问AFL hello world示例

EN

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <assert.h>

char *remove_white_space(char *s)
{
    while (s && *s++)
        if (*s == ' ')
            return "moish";
    return s;
}

int main(int argc, char **argv)
{
    char buffer[256]={0};
    FILE *fl = fopen(argv[1],"rt");
    if (fl == NULL) return 0;

    assert(fscanf(fl,"%s",buffer) > 0);
    char *res = remove_white_space(buffer);
    if (strcmp(res,"a b c d") == 0)
    {
        assert(0);
    }

    fclose(fl);
    return 0;
}

$ afl-gcc main.c -o main
afl-cc 2.56b by <lcamtuf@google.com>
afl-as 2.56b by <lcamtuf@google.com>
[+] Instrumented 62 locations (64-bit, non-hardened mode, ratio 100%).
$ afl-fuzz -i INPUTS/ -o OUTPUTS ./main @@

afl-fuzz 2.56b by <lcamtuf@google.com>
[+] You have 8 CPU cores and 1 runnable tasks (utilization: 12%).
[+] Try parallel jobs - see /usr/local/share/doc/afl/parallel_fuzzing.txt.
[*] Checking CPU core loadout...
[+] Found a free CPU core, binding to #0.
[*] Checking core_pattern...

[-] Hmm, your system is configured to send core dump notifications to an
    external utility. This will cause issues: there will be an extended delay
    between stumbling upon a crash and having this information relayed to the
    fuzzer via the standard waitpid() API.

    To avoid having crashes misinterpreted as timeouts, please log in as root
    and temporarily modify /proc/sys/kernel/core_pattern, like so:

    echo core >/proc/sys/kernel/core_pattern

[-] PROGRAM ABORT : Pipe at the beginning of 'core_pattern'
         Location : check_crash_handling(), afl-fuzz.c:7316