angr / rex

Shellphish's automated exploitation engine, originally created for the Cyber Grand Challenge.
BSD 2-Clause "Simplified" License
635 stars 102 forks source link

angr.exploration_techniques.tracer.TracerDesyncError: BUG! Please investigate the claim in the comment above me #54

Closed Techno-Fox closed 2 years ago

Techno-Fox commented 4 years ago

Hello (It's me again!!!). So No I'm getting this error (put what's left of my sanity here). I believe this has something to do with libc.6.so (hope i spelled that right).

Story time:

So I'm used to finding vulnerabilities the "old fashion way" were you would stare at a debugger and examine the code flow. However to make my life simpler I started researching ways on who to find vulnerabilities easier. I always heard of fuzzing, but never for a binary, AFL, or shellphuzz (which from my knowledge uses AFL and driller). Now I've spent two days (school got in the way). Trying to figure out some errors. Finally got shellphuzz to work. OR so I though. This error still comes up, and even in rex (not the same exact error, but for the same reason I believe). I would really like some help on this. THX

P.S. Sorry If I'm giving you all a hard time. Just trying to help if possible, and get used to fuzzing with a variaty of tools. I've done my research on you all, and congrats at the DARPA.

P.S.S Thank you for helping me in the past.

The error :

angr.exploration_techniques.tracer.TracerDesyncError: BUG! Please investigate the claim in the comment above me

The FULL Error :

Traceback (most recent call last): File "/opt/fuzzer/driller/local_callback.py", line 122, in for new_input in d.drill_generator(): File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/driller/driller_main.py", line 101, in drill_generator for i in self._drill_input(): File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/driller/driller_main.py", line 141, in _drill_input simgr.step() File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/misc/hookset.py", line 75, in call result = current_hook(self.func.self, args, kwargs) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/exploration_techniques/driller_core.py", line 39, in step simgr.step(stash=stash, kwargs) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/misc/hookset.py", line 75, in call result = current_hook(self.func.self, args, kwargs) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/exploration_techniques/tracer.py", line 225, in step return simgr.step(stash=stash, kwargs) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/misc/hookset.py", line 80, in call return self.func(args, kwargs) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/sim_manager.py", line 344, in step successors = self.step_state(state, successor_func=successor_func, run_args) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/misc/hookset.py", line 75, in call result = current_hook(self.func.self, args, **kwargs) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/exploration_techniques/tracer.py", line 275, in step_state self._update_state_tracking(succs[0]) File "/opt/fuzzer/shellphuzz_venv3/lib/python3.7/site-packages/angr/exploration_techniques/tracer.py", line 386, in _update_state_tracking deviating_trace_idx=idx) angr.exploration_techniques.tracer.TracerDesyncError: BUG! Please investigate the claim in the comment above me (b'', None)

P.S. I am running this in a Python3 virtual environment

rhelmot commented 4 years ago

This is a duplicate of https://github.com/shellphish/driller/issues/80, and I need the same thing from you in order to debug it.

Techno-Fox commented 4 years ago

Just sent the file over to you over https://github.com/shellphish/driller/issues/80 You can use some litterly random input fuzzing data. I had to much to compress and send over.

github-actions[bot] commented 2 years ago

This issue has been marked as stale because it has no recent activity. Please comment or add the pinned tag to prevent this issue from being closed.

github-actions[bot] commented 2 years ago

This issue has been closed due to inactivity.