googleprojectzero / googleprojectzero/Jackalope
Crash Count
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.4k
- Forks
- 157
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
I was comparing the performance between Jackalope and WinAFL with DynamoRIO and found when fuzzing the same target with the same corpus and offset that Jackalope found around 30 crashes while WinAFL only found 7.
Some of the crashes from Jackalope had access addresses that are close like:
access_violation_xxxxx76A_xxxxx861_1
access_violation_xxxxx76A_xxxxx873_1
OR
access_violation_xxxxx76A_xxxxx3DE_1
access_violation_xxxxx76A_xxxxx3C0_1
Just wondering why Jackalope is finding 4x more crashes under the same conditions?
Is this a sensitivity thing where maybe its picking up the same crash but labeling it differently?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the comparison with Jackalope and WinAFL using the same target, corpus, and offset. Compare the reported access addresses to determine whether nearby addresses represent the same underlying crash or distinct findings, then establish what explains the difference in crash counts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- security, testing-qa
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100