intel / intel/tsffs

Unable to Resume Fuzzing Session After Reproducing Crash via tsffs.iface.fuzz.repro

Open
#276 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
331
Forks
26
Avg merge
1d 5h
Merged PRs (30d)
2

Description

We are fuzzing an EDK2 application built under simicsOpenBoardPkg using TSFFS with Simics.
The fuzzing configuration includes:

`@tsffs.exceptions = [3,6,14]`

Exceptions 3, 6, and 14 are treated as solutions. When any of these exceptions occur, the corresponding input seed is saved in the solution directory.

During an active fuzzing session:
A crash was detected.
The crashing input seed was saved in the solution directory.
The fuzzing session was interrupted using Ctrl + C.

Following the official reproduction guide:
https://intel.github.io/tsffs/tutorials/edk2-uefi/reproducing-runs.html

I reproduced the crash using:
`simics> @tsffs.iface.fuzz.repro("%simics%/corpus/4385dc33f608888d")`

The simulation runs once with the specified input. After execution, Simics allows debugging using:
`simics> reverse-to start`

However, as documented:
Fuzzing **cannot be resumed after entering repro mode** due to inconsistencies with the simulated system clock.

My questions:
Is there any supported way to:
> Reproduce a crash from a solution seed
> Debug it
> And then continue fuzzing from the previous session state?

If resuming is not possible by design, what is the recommended workflow for:
> Efficient crash reproduction
> Deep debugging
> And continuing fuzzing afterward?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.