Abstract

Coverage-guided fuzzing is generally the most effective fuzzing technique, which can be used to find security bugs in software with little effort. While this technique is widely available on open-source software, there’s little support for closed-source applications. This is where TinyInst, a lightweight dynamic binary instrumentation library, comes into play. This talk goes through the process of porting TinyInst to macOS and how this successfully enabled coverage-guided binary fuzzing on Apple’s platform. The talk will include:

What porting such a library involves
The process of writing a custom debugger for macOS
Challenges encountered during development
Results and how this tool can be used to find bugs