ris3-lab / dice-dma-emulation Goto Github PK

/home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/Unit-Test/../DICE-P2IM-Utilities/me.py:44: DeprecationWarning: The SafeConfigParser class has been renamed to ConfigParser in Python 3.2. This alias will be removed in future versions. Use ConfigParser directly instead.
  parser = configparser.SafeConfigParser()
***************
./Firmware/Binaries-DICE/F103_ADC_SingleConversion_TriggerTimer_DMA.elf
***************
Change working dir to: 1/
CWD: /home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/Unit-Test/1
cmd to launch this script: /home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/Unit-Test/../DICE-P2IM-Utilities/me.py -c mi-f103.cfg

args after processing: Namespace(afl_file=None, config='mi-f103.cfg', eval=False, gt=None, model_if=None, print_to_file=False, run_from_fs=False, run_num='1')

configurations after processing: Namespace(board='NUCLEO-F103RB', img='/home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/Unit-Test/Firmware/Binaries-DICE/F103_ADC_SingleConversion_TriggerTimer_DMA.elf', log_f='/home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/Unit-Test/me.log', mcu='STM32F103RB', objdump='/home/gym/DICE-DMA-Emulation/p2im/gcc-arm-none-eabi-9-2020-q2-update/bin/arm-none-eabi-objdump', peri_addr_range=512, qemu_bin='/home/wangfeng/DICE-DMA-Emulation/DICE-precompiled/ARM_bin/qemu-system-gnuarmeclipse', qemu_log='unimp,guest_errors,int', retry_num=3)

depth 1, stage: SR_R_ID
cmd: /home/wangfeng/DICE-DMA-Emulation/DICE-precompiled/ARM_bin/qemu-system-gnuarmeclipse -verbose -verbose -d unimp,guest_errors,int -nographic -board NUCLEO-F103RB -mcu STM32F103RB -image /home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/Unit-Test/Firmware/Binaries-DICE/F103_ADC_SingleConversion_TriggerTimer_DMA.elf -pm-stage 1 -trace trace-depth:1,stage:1.0 -reg-acc reg_acc-depth:1,stage:1.0 -model-output model-depth:1,stage:1.0.json
ret_val: 0x7f
ret_val == 0x7f, re-run it!
ret_val: 0x7f
ret_val == 0x7f, re-run it!
ret_val: 0x7f
ret_val == 0x7f, re-run it!
Traceback (most recent call last):
  File "/home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/Unit-Test/../DICE-P2IM-Utilities/me.py", line 1158, in <module>
    ret_val = stage1()
  File "/home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/Unit-Test/../DICE-P2IM-Utilities/me.py", line 358, in stage1
    ret_val = qemu_run(cmd, cfg.retry_num, stage)
  File "/home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/Unit-Test/../DICE-P2IM-Utilities/me.py", line 192, in qemu_run
    color_print(error_rv[stage][ret_val], "red")
KeyError: 1
['/home/wangfeng/DICE-DMA-Emulation/DICE-precompiled/ARM_bin/qemu-system-gnuarmeclipse', '-verbose', '-verbose', '-d', 'unimp,guest_errors,int', '-nographic', '-board', 'NUCLEO-F103RB', '-mcu', 'STM32F103RB', '-image', '/home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/Unit-Test/Firmware/Binaries-DICE/F103_ADC_SingleConversion_TriggerTimer_DMA.elf', '-pm-stage', '1', '-trace', 'trace-depth:1,stage:1.0', '-reg-acc', 'reg_acc-depth:1,stage:1.0', '-model-output', 'model-depth:1,stage:1.0.json']

exit_callback is invoked

Execution time(seconds):
0.06402420997619629
Traceback (most recent call last):
  File "/home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/Unit-Test/../DICE-P2IM-Utilities/statFp3.py", line 261, in <module>
    aux = getStat(sys.argv[1],sys.argv[2],sys.argv[3])
  File "/home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/Unit-Test/../DICE-P2IM-Utilities/statFp3.py", line 177, in getStat
    for intrs in data["interrupts"]:
KeyError: 'interrupts'

[-] Oops, the program crashed with one of the test cases provided. There are
    several possible explanations:

    - The test case causes known crashes under normal working conditions. If
      so, please remove it. The fuzzer should be seeded with interesting
      inputs - but not ones that cause an outright crash.

    - The current memory limit (2.00 GB) is too low for this program, causing
      it to die due to OOM when parsing valid files. To fix this, try
      bumping it up with the -m setting in the command line. If in doubt,
      try something along the lines of:

      ( ulimit -Sv $[2047 << 10]; /path/to/binary [...] <testcase )

      Tip: you can use http://jwilk.net/software/recidivm to quickly
      estimate the required amount of virtual memory for the binary. Also,
      if you are using ASAN, see docs/notes_for_asan.txt.

    - Least likely, there is a horrible bug in the fuzzer. If other options
      fail, poke <[email protected]> for troubleshooting tips.

/fuzz.py:46: DeprecationWarning: The SafeConfigParser class has been renamed to ConfigParser in Python 3.2. This alias will be removed in future versions. Use ConfigParser directly instead.
  parser = configparser.SafeConfigParser(os.environ)
Change working dir to: /home/wangfeng/FuzzBase/Modbus/1.0
CWD: /home/wangfeng/FuzzBase/Modbus/1.0

try our best to extract model w/o input
model already extracted! No need to do it again

extract model for each seed input
0.input.data.1
run f/w w/ seed input to check if there is aup
cmd_qemu: /home/wangfeng/DICE-DMA-Emulation/p2im/qemu/src/install/debian64/qemu/bin/qemu-system-gnuarmeclipse -nographic -aflFile /home/wangfeng/FuzzBase/Modbus/1.0/inputs/input.data -board NUCLEO_F303RE -mcu STM32F303RE -image /home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/Fuzzing/Firmware/Binaries/Modbus.elf -pm-stage 3 -model-input /home/wangfeng/FuzzBase/Modbus/1.0/0/peripheral_model.json -me-bin /home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/DICE-P2IM-Utilities/me.py -me-config mi-f303.cfg

No aup, don't run ME

launch fuzzer
cmd_afl: /home/wangfeng/DICE-DMA-Emulation/p2im/afl/afl-fuzz -m none -i /home/wangfeng/FuzzBase/Modbus/1.0/inputs -o /home/wangfeng/FuzzBase/Modbus/1.0/outputs -t 2000+ -QQ -a /home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/DICE-P2IM-Utilities/me.py -b mi-f303.cfg -c /home/wangfeng/FuzzBase/Modbus/1.0/0/peripheral_model.json -T Modbus_1.0 -d /home/wangfeng/DICE-DMA-Emulation/p2im/qemu/src/install/debian64/qemu/bin/qemu-system-gnuarmeclipse -nographic -board NUCLEO_F303RE -mcu STM32F303RE -image /home/wangfeng/DICE-DMA-Emulation/DICE-Evaluation/ARM/Fuzzing/Firmware/Binaries/Modbus.elf -pm-stage 3 -aflFile @@

afl-fuzz 2.06b by <[email protected]>
[+] You have 12 CPU cores and 1 runnable tasks (utilization: 8%).
[+] Try parallel jobs - see docs/parallel_fuzzing.txt.
[*] Checking core_pattern...
[*] Checking CPU scaling governor...
[*] Setting up output directories...
[+] Output directory exists but deemed OK to reuse.
[*] Deleting old session data...
[+] Output dir cleanup successful.
[*] Scanning '/home/wangfeng/FuzzBase/Modbus/1.0/inputs'...
[+] No auto-generated dictionary tokens to reuse.
[*] Creating hard links for all input files...
[*] Validating target binary...
[*] Attempting dry run with 'id:000000,orig:input.data'...

[-] Oops, the program crashed with one of the test cases provided. There are
    several possible explanations:

    - The test case causes known crashes under normal working conditions. If
      so, please remove it. The fuzzer should be seeded with interesting
      inputs - but not ones that cause an outright crash.

    - Least likely, there is a horrible bug in the fuzzer. If other options
      fail, poke <[email protected]> for troubleshooting tips.

[-] PROGRAM ABORT : Test case 'id:000000,orig:input.data' results in a crash
         Location : perform_dry_run(), afl-fuzz.c:2781