stevenjohnstone

This demos how memcpy can go badly wrong when used to remove an element of an array by shifting content left.

#include <assert.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

stevenjohnstone

Use this configuration file
```
{
  "name": "Royal Kludge R65",
  "vendorId": "0x342d",
  "productId": "0xe481",
  "keycodes": ["qmk_lighting"],
  "menus": [
    {
      "label": "Lighting",

stevenjohnstone

// https://roadrunnerwmc.github.io/blog/2020/05/08/nsmb-rng.html takes about 10 seconds to find
// a fixed point for the random number generator

#include <assert.h>
#include <stdio.h>
#include <stdint.h>

uint32_t rand_nsmb(uint32_t *state) {
    uint64_t value = (uint64_t)(*state) * 1664525 + 1013904223;
    return *state = value + (value >> 32);

stevenjohnstone

(set-logic QF_BV)

; Quicker way to find fixpoints in the rng discussed in
; https://roadrunnerwmc.github.io/blog/2020/05/08/nsmb-rng.html .
;
; On my machine (AMD Ryzen 5 3550H with 8G RAM), running this with z3
; finds a fixedpoint in about 80 seconds

; Here's the code we'll be  modelling:
;

stevenjohnstone

// +build gofuzz

// Package antifuzz shows how gofuzz transformation of inputs breaks coverage guidance.
//
// When running "go-fuzz -func FuzzGood", a crasher is found almost immediately. In contrast,
// when running "go-fuzz -func FuzzBad" no crasher is found and it likely won't for a long time.
package antifuzz

import fuzz "github.com/google/gofuzz"

stevenjohnstone

{
  "meta": {
    "theme": "modern-classic"
  },
  "basics": {
    "name": "Steven Johnstone",
    "label": "Security Engineering Leader | Founder",
    "email": "[email protected]",
    "summary": "Seasoned Security Engineer and Founder with 15+ years of experience protecting critical national infrastructure, building security-first products, and driving compliance. A true builder who combines strategic experience with deep, hands-on engineering skills (Golang, C/C++, Assembly). Proven track record of founding startups, coding core systems, and securing successful exits to Cisco, Motorola, and Fortinet.",
    "location": {

stevenjohnstone

// Using the approach of afl-python to make a
// Lua fuzzer.
// Build with "gcc -I/usr/include/lua5.3/ -L/usr/local/lib -llua5.3 -rdynamic afl-fuzz.c"
// (or whatever works on your platform).
//
// Write a script which has a global function "fuzz" which reads all of stdin and processes it
// to exercise some code in which you'd like to find logic bugs.

#include <assert.h>
#include <fcntl.h>

stevenjohnstone

#!/usr/bin/env python
# coding: utf-8
import angr
import archinfo
import claripy
import time


def main():
    p = angr.Project('ctf')

stevenjohnstone

#include <assert.h>
#include <dlfcn.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <stdint.h>

// Background reading: http://tukan.farm/2017/07/08/tcache/

const size_t msize = 0x100;

stevenjohnstone

#include <stdlib.h>
#include <string.h>

int main(int argc, const char **argv) {
    char *foo = getenv("foo");
    if (strcmp(foo, "bar") == 0) {
        return 0;
    }
    return 1;
}