mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
Andrew Cooper
69f4633817
AFL has an alternative llvm-base instrumentation mode, which has much lower overhead than the traditional afl-gcc. One extra ability is to chose exactly where the master process gets initialised to, before being forked for testing. This point is chosen after the call to LLVMFuzzerInitialize(), so the stack isn't being remapped executable for every test. Another extra ability is to feed multiple inputs into a single test process, to reduce the number of fork() calls required overall. Two caveats are that if stdin is used for data, it must be unbuffered, and if input is passed via a command line parameter, the underlying file must be opened and closed on each iteration. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Wei Liu <wei.liu2@citrix.com>
44 lines
1.2 KiB
Plaintext
44 lines
1.2 KiB
Plaintext
# OVERVIEW
|
|
|
|
Some fuzzing targets have American Fuzzy Lop (AFL) support.
|
|
|
|
See also http://lcamtuf.coredump.cx/afl/
|
|
|
|
# HOW IT WORKS
|
|
|
|
AFL provides a customised toolchain to build an executable, which in
|
|
turn is launched by the fuzzer.
|
|
|
|
# HOW TO USE IT
|
|
|
|
Use the x86 instruction emulator fuzzer as an example.
|
|
|
|
1. download and compile AFL in $AFLPATH.
|
|
|
|
2. run the following commands to build:
|
|
$ cd tools/fuzz/x86_instruction_emulator
|
|
$ make distclean
|
|
|
|
If you have a new enough version of Clang/LLVM and have configured AFL's
|
|
llvm_mode, make use of afl-clang-fast:
|
|
|
|
$ make CC=$AFLPATH/afl-clang-fast afl # produces afl-harness
|
|
|
|
If not, use the default afl-gcc:
|
|
|
|
$ make CC=$AFLPATH/afl-gcc afl # produces afl-harness
|
|
|
|
3. provide initial test case (fuzzer dependent, see afl-*.c):
|
|
$ mkdir testcase_dir
|
|
$ dd if=/dev/urandom of=testcase_dir/rand.bin \
|
|
bs=`./afl-harness --min-input-size` count=1
|
|
|
|
3a. use a tmpfs for findings_dir (Perf improvement and reduced disk load)
|
|
$ mkdir findings_dir
|
|
$ mount -t tmpfs -o size=512M tmpfs findings_dir
|
|
|
|
4. run the fuzzer with AFL:
|
|
$ $AFLPATH/afl-fuzz -t 1000 -i testcase_dir -o findings_dir -- ./afl-harness
|
|
|
|
Please see AFL documentation for more information.
|