zyw-200 / FirmAFL

FIRM-AFL is the first high-throughput greybox fuzzer for IoT firmware.
GNU General Public License v3.0
438 stars 91 forks source link

Running into errors with run.sh #48

Open majodu opened 3 years ago

majodu commented 3 years ago

I am trying to get the tplink 940 firmware working

when running run.sh I get the error

Creating TAP device tap105568_0...
Set 'tap105568_0' persistent and owned by uid 1000
Bringing up TAP device...
Adding route to 192.168.0.1...
Starting firmware emulation... use Ctrl-a + x to exit
afl-fuzz 2.52b by <lcamtuf@google.com>
[+] Looks like we're not running on a tty, so I'll be a bit less verbose.
[+] You have 1 CPU core and 3 runnable tasks (utilization: 300%).
[*] Checking core_pattern...

[-] Hmm, your system is configured to send core dump notifications to an
    external utility. This will cause issues: there will be an extended delay
    between stumbling upon a crash and having this information relayed to the
    fuzzer via the standard waitpid() API.

    To avoid having crashes misinterpreted as timeouts, please log in as root
    and temporarily modify /proc/sys/kernel/core_pattern, like so:

    echo core >/proc/sys/kernel/core_pattern

[-] PROGRAM ABORT : Pipe at the beginning of 'core_pattern'
         Location : check_crash_handling(), afl-fuzz.c:7289

Deleting route...
Bringing down TAP device...
Deleting TAP device tap105568_0...
Set 'tap105568_0' nonpersistent

if I take out the AFL line from

${AFL} \
 ${QEMU} -m 256  -M ${QEMU_MACHINE} -kernel ${KERNEL} \

I get the output

Creating TAP device tap105568_0...
Set 'tap105568_0' persistent and owned by uid 1000
Bringing up TAP device...
Adding route to 192.168.0.1...
Starting firmware emulation... use Ctrl-a + x to exit
Could not create fifo ../image_105600/user_cpu_state
Deleting route...
Bringing down TAP device...
Deleting TAP device tap105568_0...
Set 'tap105568_0' nonpersistent

if i replace QEMU="./qemu-system-mips" with QEMU="get_qemu ${ARCHEND}" the VM starts up but it hangs on [*] Spinning up the fork server... when running the start.py script.

has anyone encountered this? I feel like i am at the last hurdle of getting this thing working