Title: Protocol-level transaction fuzzing tool Post by: Gavin Andresen on January 17, 2012, 11:19:14 PM I did some work today that should be useful to stress-test transaction handling for alternative bitcoin implementations:
https://github.com/gavinandresen/bitcoin-git/tree/fuzzer From its README.md: Hacked version of Bitcoin that adds a "relayfuzzed" command. Note: this only works on the testnet. USING THIS CODE First, create one or more transactions using the send* RPC commands, and remember their transaction IDs. This version of bitcoin is modified so 'original' wallet transactions are not announced to the network. Then, you can generate as many "fuzzed" variations as you like using the relayfuzzed command, which takes a transaction ID and an integer to seed a random number generator. Example usage from a bash prompt: Code: # Run two bitcoind's that talk to each other: THINGS TO BE AWARE OF You will trigger the denial-of-service-prevention code using this. If you are running a "testnet-in-a-box" setup (see https://sourceforge.net/projects/bitcoin/files/Bitcoin/testnet-in-a-box/) then you don't have to worry, nodes running on localhost don't disconnect each other for bad behavior. Otherwise, you can run bitcoind with -banscore=999999 to avoid being disconnected. Running the code being tested under Valgrind or Purify or another memory-corruption detection tool is a good idea. Types of "high-level" fuzzing done: Insert random opcodes at the front of the transactions's scriptSig(s) Types of "low-level" fuzzing done: Change bit in one of the transaction's bytes Delete one or more bytes Insert one or more random bytes TODO: Generate mostly-random scriptSig/scriptPubkey pairs that validate, and generate pairs/chains of valid transactions that spend them. Title: Re: Protocol-level transaction fuzzing tool Post by: Red Emerald on February 02, 2012, 01:54:35 AM Have you found any cool vulnerabilities with this?
Title: Re: Protocol-level transaction fuzzing tool Post by: Gavin Andresen on February 02, 2012, 02:17:48 PM Have you found any cool vulnerabilities with this? No, bitcoind is solid as a rock, both with and without the BIP 16 patches applied. |