mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-09 16:51:34 +00:00
46 lines
2.2 KiB
Markdown
46 lines
2.2 KiB
Markdown
# Triaging crashes
|
|
|
|
The coverage-based grouping of crashes usually produces a small data set that
|
|
can be quickly triaged manually or with a very simple GDB or Valgrind script.
|
|
Every crash is also traceable to its parent non-crashing test case in the
|
|
queue, making it easier to diagnose faults.
|
|
|
|
Having said that, it's important to acknowledge that some fuzzing crashes can be
|
|
difficult to quickly evaluate for exploitability without a lot of debugging and
|
|
code analysis work. To assist with this task, afl-fuzz supports a very unique
|
|
"crash exploration" mode enabled with the -C flag.
|
|
|
|
In this mode, the fuzzer takes one or more crashing test cases as the input
|
|
and uses its feedback-driven fuzzing strategies to very quickly enumerate all
|
|
code paths that can be reached in the program while keeping it in the
|
|
crashing state.
|
|
|
|
Mutations that do not result in a crash are rejected; so are any changes that
|
|
do not affect the execution path.
|
|
|
|
The output is a small corpus of files that can be very rapidly examined to see
|
|
what degree of control the attacker has over the faulting address, or whether
|
|
it is possible to get past an initial out-of-bounds read - and see what lies
|
|
beneath.
|
|
|
|
Oh, one more thing: for test case minimization, give afl-tmin a try. The tool
|
|
can be operated in a very simple way:
|
|
|
|
```shell
|
|
./afl-tmin -i test_case -o minimized_result -- /path/to/program [...]
|
|
```
|
|
|
|
The tool works with crashing and non-crashing test cases alike. In the crash
|
|
mode, it will happily accept instrumented and non-instrumented binaries. In the
|
|
non-crashing mode, the minimizer relies on standard AFL++ instrumentation to make
|
|
the file simpler without altering the execution path.
|
|
|
|
The minimizer accepts the -m, -t, -f and @@ syntax in a manner compatible with
|
|
afl-fuzz.
|
|
|
|
Another tool in AFL++ is the afl-analyze tool. It takes an input
|
|
file, attempts to sequentially flip bytes, and observes the behavior of the
|
|
tested program. It then color-codes the input based on which sections appear to
|
|
be critical, and which are not; while not bulletproof, it can often offer quick
|
|
insights into complex file formats. More info about its operation can be found
|
|
near the end of [technical_details.md](technical_details.md). |