Destroying x86_64 instruction decoders with differential fuzzing

Summary: Trail of Bits has open-sourced mishegos, a differential fuzzer that feeds the same instruction candidates to multiple x86_64 decoders and compares their outputs, using a sliding strategy that generates up to 26-byte candidates to yield 12 windows per input. A single 60-second run on a not particularly fast Linux server inside Docker produced about 1 million cohorts, or 4 million bundled outputs with 4 workers configured.
What you should know: The fuzzer found Capstone reporting false positives and false negatives, libbfd being utterly and repeatedly wrong, and udis86 behaving like libopcodes with spotty maintenance, so the disassembly your analysts treat as ground truth can be used to construct adversarial binaries that confuse your tools.

Read the original at Trail of Bits Blog ↗