Question

我正试图弄清楚如何使用AFL，但似乎无法运行一个简单的示例。这是我的C程序：

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <assert.h>

char *remove_white_space(char *s)
{
    while (s && *s++)
        if (*s == ' ')
            return "moish";
    return s;
}

int main(int argc, char **argv)
{
    char buffer[256]={0};
    FILE *fl = fopen(argv[1],"rt");
    if (fl == NULL) return 0;

    assert(fscanf(fl,"%s",buffer) > 0);
    char *res = remove_white_space(buffer);
    if (strcmp(res,"a b c d") == 0)
    {
        assert(0);
    }

    fclose(fl);
    return 0;
}

我的输入种子是一个带有一行abhgsd的文本文件。这是我所做的：

$ afl-gcc main.c -o main
afl-cc 2.56b by <lcamtuf@google.com>
afl-as 2.56b by <lcamtuf@google.com>
[+] Instrumented 62 locations (64-bit, non-hardened mode, ratio 100%).
$ afl-fuzz -i INPUTS/ -o OUTPUTS ./main @@

我收到了这个红色的CAPITAL CRASH消息：

afl-fuzz 2.56b by <lcamtuf@google.com>
[+] You have 8 CPU cores and 1 runnable tasks (utilization: 12%).
[+] Try parallel jobs - see /usr/local/share/doc/afl/parallel_fuzzing.txt.
[*] Checking CPU core loadout...
[+] Found a free CPU core, binding to #0.
[*] Checking core_pattern...

[-] Hmm, your system is configured to send core dump notifications to an
    external utility. This will cause issues: there will be an extended delay
    between stumbling upon a crash and having this information relayed to the
    fuzzer via the standard waitpid() API.

    To avoid having crashes misinterpreted as timeouts, please log in as root
    and temporarily modify /proc/sys/kernel/core_pattern, like so:

    echo core >/proc/sys/kernel/core_pattern

[-] PROGRAM ABORT : Pipe at the beginning of 'core_pattern'
         Location : check_crash_handling(), afl-fuzz.c:7316

除非我确定自己在做什么，否则我不太愿意更改某些内容。这里发生了什么？我应该听AFL在说什么吗？

Answer 1

答案就在您的面前。

log in as root and echo core >/proc/sys/kernel/core_pattern

Answer 2

您可能应该更改核心模式，但是以后可以更改。许多Linux发行版都提供了诸如apport之类的崩溃报告服务，该服务依赖于通过诸如|/usr/share/apport/apport %p %s %c %d %P（请参阅man 5 core）之类的核心模式将崩溃进程中的核心转储通过管道传递给它。通过这种方式进行设置，每次程序崩溃时，都会运行apport，并将内核作为标准输入馈入该程序。因此，如果您将核心模式更改为core，进行模糊测试，然后将核心模式更改回当前状态，则您发行版的崩溃报告程序应恢复其正常运行。

AFL可能有一个环境变量来禁用此检查，因为我知道存在一些环境变量来禁用其他预模糊检查（例如AFL_SKIP_CRASHES允许使初始种子中的输入崩溃），但是切换该成本非常低

AFL Hello World示例

2 个答案: