kAFL icon indicating copy to clipboard operation
kAFL copied to clipboard

kafl fuzzer measures the wrong test case's coverage

Open timnewsham opened this issue 6 years ago • 0 comments

qemu.py sends an extra 'R' message during initial handshake and soft reload. This releases the virtual machine that is waiting on hypercall_next_payload before qemu.py writes to the payload buffer. As a result, when the bitmap is returned, it is always measuring the previous test case, not the current test case (unless the vm is running slow enough, then qemu.py can occasionally win the race and get the buffer filled before the vm processes it). The fix is easy -- remove the extra send of the 'R' message in qemu.py's soft_reload and set_init_state methods.

timnewsham avatar Aug 14 '19 18:08 timnewsham