0

I'm trying to figure out how to use AFL, but I can't seem to make a simple example running. Here is my C program:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <assert.h>

char *remove_white_space(char *s)
{
    while (s && *s++)
        if (*s == ' ')
            return "moish";
    return s;
}

int main(int argc, char **argv)
{
    char buffer[256]={0};
    FILE *fl = fopen(argv[1],"rt");
    if (fl == NULL) return 0;

    assert(fscanf(fl,"%s",buffer) > 0);
    char *res = remove_white_space(buffer);
    if (strcmp(res,"a b c d") == 0)
    {
        assert(0);
    }

    fclose(fl);
    return 0;
}

My input seed is a text file with a single line abhgsd. Here is what I did:

$ afl-gcc main.c -o main
afl-cc 2.56b by <lcamtuf@google.com>
afl-as 2.56b by <lcamtuf@google.com>
[+] Instrumented 62 locations (64-bit, non-hardened mode, ratio 100%).
$ afl-fuzz -i INPUTS/ -o OUTPUTS ./main @@

And I got this red CAPITAL CRASH message:

afl-fuzz 2.56b by <lcamtuf@google.com>
[+] You have 8 CPU cores and 1 runnable tasks (utilization: 12%).
[+] Try parallel jobs - see /usr/local/share/doc/afl/parallel_fuzzing.txt.
[*] Checking CPU core loadout...
[+] Found a free CPU core, binding to #0.
[*] Checking core_pattern...

[-] Hmm, your system is configured to send core dump notifications to an
    external utility. This will cause issues: there will be an extended delay
    between stumbling upon a crash and having this information relayed to the
    fuzzer via the standard waitpid() API.

    To avoid having crashes misinterpreted as timeouts, please log in as root
    and temporarily modify /proc/sys/kernel/core_pattern, like so:

    echo core >/proc/sys/kernel/core_pattern

[-] PROGRAM ABORT : Pipe at the beginning of 'core_pattern'
         Location : check_crash_handling(), afl-fuzz.c:7316

I'm a bit reluctant to change something unless I'm sure what I'm doing. What's going on here? Should I listen to what AFL is saying?

OrenIshShalom
  • 5,974
  • 9
  • 37
  • 87

2 Answers2

1

The answer is right there in front of you.

log in as root and echo core >/proc/sys/kernel/core_pattern
geeknik
  • 1,056
  • 8
  • 10
1

You should probably change your core pattern, but you can change it back later. Many linux distros have a crash reporting service like apport, which relies on having core dumps from crashing processes piped to it via a core pattern like |/usr/share/apport/apport %p %s %c %d %P (see man 5 core) When the core pattern is set up this way, every time a program crashes, apport is run and the core is fed to it as standard input. So if you change the core pattern to just core, do your fuzzing, and then change the core pattern back to whatever it is currently, your distro's crash reporter should resume its normal operation.

AFL may have an environment variable to disable this check, as I know there exist environment variables to disable other pre-fuzzing checks (like AFL_SKIP_CRASHES allowing crashing input in the initial seeds), but this one is pretty low-cost to toggle.

lorimer
  • 261
  • 5
  • 7