Skip to content

Commit aff1970

Browse files
tokatokatokatoka
committed
non fix seed variant
1 parent 7e0413f commit aff1970

20 files changed

+1840
-0
lines changed

‎fuzzers/aflplusplus_t1/builder.Dockerfile

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# Copyright 2020 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
ARG parent_image
16+
FROM $parent_image
17+
18+
RUN apt-get update && \
19+
apt-get install -y \
20+
build-essential \
21+
python3-dev \
22+
python3-setuptools \
23+
automake \
24+
cmake \
25+
git \
26+
flex \
27+
bison \
28+
libglib2.0-dev \
29+
libpixman-1-dev \
30+
cargo \
31+
libgtk-3-dev \
32+
# for QEMU mode
33+
ninja-build \
34+
gcc-$(gcc --version|head -n1|sed 's/\..*//'|sed 's/.* //')-plugin-dev \
35+
libstdc++-$(gcc --version|head -n1|sed 's/\..*//'|sed 's/.* //')-dev
36+
37+
# Download afl++.
38+
RUN git clone -b dev https://github.com/AFLplusplus/AFLplusplus /afl && \
39+
cd /afl && \
40+
git checkout d206d5fc46f40e4b085c284abfd9409841a07877
41+
42+
# Build without Python support as we don't need it.
43+
RUN cd /afl && \
44+
unset CFLAGS CXXFLAGS && \
45+
export CC=clang AFL_NO_X86=1 && \
46+
PYTHON_INCLUDE=/ make && \
47+
cp utils/aflpp_driver/libAFLDriver.a /

‎fuzzers/aflplusplus_t1/description.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# aflplusplus
2+
3+
AFL++ fuzzer instance that has the following config active for all benchmarks:
4+
- PCGUARD instrumentation
5+
- cmplog feature
6+
- dict2file feature
7+
- "fast" power schedule
8+
- persistent mode + shared memory test cases
9+
10+
Repository: [https://github.com/AFLplusplus/AFLplusplus/](https://github.com/AFLplusplus/AFLplusplus/)
11+
12+
[builder.Dockerfile](builder.Dockerfile)
13+
[fuzzer.py](fuzzer.py)
14+
[runner.Dockerfile](runner.Dockerfile)

‎fuzzers/aflplusplus_t1/fuzzer.py

Lines changed: 283 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,283 @@
1+
# Copyright 2020 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
"""Integration code for AFLplusplus fuzzer."""
16+
17+
import os
18+
import shutil
19+
20+
from fuzzers.afl import fuzzer as afl_fuzzer
21+
from fuzzers import utils
22+
23+
24+
def get_cmplog_build_directory(target_directory):
25+
"""Return path to CmpLog target directory."""
26+
return os.path.join(target_directory, 'cmplog')
27+
28+
29+
def get_uninstrumented_build_directory(target_directory):
30+
"""Return path to CmpLog target directory."""
31+
return os.path.join(target_directory, 'uninstrumented')
32+
33+
34+
def build(*args): # pylint: disable=too-many-branches,too-many-statements
35+
"""Build benchmark."""
36+
# BUILD_MODES is not already supported by fuzzbench, meanwhile we provide
37+
# a default configuration.
38+
39+
build_modes = list(args)
40+
if 'BUILD_MODES' in os.environ:
41+
build_modes = os.environ['BUILD_MODES'].split(',')
42+
43+
# Placeholder comment.
44+
build_directory = os.environ['OUT']
45+
46+
# If nothing was set this is the default:
47+
if not build_modes:
48+
build_modes = ['tracepc', 'cmplog', 'dict2file']
49+
50+
# For bug type benchmarks we have to instrument via native clang pcguard :(
51+
build_flags = os.environ['CFLAGS']
52+
53+
if build_flags.find(
54+
'array-bounds'
55+
) != -1 and 'qemu' not in build_modes and 'classic' not in build_modes:
56+
if 'gcc' not in build_modes:
57+
build_modes[0] = 'native'
58+
59+
# Instrumentation coverage modes:
60+
if 'lto' in build_modes:
61+
os.environ['CC'] = '/afl/afl-clang-lto'
62+
os.environ['CXX'] = '/afl/afl-clang-lto++'
63+
edge_file = build_directory + '/aflpp_edges.txt'
64+
os.environ['AFL_LLVM_DOCUMENT_IDS'] = edge_file
65+
if os.path.isfile('/usr/local/bin/llvm-ranlib-13'):
66+
os.environ['RANLIB'] = 'llvm-ranlib-13'
67+
os.environ['AR'] = 'llvm-ar-13'
68+
os.environ['AS'] = 'llvm-as-13'
69+
elif os.path.isfile('/usr/local/bin/llvm-ranlib-12'):
70+
os.environ['RANLIB'] = 'llvm-ranlib-12'
71+
os.environ['AR'] = 'llvm-ar-12'
72+
os.environ['AS'] = 'llvm-as-12'
73+
else:
74+
os.environ['RANLIB'] = 'llvm-ranlib'
75+
os.environ['AR'] = 'llvm-ar'
76+
os.environ['AS'] = 'llvm-as'
77+
elif 'qemu' in build_modes:
78+
os.environ['CC'] = 'clang'
79+
os.environ['CXX'] = 'clang++'
80+
elif 'gcc' in build_modes:
81+
os.environ['CC'] = 'afl-gcc-fast'
82+
os.environ['CXX'] = 'afl-g++-fast'
83+
if build_flags.find('array-bounds') != -1:
84+
os.environ['CFLAGS'] = '-fsanitize=address -O1'
85+
os.environ['CXXFLAGS'] = '-fsanitize=address -O1'
86+
else:
87+
os.environ['CFLAGS'] = ''
88+
os.environ['CXXFLAGS'] = ''
89+
os.environ['CPPFLAGS'] = ''
90+
else:
91+
os.environ['CC'] = '/afl/afl-clang-fast'
92+
os.environ['CXX'] = '/afl/afl-clang-fast++'
93+
94+
print('AFL++ build: ')
95+
print(build_modes)
96+
97+
if 'qemu' in build_modes or 'symcc' in build_modes:
98+
os.environ['CFLAGS'] = ' '.join(utils.NO_SANITIZER_COMPAT_CFLAGS)
99+
cxxflags = [utils.LIBCPLUSPLUS_FLAG] + utils.NO_SANITIZER_COMPAT_CFLAGS
100+
os.environ['CXXFLAGS'] = ' '.join(cxxflags)
101+
102+
if 'tracepc' in build_modes or 'pcguard' in build_modes:
103+
os.environ['AFL_LLVM_USE_TRACE_PC'] = '1'
104+
elif 'classic' in build_modes:
105+
os.environ['AFL_LLVM_INSTRUMENT'] = 'CLASSIC'
106+
elif 'native' in build_modes:
107+
os.environ['AFL_LLVM_INSTRUMENT'] = 'LLVMNATIVE'
108+
109+
# Instrumentation coverage options:
110+
# Do not use a fixed map location (LTO only)
111+
if 'dynamic' in build_modes:
112+
os.environ['AFL_LLVM_MAP_DYNAMIC'] = '1'
113+
# Use a fixed map location (LTO only)
114+
if 'fixed' in build_modes:
115+
os.environ['AFL_LLVM_MAP_ADDR'] = '0x10000'
116+
# Generate an extra dictionary.
117+
if 'dict2file' in build_modes or 'native' in build_modes:
118+
os.environ['AFL_LLVM_DICT2FILE'] = build_directory + '/afl++.dict'
119+
os.environ['AFL_LLVM_DICT2FILE_NO_MAIN'] = '1'
120+
# Enable context sentitivity for LLVM mode (non LTO only)
121+
if 'ctx' in build_modes:
122+
os.environ['AFL_LLVM_CTX'] = '1'
123+
# Enable N-gram coverage for LLVM mode (non LTO only)
124+
if 'ngram2' in build_modes:
125+
os.environ['AFL_LLVM_NGRAM_SIZE'] = '2'
126+
elif 'ngram3' in build_modes:
127+
os.environ['AFL_LLVM_NGRAM_SIZE'] = '3'
128+
elif 'ngram4' in build_modes:
129+
os.environ['AFL_LLVM_NGRAM_SIZE'] = '4'
130+
elif 'ngram5' in build_modes:
131+
os.environ['AFL_LLVM_NGRAM_SIZE'] = '5'
132+
elif 'ngram6' in build_modes:
133+
os.environ['AFL_LLVM_NGRAM_SIZE'] = '6'
134+
elif 'ngram7' in build_modes:
135+
os.environ['AFL_LLVM_NGRAM_SIZE'] = '7'
136+
elif 'ngram8' in build_modes:
137+
os.environ['AFL_LLVM_NGRAM_SIZE'] = '8'
138+
elif 'ngram16' in build_modes:
139+
os.environ['AFL_LLVM_NGRAM_SIZE'] = '16'
140+
if 'ctx1' in build_modes:
141+
os.environ['AFL_LLVM_CTX_K'] = '1'
142+
elif 'ctx2' in build_modes:
143+
os.environ['AFL_LLVM_CTX_K'] = '2'
144+
elif 'ctx3' in build_modes:
145+
os.environ['AFL_LLVM_CTX_K'] = '3'
146+
elif 'ctx4' in build_modes:
147+
os.environ['AFL_LLVM_CTX_K'] = '4'
148+
149+
# Only one of the following OR cmplog
150+
# enable laf-intel compare splitting
151+
if 'laf' in build_modes:
152+
os.environ['AFL_LLVM_LAF_SPLIT_SWITCHES'] = '1'
153+
os.environ['AFL_LLVM_LAF_SPLIT_COMPARES'] = '1'
154+
os.environ['AFL_LLVM_LAF_SPLIT_FLOATS'] = '1'
155+
if 'autodict' not in build_modes:
156+
os.environ['AFL_LLVM_LAF_TRANSFORM_COMPARES'] = '1'
157+
158+
if 'eclipser' in build_modes:
159+
os.environ['FUZZER_LIB'] = '/libStandaloneFuzzTarget.a'
160+
else:
161+
os.environ['FUZZER_LIB'] = '/libAFLDriver.a'
162+
163+
# Some benchmarks like lcms. (see:
164+
# https://github.com/mm2/Little-CMS/commit/ab1093539b4287c233aca6a3cf53b234faceb792#diff-f0e6d05e72548974e852e8e55dffc4ccR212)
165+
# fail to compile if the compiler outputs things to stderr in unexpected
166+
# cases. Prevent these failures by using AFL_QUIET to stop afl-clang-fast
167+
# from writing AFL specific messages to stderr.
168+
os.environ['AFL_QUIET'] = '1'
169+
os.environ['AFL_MAP_SIZE'] = '2621440'
170+
171+
src = os.getenv('SRC')
172+
work = os.getenv('WORK')
173+
174+
with utils.restore_directory(src), utils.restore_directory(work):
175+
# Restore SRC to its initial state so we can build again without any
176+
# trouble. For some OSS-Fuzz projects, build_benchmark cannot be run
177+
# twice in the same directory without this.
178+
utils.build_benchmark()
179+
180+
if 'cmplog' in build_modes and 'qemu' not in build_modes:
181+
182+
# CmpLog requires an build with different instrumentation.
183+
new_env = os.environ.copy()
184+
new_env['AFL_LLVM_CMPLOG'] = '1'
185+
186+
# For CmpLog build, set the OUT and FUZZ_TARGET environment
187+
# variable to point to the new CmpLog build directory.
188+
cmplog_build_directory = get_cmplog_build_directory(build_directory)
189+
os.mkdir(cmplog_build_directory)
190+
new_env['OUT'] = cmplog_build_directory
191+
fuzz_target = os.getenv('FUZZ_TARGET')
192+
if fuzz_target:
193+
new_env['FUZZ_TARGET'] = os.path.join(cmplog_build_directory,
194+
os.path.basename(fuzz_target))
195+
196+
print('Re-building benchmark for CmpLog fuzzing target')
197+
utils.build_benchmark(env=new_env)
198+
199+
if 'symcc' in build_modes:
200+
201+
symcc_build_directory = get_uninstrumented_build_directory(
202+
build_directory)
203+
os.mkdir(symcc_build_directory)
204+
205+
# symcc requires an build with different instrumentation.
206+
new_env = os.environ.copy()
207+
new_env['CC'] = '/symcc/build/symcc'
208+
new_env['CXX'] = '/symcc/build/sym++'
209+
new_env['SYMCC_OUTPUT_DIR'] = '/tmp'
210+
new_env['CXXFLAGS'] = new_env['CXXFLAGS'].replace('-stlib=libc++', '')
211+
new_env['FUZZER_LIB'] = '/libfuzzer-harness.o'
212+
new_env['OUT'] = symcc_build_directory
213+
new_env['SYMCC_LIBCXX_PATH'] = '/libcxx_native_build'
214+
new_env['SYMCC_NO_SYMBOLIC_INPUT'] = '1'
215+
new_env['SYMCC_SILENT'] = '1'
216+
217+
# For symcc build, set the OUT and FUZZ_TARGET environment
218+
# variable to point to the new symcc build directory.
219+
new_env['OUT'] = symcc_build_directory
220+
fuzz_target = os.getenv('FUZZ_TARGET')
221+
if fuzz_target:
222+
new_env['FUZZ_TARGET'] = os.path.join(symcc_build_directory,
223+
os.path.basename(fuzz_target))
224+
225+
print('Re-building benchmark for symcc fuzzing target')
226+
utils.build_benchmark(env=new_env)
227+
228+
shutil.copy('/afl/afl-fuzz', build_directory)
229+
if os.path.exists('/afl/afl-qemu-trace'):
230+
shutil.copy('/afl/afl-qemu-trace', build_directory)
231+
if os.path.exists('/aflpp_qemu_driver_hook.so'):
232+
shutil.copy('/aflpp_qemu_driver_hook.so', build_directory)
233+
if os.path.exists('/get_frida_entry.sh'):
234+
shutil.copy('/afl/afl-frida-trace.so', build_directory)
235+
shutil.copy('/get_frida_entry.sh', build_directory)
236+
237+
238+
# pylint: disable=too-many-arguments
239+
def fuzz(input_corpus,
240+
output_corpus,
241+
target_binary,
242+
flags=tuple(),
243+
skip=False,
244+
no_cmplog=False): # pylint: disable=too-many-arguments
245+
"""Run fuzzer."""
246+
# Calculate CmpLog binary path from the instrumented target binary.
247+
target_binary_directory = os.path.dirname(target_binary)
248+
cmplog_target_binary_directory = (
249+
get_cmplog_build_directory(target_binary_directory))
250+
target_binary_name = os.path.basename(target_binary)
251+
cmplog_target_binary = os.path.join(cmplog_target_binary_directory,
252+
target_binary_name)
253+
254+
afl_fuzzer.prepare_fuzz_environment(input_corpus)
255+
# decomment this to enable libdislocator.
256+
# os.environ['AFL_ALIGNED_ALLOC'] = '1' # align malloc to max_align_t
257+
# os.environ['AFL_PRELOAD'] = '/afl/libdislocator.so'
258+
259+
flags = list(flags)
260+
261+
if os.path.exists('./afl++.dict'):
262+
flags += ['-x', './afl++.dict']
263+
264+
# Move the following to skip for upcoming _double tests:
265+
if os.path.exists(cmplog_target_binary) and no_cmplog is False:
266+
flags += ['-c', cmplog_target_binary]
267+
268+
#os.environ['AFL_IGNORE_TIMEOUTS'] = '1'
269+
os.environ['AFL_IGNORE_UNKNOWN_ENVS'] = '1'
270+
os.environ['AFL_FAST_CAL'] = '1'
271+
os.environ['AFL_NO_WARN_INSTABILITY'] = '1'
272+
os.environ['AFL_NO_SYNC'] = '1'
273+
274+
if not skip:
275+
os.environ['AFL_DISABLE_TRIM'] = '1'
276+
os.environ['AFL_CMPLOG_ONLY_NEW'] = '1'
277+
if 'ADDITIONAL_ARGS' in os.environ:
278+
flags += os.environ['ADDITIONAL_ARGS'].split(' ')
279+
280+
afl_fuzzer.run_afl_fuzz(input_corpus,
281+
output_corpus,
282+
target_binary,
283+
additional_flags=flags)

‎fuzzers/aflplusplus_t1/runner.Dockerfile

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Copyright 2020 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
FROM gcr.io/fuzzbench/base-image
16+
17+
# This makes interactive docker runs painless:
18+
ENV LD_LIBRARY_PATH="$LD_LIBRARY_PATH:/out"
19+
#ENV AFL_MAP_SIZE=2621440
20+
ENV PATH="$PATH:/out"
21+
ENV AFL_SKIP_CPUFREQ=1
22+
ENV AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
23+
ENV AFL_TESTCACHE_SIZE=2
24+
# RUN apt-get update && apt-get upgrade && apt install -y unzip git gdb joe

0 commit comments

Comments
 (0)