Skip to content

Commit 26b3259

Browse files
authored
Optimize GDB prompt in CrashAnalyzer (#1141)
This pr is used to optimize the gdb prompt. The language is more refined and unified, and the structure is clearer. In particular, In GDB, do not use shell-style redirection like: ```run < {AFTIFACT_PATH}``` This won't work because GDB is not a shell. I have seen too many these cases, LLM model like GPT-4o also makes this mistake. Also, avoid using: ```run -- {AFTIFACT_PATH}``` unless the fuzz driver explicitly expects that pattern. Relevant case: https://llm-exp.oss-fuzz.com/Result-reports/ofg-pr/2025-07-01-1133-pamusuo-comparison/sample/output-igraph-igraph_sparsemat_arpack_rssolve/03.html#:~:text=54%3A58%20%5BTrial%20ID%3A%2003%5D%20INFO%20%5Bbase_agent.-,chat_llm,-%3A96%5D%3A Furthermore, while ```run {AFTIFACT_PATH}``` seems correct, it may execute the testcase multiple times, depending on how libFuzzer is configured. ✅ Instead, always use: ```run -runs=1 {AFTIFACT_PATH}``` to ensure the fuzz driver runs exactly once with the provided testcase — ideal for reproducible crash debugging.
1 parent d8c0fcb commit 26b3259

File tree

1 file changed

+38
-33
lines changed

1 file changed

+38
-33
lines changed

prompts/tool/gdb_tool.txt

Lines changed: 38 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,47 @@
11
<tool>
22
**GDB tool Guide**
3-
You can leverage GDB by iteractively sending me a GDB command, and I will provide you with the output of the command. The path of fuzz driver binary is '/out/{TARGET_NAME}'. The testcase that triggers runtime crash is stored at '{AFTIFACT_PATH}'.
3+
You can issue GDB commands one at a time and I’ll return each command’s output. The fuzz driver binary is located at '/out/{TARGET_NAME}'. The crash-triggering testcase is located at '{AFTIFACT_PATH}'.
44

55
<interaction protocols>
6-
1. I have executed 'gdb /out/{TARGET_NAME}'. You are now in GDB session, NOT in shell session. DO NOT run 'gdb /out/{TARGET_NAME}' again! DO NOT run shell commands!
7-
2. Strictly ONE GDB command at a time!
8-
3. Each message you send should first explain the reason why you want to run the command wrapped by <reason></reason>, then provide the command to run wrapped in <gdb></gdb> in this format:
9-
<reason>
10-
Reasons here.
11-
</reason>
12-
<gdb>
13-
One gdb command here.
14-
</gdb>
15-
4. Each reponse I send will repeat the command you sent wrapped in <gdb command></gdb command> for you to double-check, followed by the command standard output wrapped in <gdb output></gdb output> and stderr wrapped in <stderr></stderr> in this format:
16-
<gdb command>
17-
The command I executed, copied from the command you sent.
18-
</gdb command>
19-
<gdb output>
20-
The standard output of the command.
21-
</gdb output>
22-
<stderr>
23-
The standard error of the command.
24-
</stderr>
25-
5. The final goal is to answer questions about runtime crash, executed fuzz driver and project under test: a) ‘False’(if the crash is caused by bug in fuzz driver) or ‘True'(if the crash is caused by bug in project)? b) If the crash is caused by bug in fuzz driver, provide analyses, and are there any suggestions for modifying the fuzz driver? c) If the crash is caused by bug in project, provide analyses, and are there any suggestions for patching the project?
26-
6. If you have a conclusion on above questions, output the conclusion wrapped by <conclusion></conclusion> followed by the analysis and suggestion wrapped in <analysis and suggestion></analysis and suggestion>:
27-
<conclusion>
28-
‘False’ or ‘True’
29-
</conclusion>
30-
<analysis and suggestion>
31-
Analysis and suggestion
32-
</analysis and suggestion>
6+
1. The binary is already loaded with 'gdb /out/{TARGET_NAME}'. You are **inside the GDB session**, not a shell.
7+
2. **One** GDB command per message.
8+
3. Each message you send must follow the format below:
9+
<reason>
10+
A short explanation of why you are issuing this GDB command.
11+
</reason>
12+
<gdb>
13+
A single GDB command to execute.
14+
</gdb>
15+
4. For every response I send, the format will be:
16+
<gdb command>
17+
The exact command you issued.
18+
</gdb command>
19+
<gdb output>
20+
Standard output from the GDB command.
21+
</gdb output>
22+
<stderr>
23+
Standard error (if any).
24+
</stderr>
25+
5. The ultimate goal is to determine the root cause of the crash based on the fuzz driver and project under test:
26+
a) Is the crash caused by a **bug in the project**? → Output **‘True’**
27+
b) Or is it caused by a **bug in the fuzz driver**? → Output **‘False’**
28+
c) In either case, provide a brief analysis and suggestions for fixing the issue.
29+
6. Once you reach a conclusion, reply using this format:
30+
<conclusion>
31+
True (if crash is caused by the project)
32+
or
33+
False (if crash is caused by the fuzz driver)
34+
</conclusion>
35+
<analysis and suggestion>
36+
• 1–2 lines summarizing the root cause.
37+
• Practical suggestions to fix the fuzz driver or patch the project.
38+
</analysis and suggestion>
3339
</interaction protocols>
3440

3541
<general rules>
36-
1. DO NOT wrap code snippets with ```, using the XML-style tags above will suffice.
37-
2. DO NOT Compile or Run Code!
38-
3. Strictly ONE GDB command at a time!
39-
4. DO NOT run 'gdb /out/{TARGET_NAME}' again!
40-
5. DO NOT run shell commands!
42+
1. Do **NOT** run `gdb /out/{TARGET_NAME}` again or issue any shell commands.
43+
2. Do **NOT** compile or run code outside of GDB.
44+
3. Do **NOT** use `run < {AFTIFACT_PATH}` or `run -- {AFTIFACT_PATH}`. Instead, use `run -runs=1 {AFTIFACT_PATH}` to execute the crash input exactly once.
45+
4. No Markdown code fences (```), only the XML tags defined above.
4146
</general rules>
4247
</tool>

0 commit comments

Comments
 (0)