mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
George Dunlap
2b1cde7783
Finding aggregate coverage for a set of test files means running each afl-generated test case through the harness. At the moment, this is done by re-executing afl-harness-cov with each input file. When a large number of test cases have been generated, this can take a significant amonut of time; a recent test with 30k total files generated by 4 parallel fuzzers took over 7 minutes. The vast majority of this time is taken up with 'exec', however. Since the harness is already designed to loop over multiple inputs for llvm "persistent mode", just allow it to take a large number of inputs on the same when *not* running in llvm "persistent mode".. Then the command can be efficiently executed like this: ls */queue/id* | xargs $path/afl-harness-cov For the above-mentioned test on 30k files, the time to generate coverage data was reduced from 7 minutes to under 30 seconds. Signed-off-by: George Dunlap <george.dunlap@citrix.com> Acked-by: Jan Beulich <jbeulich@suse.com> Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
65 lines
2.0 KiB
Plaintext
65 lines
2.0 KiB
Plaintext
# OVERVIEW
|
|
|
|
Some fuzzing targets have American Fuzzy Lop (AFL) support.
|
|
|
|
See also http://lcamtuf.coredump.cx/afl/
|
|
|
|
# HOW IT WORKS
|
|
|
|
AFL provides a customised toolchain to build an executable, which in
|
|
turn is launched by the fuzzer.
|
|
|
|
# HOW TO USE IT
|
|
|
|
Use the x86 instruction emulator fuzzer as an example.
|
|
|
|
1. download and compile AFL in $AFLPATH.
|
|
|
|
2. run the following commands to build:
|
|
$ cd tools/fuzz/x86_instruction_emulator
|
|
$ make distclean
|
|
|
|
If you have a new enough version of Clang/LLVM and have configured AFL's
|
|
llvm_mode, make use of afl-clang-fast:
|
|
|
|
$ make CC=$AFLPATH/afl-clang-fast afl # produces afl-harness
|
|
|
|
If not, use the default afl-gcc:
|
|
|
|
$ make CC=$AFLPATH/afl-gcc afl # produces afl-harness
|
|
|
|
3. provide initial test case (fuzzer dependent, see afl-*.c):
|
|
$ mkdir testcase_dir
|
|
$ dd if=/dev/urandom of=testcase_dir/rand.bin \
|
|
bs=`./afl-harness --min-input-size` count=1
|
|
|
|
3a. use a tmpfs for findings_dir (Perf improvement and reduced disk load)
|
|
$ mkdir findings_dir
|
|
$ mount -t tmpfs -o size=512M tmpfs findings_dir
|
|
|
|
4. run the fuzzer with AFL:
|
|
$ $AFLPATH/afl-fuzz -t 1000 -i testcase_dir -o findings_dir -- ./afl-harness
|
|
|
|
Please see AFL documentation for more information.
|
|
|
|
# GENERATING COVERAGE INFORMATION
|
|
|
|
To use afl-cov or gcov, you need a separate binary instrumented to
|
|
generate coverage data. To do this, use the target `afl-cov`:
|
|
|
|
$ make afl-cov #produces afl-harness-cov
|
|
|
|
In order to speed up the process of checking total coverage,
|
|
`afl-harness-cov` can take several test inputs on its command-line;
|
|
the speed-up effect should be similar to that of using afl-clang-fast.
|
|
You can use xargs to do this most efficiently, like so:
|
|
|
|
$ ls queue/id* | xargs $path/afl-harness-cov
|
|
|
|
NOTE: Please also note that the coverage instrumentation hard-codes
|
|
the absolute path for the instrumentation read and write files in the
|
|
binary; so coverage data will always show up in the build directory no
|
|
matter where you run the binary from.
|
|
|
|
Please see afl-cov and/or gcov documentation for more information.
|