julihoh

Our first #ACSAC2023 paper #preview for today is Geretto et al.'s work on accelerating #hybrid #fuzzing by reducing the time spent in the SMT solver via trie-based query #scheduling. openconf.org/acsac2023/modu… @EliaGeretto @julihoh_ @c_giuffrida @herbertbos @EKouwe @kgleissen @vu5ec

@AndreaBancora I’m very glad it saved your work :) after all, this is exactly what I made it for! Cheers!

@julihoh_ I just found your code because I lost almost 4 hours of critical work. You absolutely saved my day (and my mental health). I can not thank you enough. This code should be shipped with every Mac. You should get a statue.

⚠️Attention macOS users! Ever lost PDF annotations when using Preview? It can be extremely frustrating to lose hours of work when providing feedback on a draft... Worry no more! My recovery tool just got a web app 🎉 julihoh.github.io/pdf_annotation… #webassembly #rustlang

@jbhuang0604 @dungnm1710 Just my 0,02€: Please don’t forget that creating an atmosphere where the student is comfortable with sharing „failed“ results is a precondition for any of this to work properly ❤️ the ability to tell the entire truth is paramount 💫

How to share your progress with your mentors/collaborators? Throughout your research project, 99% of the time your approach DOESN'T WORK (yet). 😬 How could we share these "failed results" and have productive conversations with your mentors/collaborators? 👇

.@Battlefield 2042 beta doesn’t run on my 7 y/o GPU due to „too old drivers“, which I can’t update due to AMD dropping support. Yet, one regedit.exe later, it plays just fine. I get it from an eng. perspective, but as a consumer: why this artificial block? #plannedobsolescence

@andreafioraldi This idea is 🔥initial results seem promising, I’ll keep you posted!

@julihoh_ a good strategy then is to process the entire corpus firstly with these tricks and then for a second run disable concretization

losing my mind over hybrid fuzzing... just introduced a bug that consistently gave me 4-5% more coverage. WTF? seems like rand() (more or less) is a great strategy to choose which bytes to symbolize in the input...

@GHSecurityLab @mboehme_ What’s @vu5ec doing right up there with the big companies? Genuinely curious…

We spoke with maintainers about their experience interacting with the security research community and engaging in the vulnerability disclosure processes. Check out what they shared and we learned! github.co/2X71ZtK

I put quite a bit of effort into documentation! Check the article for links. I'd love to see other people start using it - it should be quite usable and I'm personally excited about what's possible using it! (including my own thesis :))) )

Also: I didn't have the time to create more technical write-ups yet. There are some suggestions in the blog post, so let me know if you are particularly interested in one of them!

GSoC 21 is over and I took some to summarise the past 10 weeks and reflect a bit julihoh.github.io/2021/08/19/gso… . Finally meaningfully contributing to Open Source was inspiring & I hope it won't stop :) Cheers to @domenuk and @andreafioraldi for being awesome mentors!

More information about hybrid fuzzing by @julihoh_ here: github.com/AFLplusplus/Li…

Based on SymCC with Rust bindings for custom runtimes (for custom constraint filtering etc...)

@jzvw @domenuk There is still a bunch of documentation coming. I also want create something like a write-up as part of my duties for GSoC, so stay tuned! :)

@domenuk Is there a writeup available on how fuzzing/concolic analysis work together? Sounds promising.

LibAFL now supoprt concolic execution, thanks to our #GSOC student Julius github.com/AFLplusplus/Li…

@domenuk finally created a real twitter account, just to retweet this :)