#Pull AFL and install QEMU supportgit clone https://github.com/mcarpenter/aflcd aflmakecd qemu_mode/sudo apt install libtool-binexport CPU_TARGET=mips./build_qemu_support.shsudo -i#Stop coredumps from being sent to an external utilityecho core > /proc/sys/kernel/core_patternexitQEMU_LD_PREFIX=$(pwd) AFL_PATH=/home/$USER/afl afl-fuzz -i testcases/ -o output/ -Q -- ./myBinaryWithSTDIN
If you get issues on Ubuntu 18.04, add the following to the qemu_mode/patches
directory:
From 75e5b70e6b5dcc4f2219992d7cffa462aa406af0 Mon Sep 17 00:00:00 2001From: Paolo Bonzini <[email protected]>Date: Tue, 28 Nov 2017 11:51:27 +0100Subject: [PATCH] memfd: fix configure testMIME-Version: 1.0Content-Type: text/plain; charset=utf8Content-Transfer-Encoding: 8bitRecent glibc added memfd_create in sys/mman.h. This conflicts withthe definition in util/memfd.c:/builddir/build/BUILD/qemu-2.11.0-rc1/util/memfd.c:40:12: error: static declaration of memfd_create follows non-static declarationFix the configure test, and remove the sys/memfd.h inclusion since thefile actually does not exist---it is a typo in the memfd_create(2) manpage.Cc: Marc-André Lureau <[email protected]>Signed-off-by: Paolo Bonzini <[email protected]>---configure | 2 +-util/memfd.c | 4 +---2 files changed, 2 insertions(+), 4 deletions(-)diff --git a/configure b/configureindex 9c8aa5a..99ccc17 100755--- a/configure+++ b/configure@@ -3923,7 +3923,7 @@ fi# check if memfd is supportedmemfd=nocat > $TMPC << EOF-#include <sys/memfd.h>+#include <sys/mman.h>int main(void){diff --git a/util/memfd.c b/util/memfd.cindex 4571d1a..412e94a 100644--- a/util/memfd.c+++ b/util/memfd.c@@ -31,9 +31,7 @@#include "qemu/memfd.h"-#ifdef CONFIG_MEMFD-#include <sys/memfd.h>-#elif defined CONFIG_LINUX+#if defined CONFIG_LINUX && !defined CONFIG_MEMFD#include <sys/syscall.h>#include <asm/unistd.h>--1.8.3.1
And add patch -p1 <../patches/mman.diff || exit 1
to line 129 of build_qemu_support.sh
#Make a 1GB ramdisk file from which AFL can read inputmkdir -p inputFilesmount -t tmpfs -o size=1024M tmpfs inputFiles/
This part uses the afl-clang-fast to build instrumented binaries.
#Ubuntu does not have clang 5, and I don't like building it from sourcewget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add -sudo apt-add-repository "deb http://apt.llvm.org/xenial/ llvm-toolchain-xenial-5.0 main"sudo apt-get updatesudo apt-get install -y clang-5.0 llvm-5.0#Ubuntu doesn't like adding "clang" and "llvm-config" to the /usr/binsudo ln -s /usr/bin/clang-5.0 /usr/bin/clangsudo ln -s /usr/bin/clang++-5.0 /usr/bin/clang++sudo ln -s /usr/bin/llvm-config-5.0 /usr/bin/llvm-config#Pull AFL and install llvm modegit clone https://github.com/mcarpenter/aflcd aflmakecd llvm_mode#This part is important. Clang5 support WILL NOT WORK without this changevim Makefile#Change CLANG_CFL from#CLANG_CFL = `$(LLVM_CONFIG) --cxxflags` -fno-rtti -fpic $(CXXFLAGS)# To#CLANG_CFL = -I/usr/lib/llvm-5.0/include -std=c++0x -fuse-ld=gold -Wl,--no-keep-files-mapped -Wl,--no-map-whole-files -fPIC -Werror=date-time -std=c++11 -Wall -W -Wno-unused-parameter -Wwrite-strings -Wcast-qual -Wno-missing-field-initializers -pedantic -Wno-long-long -Wno-maybe-uninitialized -Wdelete-non-virtual-dtor -Wno-comment -ffunction-sections -fdata-sections -O2 -DNDEBUG -fno-exceptions -DLLVM_BUILD_GLOBAL_ISEL -D_GNU_SOURCE -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS -fno-rtti -fpic $(CXXFLAGS)#`llvm-config --cxxflags` includes the `-fvisibility-inlines-hidden` flag which WILL BREAK AFL INSTRUMENTATION.makecd ..sudo make installcd /path/to/source/code./configure CC=afl-clang-fastmake
Makes fuzzing binaries with socket/alarm/fork etc so much easier
git clone https://github.com/zardus/preeny.gitcd preeny#Your architecture libsmake#32 bit libsCFLAGS=-m32 make#Cross architecture libsCC=mips-malta-linux-gnu-gcc make -i#Standard usage:LD_PRELOAD="/home/$USER/preeny/x86_64-linux-gnu/defork.so" ./myFavoriteForkingBinary#AFL usage:AFL_PRELOAD="/home/$USER/preeny/x86_64-linux-gnu/desock.so" afl-fuzz -i i/ -o o/ -m 200 ./myFavoriteSocketBinary
#This disables fork server which stops before main() and issues forked processes from thereAFL_NO_FORKSRV=1#Send your LD_PRELOAD stuff only to the binary. This way you don't mess with AFL's fork serverAFL_PRELOAD="/home/$USER/preeny/x86_64-linux-gnu/defork.so"