Ivan Fratric

Results 257 comments of Ivan Fratric

There are 2 reasons why Jackalope might discard the sample: - Mutating the sample produces too many crashes - Mutating the sample produces too many hangs This is for performance...

If your target is using exceptions, you should add `-generate_unwind` flag, otherwise the exceptions won't be handled correctly under instrumentation and you'll get crashes / hangs like you describe. There...

WinAFL.sln won't be generated unless DynamoRIO_DIR is specified. Please see the README for build instructions. Note: winafl can work without DynamoRIO, but then one of the other modes (e.g. -DTINYINST=1)...

Hey, thanks for reporting! Just a quick note to let you know this is on my radar, but I'm out of office at the moment without access to the Apple...

I can try it on Apple Silicon host once I'm back in the office (next week, hopefully). One thing you can try is remove the PAC bits in `exception->ip` in...

FYI: I'm back and looking into this. You are correct that the PC (and some other register values) read from the thread context are PAC-signed when the target is an...

There has been some progress in https://github.com/googleprojectzero/TinyInst/commit/23e026a1a02ae7427cd9235db4752f7b33413fca, but while this works for my own arm64e programs (assuming TinyInst was built with `-DCMAKE_OSX_ARCHITECTURES=arm64e`), it still doesn't work on Apple binaries. Possibly...

Hey there, when saying "winAfl is not working in Win11" I assume you mean the issue explained here: https://github.com/googleprojectzero/winafl/issues/466#issuecomment-2801286392 Since the issue is in DynamoRIO and not WinAFL itself, there...

Does it work if you replace dr_register_exit_event with drmgr_register_exit_event here: https://github.com/googleprojectzero/winafl/blob/master/winafl.c#L1000

You are most likely encountering a know issue with DynamoRIO instrumentation on Windows 11 after 24H2, see https://github.com/DynamoRIO/dynamorio/issues/7487. Unfortunately little can be done on the WinAFL end until either the...