No path while fuzzing ChakraCore

[zr950624]

No path while fuzzing ChakraCore

[eqv]

Can you confirm that AFL++ finds paths on the same target binary?

[zr950624]

Can you confirm that AFL++ finds paths on the same target binary?

Yes, AFL++ works well with enlarging memory settings by using -m none.

               american fuzzy lop ++2.64d (ch) [explore] {0}
┌─ process timing ────────────────────────────────────┬─ overall results ────┐
│        run time : 0 days, 0 hrs, 0 min, 8 sec       │  cycles done : 0     │
│   last new path : 0 days, 0 hrs, 0 min, 0 sec       │  total paths : 31    │
│ last uniq crash : none seen yet                     │ uniq crashes : 0     │
│  last uniq hang : none seen yet                     │   uniq hangs : 0     │
├─ cycle progress ───────────────────┬─ map coverage ─┴──────────────────────┤
│  now processing : 0.0 (0.0%)       │    map density : 3.26% / 7.39%        │
│ paths timed out : 0 (0.00%)        │ count coverage : 1.69 bits/tuple      │
├─ stage progress ───────────────────┼─ findings in depth ───────────────────┤
│  now trying : calibration          │ favored paths : 20 (64.52%)           │
│ stage execs : 17/40 (42.50%)       │  new edges on : 30 (96.77%)           │
│ total execs : 1097                 │ total crashes : 0 (0 unique)          │
│  exec speed : 55.31/sec (slow!)    │  total tmouts : 0 (0 unique)          │
├─ fuzzing strategy yields ──────────┴───────────────┬─ path geometry ───────┤
│   bit flips : 0/0, 0/0, 0/0                        │    levels : 2         │
│  byte flips : 0/0, 0/0, 0/0                        │   pending : 31        │
│ arithmetics : 0/0, 0/0, 0/0                        │  pend fav : 20        │
│  known ints : 0/0, 0/0, 0/0                        │ own finds : 10        │
│  dictionary : 0/0, 0/0, 0/0                        │  imported : n/a       │
│   havoc/rad : 0/0, 0/0, 0/0                        │ stability : 99.63%    │
│   py/custom : 0/0, 0/0                             ├───────────────────────┘
│        trim : 28.69%/88, n/a                       │          [cpu000:  6%]
└────────────────────────────────────────────────────┘

[eqv]

I'll look into this later. Can you check if it works without the bitmap size changes?

[zr950624]

I'll look into this later. Can you check if it works without the bitmap size changes?

Still no path without bitmap size changes.

[eqv]

I tried to compile chakracore with afl-clang-fast, but ran into some problems regarding the fact that it is split into the "ch" binary, and libChakraCore.so. Could you post your build steps in a reproducible way?

[zr950624]

I tried to compile chakracore with afl-clang-fast, but ran into some problems regarding the fact that it is split into the "ch" binary, and libChakraCore.so. Could you post your build steps in a reproducible way?

I build ChakraCore with ./build.sh --cc=/path/to/afl-clang-fast --cxx=/path/to/afl-clang-fast++ --static -j=30.
Then fuzz "ch" with nautilus.

[eqv]

Cool, looking into it. Didn't see the --static flag.

[eqv]

Ok I can reproduce this. Looking into it.

[eqv]

Should be fixed by a132369, when porting the Forkserver we forgot to add the program path to the argument list, resulting in ch not receiving the input file path. Please verify and close this issue.

[zr950624]

Thanks for fixing! It works well now.

[zr950624]

Just a notification lol.
https://github.com/nautilus-fuzz/nautilus/blob/master/fuzzer/src/fuzzer.rs#L339

[eqv]

Yeah, that's the "stability score" of AFL expressed... well... less optimally^^ If you see lots of these (with ch you will), that means the bitmap target is pretty nondeterministic.