search

google / AFL

american fuzzy lop - a security-oriented fuzzer
https://lcamtuf.coredump.cx/afl/
Apache License 2.0
3.67k stars 631 forks source link

Fuzz programs that change input files #111

Closed qixin5 closed 4 years ago

qixin5 commented 4 years ago

Dear AFL authors,

I wonder what could be a way to use AFL to properly fuzz a program that modifies the input files provided.

I tried fuzzing bzip2 by running something like "path_to_afl-fuzz -i afl-in -o afl-out ./bzip2 @@", where ./bzip2 is a program that's compiled using afl-clang and afl-in contains a text file to be zipped. Unfortunately, I got "total paths: 1" and "(odd, check syntax!)" all the time.

I suspect that this is because bzip2 deletes the original text file (i.e., the input file for AFL) for zipping, and this makes AFL run in an unexpected way.

If so, I wonder what could be a workaround here? Thanks very much!

ianruh commented 4 years ago

Hi @qixin5, It looks like your problem is that bzip2 won't overwrite existing .bz2 files be default. Add the -f flag ("overwrite existing output files" - from the bzip2 help text) to force it to do so.

So your command would be afl-fuzz -i afl-in -o afl-out ./bzip2 -f @@.