Format for providing inputs for argv fuzzing ?

146 views
Skip to first unread message

v k

unread,
Jan 29, 2024, 2:41:06 PMJan 29
to afl-users
Hi All,

My test application makes use of command line arguments as inputs:
I have used the experimental argv_fuzzing  and compiled the application successfully.
```
#include "/AFLplusplus/utils/argv_fuzzing/argv-fuzz-inl.h"
int main (int argc, char * argv[])
{
   AFL_INIT_SET0("a.out");
    // application logic.
}
```

My application takes several  arguments for internal logic. The arguments are defined and handled within the application

```
example commands:
./a.out  -r  -d 8125 -p ASW   //read operation
./a.out  -w  -d 0017 -p  030F -v 0xFF // write operation
...
```

I have defined the inputs in the file accordingly:
```
// file: seed/input.txt
-r -d 8125 -p ASW  
-w -d 0017 -p  030F -v 0xFF
-r -d 312F -p ENC
-w -d 111F -p  030F -v 0x54
...
```

I run the fuzzer as follows:
```
afl-fuzz -D -i ../seed/ -o out/ -- app/a.out
```

After executing for almost more than 24 hrs, I do not see any crashes. 
This makes me wonder if the format of test input I provided is valid or not?

Can someone clarify if the format of input provided in file seed/input.txt is valid or not? 
The input.txt file is written by me and each line is terminated with a newline character(Enter key) in the file. Is this the correct format to write the input ? Or should I be focussing on a null terminated line?



floyd

unread,
Jan 29, 2024, 4:10:48 PMJan 29
to afl-...@googlegroups.com
Hi,

The argv-fuzz-inl.h reads:

This will cause the program to read NUL-delimited input from stdin and put it in argv[]. Two subsequent NULs terminate the array. Empty params are encoded as a lone 0x02. Lone 0x02 can't be generated, but that shouldn't matter in real life.

So you should have multiple files in the seed directory, for example one that has (where \x00 are actually zero bytes):

-r\x00-d\x008125\x00-p\x00ASW\x00\x00

If you want to supply multiple input example seeds, put them in additional files.

Maybe also try a generic AFL++ tutorial first, the concept of „one input example per file“ is universal for AFL

cheers
floyd



On 29 Jan 2024, at 20:41, v k <venkates...@gmail.com> wrote:

Hi All,
--
You received this message because you are subscribed to the Google Groups "afl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to afl-users+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/afl-users/cdddfce8-9c39-49e2-825c-4e850754153an%40googlegroups.com.
Reply all
Reply to author
Forward
0 new messages