Fuzzing at Mach Speed

The speaker presents about a year of on-and-off research into fuzzing macOS inter-process communication, focusing on Mach messages, the lowest-level IPC mechanism on the platform. The opening covers fuzzing basics, attack vectors, and why memory-unsafe code yields serious bugs. It then explains Mach ports, port rights, and the bootstrap server, plus how these messages have enabled sandbox escapes in earlier research.

The middle section covers the practical workflow. Rather than picking targets blindly, the researcher used an existing sandbox-checking tool to narrow down which services a sandboxed process could reach, landing on a core audio daemon. Framework binaries are not on disk on modern macOS, so they were pulled from the dyld shared cache. Early attempts that hooked the send call in a debugger were slow and made it hard to tie crashes to inputs, so the approach shifted to a custom harness that calls the message handler directly. Because the handler was not exported, the harness resolved its offset through a custom symbol parser. Seed inputs were captured by dumping live messages while generating audio traffic.

Coverage instrumentation, run alongside Guard Malloc, guided the mutation-based fuzzer toward unexplored branches, and crashes were triaged by exploitability heuristics and whether they reproduced reliably. The talk stresses that early attempts failed often and that this kind of work is slow. Future work includes stateful fuzzing, since handlers may depend on message order, and automatic initialization of services. The researcher planned to release the tooling once approval came through.