I am not sure how you are distinguishing my theoretical protocol agnostic fuzzer from afl. Is afl a jpg/png specific fuzzer? One of the things that is great about afl is that it is not targeted towards a specific file format it can work with a small corpus or thorough dictionary of the target format. eg I can give afl-fuzz a snippet of two of markdown and it will go nuts or if I want to be exhaustive I can feed afl the afl "dictionary" from the commonmark testsuite.
How do you ever eliminate false positives when fuzzing? And what constitutes a false positive?
having only read about the usage and successes of AFL, I'm curious what you would "feed" this network protocol debugger. a grammar file (something like BinPAC++ [0]) or something else entirely?
Comments
I am not sure how you are distinguishing my theoretical protocol agnostic fuzzer from afl. Is afl a jpg/png specific fuzzer? One of the things that is great about afl is that it is not targeted towards a specific file format it can work with a small corpus or thorough dictionary of the target format. eg I can give afl-fuzz a snippet of two of markdown and it will go nuts or if I want to be exhaustive I can feed afl the afl "dictionary" from the commonmark testsuite.
How do you ever eliminate false positives when fuzzing? And what constitutes a false positive?
having only read about the usage and successes of AFL, I'm curious what you would "feed" this network protocol debugger. a grammar file (something like BinPAC++ [0]) or something else entirely?
[0] http://www.icir.org/hilti/binpac/intro.html
A PCAP file of captured traffic?