Busybox no coverage

On Fri, Aug 27, 2021 at 03:36:31AM -0700, Sony Bavaria wrote:

[…]

> As mentioned earlier depending on applet I get 1 to 3 paths. For example
> for gunzip/gzip applet I get three path only. I am not using QEMU mode (as
> others who were fuzzing busybox were).

[…]

> my command:

>

> *afl-fuzz -i corpus/ -o outdir/ ./busybox gzip @@*

With “busybox gzip @@” as the command line, you’ll test compression, not
decompression. I’d expect it to be relatively difficult to hit interesting
cases this way, as the input data is more or less treated as opaque and
will not be parsed.

Decompression (gzip -d or gunzip) seems more likely to evoke interesting
behavior.

Also, what’s in your corpus directory?

Best regards.

Read more here: Source link