--- /dev/null
+# EditorConfig is awesome: https://editorconfig.org
+
+# top-most EditorConfig file
+root = true
+
+# Unix-style newlines with a newline ending every file
+[*]
+end_of_line = lf
+insert_final_newline = true
+charset = utf-8
+indent_style = space
+indent_size = 2
+
+[Makefile]
+indent_style = tab
--- /dev/null
+# LaTeX
+*\~
+*.swp
+*.log
+*.aux
+*.out
+*.snm
+*.nav
+*.toc
+*.vrb
--- /dev/null
+THEME ?= pgpro2025.theme
+
+THEMES = theme.nonfree pgpro2025.theme
+
+TOP_DIR = $(shell pwd)
+FONTS_DIR = $(TOP_DIR)/$(THEME)/fonts
+
+all:
+ "$(TOP_DIR)/bin/gen_font_config.pl" "$(FONTS_DIR)"
+ ln -sf "$(THEME)/theme_setup.tex" theme_setup.tex
+ FONTCONFIG_FILE="$(FONTS_DIR)/fonts.conf" fc-cache
+
+ # Надо в два прохода
+ #FONTCONFIG_FILE="$(FONTS_DIR)/fonts.conf" xelatex -interaction=nonstopmode example.tex
+ #FONTCONFIG_FILE="$(FONTS_DIR)/fonts.conf" xelatex -interaction=nonstopmode example.tex
+ FONTCONFIG_FILE="$(FONTS_DIR)/fonts.conf" xelatex example.tex
+ FONTCONFIG_FILE="$(FONTS_DIR)/fonts.conf" xelatex example.tex
+ make clean
+
+clean:
+ rm -f *.log *.aux *.out *.snm *.nav *.toc *.vrb
+ $(foreach theme,$(THEMES), rm -f "$(TOP_DIR)/$(theme)/fonts/fonts.conf";)
+ $(foreach theme,$(THEMES), rm -rf "$(TOP_DIR)/$(theme)/fonts-cache";)
+
--- /dev/null
+# Шаблон презентаций для Beamer
+
+При подготовке шаблона использованы:
+* [Шаблон презентации PostgresPro для Openoffice](link hidden)
+* Шрифт [Gilroy](https://oc.postgrespro.ru/index.php/s/oXFIYT9dLwLCle6)
+* Тема [gcr2019](https://github.com/schors/gcr2019theme) для Beamer
+
+Для сборки запустите команду: `xelatex example.tex`
--- /dev/null
+#!/usr/bin/perl
+
+use strict;
+
+my $font_path = $ARGV[0];
+
+die "Please specify path to font dir as a first arg\n" unless $font_path;
+
+my $data = <<ENDOFDATA;
+
+<?xml version="1.0"?>
+<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+<fontconfig>
+ <dir>$font_path</dir>
+ <cachedir>$font_path-cache</cachedir>
+</fontconfig>
+
+ENDOFDATA
+
+$data =~ s/^\s+//s; # Remove all spaces at the beginning of the text, to make xml parser happy
+
+open F, ">", "$font_path/fonts.conf" or die "Cannot open $font_path/fonts.conf: $!";
+print F $data;
+close F;
+
--- /dev/null
+\usepackage{listings}
+
+% for listings
+\definecolor{acmebg}{HTML}{FFFFEF}
+\definecolor{acmeh}{HTML}{EFFFFF}
+\definecolor{acmec}{HTML}{8C8ACE}
+\definecolor{acmel}{HTML}{52AAAD}
+\definecolor{acmel1}{HTML}{EFEF9C}
+\definecolor{acmel2}{HTML}{9CEFEF}
+\lstset{
+ columns=flexible,
+ keepspaces=true,
+ showstringspaces=false,
+ showtabs=false,
+ tabsize=4,
+ frame=single,
+ basicstyle=\fontsize{10pt}{12}\bf\ttfamily\color{black},
+ backgroundcolor=\color{acmebg},
+ commentstyle=\color{black},
+ keywordstyle=\color{black},
+ stringstyle=\color{red},
+ rulecolor=\color{acmel},
+ framerule=1pt
+}
+
+% for listings background
+\makeatletter
+\let\old@lstKV@SwitchCases\lstKV@SwitchCases
+\def\lstKV@SwitchCases#1#2#3{}
+\makeatother
+\usepackage{lstlinebgrd}
+\makeatletter
+\let\lstKV@SwitchCases\old@lstKV@SwitchCases
+
+\lst@Key{numbers}{none}{%
+ \def\lst@PlaceNumber{\lst@linebgrd}%
+ \lstKV@SwitchCases{#1}%
+ {none:\\%
+ left:\def\lst@PlaceNumber{\llap{\normalfont
+ \lst@numberstyle{\thelstnumber}\kern\lst@numbersep}\lst@linebgrd}\\%
+ right:\def\lst@PlaceNumber{\rlap{\normalfont
+ \kern\linewidth \kern\lst@numbersep
+ \lst@numberstyle{\thelstnumber}}\lst@linebgrd}%
+ }{\PackageError{Listings}{Numbers #1 unknown}\@ehc}}
+\makeatother
\ No newline at end of file
--- /dev/null
+% библиотеки
+\usetikzlibrary{%
+ arrows, % стрелки
+ shapes.misc, % фигуры
+ shapes.geometric, % фигура ellipse
+ chains, % цепочки
+ positioning, % позиционирование элементов
+ scopes, % создание дополнительных веток
+ shadows % тени
+}
+% указание цветов
+\definecolor{Gray}{RGB}{102,102,102}
+\definecolor{LightGray}{RGB}{178,178,178}
+\definecolor{Red}{RGB}{204,0,0}
+\definecolor{Pink}{RGB}{255,102,102}
+
+% установки для элементов
+\tikzset{
+ every node/.style={on chain},
+ every join/.style={->}, % со стрелками
+ Rectangle/.style={
+ rectangle, % обычный прямоугольник
+ % размер блока
+ minimum size=6mm,
+ very thick, % двойная линия
+ draw=Gray, % указываем заданный ранее цвет
+ % цвета узлов
+ top color=white,
+ bottom color=LightGray,
+ % шрифт моноширинный
+ font=\ttfamily
+ },
+ Rounded/.style={
+ rounded rectangle, % прямоугольник со скруглёнными углами
+ drop shadow={opacity=0.35}, % тень от узлов
+ minimum size=6mm, % размер узла
+ very thick, % двойная линия
+ draw=black!50, % цвет обводки
+ top color=white,bottom color=black!20, % цвета градиента
+ font=\itshape}, % шрифт курсив
+Ellipse/.style={
+ ellipse, % прямоугольник со скруглёнными углами
+ drop shadow={opacity=0.35}, % тень от узлов
+ minimum size=6mm, % размер узла
+ very thick, % двойная линия
+ draw=black!50, % цвет обводки
+ top color=white,bottom color=black!20, % цвета градиента
+ font=\itshape}, % шрифт курсив
+}
\ No newline at end of file
--- /dev/null
+\documentclass{beamer}
+
+\usepackage{xltxtra}
+\defaultfontfeatures{Ligatures=TeX,Mapping=tex-text}
+\usepackage[english]{babel}
+\usepackage[utf8]{inputenc}
+
+\definecolor{linkcolor}{HTML}{799B03}
+\definecolor{urlcolor}{HTML}{6633FF}
+\hypersetup{pdfstartview=FitH, linkcolor=linkcolor, urlcolor=urlcolor, colorlinks=true}
+
+\title{How Fuzzing Works}
+\subtitle{A Plain-Language Explanation}
+\author{Nikolay Shaplov \\ {\small illustrations: Nikolay Shaplov, Dina Tabosskaya}}
+\institute{Postgres Professional}
+
+\input{theme_setup.tex}
+\input{elements/code.tex}
+
+\begin{document}
+
+% Auto-generated from Osnovy_fazzinga_v2025-04.odp
+
+
+% ============================================================
+% Slide 1: Title slide
+% ============================================================
+\begin{frame}
+ \titlepage
+\end{frame}
+
+% ==========================================================
+% Slide 2: Postgres Professional
+% ==========================================================
+\begin{frame}{Postgres Professional}
+ \begin{itemize}
+ \item About the speaker
+ \item Russian-origin DBMS based on PostgreSQL;
+ \item development of derivative products;
+ \item support;
+ \item certified edition.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 3: Secure Development Lifecycle
+% ==========================================================
+\begin{frame}{Secure Development Lifecycle}
+ \begin{itemize}
+ \item SDL – Security Development Lifecycle
+ \item ...
+ \item V. Verification
+ \item static analysis;
+ \item dynamic analysis;
+ \item fuzz testing.
+ \item ...
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 4: Secure Development Lifecycle
+% ==========================================================
+\begin{frame}{Secure Development Lifecycle}
+ \textbf{SDL – Security Development Lifecycle}
+ \par\vspace{0.1cm}
+ \begin{itemize}\small
+ \item ...
+ \item V. Verification
+ \item static analysis;
+ \item dynamic analysis
+ \item fuzz testing
+ \item ...
+ \item on-the-desk demotivator
+ \end{itemize}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/na-stole-demotivator.png}
+\end{frame}
+
+% ==========================================================
+% Slide 5: Talk Outline
+% ==========================================================
+\begin{frame}{Talk Outline}
+ \begin{itemize}
+ \item from unit testing to fuzz testing:
+ \item general idea of fuzzing;
+ \item sanitizers;
+ \item trace instrumentation;
+ \item fuzzer strategy.
+ \item hands-on examples;
+ \item extending fuzzing capabilities.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 6: Tools and Materials
+% ==========================================================
+\begin{frame}{Tools and Materials}
+ \begin{itemize}
+ \item access to source code;
+ \item program in a compiled language (C/C++);
+ \item compiler: clang + wrappers afl-clang-fast and afl-clang-lto;
+ \item fuzzer: AFL++.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 7: Fuzzing
+% ==========================================================
+\begin{frame}{Fuzzing}
+ \begin{itemize}
+ \item What is fuzzing?
+ \item (fun pictures)
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 8: How We Usually Test
+% ==========================================================
+\begin{frame}{How We Usually Test}
+ {\small Unit testing}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/scheme-slide8.png}
+\end{frame}
+
+% ==========================================================
+% Slide 9: Testing All Possible Inputs
+% ==========================================================
+\begin{frame}{Testing All Possible Inputs}
+ {\small The ideal approach}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/X-fx-Y.png}
+\end{frame}
+
+% ==========================================================
+% Slide 10: Testing All Possible Inputs
+% ==========================================================
+\begin{frame}{Testing All Possible Inputs}
+ {\small What we can actually do}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/Xx-fx-Yy.png}
+\end{frame}
+
+% ==========================================================
+% Slide 11: Testing All Possible Inputs
+% ==========================================================
+\begin{frame}{Testing All Possible Inputs}
+ {\small How to verify output correctness?}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/Xx-fx-Yy-eq.png}
+\end{frame}
+
+% ==========================================================
+% Slide 12: Testing All Possible Inputs
+% ==========================================================
+\begin{frame}{Testing All Possible Inputs}
+ {\small Reference/alternative implementations exist}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/Xx-fx-Yy-fuzz.png}
+\end{frame}
+
+% ==========================================================
+% Slide 13: Testing All Possible Inputs
+% ==========================================================
+\begin{frame}{Testing All Possible Inputs}
+ {\small Sanitizers: indirect correctness verification}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/Xx-fx-Yy-sanitizers.png}
+\end{frame}
+
+% ==========================================================
+% Slide 14: Checks Injected at Compile Time
+% ==========================================================
+\begin{frame}{Checks Are Injected at Compile Time}
+ \begin{itemize}
+ \item Sanitizers
+ \item ASan – Address Sanitizer
+ \item UBSan – Undefined Behavior Sanitizer
+ \item \ldots
+ \item Write your own check!
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 15: Checks Injected at Compile Time
+% ==========================================================
+\begin{frame}{Checks Are Injected at Compile Time}
+ {\small Sanitizers}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/ASan_screenshot.png}
+\end{frame}
+
+% ==========================================================
+% Slide 16: Checks Injected at Compile Time
+% ==========================================================
+\begin{frame}{Checks Are Injected at Compile Time}
+ {\small Sanitizers}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/ASan_screenshot.png}
+\end{frame}
+
+% ==========================================================
+% Slide 17: Checks Injected at Compile Time
+% ==========================================================
+\begin{frame}{Checks Are Injected at Compile Time}
+ {\small Sanitizers}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/ASan_screenshot.png}
+\end{frame}
+
+% ==========================================================
+% Slide 18: Checks Injected at Compile Time
+% ==========================================================
+\begin{frame}{Checks Are Injected at Compile Time}
+ {\small Sanitizers}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/ASan_screenshot.png}
+\end{frame}
+
+% ==========================================================
+% Slide 19: Fuzzer
+% ==========================================================
+\begin{frame}{Fuzzer}
+ {\small The program driving the testing}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/fuzzer-Xx-fx.png}
+\end{frame}
+
+% ==========================================================
+% Slide 20: Fuzzer
+% ==========================================================
+\begin{frame}{Fuzzer}
+ {\small Unfortunately, knows nothing about the input space}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/fuzzer-all-data-fx.png}
+\end{frame}
+
+% ==========================================================
+% Slide 21: Researcher Prepares Corpus; Fuzzer Mutates It
+% ==========================================================
+\begin{frame}{The Researcher Prepares a Corpus; the Fuzzer Mutates It ``Randomly''}
+ {\small Corpus and mutations}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/scheme-slide21.png}
+\end{frame}
+
+% ==========================================================
+% Slide 22: JPEG File Mutation During Fuzzing
+% ==========================================================
+\begin{frame}{JPEG File Mutation During Fuzzing}
+ {\small Fuzzer mutations}
+ \par\vspace{0.1cm}
+ \centering
+ % TODO: animated GIF — convert to PNG/PDF manually
+ % \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/AFL_Fuzz_Logo.gif}
+\end{frame}
+
+% ==========================================================
+% Slide 23: Some Mutation Algorithms
+% ==========================================================
+\begin{frame}{Some Mutation Algorithms}
+ \begin{itemize}
+ \item Fuzzer mutations
+ \item bitflip --- randomly flips bits;
+ \item arith --- random arithmetic operations;
+ \item extras --- dictionary word insertion;
+ \item havoc --- complex algorithm; includes block-level operations:
+ \item duplication;
+ \item deletion;
+ \item replacement with random data.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 24: Fuzzing
+% ==========================================================
+\begin{frame}{Fuzzing}
+ {\small Full scheme}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/full-scheme.png}
+\end{frame}
+
+% ==========================================================
+% Slide 25: Fuzzing
+% ==========================================================
+\begin{frame}{Fuzzing}
+ {\small Full scheme}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/full-scheme-red.png}
+\end{frame}
+
+% ==========================================================
+% Slide 26: Fuzzing --- Coverage by Execution Traces
+% ==========================================================
+\begin{frame}{Fuzzing --- Coverage by Execution Traces}
+ \begin{itemize}
+ \item Basic block --- a set of CPU instructions:
+ \item executed sequentially;
+ \item no branches or conditional jumps inside;
+ \item control flow enters only at the block entry point.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 27: Fuzzing --- Coverage by Execution Traces
+% ==========================================================
+\begin{frame}{Fuzzing --- Coverage by Execution Traces}
+ \begin{itemize}
+ \item An execution trace is the sequence of basic blocks traversed during a particular program run.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 28: Fuzzing --- Coverage by Execution Traces
+% ==========================================================
+\begin{frame}{Fuzzing --- Coverage by Execution Traces}
+ \begin{itemize}
+ \item Trace instrumentation tools from the AFL++ suite:
+ \item afl-clang-fast
+ \item afl-clang-lto
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 29: Fuzzing
+% ==========================================================
+\begin{frame}{Fuzzing}
+ {\small Full scheme}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/full-scheme.png}
+\end{frame}
+
+% ==========================================================
+% Slide 30: How Long Should You Fuzz?
+% ==========================================================
+\begin{frame}{How Long Should You Fuzz?}
+ \begin{itemize}
+ \item Fuzzing strategy
+ \textbf{Key stopping criteria:}
+ \par
+ \item total run time / number of executions;
+ \item time elapsed since the last new trace was found.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 31: Fuzzing
+% ==========================================================
+\begin{frame}{Fuzzing}
+ \begin{itemize}
+ \item Hands-on example
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 32: A Simple Target Function
+% ==========================================================
+\begin{frame}[fragile]{A Simple Target Function}
+ \textbf{What it looks like in practice}
+ \par\vspace{0.3cm}
+ \begin{lstlisting}[language=C]
+void function_to_fuzz(char *str)
+{
+if (str[0] == 'C')
+if (str[1] == 'R')
+if (str[2] == 'A')
+if (str[3] == 'S')
+if (str[4] == 'H')
+abort(); /* Crash */
+}
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Slide 33: Building the Test Harness
+% ==========================================================
+\begin{frame}[fragile]{Building the Test Harness}
+ \textbf{What it looks like in practice}
+ \par\vspace{0.3cm}
+ \begin{lstlisting}[language=C]
+int main(int argc, char** argv)
+{
+char buf[100];
+read(0, buf, sizeof(buf)); /* Read data from STDIN */
+function_to_fuzz(buf);
+}
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Slide 34: Build and Smoke-Test
+% ==========================================================
+\begin{frame}[fragile]{Build and Smoke-Test}
+ \textbf{What it looks like in practice}
+ \par\vspace{0.3cm}
+ \begin{lstlisting}[language=bash]
+$ AFL_USE_ASAN=1 AFL_USE_UBSAN=1 afl-clang-fast test1.c
+....
+$ echo TEST | ./a.out
+$ echo CRASH_123 | ./a.out
+Illegal instruction
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Slide 35: Running the Fuzzer
+% ==========================================================
+\begin{frame}[fragile]{Running the Fuzzer}
+ \textbf{What it looks like in practice}
+ \par\vspace{0.3cm}
+ \begin{lstlisting}[language=bash]
+echo 0 >/proc/sys/kernel/randomize_va_space # required!
+$ mkdir in
+$ echo TEST > in/initial_sample
+$ afl-fuzz -i in -o out ./a.out
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Slide 36: Waiting for Results
+% ==========================================================
+\begin{frame}{Waiting for Results}
+ {\small What it looks like in practice}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/AFL-fuzz-status.png}
+\end{frame}
+
+% ==========================================================
+% Slide 37: Waiting for Results
+% ==========================================================
+\begin{frame}{Waiting for Results}
+ {\small What it looks like in practice}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/AFL-fuzz-status.png}
+\end{frame}
+
+% ==========================================================
+% Slide 38: Waiting for Results
+% ==========================================================
+\begin{frame}{Waiting for Results}
+ {\small What it looks like in practice}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/AFL-fuzz-status.png}
+\end{frame}
+
+% ==========================================================
+% Slide 39: Analysis: Working Corpus out/default/queue/
+% ==========================================================
+\begin{frame}[fragile]{Analysis: Working Corpus out/default/queue/}
+ \textbf{What it looks like in practice}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}
+id:000000,time:0,orig:1
+TEST
+id:000001,src:000000,time:6,op:havoc,rep:16,+cov
+C
+id:000002,src:000001,time:5094,op:havoc,rep:4,+cov
+CR
+id:000003,src:000002,time:61199,op:havoc,rep:2,+cov
+CRAR
+id:000004,src:000003,time:66276,op:havoc,rep:2,+cov
+CRAS
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Slide 40: Analysis: Working Corpus out/default/queue/
+% ==========================================================
+\begin{frame}[fragile]{Analysis: Working Corpus out/default/queue/}
+ \textbf{What it looks like in practice}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}
+id:000000,time:0,orig:1
+TEST
+id:000001,src:000000,time:6,op:havoc,rep:16,+cov
+C
+id:000002,src:000001,time:5094,op:havoc,rep:4,+cov
+CR
+id:000003,src:000002,time:61199,op:havoc,rep:2,+cov
+CRAR
+id:000004,src:000003,time:66276,op:havoc,rep:2,+cov
+CRAS
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Slide 41: Analysis: Working Corpus out/default/queue/
+% ==========================================================
+\begin{frame}[fragile]{Analysis: Working Corpus out/default/queue/}
+ \textbf{What it looks like in practice}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}
+id:000000,time:0,orig:1
+TEST
+id:000001,src:000000,time:6,op:havoc,rep:16,+cov
+C
+id:000002,src:000001,time:5094,op:havoc,rep:4,+cov
+CR
+id:000003,src:000002,time:61199,op:havoc,rep:2,+cov
+CRAR
+id:000004,src:000003,time:66276,op:havoc,rep:2,+cov
+CRAS
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Slide 42: Analysis: Working Corpus out/default/queue/
+% ==========================================================
+\begin{frame}[fragile]{Analysis: Working Corpus out/default/queue/}
+ \textbf{What it looks like in practice}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}
+id:000000,time:0,orig:1
+TEST
+id:000001,src:000000,time:6,op:havoc,rep:16,+cov
+C
+id:000002,src:000001,time:5094,op:havoc,rep:4,+cov
+CR
+id:000003,src:000002,time:61199,op:havoc,rep:2,+cov
+CRAR
+id:000004,src:000003,time:66276,op:havoc,rep:2,+cov
+CRAS
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Slide 43: Analysis: Working Corpus out/default/queue/
+% ==========================================================
+\begin{frame}[fragile]{Analysis: Working Corpus out/default/queue/}
+ \textbf{What it looks like in practice}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}
+id:000000,time:0,orig:1
+TEST
+id:000001,src:000000,time:6,op:havoc,rep:16,+cov
+C
+id:000002,src:000001,time:5094,op:havoc,rep:4,+cov
+CR
+id:000003,src:000002,time:61199,op:havoc,rep:2,+cov
+CRAR
+id:000004,src:000003,time:66276,op:havoc,rep:2,+cov
+CRAS
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Slide 44: Analysis: Working Corpus out/default/queue/
+% ==========================================================
+\begin{frame}[fragile]{Analysis: Working Corpus out/default/queue/}
+ \textbf{What it looks like in practice}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}
+id:000000,time:0,orig:1
+TEST
+id:000001,src:000000,time:6,op:havoc,rep:16,+cov
+C
+id:000002,src:000001,time:5094,op:havoc,rep:4,+cov
+CR
+id:000003,src:000002,time:61199,op:havoc,rep:2,+cov
+CRAR
+id:000004,src:000003,time:66276,op:havoc,rep:2,+cov
+CRAS
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Slide 45: Analysis: Crash Corpus out/default/crashes/
+% ==========================================================
+\begin{frame}[fragile]{Analysis: Crash Corpus out/default/crashes/}
+ \textbf{What it looks like in practice}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}
+id:000000,sig:04,src:000004,time:133872,op:havoc,rep:2 CRASHSSS
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Slide 46: Persistent Mode: Faster, Higher, Stronger
+% ==========================================================
+\begin{frame}[fragile]{Persistent Mode: Faster, Higher, Stronger}
+ \textbf{What it looks like in practice}
+ \par\vspace{0.3cm}
+ \begin{lstlisting}[language=C]
+int main(int argc, char** argv)
+{
+char buf[100];
+FILE * f;
+if (argc<2)
+{
+fprintf(stderr,"Please specify input file name as first argument\n");
+return 1;
+}
+while(__AFL_LOOP(1000))
+{
+f = fopen(argv[1], "r");
+if(!f)
+{
+fprintf(stderr,"Error opening file: '%s'\n",argv[1]);
+return 1;
+}
+fread(buf, 1, sizeof(buf), f);
+fclose(f);
+function_to_fuzz(buf);
+}
+}
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Slide 47: Persistent Mode: Faster, Higher, Stronger
+% ==========================================================
+\begin{frame}[fragile]{Persistent Mode: Faster, Higher, Stronger}
+ \textbf{What it looks like in practice}
+ \par\vspace{0.3cm}
+ \begin{lstlisting}[language=bash]
+$ afl-fuzz -i in -o out ./a.out @@
+ \end{lstlisting}
+\end{frame}
+
+
+% ============================================================
+% Slide 48: Section divider
+% ============================================================
+\begin{frame}
+ \vfill
+ \centering
+ {\Large\bfseries Extending Fuzzing Capabilities}
+ \vfill
+\end{frame}
+
+% ==========================================================
+% Slide 49: Dynamic Symbolic Execution
+% ==========================================================
+\begin{frame}{Dynamic Symbolic Execution}
+ \begin{itemize}
+ \item Fuzzing + DSE
+ \item Problem: the fuzzer cannot find an input radically different from those in the working corpus.
+ \item Solution: a DSE engine can synthesize inputs that reach previously uncovered branches.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 50: Dynamic Symbolic Execution
+% ==========================================================
+\begin{frame}{Dynamic Symbolic Execution}
+ \begin{itemize}
+ \item Fuzzing + DSE
+ \item In DSE the program is modelled as a formula. Variables are not concrete values but ``symbols\'\' with permitted ranges.
+ \item The formula can be ``solved\'\' to derive inputs that steer execution into a target branch.
+ \item Sydr by ISP RAS
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 51: Structure-Aware Fuzzing
+% ==========================================================
+\begin{frame}{Structure-Aware Fuzzing}
+ \begin{itemize}
+ \item Fuzzing + SAF
+ \item Problem: in layered systems fuzzing only stresses the first layer (parser, etc.)
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 52: Fuzzing + SAF
+% ==========================================================
+\begin{frame}{Fuzzing + SAF}
+ \centering
+ \includegraphics[width=\textwidth, height=0.85\textheight, keepaspectratio]{images/serebtyani_screenshot.png}
+\end{frame}
+
+% ==========================================================
+% Slide 53: Structure-Aware Fuzzing
+% ==========================================================
+\begin{frame}{Structure-Aware Fuzzing}
+ \begin{itemize}
+ \item Fuzzing + SAF
+ \item Problem: in layered systems fuzzing only stresses the first layer (parser, etc.)
+ \item Solution: generate syntactically/structurally valid inputs from the fuzzer's raw bytes.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 54: LibBlobStamper
+% ==========================================================
+\begin{frame}{LibBlobStamper}
+ \begin{itemize}
+ \item Fuzzing + SAF
+ \textbf{Requirements:}
+ \par
+ \item reproducibility;
+ \item preserving feedback to the fuzzer;
+ \item preserving DSE compatibility.
+ \textbf{Features:}
+ \par
+ \item abstract approach;
+ \item iterative description;
+ \item specification in a Turing-complete language (C++);
+ \item binary and string outputs.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 55: LibBlobStamper
+% ==========================================================
+\begin{frame}{LibBlobStamper}
+ \begin{itemize}
+ \item Fuzzing + SAF
+ \item Free software: \url{https://github.com/postgrespro/libblobstamper}
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Slide 56: I. Reproduce the Presentation Example
+% ==========================================================
+\begin{frame}[fragile]{I. Reproduce the Presentation Example}
+ \textbf{Hands-on Exercise}
+ \par\vspace{0.1cm}
+ \includegraphics[height=0.8cm]{images/AFL-logo-small.png}\quad
+ \url{https://github.com/AFLplusplus/AFLplusplus}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}[language=C]
+void function_to_fuzz(char *str)
+{
+if (str[0] == 'C')
+if (str[1] == 'R')
+if (str[2] == 'A')
+if (str[3] == 'S')
+if (str[4] == 'H')
+abort(); /* Crash */
+}
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Slide 57: II. Fuzzing the jq Utility
+% ==========================================================
+\begin{frame}{II. Fuzzing the jq Utility}
+ \textbf{Hands-on Exercise}
+ \par\vspace{0.1cm}
+ \begin{itemize}\small
+ \item jq --- a JSON filtering utility.
+ \item https://github.com/jqlang/jq
+ \item Fuzz the input-parsing routine.
+ \end{itemize}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/jq-logo.png}
+\end{frame}
+
+% ==========================================================
+% Slide 58: III. Fuzzing the pcre2 Library
+% ==========================================================
+\begin{frame}{III. Fuzzing the pcre2 Library}
+ \textbf{Hands-on Exercise}
+ \par\vspace{0.1cm}
+ \begin{itemize}\small
+ \item pcre2 --- a library implementing regular expression matching.
+ \item https://github.com/PCRE2Project/pcre2
+ \item Fuzz the regex-compilation and matching routines against a trivial input.
+ \end{itemize}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/pcre2-logo.png}
+\end{frame}
+
+% ==========================================================
+% Slide 59: What We Looked For and Found in PostgreSQL
+% ==========================================================
+\begin{frame}{What We Looked For and Found in PostgreSQL}
+ \begin{itemize}
+ \item Fuzzing results
+ \textbf{AFL++/Crusher:}
+ \par
+ \item string type representations (direct fuzzing);
+ \item operations between types (LibBlobStamper).
+ \textbf{Custom fuzzing:}
+ \par
+ \item shuffling regression tests (\textasciitilde{}30 fixes, 1 CVE).
+ \end{itemize}
+\end{frame}
+
+
+% ============================================================
+% Slide 60: Fuzzing is easy!
+% ============================================================
+\begin{frame}{Conclusions}
+ \vfill
+ {\Large\bfseries Fuzzing is easy!}
+ \par\vspace{0.5cm}
+ \vfill
+\end{frame}
+
+
+% ============================================================
+% Slide 61: Fuzzing is essential!
+% ============================================================
+\begin{frame}{Conclusions}
+ \vfill
+ {\Large\bfseries Fuzzing is essential!}
+ \par\vspace{0.5cm}
+ \vfill
+\end{frame}
+
+
+% ============================================================
+% Slide 62: Fuzzing is essential!
+% ============================================================
+\begin{frame}{Conclusions}
+ \vfill
+ {\Large\bfseries Fuzzing is essential!}
+ \par\vspace{0.5cm}
+ {\Large\bfseries There are fuzzing tools for your language too --- just search for them!}
+ \par\vspace{0.5cm}
+ \vfill
+\end{frame}
+
+
+% ============================================================
+% Slide 63: Questions
+% ============================================================
+\begin{frame}{Questions}
+ \centering
+ \includegraphics[width=\textwidth, height=0.85\textheight, keepaspectratio]{images/voprosy.png}
+\end{frame}
+
+
+% ============================================================
+% Slide 64: Feedback
+% ============================================================
+\begin{frame}{Feedback}
+ \begin{columns}[c]
+ \column{0.4\textwidth}
+ \centering
+ \includegraphics[width=\textwidth]{images/qr-feedback.png}
+ \column{0.6\textwidth}
+ \url{https://pgpro.pro/spbedufeedback}
+ \end{columns}
+\end{frame}
+
+
+% ============================================================
+% Slide 65: Contacts
+% ============================================================
+\begin{frame}{Contacts}
+ \begin{itemize}
+ \item E-mail: n.shaplov@postgrespro.ru
+ \item Matrix: @dhyan:nataraj.su
+ \item Git: https://gitlab.com/dhyannataraj
+ \item Nikolay Shaplov (Postgres Professional)
+ \end{itemize}
+\end{frame}
+
+\end{document}
--- /dev/null
+% PgPro 2025 — цвета и шрифты
+% Шрифты: Roboto (Regular, Medium), Roboto Mono Regular
+% Цвета: корпоративный синий #142D99, белый фон, серые блоки
+\mode<presentation>
+
+% --- Шрифты -----------------------------------------------------------------
+\AtBeginDocument{%
+ \setromanfont{Roboto}%
+ \setsansfont[BoldFont={Roboto Medium}]{Roboto}%
+ \setmonofont{Roboto Mono}%
+}
+
+% --- Цвета ------------------------------------------------------------------
+\definecolor{pgpro@blue}{HTML}{142D99}
+\definecolor{pgpro@gray}{HTML}{EFEFF2}
+\definecolor{pgpro@divider}{HTML}{D4D4DC}
+\definecolor{pgpro@muted}{HTML}{ADADBC}
+
+% --- Титульный слайд: заголовок ---------------------------------------------
+% Заголовок 1: Roboto Medium, 40 pt
+\setbeamercolor*{title page header}{fg=white}
+\setbeamerfont*{title}{size*={40pt}{1.1},family=\sffamily,series=\bfseries}
+
+% --- Титульный слайд: подзаголовок ------------------------------------------
+% Располагается под заголовком, Regular, чуть меньше
+\definecolor{pgpro@subtitle}{HTML}{889BEF}
+\setbeamercolor*{subtitle}{fg=pgpro@subtitle}
+\setbeamerfont*{subtitle}{size*={20pt}{1.2},family=\sffamily}
+
+% --- Титульный слайд: автор -------------------------------------------------
+% Текст 1: Roboto Regular, 14 pt
+\setbeamercolor*{author}{fg=white}
+\setbeamerfont*{author}{size*={14pt}{1.3},family=\sffamily}
+
+% --- Титульный слайд: byline (должность) ------------------------------------
+% Текст 2: Roboto Regular, 12 pt
+\setbeamercolor*{byline}{fg=white}
+\setbeamerfont*{byline}{size*={12pt}{1.3},family=\sffamily}
+
+% --- Заголовок фрейма -------------------------------------------------------
+% Заголовок 2: Roboto Medium, 28 pt
+\setbeamercolor*{frametitle}{fg=pgpro@blue}
+\setbeamerfont*{frametitle}{size*={28pt}{1.1},family=\sffamily,series=\bfseries}
+
+% --- Основной текст ---------------------------------------------------------
+\setbeamercolor{normal text}{fg=pgpro@blue}
+\setbeamerfont{normal text}{size*={21pt}{1.95},family=\sffamily}
+\AtBeginDocument{\usebeamerfont{normal text}}
+
+% --- Списки -----------------------------------------------------------------
+\setbeamertemplate{itemize items}{\textbullet}
+\setbeamercolor{itemize/enumerate body}{fg=pgpro@blue}
+\setbeamerfont{itemize/enumerate body}{size*={21pt}{1.95},family=\sffamily}
+\addtobeamertemplate{itemize/enumerate body begin}{%
+ \setlength{\itemsep}{10.5pt}%
+}{}
+
+% --- Блоки ------------------------------------------------------------------
+\setbeamercolor{block title}{fg=white,bg=pgpro@blue}
+\setbeamercolor{block body}{fg=pgpro@blue,bg=pgpro@gray}
+
+\mode<all>
--- /dev/null
+% PgPro 2025 — внутренняя тема: фоны и шаблон титульного слайда
+\mode<presentation>
+
+\usetikzlibrary{calc}
+
+\setbeamertemplate{background}{
+ \begin{tikzpicture}
+ \ifnum\thepage=1\relax%
+ \node[anchor=south west,inner sep=0] at (0,0)
+ {\includegraphics[width=\the\paperwidth,height=\the\paperheight]%
+ {pgpro2025.theme/bgpics/title_bg}};
+ \fi
+ \ifnum\thepage>1\relax%
+ \node[anchor=south west,inner sep=0] at (0,0)
+ {\includegraphics[width=\the\paperwidth,height=\the\paperheight]%
+ {pgpro2025.theme/bgpics/page_bg}};
+ \node[anchor=east] at (\textwidth+1cm,0.5cm)
+ {\color{pgpro@muted}\tiny\insertframenumber};
+ \fi
+ \end{tikzpicture}
+}
+
+% Шаблон титульной страницы
+% Координаты абсолютные от верхнего края слайда через current page.north west.
+% Требует двух прогонов xelatex (remember picture).
+% Блок 1: Заголовок + Подзаголовок, верх на 0.52″ от верха слайда
+% Блок 2: Автор + Должность, верх на 6.34″ от верха слайда
+\defbeamertemplate*{title page}{PgPro2025}[1][]
+{%
+ \begin{tikzpicture}[remember picture, overlay]
+ % Блок 1: Заголовок + Подзаголовок
+ \node[anchor=north west, text width=\paperwidth-1.33cm-1.03cm, align=left]
+ at ($(current page.north west) + (1.33cm, -0.52in - 1cm)$) {%
+ {\usebeamerfont{title}\usebeamercolor[fg]{title page header}\inserttitle}%
+ \ifx\insertsubtitle\@empty\else\\[0.3cm]%
+ {\usebeamerfont{subtitle}\usebeamercolor[fg]{subtitle}\insertsubtitle}%
+ \fi%
+ };
+ % Блок 2: Автор + Должность
+ \node[anchor=north west, text width=\paperwidth-1.33cm-1.03cm, align=left]
+ at ($(current page.north west) + (1.33cm, -6.34in)$) {%
+ {\usebeamerfont{author}\usebeamercolor[fg]{author}\insertauthor}%
+ \ifx\insertinstitute\@empty\else\\[0.15cm]%
+ {\usebeamerfont{institute}\usebeamercolor[fg]{institute}\insertinstitute}%
+ \fi%
+ };
+ \end{tikzpicture}%
+}
+
+\mode<all>
--- /dev/null
+% PgPro 2025 — внешняя тема
+\mode<presentation>
+
+\setbeamertemplate{frametitle}{%
+ \vskip1.4cm%
+ \begin{beamercolorbox}[wd=\paperwidth,leftskip=1.33cm]{frametitle}%
+ \usebeamerfont{frametitle}\insertframetitle%
+ \end{beamercolorbox}%
+ \vskip0.5cm%
+}
+
+\mode<all>
--- /dev/null
+% PgPro 2025 Beamer Theme
+% Логическая структура основана на beamerthemePgPro (gcr2019 derived)
+% Визуальный стиль — корпоративный шаблон Postgres Pro 2025
+\mode<presentation>
+
+\RequirePackage{tikz}
+\RequirePackage{etoolbox}
+
+% Контент фреймов прижат к верху (аналог [t] для всех фреймов).
+% \beamer@frametopskip=0pt в преамбуле не работает: Beamer сбрасывает
+% его в значение «0pt plus 1fill» при каждом \begin{frame} (default [c]).
+% Поэтому ставим [t] принудительно перед каждым фреймом.
+\BeforeBeginEnvironment{frame}{\setkeys{beamerframe}{t}}
+
+% Размер слайда = размеру фоновых PDF (960×540 bp)
+% Патчим внутренние переменные Beamer напрямую,
+% т.к. они кэшируются при загрузке класса до загрузки темы
+\makeatletter
+\setlength{\paperwidth}{960bp}
+\setlength{\paperheight}{540bp}
+\setlength{\beamer@paperwidth}{960bp}
+\setlength{\beamer@paperheight}{540bp}
+\makeatother
+
+\useinnertheme{PgPro2025}
+\useoutertheme{PgPro2025}
+\usecolortheme{PgPro2025}
+
+\setbeamertemplate{navigation symbols}{}
+\setbeamertemplate{blocks}[rounded][shadow=true]
+\setbeamertemplate{footline}{\vspace{1cm}}
+
+% Охранное поле — после переопределения размеров
+\setbeamersize{text margin left=1.33cm,text margin right=1.03cm}
+
+\mode<all>
--- /dev/null
+\makeatletter
+\def\input@path{{./pgpro2025.theme/}}
+\makeatother
+\usetheme{PgPro2025}
--- /dev/null
+\mode<presentation>
+
+% Settings
+\AtBeginDocument{\setromanfont{Times New Roman}}
+\AtBeginDocument{\setsansfont{Gilroy}}
+\AtBeginDocument{\setmonofont{Consolas}}
+\setbeamercolor*{title page header}{fg=white}
+\setbeamerfont*{title}{size*={32pt}{1},family=\sffamily}
+\setbeamercolor*{author}{fg=white}
+\setbeamerfont*{author}{size*={18pt}{1},family=\sffamily}
+\setbeamercolor*{frametitle}{fg=cyan}
+\setbeamerfont*{frametitle}{size*={22pt}{1},family=\sffamily,series=\bfseries}
+%\definecolor{text}{HTML}{595959}
+\definecolor{text}{HTML}{000000}
+\setbeamercolor{normal text}{fg=text}
+\setbeamerfont{normal text}{size*={12pt}{18},family=\sffamily}
+\AtBeginDocument{\usebeamerfont{normal text}}
+\setbeamertemplate{itemize items}{\textbullet}% отключает кошмарные синие треугольники
+\setbeamercolor{itemize/enumerate body}{fg=text}
+\mode
+<all>
--- /dev/null
+\mode<presentation>
+
+\setbeamertemplate{background}{
+ \begin{tikzpicture}
+ \ifnum\thepage=1\relax%
+ \node[anchor=south west,inner sep=0] at (0,0) {\includegraphics[width=\the\paperwidth, height=\the\paperheight]{theme.nonfree/bgpics/pgpro_title_bg.png}};
+ \fi
+ \ifnum\thepage>1\relax%
+ \node[anchor=south west, inner sep=0] at (0,0) {\includegraphics[width=\the\paperwidth, height=\the\paperheight]{theme.nonfree/bgpics/pgpro_page_bg.png}};
+ \node[anchor=east] at(\textwidth+1cm,0.5cm) {\color{text}\tiny\insertframenumber};
+ \fi
+ \end{tikzpicture}
+}
+
+% Title page
+\defbeamertemplate*{title page}{gcr2019}[1][]
+{
+ \vskip3cm%
+ \begin{beamercolorbox}[leftskip=0.7cm,left,#1]{title page header}
+ \usebeamerfont{title}\inserttitle\par%
+ \end{beamercolorbox}%
+ \vskip0.75cm%
+ \begin{beamercolorbox}[leftskip=0.7cm,left,#1]{author}
+ \usebeamerfont{author}\insertauthor%
+ \end{beamercolorbox}
+ \vspace{9cm}
+}
+
+\mode
+<all>
--- /dev/null
+\mode<presentation>
+
+% Frame title
+\defbeamertemplate*{frametitle}{gcr2019}[1][]
+{
+ \vskip1cm
+ \begin{beamercolorbox}[wd=\paperwidth,leftskip=0.7cm]{frametitle}
+ \usebeamerfont{frametitle}%
+ \insertframetitle
+ \end{beamercolorbox}
+}
+
+\mode<all>
\ No newline at end of file
--- /dev/null
+% Based on gcr2019 theme (https://github.com/schors/gcr2019theme)
+% Used backghround pictures from template https://confluence.postgrespro.ru/download/attachments/169509420/_PostgresPro_ШАБЛОН.odp?version=1&modificationDate=1675418955114&api=v2
+% and Gilroy font from https://oc.postgrespro.ru/index.php/s/oXFIYT9dLwLCle6
+\mode<presentation>
+
+% Requirement
+\RequirePackage{tikz}
+
+% Settings
+\useinnertheme{PgPro}
+\useoutertheme{PgPro}
+\usecolortheme{PgPro}
+
+\setbeamertemplate{navigation symbols}{}
+\setbeamertemplate{blocks}[rounded][shadow=true]
+\setbeamertemplate{footline}{\vspace{1cm}}
+\setbeamersize{text margin left=0.7cm,text margin right=0.7cm}
+
+\mode<all>
--- /dev/null
+\makeatletter
+\def\input@path{{./theme.nonfree}}
+\makeatother
+\usetheme{PgPro}
+
--- /dev/null
+pgpro2025.theme/theme_setup.tex
\ No newline at end of file
FONTCONFIG_FILE="$(FONTS_DIR)/fonts.conf" fc-cache
# Надо в два прохода
- FONTCONFIG_FILE="$(FONTS_DIR)/fonts.conf" xelatex example.tex
- FONTCONFIG_FILE="$(FONTS_DIR)/fonts.conf" xelatex example.tex
+ #FONTCONFIG_FILE="$(FONTS_DIR)/fonts.conf" xelatex -interaction=nonstopmode example.tex
+ #FONTCONFIG_FILE="$(FONTS_DIR)/fonts.conf" xelatex -interaction=nonstopmode example.tex
+ FONTCONFIG_FILE="$(FONTS_DIR)/fonts.conf" xelatex example.tex
+ FONTCONFIG_FILE="$(FONTS_DIR)/fonts.conf" xelatex example.tex
make clean
clean:
\usepackage[russian]{babel}
\usepackage[utf8]{inputenc}
- % Цвета для гиперссылок
- \definecolor{linkcolor}{HTML}{799B03} % цвет ссылок
- \definecolor{urlcolor}{HTML}{6633FF} % цвет гиперссылок
-
- \hypersetup{pdfstartview=FitH, linkcolor=linkcolor,urlcolor=urlcolor, colorlinks=true}
+\definecolor{linkcolor}{HTML}{799B03}
+\definecolor{urlcolor}{HTML}{6633FF}
+\hypersetup{pdfstartview=FitH, linkcolor=linkcolor, urlcolor=urlcolor, colorlinks=true}
-\title{Название презентации}
-\subtitle{Подзаголовок презентации}
-\author{Константин Констанинович Константинопольский}
-\institute{Шамбала, Гималаи, май 2026}
-
-
-\input{theme_setup.tex} % Подгружаем тему из файла
+\title{Как работает fuzzing-тестирование}
+\subtitle{Рассказ простым языком}
+\author{Николай Шаплов \\ {\small иллюстрации: Николай Шаплов, Дина Табосская}}
+\institute{Postgres Professional}
+\input{theme_setup.tex}
\input{elements/code.tex}
\begin{document}
+% Сгенерировано автоматически из Основы_фаззинга_v2025-04.odp
+
+
+% ============================================================
+% Слайд 1: Титульный
+% ============================================================
\begin{frame}
-\titlepage
+ \titlepage
+\end{frame}
+
+% ==========================================================
+% Слайд 2: Postgres Professional
+% ==========================================================
+\begin{frame}{Postgres Professional}
+ \begin{itemize}
+ \item Откуда я
+ \item отечественная СУБД на основе PostgreSQL;
+ \item разработка производных продуктов;
+ \item поддержка;
+ \item сертифицированная версия.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Слайд 3: Жизненный цикл безопасной разработки
+% ==========================================================
+\begin{frame}{Жизненный цикл безопасной разработки}
+ \begin{itemize}
+ \item SDL – Security Development Lifecycle
+ \item ...
+ \item V. Верификация
+ \item статический анализ;
+ \item динамический анализ;
+ \item фаззинг-тестирование.
+ \item ...
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Слайд 4: Жизненный цикл безопасной разработки
+% ==========================================================
+\begin{frame}{Жизненный цикл безопасной разработки}
+ \textbf{SDL – Security Development Lifecycle}
+ \par\vspace{0.1cm}
+ \begin{itemize}\small
+ \item ...
+ \item V. Верификация
+ \item статический анализ;
+ \item динамический анализ
+ \item фаззинг тестирование
+ \item ...
+ \item на-столе-демотиватор
+ \end{itemize}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/na-stole-demotivator.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 5: План доклада
+% ==========================================================
+\begin{frame}{План доклада}
+ \begin{itemize}
+ \item от модульного тестирования к фаззинг-тестированию:
+ \item общая идея фаззинга;
+ \item санитайзеры;
+ \item инструментация трасс;
+ \item стратегия фаззера.
+ \item наглядные примеры;
+ \item расширяя возможности фаззинга.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Слайд 6: Приборы и материалы
+% ==========================================================
+\begin{frame}{Приборы и материалы}
+ \begin{itemize}
+ \item доступ к исходному коду;
+ \item программа на компилируемом языке (C/C++);
+ \item компилятор: clang + обертки afl-clang-fast и afl-clang-lto;
+ \item фаззер: AFL++.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Слайд 7: Fuzzing
+% ==========================================================
+\begin{frame}{Fuzzing}
+ \begin{itemize}
+ \item Что такое фаззинг?
+ \item (веселые картинки)
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Слайд 8: Как мы обычно тестируем
+% ==========================================================
+\begin{frame}{Как мы обычно тестируем}
+ {\small Модульное тестирование}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/scheme-slide8.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 9: Тестирование всех возможных вариантов
+% ==========================================================
+\begin{frame}{Тестирование всех возможных вариантов}
+ {\small Как хотелось бы}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/X-fx-Y.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 10: Тестирование всех возможных вариантов
+% ==========================================================
+\begin{frame}{Тестирование всех возможных вариантов}
+ {\small Как на самом деле можем}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/Xx-fx-Yy.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 11: Тестирование всех возможных вариантов
+% ==========================================================
+\begin{frame}{Тестирование всех возможных вариантов}
+ {\small А как проверить правильность результата?}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/Xx-fx-Yy-eq.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 12: Тестирование всех возможных вариантов
+% ==========================================================
+\begin{frame}{Тестирование всех возможных вариантов}
+ {\small Бывают эталонные/альтернативные реализации}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/Xx-fx-Yy-fuzz.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 13: Тестирование всех возможных вариантов
+% ==========================================================
+\begin{frame}{Тестирование всех возможных вариантов}
+ {\small Санитайзеры: косвенная проверка правильности работы}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/Xx-fx-Yy-sanitizers.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 14: Проверки добавляются на этапе компиляции
+% ==========================================================
+\begin{frame}{Проверки добавляются на этапе компиляции}
+ \begin{itemize}
+ \item Санитайзеры
+ \item ASan – Address Sanitizer
+ \item UBSan – Undefined Behavior Sanitizer
+ \item …
+ \item Напиши свою проверку!
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Слайд 15: На этапе компиляции добавляются проверки
+% ==========================================================
+\begin{frame}{На этапе компиляции добавляются проверки}
+ {\small Санитайзеры}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/ASan_screenshot.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 16: На этапе компиляции добавляются проверки
+% ==========================================================
+\begin{frame}{На этапе компиляции добавляются проверки}
+ {\small Санитайзеры}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/ASan_screenshot.png}
\end{frame}
-\begin{frame}[t]{Первый слайд}
- Какой-то список
+% ==========================================================
+% Слайд 17: На этапе компиляции добавляются проверки
+% ==========================================================
+\begin{frame}{На этапе компиляции добавляются проверки}
+ {\small Санитайзеры}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/ASan_screenshot.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 18: На этапе компиляции добавляются проверки
+% ==========================================================
+\begin{frame}{На этапе компиляции добавляются проверки}
+ {\small Санитайзеры}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/ASan_screenshot.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 19: Fuzzer
+% ==========================================================
+\begin{frame}{Fuzzer}
+ {\small Программа, которая обеспечивает тестирование}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/fuzzer-Xx-fx.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 20: Fuzzer
+% ==========================================================
+\begin{frame}{Fuzzer}
+ {\small К сожалению, не знает ничего о множестве входных данных}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/fuzzer-all-data-fx.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 21: Исследователь готовит набор входных данных, покрывающих всю
+% ==========================================================
+\begin{frame}{Исследователь готовит набор входных данных, покрывающих всю функциональность, фаззер «случайным» образом меняет их}
+ {\small Набор сэмплов и мутации}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/scheme-slide21.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 22: Мутация jpeg-файла в процессе фаззинга
+% ==========================================================
+\begin{frame}{Мутация jpeg-файла в процессе фаззинга}
+ {\small Fuzzer - мутации}
+ \par\vspace{0.1cm}
+ \centering
+ % TODO: анимированный GIF — конвертировать в PNG/PDF вручную
+ % \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/AFL_Fuzz_Logo.gif}
+\end{frame}
+
+% ==========================================================
+% Слайд 23: Некоторые из алгоритмов мутаций
+% ==========================================================
+\begin{frame}{Некоторые из алгоритмов мутаций}
\begin{itemize}
- \item Элемент 1
- \item Элемент 2
- \item Элемент 3
- \item Элемент 4
+ \item Fuzzer - мутации
+ \item bitflip — рандомно передергивает биты;
+ \item arith — случайные арифметические операции;
+ \item extras — вставка слов из словаря;
+ \item havoc — комплексный алгоритм. Включает в т.ч. блоковые операции:
+ \item дупликация;
+ \item удаление;
+ \item замена случайными данными.
\end{itemize}
\end{frame}
-\begin{frame}{Схемка}
- \input{elements/diag.tex}
- \resizebox{\textwidth}{!}{
- \begin{tikzpicture}[start chain, node distance=15mm and 12mm] % начало цепочки
- \node (client)[Ellipse, bottom color=cyan]{Клиент};
- \node (element1)[Rectangle, right= of client]{Элемент 1};
- \node (element2)[Rectangle, right=of element1]{Элемент 2};
- \node (element3)[Rectangle, right=of element2]{Элемент 3};
+% ==========================================================
+% Слайд 24: Fuzzing
+% ==========================================================
+\begin{frame}{Fuzzing}
+ {\small Полная схема}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/full-scheme.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 25: Fuzzing
+% ==========================================================
+\begin{frame}{Fuzzing}
+ {\small Полная схема}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/full-scheme-red.png}
+\end{frame}
- \node (data)[Ellipse, below=of client]{Данные};
- \node (log1)[Rounded, below=of element1, align=center]{Текст 1\\Текст 2};
- \node (log2)[Rounded, below=of element2, align=center]{Текст 3\\Текст 4};
- \node (export)[Rounded, below=of element3, align=center]{Текст 5\\Текст 6};
- \path[->] (element1) edge (log1);
- \path[->] (element2) edge (log2);
- \path[->] (element3) edge (export);
+% ==========================================================
+% Слайд 26: Fuzzing — покрытие трассами
+% ==========================================================
+\begin{frame}{Fuzzing — покрытие трассами}
+ \begin{itemize}
+ \item Базовый блок — набор процессорных инструкций:
+ \item выполняются последовательно;
+ \item отсутствуют ветвления и условные переходы;
+ \item передачи управления извне, только в начало блока.
+ \end{itemize}
+\end{frame}
- \node (pgpro)[Ellipse, below=of data, bottom color=cyan]{PostgresPro};
- \node (element4)[Rectangle, below=of log2]{Элемент 4};
- \path[->] (log1) edge (element4);
- \path[->] (log2) edge (element4);
- \path[->] (export) edge (element4);
- \end{tikzpicture} % конец блока
- }
+% ==========================================================
+% Слайд 27: Fuzzing — покрытие трассами
+% ==========================================================
+\begin{frame}{Fuzzing — покрытие трассами}
+ \begin{itemize}
+ \item Трасса выполнения — последовательность базовых блоков, которые были выполнены при конкретном запуске программы.
+ \end{itemize}
\end{frame}
-\begin{frame}[fragile, shrink=10]{Еще слайд}
- Опять список:
+% ==========================================================
+% Слайд 28: Fuzzing — покрытие трассами
+% ==========================================================
+\begin{frame}{Fuzzing — покрытие трассами}
\begin{itemize}
- \item Элемент 1
- \item Пример ссылки (\href{https://postgrespro.ru}{https://postgrespro.ru}) \\~\\
- \end{itemize}
+ \item Инструменты разметки (инструментации) трасс из комплекта AFL++:
+ \item afl-clang-fast
+ \item afl-clang-lto
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Слайд 29: Fuzzing
+% ==========================================================
+\begin{frame}{Fuzzing}
+ {\small Полная схема}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/full-scheme.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 30: Как долго фаззить?
+% ==========================================================
+\begin{frame}{Как долго фаззить?}
+ \begin{itemize}
+ \item Fuzzing — стратегия
+ \textbf{Основные ориентиры:}
+ \par
+ \item времени работы / кол-во запусков;
+ \item время с момента нахождения последней новой трассы.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Слайд 31: Fuzzing
+% ==========================================================
+\begin{frame}{Fuzzing}
+ \begin{itemize}
+ \item Практический пример
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Слайд 32: Простая исследуемая функция
+% ==========================================================
+\begin{frame}[fragile]{Простая исследуемая функция}
+ \textbf{Как это выглядит на практике}
+ \par\vspace{0.3cm}
+ \begin{lstlisting}[language=C]
+void function_to_fuzz(char *str)
+{
+if (str[0] == 'C')
+if (str[1] == 'R')
+if (str[2] == 'A')
+if (str[3] == 'S')
+if (str[4] == 'H')
+abort(); /* Аварийное завершение */
+}
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Слайд 33: Создаем «модуль» тестирования
+% ==========================================================
+\begin{frame}[fragile]{Создаем «модуль» тестирования}
+ \textbf{Как это выглядит на практике}
+ \par\vspace{0.3cm}
+ \begin{lstlisting}[language=C]
+int main(int argc, char** argv)
+{
+char buf[100];
+read(0, buf, sizeof(buf)); /* Read data from STDIN */
+function_to_fuzz(buf);
+}
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Слайд 34: Собираем и проверяем
+% ==========================================================
+\begin{frame}[fragile]{Собираем и проверяем}
+ \textbf{Как это выглядит на практике}
+ \par\vspace{0.3cm}
+ \begin{lstlisting}[language=bash]
+$ AFL_USE_ASAN=1 AFL_USE_UBSAN=1 afl-clang-fast test1.c
+....
+$ echo TEST | ./a.out
+$ echo CRASH_123 | ./a.out
+Недопустимая инструкция
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Слайд 35: Запускаем фаззинг
+% ==========================================================
+\begin{frame}[fragile]{Запускаем фаззинг}
+ \textbf{Как это выглядит на практике}
+ \par\vspace{0.3cm}
+ \begin{lstlisting}[language=bash]
+echo 0 >/proc/sys/kernel/randomize_va_space # так надо!
+$ mkdir in
+$ echo TEST > in/initial_sample
+$ afl-fuzz -i in -o out ./a.out
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Слайд 36: Ждем результатов
+% ==========================================================
+\begin{frame}{Ждем результатов}
+ {\small Как это выглядит на практике}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/AFL-fuzz-status.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 37: Ждем результатов
+% ==========================================================
+\begin{frame}{Ждем результатов}
+ {\small Как это выглядит на практике}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/AFL-fuzz-status.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 38: Ждем результатов
+% ==========================================================
+\begin{frame}{Ждем результатов}
+ {\small Как это выглядит на практике}
+ \par\vspace{0.1cm}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/AFL-fuzz-status.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 39: Анализ. Директория рабочих сэмплов out/default/queue/
+% ==========================================================
+\begin{frame}[fragile]{Анализ. Директория рабочих сэмплов out/default/queue/}
+ \textbf{Как это выглядит на практике}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}
+id:000000,time:0,orig:1
+TEST
+id:000001,src:000000,time:6,op:havoc,rep:16,+cov
+C
+id:000002,src:000001,time:5094,op:havoc,rep:4,+cov
+CR
+id:000003,src:000002,time:61199,op:havoc,rep:2,+cov
+CRAR
+id:000004,src:000003,time:66276,op:havoc,rep:2,+cov
+CRAS
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Слайд 40: Анализ. Директория рабочих сэмплов out/default/queue/
+% ==========================================================
+\begin{frame}[fragile]{Анализ. Директория рабочих сэмплов out/default/queue/}
+ \textbf{Как это выглядит на практике}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}
+id:000000,time:0,orig:1
+TEST
+id:000001,src:000000,time:6,op:havoc,rep:16,+cov
+C
+id:000002,src:000001,time:5094,op:havoc,rep:4,+cov
+CR
+id:000003,src:000002,time:61199,op:havoc,rep:2,+cov
+CRAR
+id:000004,src:000003,time:66276,op:havoc,rep:2,+cov
+CRAS
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Слайд 41: Анализ. Директория рабочих сэмплов out/default/queue/
+% ==========================================================
+\begin{frame}[fragile]{Анализ. Директория рабочих сэмплов out/default/queue/}
+ \textbf{Как это выглядит на практике}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}
+id:000000,time:0,orig:1
+TEST
+id:000001,src:000000,time:6,op:havoc,rep:16,+cov
+C
+id:000002,src:000001,time:5094,op:havoc,rep:4,+cov
+CR
+id:000003,src:000002,time:61199,op:havoc,rep:2,+cov
+CRAR
+id:000004,src:000003,time:66276,op:havoc,rep:2,+cov
+CRAS
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Слайд 42: Анализ. Директория рабочих сэмплов out/default/queue/
+% ==========================================================
+\begin{frame}[fragile]{Анализ. Директория рабочих сэмплов out/default/queue/}
+ \textbf{Как это выглядит на практике}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}
+id:000000,time:0,orig:1
+TEST
+id:000001,src:000000,time:6,op:havoc,rep:16,+cov
+C
+id:000002,src:000001,time:5094,op:havoc,rep:4,+cov
+CR
+id:000003,src:000002,time:61199,op:havoc,rep:2,+cov
+CRAR
+id:000004,src:000003,time:66276,op:havoc,rep:2,+cov
+CRAS
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Слайд 43: Анализ. Директория рабочих сэмплов out/default/queue/
+% ==========================================================
+\begin{frame}[fragile]{Анализ. Директория рабочих сэмплов out/default/queue/}
+ \textbf{Как это выглядит на практике}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}
+id:000000,time:0,orig:1
+TEST
+id:000001,src:000000,time:6,op:havoc,rep:16,+cov
+C
+id:000002,src:000001,time:5094,op:havoc,rep:4,+cov
+CR
+id:000003,src:000002,time:61199,op:havoc,rep:2,+cov
+CRAR
+id:000004,src:000003,time:66276,op:havoc,rep:2,+cov
+CRAS
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Слайд 44: Анализ. Директория рабочих сэмплов out/default/queue/
+% ==========================================================
+\begin{frame}[fragile]{Анализ. Директория рабочих сэмплов out/default/queue/}
+ \textbf{Как это выглядит на практике}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}
+id:000000,time:0,orig:1
+TEST
+id:000001,src:000000,time:6,op:havoc,rep:16,+cov
+C
+id:000002,src:000001,time:5094,op:havoc,rep:4,+cov
+CR
+id:000003,src:000002,time:61199,op:havoc,rep:2,+cov
+CRAR
+id:000004,src:000003,time:66276,op:havoc,rep:2,+cov
+CRAS
+ \end{lstlisting}
+\end{frame}
- Пример кода:
- \begin{lstlisting}[linewidth=0.9\textwidth]
- pip install -r requirements.txt
+% ==========================================================
+% Слайд 45: Анализ. Директория аварийных сэмплов out/default/crashes/
+% ==========================================================
+\begin{frame}[fragile]{Анализ. Директория аварийных сэмплов out/default/crashes/}
+ \textbf{Как это выглядит на практике}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}
+id:000000,sig:04,src:000004,time:133872,op:havoc,rep:2 CRASHSSS
\end{lstlisting}
\end{frame}
-{\setbeamertemplate{background}{
- \begin{tikzpicture}
- \node[anchor=south west, inner sep=0] at (0,0) {\includegraphics[width=\the\paperwidth, height=\the\paperheight]{theme.nonfree/bgpics/pgpro_title_bg2.png}};
- \node[anchor=east] at(\textwidth+1cm,0.5cm) {\color{white}\tiny\insertframenumber};
- \end{tikzpicture}
- }
- \setbeamercolor{normal text}{fg=white}\usebeamercolor*{normal text}
- \setbeamerfont{normal text}{size*={32pt}{1},family=\sffamily}\usebeamerfont*{normal text}
- \begin{frame}
- \vskip1cm
- Демонстрация
- \end{frame}
- \begin{frame}
- \vskip1cm
- Q\&A
- \end{frame}
+% ==========================================================
+% Слайд 46: Persistent mode: быстрее, выше, сильнее
+% ==========================================================
+\begin{frame}[fragile]{Persistent mode: быстрее, выше, сильнее}
+ \textbf{Как это выглядит на практике}
+ \par\vspace{0.3cm}
+ \begin{lstlisting}[language=C]
+int main(int argc, char** argv)
+{
+char buf[100];
+FILE * f;
+if (argc<2)
+{
+fprintf(stderr,"Please specify input file name as first argument\n");
+return 1;
+}
+while(__AFL_LOOP(1000))
+{
+f = fopen(argv[1], "r");
+if(!f)
+{
+fprintf(stderr,"Error opening file: '%s'\n",argv[1]);
+return 1;
}
+fread(buf, 1, sizeof(buf), f);
+fclose(f);
+function_to_fuzz(buf);
+}
+}
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Слайд 47: Persistent mode: быстрее, выше, сильнее
+% ==========================================================
+\begin{frame}[fragile]{Persistent mode: быстрее, выше, сильнее}
+ \textbf{Как это выглядит на практике}
+ \par\vspace{0.3cm}
+ \begin{lstlisting}[language=bash]
+$ afl-fuzz -i in -o out ./a.out @@
+ \end{lstlisting}
+\end{frame}
+
+
+% ============================================================
+% Слайд 48: Раздел
+% ============================================================
+\begin{frame}
+ \vfill
+ \centering
+ {\Large\bfseries Расширяя возможности фаззинга}
+ \vfill
+\end{frame}
+
+% ==========================================================
+% Слайд 49: Динамическое символьное выполнение
+% ==========================================================
+\begin{frame}{Динамическое символьное выполнение}
+ \begin{itemize}
+ \item Fuzzing + DSE
+ \item Проблема: фаззер не сможет найти сэмпл, кардинально отличающийся от сэмплов из рабочего пула.
+ \item Решение: система DSE позволяет подобрать данные для попадания в неохваченные ветви исследуемой программы.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Слайд 50: Динамическое символьное выполнение
+% ==========================================================
+\begin{frame}{Динамическое символьное выполнение}
+ \begin{itemize}
+ \item Fuzzing + DSE
+ \item В DSE программа представляется как формула. Переменные — не конкретные значения, а «символы», имеющие допустимые диапазоны.
+ \item Можно пытаться «решить» формулу для подбора данных, дающих попадание в нужную ветку кода
+ \item Sydr от ИСП РАН
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Слайд 51: Structure-Aware Fuzzing
+% ==========================================================
+\begin{frame}{Structure-Aware Fuzzing}
+ \begin{itemize}
+ \item Fuzzing + SAF
+ \item Проблема: в многоуровневых системах фаззинг «нагружает» только первый уровень системы (синтаксический анализатор и т.п.)
+ \end{itemize}
+\end{frame}
-{\setbeamertemplate{background}{
- \begin{tikzpicture}
- \node[anchor=south west, inner sep=0] at (0,0) {\includegraphics[width=\the\paperwidth, height=\the\paperheight]{theme.nonfree/bgpics/pgpro_thanks_bg.png}};
- \node[anchor=east] at(\textwidth+1cm,0.5cm) {\color{white}\tiny\insertframenumber};
- \end{tikzpicture}
- }
- \begin{frame}
- \end{frame}
+% ==========================================================
+% Слайд 52: Fuzzing + SAF
+% ==========================================================
+\begin{frame}{Fuzzing + SAF}
+ \centering
+ \includegraphics[width=\textwidth, height=0.85\textheight, keepaspectratio]{images/serebtyani_screenshot.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 53: Structure-Aware Fuzzing
+% ==========================================================
+\begin{frame}{Structure-Aware Fuzzing}
+ \begin{itemize}
+ \item Fuzzing + SAF
+ \item Проблема: в многоуровневых системах фаззинг «нагружает» только первый уровень системы (синтаксический анализатор и т.п.)
+ \item Решение: генерировать синтаксически-/структурно-верные входные данные на основе «случайных» данных, полученных из фаззера.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Слайд 54: LibBlobStamper
+% ==========================================================
+\begin{frame}{LibBlobStamper}
+ \begin{itemize}
+ \item Fuzzing + SAF
+ \textbf{Требования:}
+ \par
+ \item воспроизводимость;
+ \item сохранение обратной связи с фаззером;
+ \item сохранение работоспособности DSE.
+ \textbf{Фичи:}
+ \par
+ \item абстрактный подход;
+ \item итеративное описание;
+ \item описание на тьюринг-полном языке (С++);
+ \item бинарные и строковые результаты.
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Слайд 55: LibBlobStamper
+% ==========================================================
+\begin{frame}{LibBlobStamper}
+ \begin{itemize}
+ \item Fuzzing + SAF
+ \item Свободное ПО:https://github.com/postgrespro/libblobstamper
+ \end{itemize}
+\end{frame}
+
+% ==========================================================
+% Слайд 56: I. Воспроизвести пример из презентации
+% ==========================================================
+\begin{frame}[fragile]{I. Воспроизвести пример из презентации}
+ \textbf{Самостоятельная работа}
+ \par\vspace{0.1cm}
+ \includegraphics[height=0.8cm]{images/AFL-logo-small.png}\quad
+ \url{AFL++: https://github.com/AFLplusplus/AFLplusplus}
+ \par\vspace{0.2cm}
+ \begin{lstlisting}[language=C]
+void function_to_fuzz(char *str)
+{
+if (str[0] == 'C')
+if (str[1] == 'R')
+if (str[2] == 'A')
+if (str[3] == 'S')
+if (str[4] == 'H')
+abort(); /* Аварийное завершение */
}
+ \end{lstlisting}
+\end{frame}
+
+% ==========================================================
+% Слайд 57: II. Фаззинг утилиты jq
+% ==========================================================
+\begin{frame}{II. Фаззинг утилиты jq}
+ \textbf{Самостоятельная работа}
+ \par\vspace{0.1cm}
+ \begin{itemize}\small
+ \item jq — утилита для фильтрации json-данных.
+ \item https://github.com/jqlang/jq
+ \item Произвести фаззинг процедуры чтения входных данных
+ \end{itemize}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/jq-logo.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 58: III. Фаззинг библиотеки pcre2
+% ==========================================================
+\begin{frame}{III. Фаззинг библиотеки pcre2}
+ \textbf{Самостоятельная работа}
+ \par\vspace{0.1cm}
+ \begin{itemize}\small
+ \item pcre2 — библиотека реализующая поиск по регулярному выражению.
+ \item https://github.com/PCRE2Project/pcre2
+ \item Произвести фаззинг процедуры разбора регулярного вражения и применения его к тривиальному файлу
+ \end{itemize}
+ \centering
+ \includegraphics[width=\textwidth, height=0.75\textheight, keepaspectratio]{images/pcre2-logo.png}
+\end{frame}
+
+% ==========================================================
+% Слайд 59: Чего искали и чего нашли в postgres?
+% ==========================================================
+\begin{frame}{Чего искали и чего нашли в postgres?}
+ \begin{itemize}
+ \item Fuzzing результаты
+ \textbf{AFL++/Crusher:}
+ \par
+ \item строковые представления типов (прямой фаззинг);
+ \item операции между типами (LibBlobStamper).
+ \textbf{Кастомный фаззинг:}
+ \par
+ \item перемешивание regression-тестов(\textasciitilde{}30 фиксов, 1 CVE).
+ \end{itemize}
+\end{frame}
+
+
+% ============================================================
+% Слайд 60: Фаззить просто!
+% ============================================================
+\begin{frame}{Выводы}
+ \vfill
+ {\Large\bfseries Фаззить просто!}
+ \par\vspace{0.5cm}
+ \vfill
+\end{frame}
+
+
+% ============================================================
+% Слайд 61: Фаззить нужно!
+% ============================================================
+\begin{frame}{Выводы}
+ \vfill
+ {\Large\bfseries Фаззить нужно!}
+ \par\vspace{0.5cm}
+ \vfill
+\end{frame}
+
+
+% ============================================================
+% Слайд 62: Фаззить нужно!
+% ============================================================
+\begin{frame}{Выводы}
+ \vfill
+ {\Large\bfseries Фаззить нужно!}
+ \par\vspace{0.5cm}
+ {\Large\bfseries И для вашего языка есть инструменты фаззинга,просто погуглите!}
+ \par\vspace{0.5cm}
+ \vfill
+\end{frame}
+
+
+% ============================================================
+% Слайд 63: Вопросы
+% ============================================================
+\begin{frame}{Вопросы}
+ \centering
+ \includegraphics[width=\textwidth, height=0.85\textheight, keepaspectratio]{images/voprosy.png}
+\end{frame}
+
+
+% ============================================================
+% Слайд 64: Обратная связь
+% ============================================================
+\begin{frame}{Обратная связь}
+ \begin{columns}[c]
+ \column{0.4\textwidth}
+ \centering
+ \includegraphics[width=\textwidth]{images/qr-feedback.png}
+ \column{0.6\textwidth}
+ \url{https://pgpro.pro/spbedufeedback}
+ \end{columns}
+\end{frame}
+
+
+% ============================================================
+% Слайд 65: Контакты
+% ============================================================
+\begin{frame}{Контакты}
+ \begin{itemize}
+ \item E-mail: n.shaplov@postgrespro.ru
+ \item Matrix: @dhyan:nataraj.su
+ \item Git: https://gitlab.com/dhyannataraj
+ \item Nikolay Shaplov (Postgres Professional)
+ \end{itemize}
+\end{frame}
+
\end{document}
--- /dev/null
+pgpro2025.theme/theme_setup.tex
\ No newline at end of file
projects / articles.git / commitdiff
