I am using TritonDSE to test the libjpeg program from fuzzbench. It warns "Instruction not mapped: 0x281a0". Why is this happen & how can I debug this? Thanks!
The script:
import logging
from tritondse import CompositeData
from tritondse import Config
from tritondse import CoverageStrategy
from tritondse import ProcessState
from tritondse import CleLoader as Program
#from tritondse import Program as Program
from tritondse import Seed
from tritondse import SeedFormat
from tritondse import SymbolicExecutor
from tritondse import SymbolicExplorator, ExplorationStatus
from time import monotonic as _time
import random
random.seed(0)
prog_path = f'~/fuzzbench_progs/libjpeg/libjpeg-turbo.3.0.x/build/fuzz/libjpeg_turbo_fuzzer'
argv = [prog_path, '@@']
prog = Program(prog_path)
coverage_strategy = CoverageStrategy.EDGE
seed_buffer = b'A' * 1000
config = Config(coverage_strategy=coverage_strategy,
pipe_stdout=True,
seed_format=SeedFormat.COMPOSITE,
skip_unsupported_import=True,
skip_unsupported_instruction=True,
exploration_timeout=3600 * 16)
# seed queue collection & monitering
logging.basicConfig(level=logging.INFO)
st = _time()
def pre_exec_hook(se: SymbolicExecutor, state: ProcessState):
logging.info(f"[PRE-EXEC] Processing seed: {_time() - st}")
def post_exec_hook(se: SymbolicExecutor, state: ProcessState):
logging.info(f"[POST-EXEC] PCs:")
pcs = state.get_path_constraints()
for pc in pcs:
if pc.isMultipleBranches():
c = pc.getBranchConstraints()[1]['constraint']
print(c)
seed = Seed(CompositeData(argv=[arg.encode('ascii') for arg in argv],
files={"stdin": b"",
"@@": seed_buffer}))
dse = SymbolicExplorator(config, prog)
dse.add_input_seed(seed)
dse.callback_manager.register_pre_execution_callback(pre_exec_hook)
dse.callback_manager.register_post_execution_callback(post_exec_hook)
dse.explore()
I am using TritonDSE to test the libjpeg program from fuzzbench. It warns "Instruction not mapped: 0x281a0". Why is this happen & how can I debug this? Thanks!
The script: