execution speed very slow about winafl HOT 5 CLOSED

It would be also nice to know what the execution speed is without any instrumentation, to establish what the "normal" behavior is.

However, since you are unloading the library every time, it is quite possible that dynamorio has to translate a lot of code anew for every iteration which introduces unnecessary overhead. The way to work around this is:

void fuzz() {
//call functions on a dll
}

int main(int argc, char **argv)
{
hDLL = LoadLibrary("foo");
fuzz()
FreeLibrary(hDLL);
}

And then use the target_offset of fuzz() instead of main().

from winafl.

So basically execution without LoadLibrary() reaches up to 600 exec/sec
When I just LoadLibrary() it drops to 13 exec/sec. You can see below my main function. A very simple Main that basically loads the DLL and free it just to benchmark

int main(int argc, char **argv)
{   
   char DLL[] = "ABCpdfCE5";
   HANDLE Proc;
   HINSTANCE hDLL;
   int ret;
   printf("Attempting to load .DLL...\n");
   hDLL = LoadLibrary(DLL);
   if(hDLL == NULL)
    {
      printf("DLL NAME: %s\n", DLL);
      printf(".DLL load FAILED!!1\n");
      return -1;
    }
    FreeLibrary(hDLL);//release the DLL library 
    return 0;

}

And when I start to call functions ... it drops to 0.3 exec/sec to 0.8 exec/sec which is pretty bad. I am not a windows guru but I will try to place the folder where I execute the binary and the DLL in something similar to ramfs in Linux (need to google that). Please if you have any ideas to enhance execution I would love to hear them.

Update: tried the RamDisk on windows .. no improvement!

from winafl.

Yes that does sound pretty slow. What's the execution speed if you just run your target natively? I don't think LoadLibrary should be the bottleneck, but if it is you can only call it once at the beginning of your test program and then create another function that you'd actually fuzz (without calling LoadLibrary for every iteration).

from winafl.

It would be also nice to know what the execution speed is without any instrumentation, to establish what the "normal" behavior is.
That's why I tested a simple hellow_World app and got the execution speed to be around 600 exec/sec

I will try your suggested solutions, seems very tempting!

Btw, will DynamoRIO be able to instrument the code if the binary was written in .NET? a C# code basically?? (I think no!)

from winafl.

However, since you are unloading the library every time, it is quite possible that dynamorio has to translate a lot of code anew for every iteration which introduces unnecessary overhead. The way to work around this is:

void fuzz() {
//call functions on a dll
}

int main(int argc, char **argv)
{ 
hDLL = LoadLibrary("foo");
fuzz()
FreeLibrary(hDLL);
}

And then use the target_offset of fuzz() instead of main().

That was it. This basically enhanced the fuzzing speed from 7 exec/sec to 200 exec/sec .. which isn't bad.

from winafl.