search

googleprojectzero / Jackalope

Binary, coverage-guided fuzzer for Windows, macOS, Linux and Android
Apache License 2.0
1.1k stars 128 forks source link

Order of parameters in cmpcov matters? #24

Closed expend20 closed 2 years ago

expend20 commented 2 years ago

Hello @ifratric,

I've encountered a small problem in cmp coverage mechanics. It looks like the order of parameters does count. For example:

    cmp rcx, [rsp+0x78] ; this won't work

vs:

    cmp [rsp+0x78], rcx ; this is working

But in the first case some samples are found, so just as an assumptoin, the displacement may be calculated not accurately.

Project attached: jack_cmp.zip

UPD: just in case the parameters for the fuzzer:

fuzzer.exe -in c:\temp\in_1\ -out out -t 5000 -instrument_module test.exe -target_module test.exe -target_method FuzzIteration -nargs 1 -iterations 10000 -persist -loop -cmp_coverage -- test.exe @@
ifratric commented 2 years ago

This should be fixed by https://github.com/googleprojectzero/TinyInst/commit/022421abb6e027d15d11bef835c4cb4b52b2d45f

I ran your test target and confirmed it's now working correctly. Cheers!