From a1c9c497d5e0659e94a25f8cb399f4d111643606 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Wed, 6 May 2020 15:37:49 +0200 Subject: aarch64 support for afl-untracer --- examples/afl_untracer/README.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'examples/afl_untracer/README.md') diff --git a/examples/afl_untracer/README.md b/examples/afl_untracer/README.md index 4ff96423..8e24c2a4 100644 --- a/examples/afl_untracer/README.md +++ b/examples/afl_untracer/README.md @@ -14,6 +14,21 @@ To generate the `patches.txt` file for your target library use the `ida_get_patchpoints.py` script for IDA Pro or `ghidra_get_patchpoints.java` for Ghidra. +The patches.txt file has to pointed to by `AFL_UNTRACER_FILE`. + +Example (after modfying afl-untracer.c to your needs, compiling and creating +patches.txt): +``` +AFL_UNTRACER_FILE=./patches.txt afl-fuzz -i in -o out -- ./afl-untracer +``` + +To testing/debugging you can try: +``` +make DEBUG=1 +AFL_UNTRACER_FILE=./patches.txt AFL_DEBUG=1 gdb ./afl-untracer +``` +and then you can easily set breakpoints to "breakpoint" and "fuzz". + This idea is based on [UnTracer](https://github.com/FoRTE-Research/UnTracer-AFL) and modified by [Trapfuzz](https://github.com/googleprojectzero/p0tools/tree/master/TrapFuzz). This implementation is slower because the traps are not patched out with each -- cgit 1.4.1 From 8cdf767bf589e3f709fda1d580b5899f046ae070 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Wed, 6 May 2020 15:57:38 +0200 Subject: doc update --- examples/afl_untracer/Makefile | 2 +- examples/afl_untracer/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'examples/afl_untracer/README.md') diff --git a/examples/afl_untracer/Makefile b/examples/afl_untracer/Makefile index ad67e8bc..14a09b41 100644 --- a/examples/afl_untracer/Makefile +++ b/examples/afl_untracer/Makefile @@ -7,7 +7,7 @@ endif all: afl-untracer libtestinstr.so afl-untracer: afl-untracer.c - $(CC) $(OPT) -I../../include -g -o afl-untracer afl-untracer.c -ldl -pthread + $(CC) $(OPT) -I../../include -g -o afl-untracer afl-untracer.c -ldl libtestinstr.so: libtestinstr.c $(CC) -g -O0 -fPIC -o libtestinstr.so -shared libtestinstr.c diff --git a/examples/afl_untracer/README.md b/examples/afl_untracer/README.md index 8e24c2a4..0bd788f3 100644 --- a/examples/afl_untracer/README.md +++ b/examples/afl_untracer/README.md @@ -3,7 +3,7 @@ afl-untracer is an example skeleton file which can easily be used to fuzz a closed source library. -It requires less memory than qemu_mode however it is way +It requires less memory and is x3-5 faster than qemu_mode however it is way more course grained and does not provide interesting features like compcov or cmplog. -- cgit 1.4.1 From 01b5aa123df8200f6c071f6ee1f3c05722b12fee Mon Sep 17 00:00:00 2001 From: van Hauser Date: Wed, 6 May 2020 17:20:42 +0200 Subject: better README for untracer --- examples/afl_untracer/README.md | 32 ++++++++++++++++++++++++---- examples/afl_untracer/ida_get_patchpoints.py | 3 +++ 2 files changed, 31 insertions(+), 4 deletions(-) (limited to 'examples/afl_untracer/README.md') diff --git a/examples/afl_untracer/README.md b/examples/afl_untracer/README.md index 0bd788f3..7d870c42 100644 --- a/examples/afl_untracer/README.md +++ b/examples/afl_untracer/README.md @@ -1,4 +1,6 @@ -# afl-untracer +# afl-untracer - fast fuzzing of binary-only libraries + +## Introduction afl-untracer is an example skeleton file which can easily be used to fuzz a closed source library. @@ -7,8 +9,17 @@ It requires less memory and is x3-5 faster than qemu_mode however it is way more course grained and does not provide interesting features like compcov or cmplog. -Read and modify afl-untracer.c then `make` and use it as the afl-fuzz target -(or even remote via afl-network-proxy). +Supported is so far Intel (i386/x86_64) and AARCH64. + +## How-to + +### Modify afl-untracer.c + +Read and modify afl-untracer.c then `make`. +To adapt afl-untracer.c to your need read the header of the file and then +search and edit the `STEP 1`, `STEP 2` and `STEP 3` locations. + +### Generate patches.txt file To generate the `patches.txt` file for your target library use the `ida_get_patchpoints.py` script for IDA Pro or @@ -16,19 +27,32 @@ To generate the `patches.txt` file for your target library use the The patches.txt file has to pointed to by `AFL_UNTRACER_FILE`. +To easily run the scripts without needing to run the GUI with Ghidra: +``` +$ /opt/ghidra/support/analyzeHeadless /tmp/ tmp$$ -import libtestinstr.so -postscript ./ghidra_get_patchpoints.java +$ rm -rf /tmp/tmp$$ +``` + +### Fuzzing + Example (after modfying afl-untracer.c to your needs, compiling and creating patches.txt): ``` AFL_UNTRACER_FILE=./patches.txt afl-fuzz -i in -o out -- ./afl-untracer ``` +(or even remote via afl-network-proxy). + +### Testing and debugging -To testing/debugging you can try: +For testing/debugging you can try: ``` make DEBUG=1 AFL_UNTRACER_FILE=./patches.txt AFL_DEBUG=1 gdb ./afl-untracer ``` and then you can easily set breakpoints to "breakpoint" and "fuzz". +# Background + This idea is based on [UnTracer](https://github.com/FoRTE-Research/UnTracer-AFL) and modified by [Trapfuzz](https://github.com/googleprojectzero/p0tools/tree/master/TrapFuzz). This implementation is slower because the traps are not patched out with each diff --git a/examples/afl_untracer/ida_get_patchpoints.py b/examples/afl_untracer/ida_get_patchpoints.py index c7e8f899..43cf6d89 100644 --- a/examples/afl_untracer/ida_get_patchpoints.py +++ b/examples/afl_untracer/ida_get_patchpoints.py @@ -57,3 +57,6 @@ with open(home + "/Desktop/patches.txt", "w") as f: f.write('\n') print("Done, found {} patchpoints".format(len(patchpoints))) + +# For headless script running remove the comment from the next line +#ida_pro.qexit() -- cgit 1.4.1 From 37b681ac11f62ccb41d13a146a319819af1c178d Mon Sep 17 00:00:00 2001 From: hexcoder Date: Thu, 7 May 2020 10:09:08 +0200 Subject: untracer README: one typo fixed --- examples/afl_untracer/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'examples/afl_untracer/README.md') diff --git a/examples/afl_untracer/README.md b/examples/afl_untracer/README.md index 7d870c42..29234889 100644 --- a/examples/afl_untracer/README.md +++ b/examples/afl_untracer/README.md @@ -35,7 +35,7 @@ $ rm -rf /tmp/tmp$$ ### Fuzzing -Example (after modfying afl-untracer.c to your needs, compiling and creating +Example (after modifying afl-untracer.c to your needs, compiling and creating patches.txt): ``` AFL_UNTRACER_FILE=./patches.txt afl-fuzz -i in -o out -- ./afl-untracer -- cgit 1.4.1 From 38dac93f631356d6a1288931e01f9effec9c8c88 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Mon, 11 May 2020 22:44:44 +0200 Subject: fix typos --- examples/afl_untracer/README.md | 4 ++-- examples/afl_untracer/afl-untracer.c | 2 +- llvm_mode/README.lto.md | 11 ++++++++--- llvm_mode/afl-llvm-lto-instrim.so.cc | 3 ++- 4 files changed, 13 insertions(+), 7 deletions(-) (limited to 'examples/afl_untracer/README.md') diff --git a/examples/afl_untracer/README.md b/examples/afl_untracer/README.md index 29234889..05fd8776 100644 --- a/examples/afl_untracer/README.md +++ b/examples/afl_untracer/README.md @@ -16,7 +16,7 @@ Supported is so far Intel (i386/x86_64) and AARCH64. ### Modify afl-untracer.c Read and modify afl-untracer.c then `make`. -To adapt afl-untracer.c to your need read the header of the file and then +To adapt afl-untracer.c to your needs, read the header of the file and then search and edit the `STEP 1`, `STEP 2` and `STEP 3` locations. ### Generate patches.txt file @@ -25,7 +25,7 @@ To generate the `patches.txt` file for your target library use the `ida_get_patchpoints.py` script for IDA Pro or `ghidra_get_patchpoints.java` for Ghidra. -The patches.txt file has to pointed to by `AFL_UNTRACER_FILE`. +The patches.txt file has to be pointed to by `AFL_UNTRACER_FILE`. To easily run the scripts without needing to run the GUI with Ghidra: ``` diff --git a/examples/afl_untracer/afl-untracer.c b/examples/afl_untracer/afl-untracer.c index 5dbc71bf..af16a6bf 100644 --- a/examples/afl_untracer/afl-untracer.c +++ b/examples/afl_untracer/afl-untracer.c @@ -276,7 +276,7 @@ library_list_t *find_library(char *name) { } -/* for having an easy breakpoint after load the shared library */ +/* for having an easy breakpoint location after loading the shared library */ // this seems to work for clang too. nice :) requires gcc 4.4+ #pragma GCC push_options #pragma GCC optimize("O0") diff --git a/llvm_mode/README.lto.md b/llvm_mode/README.lto.md index f930c560..fa5b8665 100644 --- a/llvm_mode/README.lto.md +++ b/llvm_mode/README.lto.md @@ -145,16 +145,21 @@ Known issues: Hence if building a target with afl-clang-lto fails try to build it with llvm11 and LTO enabled (`CC=clang-11` `CXX=clang++-11` `CFLAGS=-flto=full` and `CXXFLAGS=-flto=full`). + +An example that does not build with llvm 11 and LTO is ffmpeg. + If this succeeeds then there is an issue with afl-clang-lto. Please report at [https://github.com/AFLplusplus/AFLplusplus/issues/226](https://github.com/AFLplusplus/AFLplusplus/issues/226) ### Target crashes immediately -If the target is using early constructors (values smaller than 6) or have their -own _init/.init functions and these are instrumented then the target will -likely crash when started. This can be avoided by compiling with +If the target is using early constructors (priority values smaller than 6) +or have their own _init/.init functions and these are instrumented then the +target will likely crash when started. This can be avoided by compiling with `AFL_LLVM_MAP_DYNAMIC=1` . +This can e.g. happen with OpenSSL. + ## Upcoming Work 1. Currently the LTO whitelist feature does not allow to instrument main, diff --git a/llvm_mode/afl-llvm-lto-instrim.so.cc b/llvm_mode/afl-llvm-lto-instrim.so.cc index a686bb81..a7d9b756 100644 --- a/llvm_mode/afl-llvm-lto-instrim.so.cc +++ b/llvm_mode/afl-llvm-lto-instrim.so.cc @@ -10,7 +10,8 @@ http://www.apache.org/licenses/LICENSE-2.0 - This library is plugged into LLVM when invoking clang through afl-clang-fast. + This library is plugged into LLVM when invoking clang through afl-clang-fast + or afl-clang-lto with AFL_LLVM_INSTRUMENT=CFG or =INSTRIM */ -- cgit 1.4.1