) Using WinAFL

---------------

Note: If you are using pre-built binaries you'll need to download DynamoRIO

release 6.1.- from https://github.com/DynamoRIO/dynamorio/wiki/Downloads.

If you built WinAFL from source, you can use whatever version of DynamoRIO

you used to build WinAFL.

The command line for afl-fuzz on Windows is different than on Linux. Instead of

%s [ afl options ] -- [instrumentation options] -- 

it now looks like this

afl-fuzz [afl options] -- [instrumentation options] -- target_cmd_line

The followin afl-fuzz options are supported:

  -i dir        - input directory with test cases

  -o dir        - output directory for fuzzer findings

  -D dir        - directory containing DynamoRIO binaries (drrun, drconfig)

  -t msec       - timeout for each run

  -f file       - location read by the fuzzed program

  -M \\ -S id   - distributed mode

  -x dir        - optional fuzzer dictionary

Please refer to the original AFL documentation for more info on these flags.

The following instrumentation options are used

  -covtype         - the type of coverage being recorded. Supported options are

                     bb (basic block, default) or edge.

  -coverage_module - module for which to record coverage. Multiple module flags

                     are supported.

  -target_module   - module which contains the target function to be fuzzed.

                     Either -target_method or -target_offset need to be

                     specified together with this option.

  -target_method   - name of the method to fuzz in persistent mode. A symbol

                     for the method needs to be exported for this to work.

                     Otherwise use -target_offset instead.

  -target_offset   - offset of the method to fuzz from the start of the module.

  -fuzz_iterations - Maximum nuber of iterations for the target function to run

                     before restarting the target process.

  -nargs           - Number of arguments the fuzzed method takes. This is used

                     to save/restore the arguments between runs.

  -debug           - Debug mode. Does not try to connect to the server. Outputs

                     a log file containing loaded modules, opened files and

                     coverage infrormation.

  -logdir          - specifies in which directory the log file will be written

                     (only to be used with -debug).

In general, you should perform the following steps when fuzzing a new target:

. Make sure your target is running correctly without instrumentations.

. Open the target binary in WinDbg and locate the function you want to fuzz.

Note the offset of the function from the start of the module. For example, if

you want to fuzz the main function and happen to have symbols around, you can

use the following windbg command:

x test!main

. Make sure that the target is running correctly under DynamoRIO. For this

purpose you can use the standalone debug mode of WinAFL client which does not

require connecting to afl-fuzz. Make sure you use the drrun.exe and winafl.dll

version which corresponds to your target ( vs.  bit).

Example command line

path\to\DynamoRIO\bin64\drrun.exe -c winafl.dll -debug

-target_module test_gdiplus.exe -target_offset 0x1270 -fuzz_iterations

-nargs  -- test_gdiplus.exe input.bmp

You should see the output corresponding to your target function being run

times after which the target executable will exit. A .log file should be

created in the current directory. The log file contains useful information

such as the files and modules loaded by the target as well as the dump of AFL

coverage map. In the log you should see pre_fuzz_handler and post_fuzz_handler

being run exactly  times as well as your input file being open in each

iteration. Note the list of loaded modules for setting the -coverage_module

flag. Note that you must use the same values for module names as seen in the

log file (case sensitive).

. Now you should be ready to fuzz the target. First, make sure that both

afl-fuzz.exe and winafl.dll are in the current directory. As stated earlier,

the command line for afl-fuzz on Windows is

afl-fuzz [afl options] -- [instrumentation options] -- target_cmd_line

Please refer above for the list of supported AFL and instrumentation options.

In AFL options, you must specify the DynamoRIO binaries directory via the new

-D option. You need to match the DynamoRIO and winafl.dll build ( vs.  bit)

to the target binary. -t (timeout) option is mandatory for winafl as execution

time can vary significantly under instrumentation so it’s not a good idea to

rely on the auto-determined values.

You can use the same winafl options as in step  but remember to exclude the

-debug flag and you'll probably want to increase the iteration count.

Note that, unlike linux AFL, in WinAFL the default coverage mode is basic

block. This is because in multithreaded (i.e. most real-world) applications

every context switch would be interpreted as new coverage even when no new

coverage actually occured. If you are confident that all your coverage modules

execute only a single thread at a time you can change this by adding

-covtype edge

to your instrumentation flags.

As in afl-fuzz on Linux you can replace the input file param of the target

binary with @@

An example command line would look like

afl-fuzz.exe -i in -o out -D C:\work\winafl\DynamoRIO\bin64 -t  --

-coverage_module gdiplus.dll -coverage_module WindowsCodecs.dll

-fuzz_iterations  -target_module test_gdiplus.exe -target_offset 0x1270

-nargs  -- test_gdiplus.exe @@

That’s it. Happy fuzzing! Let me know if you find any bugs.