Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error while running 32 bit binary in 64 bit machine #15

Open
lzina opened this issue May 14, 2019 · 1 comment
Open

Error while running 32 bit binary in 64 bit machine #15

lzina opened this issue May 14, 2019 · 1 comment

Comments

@lzina
Copy link

lzina commented May 14, 2019

Hi,
I experience something very wired when running my 32 binary on 64 bit machine with shellphish/fuzzer.

If I execute the command below:

/~/PycharmProjects/driller-afl/venv/bin/python /~/PycharmProjects/driller-afl/venv/bin/shellphuzz --memory none -c 1 -d 1 --length-extension 20 --driller-timeout 80 /~/PycharmProjects/driller-afl/venv/test_cases/test_new_null_pointer_32

I get the error:

�[0;36mafl-fuzz �[1;37m1.85b�[0m by <[email protected]>
�[1;32m[+] �[0mLooks like we're not running on a tty, so I'll be a bit less verbose.�[0m
�[1;32m[+] �[0mYou have 3 CPU cores and 2 runnable tasks (utilization: 67%).�[0m
�[1;32m[+] �[0mTry parallel jobs - see /usr/local/share/doc/afl/parallel_fuzzing.txt.�[0m
�[1;34m[*] �[0mChecking core_pattern...�[0m
�[1;34m[*] �[0mSetting up output directories...�[0m
�[1;34m[*] �[0mScanning '/dev/shm/work/test_new_null_pointer_32/input'...�[0m
�[1;32m[+] �[0mNo auto-generated dictionary tokens to reuse.�[0m
�[1;34m[*] �[0mCreating hard links for all input files...�[0m
�[1;34m[*] �[0mLoading extra dictionary from '/dev/shm/work/test_new_null_pointer_32/test_new_null_pointer_32.dict' (level 0)...�[0m
�[1;32m[+] �[0mLoaded 1 extra tokens, size range 19 B to 19 B.�[0m
�[1;34m[*] �[0mValidating target binary...�[0m
�[1;34m[*] �[0mAttempting dry run with 'id:000000,orig:seed-0'...�[0m
�[1;34m[*] �[0mSpinning up the fork server...�[0m

�[1;31m[-] �[0mHmm, looks like the target binary terminated before we could complete a
    handshake with the injected code. Perhaps there is a horrible bug in the
    fuzzer. Poke <[email protected]> for troubleshooting tips.
��)B�[?25h�[1;31m
[-] PROGRAM ABORT : �[1;37mFork server handshake failed�[1;31m
         Location : �[0minit_forkserver(), afl-fuzz.c:2082

However, if I run AFL through cmd with the same afl-fuzz and afl-qemu-tracer files like below:

guest@vm:~/Documents/Fuzzing$ export AFL_PATH='/~/PycharmProjects/driller-afl/venv/bin/afl-unix/tracers/i386'
guest@vm:~/Documents/Fuzzing$ /~/PycharmProjects/driller-afl/venv/bin/afl-unix/afl-fuzz  -i 'afl-master32/qemu-32-test/input' -o 'afl-master32/qemu-32-test/output' -m none -Q ./afl-master32/qemu-32-test/test_new_null_pointer_32 

everything works as excepted.

issue_driller_afl.zip

please your help.

@lzina
Copy link
Author

lzina commented May 16, 2019

Eventually is worked for me.
I comment 2 lines in fuzzer.py:

  1. os.environ['QEMU_LD_PREFIX'] = path
  2. args += ["--"] in _start_afl_instance function

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant