Covered Blocks field is always 0 about fluffi HOT 5 CLOSED

Hi vinamrabhatia,

Can you check that you have added the binary as an in-scope module? Only then will it attempt to gather the coverage for that module

If that is the case, can you maybe post a screenshot of your settings? Most importantly: Which runner type are you currently using?

Thanks

from fluffi.

Sure! PFA.
Screenshot.pdf

from fluffi.

Awesome, thanks!

So everything there seems right, and from what i see the running actually works, so it definitely is some kind of issue with dynamorio. Sorry to ask for even more information, but could you maybe send us the log?

Otherwise, how about a short telco where we can take a look at it together?

from fluffi.

Hi @amb42,

I have discussed this with @vinamrabhatia today. Our observation is that, for this test binary, the number of covered blocks stayed 0 for several hours even though a crashing input was found in the first few minutes. Eventually, the number of covered blocks would go up as expected, as shown in his screenshot.

We currently have a working hypotheses: perhaps there was a delay in updating the number of covered blocks in the DB. Maybe there is some buffering going on and the buffer content only gets pushed to the DB when either:

(a) some amount of time has passed / some number of events have happened or

(b) the buffer has been filled.

Since this test binary is very small, (b) may never become true for it. This leaves only possibility (a), which could explain our observation.

@vinamrabhatia will soon try to fuzz some bigger binaries to test our hypothesis. But meanwhile if you have some clue for us, that would be wonderful too! Thanks!

from fluffi.

Hi,

I believe that the main reason we were getting 0 covered blocks was because we were not using the target modules properly. I tried running a few fuzz jobs after giving the target module in the required manner, and I can observe the block coverages now. I think the issue can be closed.

from fluffi.