History

Andrea Fioraldi bdb5efbf5b

* print sender id

* storing sender id to env

* executor in llmp handle_in_client

* compile the lib

* compiling generic_inmemory

* fix forkserver

* adapt from fuzzers

* instrospection fix

* exitkind in NewTestcase

* fix libafl_frida

* fix firda_libpng

* send conf with Newtestcase event

* bump to 0.4.0

* no_std fix

* fmt

* fix libfuzzer_libmozjpeg

Co-authored-by: Dominik Maier <domenukk@gmail.com>

2021-06-22 15:04:14 +02:00

src

Configurations (#162 )

2021-06-22 15:04:14 +02:00

.gitignore

Frida Executor Example (#27 )

2021-03-22 12:45:38 +01:00

build.rs

Launcher (#48 )

2021-05-19 13:08:24 +02:00

Cargo.toml

Configurations (#162 )

2021-06-22 15:04:14 +02:00

harness.cc

Cmplog instrumentation for Frida (#99 )

2021-06-09 14:11:43 +02:00

README.md

Added MacOS CI (#131 )

2021-06-07 01:24:41 +02:00

README.md

Libfuzzer for libpng

This folder contains an example fuzzer for libpng, using LLMP for fast multi-process fuzzing and crash detection. To show off crash detection, we added a ud2 instruction to the harness, edit harness.cc if you want a non-crashing example. It has been tested on Linux.

Build

To build this example, run cargo build --release in this folder. This will call (the build.rs)[./build.rs], which in turn downloads a libpng archive from the web. Then, it will link (the fuzzer)[./src/fuzzer.rs] against (the C++ harness)[./harness.cc] and the instrumented libpng. Afterwards, the fuzzer will be ready to run, from target/frida_libpng.

Build For Android

When building for android using a cross-compiler, make sure you have a standalone toolchain, and then add the following:

In the ~/.cargo/config file add a target with the correct cross-compiler toolchain name (in this case aarch64-linux-android, but names may vary) [target.aarch64-linux-android] linker="aarch64-linux-android-clang"
add path to installed toolchain to PATH env variable.
define CLANG_PATH and add target to the build command line: CLANG_PATH=<path to installed toolchain>/bin/aarch64-linux-android-clang cargo -v build --release --target=aarch64-linux-android

Run

This example uses in-process-fuzzing, using the launcher feature, in combination with a Restarting Event Manager. This means running --cores each client will start itself again to listen for crashes and timeouts. By restarting the actual fuzzer, it can recover from these exit conditions.

After building the libpng-harness, too, you can run find . -name libpng-harness.so to find the location of your harness, then run ./target/release/frida_libpng ./libpng-harness.so LLVMFuzzerTestOneInput ./libpng-harness.so --cores=0