search

googleprojectzero / winafl

A fork of AFL for fuzzing Windows binaries
Apache License 2.0
2.34k stars 534 forks source link

Fail to fuzz imagemagick convert #31

Open fuzzyushi opened 7 years ago

fuzzyushi commented 7 years ago

Hi, ivan, When I fuzzed the iamgemagick convert with using the command afl-fuzz -i input_dir -o output_dir -D path/to/Dynamorio/bin32 -t 20000 -- coverage_module convert.exe -fuzz_iterations 5000 -target_module convert.exe -target_offset 0xa291e -nargs 3 -- convert.exe @@ out.ipg I got an error that PROGRAM ABORT: test case result in a hang when perform_dry_run().

0xa291e is the export entry of main() function, I got it from IDA pro.

I wonder whether the command is correct or not? When I typed the command convert a.png a.jpg in the console, I got the correct result. So I need your help.

ivanfratric commented 7 years ago

Hi, the best way to check if your command is correct or not is to use the WinAFL debug mode before attempting a fuzzing run. Please see the readme for details.

mrpeppels commented 7 years ago

Indeed, as the readme sais, the next step is to generate a debug log and analyze the output. I suggest looking at the other issues for help. Off the bat, i do see an error that could cause that output, your coverage_module does not have a dash in front of it.