qiling icon indicating copy to clipboard operation
qiling copied to clipboard

AFL++ not detecting crashes on Qiling dev

Open Olasergiolas opened this issue 2 years ago • 0 comments

*Describe the bug Previously, when fuzzing an ARM binary using a Qiling fuzzing script with Qiliing stable, AFL++ was able to properly identify and record when the binary crashed but now on Qiling dev, crashes do not seem to be getting caught by AFL++ anymore. The binary in question is a proof of concept that forces a crash when a string starting with 'a' longer than 10 characters is used as parameter.

  • Packages used with Qiling stable: image
  • Packages used with Qiling dev: image

Sample Code A frozen branch has been created in https://github.com/Olasergiolas/TFG/tree/issue-qiling-fuzzing/Fuzzing/Qiling/PoC with everything needed to recreate the issue.

Expected behavior AFL++ should be able to detect crashes regardless of the Qiling version.

Screenshots The following AFL++ instances were started with AFL_PATH="/AFLplusplus" PATH="$AFL_PATH:$PATH" afl-fuzz -i fuzz_setup/in -o fuzz_setup/out -U -- python3 src/fuzz.py @@ and AFL_PATH="/AFLplusplus" PATH="$AFL_PATH:$PATH" afl-fuzz -i fuzz_setup/in -o fuzz_setup/out -U -- python3 src/dev/fuzz.py @@

  • The crash is found instantly when fuzzing on Qiling stable: image
  • No crash is found after fuzzing for 20 minutes on Qiling dev: image

Additional context It was also observed that when running the fuzzing script ("src/fuzz.py" and "src/dev/fuzz.py") without AFL++ (python fuzz.py fuzz_setup/in/b), two different behaviors are exhibited depending on the version of Qiling that is being used.

  • On QIling stable: image
  • On Qiling dev: image image

Olasergiolas avatar May 30 '22 19:05 Olasergiolas