Post-crash core dump triaging
Not all crashes are equal and not all crashes are exploitable. So, how do we proceed when AFL outputs a crash? We are going to show how to triage a crash in an older version of the Linux kernel, compatible with older CVEs.
We will reuse the original crash from the TriforceAFL kernel so that it will be easier to examine crashes.
In order to prepare the environment, we need to install a few utilities. One of the most useful tools is gdb, the Linux debugger. The process of analyzing a crash is similar to debugging a program using gdb, which is the standard debugger for Linux and can be used with a core dump.
Our Triforce image, besides the original test cases, also contains their core dumps, so we can go and check them.
Our Docker image comes with gdb, the most important thing is to have a kernel with symbols. Here, we show the crash exercise. The runTest script leverages runFuzz. Hence, it keeps the same system configuration and allows us to...
