androidpythonsecurityfuzzingprocess-monitoring

Process monitoring on Android while fuzzing

In fuzzing, an important part is to monitor the targeted (attacked) process for any crash and keep recording crash details. Sulley is a fuzzing framework mainly intended to work in Linux and Windows and written Python. I am planning to port it to Android using Kivy as example, however I am wondering if the process monitor will work properly on Android as I except process monitoring on Android has different approach? Any advice on this?

Solution

  • Tl;dr: No

    Sulley uses pydbg, a "pure-python win32 debugger interface." So, no, it will probably not work.

    Sulley's process_monitor_unix.py seems to just run and monitor the process.

    Alternatives

    1. You might look into ways to hook into Android's debugging features. It may be possible to interact programmatically, and therefore create an Android process monitor.
    2. You can always run Sulley without a process monitor. If Sulley ends up hanging or crashing, it would indicate a potential crash.
    3. boofuzz, a Sulley derivative (full disclosure: I maintain boofuzz) will treat non-responses and broken connections as failures.