alwin.berger/FRET-LibAFL
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
FRET-LibAFL/fuzzers/frida_libpng
History
Dominik Maier 663a33168e
Associated types for Corpus, State (#767) 
* Associated types for Corpus, State

* cleanup

* fix no_std

* drop unused clauses

* Corpus

* cleanup

* adding things

* fixed fuzzer

* remove phantom data

* python

* progress?

* more more

* oof

* wow it builds?

* python fixes, tests

* fix python fun

* black fmt for python

* clippy, added Nop things

* fixes

* fix merge

* make it compile (#836)

* doc-test fixes, prelude-b-gone for cargo-hack compat

* fixes for windows, concolic

* really fix windows, maybe

* imagine using windows

* ...

* elide I generic when used with S: State

* Elide many, many generics, but at what cost?

* progress on push

* Constraint HasCorpus, HasSolutions at trait definition

* remove unused feature

* remove unstable usage since we constrained HasCorpus at definition

* compiled, but still no type inference for MaxMapFeedback

* cleanup inprocess

* resolve some std conflicts

* simplify map

* undo unnecessary cfg specification

* fix breaking test case for CI on no-std

* fix concolic build failures

* fix macos build

* fixes for windows build

* timeout fixes for windows build

* fix pybindings issues

* fixup qemu

* fix outstanding local build issues

* maybe fix windows inprocess

* doc fixes

* unbridled fury

* de-associate State from Feedback, replace with generic as AT inference is not sufficient to derive specialisation for MapFeedback

* merge update

* refactor + speed up fuzzer builds by sharing build work

* cleanup lingering compiler errors

* lol missed one

* revert QEMU-Nyx change, not sure how I did that

* move HasInput to inputs

* HasInput => KnowsInput

* update bounds to enforce via associated types

* disentangle observers with fuzzer

* revert --target; update some fuzzers to match new API

* resolve outstanding fuzzer build blockers (that I can run on my system)

* fixes for non-linux unixes

* fix for windows

* Knows => Uses, final fixes for windows

* <guttural screaming>

* fixes for concolic

* loosen bound for frida executor so windows builds correctly

* cleanup generics for eventmanager/eventprocessor to drop observers requirement

* improve inference over fuzz_one and friends

* update migration notes

* fixes for python bindings

* fixes for generic counts in event managers

* finish migration notes

* post-merge fix

Co-authored-by: Addison Crump <addison.crump@cispa.de>
2022-10-24 03:22:26 +02:00
..
corpus
ShMem Server for MacOS (#238)
2021-08-05 17:08:01 +02:00
src
Associated types for Corpus, State (#767)
2022-10-24 03:22:26 +02:00
.gitignore
fixes for frida mode for win and checks in rust 1.56 (#334)
2021-10-25 11:49:34 +02:00
Cargo.toml
Update dependencies, removed unused deps, CI fixes (#839)
2022-10-18 20:36:43 +02:00
harness_win.cpp
Windows CI for frida (#658)
2022-05-30 23:06:37 +02:00
harness.cc
Format C/Cpp code in ./scripts/fmt_all.sh (#653)
2022-05-29 03:23:02 +02:00
Makefile.toml
CI: Build fuzzers with shared cargo target dir (#845)
2022-10-20 21:38:58 +02:00
README.md
Token mutations: set MutationResult for CmpValues::Bytes (#838)
2022-10-14 13:03:57 +02:00

README.md

Libfuzzer for libpng

This folder contains an example fuzzer for libpng, using LLMP for fast multi-process fuzzing and crash detection. To show off crash detection, we added a ud2 instruction to the harness, edit harness.cc if you want a non-crashing example. It has been tested on Linux.

Build

To build this example, run cargo build --release in this folder. This will call (the build.rs)[./build.rs], which in turn downloads a libpng archive from the web. Then, it will link (the fuzzer)[./src/fuzzer.rs] against (the C++ harness)[./harness.cc] and the instrumented libpng. Afterwards, the fuzzer will be ready to run, from target/frida_libpng.
On unix platforms, you'll need libc++ to build it.

Alternatively you can run cargo make run and this command will automatically build and run the fuzzer

Build For Android

When building for android using a cross-compiler, make sure you have a standalone toolchain, and then add the following:

  1. In the ~/.cargo/config file add a target with the correct cross-compiler toolchain name (in this case aarch64-linux-android, but names may vary) [target.aarch64-linux-android] linker="aarch64-linux-android-clang"
  2. add path to installed toolchain to PATH env variable.
  3. define CLANG_PATH and add target to the build command line: CLANG_PATH=<path to installed toolchain>/bin/aarch64-linux-android-clang cargo -v build --release --target=aarch64-linux-android

Run

This example uses in-process-fuzzing, using the launcher feature, in combination with a Restarting Event Manager. This means running --cores each client will start itself again to listen for crashes and timeouts. By restarting the actual fuzzer, it can recover from these exit conditions.

After building the libpng-harness, you can run find . -name libpng-harness.so to find the location of your harness, then run ./frida_fuzzer -F LLVMFuzzerTestOneInput -H ./libpng-harness.so -l ./libpng-harness.so

Windows

You can also fuzz libpng-1.6.37 on windows with frida mode

To build it with visual studio

  1. Install clang for windows (make sure you add LLVM to the system path!) https://github.com/llvm/llvm-project/releases/tag/llvmorg-12.0.1

  2. Download libpng-1.6.37[https://deac-fra.dl.sourceforge.net/project/libpng/libpng16/1.6.37/libpng-1.6.37.tar.xz] and zlib [https://zlib.net/fossils/zlib-1.2.11.tar.gz] into this directory, and rename zlib-1.2.11 directory to zlib.

  3. Build libpng1.6.37

    • Open libpng-1.6.37/projects/vstudio/vstudio.sln
    • Open Build->Configuration Manager
      • select Release for Active solution configuration and
      • select ->x64 for Active solution platform (Copy settings from Win32)
    • Then for libpng, pngstest, pngtest, pngunknown, pngvalid, zlib in Solution Explorer, choose General -> Configuration Type -> Static library(.lib)
      • C/C++ -> Treat Warnings As Errors -> No
      • C/C++ -> Code Generation -> Runtime Library -> Multi-threaded (/MT)
    • Finally, you can build libpng-1.6.37

  4. Compile the harness Fire up a powershell at this directory.

cp .\libpng-1.6.37\projects\vstudio\x64\Release\libpng16.lib .
cp .\libpng-1.6.37\projects\vstudio\x64\Release\zlib.lib .
cp .\target\release\frida_libpng.exe .
clang++ -O3 -c -I.\libpng-1.6.37 .\harness.cc -o .\harness.o
clang++ -L.\zlib.dll .\harness.o .\libpng16.lib -lzlib -shared -o .\libpng-harness.dll
  1. Run the fuzzer
./frida_fuzzer.exe ./libpng-harness.dll LLVMFuzzerTestOneInput ./libpng-harness.dll