Windows Support

[novafacing]

It seems like there are some issues with the fuzzer's support of Windows targets. In particular, some of the Win32 API usage like

fuzzilli/Sources/libreprl/libreprl-windows.c

Line 195 in f31876f

if (CreatePipe(&output[PI_READ], &output[PI_WRITE], &sa, 0))

is incorrect (CreatePipe returns 0 on failure, not on success). I also notice there isn't anywhere the data channel mappings are actually passed into the target, either via environment variable or CLI args, so I'm curious what the expected way for the target to discover the memory mapping is.

I'm wondering A) whether anyone has successfully used fuzzilli to target a JS engine running on Windows and B) whether there is a plan to support it for this use case? I harnessed a JS engine I'm interested in fuzzing that does run on Windows, but I've run into these issues which are blocking me from moving forward.

[CSharperMantle]

Same problem here.

I am trying to run Fuzzilli on Windows targeting SpiderMonkey. I've managed to get things to compile in #524, but as @novafacing has mentioned, there are still plenty of problems:

• CreatePipe usage is incorrect,
• Only the control channel is forwarded to the child as stdin/stdout. The data channel is completely missing.

The first one is trivial to fix. The second one is also not impossible: No child-to-main data flow is used (confirm by searching data_out->fd in POSIX version), and we can use a named mapping to share main-to-child data flow. But that requires changes on the target side as well. AFAIK, SpiderMonkey doesn't have such support as of this writing.