search

SoftSec-KAIST / NTFuzz

NTFUZZ: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis (IEEE S&P '21)
MIT License
94 stars 22 forks source link

Other Windows version #2

Open aceqe opened 2 years ago

aceqe commented 2 years ago

Hi,

I tested it on windows 20H1 and got the following error:

[System:Progress] Parsing target binaries to construct CFGs...
[System:Progress] Initializing PDB symbol information...
Unhandled exception. System.Exception: Invalid range: 18011b190
   at Microsoft.FSharp.Core.PrintfModule.PrintFormatToStringThenFail@1433.Invoke(String message) in F:\workspace\_work\1\s\src\fsharp\FSharp.Core\printf.fs:line 1433
   at DLLAnalysis.NUIntModule.ofUInt64(UInt64 ui64) in /mnt/e/fuzz/NTFuzz/DLLAnalysis/src/Core/IntTypes.fs:line 37
   at DLLAnalysis.AddrModule.makeWithUI64(String bin, UInt64 ui64) in /mnt/e/fuzz/NTFuzz/DLLAnalysis/src/Core/BinTypes.fs:line 121
   at DLLAnalysis.PESymbol.updateSymbolMap(String binName, Symbol sym) in /mnt/e/fuzz/NTFuzz/DLLAnalysis/src/Core/PESymbol.fs:line 33
   at DLLAnalysis.PESymbol.initAux@51.Invoke(Symbol sym) in /mnt/e/fuzz/NTFuzz/DLLAnalysis/src/Core/PESymbol.fs:line 51
   at DLLAnalysis.PESymbol.initAux(String binName, BinHandler binHandle) in /mnt/e/fuzz/NTFuzz/DLLAnalysis/src/Core/PESymbol.fs:line 51
   at DLLAnalysis.PESymbol.init@55.Invoke(Tuple`2 tupledArg) in /mnt/e/fuzz/NTFuzz/DLLAnalysis/src/Core/PESymbol.fs:line 55
   at DLLAnalysis.PESymbol.init(FSharpList`1 binaries) in /mnt/e/fuzz/NTFuzz/DLLAnalysis/src/Core/PESymbol.fs:line 55
   at DLLAnalysis.FrontEnd.Parser.run(FSharpList`1 binFiles) in /mnt/e/fuzz/NTFuzz/DLLAnalysis/src/FrontEnd/Parse.fs:line 43
   at DLLAnalysis.CodeGenerate.run(String[] argv) in /mnt/e/fuzz/NTFuzz/DLLAnalysis/src/CodeGenerate/CodeGenerate.fs:line 43
   at Main.runMode(String mode, String[] args) in /mnt/e/fuzz/NTFuzz/DLLAnalysis/src/Main/Main.fs:line 14
   at Main.main(String[] argv) in /mnt/e/fuzz/NTFuzz/DLLAnalysis/src/Main/Main.fs:line 21

Project DLLanalysis can run ok on newer windows versions?

jchoi2022 commented 2 years ago

Hi, the problem here is that NTFUZZ currently targets x86 (32bit) Windows. This is to ease the implementation of system call hooking, as described in the paper. I will update the repo to mention this point in the README, too.

Please let me know if you still encounter a problem while trying DLLAnalysis on x86 version of Windows 20H1. (I didn't have time to try NTFUZZ on the latest Windows, unfortunately.)