In this post, I will introduce fpicker. Fpicker is a Frida-based
coverage-guided, mostly in-process, blackbox fuzzing suite. Its most significant
feature is the AFL++ proxy mode which enables blackbox in-process fuzzing with
AFL++ on platforms supported by Frida. In practice, this means that fpicker
enables fuzzing binary-only targets with AFL++ on potentially any system that is
supported by Frida. For example, it allows fuzzing a user-space application on
the iOS operating system, such as the Bluetooth daemon bluetoothd – which was
part of the original motivation to implement fpicker.
I was at the hack.lu conference in Luxembourg this year and attended the fuzzing
workshop, held by René Freingruber from
SEC Consult. I have been curious about this topic
for some years now, but besides doing some manual fuzzing and web-fuzzing, I
never looked into the whole topic that much.
The workshop lasted for around four hours. Before the workshop started each
student got two VMs (Linux/Windows) where everything necessary was already set
up. The VMs included 23 exercises, with step-by-step explanations, source code
and exploits. René started out with an introduction to fuzzing, listing popular
fuzzers and showing an example on how to fuzz with
afl.