Comments (6)
I would disagree that fork() is unnecessary with persistent mode. Any sufficiently complicated (and poorly-written) app that maintains large amounts of global state will never get past a single iteration in persistent mode (from my own experience with using this) because jumping execution back to the target function will often fail some kind of check on the global state.
If I understand the fork() strategy correctly, it would actually mitigate this issue because you'd fork from a point where the global state is correct, so you would avoid the issue of rerunning the target function from a bad state. I suspect this would actually be very helpful with the target I'm fuzzing and I may be able to dedicate some time to getting it to work.
from winafl.
WinAFL alternative to fork() is persistent mode, that is, running multiple samples without restarting the target process. WinAFL user selects a target function (usually the function that processes the input file) via target_module / target_offset and once that function is reached it is ran in a loop instead of returning normally. In between the iterations WinAFL processes coverage data and replaces the input file with a fresh sample.
from winafl.
@ivanfratric you mean that it is unnecessary to do Fork()? And for the improvement done by Marcel Böhme's CCS16 Coverage-based Greybox Fuzzing as Markov Chain, do you think it benefits WinAFL?
from winafl.
Yes, in persistent mode fork() is unnecessary. It is possible to implement many different fuzzing strategies but that is outside the scope of this project. The goal of WinAFL was explicitly to mirror the functionality of AFL on windows. I have another project that would make it easier to plug custom fuzzing strategies while using winafl client for coverage measurement. I might merge this with WinAFL at some point, but as I wrote, for now this is out of scope.
from winafl.
Well, the current solution has its drawbacks but it is for the most part a working solution and it is working under severe constraints such as no fork on Windows and no access to target source code. Of course, if you have an idea how to do it better you are absolutely free to implement it, I'd welcome an alternative to WinAFL :-)
from winafl.
Just a quick comment - Windows includes an API that may help with restoring global state during persistent mode. The GetWriteWatch/ResetWriteWatch APIs could be used if a hook on VirtualAlloc set the MEM_WRITE_WATCH prior to global state being initialized.
from winafl.
Related Issues (20)
- PROGRAM ABORT : Unexpected result from pipe! expected 'P', instead received '' HOT 1
- ERROR while building winafl HOT 1
- Error: Can't open .cur_input
- drrun.exe and afl-fuzz.exe giving error when -fsanitize=address flag given to compile target
- PROGRAM ABORT : Test case 'id_000000' results in a crash HOT 3
- Occur time out when init test case
- Incorrect detection count threads on multiCPU motherboards HOT 2
- Winafl doesn't want to start, reading other issues didn't help
- PROGRAM ABORT : CreateNamedPipe failed, GLE=231 HOT 2
- tmin: Proposing del_len option for improved speed HOT 2
- Is dumb mode (-n) currently implemented? HOT 4
- My output keeps showing a timeout HOT 8
- problem about finding crashes HOT 6
- not running under DR HOT 4
- No expected output when using standalone debug mode of WinAFL client HOT 3
- WinAFL internal crash HOT 2
- winafl.dll : fatal error LNK1120 HOT 2
- Timeout Options Madness HOT 2
- Unable to load client library: winafl.dll: library initializer failed.. HOT 2
- Inconsistent Execution of instrument_bb_coverage Function A HOT 6
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from winafl.