Comments (14)
Yep, there is such a problem in AFL mutator. I believe the original AFL has the same issue (may be not). The whole logic is implemented here: https://github.com/mxmssh/manul/blob/master/afl_fuzz.py. I think it is a corner case that should be handled specifically. I have never expected input to be 1 byte long :)
from manul.
@mxmssh thank you for response!
I'm just playing with it and looking what it is capable of. I've verified that AFL can grow input buffer from 1 byte without any hesitation (at least it's true for WinAFL's which is using a bit outdated version of AFL 2.43b). For example, I provided input corpus of one byte and the binary was checking 16 bytes byte-by-byte and then crash, WinAFL found a crash in 2-3mins single threaded . I've also checked manul's AFL python mutator on corpus from 1 to 16 bytes. In each case it was not able to grow buffer even on a single byte. So, it may be a bug which doesn't allow to grow input bigger no matter what size it is. So far I didn't look at mutator sources it's just some conclusions basted on testing.
Can I ask how are you debugging python code? I want to use interactive debuggin and I was trying using VSCode. It can't step inside of code which is behind multiprocessing.Process()
, so I just patched the code to not to use this module and then I was able to attach interactive debugging to mutator's code. I'm just curious how are you doing this? :)
Btw, should radamsa mutator work on Windows? (I'm asking this because I've quickly checked it and wasn't able to leverage it)
Thanks!
from manul.
Seems like a bug in Manul :)
I don't usually use any IDE or step-by-step debugging for Python code, static code analysis + debug printing helps me to find 99% of the problems.
from manul.
Radamsa mutator should work on windows
from manul.
It should work better now.
from manul.
It should work now.
from manul.
Thanks a lot! I've checked 9c5fe26 revison, but I couldn't verify it. It seems AFL mutator is not able neither grow nor shrink sizes of input files. The sizes of files in "queue" directory is always equal to the corresponding sample in "input" directory.
from manul.
Could you try the latest version?
from manul.
Oh, sorry it was wrong revision given. I've tried 7c6037b just now, same result. No growing, no shrinking.
from manul.
That's weird :) Can you copy-paste manul.config that you are using for fuzzing? Are you doing coverage-guided fuzzing on Linux, right?
from manul.
Can you copy-paste manul.config that you are using for fuzzing?
sure, here you are:
dbi = dynamorio
dbi_root = z:\s\tools\dr791\bin32\drrun.exe
dbi_client_root = z:\s\git\manul\dbi_clients_src\client_32\RelWithDebInfo\binafl.dll
dbi_persistence_mode = 1
dbi_target_module = manul_test.exe
dbi_target_method = fuzz
dbi_fuzz_iterations = 20000
Are you doing coverage-guided fuzzing on Linux, right?
Nope, I'm on Windows. Here is the binary if want to try along.
manul.py -i in -o out -n 1 "...manul_test.exe @@"
For input corpus try just one file with one random byte.
from manul.
I see, do you allocate 100% for AFL mutator, right?
from manul.
Yeah, correct. That part is just default:
mutator_weights=afl:10,radamsa:0
from manul.
Ok, now it is finally fixed :) I have also compared winAFL and Manul on test32.exe distributed with Manul. Both fuzzers were able to identify crash. winAFL managed to identify the problem faster than Manul due to deadlock problem in Python3. However, the implementation seems to be correct.
Please take a look into current config if you want to test it on your own.
from manul.
Related Issues (20)
- AttributeError: 'ModuleNotFoundError' object has no attribute 'message'
- ModuleNotFoundError: No module named 'adamsa' HOT 2
- Suggest : Stdin option (Like afl) HOT 2
- Suggest : verbose option HOT 3
- Crashes saved aren't really crashes HOT 2
- Windows test32/64 DR client crash
- windows issues HOT 4
- Add Radamsa as a library HOT 1
- It seems manul afl new path not increase on windows, but winafl can detected more path for same exe HOT 14
- Manul reports exception instead of crash in forkmode
- Integrate manul with FuzzBench HOT 1
- Add/test support of __afl_persistent_loop
- test_network.exe fuzzing config?
- Problem with crash detection in the fuzzstati0n/fuzzgoat project? HOT 2
- Performance manul vs afl++ HOT 1
- real path of input file HOT 7
- [Linux] Some python bugs (with fix) in dbi driver
- [linux] dbi mode doesn't work (as expected) HOT 1
- FileNotFoundError: [Errno 2] No such file or directory: 'manul.config'
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from manul.