IntelLabs / kAFL

A fuzzer for full VM kernel/driver targets
https://intellabs.github.io/kAFL/
MIT License
625 stars 88 forks source link

Windows userspace target raises libxdc_decode errors #242

Closed Wenzel closed 8 months ago

Wenzel commented 8 months ago

    __                        __  ___    ________
   / /_____  _________  ___  / / /   |  / ____/ /
  / //_/ _ \/ ___/ __ \/ _ \/ / / /| | / /_  / /
 / ,< /  __/ /  / / / /  __/ / / ___ |/ __/ / /___
/_/|_|\___/_/  /_/ /_/\___/_/ /_/  |_/_/   /_____/
===================================================

<< kAFL Fuzzer >>

Warning: Launching without --seed-dir?
No PT trace region defined.
00:00:00:     0 exec/s,    0 edges,  0% favs pending, findings: <0, 0, 0>
Worker-00 Launching virtual machine...
/home/mtarral/kafl/kafl/qemu/x86_64-softmmu/qemu-system-x86_64
        -enable-kvm
        -machine kAFL64-v1
        -cpu kAFL64-Hypervisor-v1,+vmx
        -no-reboot
        -net none
        -display none
        -chardev socket,server,id=nyx_socket,path=/dev/shm/kafl_mtarral/interface_0
        -device nyx,chardev=nyx_socket,workdir=/dev/shm/kafl_mtarral,worker_id=0,bitmap_size=65536,input_buffer_size=131072
        -device isa-serial,chardev=kafl_serial
        -chardev file,id=kafl_serial,mux=on,path=/dev/shm/kafl_mtarral/serial_00.log
        -m 4096
        -drive file=/home/mtarral/.local/share/libvirt/images/windows_x86_64_vagrant-kafl-windows.img
        -monitor unix:/tmp/monitor.sock,server,nowait
        -fast_vm_reload path=/dev/shm/kafl_mtarral/snapshot/,load=off
qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.07H:EBX.hle [bit 4]
qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.07H:EBX.rtm [bit 11]
[QEMU-NYX] Warning: Invalid sharedir...
[QEMU-NYX] Booting VM to start fuzzing...
[+] Starting... C:\Users\vagrant\Desktop\bin\userspace\selffuzz_test.exe
[+] Creating snapshot...
[host_config] bitmap sizes = <0x10000,0x1000>
[host_config] payload size = 128KB
[host_config] worker id = 00
[+] Allocating buffer for kAFL_payload struct
[+] Submitting buffer address to hypervisor...
[+] range buffer af4e0000...
[+] Locking fuzzing ranges...
[+] Range 0 enabled: 0  (0000000000000000-0000000000000000)
[+] Range 1 enabled: 0  (0000000000000000-0000000000000000)
[+] Range 2 enabled: 0  (0000000000000000-0000000000000000)
[+] Range 3 enabled: 0  (0000000000000000-0000000000000000)
[+] Range: 0x00007ff7010819ec-0x00007ff701081b20
Worker-00 Entering fuzz loop..
00:01:18:     0 exec/s,    0 edges,  0% favs pending, findings: <0, 0, 0>
ERR:    TNT 3 at position <0x7ff7010815b6,0x7ff7010815b6>
[QEMU-NYX] Warning: libxdc_decode returned decoder_error

ERR:    TNT 3 at position <0x7ff7010815b6,0x7ff7010815b6>
[QEMU-NYX] Warning: libxdc_decode returned decoder_error

ERR:    TNT 3 at position <0x7ff7010815b6,0x7ff7010815b6>
[QEMU-NYX] Warning: libxdc_decode returned decoder_error

ERR:    TNT 3 at position <0x7ff7010815b6,0x7ff7010815b6>
[QEMU-NYX] Warning: libxdc_decode returned decoder_error

ERR:    TNT 3 at position <0x7ff7010815b6,0x7ff7010815b6>
[QEMU-NYX] Warning: libxdc_decode returned decoder_error

ERR:    TNT 3 at position <0x7ff7010815b6,0x7ff7010815b6>
[QEMU-NYX] Warning: libxdc_decode returned decoder_error

ERR:    TNT 3 at position <0x7ff7010815b6,0x7ff7010815b6>
[QEMU-NYX] Warning: libxdc_decode returned decoder_error

ERR:    TNT 3 at position <0x7ff7010815b6,0x7ff7010815b6>
[QEMU-NYX] Warning: libxdc_decode returned decoder_error

Tested on 6.0 kernel, and on 5.10.73. Not related to https://github.com/IntelLabs/kafl.linux/issues/10

Raised by @NoRelect on awesome-fuzzing Discord (#snapshot-engines channel)