trailofbits/deepstate

Random Fuzzing outputs generated with '?'

akhikolla opened this issue · 2 comments

I am running Runlen from examples in deepstate using Eclipser
(mkdir temp & deepstate-eclipser ./Runlen -o temp --timeout 30) and I get the following randomized inputs with '?' following them and it shows nodes(Left/Right)
err1
err2
err3

Can someone please explain me what does these inputs generated with '?' mean and how are they passed on to the code and how can they find crashes/other vulnerabilities in code?
How can I know which input aborts the code because I don't see any error message after code aborts or reason why it failed?

Hi @akhikolla

DeepState can work using third-party tools to get new inputs to test. In this case, DeepState is using Eclipser and showing it's internal output. I believe it is showing the individual input bytes that the tool guessed (according to collected "linear" constrains), but perhaps you could ask their authors about clarification on the meaning of the ?.

Yeah, I think it's just unprintable bytes