Brief SVG and Flash Fuzzing

We are just over a long weekend because of Easter bank holidays. It was an opportunity to do some kind of security experiments and I decided to improve my tiny fuzzers, and to run some brief tests with them.

Introduced SVG Fuzzing

I've been thinking about writing an SVG fuzzer for a long time, and now the time has come. It's only a few lines in source so far, and this one is written in C#. In my scenario, I don't think C is a good language to write fuzzer, and to write security testing tools in general. Despite this, I've got all of them written in C. It's time for change because I can see that it's much easier to expand C# program, so I might rewrite some of them. Anyway, the SVG fuzzer is mutation based. It currently supports to mix-up tags only, but has simple functionality to define the number of output files to generate, and the number of fuzzing rounds to apply on each sample. I have to look at the SVG specification and to inspect SVG files in more detail to find out more and more creative test cases.

I've got 130 template files that I currently use. I fuzzed them with the option to generate 1000 altered files from each input files, so all together I've got 130000 files.

The samples were generated to test browsers. When executed the test, Opera, with some exceptions, kept displaying a message "XML parsing failed" rather than showing up broken images. I thought it will pass all test cases because of bailing out early. That was not the case. I encountered some crashes but they all tried to access to memory address near null. At the moment, I don't know code execution is possible with those crashes but probably not. The first crash was at about sample number 1500 though.

When executed the test, Chrome and Firefox popped up JavaScript error messages on several occasions and the tests were stuck in until I manually closed the message boxes. It seemed that both browsers showed broken pictures rather than displaying error messages about failed parsing. None of them crashed though.

I had to disqualify Internet Explorer from the test because it kept popping up error messages, actually several and distinct error messages on all files nearly. I was able to suppress some of them by changing registry entries but still left a lot to resolve, and didn't immediately find a solution, so I consider resolving this in the future, probably in a generic way.

Fuzzing Flash Files

I have had about 5000 template samples, and targeted fuzzing control transfer instructions in a way to change the target addresses of the jumps. Generated about 300000 samples but didn't see Flash player crashing on any sample. Found a couple of infinite loops though.

Unconscious

This blog post highlights an interesting part of this factual video (available only in the UK). I'd highlight another part, from the end of the video, that I find also interesting.

One part of the video was about data overload, and how the brain filters the information we need. There was an experiment where satellite images taken of Afghanistan, to locate enemy hosts. But the images are so large and hunting through the pictures cannot be done with computers, and it's very monotonic and slow by doing it manually. In the experiment, the satellite images were randomly separated to hundreds of sub images. Few showed building that the the professor wanted to find. The professor got an EEG cap that monitored his brain activity on the certain part of the brain. He looked at the sample image containing the building and brain signals were recorded by EEG cap. The satellite images started flashing up on the screen, and the professor didn't immediately realize any buildings on them. They created a color map of the brain activity where, for example, the red meant something grabbed his attention. They matched the brain activity with the pictures. When they looked the corresponding picture to the red region, there were buildings on there.

I was smiling when saw this. Not because I don't believe it but on the contrary. Actually, I've been doing this with the exception that I don't wear EEG cap, and I don't look at satellite images. I look at hex dump or at interpreted machine code or at source code. These tend to be huge amount of information to look at by eye. I usually scroll through them quickly and I know that I might miss something but carry on anyway. I just don't know if my unconscious picks up something that I don't immediately realize but I have no reason to disbelieve this video.

One byte heap overflow

The following code snippet copies the content of source buffer to the destination buffer. Since the source buffer is one-byte-larger than the destination buffer it overflows the heap by one byte.

void main(void)
{
    char* pDest = new char[4];
    char pSrc[] = {"Bytes"};
    memcpy(pDest, pSrc, 5);
    delete pDest;
}

Let's see the source code again matching the blocks to their native counterparts.

void main(void)
{
 push        ebp
 mov         ebp,esp
 sub         esp,8
    char* pDest = new char[4];
 push        4
 call        dword ptr [__imp_operator new (10E209Ch)]
    char pSrc[] = {"Bytes"};
 mov         ecx,dword ptr [string "Bytes" (10E20F4h)]
 mov         dx,word ptr ds:[10E20F8h]
    memcpy(pDest, pSrc, 5);
 mov         dword ptr [eax],ecx ;Copy 4 bytes to destination buffer
 mov         cl,dl
    delete pDest;
 push        eax
 mov         word ptr [ebp-4],dx
 mov         byte ptr [eax+4],cl ;Copy the 5th byte out of destination buffer
 call        dword ptr [__imp_operator delete (10E20A4h)]
 add         esp,8
}
 xor         eax,eax
 mov         esp,ebp
 pop         ebp
 ret

In this example one byte overflow didn't lead to crash on my machine, and in reality, the error would have remained undetected. These errors can be detected by enabling full page heap verification by setting up global flags like below.

gflags /p /enable TestSilentCorrupt.exe /full

When you execute the program it now crashes when delete() is called.

It remains a question for me that the copy of 5th byte why it is associated in the block with delete() rather with memcpy().

Finding the appropriate ReadFile

There are applications reading data from numerous files when they're running. If you want to intercept when the certain file is being read, one possibility is to put breakpoint, let's say, on ReadFile() and wait for the debugger to break in. It happens that the debugger constantly breaks in on ReadFile() that you're not interested in. It can be extremely time consuming to ignore the unwanted debugger breaks until the certain file is being read.

This is a Windbg script that I usually use it as a template to intercept when a certain file is being read. It checks for specified value in the buffer of ReadFile(), and if the vaule matches the debugger can break in.

Fuzzing Control Transfer Instructions

Earlier last year, I wrote about my Flash fuzzer for example here and here.

This weekend I just added a little improvement to it. Since I was able to reach the byte codes of DoABC tag and to parse them, there is a lot of possibility to implement fuzzing opportunities by little changes.

What I did is the ability to alter control transfer instructions for ifeq, iffalse, ifge, ifgt, ifle, iflt, ifnge, ifngt, ifnle, ifnlt, ifne, ifstricteq, ifstrictne, iftrue, jump to change the target address of them. These instructions take only one operand that is fixed-length: 24-bit signed integer that is 3 bytes, so it was very straightforward to parse and change them.

One thing I wanted to pay attention that is the target of jumps should be within the region of the method but it was quick to implement this because the method addresses and sizes are already available from the parser info.

Unexpected Thickness of SplitContainer

I haven't really been involved in C# apart from spent the whole 2011 to reverse engineer MSIL code at work but that wasn't about programming; it was about to debug .NET code without using reference to source code, but in fact, none of real programming experience.

My role has been changed at work, and it's unlikely I will continue with .NET anyhow. This is a great opportunity for me to fill my freetime with C# programming - I find .NET interesting, have the (low-level) basics of the virtual machine after all, and people say it's (very) straightforward to get on with it at development point of view.

Here is the first impression involving SplitContainer.

I needed to split the screen into three panels. SplitContainer divides the display area into two panels, but when you use only one instance, you cannot really use it to divide the display area into three panels. I managed to use two SplitContainers to divide the display area into three panels. There is the main SplitContainer, and there is the secondary SplitContainer put on one panel of the main SplitContainer's. I had three panes and I thought that was it.

I set SplitterWidth to 1 on both of SplitContainers to narrow the thickness of the splitter. Launched the program to check if it looked as expected, but in reality, it didn't. Here is how it looked.

As you can see above that the splitter of the secondary SplitContainer was not as thick as the splitter of the main SplitContainer. It's interesting because, on the design view, it looked good.

I set SplitterWidth to 2 and checked the result but the thickness of the splitters have different sizes when started the program.

I set SplitterWidth to 4 and surprisingly the result looked good. The splitters, however, were too wide to use it in a program. You can see ot on the picture below.

The solution is as follows. I don't know the root cause of this but I realized if I set SplitterWidth to 1 in the constructor of the Form, the splitters' wide have the same size, as seen below.

Above experiences are with Microsoft Visual C# 2010 Express.