googleprojectzero / winafl

A fork of AFL for fuzzing Windows binaries
Apache License 2.0
2.36k stars 533 forks source link

not running under DR #441

Closed zhefox closed 5 months ago

zhefox commented 5 months ago

When I run my harness with drrun debug it works fine, but when I run fuzz with winafl it shows the following: process 37460 is not running under DR 0 processes nudged nudge operation failed, verify permissions and parameters.

drrun debug log: Module loaded, dynamorio.dll Module loaded, xxx.dll Module loaded, winafl.dll Module loaded, drx.dll Module loaded, drreg.dll Module loaded, drmgr.dll Module loaded, drwrap.dll Module loaded, harness.exe Module loaded, VERIFIER.dll Module loaded, VCOMP140.DLL Module loaded, VCRUNTIME140.dll Module loaded, ucrtbase.dll Module loaded, KERNELBASE.dll Module loaded, WS2_32.dll Module loaded, RPCRT4.dll Module loaded, KERNEL32.dll Module loaded, ntdll.dll In pre_fuzz_handler In OpenFileW, reading xxx In OpenFileW, reading xxx In post_fuzz_handler In pre_fuzz_handler In OpenFileW, reading xxx In OpenFileW, reading xxx In post_fuzz_handler

In post_fuzz_handler Everything appears to be running normally. Coverage map follows:

zhefox commented 5 months ago

I'll add to my command line arguments afl-fuzz.exe -i in -o out -m none -t 20000+ -D C:\Use rs\xxx\Desktop\fuzz\dymRIO\bin64\ -- -coverage_module xxx.dll -target_module harness.exe -target_offset 0x1130 -fuzz_iterations 2 -nargs 2 -- C:\Users\xxx\Deskt op\fuzz\harness.exe @@

zhefox commented 5 months ago

Furthermore, my program is running normally, and WinAFL is indeed fuzzing, as evidenced by the running interface. Upon inspection, I've confirmed that winafl.dll has successfully been instrumented into the target program.

zhefox commented 5 months ago

image

zhefox commented 5 months ago

Oh, I think I've just discovered an issue in my harness. There's a conditional judgment in the code that's causing the program's DLL to prematurely exit before reaching the end of the harness.