Cardinal Crystal Fuzzer (CCF)

Security research fuzzer for legacy Windows vulnerability analysis
Written entirely in Crystal · MIT License · v0.8.0

Overview

Cardinal Crystal Fuzzer (CCF) is a security-focused fuzzing framework for analyzing legacy Windows operating system vulnerabilities. It targets the full Windows 9x/NT legacy stack — from Windows 95 through Windows Vista — using public CVE data to generate targeted, high-signal fuzzing inputs.

CCF is designed for:

• Reverse engineers studying legacy Windows internals
• Security researchers analyzing old CVE reproduction cases
• Penetration testers with explicit authorization on legacy infrastructure
• Students learning how fuzzing and vulnerability research work

⚠️ Legal Disclaimer: Use CCF only on systems you own or have explicit written permission to test. CVE data is included for defensive/research purposes only. Unauthorized use against systems you do not own is illegal.

Features

Supported OS Targets

New in v0.8.0

• ✅ Crash-Safe Persistence — atomic file writes (rename), WAL, fsync flush
  • SafeWriter module: atomic write + WAL + fsync
  • Checkpoint: fuzzing session save/restore after abnormal termination
  • CorpusManager: interesting input collection, deduplication, pruning
  • SIGTERM/SIGINT handler: flush logs before exit
  • CrashLogger: per-file crash count cap (1000), atomic crash detail writes
• ✅ Korean comments — all 18 source files converted to Korean annotations
• ✅ ASCII art banner — ANSI blue banner on every run
• ✅ README.ko.md — complete Korean documentation
• ✅ 95 specs passing (was 81)

New in v0.7.0

• ✅ PE binary format fuzzer — 14 structure-aware mutation ops for Windows PE/DLL parsing CVEs
  • MZ/DOS header corruption, PE signature flip, COFF/Optional header field fuzzing
  • Section header overflow (VirtualSize, RVA, PointerToRawData)
  • Import/Export/Resource/TLS directory corruption, checksum break, overlay append
  • generate_base_pe() produces valid PE32 / PE32+ structures
• ✅ LNK file fuzzer — 15 mutation ops targeting CVE-2010-2568 class (Vista/XP/2000/ME)
  • Shell Link header magic, CLSID, LinkFlags, FileAttributes fuzzing
  • FILETIME corruption, IconIndex/ShowCommand/HotKey field attacks
  • IDList size overflow, LinkInfo misparse, StringData length corruption
  • UNC path injection (\\\\attacker\\share\\evil.dll) — direct CVE-2010-2568 vector
  • IconLocation buffer overflow — key attack surface for shell32 parsing
  • ExtraData block injection (SpecialFolder/KnownFolder malformed blocks)
  • generate_base_lnk() produces valid [MS-SHLLINK] compliant structure
• ✅ MutationEngine integration — all PE/LNK ops routable via apply_named_op()
• ✅ CrashLearner coverage — MUTATION_OPS expanded from 27 → 56 ops
• ✅ 81 specs passing (was 53)

New in v0.6.1

• ✅ Windows EXE — pre-built ccf-windows-amd64.exe via GitHub Actions
• ✅ SARIF export — GitHub Code Scanning compatible security report
• ✅ HTML dashboard — stat cards, color bars, mutation leaderboard
• ✅ WINS protocol (UDP/42) — CVE-1999-0142 registration/query/release fuzzing
• ✅ Messenger protocol (port 1026) — CVE-2003-0660 overflow payload
• ✅ Delta-debugging minimizer — O(n log n) vs previous O(n²) byte-by-byte
• ✅ Win9x-aware adaptive strategy — automatic Win9x CVE vector bias
• ✅ RPC opnum fuzzing — boundary opnum corruption for CVE-2003-0352 class
• ✅ UDP fuzzing — send_udp(), probe_udp(), win9x_session()
• ✅ ANSI sanitization in crash logs + 100MB log rotation
• ✅ CveRegistry API — by_year, by_product, win9x_entries, severity_breakdown, etc.
• ✅ 47 specs passing

v0.5.0

• ✅ Windows 95 & 98 CVE profiles — 22 new vulnerability entries
• ✅ NetBIOS spray mutation — targets CVE-1999-0382, CVE-1999-0661 class
• ✅ ASN.1 corruption mutation — targets CVE-2002-0369, CVE-2003-0818 class
• ✅ Win9x heap spray mutation — VxD/ring-0 boundary patterns
• ✅ Security hardening — config bounds checking, safe path validation, null byte rejection

Requirements

• Crystal >= 1.19.0
• macOS, Linux (or any Crystal-supported platform)
• No external shards required

Installation & Build

# Clone
git clone https://github.com/KaztoRay/Cardinal-Crystal-Fuzzer.git
cd Cardinal-Crystal-Fuzzer

# Build (release mode — optimized)
crystal build src/main.cr -o bin/ccf --release

# Or debug build
crystal build src/main.cr -o bin/ccf

Usage

Basic Fuzzing

./bin/ccf --target-cmd "./target_binary @@" --iterations 5000

Legacy OS Targeted Fuzzing

# Windows 95 target — NetBIOS/SMB attack surface
./bin/ccf --target-cmd "./target @@" --target-os win95 --strategy cve_targeted --iterations 10000

# Windows 98 target — ASN.1 / Messenger attack surface
./bin/ccf --target-cmd "./target @@" --target-os win98 --strategy adaptive --crash-learning true

# Windows 2000 — IIS 5.0 / LSASS attack surface
./bin/ccf --target-cmd "./target @@" --target-os win2000 --strategy crash_guided

# Windows XP — EternalBlue / SMB attack surface
./bin/ccf --target-cmd "./target @@" --target-os xp --strategy cve_targeted

# Windows Vista — SMBv2 / LNK attack surface
./bin/ccf --target-cmd "./target @@" --target-os vista --strategy adaptive

Seed Generation

# Generate CVE-seeded inputs for all OS targets
./bin/ccf --generate-seeds --seed-dir seeds

# Generate seeds for a specific OS
./bin/ccf --generate-seeds --seed-dir seeds --target-os win95
./bin/ccf --generate-seeds --seed-dir seeds --target-os win98

Legacy OS Vulnerability Summary

# Print full CVE summary for all supported OS targets
./bin/ccf --legacy-summary

Fuzzing Strategies

All Options

--target-cmd CMD         Target command (use @@ for input placeholder)
--seed-dir DIR           Seed directory (default: seeds/)
--out-dir DIR            Output directory (default: out/)
--iterations N           Number of fuzzing iterations (default: 1000)
--timeout-ms N           Per-run timeout in ms (default: 2000)
--max-size N             Max input size in bytes (default: 4096)
--target-os OS           OS target: win95|win98|me|win2000|xp|vista
--strategy S             Fuzzing strategy (see table above)
--crash-learning BOOL    Enable crash-guided learning (default: true)
--minimize-crashes       Enable crash input minimization
--report-format FMT      Report format: json|markdown|html|all
--generate-seeds         Generate CVE-seeded inputs and exit
--legacy-summary         Print legacy OS CVE summary and exit
--verbose                Verbose output
--workers N              Number of parallel workers

Output Structure

out/
├── crashes/          # Crash-triggering inputs (binary)
├── crash_db.json     # Structured crash database
├── report.json       # JSON fuzzing report
├── report.md         # Markdown fuzzing report
└── report.html       # HTML fuzzing report

Mutation Operations

CCF implements 56 mutation operations:

Security Notes

• All file path inputs are validated to prevent directory traversal
• Null bytes in target commands are rejected
• Iteration counts, timeouts, and buffer sizes are clamped to safe bounds
• Crash log output is capped at 100 MB to prevent disk exhaustion
• Target command is length-limited to 4096 characters

License

MIT License © 2025 KaztoRay