My steps: # Edit FourIndependentBranchesTest.cpp to replace exit(1) with abort()Īfl-gcc -c ~/llvm-project/compiler-rt/lib/fuzzer/standalone/StandaloneFuzzTargetMain.cĪfl-g++ ~/llvm-project/compiler-rt/test/fuzzer/FourIndependentBranchesTest.cpp StandaloneFuzzTĪFL_SKIP_CPUFREQ=1 afl-fuzz -i in -o out. (unless I provide a very close corpus element).įrom the Ankou paper I expected that it would shine on this kind of puzzles. I've tried Ankou on and failed to make Ankou find the bug There are too many programs in our benchmark, so we will use only one package in this example: cflow. Divide it by the time column to obtain the throughout. And the execN column of seed_manager.csv represents the total number of test cases executed so far. The edge_n value of receiver.csv represents the branch coverage. Statistics of the fuzzing campaign can be found in the $OUTPUT_DIR/status* directory CSV files. Crashes are listed in $OUTPUT_DIR/crashes-* and found seeds in $OUTPUT_DIR/seeds-*. Analyze Ankou output directory for results.benchmark/rq1_rq3.json only contains the 24 subjets used for Research Question 1 and 3 of the paper. Run the produced subjects with the commands found in benchmark/configuration.json.Additionnally, this repository includes the seeds used to initialize the evalution fuzzing campaigns. All the packages' source can be found with the same version used in Ankou evaluation at. Compile the 24 packages mentioned in the paper at the same version or commit using afl-gcc.Once Ankou is installed, in order to reproduce the Ankou evaluation: readelf -args '-a ' -i seeds -o out Evaluation Reproduction Mkdir seeds cp elfedit seeds/ # Put anything in the seeds folder.

Mac os ulimit