[Music]
hi guys okay let's go
[Music]
so what am I going to talk about this is
just a warning so you can get out now in
case it doesn't interest you anyway
I have a strong desire to find security
bugs well because it's fun and sometimes
it pays the bills
I think it's even better if you can find
him while you're sleeping which means
doing some fuzzing normally
[Music]
I'm gonna go through a series of
problems I encountered when I was
attempting to First in this case Adobe
Reader
hopefully
good Solutions and if they're not good
someone else can give me better
Solutions and then well basically it's a
step-by-step guide on how you
can find the security bugs and stuff
so if we look at fuzzing as a whole
there are some things you must have when
you want to do a fuzzing campaign right
you need some sort of input generation
to be fit to something which passes the
input that input Generation Well the
input you generate has to be
conformant to Any Given standard that
the parser
that the parser expects you want to
a little bit closer better
better now
fantastic okay
you need an input delivery mechanism
where you can feed the input there's an
end on my computer uh
um we need an input delivery mechanism
where you can feed
the generated input to your Target and
you want to execute your target as fast
as possible because more executions
means more test cases executed and so on
and so on and so on you need a mechanism
for fault detection so that you know if
your generated input has caused a fault
so you can do crazy duplication and
similar things and fault analysis of
course
so
when we look at
the current state of the art inversing
and that of course means something like
AFL
it's fantastic but it also takes work
and it's actually it quickly becomes
complicated at least if you want to do
things
um
let's say as good as possible right so
one of the problems well not problem as
such but one of the challenges is that
modern fuzzing has evolved into
something extremely complex so there's
there's been in the later years there's
been almost like a
a revolution in how will forces perform
and if you're not doing it the right way
maybe it should
but it doesn't have to be like that
because bugs are so plentiful that
they're still room for doing it
just good enough right you don't have to
do
input tracing and hit tracing and
function coverage and feedback
reinforcing and all that stuff which is
amazing but also complicated and this is
what I refer to when I mean Park hunting
for normal people because you don't have
to
be God's gift to computers or Ellen
during to uh to be able to write for us
to find bugs in actual contemporary
software you can just
start symbol and then just sort of make
it up as you go and see where it takes
you
so for Adobe Reader
um the first problem you'll encounter is
that once back in the day it was enough
to just download random PDF files off
the internet
and just do some random mutations in
them and do some bit flipping and
whatever insert weird strings and that
would be enough to find exploitable
vulnerabilities where you
the smash your function pointer or
something else which could be
sort of trivial to exploit
um
Excuse excuse me
this is no longer the case if you look
at checkpoint research they made a
a pretty good post called I think it was
50 bucks in 50 days or something where
they
um
they first a lot of the Adobe Reader
binary content passes using I think it
was winning the excellent article but
that sort of also
took away well it took away at least 50
of the bugs in Adobe Reader right which
is bad for
us who else the rest of us who wants to
find bugs in it
um so the solution for that problem is
to
take a step back and find out what else
you can attack which is not the binary
passes that checkpoint has referred to
death and I figured maybe we can just
find uh unflippable functionality in the
software meaning that I can't just bit
flip my way to a memory corruption and
go woohoo money right so instead of
looking at that you can look at the PDF
spec it's very long and not super
interesting but it
it gives you an idea of what the formal
action supports and in this case it's
JavaScript so it's been supporting
JavaScript since around Y2K and you
cannot just
build flip JavaScript and find good
boards well you can find some but but
nothing
the amount of compute Cycles you need to
do to just do blind mutation
on JavaScript and hope to find boxes
through the roof I mean it is possible
I've done it but it is it's also a waste
of cycles and pretty stupid
so when we look at versing a very
important part of it is the input
generation right
and I only have a limited idea on how to
make smart evil input it's pretty easy
when it's binding forward because you
can just
flip bits and brute force your way to a
solution right but in a textual context
it's not very easy to to make smart evil
input
but some smart people in this case the
guys from Mozilla I think released some
free tools with a proven track record in
this case Dharma from Mozilla tomato is
from one of the guys at Google and
redempts is from some Finnish guy for
this one I settled on Dharma which is a
generation based currency extreme
grandmother and you can also use tomato
if you're so inclined but I had used
Dharma before for something else so it
was natural to settle on this
and what is a generation based context
for your grandma first it sounds
complicated but it's actually
not because this is
a grammar file I made for them just a
for armor just a symbol grammar and as
you can see here I instructed to
generate
output output must consist of either
first one or second one it's going to
pick one at random
first one
when we look at this consists of the
string first one and then something
which will be expanded in this case a
parameter and a parameter and a
parameter and then maybe with two
parameters or with one or with none and
second one is the same right and then
parameter pulls from the standard
library inside Dharma where it can put
in a Boolean a digit integers
all that stuff so you don't need to come
up with what could be bad data right the
the framework will handle that for you
so you basically just describe the
constraints free output in the in the
grammar file and download will Generate
random but well-formed input provided
you make it well from grammar files
right
boom yes so this is what the grammar
will output so we can see that it first
iteration it just picked the thing
called first one with no parameters and
second one so subsequent
uh executions of the person will just
keep generating
well-formed but
malformed data if that makes sense so
malicious in some sense right
cool thing about Dharma it's written in
Python
the standard library of edge cases is
fairly extensive so it covers all the
well it covers integer overflows and all
the edge case integers around where if
you increase by one it goes negative and
all that stuff it's easy to extend the
grammar as well so you can just put in
something like this where you go
overflow and then repeat so this is like
a macro which will expand
and if you I mean it's really easy to
modify the generators which means that
you can put in your own secret sauce so
even if you happen to write a grammar
file which is exactly identical to the
guy next to you if you extended some of
the Badness Library you have a chance of
finding bugs that that he won't find
right
uh
you can steal the bad string library
from something like Boo first which I
and I think that one stole most of it
from Spike back in the day
well first is the continuation of Sully
which stole the strings from the back
anyway
it's a good idea to ensure that this
generated data is valid and monitor the
output for syntax errors because
as you can see in the bottom here I've
generated some some data
which is not valid and this means that
the password will actually
[Music]
um
it'll bail out because you cannot catch
the you cannot catch syntax errors so
you can catch
uh let's say violent found exceptions
and other things but you cannot catch
syntheters so you have to make sure that
it's syntactically valid to show that
it's not
being rejected by the initial passing
mechanism which does some magic before
it's executed right
next problem you're going to encounter
is that Dharma and tomato they don't
in themselves know anything about PDF
specific things so you have to make all
the PDF stuff yourself right and if you
say well I'll just
use the standout grammar and first the
JavaScript engine well it's a waste of
time in the Adobe Reader case because
it's spider monkey which is the
JavaScript engine from Mozilla
and it has been since
maybe it started with the reader DC I
don't know but it's it's been like that
for quite a while it's of course a
heavily modified spider monkey because
all the PDF is
specific JavaScript things I bolted on
by Adobe
um
afterwards and you can
maybe if you follow the spider monkey
bar trigger maybe you can find when they
fix a bug it's most likely not going to
be
fixed in the version that adobe has
imported at least not instantly so
there's there's quite a bit of latency
period there where you you can score
some quick wins maybe
um
so
it's just a matter of finding something
PDF related and JavaScript from the
JavaScript reference write a grammar
file and Away you go
if you look at the PDF JavaScript
reference it's
it's been updated it was updated in 21
after maybe 10 years of nothing right
it's actually pretty well sorted into uh
the overall API and the properties and
methods so you can focus on complex or
interactive parts and you can actually
just
browse the table of contents as I do
here and see that The annotation object
has a bunch of properties and then you
go a bit down and you see that it also
has methods
so maybe that's an easy target to pick
it well I know it is
then we come to the lies the computer is
lying as usual all the document is lying
because if you dump the search object
from
within the JavaScript console in Adobe
Reader you will see that
uh yeah okay I dumped the search object
and then when you compare it to the
actual documentation and the search
methods according to the Dockers add
index get index query and remove index
but when you dump the object itself live
you will see that there's a method
called get index as well and there's
also an undocumented property
why is that good well it's good because
it's either really old code which is
supposed to go away and it's not no
longer maintained and no longer kept in
the table of contents or its new stuff
which may mean that since it's let's say
undocumented it may be a good area to
find
unboxing since nobody knows it exists
right I've definitely found bugs in
Adobe Reader where the documentation
didn't mention any uh there were no
references to some API it had but but it
still worked right
so if we go back to the Dharma stuff and
look at The annotation properties
and also here the alignment attachment
AP blah blah all that stuff
you just Define a grammar where you say
the error properties can be known
it's just
this is the I would say this is one of
the easiest ways of finding bugs
actually because you just have to
sit and transcribe the documentation
from the JavaScript reference into a
grammar file that darma can understand
and then it's going to start generating
malicious input that you can read and
then bugs are gonna
rain so it's pretty easy and it's pretty
fun
if you look at what the output from
Dharma is for The annotation properties
it's going to look like this where well
for the set properties
so it's going to sit a bunch of weird in
this case still a bunch of weird
properties do something with State
models and maybe it's gonna
change a logo and then call a function
and then something bad is going to
happen eventually
so this is this output is well formed
but nonsense right
so next problem you're going to
encounter sadly is that uh
Adobe Reader is now
it's no longer just something which
passes and does stuff since reader DC
it's split up
uh with the standard renderer and broker
model so the renderer is sandboxed and
asks the broker process if it's allowed
to do search inserts and such but but it
also means that
there's multiple processes that talk IPC
and PDF surrendered in tabs and so on
and so on and so on so you can't just
start it twice and say you run this
input and you run that input and if you
guys should save it
a pretty easy solution is to First on OS
X instead
because that one doesn't have a problem
with spawning 20 simultaneous Adobe
readers because well posix I guess
or just use Virtual machines for
isolation and scaling it's super
primitive but it's also cheap
if you need to
um
if you wanna
make it so that you can run it over
reader multiple times in the same
Windows instance I mean you need to
reverse it and find someone who knows
what they're doing to to sort of give
away the cannot run twice logic it's not
worth it because Hardware is cheap and
if you find a solution to make it run
twice
it's going to get updated and you'll
need to reapply that solution with
different offsets or whatever it's a
nightmare and it's not not worth it
the next problem when you start an
application there's a bunch of work
being done in loading libraries and
other boring disk IO so I was thinking
maybe you can just rip out the
JavaScript engine and first that one
turns out it's extremely complicated
it's not like there's a javascript.tll
which exports a function called pass
JavaScript right sadly so extremely
complicated and I I wanted something
simple not a six month conversion
project so
solution is to we'll just
no solution right now
so what I ended up with is start the
application only once and then just
instrument the GUI
to avoid restarting the application the
good part about that is that you have
you have a live PDF document with the
with a Dom that you can interact with so
you're all of a sudden it don't know me
that with this you're you're not
you're not forcing the JavaScript
parsing you're actually forcing the the
Dom itself which is a lot more useful
because that's where all the well all
the Dom interactions are what's going to
lead to you so if the reason all that
stuff
um
and then
I mean yes it is cheesy but it works
well with just two periodic housekeeping
restarts so fire off a thousand test
cases restart the application and and
done right
so how do you get the console well you
make your own console.pdf DDA Stevens
has made a few PDF tools including one
which can make a PDF which contains
JavaScript that will be executed when
you open it and then as the script you
just put in this console.go so you can
pop an interactive JavaScript console
from the regular reader and not just the
professional version which you normally
need to do JavaScript development
and this also works for foxit
in the case of Adobe Reader there's this
Acro help object you can pass as an
argument
it I think they've stopped maintaining
it because it works for some things and
then it also definitely doesn't work for
a lot of things
so the next problem is that you have the
input and you know where to put it so
you can get rid of the startup overhead
but how do you get it there do you sit
and copy paste the input you generated
no you do not you just use Pi One auto
and Paperclip
uh
it has it
doing doing it like this where you
generate the the
the input externally has a distinct
advantage over in Tom version because
you have a precise log of all the Dom
manipulations you attempt to perform
I made another photo where I just do
stuff
a bunch of JavaScript sticking in
executed where it does Dumb
manipulations and the problem is that
that when something goes wrong
you don't really know what went wrong
because logging is hard so I made a
really this is the worst thing I've ever
done I think I as a log function I
tried to read a file where I get a
permission denied but but it's still
gonna it's still gonna lock the input so
let's say my input is and here then I'm
gonna try to read a file called blur
right and
it's going to feel but it's still gonna
show up in something like um pragmon so
I can just do API monitoring and see
that it
gets access denied by trying to read
this file but I still have the log of
the stuff that I fit into it right so
that's a way of doing
first logging inside the Dom but but
it's
it's a nightmare it's definitely trash
and it's also easy when you do the Dom
manipulations from inside the Dom to end
up in a situation where
when your father lives in the dorm your
father can do a manipulation which
destroys your fusser right because then
all of a sudden rain is no longer a
function because you've destroyed it
with your fossil so ah not very good
uh so for the Google automation pyburn
Auto fantastic you can ride some python
code you can attach to Pioneers you can
find the dialogues you need and just
make it click all the buttons and do all
the things
if you spawn it with piwin also
it prevents easy debugging but
the solution is just to
don't spawn it with pyramid also you can
just attach afterwards with the Power
Note application connect right
uh
the next problem
you're going to have and
this is something you can only
this is something you can only find once
you've found your first crash right
because if everything is working as
intended uh well and and the program is
not crashing then you'll never encounter
these weird error dialogues right but
then once you've found your first crash
and your father says we'll continue it's
just gonna stall so you need some some
handling of error dialogues as well
in the function reader case
that's fun because if you feed a bunch
of script script script it's going to
pop up this
um
there's enter no more than 256
characters dialogue but you can still
keep feeding script to the console and
it's just gonna get cute and then when
you click OK the next 200 lines of
script are going to get executed so that
makes it really weird and something you
need to to handle
[Music]
specifically I just patched out the call
to the message box in this case because
otherwise it it was impossible to find
out what part of the script actually
caused the questions in foxid
um
yes next problem pywin also
Windows GUI automation starts working
after a while I don't know if some
handles are leaking or something
just reboot the machine and it's a lot I
mean
rebooting wastes
15 seconds of your first thing runtime
and trying to investigate why it it
feels well that you can always taste on
it right and maybe you can't even do
anything about it uh
if you use the 64-bit pipe and also for
32-bit apps
you're gonna have the problems arise
more often uh
but
you no longer need to maintain two
different python installations because
the recent acrobat will I no longer need
to maintain two different because the
reason the acrobat is now 64-bit finally
woohoo
uh next problem with acrobat the
JavaScript console is the worst
JavaScript console you will ever try in
your life there's a maximum of 3200
lines of script but the solution is to
just generate your input in chunks and
just feed it a thousand lines at a time
and this
this doubles as an easy fault indicator
as well and what I mean by that I mean
that if I cannot feed the data through
the dialog
my chunk of data then something uh bad
has happened and I can act accordingly I
know that well something bad happened
so your next problem once you start
finding crashes uh well Pi dbg hasn't
worked for quite a while and wouldn't
have dvg is a pain in the ass
a lot of things
well running Adobe Reader under a
debugger
while you're fussing it is also a
complete waste of time
um
and my solution to this was uh just
don't do it because when you look at the
way it works when I do the sequential
input feeding I feed this data and then
eventually the app graduates I'm no
longer able to
feed the data so I know it is correct
and then I can just save that data right
so there's no need to do this
Advanced uh fault detection
at runtime using a debugger
if you're so inclined you can also catch
faults with mini terms but in in this
case it's not needed because if you
cannot feed the script you know that
something's up and then
you have a solution right
um next problem well something you're
going to find out when you wanna
combine the sequence of of data into
something that can reproduce the crash
is that the disk IO well I use turquoin
super slow with the exig overhead so you
as you can see it takes like seven and a
half seconds to concatenate a few files
do it in Python it takes
0.06 seconds instead
so
in this particular case any solution
would also just be to the data that you
generate if you save it in decent file
names you won't need to do this terrible
patch Loop and then you can just get all
the files into one
but this is something you're only going
to find out once you actually start
working on it and find out where where
the Hang-Ups are in your in your queue
next problem
you have a crash uh what is it can I
sell it can I use it what can I do with
it
it's super hard and complicated and
takes time and actual work but
you can use skylines bug ID for
automatic triage of the walls so if
anybody remembers there was this wind
DPG plugin called Bing exploitable
[Music]
I'd I'd say this is being exploitable on
steroids times a lot because this
is actually very useful uh it generates
beautiful HTML reports and comes with
some page Heap script so you can enable
page heave for your app or it has a
bunch of defaults as well free for test
runs you have to pay if you want to use
it to make money
if you look at page Heap the page view
is useful because you set certain
patterns in memory when allocating and
feeding memory
Etc which means that once you start
doing some memorable rights on the Heap
it's more likely to cause a crash or if
you try to read from some data which has
been freed it's also gonna crash instead
of maybe reading something valid and
continuing execution so you get some
slowdown with it because well it's a
different allocator but
you get more bugs and I think that's
that's a great treat-off
if you look at a sample bug ID report
uh the I think the meat of it is you
have an access validation at this
address blah blah blah blah
uh
and then when you look at the verdict
from bug ID it says that if it might
allow information disclosure but then
when you look at
the disassembly down below you can see
that is trying to read eax into ESI and
then he assigns vcx
and then it's going to call you say okay
so we control
or at least eax is set to if you if you
if you have zero which means that uh
page Heap has well the memory has been
freed and then page Heap has
said this pattern for the field memory
which means that
while Bugatti thinks that it's uh
it's an out of bounds read it's actually
trying to
de-reference some feed memory instead so
you still need to do some manual
analysis to make sure that you're not
missing out on good books because this
looks to be a use of the freeway and
just get some code execution instead
um if you
the next problem yes uh you have a
hundred thousand lines of JavaScript
and minimizing that into finding out
what causes the crash is also a huge
pain
uh you
you cannot really be sure which which of
the many many lines are required for the
crash uh of course common sense is that
since we're feeding the input
sequentially into the reader the last
blob of data
is what's causing the application to
crash but maybe it's dependent on it's
well it's most certainly dependent on
the sequence of actions before that uh
the Greek solution for that is also
instead of trying to minimize by hand
which is sometimes easy sometimes not
it's just to use lithium so again from
Mozilla
line based test case reducer so
here yeah this is the marketing material
you can reduce the 3000 languages case
to treated
10 lines in minutes faster than you can
do by hand and lithium works on
interestingness tests as it's described
in the literature
so
in my case I'm interested in things that
crash due to memory errors so there's an
interestingness test
that's called crashes right and then you
say
you instruct lithium into
monitoring the execution and then just
cutting out chunks from the from the
line in the PDF and when when it has cut
out chunks that cause the application to
no longer crash it throws out that and
says well cut out something else instead
right
it supports these markers called TD
begin TDN so you can stick it into in
front and after your the JavaScript that
you've injected into the PDF so that you
don't
try to minimize and remove essential
parts of the actual PDF file itself
which will just cause well the wrong
kind of errors and not the stuff you're
interested in
and you go away that's fantastic right
but then once you start looking and
using lithium you find out that maybe
you're a fantastic user after free is
now being reduced into a different bug
which causes and I'll find out the
reference right and then all of a sudden
your money making input has turned into
something useless instead
I just asked the guys uh
help what I do here and they say well
there's something called crashes at the
pie from
some other project it's not mainlined
into lithium and probably never will but
but you can use it anyway with that you
can say I want
the calls to actually look the same
uh so that when lithium reduces your
JavaScript it's a it instead of just
saying crash good keep reducing if it
sees that the call stack has changed
it's gonna throw out that reduction uh
so that you keep your good good crashing
input and not uh bad crashing input
right
so next problem it's pretty hard to make
something generic targeting different
applications of course that's what I
didn't want to make right so you end up
hard coding a bunch of stuff but
it's not a problem if you're not giving
it to someone else I think some smart
guy told me yesterday your code can be
as terrible as you want if it's just for
you it's you only have to make it nice
when you give it to someone else right
so just make all the temporary hacks
it's it's perfect
of course you can also use a modular
approach and just make an application
specific GUI instrumentation harness for
the for example
um
when I made all this but I made it for
Adobe Reader and it was like maybe
there's some bugs and it as well
the only thing I need to redo is the GUI
instrumentation part and that's like
seriously three minutes of work and then
of course a few other
changes but but
it was pretty easy actually
um
yes
if you do as if you read the diamond
documentation and do as you're supposed
to do you're gonna run into some art of
memory problems in Adobe Reader when you
keep
adding annotations sadly but you can
just then select the instrumentation
from within Dharma
instead and then
this is the main fuzzing Loop this is
basically all you need to do
to generate data feed it and log faults
right so as you viewer here will notice
the complete lack of exception handling
which works to my advantage because if
the
if the thing the Abomination here trying
to type Keys into the JavaScript console
if that fails
than the f is Quest right and then the
the puzzle will crash and then something
external will say Well it the father
stop feeding data save the input queue
and then start everything again
so the entire workflow in this is
actually that you
find some Target functionality and you
write your grammar uh
and
[Music]
you can even you can you can make a
half-assed grammar initially and then
you can just keep updating it while the
version is running that's not a problem
at all and then you use Dharma to
generate your input based on this
grammar feed it using pyron also and
just wait for the crashes to start
raining automated crash analysis with
bug ID
so that's handled for us minimizing the
crashing input using lithium then that's
handled for us
and these these steps are not tightly
covered right you can easily break them
out to distinct worker nodes they they
don't need to I mean the whole process
is slow enough that that you can just
have a centralized file storage where
you SCP over files or something and then
workers can come in and pull jobs
it's uh it's it's quite fine
and the way it works is that Dharma
produces for bug ID which produces for
lithium
the the mining for the actual bus with
the armor is a lot slower than the bug
ID analysis which is a lot faster than
the lithium reducer right so it makes
sense to have a lot of The Producers
here in in number two uh maybe not so
many for the Bugatti because that
process is pretty static and then some
more notes to do the the minimizing
right so you can play around with that a
bit and get something where
you don't have nodes
waiting around for for actual work but
but that
that requires some tuning and there's I
I can't come up with a generic recipe
for how many you need of each then so
that that's just a matter of trying it
out
finally results
um
I first did for two weeks on a pretty
shitty laptop and I got 339 crashes
giving me 132 distinct uh
reports from bug ID with 39 distinct
crash locations and
distinct reports but identical great
locations means that there's a different
call stack leading to the same crash
location right and it's pretty much the
entire palette of what Bugatti support
so it's access for religion reading you
know
Buffalo flows out of bounds reads writes
you name it you can have it all in Adobe
Reader
and I
I definitely took some shortcuts when I
wrote the grammar for some of the things
so it was pretty lazy but it worked out
a lot better than than I expected anyway
so
there you have it uh
when you make your fuzzing
infrastructure uh use don't use crabby
old Windows XP machines or whatever you
usually use a virtualized Windows 10 or
Windows Server 2019 it boots in like 10
12 seconds so the complete reset of
state and everything on until you're
back and the first one is running is
like at 10 second job right
and you can disable the antivirus on the
server
if you first on the end user OS and you
generate this and you make PDF files and
if they have even just a bit of meat in
them Defender is going to quarantine
your files right so get rid of that
because otherwise it's also gonna every
time you make files it's going to come
in and scan and whatnot
um
I keep a shift down installation with
basically nothing but
Adobe Reader in it on some nvme and then
I just spawn a linked clones or copy
clones to Ram drives that's also
pretty cheap and I avoid wearing out my
nvmes
and definitely destroy the Adobe Reader
update mechanism because otherwise it's
just going to update mid campaign and
then you come in and
your crashes are you have a big queue of
crashes and you want to analyze them and
they're no longer crashing and you're
like what the hell is up Why didn't it
work did I break something
for me it was the reader so destroy that
one uh
building on this I think uh and
something for you to do you can go ahead
and write more grammars and write well
some grammars for reader or even acrobat
which is like the professional version
to make PDF files it has a much richer
feature set than
then do a common reader
I need to fix my grandma's for some
better coverage because I took a bunch
of shortcuts I was thinking to
[Music]
so if you look at Dharma and tomato
they're both Country Grammar forces and
they should be behaving more or less
identically but maybe there's some
secret sauce
behind the scenes so I was thinking to
maybe write the same grammar the formats
are well close but not identical and
then do a first off between tomato and
Dharma just for fun
something else you can do is look at
historically problematic JavaScript
um sort of regression test from
Chrome or from Firefox
that can also give you a hint uh
as to what kind of
malicious JavaScript that is you want to
generate right when you write your
grammars like do you want to
set values to null or do you want to do
some weird re-entrancy or whatever so it
pays to
it pays to follow what all the browsers
guys are doing and of course not all of
it applies to this limited subset but
but still it
it pays to Snoop on on their stuff
uh something else that
I or you could do I want to do it at
least is to make a replay algorithm
so I can minimize the minimizing efforts
because while it's
while lithium runs unattended and
automated it's still
it's still intensive and it it feels
like
well you're definitely wasting a bunch
of Cycles so if you have to pay for your
compute time maybe it pays to to well
cut down on the minimizing if it's uh
I was thinking to make some sort of
blacklisting through if I because if you
keep
crashing on the same unexplodable bug
early in your fuzzing then
you're again you're wasting Cycles right
it's surprisingly complicated to to
Blacklist things you don't want to do
when you do this the manipulation but
it is what it is it's not a big problem
it's just something to look at
so if we try to see
or make some sort of conclusion well I
think Adobe Reader is still incredibly
full of bugs right because I'm one guy
with one laptop and I sit down
for some weeks and press some buttons
and it's just raining crashes uh
for some reason it's still widely used
in corporate environments and I don't
understand this because they have the
quarterly paid cycle
um
and there's always code refusion bugs in
it right so
I honestly don't understand why it's not
blacklisted in all cooperations but hey
I don't write the policy
the bugs are easy to find if you look in
the right places tooling is easy
it's a bunch of scripting python page
files imagination
and uh
I don't like it when someone gives a
presentation and say Here's a person I
wrote this is how you do it I found all
the books and I reported it and made
money right so I didn't report anything
you can just go do what I described and
you'll find the same craze as me right
now so
also it's super complicated
or annoying at least to build your
versing pipeline if you don't have
anything that crashes right if you can't
find at least one valid crash it's hard
to work on your
crash detection logic and all that stuff
so
I left all the crazies in there
and that was it
so talk to me about computers and if you
made something better than this for PDF
down first thing
hook me up
thank you
[Applause]
awesome thanks very much so do we have
any questions in the room here if so
um could you
um line up behind the microphone uh any
questions from the internet no questions
from the internet uh
great okay well um
if if there are any kind of any
questions the uh people can come and uh
which which Village you're in in we do
you have a village you're in
anyways oh there's one question ah sorry
all right so have you met any software
that you uh couldn't find any bugs in
just yes or no no
[Laughter]
I mean
finding Birds
I think you should if you're interested
in in how to find bugs and all that
stuff if you watch marked out keynote
from offensive con I think that this
year I think that was awesome because it
goes into
the whole mindset required right because
I think also if you if you go in with
the mindset of everybody's looked at
this I'm not going to find any box then
you will most definitely be correct
right but if you go in with the mindset
of I'm probably going to find some bugs
you're also correct because finding the
bugs is a matter of
understanding
how the thing works and then just
pushing all the edge cases everywhere
thanks great thanks next question
hello yeah first of all thanks for your
dog real nice
um you said one of the tips was disable
the object mechanism which sounds
obvious
um but what about disabling the internet
well that actually result in different
behavior in your experience or
well so he's asking if it will help to
just disable the internet well I guess
it's
an easy quick solution but but I built
my uh I built my new or not my network
but my setup with distinct worker nodes
that talk over the network and pull jobs
and do stuff here and there so I think
it's a bigger pain in the ass to not
have internet on them than it is to just
screw with the update mechanism because
maybe you want your pipeline to actually
do check for the latest version and pull
that one down and
do everything automatically
update mechanism all together as in you
don't test that bar well the update
mechanism just downloads design binary
and executes that one right so that part
is not interesting but so I think it's
better to just destroy it and and have
then you know what version of Adobe
Reader your
you're fussing because it's not in the
case of Adobe Reader it's not going to
say there's a new version do you want to
update it's just gonna do it right yeah
I thought maybe perhaps they might do
different Behavior if you have internet
it might be speaking to the microphones
microphone now but uh yeah sure so I was
thinking perhaps that if you have
internet enabled
yeah is that better okay if you have
internet enabled then perhaps the other
reader would do some other checks as in
a load different pieces of code then
well it's there's no internet it might
skip that perhaps it might be a check if
this is online then go into this sub
routine but if it's not then that's a
private team so I was wondering if that
you know
might be interesting as well I mean you
might skip that yeah I I see what you
mean and possible but but I'd say not
relevant for the stuff I'm doing right
now but definitely something to bear in
mind right
thanks thanks for the question and uh
let's give a round of applause but
goodness
[Applause]
um