3e38862837
* forkserver: Add an API to setup the shared memory region for edge coverage This is inspired from and meant to be similar to afl-cc's instrumentation. Remove ! return type from __afl_start_forkserver as it returns in several cases. * Add example fuzzer using LibAFL's forkserver The fuzzer is instrumented with libafl_cc as well. Co-authored-by: ergrelet <ergrelet@users.noreply.github.com>
116 lines
2.6 KiB
TOML
116 lines
2.6 KiB
TOML
# Variables
|
|
[env]
|
|
FUZZER_NAME='fuzzer_libafl_cc'
|
|
CARGO_TARGET_DIR = { value = "${PROJECT_DIR}/target", condition = { env_not_set = ["CARGO_TARGET_DIR"] } }
|
|
LIBAFL_CC = '${CARGO_TARGET_DIR}/release/libafl_cc'
|
|
LIBAFL_CXX = '${CARGO_TARGET_DIR}/release/libafl_cxx'
|
|
FUZZER = '${CARGO_TARGET_DIR}/release/${FUZZER_NAME}'
|
|
PROJECT_DIR = { script = ["pwd"] }
|
|
|
|
[tasks.unsupported]
|
|
script_runner="@shell"
|
|
script='''
|
|
echo "Cargo-make not integrated yet on this"
|
|
'''
|
|
|
|
# Compilers
|
|
[tasks.cxx]
|
|
linux_alias = "cxx_unix"
|
|
mac_alias = "cxx_unix"
|
|
windows_alias = "unsupported"
|
|
|
|
[tasks.cxx_unix]
|
|
command = "cargo"
|
|
args = ["build" , "--release"]
|
|
|
|
[tasks.cc]
|
|
linux_alias = "cc_unix"
|
|
mac_alias = "cc_unix"
|
|
windows_alias = "unsupported"
|
|
|
|
[tasks.cc_unix]
|
|
command = "cargo"
|
|
args = ["build" , "--release"]
|
|
|
|
[tasks.crash_cxx]
|
|
linux_alias = "crash_cxx_unix"
|
|
mac_alias = "crash_cxx_unix"
|
|
windows_alias = "unsupported"
|
|
|
|
[tasks.crash_cxx_unix]
|
|
command = "cargo"
|
|
args = ["build" , "--release", "--features=crash"]
|
|
|
|
[tasks.crash_cc]
|
|
linux_alias = "crash_cc_unix"
|
|
mac_alias = "crash_cc_unix"
|
|
windows_alias = "unsupported"
|
|
|
|
[tasks.crash_cc_unix]
|
|
command = "cargo"
|
|
args = ["build" , "--release", "--features=crash"]
|
|
|
|
# Harness
|
|
[tasks.fuzzer]
|
|
linux_alias = "fuzzer_unix"
|
|
mac_alias = "fuzzer_unix"
|
|
windows_alias = "unsupported"
|
|
|
|
[tasks.fuzzer_unix]
|
|
command = "${CARGO_TARGET_DIR}/release/libafl_cc"
|
|
args = ["${PROJECT_DIR}/src/program.c", "-o", "${FUZZER_NAME}", "-lm"]
|
|
dependencies = [ "cxx", "cc" ]
|
|
|
|
# Crashing Harness
|
|
[tasks.fuzzer_crash]
|
|
linux_alias = "fuzzer_crash_unix"
|
|
mac_alias = "fuzzer_crash_unix"
|
|
windows_alias = "unsupported"
|
|
|
|
[tasks.fuzzer_crash_unix]
|
|
command = "${CARGO_TARGET_DIR}/release/libafl_cc"
|
|
args = ["${PROJECT_DIR}/src/program.c", "-o", "${FUZZER_NAME}_crash", "-lm"]
|
|
dependencies = [ "crash_cxx", "crash_cc" ]
|
|
|
|
# Run the fuzzer
|
|
[tasks.run]
|
|
linux_alias = "run_unix"
|
|
mac_alias = "run_unix"
|
|
windows_alias = "unsupported"
|
|
|
|
[tasks.run_unix]
|
|
script_runner = "@shell"
|
|
script='''
|
|
taskset -c 1 ${CARGO_TARGET_DIR}/release/${CARGO_MAKE_PROJECT_NAME} ./${FUZZER_NAME} ./corpus/ -t 1000
|
|
'''
|
|
dependencies = [ "fuzzer" ]
|
|
|
|
|
|
# Run the fuzzer with a crash
|
|
[tasks.crash]
|
|
linux_alias = "crash_unix"
|
|
mac_alias = "crash_unix"
|
|
windows_alias = "unsupported"
|
|
|
|
[tasks.crash_unix]
|
|
script_runner = "@shell"
|
|
script='''
|
|
taskset -c 1 ${CARGO_TARGET_DIR}/release/${CARGO_MAKE_PROJECT_NAME} ./${FUZZER_NAME}_crash ./corpus/ -t 1000
|
|
'''
|
|
dependencies = [ "fuzzer_crash" ]
|
|
|
|
# Clean up
|
|
[tasks.clean]
|
|
linux_alias = "clean_unix"
|
|
mac_alias = "clean_unix"
|
|
windows_alias = "unsupported"
|
|
|
|
[tasks.clean_unix]
|
|
# Disable default `clean` definition
|
|
clear = true
|
|
script_runner="@shell"
|
|
script='''
|
|
rm -f ./${FUZZER_NAME}
|
|
cargo clean
|
|
'''
|