Peach The Fuzzing Platform v2.3.8 released
Peach is a SmartFuzzer that is capable of performing both generation and mutation based fuzzing.
Peach requires the creation of PeachPit files that define the structure, type information, and relationships in the data to be fuzzed. It additionally allows for the configuration of a fuzzing run including selecting a data transport (Publisher), logging interface, etc.
Peach has been under active development since 2004 and is in its second major version with the third currently under development. Peach was created and is actively developed by Michael Eddington of Deja Vu Security
Features
- Cross platform support (Linux, OS X, Windows, etc.)
- Mono compatibility
- Backwards comparable with existing Peach definitions
- Easier to drive Peach programmatically
- Design to allow for next generation of fuzzing technology
- A number of GUI programs for:
- Simple File Fuzzing
- Simple Network Fuzzing
Changelog
Peach v2.3.8 has been a long time coming. Lots of updates, changes and bug fixes. I’m also happy to say the Peach Validator GUI now works on all platforms!
Major Changes:
- Python v2.7 is now the supported version for both 32bit and 64bit
- Peach Validator GUI works on all platforms
- The –strategy command line has been removed and is now an element <Strategy/> under <Test/>. The command line tool peachrand.* has also been removed. Instead please set the Strategy in the Peach Pit. This change will allow strategies to be passed parameters.
The Full Changeling:
- New: Moving to Python 2.7, this is the final python 2 version.
- New: Peach filesystem logger now always writes out first test case #
- New: Peach filesystem logger logs test case skipping
- New: Peach logging better detects crashes/ctrl+c and logs last test case #
- New: CleanupRegistry monitor added
- New: FilePerIteration publisher supports “##FILEBASE##” in filename
- New: Publishers now have self.parent set by parser code.
- New: DataModel can be defined inside of Action
- New: Timeout and iteration repeat when debugger hangs
- New: Windows Kernel module for fuzzing in Kernel space
- New: Nice error message for some Publisher parsing exceptions
- New: –seed paramter to set random seed
- New: <Strategy> element added to <Test>
- New: file system logger now logs command line
- New: file system logger now logs pit file name
- Change: Aliased internal analyzers to XmlAnalyzer, Asn1Analyzer, BinaryAnalyzer,
- Change: –strategy command line argument depricated
- Change: No longer warn when Unix debugger does not load
- Change: Now using psutil module to get cpu time
- Change: Added <Agent/> back to template.xml
- Change: Removed warning about vtrace/windbg not loading
- Change: Random SEED now logged
- Change: You can now –skipto in Random Strategy
- Change: Added Udp6Listener publisher
- Change: First iteration must work, else we stop
- Change: Updated peach.xsd to include raw.* publishers and udp.UdpListener
- Bug: COM publisher was not using “WithNode” mode to get Python data type
- Bug: Capture more stack traces when Publisher miss-configured
- Bug: Fixed parsing of hex values from XML
- Bug: Bug loading analyzers
- Bug: Not loading custom analyzer modules when asCommandLine enabled.
- Bug: valueType of literal was not always evaulated
- Bug: Fixed several bugs in Peach Shark.
- Bug: When a count relation goes into an array that can be 0, remove
- relation-ship when array is 0, but only if a count is providing the 0.
- Bug: Inconsistent behaviour with exceptions and watchers/agents/publishers
- Bug: EngineWatcher.OnStopRun/Logger.OnStopRun was not being called correctly
- New: New IPv6 Raw publisher (raw.Raw6) added.
- Bug: Fixed ValidValues mutator/hint to work with Numbers
- Bug: XmlElement/XmlAttributes: xmlns:n attributes moving to parent element.
- fixed by moving to internal python xml module instead of 4suite.Also not pretty printing
- fixed by moving to internal python xml module instead of 4suite.Also not pretty printing
