winafl

winafl copied to clipboard

How to fuzz an executable with WinAFL?

5

Sorry this is a question rather than an issue, I reposted it here since there were no replies on afl-users list (https://groups.google.com/forum/#!topic/afl-users/x-GbNuqnvEM). I was trying WinAFL and followed the tutorials...

hongxuchen

The application crashes when I try to make sure that the target is working correctly under DynamoRIO with -c WinAFL.dll client module.

1

Hello. The application crashes when I try to make sure that the target is working correctly under DynamoRIO with -c WinAFL.dll client module. I try this: `D:/.../DynamoRIO-Windows-7.91.18151-0/bin64/drrun.exe -c winafl.dll -debug...

JeySamir

Application hangs when using custom net fuzzer

13

I'm trying to fuzz an application that starts up, spawns a lot of threads, and both connects to a server and acts as a server. Using drrun with the debug...

Jello

There is a way to fuzz GUI applications with WinAFL ?

4

Hey everyone I try to fuzz some app with a GUI, but it require me to press some buttons to open a file. but when I try to fuzz it,...

Daniel0xcc

PROGRAM ABORT : No instrumentation detected

1

`afl-fuzz.exe -i ..\testcases\tests -o ..\out -D C:\DynamoRIO\bin32 -t 10000+ -- -coverage_module AppShieldDLL.dll -fuzz_iterations 5000 -target_module HncAppShield.exe -target_method fuzz_hwp -nargs 1 -- .\HncAppShield.exe @@` `WinAFL 1.16b by `Based on AFL 2.43b...

ryancor

I'm attempting to use afl_post_library to modify test cases. I only see my code called once on setup with the "hello" test string, as seen here. https://github.com/googleprojectzero/winafl/blob/master/afl-fuzz.c#L1477 After this, it...

Jello

Hey everyone !, I try to use static instrumentation (via syzygy) and i get errors every time that look's like this : `[0805/230501:ERROR:pe_file_parser.cc(1175)] Unknown version of the IMAGE_LOAD_CONFIG_DIRECTORY structure (160...

Daniel0xcc

I spent an hour right now trying to debug `error connecting to pipe` on test run without afl-fuzz. It occured that I forgot the `-debug` option. While the whole thing...

vient

[PT] Module ... loaded in the address range that module ... previously occupied.

2

Hi, Just curious why there is [such](https://github.com/googleprojectzero/winafl/blob/master/winaflpt.c#L723) a constraint? It's not uncommon to hit this behavior ``` [-] PROGRAM ABORT : Module RICHED20.DLL loaded in the address range that module...

expend20

When doing network fuzzing, does winafl allows us to fuzz function that calls the receive data function?

2

Hi, I have a question on network fuzzing. Can I choose the target function that calls the receive data function? For example, I tried to fuzz test_netmode.exe (provided by WinAFL)....

xinyile