Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

afl-showmap generating incorrectly sized map #139

Closed
emwjacobson opened this issue Apr 14, 2023 · 1 comment
Closed

afl-showmap generating incorrectly sized map #139

emwjacobson opened this issue Apr 14, 2023 · 1 comment

Comments

@emwjacobson
Copy link

Running the following command I get the following errors (with increased verbosity)

root@39b2dcd3cc08:/cb-multios# /root/.cargo/bin/symcc_fuzzing_helper -v -o /cb-multios/build_afl/challenges/Barcoder/out/ -a Barcoder-S -n symcc -- /cb-multios/build_symcc/challenges/Barcoder/Barcoder
[2023-04-14T01:56:33Z DEBUG symcc_fuzzing_helper] SymCC configuration: SymCC { use_standard_input: true, bitmap: "/cb-multios/build_afl/challenges/Barcoder/out/symcc/bitmap", input_file: "/cb-multios/build_afl/challenges/Barcoder/out/symcc/.cur_input", command: ["/cb-multios/build_symcc/challenges/Barcoder/Barcoder"] }
[2023-04-14T01:56:33Z DEBUG symcc_fuzzing_helper] AFL configuration: AflConfig { show_map: "afl-showmap", target_command: ["--", "/cb-multios/build_afl/challenges/Barcoder/Barcoder"], use_standard_input: true, use_qemu_mode: false, queue: "/cb-multios/build_afl/challenges/Barcoder/out/Barcoder-S/queue" }
[2023-04-14T01:56:33Z INFO  symcc_fuzzing_helper] Running on input /cb-multios/build_afl/challenges/Barcoder/out/Barcoder-S/queue/id:000005,src:000000,time:56,execs:62,op:havoc,rep:4,+cov
[2023-04-14T01:56:33Z DEBUG symcc_fuzzing_helper::symcc] Running SymCC as follows: "timeout" "-k" "5" "90" "/cb-multios/build_symcc/challenges/Barcoder/Barcoder"
[2023-04-14T01:56:35Z DEBUG symcc_fuzzing_helper::symcc] SymCC returned code 0
[2023-04-14T01:56:35Z INFO  symcc_fuzzing_helper] Generated 0 test cases (0 new)
[2023-04-14T01:56:35Z INFO  symcc_fuzzing_helper] Running on input /cb-multios/build_afl/challenges/Barcoder/out/Barcoder-S/queue/id:000075,src:000067,time:40522,execs:36944,op:havoc,rep:16,+cov
[2023-04-14T01:56:35Z DEBUG symcc_fuzzing_helper::symcc] Running SymCC as follows: "timeout" "-k" "5" "90" "/cb-multios/build_symcc/challenges/Barcoder/Barcoder"
[2023-04-14T01:56:37Z DEBUG symcc_fuzzing_helper::symcc] SymCC returned code 0
[2023-04-14T01:56:37Z DEBUG symcc_fuzzing_helper] Processing test case /tmp/.tmpS2FzjJ/output/000021-optimistic
[2023-04-14T01:56:37Z DEBUG symcc_fuzzing_helper::symcc] Running afl-showmap as follows: "afl-showmap" "-t" "5000" "-m" "none" "-b" "-o" "/tmp/.tmpS2FzjJ/testcase_bitmap" "--" "/cb-multios/build_afl/challenges/Barcoder/Barcoder"
[2023-04-14T01:56:37Z DEBUG symcc_fuzzing_helper::symcc] afl-showmap returned exit status: 0
Error: Failed to check whether test case /tmp/.tmpS2FzjJ/output/000021-optimistic is interesting

Caused by:
    0: Failed to read the AFL bitmap that afl-showmap should have generated at /tmp/.tmpS2FzjJ/testcase_bitmap
    1: The file to load the coverage map from has the wrong size (896)

Seems to originate from here:

"The file to load the coverage map from has the wrong size ({})",
and it looks like it's looking for an output of size 65536 (though I am not familiar with Rust).

Manually running afl-showmap from the example output returns the following:

root@39b2dcd3cc08:/cb-multios# afl-showmap -t 5000 -m none -b -o /tmp/testcase_bitmap -- /cb-multios/build_afl/challenges/Barcoder/Barcoder
afl-showmap++4.00c by Michal Zalewski
[*] Executing '/cb-multios/build_afl/challenges/Barcoder/Barcoder'...
-- Program output begins --
-- Program output ends --

+++ Program timed off +++
[+] Hash of coverage map: a25d811ee0af7a15
[+] Captured 10 tuples (map size 876, highest value 0, total values 0) in '/tmp/testcase_bitmap'.

I've compiled using AFL_USE_ASAN=1 using afl-clang-fast /afl-clang-fast++ to compile, though I also tried afl-clang/afl-clang++ as mentioned in the Fuzzing.txt page. Additionally, from the afl-showmap help page, I tried setting AFL_MAP_SIZE to any number, but it doesn't seem to change the resulting map size.

Any thoughts or things that I might be overlooking?

@emwjacobson
Copy link
Author

UPDATE

I probably should have looked at Pull Requests :) Obviously I'm using AFL++ which doesn't have explicit support.
Pull request #90 resolves this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant