better docu and greater dockerfile

3 files changed, 58 insertions, 23 deletions

diff --git a/Dockerfile b/Dockerfile
index d28f75b..444e3ff 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,8 @@
-FROM ubuntu:trusty
-MAINTAINER rjohnson@moflow.org/vh@thc.org
+FROM kalilinux/kali-rolling AS afl-dyninst-base
+MAINTAINER mh@mh-sec.de
 
-# dyninst ubuntu 14.04/x64
-RUN apt-get update && apt-get install -y \
+ARG DEBIAN_FRONTEND=noninteractive
+RUN apt-get update && apt-get upgrade && apt-get install -y \
         build-essential \
         gcc \
         g++ \
@@ -14,33 +14,45 @@ RUN apt-get update && apt-get install -y \
         gzip \
         vim \
         curl \
+        apt-utils \
         libelf-dev \
         libelf1 \
         libiberty-dev \
         libboost-all-dev \
-    && rm -rf /var/lib/apt/lists/*
+        libtbb2 \
+        libtbb-dev \
+    && apt-get -y autoremove && rm -rf /var/lib/apt/lists/*
 
 RUN git clone https://github.com/dyninst/dyninst \
         && cd dyninst && mkdir build && cd build \
         && cmake .. \
         && make \
         && make install \
-        && cd ../..
+        && cd .. ; rm -rf build ; cd ..
 
-RUN curl http://lcamtuf.coredump.cx/afl/releases/afl-latest.tgz | tar -zxvf - \
-        && cd afl-* \
-        && make \
+RUN git clone https://github.com/vanhauser-thc/AFLplusplus \
+        && cd AFLplusplus \
+        && make source-only \
         && make install \
+        && make clean \
         && cd ..
 
 RUN git clone https://github.com/vanhauser-thc/afl-dyninst \
         && cd afl-dyninst \
-        && ln -s `ls -d1 ../afl-2* | tail -1` afl \
+        && ln -s ../AFLplusplus afl \
         && make \
         && make install \
+        && make clean \
         && cd .. \
         && echo "/usr/local/lib" > /etc/ld.so.conf.d/dyninst.conf && ldconfig \
         && echo "export DYNINSTAPI_RT_LIB=/usr/local/lib/libdyninstAPI_RT.so" >> .bashrc
 
-# output usage and give a shell 
-CMD afl-dyninst ; /bin/bash -i
+ENV DYNINSTAPI_RT_LIB /usr/local/lib/libdyninstAPI_RT.so
+
+# the afl-dyninst image:
+FROM afl-dyninst-base AS afl-dyninst
+CMD afl-dyninst.sh
+
+# the afl-fuzz-dyninst image (with afl++):
+FROM afl-dyninst-base AS afl-fuzz-dyninst
+CMD afl-fuzz-dyninst.sh
diff --git a/README.md b/README.md
index 8c95f2c..2a2ef14 100644
--- a/README.md
+++ b/README.md
@@ -12,13 +12,31 @@ callback either at _init or at specified entry point.
 
 ## Building / Compiling
 
+### docker
+
+simply run
+```
+docker build .
+```
+which will take ~25 minutes.
+Afterwards you have two docker containers you can run directly.
+
+One for instrumenting binaries:
+```
+docker run afl-dyninst
+```
+And one for fuzzing the instrumented binaries:
+```
+docker run afl-fuzz-dyninst
+```
+
+### on your own
+
 1. Clone, compile and install dyninst: https://github.com/dyninst/dyninst/
 
 Note that you could also use dyninst 9.3.2, but has less platform support and
 quite a few bugs. For using dyninst 9.x you have to edit the Makefile
-Using at least 10.0.1 is highly recommended.
-
-NOTE: You should use at least dyninst 10.0.1 !
+Using at least 10.1.0 is highly recommended!
 
 2. Download and install afl++ from https://github.com/vanhauser-thc/AFLplusplus
 It's an up to date and enhanced version to the original afl with better
@@ -33,18 +51,20 @@ performance, new features and bugfixes.
 
 ### Building dyninst 10
 
-building dyninst10 is a pain. I recommend the following steps:
+Building dyninst10 can be a pain.
+If you are not on debian-testing or kali-rolling, I recommend the following steps:
 1. remove elfutils if installed as a distribution package
-2. download the newest elfutils, make and (!) make install
-3. install libboost-all-dev for your distribution
-4. execute (depending where your libboost is installed, for me its /usr/lib/x86_64-linux-gnu):
+2. install libboost-all-dev for your distribution
+3. execute (depending where your libboost is installed, for me its /usr/lib/x86_64-linux-gnu):
 ```shell
 cd /usr/lib/x86_64-linux-gnu && for i in libboost*.so libboost*.a; do
   n=`echo $i|sed 's/\./-mt./'`
   ln -s $i $n 2> /dev/null
 done
 ```
-5. git clone https://github.com/dyninst/dyninst ; mkdir build ; cd build ; cmake .. ; make ; make install
+4. git clone https://github.com/dyninst/dyninst ; mkdir build ; cd build ; cmake .. ; make ; make install
+If dyninst complains about any missing packages - install them.
+Depending on the age of your Linux OS you can try to use packages from your distro, and install from source otherwise.
 
 
 ## Commandline options
@@ -173,12 +193,15 @@ Dyninst is making big changes to the code, and hence more often than not
 things are not working anymore.
 
 Problem 1: The binary does not work (crashes or hangs)
+
 Solution: increase the -m parameter. -m 8 is the minimum recommended, on some
           targets -m 16 is required etc.
-          You can also try to remove -x performance enhancers.
+          You can also try to remove -x performance enhancers
+
 
 Problem 2: Basically every fuzzing test case is reported as crash although it
            does not when running it from the command line
+
 Solution: This happens if the target is using throw/catch, and dyninst's
           modification result in that the cought exception is not resetted and
           hence abort() is triggered.
diff --git a/afl-dyninst.cpp b/afl-dyninst.cpp
index e5e7ff6..35e55f3 100644
--- a/afl-dyninst.cpp
+++ b/afl-dyninst.cpp
@@ -54,7 +54,7 @@ const char *functions[] = { "main", "_main", "_initproc", "_init", "start", "_st
 const char *instLibrary = "libAflDyninst.so";
 
 static const char *OPT_STR = "fi:o:l:e:E:vs:dr:m:S:Dx";
-static const char *USAGE = "-dfvxD -i <binary> -o <binary> -l <library> -e <address> -E <address> -s <number> -S <funcname> -m <size>\n \
+static const char *USAGE = " -dfvxD -i <binary> -o <binary> -l <library> -e <address> -E <address> -s <number> -S <funcname> -m <size>\n \
   -i: input binary \n \
   -o: output binary\n \
   -d: do not instrument the binary, only supplied libraries\n \
@@ -345,7 +345,7 @@ int main(int argc, char **argv) {
   char *func2patch = NULL;
   int loop;
   
-  cout << "afl-dyninst (c) 2017-2019 by Aleksandar Nikolic and Marc Heuse [https://github.com/vanhauser-thc/afl-dyninst] Apache 2.0 License" << endl;
+  cout << "afl-dyninst (c) 2017-2020 by Aleksandar Nikolic and Marc Heuse [https://github.com/vanhauser-thc/afl-dyninst] Apache 2.0 License" << endl;
 
   if (argc < 3 || strncmp(argv[1], "-h", 2) == 0 || strncmp(argv[1], "--h", 3) == 0) {
     cout << "Usage: " << argv[0] << USAGE;