Skip to content

Commit db011eb

Browse files
DanBlackwellDanBlackwell
committed
Added dgfuzz_dc6e84_rand_sched to test random scheduler with dataflow guidance
1 parent a051ad7 commit db011eb

File tree

5 files changed

+281
-0
lines changed

5 files changed

+281
-0
lines changed

‎fuzzers/dgfuzz_dc6e84_rand_sched/builder.Dockerfile

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# Copyright 2020 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
ARG parent_image
16+
FROM $parent_image
17+
18+
# Uninstall old Rust & Install the latest one.
19+
RUN if which rustup; then rustup self uninstall -y; fi && \
20+
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > /rustup.sh && \
21+
sh /rustup.sh -y && \
22+
/root/.cargo/bin/rustup toolchain install nightly && \
23+
rm /rustup.sh
24+
25+
RUN apt-get update && \
26+
apt-get install -y \
27+
build-essential \
28+
cargo && \
29+
apt-get install -y wget libstdc++5 libtool-bin automake flex bison \
30+
libglib2.0-dev libpixman-1-dev python3-setuptools unzip \
31+
apt-utils apt-transport-https ca-certificates joe curl && \
32+
PATH="/root/.cargo/bin/:$PATH" cargo install cargo-make
33+
34+
35+
# Download DGFuzz.
36+
RUN git clone https://github.com/DanBlackwell/DGFuzz /dgfuzz
37+
38+
# Checkout a current commit
39+
RUN cd /dgfuzz && git pull && git checkout dc6e8444c6c28fe6bc1af14b7cef01c575419288 || true
40+
41+
# apply a patch (local testing only)
42+
COPY ./patch /dgfuzz/patch
43+
RUN cd /dgfuzz && git apply ./patch
44+
45+
# Compile DGFuzz.
46+
RUN cd /dgfuzz && \
47+
unset CFLAGS CXXFLAGS && \
48+
export CC=clang AFL_NO_X86 && \
49+
cd ./fuzzers/fuzzbench_dataflow_guided && \
50+
PATH="/root/.cargo/bin/:$PATH" cargo +nightly build --profile release-fuzzbench --features no_link_main
51+
52+
# Auxiliary weak references.
53+
RUN cd /dgfuzz/fuzzers/fuzzbench_dataflow_guided && \
54+
clang -c stub_rt.c && \
55+
ar r /stub_rt.a stub_rt.o
56+
57+
# install AFL++ dependencies
58+
RUN apt-get update && \
59+
apt-get install -y \
60+
build-essential \
61+
python3-dev \
62+
python3-setuptools \
63+
automake \
64+
cmake \
65+
git \
66+
flex \
67+
bison \
68+
libglib2.0-dev \
69+
libpixman-1-dev \
70+
cargo \
71+
libgtk-3-dev \
72+
# for QEMU mode
73+
ninja-build \
74+
gcc-$(gcc --version|head -n1|sed 's/\..*//'|sed 's/.* //')-plugin-dev \
75+
libstdc++-$(gcc --version|head -n1|sed 's/\..*//'|sed 's/.* //')-dev
76+
77+
# compile afl-clang-dgfuzz
78+
RUN cd /dgfuzz/fuzzers/fuzzbench_dataflow_guided/afl-cc && \
79+
unset CFLAGS CXXFLAGS && \
80+
export CC=clang AFL_NO_X86=1 && \
81+
PYTHON_INCLUDE=/ make && \
82+
cd utils/aflpp_driver/ && \
83+
PYTHON_INCLUDE=/ make && \
84+
cp ./libAFLDriver.a /
85+
86+

‎fuzzers/dgfuzz_dc6e84_rand_sched/description.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# PrescientFuzz
2+
3+
based on libafl fuzzer instance
4+
- persistent mode
5+
6+
[builder.Dockerfile](builder.Dockerfile)
7+
[fuzzer.py](fuzzer.py)
8+
[runner.Dockerfile](runner.Dockerfile)

‎fuzzers/dgfuzz_dc6e84_rand_sched/fuzzer.py

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
# Copyright 2020 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
"""Integration code for a LibAFL-based fuzzer."""
16+
17+
import os
18+
import sys
19+
import subprocess
20+
from pathlib import Path
21+
22+
from fuzzers import utils
23+
24+
25+
def prepare_fuzz_environment(input_corpus):
26+
"""Prepare to fuzz with a LibAFL-based fuzzer."""
27+
os.environ['ASAN_OPTIONS'] = 'abort_on_error=1:detect_leaks=0:'\
28+
'malloc_context_size=0:symbolize=0:'\
29+
'allocator_may_return_null=1:'\
30+
'detect_odr_violation=0:handle_segv=0:'\
31+
'handle_sigbus=0:handle_abort=0:'\
32+
'handle_sigfpe=0:handle_sigill=0'
33+
os.environ['UBSAN_OPTIONS'] = 'abort_on_error=1:'\
34+
'allocator_release_to_os_interval_ms=500:'\
35+
'handle_abort=0:handle_segv=0:'\
36+
'handle_sigbus=0:handle_sigfpe=0:'\
37+
'handle_sigill=0:print_stacktrace=0:'\
38+
'symbolize=0:symbolize_inline_frames=0'
39+
# Create at least one non-empty seed to start.
40+
utils.create_seed_file_for_empty_corpus(input_corpus)
41+
42+
43+
def build_dfsan():
44+
"""Build benchmark with dfsan."""
45+
new_env = os.environ.copy()
46+
new_env['CC'] = ('/dgfuzz/fuzzers/fuzzbench_dataflow_guided/afl-cc/'
47+
'afl-clang-dgfuzz')
48+
new_env['CXX'] = ('/dgfuzz/fuzzers/fuzzbench_dataflow_guided/afl-cc/'
49+
'afl-clang-dgfuzz++')
50+
51+
new_env['ASAN_OPTIONS'] = 'abort_on_error=0:allocator_may_return_null=1'
52+
new_env['UBSAN_OPTIONS'] = 'abort_on_error=0'
53+
new_env['AFL_QUIET'] = '1'
54+
55+
new_env['FUZZER_LIB'] = '/libAFLDriver.a'
56+
57+
build_directory = new_env['OUT']
58+
dfsan_build_directory = os.path.join(build_directory, 'dfsan')
59+
os.mkdir(dfsan_build_directory)
60+
new_env['OUT'] = dfsan_build_directory
61+
62+
cfg_file = os.path.join(build_directory, 'aflpp_cfg.bin')
63+
new_env['AFL_LLVM_CFG_FILE'] = cfg_file
64+
if os.path.isfile(cfg_file):
65+
os.remove(cfg_file)
66+
Path(cfg_file).touch()
67+
68+
src = os.getenv('SRC')
69+
work = os.getenv('WORK')
70+
71+
with utils.restore_directory(src), utils.restore_directory(work):
72+
# Restore SRC to its initial state so we can build again without any
73+
# trouble. For some OSS-Fuzz projects, build_benchmark cannot be run
74+
# twice in the same directory without this.
75+
utils.build_benchmark(env=new_env)
76+
77+
fuzz_target = os.getenv('FUZZ_TARGET')
78+
exec_path = os.path.join(dfsan_build_directory, fuzz_target)
79+
new_path = os.path.join(dfsan_build_directory, fuzz_target + '_dfsan')
80+
os.rename(exec_path, new_path)
81+
82+
83+
def build():
84+
"""Build benchmark."""
85+
86+
# first build it with DFSan enabled
87+
build_dfsan()
88+
89+
os.environ['CC'] = ('/dgfuzz/fuzzers/fuzzbench_dataflow_guided/target/'
90+
'release-fuzzbench/libafl_cc')
91+
os.environ['CXX'] = ('/dgfuzz/fuzzers/fuzzbench_dataflow_guided/target/'
92+
'release-fuzzbench/libafl_cxx')
93+
94+
os.environ['ASAN_OPTIONS'] = 'abort_on_error=0:allocator_may_return_null=1'
95+
os.environ['UBSAN_OPTIONS'] = 'abort_on_error=0'
96+
97+
cflags = ['--libafl']
98+
utils.append_flags('CFLAGS', cflags)
99+
utils.append_flags('CXXFLAGS', cflags)
100+
utils.append_flags('LDFLAGS', cflags)
101+
102+
os.environ['FUZZER_LIB'] = '/stub_rt.a'
103+
build_directory = os.environ['OUT']
104+
cfg_file = os.path.join(build_directory, 'libafl_cfg.bin')
105+
os.environ['AFL_LLVM_CFG_FILE'] = cfg_file
106+
if os.path.isfile(cfg_file):
107+
os.remove(cfg_file)
108+
Path(cfg_file).touch()
109+
utils.build_benchmark()
110+
111+
112+
def fuzz(input_corpus, output_corpus, target_binary):
113+
"""Run fuzzer."""
114+
prepare_fuzz_environment(input_corpus)
115+
dictionary_path = utils.get_dictionary_path(target_binary)
116+
command = [target_binary]
117+
if dictionary_path:
118+
command += (['-x', dictionary_path])
119+
120+
# Add the control flow graph file
121+
build_directory = os.environ['OUT']
122+
cfg_file = os.path.join(build_directory, 'libafl_cfg.bin')
123+
if os.path.exists(cfg_file):
124+
command += (['-c', cfg_file])
125+
else:
126+
sys.exit(1)
127+
128+
# get the dfsan binary
129+
dfsan_build_directory = os.path.join(build_directory, 'dfsan')
130+
fuzz_target = os.getenv('FUZZ_TARGET')
131+
dfsan_fuzz_target = os.path.join(dfsan_build_directory,
132+
fuzz_target + '_dfsan')
133+
command += (['-d', dfsan_fuzz_target])
134+
135+
# Add the input and output corpus
136+
command += (['-o', output_corpus, '-i', input_corpus])
137+
fuzzer_env = os.environ.copy()
138+
fuzzer_env['LD_PRELOAD'] = '/usr/lib/x86_64-linux-gnu/libjemalloc.so.2'
139+
print(command)
140+
subprocess.check_call(command, cwd=os.environ['OUT'], env=fuzzer_env)

‎fuzzers/dgfuzz_dc6e84_rand_sched/patch

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
diff --git a/fuzzers/fuzzbench_dataflow_guided/src/lib.rs b/fuzzers/fuzzbench_dataflow_guided/src/lib.rs
2+
index 7d9a8d53..fe12c713 100644
3+
--- a/fuzzers/fuzzbench_dataflow_guided/src/lib.rs
4+
+++ b/fuzzers/fuzzbench_dataflow_guided/src/lib.rs
5+
@@ -29,7 +29,7 @@ use libafl::{
6+
StdScheduledMutator, Tokens,
7+
},
8+
observers::{CanTrack, HitcountsMapObserver, TimeObserver},
9+
- schedulers::prescient_weighted::PrescientProbabilitySamplingScheduler,
10+
+ schedulers::{prescient_weighted::PrescientProbabilitySamplingScheduler, RandScheduler},
11+
stages::{calibrate::CalibrationStage, StdMutationalStage, TracingStage},
12+
state::{HasCorpus, StdState},
13+
Error, HasMetadata,
14+
@@ -350,7 +350,7 @@ fn fuzz(
15+
16+
let mutation = StdMutationalStage::with_max_iterations(mutator, 128);
17+
18+
- let scheduler = PrescientProbabilitySamplingScheduler::new_with_backoff(backoff_factor);
19+
+ let scheduler = RandScheduler::new(); // PrescientProbabilitySamplingScheduler::new_with_backoff(backoff_factor);
20+
21+
// A fuzzer with feedbacks and a corpus scheduler
22+
let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);

‎fuzzers/dgfuzz_dc6e84_rand_sched/runner.Dockerfile

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Copyright 2020 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
FROM gcr.io/fuzzbench/base-image
16+
17+
RUN apt install libjemalloc2
18+
19+
# This makes interactive docker runs painless:
20+
ENV LD_LIBRARY_PATH="$LD_LIBRARY_PATH:/out"
21+
ENV AFL_MAP_SIZE=1310720
22+
ENV PATH="$PATH:/out"
23+
ENV AFL_SKIP_CPUFREQ=1
24+
ENV AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
25+
ENV AFL_TESTCACHE_SIZE=2

0 commit comments

Comments
 (0)