stevenjohnstone

#include <stdio.h>

static int x3(int a, int b) {

    int out;
    asm(
        // it's not stated in xchg rax,rax but it's
        // intel syntax. Note the noprefix means we
        // don't need % before registers
        ".intel_syntax noprefix;"

stevenjohnstone

(set-logic QF_BV)

; Convention here is add a label to the end of the register
; to mark a step in the program for which the value applies.
; e.g.
; rdx0 is the first value of rdx, rdx1 is the value at the
; next step of the program, rdxN is the value at the Nth
; step.
;
; Essentially, we're turning an assembly program into SSA form

stevenjohnstone

package main

import (
	"fmt"

	// a branch of keystone golang bindings which builds on linux
	"github.com/stevenjohnstone/keystone/bindings/go/keystone"
	uc "github.com/unicorn-engine/unicorn/bindings/go/unicorn"
)

stevenjohnstone

#!/usr/bin/env python
# coding: utf-8
import angr
import archinfo
import claripy
import time


def main():
    p = angr.Project('ctf')

stevenjohnstone

#include <stdlib.h>
#include <string.h>

int main(int argc, const char **argv) {
    char *foo = getenv("foo");
    if (strcmp(foo, "bar") == 0) {
        return 0;
    }
    return 1;
}

stevenjohnstone

#include <assert.h>
#include <dlfcn.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <stdint.h>

// Background reading: http://tukan.farm/2017/07/08/tcache/

const size_t msize = 0x100;

stevenjohnstone

#!/usr/bin/env python
# coding: utf-8
import angr
import archinfo
import claripy
import time


def main():
    p = angr.Project('ctf')

stevenjohnstone

// Using the approach of afl-python to make a
// Lua fuzzer.
// Build with "gcc -I/usr/include/lua5.3/ -L/usr/local/lib -llua5.3 -rdynamic afl-fuzz.c"
// (or whatever works on your platform).
//
// Write a script which has a global function "fuzz" which reads all of stdin and processes it
// to exercise some code in which you'd like to find logic bugs.

#include <assert.h>
#include <fcntl.h>

stevenjohnstone

{
    "meta": {
        "theme": "paper-plus-plus"
    },
    "basics": {
        "name": "Steven Johnstone",
        "label": "Software Engineer with Strong Security Focus",
        "email": "[email protected]",
        "summary": "I like to break things and help fix them",
        "location": {

stevenjohnstone

// +build gofuzz

// Package antifuzz shows how gofuzz transformation of inputs breaks coverage guidance.
//
// When running "go-fuzz -func FuzzGood", a crasher is found almost immediately. In contrast,
// when running "go-fuzz -func FuzzBad" no crasher is found and it likely won't for a long time.
package antifuzz

import fuzz "github.com/google/gofuzz"