That's why after finding the Crash, we need to enter the analysis stage
Fuzzer
↓
Crash
↓
Debugger
↓
Root Cause Analysis
↓
Bug Classification
Don't confuse Root Cause and Crash
Always keep these two separate
Crash
↓
What happened
But
Root Cause
↓
Why did it happen
For example:
Crash
↓
SIGSEGV
↓
Invalid Memory Access
The Root Cause is still unknown
We may find out after investigation
Input
↓
Unsafe Copy
↓
Buffer Overflow
↓
Memory Corruption
↓
Crash
Here we have found the root cause
From the Reverse Engineer's perspective:
When you have a Crash, keep asking yourself these questions
Where did the CPU crash
Which instruction was problematic
Which register or address was involved
Where did this value come from
What data caused this situation
Where was the first place where the wrong behavior occurred
The last question is the most important
Because the Crash may have occurred at one point but the Bug may have occurred several functions earlier
When We found a crash
We don't say we found the cause of the bug
First we find the location of the crash
Then we examine the problematic instruction, then we look at the registers and memory, then we follow the data path back to where the problem actually occurred
That is
Crash
↓
Where
↓
How
↓
Why
↓
Root Cause
And this is exactly the difference between seeing a crash and understanding a bug
@reverseengine
Post #1797
135
ReverseEngineering بخش سی و یکم بافر اور فلو Root Cause Analysis پیدا کردن علت واقعی Crash توی قسمت قبل یاد گرفتیم وقتی Fuzzer کلی Crash پیدا میکنه چطور اونها رو دستهبندی کنیم حالا میخوایم یک مرحله عمیقتر بشیم این بار فقط نمیخوایم بدونیم برنامه کجا Crash کرده میخوایم…