Introduction

fuzz light year (flyr) is a block-based software vulnerability fuzzing framework. It provides a engine that generates fuzzed datasets from user-defined data models (JSON files). flyr data models are made up of three categories - outputs, blocks, and mutations. outputs define the output method (file out, TCP stream, etc.). Blocks are individual data members of a specific class and type that are used to build the template data buffer. Currently, there are three classes of blocks - numbers, lengths, and hex strings. Numbers and hex strings are simply user-defined types of data that are written to the template buffer. Lengths are reserved fields that are fixed up after the template buffer is built. Blocks of all types can be assigned one or more length fields that are fixed up after the template buffer is built. Mutations define the method used to modify the template data to create fuzzed inputs.

flyr is under rapid development. In its current state it is capable of building fuzzed datasets for file format fuzzing. The end goal is a feature rich framework encompassing the mutation engine, a frontend GUI, and crash harnesses for both Windows and Linux.

Getting Started

To dive right in checkout the examples/ directory which contains a flyr-compatible JSON fuzzing model capable of generating mutated Pcap files containing a DHCP packet. After building flyr, simply run the following command:

$ ./build/release/flyr -f ./examples/pcap.json
* Loading flyr file and validating the JSON schema
* examples/pcap.json (Pcap Fuzzing Model) loaded successfully!
* Applying build actions...
*   -- magic_number
*   -- version_major
*   -- version_minor
*   -- thiszone
*   -- sigfigs
*   -- snaplen
*   -- network
*   -- ts_sec
*   -- ts_usec
*   -- incl_len
*   -- orig_len
*   -- eth_dst
*   -- eth_src
*   -- eth_type
*   -- ip_tos
*   -- ip_diff_services
*   -- ip_tot_len
*   -- ip_id
*   -- ip_frag_off
*   -- ip_ttl
*   -- ip_protocol
*   -- ip_check
*   -- ip_saddr
*   -- ip_daddr
*   -- udp_header_and_payload
* Processing mutations...
* Done.

This will generate multiple mutated Pcap files with a name of *-lolwut.pcap ready to be fed to a Pcap parsing software application.

Programming Guide

Below is documentation on flyr engine supported outputs, blocks, and mutations that can be included in flyr JSON files. Note that JSON is a very picky file format. The file will fail to load if a comma is misplaced or the file does not contain valid JSON formatted data. flyr uses the parson C JSON parsing library. parson supports C-style comments. Users are encouraged to add comments to flyr fuzz files. Flyr fuzz files should start with the template below:

{
	"name" : "Descriptive Name Goes Here",

	/* Output method for generated fuzzed inputs */
    "output" : {
    },


    /* Individual members for building the template data buffer */
    "blocks" : {
    },


    /* Methods for mutation the template data buffer to create fuzzed inputs */
    "mutations" : {
    }
}

Reference ./examples/pcap.json for an example flyr data model.

Output

Output method for generated fuzzed inputs.

file-out

Generates and writes fuzzed datasets to files in the specified directory.

Required Arguments

Example

"output" : {
    "method" : "file-out",
    "directory-path" : "./",
    "name-suffix" : "lolwut.pcap"
},

Blocks

Individual data members of a specific class and type that are used to build the template data buffer

Numbers

Write a number to the dataset of specified size and endianess.

Required Arguments
Optional Arguments

Classes

Example
"ip_daddr" : {
	"class" : "number",
	"type" : "dword",
	"value" : "0xffffffff",
	"length-blocks" : [
        "ip_tot_len"
    ]
},

Lengths

Length blocks (such as a IP header tot_len member) that are fixed up after the dataset is built.

Required Arguments

Optional Arguments

Types

Example

"ip_tot_len" : {
	"class" : "length",
	"type" : "word",
	"endianess" : "little",
	"length-blocks" : [
        "ip_tot_len"
    ]
},

Hex

Raw hex string to be converted to bytes and written to the dataset.

Required Arguments

Optional Arguments

Example

    	"aaaaaaa" : {
    		"class" : "hex",
    		"value" : "41414141414141414141414141414141",
    	    "length-blocks" : [
                "ip_tot_len"
            ]
    	}

Mutations

Methods for mutation the template data buffer to create fuzzed inputs.

Actions

Types of data mutation.

bitflip

Iterate through a specified range flipping a single bit at a time in the generated fuzzed input.

Required Arguments