A type-aware kernel fuzzing framework for Windows that uses static binary analysis to infer system call types for more effective fuzzing.
NTFUZZ is a type-aware kernel fuzzing framework for Windows. It uses static binary analysis to infer the data types of Windows system call arguments, then employs a kernel hooking driver to perform intelligent, type-aware mutation fuzzing on those arguments. This approach helps security researchers discover deep and complex vulnerabilities in the Windows kernel more effectively than traditional blind fuzzing methods.
Security researchers, vulnerability hunters, and academic teams focused on Windows kernel security who need a structured, type-aware approach to fuzzing system calls.
Researchers choose NTFUZZ because it provides type awareness—a significant advantage over blind fuzzing. By understanding argument types, it generates more semantically valid inputs, leading to higher code coverage and the discovery of deeper, more subtle kernel bugs that random fuzzing would miss.
NTFUZZ: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis (IEEE S&P '21)
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Increases effectiveness by mutating system call arguments based on inferred data types, leading to deeper kernel bug discovery as highlighted in the IEEE paper.
Automatically analyzes Windows DLLs to extract type information without manual annotation, reducing setup effort for new Windows builds.
Uses a custom driver to intercept live system calls from seed applications, enabling real-time fuzzing with realistic traces.
Supports real apps like SumatraPDF for generating system call traces, improving fuzzing relevance compared to synthetic inputs.
Requires multiple manual steps including .NET installation, Visual Studio setup, VM preparation, and file copying, as detailed in the README's three-step guide.
Static analysis and runtime hooking must match exact Windows 10 build versions (e.g., 17134.1), or it causes kernel panics, limiting flexibility.
Relies on a binary-only version of B2R2 for static analysis, which is not open-source and may hinder customization or future updates.