Skip to content

Commit 1a27525

Browse files
vanhauser-thcvanhauser-thc
committed
fix
1 parent 48b9e78 commit 1a27525

File tree

8 files changed

+320
-0
lines changed

8 files changed

+320
-0
lines changed

‎fuzzers/aflrustrust/builder.Dockerfile

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Copyright 2020 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
ARG parent_image
16+
FROM $parent_image
17+
18+
# Install dependencies.
19+
RUN apt-get update && \
20+
apt-get install -y build-essential libstdc++5 libtool-bin automake flex \
21+
bison libglib2.0-dev python3-setuptools unzip python3-dev joe curl \
22+
cmake git apt-utils apt-transport-https ca-certificates libdbus-1-dev
23+
24+
# Uninstall old Rust & Install the latest one.
25+
RUN if which rustup; then rustup self uninstall -y; fi && \
26+
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > /rustup.sh && \
27+
sh /rustup.sh --default-toolchain nightly-2023-09-21 -y && \
28+
rm /rustup.sh
29+
30+
# Download afl++.
31+
RUN git clone https://github.com/AFLplusplus/AFLplusplus /afl
32+
33+
# Checkout a current commit
34+
RUN cd /afl && git checkout 8cdc48f73a17ddd557897f2098937a8ba3bfe184
35+
36+
# Build without Python support as we don't need it.
37+
# Set AFL_NO_X86 to skip flaky tests.
38+
RUN cd /afl && \
39+
unset CFLAGS CXXFLAGS && \
40+
export CC=clang AFL_NO_X86=1 && \
41+
PYTHON_INCLUDE=/ make && \
42+
make install && \
43+
cp utils/aflpp_driver/libAFLDriver.a /
44+
45+
# Download libafl.
46+
RUN git clone https://github.com/AFLplusplus/LibAFL /libafl
47+
48+
# Checkout a current commit
49+
RUN cd /libafl && git checkout c103444396697af102dce2b936a00e93017057ba
50+
51+
# Compile libafl.
52+
RUN cd /libafl && \
53+
unset CFLAGS CXXFLAGS && \
54+
cd ./fuzzers/fuzzbench_forkserver && \
55+
PATH="/root/.cargo/bin/:$PATH" cargo build --profile release-fuzzbench
56+

‎fuzzers/aflrustrust/description.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# aflplusplus
2+
3+
AFL++ fuzzer instance that has the following config active for all benchmarks:
4+
- PCGUARD instrumentation
5+
- cmplog feature
6+
- "fast" power schedule
7+
- persistent mode + shared memory test cases
8+
9+
Repository: [https://github.com/AFLplusplus/AFLplusplus/](https://github.com/AFLplusplus/AFLplusplus/)
10+
11+
[builder.Dockerfile](builder.Dockerfile)
12+
[fuzzer.py](fuzzer.py)
13+
[runner.Dockerfile](runner.Dockerfile)

‎fuzzers/aflrustrust/fuzzer.py

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# Copyright 2020 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
"""Integration code for a LibAFL fuzzer with an AFL++ forkserver."""
15+
16+
import os
17+
import shutil
18+
import subprocess
19+
20+
from fuzzers import utils
21+
from fuzzers.aflplusplus import fuzzer as aflplusplus_fuzzer
22+
from fuzzers.libafl import fuzzer as libafl_fuzzer
23+
24+
25+
def build():
26+
"""Build benchmark."""
27+
# Build the target with AFL++
28+
aflplusplus_fuzzer.build('tracepc', 'cmplog', 'dict2file')
29+
30+
# Copy to fuzzer to OUT
31+
build_directory = os.environ['OUT']
32+
fuzzer = '/libafl/fuzzers/fuzzbench_forkserver/' \
33+
'target/release-fuzzbench/fuzzbench_forkserver'
34+
shutil.copy(fuzzer, build_directory)
35+
36+
37+
def fuzz(input_corpus, output_corpus, target_binary):
38+
"""Run fuzzer."""
39+
# Calculate CmpLog binary path from the instrumented target binary.
40+
target_binary_directory = os.path.dirname(target_binary)
41+
cmplog_target_binary_directory = \
42+
aflplusplus_fuzzer.get_cmplog_build_directory(target_binary_directory)
43+
target_binary_name = os.path.basename(target_binary)
44+
cmplog_target_binary = os.path.join(cmplog_target_binary_directory,
45+
target_binary_name)
46+
47+
# Setup env vars
48+
libafl_fuzzer.prepare_fuzz_environment(input_corpus)
49+
50+
# Merge dictionaries
51+
dictionary_path = utils.get_dictionary_path(target_binary)
52+
if os.path.exists('./afl++.dict'):
53+
if dictionary_path:
54+
with open('./afl++.dict', encoding='utf-8') as dictfile:
55+
autodict = dictfile.read()
56+
with open(dictionary_path, 'a', encoding='utf-8') as dictfile:
57+
dictfile.write(autodict)
58+
else:
59+
dictionary_path = './afl++.dict'
60+
61+
# Run the fuzzer
62+
command = ['./fuzzbench_forkserver', '-c', cmplog_target_binary]
63+
if dictionary_path:
64+
command += (['-x', dictionary_path])
65+
command += (['-o', output_corpus, '-i', input_corpus, target_binary])
66+
print(command)
67+
subprocess.check_call(command)

‎fuzzers/aflrustrust/runner.Dockerfile

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Copyright 2020 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
FROM gcr.io/fuzzbench/base-image
16+
17+
# This makes interactive docker runs painless:
18+
ENV LD_LIBRARY_PATH="$LD_LIBRARY_PATH:/out"
19+
#ENV AFL_MAP_SIZE=2621440
20+
ENV PATH="$PATH:/out"
21+
ENV AFL_SKIP_CPUFREQ=1
22+
ENV AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
23+
ENV AFL_TESTCACHE_SIZE=2

‎fuzzers/libafl/builder.Dockerfile

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Copyright 2020 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
ARG parent_image
16+
FROM $parent_image
17+
18+
# Uninstall old Rust & Install the latest one.
19+
RUN if which rustup; then rustup self uninstall -y; fi && \
20+
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > /rustup.sh && \
21+
sh /rustup.sh --default-toolchain nightly-2023-09-21 -y && \
22+
rm /rustup.sh
23+
24+
# Install dependencies.
25+
RUN apt-get update && \
26+
apt-get remove -y llvm-10 && \
27+
apt-get install -y \
28+
build-essential \
29+
llvm-11 \
30+
clang-12 \
31+
cargo && \
32+
apt-get install -y wget libstdc++5 libtool-bin automake flex bison \
33+
libglib2.0-dev libpixman-1-dev python3-setuptools unzip \
34+
apt-utils apt-transport-https ca-certificates joe curl && \
35+
PATH="/root/.cargo/bin/:$PATH" cargo install cargo-make
36+
37+
# Download libafl.
38+
RUN git clone https://github.com/AFLplusplus/LibAFL /libafl
39+
40+
# Checkout a current commit
41+
RUN cd /libafl && git pull && git checkout b20fda2a4ada2a6462718dc661e139e6c7a29807 || true
42+
# Note that due a nightly bug it is currently fixed to a known version on top!
43+
44+
# Compile libafl.
45+
RUN cd /libafl && \
46+
unset CFLAGS CXXFLAGS && \
47+
export LIBAFL_EDGES_MAP_SIZE=2621440 && \
48+
cd ./fuzzers/fuzzbench && \
49+
PATH="/root/.cargo/bin/:$PATH" cargo build --profile release-fuzzbench --features no_link_main
50+
51+
# Auxiliary weak references.
52+
RUN cd /libafl/fuzzers/fuzzbench && \
53+
clang -c stub_rt.c && \
54+
ar r /stub_rt.a stub_rt.o

‎fuzzers/libafl/description.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# libafl
2+
3+
libafl fuzzer instance
4+
- cmplog feature
5+
- persistent mode
6+
7+
Repository: [https://github.com/AFLplusplus/libafl/](https://github.com/AFLplusplus/libafl/)
8+
9+
[builder.Dockerfile](builder.Dockerfile)
10+
[fuzzer.py](fuzzer.py)
11+
[runner.Dockerfile](runner.Dockerfile)

‎fuzzers/libafl/fuzzer.py

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# Copyright 2020 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
"""Integration code for a LibAFL-based fuzzer."""
16+
17+
import os
18+
import subprocess
19+
20+
from fuzzers import utils
21+
22+
23+
def prepare_fuzz_environment(input_corpus):
24+
"""Prepare to fuzz with a LibAFL-based fuzzer."""
25+
os.environ['ASAN_OPTIONS'] = 'abort_on_error=1:detect_leaks=0:'\
26+
'malloc_context_size=0:symbolize=0:'\
27+
'allocator_may_return_null=1:'\
28+
'detect_odr_violation=0:handle_segv=0:'\
29+
'handle_sigbus=0:handle_abort=0:'\
30+
'handle_sigfpe=0:handle_sigill=0'
31+
os.environ['UBSAN_OPTIONS'] = 'abort_on_error=1:'\
32+
'allocator_release_to_os_interval_ms=500:'\
33+
'handle_abort=0:handle_segv=0:'\
34+
'handle_sigbus=0:handle_sigfpe=0:'\
35+
'handle_sigill=0:print_stacktrace=0:'\
36+
'symbolize=0:symbolize_inline_frames=0'
37+
# Create at least one non-empty seed to start.
38+
utils.create_seed_file_for_empty_corpus(input_corpus)
39+
40+
41+
def build(): # pylint: disable=too-many-branches,too-many-statements
42+
"""Build benchmark."""
43+
os.environ[
44+
'CC'] = '/libafl/fuzzers/fuzzbench/target/release-fuzzbench/libafl_cc'
45+
os.environ[
46+
'CXX'] = '/libafl/fuzzers/fuzzbench/target/release-fuzzbench/libafl_cxx'
47+
48+
os.environ['ASAN_OPTIONS'] = 'abort_on_error=0:allocator_may_return_null=1'
49+
os.environ['UBSAN_OPTIONS'] = 'abort_on_error=0'
50+
51+
cflags = ['--libafl']
52+
utils.append_flags('CFLAGS', cflags)
53+
utils.append_flags('CXXFLAGS', cflags)
54+
utils.append_flags('LDFLAGS', cflags)
55+
56+
os.environ['FUZZER_LIB'] = '/stub_rt.a'
57+
utils.build_benchmark()
58+
59+
60+
def fuzz(input_corpus, output_corpus, target_binary):
61+
"""Run fuzzer."""
62+
prepare_fuzz_environment(input_corpus)
63+
dictionary_path = utils.get_dictionary_path(target_binary)
64+
command = [target_binary]
65+
if dictionary_path:
66+
command += (['-x', dictionary_path])
67+
command += (['-o', output_corpus, '-i', input_corpus])
68+
fuzzer_env = os.environ.copy()
69+
fuzzer_env['LD_PRELOAD'] = '/usr/lib/x86_64-linux-gnu/libjemalloc.so.2'
70+
print(command)
71+
subprocess.check_call(command, cwd=os.environ['OUT'], env=fuzzer_env)

‎fuzzers/libafl/runner.Dockerfile

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Copyright 2020 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
FROM gcr.io/fuzzbench/base-image
16+
17+
RUN apt install libjemalloc2
18+
19+
# This makes interactive docker runs painless:
20+
ENV LD_LIBRARY_PATH="$LD_LIBRARY_PATH:/out"
21+
#ENV AFL_MAP_SIZE=2621440
22+
ENV PATH="$PATH:/out"
23+
ENV AFL_SKIP_CPUFREQ=1
24+
ENV AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
25+
ENV AFL_TESTCACHE_SIZE=2

0 commit comments

Comments
 (0)