How to mine antivirus software vulnerabilities

How to mine antivirus software vulnerabilities

A: "I heard that your University major is information security ?"

B: "Yes, lead ."
A: "Well, install an anti-virus software ."
B: "Leaders, please respect this major. Information security is ......"
A: "Could you tell me how to discover security vulnerabilities in anti-virus software ?"
B: "Leaders, which one should install to kill software ?"
Question: How can I mine the vulnerabilities of the Anti-Virus engine?

I have been conducting virus analysis for more than three years and have never published any articles related to the anti-virus engine. Let's publish one today. The idea is confusing.
I Open qq every day and various qq groups are talking about how to use xxxx anti-virus software? How do I eliminate the virus? Some people say that anti-virus software is a laser gun, and viruses are an enemy. A killer is the scanning track of a laser gun, and a virus escape track. A good killer can kill a large number of enemies, while a good killer is to put the enemy on a hidden layer to escape the damage of a laser gun. Of course, sometimes laser guns will hurt some good people. In short, the laser gun is able to hurt people, whether it hurts good people or bad people. This is the problem with the laser gun. In fact, sometimes it is not a good solution to avoid problems. Especially for good people. If there is such a dress, it is not invisible, but a mirror. When the laser gun scans him, the laser will return, and then the laser will destroy itself. That would be interesting.

The Anti-Virus engine is the core of anti-virus software, and its complexity can be imagined. Only the most advanced personnel in antivirus companies can act as engine developers. Unfortunately, I am not familiar with the engine layer after three years of mixing in the anti-virus field. Therefore, this article may seem like a shift. I hope it will not be sprayed.
In addition to the pe format, anti-virus software can also process programs in various file formats. For example, anti-virus software involves office files when detecting and killing vulnerability samples. Flash files. Resolution of various images, sounds, and other files. There may be logical defects in the parsing process. In addition, when anti-virus software detects and removes Shell programs, it first shells the programs. When the installation package program is encountered, various package files of the installation package will be parsed. When performing infectious repair, the infected virus will be judged and modified. When processing various script Trojans, the script will be parsed and the information will be read ...... In short, anti-virus software processes various file formats. Is there a vulnerability in file format processing?

Therefore, we can start with these file formats and construct a sample with enough malformed data to make the antivirus software error when attacking us. Cause a crash.

How do I select an attack target?

First, select a remote file format. Common file formats should not be selected as targets. Anti-virus software vendors have made in-depth research on common file formats. The code is relatively sound, and finding a vulnerability is not easy.

Second, you can choose to mine new functions. Because the new function test may not be sufficient, the probability of a problem is higher.

Finally, fuzz may be better performed on various vulnerability samples. Especially new vulnerabilities. In particular, the exclusive killing tools for such vulnerabilities may have more problems.

Previously, fuzz was used to detect the Memory Corruption Vulnerability of the antivirus engine of 360 anti-virus software and 360 security guard. Has been sent to a vulnerability platform. This vulnerability has been fixed by 360 so far. Http://www.wooyun.org/bugs/wooyun-2014-085791

This vulnerability can be found through Easyfuzzer.

EasyFuzzer makes Fuzz easier