How to run a simple fuzzing job with SAVIOR #8
Comments
|
Hi, Please refer to the test folder for examples, specifically, you will need to prepare a config file similar to this and then run the coordinator by providing the required parameters |
|
Hey thanks! got that and run it with the following command :
But seems it has a problem : Seems it's not going to do the job correct . Would you please help in this case ? I am sure that I am doing all steps correctly . These are the files I have in my /jpeg-9c/obj-savior directory : |
|
I spotted the problem, before running the fuzzing job I should do this :
Now I can run the job but the new problem is encountered : Seems there is a small problem with the script so it can not find a specific path . I think it's looking for " id:000324,src:000000,op:arith8,pos:291,val:+20,+cov " but in this case it can not find it and it throws error for id_000324 . So how to solve this problem ? Thanks! |
|
Hmmm, thanks for reporting. To fix that, please revert this commit: e2c18d9 and check if it still repro Thanks |
|
Thanks for the reply . I checked the Makefile and it's already correct. this is my AFL/Makefile 👍 # Seems line 73 is as what you already said for the commit . And yes I checked the format of the input and it's like this : Any other fix to that? Seems the main problem is exactly from input format . Looking for solution to this . |
|
OK, now I got it . I should revert this commit . I reverted this and seems it's running without problem . But 3 questions here :
Thanks! |
|
@evanmak It seems that there is no problem to run the savior now, but I guess it's not functioning as expected . This is the output of a very simple program which I expect at least one crash in minutes : I went to crashes folders of both master and slave_000001 but there is nothing found ! The simple program is as (Which I get it basically from QSYM repo) : |
it seems there's no input to choose from for symex, can you verify AFL is running correctly? |
|
for your questions,
Most of the bugs found are UBSAN bugs, please refer to our paper for the number.
Yes, there's another version used in Baidu. Inc, internally, which is more well maintained. But unfortunately I do not have access to it.
It scales fine, I tested it on several modules in https://github.com/ApolloAuto/apollo, it was able to run tens of millions of instructions in like 15 minutes. |
Let me check it and reply that back to you. but before that, this is the output of running Savior on Jpeg sample : Does this output proofs that Savior is running and working correctly ? |
This is my fuzz.cfg file : And this is actually what's going on my current directory (files in the target directory): Basically, as you can see from the source code from sample program (Originally get from QSYM), the program get a file as :
So I choosed this in my config file :
Is it correct ? Basically when I run this normally with afl as :
It's not going to be correct and it outputs : But when I run it as it should be (with @@ ):
It's running well . I don't know If It's running correctly with Savior or not in the aforementioned config but I would like to know, how is possible to make the input type more customizable ? for example, for testing Savior against LAVA-M , I should pass base64 as :
How to pass this correctly to Savior ? Also, I like to know how is it possible to run a fuzzing job separately of using moriarty.py and directly with afl and savior concolic executor to test if it's working or not . If you can paste the commands here I'll appreciate you . Thanks! |
|
@evanmak Looking forward for a reply . At the moment, it's important to me to know how to pass parameters and different switches (Like the one in base64 -d) of a program to Savior so savior and afl would be know how to fuzz the program and parameters in the right way . Thanks! |
|
Hi, For how to config SAVIOR to take input from command line argument see the tcpdump example: https://github.com/evanmak/savior-source/blob/master/tests/config_samples/fuzz_tcpdump.cfg For how to run the job's separately you may try to look at the command line constructed by |
|
@evanmak Thanks about this! I have two instances of Savior, applying everything you said and they are running against base64 (LAVA-M) and the tcpdump sample . (Just checked every step to be sure that everything is going to be fine) To now, it's about 24 hours that base64 is running and unfortunately I didn't see any sign of even one crash ! Same is for tcpdump as it's running about 1 hours and didn't receive any sign of crashes (I manually check the master and slave_* folders and crashes folder inside them) . This is the summarized output of Savior running against Tcpdump to now : Any idea about if Savior is running well or possibly there's a problem around that ? I'd appreciate all your replies but I'm confused about why it is not finding any crashes :-( Thanks! |
|
The tcpdump output looks correct, KLEE is contributing seeds. As for crashes, note that SAVIOR instruments the programs with UBSAN, and If the tested program is instrumented with UBSAN, by default UBSAN is not crashing the program, instead it will just print a log message and resume the program execution. As for LAVA program, please read our paper https://yaohway.github.io/savior.pdf section V.A, its instrumentation is A bit different. Long story short, the UBSAN labels are not able to guide SAVIOR to solve LAVA's instrumented branch, so SAVIOR does not know it should solve the branch constraint for these (artificial) bugs. You will have to rebuild a different version of SAVIOR, specifically, enable this branch of the code: https://github.com/evanmak/savior-source/blob/master/AFL/llvm_mode/afl-llvm-pass.so.cc#L314-L323 last piece of suggestion, if you would like to evaluate fuzzer effectiveness, LAVA-M is now considered deprecated, I recommend checking out Google's new fuzzbench project. |
|
Hello @evanmak and thanks for your reply . I activated that branch of the code in the llvm pass and run it again, against base64 lava and this is the output : I think this output shows that the Savior fuzzer along with the Concolic execution engine is running well and working properly (Please fix me if I'm wrong) .
So, how is the proper way of fuzzing with savior so we can find the crash file / corpus ?
By this, Do you mean us to port savior into Google Fuzzbench and use that benchmark Service instead of LAVA ? Is it possible to you to make a VM (possibly vmware / virtualbox) of Savior or at-least send here your exact configurations or files for your lava tests that you mentioned in the paper ? Thanks! |
there are two ways to make it work. 1) replay the inputs in the
it is going to take some work for that, if you can make it work with FuzzBench that will be greatly appreciated, given that I don't have extra cycle to work on that these days : - /
I no longer have the old configuration for lava unfortunately. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hey !
I successfully compiled the savior and followed along the readme of savior .
but finally I don't know how to run the fuzzing job in order to run fuzzing with savior .
Would you please give a sample here so I can run savior for a fuzzing job ? the fuzzing command to run fuzzing with savior is enough .
thanks .
The text was updated successfully, but these errors were encountered: