I cant get the result.bb

[SpYHero33]

I complied target program with afl-clang-fast in llvm_mode_crash and llvm_mode,but I cant get the result.bb in all dir .
the system OS I used is kali linux 2022 on which llvm-13 and clang-13.

[bladchan]

Same question, but for me only happen in llvm_mode.
I reviewed the code:

SLIME/SLIME/llvm_mode/afl-llvm-pass.so.cc

Lines 451 to 467 in e70d715

	/* Print the queue, added by LH. */
	FILE * bb_file = NULL;
	char * bb_file_ptr = getenv("SLIME_BB_NAME");
	if(bb_file_ptr == NULL){
	bb_file = fopen("./result.bb", "w");
	} else if ((bb_file = fopen(bb_file_ptr, "w")) == NULL){
	WARNF("Cannot access document file.");
	}
	b = bb_queue;
	uint32_t afl_global_id = (afl_global_bb_id > afl_global_edge_id) ? afl_global_bb_id : afl_global_edge_id;
	#ifdef __x86_64__
	fprintf(bb_file, "%u\n", ((afl_global_id>>3)+1)<<3);
	#else
	fprintf(bb_file, "%u\n", ((afl_global_id>>2)+1)<<2);
	#endif /* ^__x86_64__ */

It seems that the pass will definitely generate ./result.bb. 🤔
According to #1, it seems that fuzzer use the results.bb under the directory of the target program compiled by llvm_mode/afl-clang-fast*. So, I have no idea about it without reviewing all codes.

[bladchan]

There is no need to set AFL_LLVM_DOCUMENT_IDS environment variable when fuzzing. The AFL_LLVM_DOCUMENT_IDS only work when using compiler under llvm_mode_crash. The import option is -H bb_file (not result.bb!!). The bb_file's name looks like "target_name.bb" according following codes:

SLIME/SLIME/llvm_mode/afl-clang-fast.c

Lines 348 to 361 in e70d715

	for(int i_lh = 0;i_lh < argc;i_lh++){
	if(argv[i_lh]){
	if((strcmp(argv[i_lh],"-o")==0)){
	i_lh++;
	int cc_end = strlen(argv[i_lh]);
	slime_bb_str = (char *)malloc(sizeof(char) * (cc_end + 3));
	strcpy(slime_bb_str, argv[i_lh]);
	strcat(slime_bb_str,".bb");
	break;
	}
	}else{
	break;
	}
	}

For example with pdftotext (xpdf-4.04):
Here're my cmd:

$ cd xpdf4.04
$ mkdir build build_crash
$ # Compiled by compiler under llvm_mode. BTW, there is no need to set `AFL_LLVM_DOCUMENT_IDS`.
$ cd build
$ CC=~/SLIME/SLIME/llvm_mode/afl-clang-fast CXX=~/SLIME/SLIME/llvm_mode/afl-clang-fast++ cmake ..
$ make
$ find ./ -name "pdftotext.bb"
./xpdf/pdftotext.bb  # <== You should use it with '-H' option
$ cd .. & cd build_crash
$ CC=~/SLIME/SLIME/llvm_mode_crash/afl-clang-fast CXX=~/SLIME/SLIME/llvm_mode_crash/afl-clang-fast++ cmake ..
$ export AFL_LLVM_DOCUMENT_IDS="absolute_path_to_result.bb_file"
$ make
$ cd ..
$ # All ready to fuzz~
$ ~/SLIME/SLIME/afl-fuzz -i ~/SLIME/SLIME/testcases/others/pdf/ -o out1 -H ./build/xpdf/pdftotext.bb -t 600+ -m none -A ./build_crash/xpdf/pdftotext ./build/xpdf/pdftotext @@ /dev/null

[SpYHero33]

thank you for your answer.I retry it just now and also cant find '.bb' file. Maybe there is something wrong when I complie LLVM and afl-clang-fast.

orz @bladchan