Closed Hanseltu closed 4 years ago
saelo
commented
4 years ago Hi!
tuhaoxin@oscar-optimal:~/github/fuzzilli$ swift run -Xlinker='-lrt' -c release FuzzilliCli --profile=jsc ~/github/fuzzilli/Targets/Spidermonkey/gecko-dev/js/src/fuzzbuild_OPT.OBJ/dist/bin/js here you are using the wrong profile, try with --profile=spidermonkey. Does it work then?
Hanseltu
commented
4 years ago @saelo thank you very much! I change the profile with spidermonkey in your advise, it seems work ok but the statement still exists in the terminal. Does this mean I can not store the crashes and analyze them?
tuhaoxin@oscar-optimal:~/github/fuzzilli$ swift run -Xlinker='-lrt' -c release FuzzilliCli --profile=spidermonkey ~/github/fuzzilli/Targets/Spidermonkey/gecko-dev/js/src/fuzzbuild_OPT.OBJ/dist/bin/js
[Cli] No filesystem storage configured, found crashes will be discarded!
[Coverage] Initialized, 431547 edges
[JavaScriptEnvironment] initialized static JS environment model
[JavaScriptEnvironment] Have 42 available builtins: ["Boolean", "RegExp", "DataView", "Proxy", "Promise", "Map", "isNaN", "eval", "parseInt", "arguments", "Function", "JSON", "Symbol", "Uint8Array", "Int16Array", "Math", "isFinite", "parseFloat", "Infinity", "undefined", "this", "String", "enqueueJob", "Number", "Float64Array", "bailout", "Uint32Array", "Uint8ClampedArray", "Object", "Uint16Array", "Array", "Float32Array", "drainJobQueue", "WeakSet", "Reflect", "WeakMap", "gc", "Int8Array", "ArrayBuffer", "Int32Array", "NaN", "Set"]
[JavaScriptEnvironment] Have 144 available method names: ["expm1", "get", "fround", "stringify", "c", "deleteProperty", "getPrototypeOf", "reduceRight", "find", "apply", "max", "setUint32", "codePointAt", "setInt8", "isSafeInteger", "acosh", "includes", "padEnd", "ownKeys", "some", "cbrt", "sort", "d", "ceil", "has", "getInt16", "create", "for", "setFloat64", "pop", "setPrototypeOf", "isArray", "getFloat32", "log1p", "sqrt", "padStart", "getUint32", "fromCharCode", "random", "reduce", "clear", "every", "cosh", "defineProperties", "indexOf", "slice", "getInt32", "copyWithin", "floor", "splice", "atan2", "hypot", "getUint8", "delete", "getOwnPropertyDescriptors", "fromCodePoint", "setFloat32", "startsWith", "log10", "trunc", "flatMap", "fromEntries", "trim", "cos", "fill", "is", "shift", "concat", "defineProperty", "abs", "join", "min", "values", "acos", "construct", "atan", "assign", "e", "sinh", "pow", "entries", "bind", "setUint8", "tanh", "round", "split", "toLocaleString", "getOwnPropertySymbols", "subarray", "flat", "keys", "setUint16", "imul", "endsWith", "from", "sin", "charCodeAt", "raw", "toString", "getInt8", "tan", "forEach", "set", "repeat", "substring", "unshift", "map", "getUint16", "getOwnPropertyDescriptor", "log", "b", "of", "isNaN", "seal", "charAt", "atanh", "isFinite", "add", "filter", "sign", "setInt16", "asinh", "exp", "isInteger", "keyFor", "getOwnPropertyNames", "call", "preventExtensions", "isSealed", "parse", "clz32", "a", "push", "reverse", "asin", "getFloat64", "freeze", "findIndex", "setInt32", "isExtensible", "isFrozen", "replace", "lastIndexOf", "log2"]
[JavaScriptEnvironment] Have 42 property names that are available for read access: ["EPSILON", "toStringTag", "POSITIVE_INFINITY", "length", "search", "asyncIterator", "replace", "species", "MAX_VALUE", "c", "byteOffset", "unscopable", "e", "E", "NEGATIVE_INFINITY", "buffer", "toString", "constructor", "MIN_SAFE_INTEGER", "iterator", "NaN", "arguments", "byteLength", "a", "b", "__proto__", "match", "name", "prototype", "matchAll", "valueOf", "MAX_SAFE_INTEGER", "description", "size", "caller", "PI", "d", "isConcatSpreadable", "split", "hasInstance", "MIN_VALUE", "toPrimitive"]
[JavaScriptEnvironment] Have 10 property names that are available for write access: ["__proto__", "c", "toString", "a", "valueOf", "constructor", "e", "b", "length", "d"]
[JavaScriptEnvironment] Have 5 custom property names: ["b", "c", "d", "e", "a"]
[Fuzzer] Initialized
[Fuzzer] Recommended timeout: at least 230ms. Current timeout: 250ms
[Fuzzer] Startup tests finished successfully
[Fuzzer] Let's go!
Fuzzer Statistics
-----------------
Total Samples: 170
Interesting Samples Found: 81
Valid Samples Found: 133
Corpus Size: 81
Success Rate: 78.24%
Timeout Rate: 0.00%
Crashes Found: 0
Timeouts Hit: 0
Coverage: 7.60%
Avg. program size: 64.65
Connected workers: 0
Execs / Second: 47.91
Total Execs: 3033Yeah, for that just add the --storagePath=/path/to/some/dir flag, see https://github.com/googleprojectzero/fuzzilli/blob/master/Sources/FuzzilliCli/main.swift#L44 then it should work :)
Hanseltu
commented
4 years ago Great! thanks a lot ~
Thank you for your awesome fuzzing tool.
I just implement fuzzilli in my ubuntu 18.04 (with swift 5.0, clang 6.0) system, but not successful. Following instructors are the steps I used, pls tell me suggestions any helpful!
step 1 : Download Spidermonkey and run fuzzbuild.sh
after ./funzzbuild.sh
step 2: swift build and run
then I got the errors.
From the suggestion in Failed to communicate with child process with firefox #15, I got the following message
Could someone tell me what's the problem and how to figure it out? Thanks a lot!