10000 QEMU Mode: Stop Fuzzing at a Specific Address · Issue #1932 · AFLplusplus/AFLplusplus · GitHub
[go: up one dir, main page]
Skip to content

QEMU Mode: Stop Fuzzing at a Specific Address #1932

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
legical opened this issue Dec 15, 2023 · 8 comments
Open

QEMU Mode: Stop Fuzzing at a Specific Address #1932

legical opened this issue Dec 15, 2023 · 8 comments
Labels
enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed

Comments

@legical
Copy link
legical commented Dec 15, 2023 •
edited
Loading

Is your feature request related to a problem? Please describe.
I am currently using AFL++ with QEMU mode for fuzz testing and I am wondering if there is a way to stop fuzzing when a specific address is reached. In some cases, the target programs are quite large, and I am only interested in fuzzing a specific segment of the binary code, typically from the program entry point to a specific address.
I would like to propose a feature that allows users to set a specific address as a fuzzing target in AFL++ QEMU mode.

Describe the solution you'd like

  • The ability to specify the target address through a command-line option or configuration file.
  • Ensuring that AFL++ gracefully halts the fuzzing process when the specified address is reached, then repeat fuzzing from the program entry to the specific address.

Describe alternatives you've considered
persistent mode allows for repeated execution of a particular section of a reentrant function, but that doesn't satisfy my needs. I want to be able to repeat the fuzzing of a program entry to any given address.

Additional context
none.
@vanhauser-thc vanhauser-thc added enhancement New feature or request help wanted Extra attention is needed good first issue Good for newcomers labels Dec 19, 2023
@vanhauser-thc
Copy link
Member

that is an idea we have in the TODO.md:

 - add AFL_QEMU_EXITPOINT (maybe multiple?)

would be nice if someone would add this :)

@JegadeeshVontlin
Copy link

I would like to work on this issue.

@Aditya-Choudhry
Copy link

I would like to work in this issue

@01ChenQing
Copy link
01ChenQing commented Jan 11, 2024 •
edited
Loading

that is an idea we have in the TODO.md:

 - add AFL_QEMU_EXITPOINT (maybe multiple?)

would be nice if someone would add this :)

I would like to help in implementing this feature, but the functionality of AFL_QEMU_EXITPOINT and AFL_QEMU_PERSISTENT_RET seems quite similar. Both involve running the guest to a specified address. To better understand the requirements, I would like to clarify the differences between these two. @legical

@vanhauser-thc
Copy link
Member

PERSISTENT_RET is for the persistent loop feature and results in that the program counter is reset. this is not what we want in this feature.

with AFL_QEMU_EXITPOINT (which should support a list of addresses) this should result in an exit() of the emulated process instead.

@CowBoy4mH3LL
Copy link
Contributor

Maybe too late, but, you could use the hooking bridge to hook that address and exit(), right?

@ArunaHulakoti
Copy link

@legical I'd like to work on this feature. can I take it up?

@vanhauser-thc
Copy link
Member

@legical I'd like to work on this feature. can I take it up?

Yes you can. It is pretty simple. When the address is reached then simply exit

@rajanarahul93 rajanarahul93 mentioned this issue May 17, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat: add AFL_QEMU_EXITPOINT for controlled exit via env var rajanarahul93/AFLplusplus
7 participants
@JegadeeshVontlin @vanhauser-thc @legical @01ChenQing @CowBoy4mH3LL @Aditya-Choudhry @ArunaHulakoti
0