lylemi / aflnw Goto Github PK

~/aflnw/build$ make
[ 25%] Building C object CMakeFiles/aflnw.dir/src/afl.c.o
afl-cc++4.10c by Michal Zalewski, Laszlo Szekeres, Marc Heuse - mode: LLVM-PCGUARD
SanitizerCoveragePCGUARD++4.10c
[+] Instrumented 3 locations with no collisions (non-hardened mode) of which are 0 handled and 0 unhandled selects.
[ 50%] Building C object CMakeFiles/aflnw.dir/src/main.c.o
afl-cc++4.10c by Michal Zalewski, Laszlo Szekeres, Marc Heuse - mode: LLVM-PCGUARD
SanitizerCoveragePCGUARD++4.10c
[+] Instrumented 11 locations with no collisions (non-hardened mode) of which are 0 handled and 0 unhandled selects.
[ 75%] Building C object CMakeFiles/aflnw.dir/src/utils.c.o
afl-cc++4.10c by Michal Zalewski, Laszlo Szekeres, Marc Heuse - mode: LLVM-PCGUARD
SanitizerCoveragePCGUARD++4.10c
[+] Instrumented 114 locations with no collisions (non-hardened mode) of which are 0 handled and 0 unhandled selects.
[100%] Linking C executable aflnw
afl-cc++4.10c by Michal Zalewski, Laszlo Szekeres, Marc Heuse - mode: LLVM-PCGUARD
/usr/bin/ld: /usr/bin/ld: DWARF error: invalid or unhandled FORM value: 0x23
CMakeFiles/aflnw.dir/src/main.c.o:(.bss+0x0): multiple definition of conf'; /usr/bin/ld: DWARF error: invalid or unhandled FORM value: 0x22 CMakeFiles/aflnw.dir/src/afl.c.o:(.bss+0x0): first defined here /usr/bin/ld: /usr/bin/ld: DWARF error: invalid or unhandled FORM value: 0x23 CMakeFiles/aflnw.dir/src/utils.c.o:(.bss+0x0): multiple definition of conf'; CMakeFiles/aflnw.dir/src/afl.c.o:(.bss+0x0): first defined here
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make[2]: *** [CMakeFiles/aflnw.dir/build.make:129：aflnw] 错误 1
make[1]: *** [CMakeFiles/Makefile2:83：CMakeFiles/aflnw.dir/all] 错误 2
make: *** [Makefile:91：all] 错误 2

您这里的代码很明朗，如果无法建立tcp连接，则程序crash。

    int ret = connect(
                  server_fd, (const struct sockaddr *)&server_listen_addr,
                  sizeof(struct sockaddr)
              );
    printf("send ret %d\n", ret);
    if (ret < 0)
    {
        crash();
    }

但是我在测试过程中，发现只有系统崩溃时才会停止，如果服务挂掉（端口挂），fuzz依然继续.

Hello, thank you for sharing this project. I have successfully built and deployed your software, but I don't quite understand how to collect crashes? When running with AFL, the crashes never get counted or logged, despite being able to see the crash and stack trace appear in the terminal of the software we're fuzzing.

For example, using the command line from your README:
/afl-fuzz -i ./input -o ./output -- ./aflnw -a 127.0.0.1 -p 8888 -- /opt/fuzz/nginx/objs/nginx

This doesn't actually start nginx, we have to start nginx in another terminal. Once we do that, we can start seeing some network requests being made towards nginx, and when we finally get nginx to crash, AFL keeps on running and doesn't log the crash or save the reproducing testcase. Can you advise on how to capture the crashes? Thank you.

wireshark抓包并没有抓到什么数据

你好，我注意到aflnw的代码有了更新，参数也更多了，请问有相关的文档说明如何使用吗？谢谢！