AngoraFuzzer / Angora

Angora is a mutation-based fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution.
Apache License 2.0
916 stars 166 forks source link

how to run angora-fuzzer? #48

Closed butterflyhack closed 2 years ago

butterflyhack commented 5 years ago

the run command:

./angora_fuzzer -i input -o output -t path/to/taint/program -- path/to/fast/program [argv]

the -t point taint mode, the -- point fast mode, they are opposite, why run together?

butterflyhack commented 5 years ago

I use the run command,:

butterfly@ubuntu:~/Desktop/ImageMagick$ /home/butterfly/Desktop/Angora/angora_fuzzer --input /home/butterfly/Desktop/in/ --output /home/butterfly/Desktop/output/ -- /home/butterfly/Desktop/imagemagick_install/bin/magick identify

and print error as below:

thread 'main' panicked at 'assertion failed: `(left != right)`
  left: `"-"`,
 right: `"-"`: You should set track target with -t PROM in LLVM mode!', fuzzer/src/command.rs:90:9
stack backtrace:
   0: std::sys::unix::backtrace::tracing::imp::unwind_backtrace
             at src/libstd/sys/unix/backtrace/tracing/gcc_s.rs:39
   1: std::sys_common::backtrace::_print
             at src/libstd/sys_common/backtrace.rs:70
   2: std::panicking::default_hook::{{closure}}
             at src/libstd/sys_common/backtrace.rs:58
             at src/libstd/panicking.rs:200
   3: std::panicking::default_hook
             at src/libstd/panicking.rs:215
   4: std::panicking::rust_panic_with_hook
             at src/libstd/panicking.rs:478
   5: std::panicking::continue_panic_fmt
             at src/libstd/panicking.rs:385
   6: std::panicking::begin_panic_fmt
             at src/libstd/panicking.rs:340
   7: angora::command::CommandOpt::new
   8: angora::fuzz_main::fuzz_main
   9: fuzzer::main
  10: std::rt::lang_start::{{closure}}
  11: std::panicking::try::do_call
             at src/libstd/rt.rs:49
             at src/libstd/panicking.rs:297
  12: __rust_maybe_catch_panic
             at src/libpanic_unwind/lib.rs:87
  13: std::rt::lang_start_internal
             at src/libstd/panicking.rs:276
             at src/libstd/panic.rs:388
             at src/libstd/rt.rs:48
  14: main
  15: __libc_start_main
  16: _start
zhangysh1995 commented 5 years ago

@butterflyhack You need to run the -t, which is the binary for taint analysis.