对 Linux 内核进行模糊测试：一名处于危险之中的学生。
我目前是一名正在大学攻读计算机相关学位的学生，我当前的项目重点是查找 Linux 内核中的漏洞。我的目标是对内核（针对 3.0 版本）进行静态审计和“模糊测试”，以尝试找到漏洞。
我的第一个问题是“简单”，对 Linux 内核进行模糊测试可能吗？我听说有人对大量协议等进行模糊测试，但对内核模块的了解却很少。我还了解到，在 Linux 系统上，所有内容都可以被视为文件，因此肯定可以通过该接口输入内核模块，不是吗？
我的第二个问题是：您会建议使用哪种模糊器？如前所述，存在许多模糊协议的模糊器，但是我认为在攻击内核模块时，其中很多都没有什么用处。显然，有一些框架，例如 Peach fuzzer，它允许您从头开始“创建”自己的模糊器，并且据说非常出色，但是我多次尝试安装 Peach 但无济于事，我发现很难相信它是合适的考虑到我在安装它时已经遇到的困难（如果有人知道任何像样的安装教程，请告诉我：P）。
如果您能够向我提供有关此问题的任何信息，我将不胜感激。鉴于我选择的主题的广度，任何方向的想法总是受到高度赞赏。同样，我想请人们不要告诉我从其他地方开始。我确实了解手头任务的规模，但无论如何我仍然会尝试它（我是一个蓝天思想家：P AKA 顽固如牛）
干杯
A.Smith
I am currently a student at a university studying a computing related degree and my current project is focusing on finding vulnerabilities in the Linux kernel. My aim is to both statically audit as well as 'fuzz' the kernel (targeting version 3.0) in an attempt to find a vulnerability.
My first question is 'simple' is fuzzing the Linux kernel possible? I have heard of people fuzzing plenty of protocols etc. but never much about kernel modules. I also understand that on a Linux system everything can be seen as a file and as such surely input to the kernel modules should be possible via that interface shouldn't it?
My second question is: which fuzzer would you suggest? As previously stated lots of fuzzers exist that fuzz protocols however I don't see many of these being useful when attacking a kernel module. Obviously there are frameworks such as the Peach fuzzer which allows you to 'create' your own fuzzer from the ground up and are supposedly excellent however I have tried repeatedly to install Peach to no avail and I'm finding it difficult to believe it is suitable given the difficulty I've already experienced just installing it (if anyone knows of any decent installation tutorials please let me know :P).
I would appreciate any information you are able to provide me with this problem. Given the breadth of the topic I have chosen, any idea of a direction is always greatly appreciated. Equally, I would like to ask people to refrain from telling me to start elsewhere. I do understand the size of the task at hand however I will still attempt it regardless (I'm a blue-sky thinker :P A.K.A stubborn as an Ox)
Cheers
A.Smith
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我认为一个很好的起点是扩展 Dave Jones 的 Linux 内核模糊器 Trinity： http://codemonkey.org.uk/2010/12/15/system-call-fuzzing-continued/ 和 http://codemonkey.org.uk/2010/11/09/system- call-abuse/
每当 Dave 进一步扩展时，他似乎都会发现更多错误。基本思想是查看您正在模糊测试的系统调用，而不是传递完全随机的垃圾，而是让您的模糊器选择至少会通过实际系统调用代码中的基本健全性检查的随机垃圾。换句话说，您使用内核源代码让您的模糊器比完全随机输入通常更深入地进行系统调用。
I think a good starting point would be to extend Dave Jones's Linux kernel fuzzer, Trinity: http://codemonkey.org.uk/2010/12/15/system-call-fuzzing-continued/ and http://codemonkey.org.uk/2010/11/09/system-call-abuse/
Dave seems to find more bugs whenever he extends that a bit more. The basic idea is to look at the system calls you are fuzzing, and rather than passing in totally random junk, make your fuzzer choose random junk that will at least pass the basic sanity checks in the actual system call code. In other words, you use the kernel source to let your fuzzer get further into the system calls than totally random input would usually go.
“模糊化”内核是描述目标的一种相当广泛的方式。
从内核的角度来看，您可以
不确定您想要实现什么。
模糊系统调用意味着检查每个 Linux 系统调用 (http://linux.die.net/man/2/syscalls)，并尝试是否可以通过奇数参数值干扰正常工作。
模糊字符或块驱动程序意味着尝试通过 /dev 接口发送数据，最终会产生奇怪的结果。
此外，您还必须区分非特权用户和根用户的尝试。
我的建议是将你的尝试范围缩小到你的主张的一个子集。这实在是太宽泛了。
祝你好运 -
亚历克斯.
"Fuzzing" the kernel is quite a broad way to describe your goals.
From a kernel point of view you can
Not sure what you want to achieve.
Fuzzing the system calls would mean checking out every Linux system call (http://linux.die.net/man/2/syscalls) and try if you can disturb regular work by odd parameter values.
Fuzzing character- or block-drivers would mean trying to send data via the /dev-interfaces in a way which would end up in odd result.
Also you have to differentiate between attempts by an unprivileged user and by root.
My suggestion is narrowing down your attempts to a subset of your proposition. It's just too damn broad.
Good luck -
Alex.
模糊测试的一种方法是通过系统调用模糊测试。
本质上，这个想法是采用系统调用，在整个可能值范围内对输入进行模糊测试 - 是否保持在为系统调用定义的规范内并不重要。
One way to fuzzing is via system call fuzzing.
Essentially the idea is to take the system call, fuzz the input over the entire range of possible values - whether it remain within the specification defined for the system call does not matter.