Error fuzzing Binutils with AFL-Fuzz

[Greg McSwagger]

 I am going to fuzz binutils. I downloaded the binutils using the wget command and ran the commands below. I ran the commands below and they all worked fine with no errors. I'm been stuck for awhile and am not sure what i've done wrong. Any suggestions to help fix this problem would be highly appreciated. 

CC=/usr/local/bin/afl-gcc ./configure --disable-shared

sudo make -j4

sudo mkdir afl_in afl_out

sudo cp /bin/ps afl_in/

all of those commands worked fine but when I tried to run afl-fuzz with the command it gave me an error.

afl-fuzz -i afl_in -o afl_out ./binutils/readelf -a @@

afl-fuzz 2.28b by <lca...@google.com>

[+] You have 4 CPU cores and 3 runnable tasks (utilization: 75%).

[+] Try parallel jobs - see /usr/local/share/doc/afl/parallel_fuzzing.txt.

[*] Setting up output directories...

[+] Output directory exists but deemed OK to reuse.

[*] Deleting old session data...

[+] Output dir cleanup successful.

[*] Scanning 'afl_in'...

[+] No auto-generated dictionary tokens to reuse.

[*] Creating hard links for all input files...

[*] Validating target binary...

[-] Looks like the target binary is not instrumented! The fuzzer depends on

    compile-time instrumentation to isolate interesting test cases while

    mutating the input data. For more information, and for tips on how to

    instrument binaries, please see /usr/local/share/doc/afl/README.

    When source code is not available, you may be able to leverage QEMU

    mode support. Consult the README for tips on how to enable this.

    (It is also possible to use afl-fuzz as a traditional, "dumb" fuzzer.

    For that, you can use the -n option - but expect much worse results.)

[-] PROGRAM ABORT : No instrumentation detected

         Location : check_binary(), afl-fuzz.c:6836

[Greg McSwagger]

Apparently I'm not the only one with this problem. https://disqus.com/home/discussion/evilsocket/fuzzing_with_afl_fuzz_a_practical_example_afl_vs_binutils/best/

[Jacek Wielemborek]

W dniu 16.08.2016 o 13:29, Greg McSwagger pisze:

> Apparently I'm not the only one with this problem.
> https://disqus.com/home/discussion/evilsocket/fuzzing_with_afl_fuzz_a_practical_example_afl_vs_binutils/best/

Hi,

A quick & dirty hack that could get you through this is to replace
/usr/bin/gcc with afl-cc. While I don't recommend that on your host
system, you can use Docker for this kind of job. Actually, I've already
done it and you can use my "aflize" project to get there with just a
couple of automated commands, for most of Debian packages:

https://github.com/d33tah/aflize

(can't remember if binutils is supported, but it should be)

Cheers,
d33tah

[Greg McSwagger]

Why do I need to I set the gcc compiled to afl-gcc with CC=/usr/local/bin/afl-gcc.

On Monday, August 15, 2016 at 8:24:29 PM UTC-4, Greg McSwagger wrote:

[Andrew Melo]

Hi,

On Monday, August 15, 2016, Greg McSwagger <gregmc...@gmail.com> wrote:

 I am going to fuzz binutils. I downloaded the binutils using the wget command and ran the commands below. I ran the commands below and they all worked fine with no errors. I'm been stuck for awhile and am not sure what i've done wrong. Any suggestions to help fix this problem would be highly appreciated. 

CC=/usr/local/bin/afl-gcc ./configure --disable-shared

sudo make -j4

sudo mkdir afl_in afl_out

sudo cp /bin/ps afl_in/

1) does the output from configure show a line saying it's using your CC?

2) Why are you building as root?

Cheers

Andrew

 

all of those commands worked fine but when I tried to run afl-fuzz with the command it gave me an error.

afl-fuzz -i afl_in -o afl_out ./binutils/readelf -a @@

afl-fuzz 2.28b by <lca...@google.com>

[+] You have 4 CPU cores and 3 runnable tasks (utilization: 75%).

[+] Try parallel jobs - see /usr/local/share/doc/afl/parallel_fuzzing.txt.

[*] Setting up output directories...

[+] Output directory exists but deemed OK to reuse.

[*] Deleting old session data...

[+] Output dir cleanup successful.

[*] Scanning 'afl_in'...

[+] No auto-generated dictionary tokens to reuse.

[*] Creating hard links for all input files...

[*] Validating target binary...

[-] Looks like the target binary is not instrumented! The fuzzer depends on

    compile-time instrumentation to isolate interesting test cases while

    mutating the input data. For more information, and for tips on how to

    instrument binaries, please see /usr/local/share/doc/afl/README.

    When source code is not available, you may be able to leverage QEMU

    mode support. Consult the README for tips on how to enable this.

    (It is also possible to use afl-fuzz as a traditional, "dumb" fuzzer.

    For that, you can use the -n option - but expect much worse results.)

[-] PROGRAM ABORT : No instrumentation detected

         Location : check_binary(), afl-fuzz.c:6836

--
You received this message because you are subscribed to the Google Groups "afl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to afl-users+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
It's dark in this basement.

[Greg McSwagger]

Here is part of output of the configure command.

CC=/usr/local/bin/afl-gcc ./configure --disable-shared

checking build system type... x86_64-apple-darwin14.4.0

checking host system type... x86_64-apple-darwin14.4.0

checking target system type... x86_64-apple-darwin14.4.0

checking for a BSD-compatible install... /usr/bin/install -c

checking whether ln works... yes

checking whether ln -s works... yes

checking for a sed that does not truncate output... /usr/bin/sed

checking for gawk... no

checking for mawk... no

checking for nawk... no

checking for awk... awk

checking for gcc... gcc

checking for C compiler default output file name... a.out

checking whether the C compiler works... yes

checking whether we are cross compiling... no

checking for suffix of executables... 

checking for suffix of object files... o

checking whether we are using the GNU C compiler... yes

checking whether gcc accepts -g... yes

checking for gcc option to accept ISO C89... none needed

checking for g++... g++

checking whether we are using the GNU C++ compiler... yes

checking whether g++ accepts -g... yes

checking whether g++ accepts -static-libstdc++ -static-libgcc... no

checking for gnatbind... no

checking for gnatmake... no

checking whether compiler driver understands Ada... no

checking how to compare bootstrapped objects... cmp --ignore-initial=16 $$f1 $$f2

checking for objdir... .libs

checking for isl 0.16, 0.15, or deprecated 0.14... no

recommended isl version is 0.16 or 0.15, the minimum required isl version 0.14 is deprecated

checking for isl 0.16 or 0.15... no

*** This configuration is not supported in the following subdirectories:

     ld gas gprof

    (Any other directories should still work fine.)

rm: conftest.dSYM: is a directory

checking for default BUILD_CONFIG... 

checking for --enable-vtable-verify... no

checking for bison... bison -y

checking for bison... bison

checking for gm4... gm4

checking for flex... flex

checking for flex... flex

checking for makeinfo... makeinfo

checking for expect... expect

checking for runtest... no

checking for ar... ar

checking for as... as

checking for dlltool... no

checking for ld... (cached) /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld

checking for lipo... lipo

checking for nm... nm

checking for ranlib... ranlib

checking for strip... strip

checking for windres... no

checking for windmc... no

checking for objcopy... no

checking for objdump... no

checking for readelf... no

checking for cc... cc

checking for c++... c++

checking for gcc... gcc

checking for gcj... no

checking for gfortran... no

checking for gccgo... no

checking for ar... ar

checking for as... as

checking for dlltool... no

checking for ld... ld

checking for lipo... lipo

checking for nm... nm

checking for objcopy... no

checking for objdump... no

checking for ranlib... ranlib

checking for readelf... no

checking for strip... strip

checking for windres... no

checking for windmc... no

checking where to find the target ar... just compiled

checking where to find the target as... host tool

checking where to find the target cc... host tool

checking where to find the target c++... host tool

checking where to find the target c++ for libstdc++... host tool

checking where to find the target dlltool... just compiled

checking where to find the target gcc... host tool

checking where to find the target gcj... host tool

checking where to find the target gfortran... host tool

checking where to find the target gccgo... host tool

checking where to find the target ld... host tool

checking where to find the target lipo... host tool

checking where to find the target nm... just compiled

checking where to find the target objcopy... just compiled

checking where to find the target objdump... just compiled

checking where to find the target ranlib... just compiled

checking where to find the target readelf... just compiled

checking where to find the target strip... just compiled

checking where to find the target windres... just compiled

checking where to find the target windmc... just compiled

checking whether to enable maintainer-specific portions of Makefiles... no

configure: creating ./config.status

config.status: creating Makefile

BreslinD:binutils-2.27 Student$ sudo make -j4

make[1]: Nothing to be done for `all-target'.

Configuring in ./libiberty

Configuring in ./etc

Configuring in ./intl

Configuring in ./zlib

configure: creating cache ./config.cache

configure: creating cache ./config.cache

configure: creating cache ./config.cache

checking for a BSD-compatible install... /usr/bin/install -c

configure: creating cache ./config.cache

checking whether /Applications/Xcode.app/Contents/Developer/usr/bin/make sets $(MAKE)... checking whether to enable maintainer-specific portions of Makefiles... no

checking for makeinfo... makeinfo --split-size=5000000

checking for perl... perl

checking build system type... yes

checking for a BSD-compatible install... /usr/bin/install -c

checking whether NLS is requested... yes

checking build system type... configure: updating cache ./config.cache

checking for msgfmt... no

checking for gmsgfmt... :

x86_64-apple-darwin14.4.0

configure: creating ./config.status

checking host system type... checking for xgettext... no

x86_64-apple-darwin14.4.0

checking host system type... checking for msgmerge... x86_64-apple-darwin14.4.0

checking target system type... no

checking for x86_64-apple-darwin14.4.0-gcc... gcc

x86_64-apple-darwin14.4.0

checking for x86_64-apple-darwin14.4.0-ar... ar

checking for x86_64-apple-darwin14.4.0-ranlib... ranlib

checking whether to install libiberty headers and static library... no

configure: target_header_dir = 

checking for x86_64-apple-darwin14.4.0-gcc... gcc

x86_64-apple-darwin14.4.0

checking for a BSD-compatible install... /usr/bin/install -c

checking whether build environment is sane... checking for C compiler default output file name... a.out

checking whether the C compiler works... yes

config.status: creating Makefile

checking for C compiler default output file name... checking whether we are cross compiling... no

checking for suffix of executables... a.out

checking whether the C compiler works... 

checking for suffix of object files... yes

checking whether we are cross compiling... no

checking for suffix of executables... o

checking whether we are using the GNU C compiler... 

make[2]: Nothing to be done for `all'.

checking for suffix of object files... yes

checking whether gcc accepts -g... o

checking whether we are using the GNU C compiler... yes

checking for gcc option to accept ISO C89... yes

checking whether gcc accepts -g... none needed

yes

checking for gcc option to accept ISO C89... checking build system type... x86_64-apple-darwin14.4.0

checking host system type... none needed

checking how to run the C preprocessor... x86_64-apple-darwin14.4.0

checking for x86_64-apple-darwin14.4.0-ranlib... ranlib

checking for library containing strerror... gcc -E

none required

checking how to run the C preprocessor... checking for grep that handles long lines and -e... gcc -E

checking for grep that handles long lines and -e... /usr/bin/grep

checking for egrep... /usr/bin/grep -E

checking for ANSI C header files... yes

checking for a thread-safe mkdir -p... ./../install-sh -c -d

checking for gawk... awk

checking whether /Applications/Xcode.app/Contents/Developer/usr/bin/make sets $(MAKE)... yes

/usr/bin/grep

checking for egrep... /usr/bin/grep -E

checking for ANSI C header files... checking whether to enable maintainer-specific portions of Makefiles... no

checking for x86_64-apple-darwin14.4.0-gcc... gcc

rm: conftest.dSYM: is a directory

rm: conftest.dSYM: is a directory

yes

checking for sys/types.h... checking for C compiler default output file name... yes

checking for an ANSI C-conforming const... yes

a.out

checking whether the C compiler works... yes

checking whether we are cross compiling... no

checking for suffix of executables... checking for sys/stat.h... yes

checking for inline... 

inline

checking for suffix of object files... yes

checking for sys/types.h... checking for stdlib.h... o

checking whether we are using the GNU C compiler... yes

checking for sys/stat.h... yes

yes

checking whether gcc accepts -g... checking for string.h... yes

checking for gcc option to accept ISO C89... yes

checking for stdlib.h... yes

checking for memory.h... none needed

checking for style of include used by /Applications/Xcode.app/Contents/Developer/usr/bin/make... GNU

checking dependency style of gcc... yes

checking for string.h... yes

checking for strings.h... yes

yes

checking for memory.h... checking for inttypes.h... gcc3

checking how to print strings... printf

checking for a sed that does not truncate output... /usr/bin/sed

checking for grep that handles long lines and -e... yes

yes

checking for strings.h... checking for stdint.h... yes

yes

checking for inttypes.h... checking for unistd.h... yes

checking for stdint.h... yes

checking minix/config.h usability... /usr/bin/grep

checking for egrep... /usr/bin/grep -E

checking for fgrep... /usr/bin/grep -F

checking for ld used by gcc... yes

/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld

checking for unistd.h... checking if the linker (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld) is GNU ld... no

no

checking for BSD- or MS-compatible name lister (nm)... checking minix/config.h presence... nm

checking the name lister (nm) interface... no

checking for minix/config.h... no

checking whether it is safe to define __EXTENSIONS__... rm: conftest.dSYM: is a directory

BSD nm

checking whether ln -s works... yes

checking the maximum length of command line arguments... yes

196608

checking whether the shell understands some XSI constructs... checking for off_t... yes

checking whether the shell understands "+="... yes

checking for /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld option to reload object files... -r

checking for x86_64-apple-darwin14.4.0-objdump... objdump

checking how to recognize dependent libraries... pass_all

checking for x86_64-apple-darwin14.4.0-ar... ar

checking for x86_64-apple-darwin14.4.0-strip... no

checking for strip... strip

checking for x86_64-apple-darwin14.4.0-ranlib... ranlib

checking command to parse nm output from gcc object... rm: conftest.dSYM: is a directory

yes

checking for special C compiler options needed for large files... no

checking for _FILE_OFFSET_BITS value needed for large files... no

checking whether gcc supports -W... yes

yes

checking for size_t... checking whether gcc supports -Wall... yes

checking whether gcc supports -Wwrite-strings... ok

checking for x86_64-apple-darwin14.4.0-dsymutil... no

checking for dsymutil... dsymutil

checking for x86_64-apple-darwin14.4.0-nmedit... no

checking for nmedit... nmedit

checking for x86_64-apple-darwin14.4.0-lipo... yes

no

checking for lipo... lipo

checking for x86_64-apple-darwin14.4.0-otool... no

checking for otool... otool

checking for x86_64-apple-darwin14.4.0-otool64... no

checking for otool64... no

checking for -single_module linker flag... checking whether gcc supports -Wc++-compat... yes

checking whether gcc supports -Wstrict-prototypes... yes

checking for -exported_symbols_list linker flag... yes

checking for working alloca.h... yes

checking whether gcc supports -pedantic ... yes

checking whether gcc and cc understand -c and -o together... yes

checking for -force_load linker flag... yes

checking for alloca... yes

checking for stdlib.h... (cached) yes

checking for unistd.h... (cached) yes

yes

checking for an ANSI C-conforming const... checking for getpagesize... yes

checking how to run the C preprocessor... yes

checking for inline... inline

checking whether byte ordering is bigendian... yes

checking for working mmap... gcc -E

checking for ANSI C header files... no

checking for a BSD-compatible install... /usr/bin/install -c

yes

checking whether we are using the GNU C Library 2.1 or newer... checking for sys/file.h... no

checking whether integer division by zero raises SIGFPE... yes

checking for sys/param.h... no

checking for inttypes.h... yes

checking for limits.h... yes

yes

checking for stdint.h... checking for sys/types.h... yes

checking for stdlib.h... (cached) yes

yes

checking for malloc.h... checking for unsigned long long... yes

checking for sys/stat.h... no

checking for string.h... (cached) yes

checking for unistd.h... (cached) yes

yes

checking for inttypes.h... checking for strings.h... (cached) yes

yes

checking for sys/time.h... checking for stdlib.h... yes

checking whether the inttypes.h PRIxNN macros are broken... yes

checking for time.h... yes

checking for string.h... no

checking for ld used by GCC... yes

checking for sys/resource.h... /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld

checking if the linker (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld) is GNU ld... no

checking for shared library run path origin... yes

yes

checking for sys/stat.h... (cached) yes

checking for memory.h... checking for sys/mman.h... done

yes

checking argz.h usability... yes

checking for fcntl.h... checking for strings.h... yes

checking for alloca.h... no

checking argz.h presence... yes

checking for inttypes.h... yes

checking for sys/pstat.h... no

checking for argz.h... no

checking limits.h usability... yes

no

checking for sys/sysmp.h... checking for stdint.h... yes

checking limits.h presence... no

checking for sys/sysinfo.h... yes

checking for limits.h... yes

checking locale.h usability... yes

checking for unistd.h... no

checking for machine/hal_sysinfo.h... yes

checking locale.h presence... no

yes

checking for sys/table.h... checking for dlfcn.h... yes

checking for locale.h... yes

checking nl_types.h usability... no

checking for sys/sysctl.h... yes

checking for objdir... .libs

yes

checking nl_types.h presence... yes

checking for sys/systemcfg.h... yes

checking for nl_types.h... yes

checking malloc.h usability... no

checking for stdint.h... (cached) yes

checking for stdio_ext.h... checking if gcc supports -fno-rtti -fno-exceptions... no

checking malloc.h presence... yes

checking for gcc option to produce PIC... -fno-common -DPIC

checking if gcc PIC flag -fno-common -DPIC works... no

checking for process.h... no

checking for malloc.h... no

checking stddef.h usability... yes

checking if gcc static flag -static works... no

checking for sys/prctl.h... no

checking if gcc supports -c -o file.o... yes

checking stddef.h presence... no

checking for sys/wait.h that is POSIX.1 compatible... yes

checking for stddef.h... yes

yes

checking if gcc supports -c -o file.o... (cached) yes

checking whether the gcc linker (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/ld) supports shared libraries... yes

checking dynamic linker characteristics... checking for stdlib.h... (cached) yes

yes

checking whether time.h and sys/time.h may both be included... checking for string.h... (cached) yes

checking for unistd.h... (cached) yes

darwin14.4.0 dyld

checking how to hardcode library paths into programs... immediate

checking whether stripping libraries is possible... yes

checking if libtool supports shared libraries... yes

checking whether to build shared libraries... no

checking whether to build static libraries... yes

checking sys/param.h usability... checking how to run the C preprocessor... gcc -E

yes

checking whether errno must be declared... no

checking size of int... yes

checking sys/param.h presence... checking for stdlib.h... (cached) yes

checking for unistd.h... (cached) yes

yes

checking for sys/param.h... yes

checking for getpagesize... checking for feof_unlocked... 4

checking size of long... yes

checking for working mmap... yes

checking for fgets_unlocked... 8

no

checking size of size_t... checking for getc_unlocked... yes

checking for memcpy... yes

checking for getcwd... 8

checking for long long... yes

checking for strerror... yes

checking for getegid... yes

checking for unistd.h... (cached) yes

yes

checking size of long long... yes

checking for geteuid... configure: updating cache ./config.cache

configure: creating ./config.status

yes

checking for getgid... 8

checking for a 64-bit type... uint64_t

checking for intptr_t... yes

checking for getuid... yes

checking for mempcpy... yes

checking for uintptr_t... no

checking for munmap... yes

yes

checking for ssize_t... checking for putenv... yes

checking for setenv... yes

checking for pid_t... yes

checking for setlocale... yes

checking for stpcpy... yes

checking for library containing strerror... yes

checking for strcasecmp... none required

checking for asprintf... yes

checking for strdup... yes

checking for atexit... yes

yes

checking for strtoul... checking for basename... config.status: creating Makefile

yes

yes

config.status: executing depfiles commands

checking for tsearch... checking for bcmp... config.status: executing libtool commands

yes

yes

checking for bcopy... checking for __argz_count... yes

no

checking for __argz_stringify... checking for bsearch... gcc -DPACKAGE_NAME=\"\" -DPACKAGE_TARNAME=\"\" -DPACKAGE_VERSION=\"\" -DPACKAGE_STRING=\"\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"zlib\" -DVERSION=\"1.1.4\" -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DHAVE_STDLIB_H=1 -DHAVE_UNISTD_H=1 -DHAVE_GETPAGESIZE=1 -DHAVE_MMAP=1 -DHAVE_MEMCPY=1 -DHAVE_STRERROR=1 -DHAVE_UNISTD_H=1 -I.      -g -O2 -c -o libz_a-adler32.o `test -f 'adler32.c' || echo './'`adler32.c

gcc -DPACKAGE_NAME=\"\" -DPACKAGE_TARNAME=\"\" -DPACKAGE_VERSION=\"\" -DPACKAGE_STRING=\"\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"zlib\" -DVERSION=\"1.1.4\" -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DHAVE_STDLIB_H=1 -DHAVE_UNISTD_H=1 -DHAVE_GETPAGESIZE=1 -DHAVE_MMAP=1 -DHAVE_MEMCPY=1 -DHAVE_STRERROR=1 -DHAVE_UNISTD_H=1 -I.      -g -O2 -c -o libz_a-compress.o `test -f 'compress.c' || echo './'`compress.c

yes

no

checking for __argz_next... checking for bzero... no

checking for __fsetlocking... yes

gcc -DPACKAGE_NAME=\"\" -DPACKAGE_TARNAME=\"\" -DPACKAGE_VERSION=\"\" -DPACKAGE_STRING=\"\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"zlib\" -DVERSION=\"1.1.4\" -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DHAVE_STDLIB_H=1 -DHAVE_UNISTD_H=1 -DHAVE_GETPAGESIZE=1 -DHAVE_MMAP=1 -DHAVE_MEMCPY=1 -DHAVE_STRERROR=1 -DHAVE_UNISTD_H=1 -I.      -g -O2 -c -o libz_a-crc32.o `test -f 'crc32.c' || echo './'`crc32.c

checking for calloc... no

checking for iconv... gcc -DPACKAGE_NAME=\"\" -DPACKAGE_TARNAME=\"\" -DPACKAGE_VERSION=\"\" -DPACKAGE_STRING=\"\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"zlib\" -DVERSION=\"1.1.4\" -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DHAVE_STDLIB_H=1 -DHAVE_UNISTD_H=1 -DHAVE_GETPAGESIZE=1 -DHAVE_MMAP=1 -DHAVE_MEMCPY=1 -DHAVE_STRERROR=1 -DHAVE_UNISTD_H=1 -I.      -g -O2 -c -o libz_a-deflate.o `test -f 'deflate.c' || echo './'`deflate.c

yes

checking for clock... gcc -DPACKAGE_NAME=\"\" -DPACKAGE_TARNAME=\"\" -DPACKAGE_VERSION=\"\" -DPACKAGE_STRING=\"\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"zlib\" -DVERSION=\"1.1.4\" -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DHAVE_STDLIB_H=1 -DHAVE_UNISTD_H=1 -DHAVE_GETPAGESIZE=1 -DHAVE_MMAP=1 -DHAVE_MEMCPY=1 -DHAVE_STRERROR=1 -DHAVE_UNISTD_H=1 -I.      -g -O2 -c -o libz_a-gzread.o `test -f 'gzread.c' || echo './'`gzread.c

yes

checking for ffs... yes

checking how to link with libiconv... -liconv

checking for iconv declaration... yes

checking for getcwd... install-shextern size_t iconv (iconv_t cd, char * *inbuf, size_t *inbytesleft, char * *outbuf, size_t *outbytesleft);

checking for nl_langinfo and CODESET... gcc -DPACKAGE_NAME=\"\" -DPACKAGE_TARNAME=\"\" -DPACKAGE_VERSION=\"\" -DPACKAGE_STRING=\"\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"zlib\" -DVERSION=\"1.1.4\" -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DHAVE_STDLIB_H=1 -DHAVE_UNISTD_H=1 -DHAVE_GETPAGESIZE=1 -DHAVE_MMAP=1 -DHAVE_MEMCPY=1 -DHAVE_STRERROR=1 -DHAVE_UNISTD_H=1 -I.      -g -O2 -c -o libz_a-gzclose.o `test -f 'gzclose.c' || echo './'`gzclose.c

yes

yes

checking for LC_MESSAGES... checking for getpagesize... gcc -DPACKAGE_NAME=\"\" -DPACKAGE_TARNAME=\"\" -DPACKAGE_VERSION=\"\" -DPACKAGE_STRING=\"\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"zlib\" -DVERSION=\"1.1.4\" -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DHAVE_STDLIB_H=1 -DHAVE_UNISTD_H=1 -DHAVE_GETPAGESIZE=1 -DHAVE_MMAP=1 -DHAVE_MEMCPY=1 -DHAVE_STRERROR=1 -DHAVE_UNISTD_H=1 -I.      -g -O2 -c -o libz_a-gzwrite.o `test -f 'gzwrite.c' || echo './'`gzwrite.c

yes

checking for bison... bison

checking version of bison... yes

2.3, ok

[floyd]

On 16/08/16 15:57, Greg McSwagger wrote:
> checking for gcc... gcc
>

Game over, wrong compiler.

Please make sure that you can modify the compiler used for a certain
piece of software. Have you looked at ./configure --help? A lot of
software just ignores $CC, which seems to be the case here, sometimes
even ignoring configure script command line options. That's why other
people suggested to you to replace the gcc binary entireley, which is a
really bad idea if your not 100% sure what you are doing. Your issue is
not an AFL issue.

cheers,
floyd

[Greg McSwagger]

Ok so I now know what the problem is now I just have to fix it.

[Greg McSwagger]

Can i edit the makefile so that it compiles with afl-gcc?

[Andrew Melo]

I wouldn't. You'll need to either sort out what the binutils configure
script needs to change the compiler or do as suggested and symlink gcc
to afl-gcc.

-Andrew

On Tue, Aug 16, 2016 at 10:50 AM, Greg McSwagger
<gregmc...@gmail.com> wrote:
> Can i edit the makefile so that it compiles with afl-gcc?
>

> --
> You received this message because you are subscribed to the Google Groups
> "afl-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an

> email to afl-users+...@googlegroups.com.

> For more options, visit https://groups.google.com/d/optout.



--

--
Andrew Melo

[Greg McSwagger]

So to setup a symlink I would run these commands

which gcc

/usr/bin/gcc

which afl-gcc

/usr/local/bin/afl-gcc

ln -s /usr/bin/gcc /usr/local/bin/afl-gcc

[Michal Zalewski]

> ln -s /usr/bin/gcc /usr/local/bin/afl-gcc

Don't do this...

If all other options fail, you can rename afl-gcc to gcc in some other
directory, and put it at the beginning of $PATH. But generally, the
best way is to wrangle the build system to use the compiler of your
choice. Most build systems let you do this pretty easily. Binutils
build system is notoriously messy, so that's probably not a great
starter project, not unless you are ready to dive into Makefiles and
shell scripts. ImageMagick should have been easier, and it's possible
that you bumped into a bug, but I was really confused by the commands
you pasted in the thread (and to be honest... I suspect that either
the tutorial you are following is not great, or that you're
overcomplicating it for some other reason).

Another simple example is libjpeg-turbo; you should be able to
download it, build with:

CC=/path/to/afl-gcc ./configure --disable-shared && make

...and then should be able to fuzz the ./djpeg utility *in the build directory*.

PS. You mentioned that you are building on MacOS X, but you seem to be
using gcc / afl-gcc... are you sure you actually have GCC installed,
and that it's not just a wrapper for Clang? See docs/INSTALL:

"The Xcode 'gcc' tool is just a wrapper for clang, so be sure to use
afl-clang to compile any instrumented binaries; afl-gcc will fail
unless you have GCC installed from another source (in which case,
please specify AFL_CC and AFL_CXX to point to the "real" GCC
binaries)."

PPS. Looking at the snippets you are pasting in the threads - please
don't sudo to root to configure, build, or fuzz software; it's just
not necessary.

/mz

[Jakub Wilk]

* Michal Zalewski <lca...@gmail.com>, 2016-08-16, 10:22:

>generally, the best way is to wrangle the build system to use the
>compiler of your choice. Most build systems let you do this pretty
>easily. Binutils build system is notoriously messy, so that's probably
>not a great starter project, not unless you are ready to dive into
>Makefiles and shell scripts.

"CC=/usr/local/bin/afl-gcc ./configure --disable-shared" worked for me
just fine against binutils-2.27. I don't know why it didn't work for
Greg. :-/

--
Jakub Wilk

[Greg McSwagger]

Ok so I'm going to try to fuzz libjpeg-turbo but there is no config file but when I run the command 
   CC=/usr/local/bin/afl-gcc ./configure --disable-shared && make I get this error

-bash: ./configure: No such file or directory

On Monday, August 15, 2016 at 8:24:29 PM UTC-4, Greg McSwagger wrote:

[Greg McSwagger]

I removed and then downloaded again libjpeg-turbo and I found the config file but when I try to build libjpeg-turbo but it still won't use afl-gcc and keeped using the regular gcc on my system.

On Monday, August 15, 2016 at 8:24:29 PM UTC-4, Greg McSwagger wrote:

[Greg McSwagger]

Ok i downloaded and built libjpeg-turbo-1.5.0 and I tried to run djpeg but when I did it didn't do anything. The cpu wasn't working very hard. I had to press control c to type in more commands.