我一直在尝试使用美国的模糊Lop,但我不能通过这样一个简单的例子来实现它:
#include <stdio.h>
#include <string.h>
int main(int argc, char * argv[]){
char name[10];
if ( argc > 1 ){
strcpy(name, argv[1]);
printf("HELLO %s\n", name);
}
return 0;
}我用常规的gcc编译了这段代码的一个版本,用afl-clang编译了另一个版本。然后将gcc版本放在输入文件夹中,我这样调用fuzzer:
afl-fuzz -i input/ -o output/ -m 2G ./a.out @@但它不起作用。
[*] Attempting dry run with 'id:000000,orig:a.out'...
[*] Spinning up the fork server...
[-] Whoops, the target binary crashed suddenly, before receiving any input
from the fuzzer! There are several probable explanations:
- The current memory limit (2.00 GB) is too restrictive, causing the
target to hit an OOM condition in the dynamic linker. Try bumping up
the limit with the -m setting in the command line. A simple way confirm
this diagnosis would be:
( ulimit -Sv $[2047 << 10]; /path/to/fuzzed_app )
Tip: you can use http://jwilk.net/software/recidivm to quickly
estimate the required amount of virtual memory for the binary.
- The binary is just buggy and explodes entirely on its own. If so, you
need to fix the underlying problem or find a better replacement.
- Less likely, there is a horrible bug in the fuzzer. If other options
fail, poke <lcamtuf@coredump.cx> for troubleshooting tips.
[-] PROGRAM ABORT : Fork server crashed with signal 6
Location : init_forkserver(), afl-fuzz.c:2056我做错了什么?
发布于 2016-03-14 09:01:04
第一个问题是,当程序接受命令行参数时,您将输入作为带有'@@‘命令的文件传递给afl-fuzz。afl接受来自标准输入或文件的输入。http://lcamtuf.coredump.cx/afl/README.txt
导致启动时崩溃的第二个问题是afl为测试用例文件名指定的自动名称:
[*] Attempting dry run with 'id:000000,orig:a.out'...这足以使您的缓冲区溢出并导致段错误。
发布于 2016-07-08 21:55:04
要完成wintermute响应,如果你想尝试AFL或演示它的工作,你可以这样做:
path变量是@@参数的路径
char *buff;
if ((buff = malloc(10)) == NULL)
abort();
if ((fd = fopen(path, "r")) == NULL)
abort();
fread(buff, 10, 1, fd);
if (strncmp(buff, "h", 1) == 0)
{
if (strncmp(buff, "he", 2) == 0)
{
if (strncmp(buff, "hel", 3) == 0)
{
if (strncmp(buff, "hell", 4) == 0)
{
if (strncmp(buff, "hello", 5) == 0)
{
buff[9] = 0; //just to be sure...
fprintf(stderr, "Nailed it ! input file is %s\n", buff);
abort();
}
}
else
{
abort(); // it should be found quick
}
}
}
}
free(buff);
fclose(fd);使用abort()将导致非法指令,被AFL视为崩溃。所以在这个例子中,你会得到多个不同的崩溃。
https://stackoverflow.com/questions/35962013
复制相似问题