PacktPublishing / Fuzzing-Against-the-Machine

MIT License
73 stars 9 forks source link

FATAL: forkserver is already up #3

Open doctorames opened 1 month ago

doctorames commented 1 month ago

hi all. Going through the book. Trying to do the vlc instrumentation in Chapter 5, page 80. CFLAGS="-O0 -g" make LDFLAGS="-fsanitize=address" This is failing for me with this error:

SanitizerCoveragePCGUARD++4.22a
[+] Instrumented 9 locations with no collisions (non-hardened mode) of which are 0 handled and 0 unhandled selects.
  CCLD     vlc-cache-gen
afl-cc++4.22a by Michal Zalewski, Laszlo Szekeres, Marc Heuse - mode: LLVM-PCGUARD
  GEN      ../modules/plugins.dat
[-] FATAL: forkserver is already up, but an instrumented dlopen() library loaded afterwards. You must AFL_PRELOAD such libraries to be able to fuzz them or LD_PRELOAD to run outside of afl-fuzz.
To ignore this set AFL_IGNORE_PROBLEMS=1 but this will lead to ambiguous coverage data.
In addition, you can set AFL_IGNORE_PROBLEMS_COVERAGE=1 to ignore the additional coverage instead (use with caution!).
/bin/bash: line 5: 1234742 Aborted                 ./vlc-cache-gen `realpath ../modules`
make[2]: *** [Makefile:1840: ../modules/plugins.dat] Error 134
make[2]: Leaving directory '/sekai/fw/fuzzing/fatm/vlc-3.0.17.3/bin'
make[1]: *** [Makefile:1563: all-recursive] Error 1
make[1]: Leaving directory '/sekai/fw/fuzzing/fatm/vlc-3.0.17.3'
make: *** [Makefile:1450: all] Error 2

Looks like the official advice can be found here: https://aflplus.plus/docs/faq/

The best solution is to simply set AFL_PRELOAD=foo.so to the libraries that are dlopen’ed (e.g., use strace to see which), or to set a manual forkserver after the final dlopen().

How do I do that? Do I have to edit the makefile somehow? Maybe I screwed something else up? Any advice.. Thanks!

doctorames commented 1 month ago

I just continued on, and tried the next thing which is to narrow down the search space for instrumentation with the selective.txt file, and running: AFL_LLVM_ALLOWLIST=$(pwd)/selective.txt CFLAGS="-O0 -g" make LDFLAGS="-fsanitize=address" This segfaulted at the same place (plugins.dat):

afl-cc++4.22a by Michal Zalewski, Laszlo Szekeres, Marc Heuse - mode: LLVM-PCGUARD
  GEN      ../modules/plugins.dat
/bin/bash: line 5: 1278618 Segmentation fault      ./vlc-cache-gen `realpath ../modules`
make[2]: *** [Makefile:1840: ../modules/plugins.dat] Error 139
make[2]: Leaving directory '/sekai/fw/fuzzing/fatm/vlc-3.0.17.3/bin'
make[1]: *** [Makefile:1563: all-recursive] Error 1
make[1]: Leaving directory '/sekai/fw/fuzzing/fatm/vlc-3.0.17.3'
make: *** [Makefile:1450: all] Error 2
doctorames commented 1 month ago

ok so I really didn't want to, but I got around these problems with AFL_IGNORE_PROBLEMS=1. Now I'm running into more problems with subsequent instructions. Some typos (that really matter), bad URLs, and some other misalignments with what the text says should happen, and what actually happens. Will submit more issues about them. If it gets to be too much, I'm going to give up on this book. So far I've spent more time troubleshooting the instructions than actually learning fuzzing. =\

doctorames commented 1 month ago

Ok, after running into problem after problem, I give up. It really looks like you guys didn't actually test these exercises on a clean system. Issue #5 basically proves this.

I'm going to just read the chapter and absorb what I can without doing this exercise. Will try doing exercises again when this one is over. I have to do this for work, so I'm kind of stuck doing what I can to absorb this knowledge, even with broken exercises. I know you never promised any kind of support. I know I am not entitled to it. But I am catching a lot of mistakes and am willing to help you by sharing them with you to make your book better. Maybe we can help each other out. :)