search

shellphish / driller

Driller: augmenting AFL with symbolic execution!
BSD 2-Clause "Simplified" License
889 stars 162 forks source link

driller-fuzzer interaction #15

Closed badd0ge closed 7 years ago

badd0ge commented 7 years ago

Hi,

So I can run the test_fuzzer and the driller by themselves. I have also installed redis and claripy and can run the run.py in driller which seems to set things up for the driller to monitor the fuzzer. I also see where in tasks.py the pending_favs is monitored for the drilling to begin. My question is whether run.py should fire up the fuzzer by itself. It calls driller.tasks.fuzz.delay(binary) which never seems to call tasks.fuzz(binary) where all of the fuzzing and monitoring should happen, correct? What is the purpose of calling tasks.fuzz.delay instead of tasks.fuzz?

Thanks

badd0ge commented 7 years ago

Ok, I think I understand a bit more how this is supposed to work. The tasks.py in driller should be invoked with celery? Like celery -A tasks worker --loglevel=info somewhere. Then run.py will send celery a message to start the fuzzing/drilling tasks while it listens for crashes from redis. I guess I need to execute the celery command separately as above?

zardus commented 7 years ago

I just uploaded the following script: https://github.com/shellphish/fuzzer/blob/master/shellphuzz

It facilitates drilling on a single machine, and is definitely easier than the whole redis/celery or kubernetes setup.