qiling
qiling copied to clipboard
AFL++ not detecting crashes on Qiling dev
*Describe the bug Previously, when fuzzing an ARM binary using a Qiling fuzzing script with Qiliing stable, AFL++ was able to properly identify and record when the binary crashed but now on Qiling dev, crashes do not seem to be getting caught by AFL++ anymore. The binary in question is a proof of concept that forces a crash when a string starting with 'a' longer than 10 characters is used as parameter.
- Packages used with Qiling stable:
- Packages used with Qiling dev:
Sample Code A frozen branch has been created in https://github.com/Olasergiolas/TFG/tree/issue-qiling-fuzzing/Fuzzing/Qiling/PoC with everything needed to recreate the issue.
- Fuzzing script for Qiling stable.
- Fuzzing script for Qiling dev.
- Source code of the fuzzed binary.
Expected behavior AFL++ should be able to detect crashes regardless of the Qiling version.
Screenshots
The following AFL++ instances were started with AFL_PATH="/AFLplusplus" PATH="$AFL_PATH:$PATH" afl-fuzz -i fuzz_setup/in -o fuzz_setup/out -U -- python3 src/fuzz.py @@
and AFL_PATH="/AFLplusplus" PATH="$AFL_PATH:$PATH" afl-fuzz -i fuzz_setup/in -o fuzz_setup/out -U -- python3 src/dev/fuzz.py @@
- The crash is found instantly when fuzzing on Qiling stable:
- No crash is found after fuzzing for 20 minutes on Qiling dev:
Additional context It was also observed that when running the fuzzing script ("src/fuzz.py" and "src/dev/fuzz.py") without AFL++ (python fuzz.py fuzz_setup/in/b), two different behaviors are exhibited depending on the version of Qiling that is being used.
- On QIling stable:
- On Qiling dev: