Binary fuzzing with AFL++

Question

I want to do some experiments with afl++ / binary fuzzing. I installed it and run build_qemu_support.sh, but there is still an error message, if i try to fuzz a binary.

Command:

afl-fuzz -Q -i /usr/tests/ -o /usr/tests/output -- ./bin/apt -d @@

Output:

[+] Loaded environment variable AFL_SKIP_CPUFREQ with value 1  
[+] Loaded environment variable AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES with value 1 afl-fuzz++3.13a based on afl by Michal Zalewski and a large online community  
[+] afl++ is maintained by Marc "van Hauser" Heuse, Heiko "hexcoder" Eißfeldt, Andrea Fioraldi and Dominik Maier  
[+] afl++ is open source, get it at https://github.com/AFLplusplus/AFLplusplus  
[+] NOTE: This is v3.x which changes defaults and behaviours - see README.md  
[+] No -M/-S set, autoconfiguring for "-S default"  
[*] Getting to work...  
[+] Using exponential power schedule (FAST)  
[+] Enabled testcache with 50 MB  
[*] Checking core_pattern...  
[+] You have 4 CPU cores and 1 runnable tasks (utilization: 25%).  
[+] Try parallel jobs - see /usr/local/share/doc/afl/parallel_fuzzing.md.  
[*] Setting up output directories...  
[+] Output directory exists but deemed OK to reuse.  
[*] Deleting old session data...  
[+] Output dir cleanup successful.  
[*] Checking CPU core loadout...  
[+] Found a free CPU core, try binding to #0.  
[*] Scanning '/usr/tests/'...  
[*] Scanning '/usr/tests//output'...  
[*] Scanning '/usr/tests//output/default'...  
[*] Scanning '/usr/tests//output/default/crashes'...  
[*] Scanning '/usr/tests//output/default/hangs'...  
[*] Scanning '/usr/tests//output/default/queue'...  
[+] Loaded a total of 4 seeds.  
[*] Creating hard links for all input files...  
[*] Validating target binary...  
[-] PROGRAM ABORT : Program './bin/apt' not found or not executable  
         Location : check_binary(), src/afl-fuzz-init.c:2579 

What is wrong?

Answer 1

The error says ./bin/apt can't be found. When you want to fuzz apt use ./usr/bin/apt instead.

Answer 2

On my machine, apt is at

$ whereis apt
apt: /usr/bin/apt /usr/lib/apt /etc/apt /usr/share/man/man8/apt.8.gz

So I use command

afl-fuzz -Q -i /usr/tests/ -o /usr/tests/output -- /usr/bin/apt -d @@