachable code behind validation
• Code uses time-based seeds or other non-deterministic global state
• Complex validation makes it nearly impossible to generate valid inputs
• You see the fuzzer repeatedly hitting the same validation failures

• The obstacle can be overcome with a good seed corpus or dictionary
• The validation is simple enough for the fuzzer to learn (e.g., magic bytes)
• You're doing grammar-based or structure-aware fuzzing that handles validation
• Skipping the check would introduce too many false positives
• The code is already fuzzing-friendly

Quick Reference

Step-by-Step

Step 1: Identify the Obstacle

1. Look for checksum/hash verification before deeper processing
2. Check for calls to rand(), time(), or srand() with system seeds
3. Find validation functions that reject most inputs
4. Identify global state initialization that differs across runs

• Coverage reports (see coverage-analysis technique)
• Profiling with -fprofile-instr-generate
• Manual code inspection of entry points

Step 2: Add Conditional Compilation

Copy
// Before: Hard obstacle
if (checksum != expected_hash) {
    return -1;  // Fuzzer never gets past here
}

// After: Conditional bypass
if (checksum != expected_hash) {
#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
    return -1;  // Only enforced in production
#endif
}
// Fuzzer can now explore code beyond this check
`**Rust Example:**`
// Before: Hard obstacle
if checksum != expected_hash {
    return Err(MyError::Hash);  // Fuzzer never gets past here
}

// After: Conditional bypass
if checksum != expected_hash {
    if !cfg!(fuzzing) {
        return Err(MyError::Hash);  // Only enforced in production
    }
}
// Fuzzer can now explore code beyond this check

Step 3: Verify Coverage Improvement

1. Rebuild with fuzzing instrumentation
2. Run the fuzzer for a short time
3. Compare coverage to the unpatched version
4. Confirm new code paths are being explored

Step 4: Assess False Positive Risk

• Does code after the check assume validated properties?
• Could skipping validation cause crashes that cannot occur in production?
• Is there implicit state dependency?

Common Patterns

Pattern: Bypass Checksum Validation

Copy
uint32_t computed = hash_function(data, size);
if (computed != expected_checksum) {
    return ERROR_INVALID_HASH;
}
process_data(data, size);
`**After:**`
uint32_t computed = hash_function(data, size);
if (computed != expected_checksum) {
#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
    return ERROR_INVALID_HASH;
#endif
}
process_data(data, size);

Pattern: Deterministic PRNG Seeding

Copy
void initialize() {
    srand(time(NULL));  // Different seed each run
}
`**After:**`
void initialize() {
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
    srand(12345);  // Fixed seed for fuzzing
#else
    srand(time(NULL));
#endif
}

Pattern: Careful Validation Skip

Copy
#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
if (!validate_config(&config)) {
    return -1;  // Ensures config.x != 0
}
#endif

int32_t result = 100 / config.x;  // CRASH: Division by zero in fuzzing!
`**After (Safe):**`
#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
if (!validate_config(&config)) {
    return -1;
}
#else
// During fuzzing, use safe defaults for failed validation
if (!validate_config(&config)) {
    config.x = 1;  // Prevent division by zero
    config.y = 1;
}
#endif

int32_t result = 100 / config.x;  // Safe in both builds

Pattern: Bypass Complex Format Validation

Copy
// Before: Multiple validation stages
pub fn parse_message(data: &[u8]) -> Result<Message, Error> {
    validate_magic_bytes(data)?;
    validate_structure(data)?;
    validate_checksums(data)?;
    validate_crypto_signature(data)?;

    deserialize_message(data)
}

// After: Skip expensive validation during fuzzing
pub fn parse_message(data: &[u8]) -> Result<Message, Error> {
    validate_magic_bytes(data)?;  // Keep cheap checks

    if !cfg!(fuzzing) {
        validate_structure(data)?;
        validate_checksums(data)?;
        validate_crypto_signature(data)?;
    }

    deserialize_message(data)
}

Advanced Usage

Tips and Tricks

Real-World Examples

Measuring Patch Effectiveness

1. Line coverage: Use llvm-cov or cargo-cov to see new reachable lines
2. Basic block coverage: More fine-grained than line coverage
3. Function coverage: How many more functions are now reachable?
4. Corpus size: Does the fuzzer generate more diverse inputs?

Combining with Other Techniques

• Corpus seeding: Provide valid inputs that get past initial parsing
• Dictionaries: Help fuzzer learn magic bytes and common values
• Structure-aware fuzzing: Use protobuf or grammar definitions for complex formats
• Harness improvements: Better harness can sometimes avoid obstacles entirely

Anti-Patterns

Tool-Specific Guidance

libFuzzer

Copy
# C++ compilation
clang++ -g -fsanitize=fuzzer,address -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION \
    harness.cc target.cc -o fuzzer

# The macro is usually defined automatically by -fsanitize=fuzzer
clang++ -g -fsanitize=fuzzer,address harness.cc target.cc -o fuzzer

• The macro is defined automatically; manual definition is usually unnecessary
• Use #ifdef to check for the macro
• Combine with sanitizers to detect bugs in newly reachable code

AFL++

Copy
# Compilation with AFL++ wrappers
afl-clang-fast++ -g -fsanitize=address target.cc harness.cc -o fuzzer

# The macro is defined automatically by afl-clang-fast

• Use afl-clang-fast or afl-clang-lto for automatic macro definition
• Persistent mode harnesses benefit most from obstacle patching
• Consider using AFL_LLVM_LAF_ALL for additional input-to-state transformations

honggfuzz

Copy
# Compilation
hfuzz-clang++ -g -fsanitize=address target.cc harness.cc -o fuzzer

• Use hfuzz-clang or hfuzz-clang++ wrappers
• The macro is available for conditional compilation
• Combine with honggfuzz's feedback-driven fuzzing

cargo-fuzz (Rust)

Copy
# Build fuzz target (cfg!(fuzzing) is automatically set)
cargo fuzz build fuzz_target_name

# Run fuzz target
cargo fuzz run fuzz_target_name

• Use cfg!(fuzzing) for runtime checks in production builds
• Use #[cfg(fuzzing)] for compile-time conditional compilation
• The fuzzing cfg is only set during cargo fuzz builds, not regular cargo build
• Can be manually enabled with RUSTFLAGS="--cfg fuzzing" for testing

LibAFL

Copy
# Compilation
clang++ -g -fsanitize=address -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION \
    target.cc -c -o target.o

• Define the macro manually or use compiler flags
• Works the same as with libFuzzer
• Useful when building custom LibAFL-based fuzzers

Troubleshooting

Related Skills

Tools That Use This Technique

Related Techniques

Resources

Key External Resources