> As mentioned earlier depending on applet I get 1 to 3 paths. For example
> for gunzip/gzip applet I get three path only. I am not using QEMU mode (as
> others who were fuzzing busybox were).
> my command:
> *afl-fuzz -i corpus/ -o outdir/ ./busybox gzip @@*
With “busybox gzip @@” as the command line, you’ll test compression, not
decompression. I’d expect it to be relatively difficult to hit interesting
cases this way, as the input data is more or less treated as opaque and
will not be parsed.
Decompression (gzip -d or gunzip) seems more likely to evoke interesting
Also, what’s in your corpus directory?
Read more here: Source link