search

zyw-200 / FirmAFL

FIRM-AFL is the first high-throughput greybox fuzzer for IoT firmware.
GNU General Public License v3.0
438 stars 91 forks source link

Spinning up for too much time #21

Closed haowayne closed 1 year ago

haowayne commented 4 years ago

I try to run the given firmware DIR-850L, and make some corrections for firm_id according to firmadyne's output. But when coming to afl-fuzz, it stucked at the point of "Spinning up the fork server". How can I fix it? Or did I do something wrong for the configuration?

[+] sending buffer size 3199 ./afl-fuzz -m none -t 800000+ -Q -i ./inputs -o ./outputs -x keywords afl-fuzz 2.52b by <lcamtuf@google.com> [+] You have 1 CPU core and 0 runnable tasks (utilization: 0%). [*] Setting up output directories... [+] Output directory exists but deemed OK to reuse. [*] Deleting old session data... [+] Output dir cleanup successful. [*] Scanning './inputs'... [+] No auto-generated dictionary tokens to reuse. [*] Creating hard links for all input files... [*] Loading extra dictionary from 'keywords' (level 0)... [+] Loaded 158 extra tokens, size range 4 B to 126 B. [!] WARNING: Some tokens are relatively large (126 B) - consider trimming. [*] Validating target binary... [*] Attempting dry run with 'id:000000,orig:seed'... dry run:./outputs/queue/id:000000,orig:seed [*] Spinning up the fork server...

haowayne commented 4 years ago

It throws an error after a long time in afl.

[-] Hmm, looks like the target binary terminated before we could complete a handshake with the injected code. Perhaps there is a horrible bug in the fuzzer. Poke lcamtuf@coredump.cx for troubleshooting tips.

[-] PROGRAM ABORT : Fork server handshake failed Location : init_forkserver(), afl-fuzz.c:2253

Nicholas-wei commented 1 year ago

I have encountered this problems days ago and I successfully fixed it. Here are some suggestions

  1. check Firmafl_2020 and follow the instructions here https://github.com/zyw-200/FirmAFL_2020 to setup
  2. in each image_xxx directory in the root directory (for example, image_9050), you can read the start.py file, you can see that the file does three things(run run.sh, run test.py and run user.sh) and there is a sleep() after run.sh. The problem for me is that the sleep() time is not enough, and firmadyne hasn't fully started the firmware yet. so I executed the three instructions by my self ,one by one (and ensures that python test.py doesn't give any connection error, otherwise firmadyne setup is not yet successful). and eventually fixes my problem
  3. When the arch is mipseb, you should write ARCH=mips in python FirmAFL_setup.py, xxxx,$(ARCH), NOT MIPSEB

image