Closed neuracr closed 5 years ago
Try
$ ../Angora/angora_fuzzer -M 0 -i in -o out2 -t ./test.track -- ./test.fast.asan @@
Angora does not support the keywork "none" for memory limitation, so the option parsing fails. The memory limitation still is 200MB in your setting.
INFO angora::fuzz_main > CommandOpt { id: 0, main: ("./test.fast.asan", ["@@"]), track: ("./test.track", ["@@"]), tmp_dir: "out2/tmp", out_file: "out2/tmp/cur_input", forksrv_socket_path: "out2/tmp/forksrv_socket", track_path: "out2/tmp/track", is_stdin: false, search_method: Gd, mem_limit: 200, time_limit: 1, is_raw: true, ld_library: "$LD_LIBRARY_PATH:/opt/llvm-4.0/lib", enable_afl: true, enable_exploitation: true }
Thanks, that worked. But still, the angora-fuzz does not detect the crash. The fuzzer "solves" all the possible paths in my test program including the one that triggers the buffer overflow but it puts it in the queue directory and it does not increase the crash counter. When I replay the sample in the queue, I get the crash and asan report.
Here is the (dummy) test program I use:
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char* argv[]){
char content[1024];
if (argc < 2){
printf("usage: test input_sample\n");
return -1;
}
FILE *file = fopen(argv[1], "r");
size_t n_read = fread(content, 1, 1024, file);
if (n_read < 1000){
printf("sample too short\n");
fclose(file);
return -1;
}
if (content[0] == 'h' && content[1] == 'e'){
if (content[2] >75){
if (content[3] < 80)
printf("well done!");
}
else if(content[2] == 74){
//triggers a crash
*(content+1025*sizeof(char)) = 'r';
}
}
fclose(file);
return 0;
}
If you want to set your own options, be sure to include abort_on_error=1 - otherwise, the fuzzer will not be able to detect crashes in the tested app. Similarly, include symbolize=0, since without it, AFL may have difficulty telling crashes and hangs apart.
https://github.com/mirrorer/afl/blob/master/docs/env_variables.txt
I will add these to Angora soon
Done, please check https://github.com/AngoraFuzzer/Angora/commit/4e6f4cf36087ba77760229976262bdf9980f1c99
Thanks.
It works. Thanks!
Hi, Thanks for releasing your code. Does angora-clang support address sanitizer ?
I tried to build the 'FAST version' of a test program with the ANGORA_USE_ASAN=1 variable set (and the TRACK version without ASAN since it seems not recommended to mix dfsan and asan). The "fast" is running properly when I execute it manually, but it makes angora-fuzz to hang:
Compiling TRACK variant
USE_TRACK=1 /home/user/sources/Angora/bin/angora-clang test.c -o test.track
Compiling FAST variant with ASAN
ANGORA_USE_ASAN=1 USE_FAST=1 /home/user/sources/Angora/bin/angora-clang test.c -o test.fast.asan
And when fuzzing:
hang and even ctrl-C does not kill the process.
When testing manually the binary for a bug, there's no problem: