Experiment irfuzzer:dagisel:x86_64:9 exited with code 1

[XChy]

I follow the README to build IRFuzzer on docker (master branch):

docker build . -t irfuzzer

And use the command below to fuzz with the original seed:

python3.10 scripts/fuzz.py --seeds seeds -o fuzzing -r 10 --type=stdout --targets="x86_64" --isel=dagisel --fuzzer=irfuzzer --time=10w -j 10 --on-exist=force

But the exit codes of all experiments are non-zero:

Experiment irfuzzer:dagisel:x86_64:0 exited with code 1
Experiment irfuzzer:dagisel:x86_64:1 exited with code 1
Experiment irfuzzer:dagisel:x86_64:2 exited with code 1
Experiment irfuzzer:dagisel:x86_64:3 exited with code 1
Experiment irfuzzer:dagisel:x86_64:4 exited with code 1
Experiment irfuzzer:dagisel:x86_64:5 exited with code 1
Experiment irfuzzer:dagisel:x86_64:6 exited with code 1
Experiment irfuzzer:dagisel:x86_64:7 exited with code 1
Experiment irfuzzer:dagisel:x86_64:8 exited with code 1
Experiment irfuzzer:dagisel:x86_64:9 exited with code 1

And the fuzzing directory is empty:

> tree ./fuzzing/
./fuzzing/
`-- irfuzzer
    `-- dagisel
        `-- x86_64
            |-- 0
            |-- 1
            |-- 2
            |-- 3
            |-- 4
            |-- 5
            |-- 6
            |-- 7
            |-- 8
            `-- 9

13 directories, 0 files

Is it expected? If yes, what is the symptom if bugs are found? Thanks you!

[DataCorrupted]

Hi! Thanks for using IRFuzzer

I think master is diverged, two/three years ago. The branch we used for the paper is ICSE25, irfuzzer-0.4/irfuzzer-0.3 should also be operational, but I don't remember the difference between the branches any more, you prob need to check the commit history to find out. Most of the changes should be on scripts only, e.g. ICSE25 prob have some fine-tuning on scripts to enable CSmith + IRFuzzer to address the reviewers concerns at the time.

Docker has always been flaky for us (unfortunately, cc @HazyFish ), trying without docker using ./build.sh may give you a better chance.

In terms of using IRFuzzer, I suggest you start with more verbose command line first, it shows you a nice AFL UI to help you monitor stats under the hood, and only use the script when you move to large scale experiment (e.g. to collect data for your paper). IIRC, the UI will tell you how many crash have been found, and they will be stored <output_dir>/crashes

[XChy]

Thanks for your reply!
I tried docker build on the icse25 branch, but AFL-Fuzz crashed with the command in README:

afl-fuzz++4.01c based on afl by Michal Zalewski and a large online community
[+] afl++ is maintained by Marc "van Hauser" Heuse, Heiko "hexcoder" Eißfeldt, Andrea Fioraldi and Dominik Maier
[+] afl++ is open source, get it at https://github.com/AFLplusplus/AFLplusplus
[+] NOTE: This is v3.x which changes defaults and behaviours - see README.md
[+] No -M/-S set, autoconfiguring for "-S default"
[*] Getting to work...
[+] Using exponential power schedule (FAST)
[+] Enabled testcache with 50 MB
[+] Generating fuzz data with a length of min=1 max=1048576
[*] Checking core_pattern...

[-] Hmm, your system is configured to send core dump notifications to an
    external utility. This will cause issues: there will be an extended delay
    between stumbling upon a crash and having this information relayed to the
    fuzzer via the standard waitpid() API.
    If you're just testing, set 'AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1'.

    To avoid having crashes misinterpreted as timeouts, please log in as root
    and temporarily modify /proc/sys/kernel/core_pattern, like so:

    echo core >/proc/sys/kernel/core_pattern

[-] PROGRAM ABORT : Pipe at the beginning of 'core_pattern'
         Location : check_crash_handling(), src/afl-fuzz-init.c:2197

And on the icse25 branch, I also tried build.sh without docker, but it just left something below:

make: *** No targets specified and no makefile found.  Stop.

Do you know why this happened? Will the LLVM installed in my system break it?

I will try your docker image in later days. Is it valid?

[DataCorrupted]

docker image is valid. However, 1) it is a customized version for alive2, so it may not do what you want 2) I heard its super large

make: *** No targets ...

Need to run init.sh before that

echo core >/proc/sys/kernel/core_pattern

Error message has said it all.

One trivia is that you need to do that on your hosting machine, not your docker.

Please read AFL's user manual more carefully.

[XChy]

@DataCorrupted, thanks for your help! It works for me now.