crashes found by AFL+ASAN cannot reproduce

[sunb...@gmail.com]

Hi,

    I have about 80+ crash samples generated by AFL+ASAN.  But I cannot reproduce the crash by feed the crash sample to the target with ASAN enabled. Any idea? 

    BTW, I have also tried valgrind with memcheck enabled, still makes no difference.

thanks

 

[Michal Zalewski]

> I have about 80+ crash samples generated by AFL+ASAN. But I cannot reproduce the crash by feed the crash sample to the target with ASAN enabled. Any idea?

Retry under afl-showmap, maybe this will help. If not, try running it
10k times and see if you get any intermittent crashes - could be a
concurrency issue.

If all that fails, not sure.

/mz

[Konstantin Serebryany]

is there a way AFL can dump the asan report alongside the crash sample?  

Also, as Michal says, it could be a concurrency issue. 

Is your target app multi-threaded? 

If so, try tsan. 

--
You received this message because you are subscribed to the Google Groups "afl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to afl-users+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Michal Zalewski]

> is there a way AFL can dump the asan report alongside the crash sample?

Right now, all file descriptors not used to deliver the fuzzed data
point to /dev/null to speed things up and limit disk I/O.

ASAN_OPTIONS='log_to_syslog=1:[...other stuff...]' may do the trick
without any changes to AFL, though?

/mz

[sunb...@gmail.com]

Hi MZ,

     Thanks for your response. I have tried run it many times, and yes, sometimes it crash again.  Now I am suffering from triage these crashes. 

     

thanks

在 2016年2月22日星期一 UTC+8下午3:39:02，Michal Zalewski写道：

[sunb...@gmail.com]

Hi Konstantin,

     I can reproduce the crash with MZ's method, it is concurrency issue. And, yes the target is multi-thread, but I cannot use tsan, cause tsan is still not supported on Android which is the platform I am fuzzing on.

     Still thanks for your suggestion.

thanks

在 2016年2月22日星期一 UTC+8下午3:23:13，Konstantin Serebryany写道：

[Behzad Najjarpour Jabbari]

Hi,

I'm not sure if it works or not, but maybe you can use "ASAN_OPTIONS=log_path=/tmp/ASAN_TMP:abort_on_error=1" environment variable to save AddressSanitizer's output somewhere.

/Behzad

[sunb...@gmail.com]

Hi Behzad,

     It works well, thanks !

在 2016年2月26日星期五 UTC+8下午9:21:48，Behzad Najjarpour Jabbari写道：