vusec / vuzzer64

This implements a 64-bit version of vusec/vuzzer fuzzing tool.
Apache License 2.0
175 stars 51 forks source link

vuzzer report 'Empty cmp.out file! Perhaps taint analysis did not run...' #29

Open lzyxdu opened 1 year ago

lzyxdu commented 1 year ago

I follow the instruction in README and wikiHOWTO to run vuzzer, using following command:

cd vuzzer64-master
export PIN_HOME=/home/lzy/pin-3.20/pin-3.20-98437-gf02b61307-gcc-linux
export PIN_ROOT=/home/lzy/pin-3.20/pin-3.20-98437-gf02b61307-gcc-linux
export DFT_HOME=/home/lzy/vuzzer/vuzzer64-master/libdft64
cd fuzzer-code
echo 0 |sudo tee /proc/sys/kernel/randomize_va_space
echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope
python runfuzzer.py -s '/home/lzy/vuzzer/vuzzer64-master/fuzzer-code/lava-m-binaries/who %s' -i 'datatemp/utmp/' -w 'lava-m-binaries/who.pkl' -n 'lava-m-binaries/who.names' -o '0x00000000'

and I got:

0
0
[*] Starting dry run now...
[*] Finished good inputs (3605)
[*] Starting bad inputs..
[*] finished common BB. TOtal such BB: 0
========================================
463091:47:57.819 - Start Program
========================================

[*] taintflow finished.
[**] Gen: 0. Executed 10 of 100.**
[**] Gen: 0. Executed 20 of 100.**
[**] Gen: 0. Executed 30 of 100.**
[**] Gen: 0. Executed 40 of 100.**
[**] Gen: 0. Executed 50 of 100.**
[**] Gen: 0. Executed 60 of 100.**
[**] Gen: 0. Executed 70 of 100.**
[**] Gen: 0. Executed 80 of 100.**
[**] Gen: 0. Executed 90 of 100.**
[**] Gen: 0. Executed 100 of 100.**
[*] Done with all input in Gen, starting SPECIAL. 

[*] Wrote to stat.log

Empty cmp.out file! Perhaps taint analysis did not run...
========================================
463091:49:35.877 - End Program
Elapsed time: 0:01:38.057
========================================

cmp.out is not empty when vuzzer is running, but when vuzzer stops,cmp.out became empty. I'd like to know if I used Vuzzer correctly? If not, what should I do to correct it? Thank you!