Running AFL-Fuzzer buffer overflow

Question

I am trying to learn about AFL-fuzzer and I have some questions:

1. I saw a video shows that if for instance there are two inputs in the code, so in the test case each line is for each input. Is that correct? Since I want put a full message (for example HTTP request) into one variable, so how do I do it?
2. I don't understand when to put @@.

For example I am trying to fuzz this code:

void Check_buffer(char* data) 
{
    char buffer[5];
    strcpy(buffer, data);
}

int main(int argc, char* argv[])
{
    char tmp_data = argv[1];
    Check_buffer(argv[1]);
    return 0;
}

I have created the in and out folders. In the in folder I have created a txt file with this content: "AAA".

The command line I have executed is:afl-clang -fno-stack-protector -z execstack 4.c -o vul4

Then I run:afl-fuzz -m none -i in/ -o out/ ./vul4 @@

I get the following error:perform_dry_run(), afl-fuzz.c:2852

If I run the command like this:afl-fuzz -m none -i in/ -o out/ ./vul4 AA it runs good but it does not find any new path and does not find crashes.

As well as, I am trying to understand the concepts of this. If I want to inject code in specific location, how do I do it?

Answer 1

1. You are trying to get data from command line arguments, but the AFL does not work with argv[] (unless your program reads files like ./prog file.txt ). Instead use something like

   #define INPUTSIZE 100
   char input[INPUTSIZE] = {0};
   read (STDIN_FILENO, input, INPUTSIZE)
   

   If you are still interested in getting data from argv[], you can use the experimental method from the AFL repository afl argv experimental

2. @@ is used when your program accepts a file via the command line this means that the fuzzer will take the file, mutate it, and substitute it into the program instead @@

p.s.

#include <stdio.h>
#include <unistd.h>


#define INPUTSIZE 100
void Check_buffer(char* data)
{
    char buffer[5];
    strcpy(buffer, data);
}

int main(int argc, char* argv[])
{

char input[INPUTSIZE] = {0};
read (STDIN_FILENO, input, INPUTSIZE);

    Check_buffer(input);
    return 0;
}

AFL result image