googleprojectzero / winafl

A fork of AFL for fuzzing Windows binaries
Apache License 2.0
2.36k stars 533 forks source link

PROGRAM ABORT : CreateNamedPipe failed, GLE=231 #430

Closed gnbon closed 8 months ago

gnbon commented 9 months ago

Winafl crashes immediately after re-start afl-fuzz. The master instance issues a program abort, but the slave instances execute dry-run normally.

afl-fuzz -M master -i cmin -o out -t 5000+ -D DynamoRIO\bin32 -- -fuzz_iterations 10000 -covtype edge -coverage_module coverage.dll -target_module target.exe -target_method fuzzme -nargs 2 -- target.exe @@
WinAFL 1.17 by <ifratric@google.com>
Based on AFL 2.43b by <lcamtuf@google.com>
[+] You have 20 CPU cores with average utilization of 21%.
[+] Try parallel jobs - see afl_docs\parallel_fuzzing.txt.
[*] Checking CPU core loadout...
[+] Found a free CPU core, binding to #12.
[+] Process affinity is set to 1000.
[*] Setting up output directories...
[+] Output directory exists but deemed OK to reuse.
[*] Deleting old session data...
[+] Output dir cleanup successful.
[*] Scanning 'cmin'...
[+] No auto-generated dictionary tokens to reuse.
[*] Creating hard links for all input files...
[*] Attempting dry run with 'id_000_id_000086'...

[-] PROGRAM ABORT : CreateNamedPipe failed, GLE=231.

         Location : create_target_process(), C:\winafl\afl-fuzz.c:2448
gnbon commented 9 months ago

The error occurs at line 2434~2449 of the code. https://github.com/googleprojectzero/winafl/blob/25d5840799b628c8ef7750cd07ef2e30b299b156/afl-fuzz.c#L2434-L2449

As far as I know, this error occurs when CreateNamedPipeattempts to create a pipe with a pipe_name argument that has already been created and not deleted.

gnbon commented 9 months ago

I solved the issue. I was running two different fuzzing campaigns with the same master name given to afl-fuzz -M option. So I guess the pipe_name was overlapped.