toad.social

danzinPosted a topic about lafleur, the CPython JIT fuzzer I'm developing: <a href="https://discuss.python.org/t/introducing-lafleur-a-cpython-jit-fuzzer/103452" rel="nofollow noopener" translate="no" target="_blank">https://discuss.python.org/t/introducing-lafleur-a-cpython-jit-fuzzer/103452</a>It has many details about the project, the results (4 JIT crashes so far), calls for help and ideas for the future.If any of this interests you, please give a read. Boosts welcome :)<a href="https://mastodon.social/tags/lafleur" class="mention hashtag" rel="nofollow noopener" target="_blank">#lafleur</a> <a href="https://mastodon.social/tags/fusil" class="mention hashtag" rel="nofollow noopener" target="_blank">#fusil</a> <a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://mastodon.social/tags/fuzzer" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzer</a> <a href="https://mastodon.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a> <a href="https://mastodon.social/tags/CPython" class="mention hashtag" rel="nofollow noopener" target="_blank">#CPython</a> <a href="https://mastodon.social/tags/JIT" class="mention hashtag" rel="nofollow noopener" target="_blank">#JIT</a>

Eric Eide"Interns Gone Wasm."Khan Karimov, my PhD student, talks about his summer internship work at F5 in this podcast. <a href="https://scholar.social/tags/webassembly" class="mention hashtag" rel="nofollow noopener" target="_blank">#webassembly</a> <a href="https://scholar.social/tags/wasm" class="mention hashtag" rel="nofollow noopener" target="_blank">#wasm</a> <a href="https://scholar.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a> <a href="https://youtu.be/OhybI5aUy5M" rel="nofollow noopener" translate="no" target="_blank">https://youtu.be/OhybI5aUy5M</a>

danzinBusy day, good day: the new CPython fuzzer lafleur found its first 2 crashes this morning! Happiness only marred by the bad job I did reducing the testcases and making the reports reproducible. Thanks Brandt Bucher and and Ken Jin for the patience! Next bug reports will be more polished and reliable.Also, we got 3 new PRs for the fuzzer but I didn't have time to review them, will have to leave that for tomorrow.<a href="https://github.com/devdanzin/lafleur/" rel="nofollow noopener" translate="no" target="_blank">https://github.com/devdanzin/lafleur/</a><a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://mastodon.social/tags/CPython" class="mention hashtag" rel="nofollow noopener" target="_blank">#CPython</a> <a href="https://mastodon.social/tags/fuzzer" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzer</a> <a href="https://mastodon.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a> <a href="https://mastodon.social/tags/fusil" class="mention hashtag" rel="nofollow noopener" target="_blank">#fusil</a> <a href="https://mastodon.social/tags/lafleur" class="mention hashtag" rel="nofollow noopener" target="_blank">#lafleur</a>

danzinTrying real hard to build a fuzzer targeting the CPython JIT, lots of features implemented but not a single crash or bug discovered so far.Such is life when hunting for crashes in robust code.This weekend I'll be spinning off a new fuzzer that grew from fusil. Wish me luck 🙂<a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://mastodon.social/tags/CPython" class="mention hashtag" rel="nofollow noopener" target="_blank">#CPython</a> <a href="https://mastodon.social/tags/JIT" class="mention hashtag" rel="nofollow noopener" target="_blank">#JIT</a> <a href="https://mastodon.social/tags/Fuzzer" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fuzzer</a> <a href="https://mastodon.social/tags/Fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fuzzing</a> <a href="https://mastodon.social/tags/fusil" class="mention hashtag" rel="nofollow noopener" target="_blank">#fusil</a> <a href="https://mastodon.social/tags/lafleur" class="mention hashtag" rel="nofollow noopener" target="_blank">#lafleur</a>

danzinSo, what's next for fuzzing CPython with fusil?The results point to interesting future ideas, including expanding fuzzing to new environments like subinterpreters, using more tools like Thread Sanitizer, and developing more advanced fuzzing techniques.A huge thank you to everyone who contributed!And thank you for reading!P.S.: if you have a C/Rust extension, we can fuzz it too: <a href="https://mastodon.social/@danzin/114383188014599269" rel="nofollow noopener" translate="no" target="_blank">https://mastodon.social/@danzin/114383188014599269</a>(5/5)<a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://mastodon.social/tags/CPython" class="mention hashtag" rel="nofollow noopener" target="_blank">#CPython</a> <a href="https://mastodon.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a> <a href="https://mastodon.social/tags/fuzzer" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzer</a> <a href="https://mastodon.social/tags/fusil" class="mention hashtag" rel="nofollow noopener" target="_blank">#fusil</a>

danzinOne finding I really like is the bug discovery pattern.There wasn't a steady stream of bugs, but spikes of findings: 1st, a huge number of crashes as I started testing a CPython that hadn't been fuzzed by fusil in a decade.Later, a new wave of issues tied to the addition of new features to the fuzzer, like support for "weird classes" and typing objects.So periodic campaigns may have better cost-benefit than continuous fuzzing.(4/5)<a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://mastodon.social/tags/CPython" class="mention hashtag" rel="nofollow noopener" target="_blank">#CPython</a> <a href="https://mastodon.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a> <a href="https://mastodon.social/tags/fuzzer" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzer</a> <a href="https://mastodon.social/tags/fusil" class="mention hashtag" rel="nofollow noopener" target="_blank">#fusil</a>

danzinThe credit for fusil's effective design goes all to Victor Stinner (<a href="https://mamot.fr/@vstinner" class="u-url mention" rel="nofollow noopener" target="_blank">@vstinner</a>), who created it nearly two decades ago. It was responsible for finding release blockers way back in 2008. I just contributed a little to revive and enhance it. Some enhancements included running generated code in threads and adopting new "interesting" objects and values as inputs, helping to discover more crashes.(3/5)<a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://mastodon.social/tags/CPython" class="mention hashtag" rel="nofollow noopener" target="_blank">#CPython</a> <a href="https://mastodon.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a> <a href="https://mastodon.social/tags/fuzzer" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzer</a> <a href="https://mastodon.social/tags/fusil" class="mention hashtag" rel="nofollow noopener" target="_blank">#fusil</a>

danzinAll this was only possible due to the great response from the Python community.Thanks to the developers efforts to triage, diagnose, and fix the problems, the campaign became a collaborative effort to improve Python.The impact was considerable, mobilizing Core Devs and contributors to create 98 PRs to fix these bugs. The average time to fix an issue was about 20 days, with a median of just five days.(2/5)<a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://mastodon.social/tags/CPython" class="mention hashtag" rel="nofollow noopener" target="_blank">#CPython</a> <a href="https://mastodon.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a> <a href="https://mastodon.social/tags/fuzzer" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzer</a> <a href="https://mastodon.social/tags/fusil" class="mention hashtag" rel="nofollow noopener" target="_blank">#fusil</a>

danzinHappy to share the results of a fuzzing campaign targeting CPython that ran from Oct 2024 to May 2025. Using the fusil fuzzer, the goal was to find crashes and improve CPython's robustness.I really like the results we got: the effort uncovered 52 unique crash-related issues. These reports approached 30% of all "type-crash" issues filed during that period. One of the crashes was classified as a Release Blocker, that was a nice result! :)(1/5)<a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://mastodon.social/tags/CPython" class="mention hashtag" rel="nofollow noopener" target="_blank">#CPython</a> <a href="https://mastodon.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a> <a href="https://mastodon.social/tags/fuzzer" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzer</a> <a href="https://mastodon.social/tags/fusil" class="mention hashtag" rel="nofollow noopener" target="_blank">#fusil</a>

danzinSo, my technical report on fuzzing CPython with fusil is almost done.I'd really appreciate some help categorizing the found issues by relevance/severity/importance or any other name for impact.Do you have the chops to help with that? And do you have time and interest? Please get in touch if so! And please boost if you can :)A plot, some tables, links to the report and some discussion are available in this thread:<a href="https://discuss.python.org/t/feedback-on-the-recent-fusil-fuzzing-campaign-of-cpython/91737" rel="nofollow noopener" translate="no" target="_blank">https://discuss.python.org/t/feedback-on-the-recent-fusil-fuzzing-campaign-of-cpython/91737</a><a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://mastodon.social/tags/CPython" class="mention hashtag" rel="nofollow noopener" target="_blank">#CPython</a> <a href="https://mastodon.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a> <a href="https://mastodon.social/tags/fuzzer" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzer</a> <a href="https://mastodon.social/tags/fusil" class="mention hashtag" rel="nofollow noopener" target="_blank">#fusil</a>

LavX NewsExploiting Mach IPC Messages: A Deep Dive into MacOS Security ResearchIn an intricate exploration of MacOS security, Dillon Franke unveils his journey through fuzzing and vulnerability discovery, focusing on Mach IPC messages. This article dissects the methodology used ...<a href="https://news.lavx.hu/article/exploiting-mach-ipc-messages-a-deep-dive-into-macos-security-research" rel="nofollow noopener" translate="no" target="_blank">https://news.lavx.hu/article/exploiting-mach-ipc-messages-a-deep-dive-into-macos-security-research</a><a href="https://ioc.exchange/tags/news" class="mention hashtag" rel="nofollow noopener" target="_blank">#news</a> <a href="https://ioc.exchange/tags/tech" class="mention hashtag" rel="nofollow noopener" target="_blank">#tech</a> <a href="https://ioc.exchange/tags/Fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fuzzing</a> <a href="https://ioc.exchange/tags/MachIPC" class="mention hashtag" rel="nofollow noopener" target="_blank">#MachIPC</a> <a href="https://ioc.exchange/tags/MacOSSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#MacOSSecurity</a>

buheratorTo join the recent series of great Windows Defender content (defendnot, EvilentCoerce) I published a status report on mpclient development: Fuzzing Windows Defender with loadlibrary in 2025 <a href="https://scrapco.de/blog/fuzzing-windows-defender-with-loadlibrary-in-2025.html" rel="nofollow noopener" target="_blank">https://scrapco.de/blog/fuzzing-windows-defender-with-loadlibrary-in-2025.html</a> <a class="hashtag" href="https://infosec.place/tag/fuzzing" rel="nofollow noopener" target="_blank">#Fuzzing</a> <a class="hashtag" href="https://infosec.place/tag/reverseengineering" rel="nofollow noopener" target="_blank">#ReverseEngineering</a> <a class="hashtag" href="https://infosec.place/tag/antivirus" rel="nofollow noopener" target="_blank">#Antivirus</a>

danzin<a href="https://mastodon.social/tags/Fusil" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fusil</a> works by generating source files with random calls, using interesting arguments, then monitoring their execution and output. It usually finds crashes resulting from the processing of invalid objects and unexpected call patterns.Fusil was created by <a href="https://mamot.fr/@vstinner" class="u-url mention" rel="nofollow noopener" target="_blank">@vstinner</a>.Features added by me include running generated code in parallel threads, testing class instances in addition to classes and functions, and using new interesting objects/values as inputs.<a href="https://github.com/issues/created?q=is%3Aissue%20author%3Adevdanzin%20-repo%3Adevdanzin%2Ffusil%20fusil%20%20sort%3Acreated-asc" rel="nofollow noopener" translate="no" target="_blank">https://github.com/issues/created?q=is%3Aissue%20author%3Adevdanzin%20-repo%3Adevdanzin%2Ffusil%20fusil%20%20sort%3Acreated-asc</a><a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://mastodon.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a>

danzinWriting about <a href="https://mastodon.social/tags/fusil" class="mention hashtag" rel="nofollow noopener" target="_blank">#fusil</a>. Some bits:Fuzzing <a href="https://mastodon.social/tags/CPython" class="mention hashtag" rel="nofollow noopener" target="_blank">#CPython</a> with fusil shows it to be a valuable tool for finding and fixing crashers. It started in October 2024 and is ongoing, using free tier cloud instances and personal computers.Results: - Fuzzing time: > 25.000 hours - Fuzzing sessions: > 1.000.000 - Hits: > 50.000 - Issues filled: 52The original design of fusil makes it well-suited for fuzzing CPython, finding both deep, relevant bugs as well as shallow, low value crashes.<a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://mastodon.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a>

Stefano ZacchiroliMy colleagues at CEA in <a href="https://mastodon.xyz/tags/Paris" class="mention hashtag" rel="nofollow noopener" target="_blank">#Paris</a>, France, are hiring a 2-year <a href="https://mastodon.xyz/tags/postdoc" class="mention hashtag" rel="nofollow noopener" target="_blank">#postdoc</a> to work on the joint research project <a href="https://mastodon.xyz/tags/SECUBIC" class="mention hashtag" rel="nofollow noopener" target="_blank">#SECUBIC</a> about <a href="https://mastodon.xyz/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a> binaries to identify <a href="https://mastodon.xyz/tags/backdoors" class="mention hashtag" rel="nofollow noopener" target="_blank">#backdoors</a>. (See this recently joint work at <a href="https://mastodon.xyz/tags/ICSE2025" class="mention hashtag" rel="nofollow noopener" target="_blank">#ICSE2025</a> for previous results: <a href="https://upsilon.cc/~zack/research/publications/icse-2025-rosa-fuzzing.pdf" rel="nofollow noopener" translate="no" target="_blank">https://upsilon.cc/~zack/research/publications/icse-2025-rosa-fuzzing.pdf</a> )If you're interested, or know interested candidates, head to: <a href="https://secubic-ptcc.github.io/jobs/open/2025/04/02/postdoc-supply-chain-binary-fuzzing.html" rel="nofollow noopener" translate="no" target="_blank">https://secubic-ptcc.github.io/jobs/open/2025/04/02/postdoc-supply-chain-binary-fuzzing.html</a> for details.<a href="https://mastodon.xyz/tags/getfedihired" class="mention hashtag" rel="nofollow noopener" target="_blank">#getfedihired</a>

danzinDo you maintain or contribute to a <a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> package that includes a C extension? Would you like to run a fuzzer against it?If so, let me know and I will run it, or help you to get it running. The fuzzer is <a href="https://mastodon.social/tags/fusil" class="mention hashtag" rel="nofollow noopener" target="_blank">#fusil</a>, which generates random code calling into your functions and methods. It's useful to check for crashes on invalid inputs or unexpected call patterns.It has found about 50 crashes in <a href="https://mastodon.social/tags/CPython" class="mention hashtag" rel="nofollow noopener" target="_blank">#CPython</a>, 20 in <a href="https://mastodon.social/tags/PyPy" class="mention hashtag" rel="nofollow noopener" target="_blank">#PyPy</a>, 6 in <a href="https://mastodon.social/tags/Numpy" class="mention hashtag" rel="nofollow noopener" target="_blank">#Numpy</a> etc.<a href="https://mastodon.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a> <a href="https://mastodon.social/tags/fuzzer" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzer</a> <a href="https://mastodon.social/tags/testing" class="mention hashtag" rel="nofollow noopener" target="_blank">#testing</a> See here: <a href="https://github.com/devdanzin/fusil/issues/37" rel="nofollow noopener" translate="no" target="_blank">https://github.com/devdanzin/fusil/issues/37</a>

Karol MazurekHow a simple <a href="https://infosec.exchange/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a> payload bypassed entitlement check and triggered a <a href="https://infosec.exchange/tags/kernel" class="mention hashtag" rel="nofollow noopener" target="_blank">#kernel</a> panic on <a href="https://infosec.exchange/tags/macOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#macOS</a> in the IOMobileFramebuffer driver. Patched in 15.4. Enjoy!<a href="https://afine.com/case-study-iomobileframebuffer-null-pointer-dereference/" rel="nofollow noopener" translate="no" target="_blank">https://afine.com/case-study-iomobileframebuffer-null-pointer-dereference/</a><a href="https://infosec.exchange/tags/RE" class="mention hashtag" rel="nofollow noopener" target="_blank">#RE</a>, <a href="https://infosec.exchange/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vulnerability</a> <a href="https://infosec.exchange/tags/Research" class="mention hashtag" rel="nofollow noopener" target="_blank">#Research</a> <a href="https://infosec.exchange/tags/PoC" class="mention hashtag" rel="nofollow noopener" target="_blank">#PoC</a>

Thor A. HoplandWhat's happening in the <a href="https://snabelen.no/tags/US" class="mention hashtag" rel="nofollow noopener" target="_blank">#US</a> government right now seems like they're "<a href="https://snabelen.no/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a> <a href="https://snabelen.no/tags/democracy" class="mention hashtag" rel="nofollow noopener" target="_blank">#democracy</a>", that is overwhelming the system and the opposition in order to install autocracy.The primary problem IMHO being that the <a href="https://snabelen.no/tags/constitution" class="mention hashtag" rel="nofollow noopener" target="_blank">#constitution</a> is still written in an antiquated form of <a href="https://snabelen.no/tags/English" class="mention hashtag" rel="nofollow noopener" target="_blank">#English</a> which allows an <a href="https://snabelen.no/tags/elite" class="mention hashtag" rel="nofollow noopener" target="_blank">#elite</a> class of specialized <a href="https://snabelen.no/tags/lawyers" class="mention hashtag" rel="nofollow noopener" target="_blank">#lawyers</a> to interpret laws, and therefore be gatekeepers of law.This is what idolization of documents gets you. At the very least update the phrasing to be more clear.

Thor A. Hopland<a href="https://snabelen.no/tags/MediaFuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#MediaFuzzing</a> is the tactic of overwhelming media with outright lies, bunk causes, statements and controversy in order to put the media and the general public into a state of disarray and confusion.<a href="https://snabelen.no/tags/Politics" class="mention hashtag" rel="nofollow noopener" target="_blank">#Politics</a> <a href="https://snabelen.no/tags/Trump" class="mention hashtag" rel="nofollow noopener" target="_blank">#Trump</a> <a href="https://snabelen.no/tags/Project2025" class="mention hashtag" rel="nofollow noopener" target="_blank">#Project2025</a> <a href="https://snabelen.no/tags/Media" class="mention hashtag" rel="nofollow noopener" target="_blank">#Media</a> <a href="https://snabelen.no/tags/fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuzzing</a> <a href="https://snabelen.no/tags/psyop" class="mention hashtag" rel="nofollow noopener" target="_blank">#psyop</a> <a href="https://snabelen.no/tags/democracy" class="mention hashtag" rel="nofollow noopener" target="_blank">#democracy</a> <a href="https://snabelen.no/tags/liberty" class="mention hashtag" rel="nofollow noopener" target="_blank">#liberty</a> <a href="https://snabelen.no/tags/unity" class="mention hashtag" rel="nofollow noopener" target="_blank">#unity</a>

Karol Mazurek🚀 New blog post! 🚀Deep dive into a <a href="https://infosec.exchange/tags/macOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#macOS</a> IONVMeFamily <a href="https://infosec.exchange/tags/driver" class="mention hashtag" rel="nofollow noopener" target="_blank">#driver</a> Denial of Service issue! It is not a security risk but a great case study for macOS driver analysis.🕵️‍♂️Enjoy! <a href="https://infosec.exchange/tags/RE" class="mention hashtag" rel="nofollow noopener" target="_blank">#RE</a> <a href="https://infosec.exchange/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vulnerability</a> <a href="https://infosec.exchange/tags/Research" class="mention hashtag" rel="nofollow noopener" target="_blank">#Research</a> <a href="https://infosec.exchange/tags/Kernel" class="mention hashtag" rel="nofollow noopener" target="_blank">#Kernel</a> <a href="https://infosec.exchange/tags/Fuzzing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fuzzing</a> <a href="https://infosec.exchange/tags/PoC" class="mention hashtag" rel="nofollow noopener" target="_blank">#PoC</a><a href="https://afine.com/case-study-analyzing-macos-ionvmefamily-driver-denial-of-service-issue/" rel="nofollow noopener" translate="no" target="_blank">https://afine.com/case-study-analyzing-macos-ionvmefamily-driver-denial-of-service-issue/</a>

Recent searches

Search options

Administered by:

Server stats:

#fuzzing