# PE file parser fuzzing

**URL:** <https://community.zeek.org/t/pe-file-parser-fuzzing/5427>\
**Category:** Zeek\
**Created:** [August 22, 2018, 10:29pm UTC](https://community.zeek.org/t/pe-file-parser-fuzzing/5427 "2018-08-22T22:29:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Maksim\_Shudrak](https://avatars.discourse-cdn.com/v4/letter/m/5f8ce5/32.png) [@Maksim\_Shudrak](https://community.zeek.org/u/Maksim_Shudrak)\
**Post date:** [August 22, 2018, 10:29pm UTC](https://community.zeek.org/t/pe-file-parser-fuzzing/5427/1 "2018-08-22T22:29:58Z")

</div>

Hi everyone,

I am trying to search for bugs in bro file parser using libfuzzer. I found the old branch where you tried to fuzz HTTP protocol. So, I have implemented everything on top this branch. I was able to easily make it work for DNP3 protocol but file analyzers are different. The problem is that I can’t reach the actual PE parser code from my LLVMFuzzerTestOneInput.

The actual code is :

analyzer::file::File\_Analyzer \*filea = new analyzer::file::File\_Analyzer(“TCP”,conn);  
filea-\>DeliverStream(DataSize, Data, true);

I had problems with file handler which I solved by adding the following line in the Manager.cc

— a/src/file\_analysis/Manager.cc  
+++ b/src/file\_analysis/Manager.cc  
@@ -427,6 +427,7 @@ string Manager::GetFileID(analyzer::Tag tag, Connection\* c, bool is\_orig)

mgr.QueueEvent(get\_file\_handle, vl);  
mgr.Drain(); // need file handle immediately so we don’t have to buffer data

- file\_mgr-\>SetHandle(“random\_str”);  
return current\_file\_id;  
}

In this case, Bro will call “hash” analyzer and ignore PE. It looks like the PE file analyzer is not loaded/initialized, the debug log reports only the following modules being loaded:  
[FjjsZfY8GArx2E0Ih] Add analyzer MD5  
[FjjsZfY8GArx2E0Ih] Add analyzer SHA1

Probably, I am on completely wrong way to make it work. it would be great if you can suggest me some other ways to make it work without significant modification of bro source code.

Thank you in advance.

---

<div class="post-metadata">

**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\
**Post date:** [August 23, 2018, 2:06pm UTC](https://community.zeek.org/t/pe-file-parser-fuzzing/5427/2 "2018-08-23T14:06:55Z")

</div>

I didn't understand how exactly you tried to instrument Bro w/ your  
fuzzing code, but here just seems like the problem is you were  
expecting Bro to add the PE analyzer unconditionally when in reality  
it's only added if the data passed in for file analysis actually looks  
like it could be valid PE. You can see that  
scripts/base/files/pe/main.bro is what registers the PE analyzer upon  
matching the "application/x-dosexec" type whose signature is defined  
in scripts/base/frameworks/files/magic/libmagic.sig (e.g. looks for  
data starting with "MZ"). If you want the PE analyzer attached  
unconditionally, you could try loading your own script that does:

&nbsp;&nbsp;&nbsp;&nbsp;event file\_new(f: fa\_file) { Files::add\_analyzer(f, Files::ANALYZER\_PE); }

- Jon

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/pe-file-parser-fuzzing/5427/3 "2022-05-06T15:46:00Z")

</div>