googleprojectzero / Jackalope

Binary, coverage-guided fuzzer for Windows, macOS, Linux and Android
Apache License 2.0
1.1k stars 128 forks source link

How to solve create process failed, GLE=2 error #39

Open bheem1007 opened 2 years ago

bheem1007 commented 2 years ago

[-] PROGRAM ABORT : CreateProcess failed, GLE=2. Location : Debugger::StartProcess(), C:\Users\admin\Desktop\Jackalope\TinyInst\Windows\debugger.cpp:1670 Screenshot 2022-09-01 153920

ifratric commented 2 years ago

GLE=2 means ERROR_FILE_NOT_FOUND, see https://docs.microsoft.com/en-us/windows/win32/debug/system-error-codes--0-499-

does Accel.exe exist in the current directory (or PATH)?

bheem1007 commented 2 years ago

yes sir! Accel.exe exist in the path, but don't know why fuzzing is not happening. Screenshot 2022-09-01 164945

ifratric commented 2 years ago

From the screenshot it looks like Accel.exe is in Accel directory. So it should be .. -- Accel\Accel.exe -m @@.

I also see you pointed input directory to Accel, but note that -in is meant for input fuzzing samples, not for directory containing the target.

bheem1007 commented 2 years ago

so what should I mention after -in sir

ifratric commented 2 years ago

A directory containing input samples. Some valid files of the type Accel.exe processes. (I have no idea what it actually does).

bheem1007 commented 2 years ago

This is the command I used, C:\Users\admin\Desktop\Jackalope\build\Release>fuzzer.exe -in Accel -out out4 -t 1000 -delivery shmem -instrument_module Accel.exe -target_module Accel.exe -target_method fuzz -nargs 1 -cgc.dll -tiny-AES128-C.dll -add_all_inputs -iterations 10000 -persist -loop -cmp_coverage -- Accel\Accel.exe -m @@

this is the result am getting while using it ,please help me to get the fuzzing output sir. Screenshot 2022-09-01 172241

bheem1007 commented 2 years ago

can you say, Is my fuzzing command is correct ? where am mistaking?

ifratric commented 2 years ago

For the command to work like this, the target needs to implement the fuzz() method. If the target isn't a fuzzing harness you yourself wrote, It's not going to work. I also expect that your target doesn't understand -m argument, since this is my fuzzing harness specific. Unfortunately I can't help you to build a fuzzing setup for a specific target. But good starting points are to understand how your target works and what Jackalope does and which options do what (you can experiment with the provided test.exe sample). You might want to first experiment without persistent mode (without -target_module and -target_method flags) until you get a setup that works.

bheem1007 commented 2 years ago

sir fuzzing is running but errors are not identifying .. Screenshot (38)