search

AngoraFuzzer / Angora

Angora is a mutation-based fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution.
Apache License 2.0
918 stars 168 forks source link

Increase MAP_SIZE or adjust function call context? #102

Open wideglide opened 4 years ago

wideglide commented 4 years ago

We're running into issues where Angora aborts fuzzing within the first 24 hours because the Density is too large (> 10%).

What is the recommended fix for this issue?

The error message suggests two different solutions

 WARN  angora::stats::chart       > Density is too large (> 10%). Please increase `MAP_SIZE_POW2` in and `common/src/config.rs`. Or disable function-call context(density > 50%) by
compiling with `ANGORA_CUSTOM_FN_CONTEXT=k` (k is an integer and 0 <= k <= 32) environment variable. Angora disables context if k is 0.

I see that the default map size is already 2^20 however, and I am not sure what the impact will be by reducing/disabling the function-call context.

spinpx commented 4 years ago

The warning is the method for fixing this issues.

  1. Since angora check every entry in the map, so if you change the map, it will influence its efficiency.
  2. You you disable function-call context, angora can't distinguish the branches in different function call context

or you can use ANGORA_INST_RATIO like AFL.