afl.rs icon indicating copy to clipboard operation
afl.rs copied to clipboard

Debugging crashes that don't happen outside of AFL.rs

Open XAMPPRocky opened this issue 4 years ago • 0 comments

Hey, not sure where's the best place to ask about this, but I'm running into crashes in my program when being fuzzed by afl.rs, that I can't replicate when running the code without the fuzzer. You can check this out yourself in the rasn repository.

Setup

  • Clone https://github.com/XAMPPRocky/rasn/tree/0b7160daca42f3b54072253accc0582dabe10295
  • cd fuzzing
  • cargo afl build
  • AFL_MAP_SIZE=117760 cargo afl fuzz -i in -o out target/debug/fuzzing
  • Leave it running, and wait until a crash appears. (usually in the first few seconds)
  • cargo run --bin check_crashes This runs a short program to run the same code as the fuzzer over each entry in the out directory.

If everything is setup, check_crashes should print No valid crash cases found. while afl.rs shows multiple (up to 20 usually) unique crashes.

XAMPPRocky avatar Sep 13 '21 12:09 XAMPPRocky