IntelLabs / kAFL

A fuzzer for full VM kernel/driver targets
https://intellabs.github.io/kAFL/
MIT License
625 stars 88 forks source link

In the kafl windows target, using the Sleep() function after a snapshot recovery seems to cause the client to stop running #281

Open nj00001 opened 1 month ago

nj00001 commented 1 month ago

Modifying the windows sample program selffuzz_test directly should reproduce the problem

    kAFL_hypercall(HYPERCALL_KAFL_NEXT_PAYLOAD, 0);
    kAFL_hypercall(HYPERCALL_KAFL_ACQUIRE, 0);

    fuzzme(payload_buffer->data, payload_buffer->size);
    Sleep(1);
    kAFL_hypercall(HYPERCALL_KAFL_RELEASE, 0);

image

The result is that every fuzz results in a timeout. And in my tests, many functions with hibernation cause this problem, such as Sleep(), select(), MsgWaitForMultipleObjectsEx(). This is actually quite a serious problem, since many programs use sleep or blocking to synchronize in one way or another.