InProcess Template Fuzzer for librairies

fuzzers/inprocess/libfuzzer_template_lib/Cargo.toml

@@ -0,0 +1,36 @@
+[package]
+name = "fuzzer_template"
+version = "0.1.0"
+edition = "2021"
+
+[features]
+default = ["std"]
+std = []
+crash = []
+
+[profile.release]
+lto = true
+codegen-units = 1
+opt-level = 3
+debug = true
+
+[build-dependencies]
+cc = { version = "1.1.21", features = ["parallel"] }
+
+[dependencies]
+libafl = { path = "../../../libafl", features = ["default"] }
+libafl_bolts = { path = "../../../libafl_bolts" }
+libafl_targets = { path = "../../../libafl_targets", features = [
+  "sancov_pcguard_hitcounts",
+  "libfuzzer",
+  "sancov_cmplog",
+] }
+# TODO Include it only when building cc
+libafl_cc = { path = "../../../libafl_cc" }
+
+log = { version = "0.4.22", features = ["release_max_level_info"] }
+mimalloc = { version = "0.1.43", default-features = false }
+
+[lib]
+name = "fuzzer_template"
+crate-type = ["staticlib"]

fuzzers/inprocess/libfuzzer_template_lib/Makefile.toml

@@ -0,0 +1,57 @@
+[env]
+FUZZER_NAME = 'fuzzer_template'
+PROJECT_DIR = { script = ["pwd"] }
+CARGO_TARGET_DIR = { value = "${PROJECT_DIR}/target", condition = { env_not_set = ["CARGO_TARGET_DIR",] } }
+PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } }
+PROFILE_DIR = { source = "${PROFILE}", default_value = "release", mapping = { "release" = "release", "dev" = "debug" }, condition = { env_not_set = [
+  "PROFILE_DIR",
+] } }
+LIBAFL_CC = '${CARGO_TARGET_DIR}/${PROFILE_DIR}/libafl_cc'
+LIBAFL_CXX = '${CARGO_TARGET_DIR}/${PROFILE}/libafl_cxx'
+FUZZER = '${CARGO_TARGET_DIR}/${PROFILE_DIR}/${FUZZER_NAME}'
+
+[tasks.clean]
+dependencies = ["cargo-clean", "clean-lib"]
+
+[tasks.clean-lib]
+cwd = "libsrc"
+script = """
+rm -rf build
+rm -rf ../fuzzer
+"""
+
+[tasks.cargo-clean]
+command = "cargo"
+args = ["clean"]
+
+[tasks.rebuild]
+dependencies = ["clean-lib", "build"]
+
+[tasks.build]
+dependencies = ["build-compilers", "build-lib", "build-fuzzer"]
+
+[tasks.build-compilers]
+script = """
+cargo build --release
+mkdir -p ${PROJECT_DIR}/libs
+cp -f ./target/${PROFILE_DIR}/libfuzzer_template.a ${PROJECT_DIR}/libs
+"""
+
+[tasks.build-lib]
+cwd = "libsrc"
+script = """
+CC=${LIBAFL_CC} CXX=${LIBAFL_CXX} cmake -S . -B build
+CC=${LIBAFL_CC} CXX=${LIBAFL_CXX} make -C build
+mv build/libtemplate.a ${PROJECT_DIR}/libs
+"""
+
+[tasks.build-fuzzer]
+script = """
+${LIBAFL_CC} -I ./libsrc -L${PROJECT_DIR}/libs -o fuzzer harness.c libs/libtemplate.a -lm -lc -lgcc
+"""
+
+[tasks.build-test]
+script = """
+clang-15 -I ./libsrc -L${PROJECT_DIR}/libs -DTEST_CORPUS=1 -o fuzzer_test harness.c libs/libtemplate.a -lm -lc -lgcc
+clang-15 -I ./libsrc -L${PROJECT_DIR}/libs -DTEST_ALL_CORPUS=1 -o fuzzer_testall harness.c libs/libtemplate.a -lm -lc -lgcc
+"""

fuzzers/inprocess/libfuzzer_template_lib/README.md

@@ -0,0 +1,60 @@
+# Libfuzzer template for statical libs
+
+This folder contains an example fuzzer for a template statical libs, using LLMP for fast multi-process fuzzing and crash detection.
+In contrast to other fuzzer examples, this setup uses `fuzz_loop_for`, to occasionally respawn the fuzzer executor.
+While this costs performance, it can be useful for targets with memory leaks or other instabilities.
+If your target is really instable, however, consider exchanging the `InProcessExecutor` for a `ForkserverExecutor` instead.
+
+It also uses the `introspection` feature, printing fuzzer stats during execution.
+
+It has been tested on Linux.
+
+## Build
+
+To build this example, run
+
+```bash
+cargo make build
+```
+
+(All build workflow is in Makefile.toml)
+
+This will build the library with the fuzzer (src/lib.rs) with the libfuzzer compatibility layer.
+In addition, it will also build two C and C++ compiler wrappers (bin/libafl_c(libafl_c/xx).rs). 
+Those compilers will be used to compile libsrc/ containing a template statical library.
+
+Then, a fuzzer is created with libtemplate.a and harness.c, wrapper for libafl and calling the template lib function.
+
+
+The fuzzer is ready to run.
+Note that, unless you use the `launcher`, you will have to run the binary multiple times to actually start the fuzz process, see `Run` in the following.
+This allows you to run multiple different builds of the same fuzzer alongside.
+
+## Run
+
+The first time you run the binary, the broker will open a tcp port (currently on port `1337`), waiting for fuzzer clients to connect. This port is local and only used for the initial handshake. All further communication happens via shared map, to be independent of the kernel. Currently, you must run the clients from the libfuzzer_template_lib directory for them to be able to access the test corpus.
+
+```
+./fuzzer_template
+
+[libafl/src/bolts/llmp.rs:407] "We're the broker" = "We\'re the broker"
+Doing broker things. Run this tool again to start fuzzing in a client.
+```
+
+And after running the above again in a separate terminal:
+
+```
+[libafl/src/bolts/llmp.rs:1464] "New connection" = "New connection"
+[libafl/src/bolts/llmp.rs:1464] addr = 127.0.0.1:33500
+[libafl/src/bolts/llmp.rs:1464] stream.peer_addr().unwrap() = 127.0.0.1:33500
+[LOG Debug]: Loaded 2 initial testcases.
+[New Testcase #2] clients: 3, corpus: 2, objectives: 0, executions: 5, exec/sec: 0
+< fuzzing stats >
+```
+
+As this example uses in-process fuzzing, we added a Restarting Event Manager (`setup_restarting_mgr`).
+This means each client will start itself again to listen for crashes and timeouts.
+By restarting the actual fuzzer, it can recover from these exit conditions.
+
+In any real-world scenario, you should use `taskset` to pin each client to an empty CPU core, the lib does not pick an empty core automatically (yet).
+

fuzzers/inprocess/libfuzzer_template_lib/corpus/a1

@@ -0,0 +1 @@
+b

fuzzers/inprocess/libfuzzer_template_lib/corpus/a2

@@ -0,0 +1 @@
+ab

fuzzers/inprocess/libfuzzer_template_lib/harness.c

@@ -0,0 +1,123 @@
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <dirent.h>
+
+#include "template.h"
+
+#define MAX_CORPUS_SIZE 10 * 1024 * 1024 //Max 10Mo
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  int ret = template_run_some_data((char*)data, size);
+  return ret;
+
+}
+
+static int filter(const struct dirent *name){return 1;}
+static int test_one_corpus(char * corpus) {
+
+  int ret;
+  struct stat stat_;
+
+  int fd = open(corpus, O_RDONLY);
+  if (fd == -1) {
+    printf("Error opening corpus\n");
+    ret = -1;
+    goto out;
+  }
+
+  stat(corpus, &stat_);
+
+  int corpus_size = stat_.st_size;
+  printf("Corpus: %s | Size : %d\n", corpus, corpus_size);
+
+  if (corpus_size > MAX_CORPUS_SIZE) {
+    printf("corpus size too big\n");
+    ret = -1;
+    goto out;
+  }
+
+  char * corpus_data = calloc(1, corpus_size);
+  int bsize = read(fd, corpus_data, corpus_size);
+
+  if (bsize != corpus_size) {
+    printf("corpus size doesn't match readed size (%d != %d)!\n", bsize, corpus_size);
+    ret = -1;
+    goto out;
+  }
+
+  ret = LLVMFuzzerTestOneInput((const uint8_t*)corpus_data, (size_t)corpus_size);
+  printf("ret=%d\n", ret);
+
+  out:
+
+    if (corpus_data) {
+      free(corpus_data);
+    }
+
+    if (fd > 0) {
+      close(fd);
+    }
+    return ret;
+
+}
+
+// simply RECOMPILE WITH -DTEST_CORPUS=1 OR -DTEST_ALL_CORPUS=1 to test corpus_evolution or crashes directory. 
+#ifdef TEST_CORPUS
+int main(int argc, char ** argv) {
+
+  if (argc < 2) {
+    printf("Usage : %s /path/to/corpus\n", argv[0]);
+    return -1;
+  } 
+
+  char * corpus = argv[1];
+  return test_one_corpus(corpus);
+}
+#endif
+
+#ifdef TEST_ALL_CORPUS
+int main(int argc, char ** argv) {
+
+  int ret;
+  struct dirent **namelist;
+  char path_corpus[200] = {0};
+
+  if (argc < 2) {
+    printf("Usage : %s /path/to/corpusdir\n", argv[0]);
+    return -1;
+  } 
+
+  int n = scandir(argv[1], &namelist, filter, alphasort);
+  if (n == -1) {
+    perror("scandir");
+    exit(EXIT_FAILURE);
+  }
+
+  while (n--) {
+    memset(path_corpus, 0, sizeof(path_corpus));
+
+    if ((strcmp(namelist[n]->d_name, ".") == 0) || strcmp(namelist[n]->d_name, "..") ==0) {
+      continue;
+    }
+
+    if ((strstr(namelist[n]->d_name, ".metadata")) || strstr(namelist[n]->d_name, ".lafl_lock")) {
+      continue;
+    }
+
+    snprintf(path_corpus, sizeof(path_corpus), "%s/%s", argv[1], namelist[n]->d_name);
+    ret = test_one_corpus(path_corpus);
+  }
+
+  free(namelist);
+  return 0;
+
+
+}
+#endif

fuzzers/inprocess/libfuzzer_template_lib/libsrc/CMakeLists.txt

@@ -0,0 +1,16 @@
+cmake_minimum_required(VERSION 3.15)
+
+project(template)
+
+add_library(${PROJECT_NAME} 
+    template.c
+)
+
+target_include_directories(${PROJECT_NAME} PUBLIC ${PROJECT_DIR})
+
+set(CMAKE_BUILD_TYPE RELEASE)
+set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -D_GNU_SOURCE -O2 -std=c99")
+set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -I ${CMAKE_SOURCE_DIR}")
+
+set(CMAKE_C_COMPILER ${CC})
+set(CMAKE_CXX_COMPILER ${CCX})

fuzzers/inprocess/libfuzzer_template_lib/libsrc/template.c

@@ -0,0 +1,16 @@
+#include "template.h"
+
+int template_run_some_data(char *data, size_t size) {
+
+    if (data[0] == 'a') {
+        if (data[1] == 'b') {
+            if (data[2] == 'c') {
+                abort();
+            }
+            return 3;
+        }
+        return 2;
+    }
+
+    return 1;
+}

fuzzers/inprocess/libfuzzer_template_lib/libsrc/template.h

@@ -0,0 +1,14 @@
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <dirent.h>
+
+//some template lib function
+int template_run_some_data(char *data, size_t size);

fuzzers/inprocess/libfuzzer_template_lib/src/bin/libafl_cc.rs

@@ -0,0 +1,36 @@
+use std::env;
+
+use libafl_cc::{ClangWrapper, CompilerWrapper, ToolWrapper};
+
+pub fn main() {
+    let args: Vec<String> = env::args().collect();
+    if args.len() > 1 {
+        let mut dir = env::current_exe().unwrap();
+        let wrapper_name = dir.file_name().unwrap().to_str().unwrap();
+
+        let is_cpp = match wrapper_name[wrapper_name.len()-2..].to_lowercase().as_str() {
+            "cc" => false,
+            "++" | "pp" | "xx" => true,
+            _ => panic!("Could not figure out if c or c++ wrapper was called. Expected {dir:?} to end with c or cxx"),
+        };
+
+        dir.pop();
+
+        let mut cc = ClangWrapper::new();
+        if let Some(code) = cc
+            .cpp(is_cpp)
+            // silence the compiler wrapper output, needed for some configure scripts.
+            .silence(true)
+            .parse_args(&args)
+            .expect("Failed to parse the command line")
+            .link_staticlib(&dir, "fuzzer_template")
+            .add_arg("-fsanitize-coverage=trace-pc-guard")
+            .run()
+            .expect("Failed to run the wrapped compiler")
+        {
+            std::process::exit(code);
+        }
+    } else {
+        panic!("LibAFL CC: No Arguments given");
+    }
+}

fuzzers/inprocess/libfuzzer_template_lib/src/bin/libafl_cxx.rs

@@ -0,0 +1,5 @@
+pub mod libafl_cc;
+
+fn main() {
+    libafl_cc::main();
+}