Dumping a non-crash path about honggfuzz HOT 3 CLOSED

It's only somewhat possible. The coverage dump is performed by the kernel in an asynchronous manner, i.e. we know only that some function (address range) was reached, and we could create a crash, but the crash itself would not be exactly in this function, because the process could be soemwhere else currently.

If this is ok with your plans (i.e. crash the process, but only knowing that it reached some function in the past), we could add sth like that.

Otherwise, maybe you can rewrite the binary, and simply add "int $3" everywhere in the function (instead of regular code). honggfuzz will see it as SIGTRAP, and will dump the crash.

from honggfuzz.

@robertswiecki Thanks for your response. =)

That was my first thought too (except with SIGSEGV, totally forgot about SIGTRAP); I thought constantly rewriting the binary might add a lot of overhead though. Do I have to completely shut down honggfuzz or can I get away with modifying the binary live?

from honggfuzz.

Inserting int3 is probably easy. What is more, you can probably try to insert a debug register with ptrace - then when the code will reach it, you'll receive SIHTRAP. But you have only 4 debug regs in x86.

from honggfuzz.