AngoraFuzzer / Angora

Angora is a mutation-based fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution.
Apache License 2.0
919 stars 168 forks source link

Unable to compile lavam programs correctly #121

Open spencerwuwu opened 2 years ago

spencerwuwu commented 2 years ago

Hello Angora authors,

I'm trying to reproduce the lavam evaluation within Magma's infrastructure. However, I think I encounter the following 2 issues. Could you help me to check if I'm doing anything wrong?

Thank you in advance!

The 2 issues are as follow:

  1. Angora cannot find any bugs while AFLplusplus can easily discover ones within a few minutes. From the log files I see that Angora is saying Multiple inconsistent warnings. It caused by the fast and track programs has different behaviors. If most constraints are inconsistent, ensure they are compiled with the same environment. Otherwise, please report us.
  2. For who, AFLplusplus can only find <20 bugs after running for 5 hours. For other targets it is finding the numbers of bugs reported in your paper.

You can find the scripts I use to compile and run the fuzzing campaigns here. Basically, the lavam programs are compiled with fuzzers/aflplusplus/instrument.sh and fuzzers/angora/instrument.sh, which they set up some config and execute targets/lavam/build.sh.
In targets/lavam/LAVAM you can find the patched source code following your instructions.

To launch the fuzzing campaigns, cd into tools/captain and run ./run.sh run_lavamrc.
run_lavamrc is the config file for the campaign. It would create a working directory in ~/lavam-results, build docker containers and start fuzzing with fuzzers/aflplusplus/run.sh and fuzzers/angora/run.sh. The fuzzing results are stored in ~/lavam-results/ar as tarballs.

Please do let me know if you need any additional information.

Spencer

spencerwuwu commented 2 years ago

The issue related to 'who' can be ignored as I missed to patch the source code correctly.
The issue of Angora still exists.