Debugging crashes that don't happen outside of AFL.rs
XAMPPRocky opened this issue · comments
Hey, not sure where's the best place to ask about this, but I'm running into crashes in my program when being fuzzed by afl.rs, that I can't replicate when running the code without the fuzzer. You can check this out yourself in the rasn
repository.
Setup
- Clone https://github.com/XAMPPRocky/rasn/tree/0b7160daca42f3b54072253accc0582dabe10295
cd fuzzing
cargo afl build
AFL_MAP_SIZE=117760 cargo afl fuzz -i in -o out target/debug/fuzzing
- Leave it running, and wait until a crash appears. (usually in the first few seconds)
cargo run --bin check_crashes
This runs a short program to run the same code as the fuzzer over each entry in theout
directory.
If everything is setup, check_crashes
should print No valid crash cases found.
while afl.rs shows multiple (up to 20 usually) unique crashes.