stephenfewer / grinder

Grinder is a system to automate the fuzzing of web browsers and the management of a large number of crashes.
BSD 3-Clause "New" or "Revised" License
415 stars 131 forks source link

Problem with log files when IE8 crashes :( #9

Closed sweetsyk00 closed 11 years ago

sweetsyk00 commented 11 years ago

hi there! Firstly, thx to the author of "Grinder" cauz it's very usefull !! Need just a little fix about the log files as you can see below...

My config :

The problem is when a crash occur, no log file is created or one with the first xml tag but nothing else. (fuzzer name="fuzz" browser="IE")

Stephen, did you have the same problem recently (or not) ?

[+G+] Starting at 2013-06-15 18:08:13 [+G+] Using the config file 'config'... [+G+] Bringing up Grinder node 'G1'... [+G+] Started the Grinder continue process 3456 [+S+] Starting at 2013-06-15 18:08:13 [+S+] Adding fuzzer 'fuzzv2' to the testcase server [+S+] Testcase server running on 127.0.0.1:8080 [+G+] Started the Grinder server process 2388 [+G+] Started the Grinder debugger process 736 [+D+] Starting at 2013-06-15 18:08:15 [+D+] Using the symbol path 'SRV_C:\symbols_http://msdl.microsoft.com/download/ symbols' [+D+] Running 'C:\Program Files\Internet Explorer\iexplore.exe' [+D+] Attached debugger to new process 2264 [+D+] Logger DLL loaded into process 2264 @ 0x10000000 [+D+] Logging process 2264 to log file 'C:\Documents and Settings\XXX\Local Sett ings\Temp\logger_2264.xml' [+D+] Attached debugger to new process 3648 [+D+] Logger DLL loaded into process 3648 @ 0x10000000 [+D+] Logging process 3648 to log file 'C:\Documents and Settings\XXX\Local Sett ings\Temp\logger_3648.xml' [+D+] Debug message from process 3648: CRecorderBarBHOSite::SetSite


[-D-] Error, unable to save the log file 'C:\Documents and Settings\XXX\Local Se ttings\Temp\logger_3648.xml' (File doesnt exist) [-D-] Failed to save the log file.


[D] [D] Caught a Read Access Violation in IE8 process 3648 at 2013-06-15 18:08:17

...

v-p-b commented 11 years ago

Looks like a duplicate of #6 ?

sweetsyk00 commented 11 years ago

oups yep u are right... did you find a solution ?

sweetsyk00 commented 11 years ago

Hey ! So i found it ! Actually, just patched the file logger.c like below && rebuild grinder_logger.dll Enjoy ;)

VOID logMessage( wchar_t * cpMessageW ) { ...

if( !hLog && cpLogFile ) {

hLog = CreateFile( cpLogFile, GENERIC_WRITE, FILE_SHARE_READ, NULL, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, NULL );

//hLog = CreateFile( cpLogFile, GENERIC_WRITE, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL );

...

} ... }

stephenfewer commented 11 years ago

Thanks sweetsyk00, CreateFile is using CREATE_ALWAYS because Grinder needs to overwrite an existing log file when logging a new testcase (LOGGER_finishedTest will close and NULL out the handle), but it also needs to create the log file if it does not already exist. CREATE_ALWAYS should provide this whereas CREATE_NEW will fail if the file already exists.

I will setup an XP box and try to recreate this bug.

[0] https://github.com/stephenfewer/grinder/blob/master/node/source/logger/logger.c#L251

stephenfewer commented 11 years ago

I just tested the latest Grinder trunk on fully patched XP SP3 with IE8 (and Ruby 1.9.3) and logging seems fine.

Does your fuzzer call logger.starting() and logger.finished() like in the example fuzzer? these two calls are important for logging to work.

I also noticed your console output doesn't show the jscript.dll being either loaded or hooked. The grinder node should print something like:

[+D+] Attached debugger to new process 1668
[+D+] Logger DLL loaded into process 1668 @ 0x10000000
[+D+] Logging process 1668 to log file 'C:\Documents and Settings\user\Local Settings\Temp\logger_1668.xml'
[+D+] jscript.dll DLL loaded into process 1668 at address 0x3D7A0000
[+D+] Resolved jscript!StrToDbl @ 0x3D7B751C
[+D+] Hooked JavaScript parseFloat() to grinder_logger.dll via proxy @ 0x02B90000

Does this step happen (perhaps you didn't cut and paste it)?

sweetsyk00 commented 11 years ago

Actually, since the last fix, all is all right ! Thanks ;)

stephenfewer commented 11 years ago

Ok, cheers. Closing this as I can't reproduce and you've now got it working! :)