QoL improvements
This commit is contained in:
parent
e505e7689c
commit
022c12568b
3
.gitignore
vendored
3
.gitignore
vendored
@ -18,3 +18,6 @@ perf.data.old
|
|||||||
|
|
||||||
.vscode
|
.vscode
|
||||||
test.dict
|
test.dict
|
||||||
|
|
||||||
|
# Ignore all built fuzzers
|
||||||
|
fuzzer_*
|
@ -6,36 +6,46 @@ It has been tested on Linux.
|
|||||||
|
|
||||||
## Build
|
## Build
|
||||||
|
|
||||||
To build this example, run `cargo build --release`.
|
To build this example, run
|
||||||
This will build the library with the fuzzer (src/lib.rs) with the libfuzzer compatibility layer and the SanitizerCoverage runtime functions for coverage feedback.
|
|
||||||
In addition, it will build also two C and C++ compiler wrappers (bin/c(c/xx).rs) that you must use to compile the target.
|
|
||||||
|
|
||||||
Then download libpng from https://deac-fra.dl.sourceforge.net/project/libpng/libpng16/1.6.37/libpng-1.6.37.tar.xz and unpack the archive.
|
|
||||||
|
|
||||||
Now compile it with:
|
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cargo build --release
|
||||||
```
|
```
|
||||||
|
|
||||||
|
This will build the library with the fuzzer (src/lib.rs) with the libfuzzer compatibility layer and the SanitizerCoverage runtime functions for coverage feedback.
|
||||||
|
In addition, it will also build two C and C++ compiler wrappers (bin/libafl_c(libafl_c/xx).rs) that you must use to compile the target.
|
||||||
|
|
||||||
|
Then download libpng, and unpack the archive:
|
||||||
|
```bash
|
||||||
|
wget https://deac-fra.dl.sourceforge.net/project/libpng/libpng16/1.6.37/libpng-1.6.37.tar.xz
|
||||||
|
tar -xvf libpng-1.6.37.tar.xz
|
||||||
|
```
|
||||||
|
|
||||||
|
Now compile libpng, using the libafl_cc compiler wrapper:
|
||||||
|
|
||||||
|
```bash
|
||||||
cd libpng-1.6.37
|
cd libpng-1.6.37
|
||||||
./configure
|
./configure
|
||||||
make CC=/path/to/libfuzzer_libpng/target/release/cc -j `nproc`
|
make CC=../target/release/libafl_cc CXX=../target/release/libafl_cxx -j `nproc`
|
||||||
```
|
```
|
||||||
|
|
||||||
You can find the static lib at `libpng-1.6.37/.libs/libpng16.a`.
|
You can find the static lib at `libpng-1.6.37/.libs/libpng16.a`.
|
||||||
|
|
||||||
Now, we have to build the libfuzzer harness and link all togheter to create our fuzzer binary.
|
Now, we have to build the libfuzzer harness and link all together to create our fuzzer binary.
|
||||||
|
|
||||||
```
|
```
|
||||||
/path/to/libfuzzer_libpng/target/debug/cxx /path/to/libfuzzer_libpng/harness.cc libpng-1.6.37/.libs/libpng16.a -I libpng-1.6.37/ -o fuzzer -lz -lm
|
cd ..
|
||||||
|
./target/release/libafl_cxx ./harness.cc libpng-1.6.37/.libs/libpng16.a -I libpng-1.6.37/ -o fuzzer_libpng -lz -lm
|
||||||
```
|
```
|
||||||
|
|
||||||
Afterwards, the fuzzer will be ready to run simply executing `./fuzzer`.
|
Afterwards, the fuzzer will be ready to run.
|
||||||
|
|
||||||
## Run
|
## Run
|
||||||
|
|
||||||
The first time you run the binary, the broker will open a tcp port (currently on port `1337`), waiting for fuzzer clients to connect. This port is local and only used for the initial handshake. All further communication happens via shared map, to be independent of the kernel. Currently you must run the clients from the libfuzzer_libpng directory for them to be able to access the PNG corpus.
|
The first time you run the binary, the broker will open a tcp port (currently on port `1337`), waiting for fuzzer clients to connect. This port is local and only used for the initial handshake. All further communication happens via shared map, to be independent of the kernel. Currently you must run the clients from the libfuzzer_libpng directory for them to be able to access the PNG corpus.
|
||||||
|
|
||||||
```
|
```
|
||||||
cargo run --release --example libfuzzer_libpng
|
./fuzzer_libpng
|
||||||
|
|
||||||
[libafl/src/bolts/llmp.rs:407] "We're the broker" = "We\'re the broker"
|
[libafl/src/bolts/llmp.rs:407] "We're the broker" = "We\'re the broker"
|
||||||
Doing broker things. Run this tool again to start fuzzing in a client.
|
Doing broker things. Run this tool again to start fuzzing in a client.
|
||||||
|
@ -27,5 +27,7 @@ fn main() {
|
|||||||
.add_link_arg("-lAdvapi32".into())
|
.add_link_arg("-lAdvapi32".into())
|
||||||
.unwrap();
|
.unwrap();
|
||||||
cc.run().unwrap();
|
cc.run().unwrap();
|
||||||
|
} else {
|
||||||
|
panic!("LibAFL CC: No Arguments given");
|
||||||
}
|
}
|
||||||
}
|
}
|
@ -28,5 +28,7 @@ fn main() {
|
|||||||
.add_link_arg("-lAdvapi32".into())
|
.add_link_arg("-lAdvapi32".into())
|
||||||
.unwrap();
|
.unwrap();
|
||||||
cc.run().unwrap();
|
cc.run().unwrap();
|
||||||
|
} else {
|
||||||
|
panic!("LibAFL CC: No Arguments given");
|
||||||
}
|
}
|
||||||
}
|
}
|
@ -90,7 +90,13 @@ impl CompilerWrapper for ClangWrapper {
|
|||||||
let mut new_args = vec![];
|
let mut new_args = vec![];
|
||||||
if args.is_empty() {
|
if args.is_empty() {
|
||||||
return Err(Error::InvalidArguments(
|
return Err(Error::InvalidArguments(
|
||||||
"The number of arguments cannot be 0".into(),
|
"The number of arguments cannot be 0".to_string(),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
|
if args.len() == 1 {
|
||||||
|
return Err(Error::InvalidArguments(
|
||||||
|
"LibAFL Compiler wrapper - no commands specified. Use me as compiler.".to_string(),
|
||||||
));
|
));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
x
Reference in New Issue
Block a user