kotee4ko
commented
1 year ago ---upd---
It seems, that if there are unused-bytes in payload data before place WHERE redq-dict C-string must be put -- kAFL can't save such testcase to corpus correct.
In next harness between 0xdeadbeef constant and C-String "PWNED!!!" two unused bytes present.
94 │ if (len >= 4) {
95 │
96 │ /* set a byte in the bitmap to guide your fuzzer */
97 │ //((uint8_t *)trace_buffer)[0] = 0x1;
98 │ if (payload_buffer->data[0] == '!') {
99 │
100 │ //((uint8_t *)trace_buffer)[1] = 0x1;
101 │ if (payload_buffer->data[1] == 'N') {
102 │
103 │ //((uint8_t *)trace_buffer)[2] = 0x1;
104 │ if (payload_buffer->data[2] == 'Y') {
105 │
106 │ //((uint8_t *)trace_buffer)[3] = 0x1;
107 │ if (payload_buffer->data[3] == 'X') {
108 │
109 │ //((uint8_t *)trace_buffer)[4] = 0x1;
110 │ /* Notifiy the hypervisor and the fuzzer that a "crash" has
111 │ * occured. Also a string is passed by this hypercall (this is
112 │ * currently not supported by AFL++-Nyx) */
113 │ if (*(int*)&(payload_buffer->data[4]) == 0xdeadbeef) {
114 │ if (!strcmp(&(payload_buffer->data[10]), "PWNED!!!")) {
115 │ hprintf("PWNED\n");
116 │ char *magic;
117 │ magic = &(payload_buffer->data[20]);
118 │ if (!memcmp(magic, "RedQueen", sizeof("RedQueen"))) {
119 │ void **crash = 0xdeadbeef;
120 │ *crash = 0xcafefeed;
121 │ kAFL_hypercall(HYPERCALL_KAFL_PANIC_EXTENDED,
122 │ (uintptr_t) "Something went wrong\n");
123 │ }
124 │ }
125 │ }
126 │ }
127 │
128 │ }
129 │
130 │ }
131 │
132 │ }
133 │
134 │ }Backend pass that code and increase edges count up to 59, but:
(.venv) |root@w00t|:{/usr/src/kAFL/kafl/examples/linux-user/forkserver} #_ hexyl /dev/shm/kafl_root/corpus/regular/payload_00007
┌────────┬─────────────────────────┬─────────────────────────┬────────┬────────┐
│00000000│ 21 4e 59 58 ef be ad de ┊ │!NYX××××┊ │
└────────┴─────────────────────────┴─────────────────────────┴────────┴────────┘
(.venv) |root@w00t|:{/usr/src/kAFL/kafl/examples/linux-user/forkserver} #_ hexyl /dev/shm/kafl_root/corpus/regular/payload_00008
┌────────┬─────────────────────────┬─────────────────────────┬────────┬────────┐
│00000000│ 21 4e 59 58 ef be ad de ┊ │!NYX××××┊ │
└────────┴─────────────────────────┴─────────────────────────┴────────┴────────┘In case of next branches:
113 │ if (*(int*)&(payload_buffer->data[4]) == 0xdeadbeef) {
114 │ if (!strcmp(&(payload_buffer->data[8]), "PWNED!!!")) {
all works as expected
(.venv) |root@w00t|:{/usr/src/kAFL/kafl/examples/linux-user/forkserver} #_ hexyl /dev/shm/kafl_root/corpus/regular/payload_00008
┌────────┬─────────────────────────┬─────────────────────────┬────────┬────────┐
│00000000│ 21 4e 59 58 ef be ad de ┊ 50 57 4e 45 44 21 21 21 │!NYX××××┊PWNED!!!│
└────────┴─────────────────────────┴─────────────────────────┴────────┴────────┘I have some experience with AFL's cmplog backend stuff, in qemu userspace. But such sort of behaviour is highly discouraged, so i think i need some help. Thanks.
Wenzel
il-steffen
I reach some troubles with redqueen feature: it doesn't handle
strcmp()calls on linux userspace target.Launch command:
Some debugging of qemu-nyx approve, that redqueen strcmp() hooks are reached and works as expected, or, at least, see strcmp() calls is target and could access guest args.
The target, as always, is simple, statically built, small harness with several branches to test integers and strings extractions.
full backtrace:
But kafl doesn't insert findings to corpus.
---upd--- After some time fuzz session log next in stdout:
So, the magic string was found and successfully injected to input, the harness react by crashing, as expected, and kAFL log this. But not new path in corpus/regular neither correct (crashing) payloads in corpus/crashes are present.
Any advices? Thanks.
Originally posted by @kotee4ko in https://github.com/IntelLabs/kAFL/issues/12#issuecomment-1646964469