ToothPicker Description
ToothPicker serves as an innovative in-process, coverage-guided fuzzer specifically designed for iOS, focusing on the Bluetooth daemon and various Bluetooth protocols. Utilizing FRIDA as its foundation, this tool can be tailored to function on any platform compatible with FRIDA. The repository also features an over-the-air fuzzer that showcases an example implementation for fuzzing Apple's MagicPairing protocol through InternalBlue. Furthermore, it includes the ReplayCrashFile script, which aids in confirming any crashes identified by the in-process fuzzer. This simple fuzzer operates by flipping bits and bytes in inactive connections, lacking coverage or injection, yet it serves effectively as a demonstration and is stateful. It requires only Python and Frida to operate, eliminating the need for additional modules or installations. Built upon the frizzer codebase, it's advisable to establish a virtual Python environment for optimal performance with frizzer. Notably, with the introduction of the iPhone XR/Xs, the PAC (Pointer Authentication Code) feature has been implemented. This advancement underscores the necessity for continuous adaptation of fuzzing tools like ToothPicker to keep pace with evolving iOS security measures.
ToothPicker Alternatives
Gym Assistant
Bio-Logic Inc.'s Gym Assistant is an easy-to use membership management software. Gym Assistant is ideal for small to medium-sized gyms, fitness centers, and health clubs. It provides the tools that gym managers need to make informed business decisions. It provides a variety of features, including access control, front desk check in, payments, billing and membership database, forms, letters, extensive reporting capabilities, and more. Upgrade with MemberConnect digital Services for SMS and member mobile app functionality.
Gym Assistant software: Simple. Powerful. Affordable.
Learn more
Ditto
Ditto is the only mobile database with built-in edge device connectivity and resiliency, enabling apps to synchronize without relying on a central server or constant cloud connectivity. With billions of edge devices and deskless workers driving operations and revenue, businesses are hitting the limits of what traditional cloud architectures can offer. Trusted by Chick-fil-A, Delta, Lufthansa, Japan Airlines, and more, Ditto is pioneering the edge-native revolution, transforming how businesses connect, sync, and operate at the edge. By eliminating hardware dependencies, Ditto’s software-driven networking is enabling businesses to build faster, more resilient systems that thrive at the edge – no Wi-Fi, servers, or cloud required.
Through the use of CRDTs and P2P mesh replication, Ditto's technology enables you to build collaborative, resilient applications where data is always available and up-to-date for every user, and can even be synced in completely offline situations. This allows you to keep mission-critical systems online when it matters most.
Ditto uses an edge-native architecture. Edge-native solutions are built specifically to thrive on mobile and edge devices, without relying solely on cloud-based services. Devices running Ditto apps can discover and communicate with each other directly, forming an ad-hoc mesh network rather than routing everything through a cloud server. The platform automatically handles the complexity of discovery and connectivity using both online and offline channels – Bluetooth, peer-to-peer Wi-Fi, local LAN, WiFi, Cellular – to find nearby devices and sync data changes in real-time.
Learn more
Atheris
Atheris is a Python fuzzing engine guided by coverage, designed to test both Python code and native extensions developed for CPython. It is built on the foundation of libFuzzer, providing an effective method for identifying additional bugs when fuzzing native code. Atheris is compatible with Linux (both 32- and 64-bit) and Mac OS X, supporting Python versions ranging from 3.6 to 3.10. Featuring an integrated libFuzzer, it is well-suited for fuzzing Python applications, but when targeting native extensions, users may need to compile from source to ensure compatibility between the libFuzzer version in Atheris and their Clang installation. Since Atheris depends on libFuzzer, which is a component of Clang, users of Apple Clang will need to install a different version of LLVM, as the default does not include libFuzzer. The implementation of Atheris as a coverage-guided, mutation-based fuzzer (LibFuzzer) simplifies the setup process by eliminating the need for input grammar definition. However, this approach can complicate the generation of inputs for code that processes intricate data structures. Consequently, while Atheris offers ease of use in many scenarios, it may face challenges when dealing with more complex parsing requirements.
Learn more
LibFuzzer
LibFuzzer serves as an in-process, coverage-guided engine for evolutionary fuzzing. By being linked directly with the library under examination, it injects fuzzed inputs through a designated entry point, or target function, allowing it to monitor the code paths that are executed while creating variations of the input data to enhance code coverage. The coverage data is obtained through LLVM’s SanitizerCoverage instrumentation, ensuring that users have detailed insights into the testing process. Notably, LibFuzzer continues to receive support, with critical bugs addressed as they arise. To begin utilizing LibFuzzer with a library, one must first create a fuzz target—this function receives a byte array and interacts with the API being tested in a meaningful way. Importantly, this fuzz target operates independently of LibFuzzer, which facilitates its use alongside other fuzzing tools such as AFL or Radamsa, thereby providing versatility in testing strategies. Furthermore, the ability to leverage multiple fuzzing engines can lead to more robust testing outcomes and clearer insights into the library's vulnerabilities.
Learn more
Pricing
Pricing Starts At:
Free
Free Version:
Yes
Integrations
Company Details
Company:
Secure Mobile Networking Lab
Website:
github.com/seemoo-lab/toothpicker
Media
Recommended Products
Our Free Plans just got better! | Auth0
You asked, we delivered! Auth0 is excited to expand our Free and Paid plans to include more options so you can focus on building, deploying, and scaling applications without having to worry about your security. Auth0 now, thank yourself later.
Product Details
Platforms
Mac
iPhone App
iPad App
Types of Training
Training Docs
Customer Support
Online Support
ToothPicker Features and Options
ToothPicker User Reviews
Write a Review- Previous
- Next
