Skip to content

Commit cb471a9

Browse files
rmalmaintokatoka
rmalmain
and
tokatoka
authored
Move to just (binary_only / full_system) (#2949)
* just port for binary only / systemmode fuzzers * introduce just libraries, with pre-initialized variables and common recipes --------- Co-authored-by: Dongjia "toka" Zhang <[email protected]>
1 parent 99e763f commit cb471a9

File tree

59 files changed

+1060
-2923
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

59 files changed

+1060
-2923
lines changed

‎.devcontainer/devcontainer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
// "forwardPorts": [],
2424
// Uncomment the next line to run commands after the container is created - for example installing curl.
2525
// Install development components that shouldn't be in the main Dockerfile
26-
"postCreateCommand": "rustup component add --toolchain nightly rustfmt clippy llvm-tools-preview && cargo binstall --locked cargo-make",
26+
"postCreateCommand": "rustup component add --toolchain nightly rustfmt clippy llvm-tools-preview",
2727
// Uncomment when using a ptrace-based debugger like C++, Go, and Rust
2828
"runArgs": [
2929
"--cap-add=SYS_PTRACE",

‎.github/workflows/build_and_test.yml

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@ jobs:
259259
# Binary-only
260260
- ./fuzzers/binary_only/fuzzbench_fork_qemu
261261
- ./fuzzers/binary_only/frida_executable_libpng
262-
- ./fuzzers/binary_only/frida_windows_gdiplus
262+
# - ./fuzzers/binary_only/frida_windows_gdiplus
263263
- ./fuzzers/binary_only/frida_libpng
264264
- ./fuzzers/binary_only/fuzzbench_qemu
265265
- ./fuzzers/binary_only/intel_pt_baby_fuzzer
@@ -291,7 +291,6 @@ jobs:
291291

292292
# In-process
293293
- ./fuzzers/fuzz_anything/cargo_fuzz
294-
# - ./fuzzers/inprocess/dynamic_analysis
295294
- ./fuzzers/inprocess/fuzzbench
296295
- ./fuzzers/inprocess/fuzzbench_text
297296
- ./fuzzers/inprocess/fuzzbench_ctx
@@ -303,10 +302,10 @@ jobs:
303302
- ./fuzzers/inprocess/libfuzzer_libpng_cmin
304303
- ./fuzzers/inprocess/libfuzzer_libpng_norestart
305304
# - ./fuzzers/inprocess/libfuzzer_libpng_tcp_manager
305+
# - ./fuzzers/inprocess/libfuzzer_windows_asan
306306
- ./fuzzers/inprocess/libfuzzer_stb_image_sugar
307307
- ./fuzzers/inprocess/libfuzzer_stb_image
308308
# - ./fuzzers/structure_aware/libfuzzer_stb_image_concolic
309-
# - ./fuzzers/inprocess/libfuzzer_windows_asan
310309
# - ./fuzzers/inprocess/sqlite_centralized_multi_machine
311310

312311
# Fuzz Anything
@@ -429,9 +428,9 @@ jobs:
429428
- uses: actions/checkout@v4
430429
- uses: ./.github/workflows/windows-tester-prepare
431430
- name: Build fuzzers/binary_only/frida_libpng
432-
run: cd fuzzers/binary_only/frida_libpng/ && cargo make test
431+
run: cd fuzzers/binary_only/frida_libpng/ && just test
433432

434-
windows-frida-libfuzzer-stb-image:
433+
windows-libfuzzer-stb-image:
435434
runs-on: windows-latest
436435
needs:
437436
- common
@@ -441,6 +440,16 @@ jobs:
441440
- name: Build fuzzers/inprocess/libfuzzer_stb_image
442441
run: cd fuzzers/inprocess/libfuzzer_stb_image && cargo build --release
443442

443+
windows-libfuzzer-asan:
444+
runs-on: windows-latest
445+
needs:
446+
- common
447+
steps:
448+
- uses: actions/checkout@v4
449+
- uses: ./.github/workflows/windows-tester-prepare
450+
- name: Build fuzzers/inprocess/libfuzzer_windows_asan
451+
run: cd fuzzers/inprocess/libfuzzer_windows_asan && just test
452+
444453
windows-frida-gdiplus:
445454
runs-on: windows-latest
446455
needs:
@@ -449,7 +458,7 @@ jobs:
449458
- uses: actions/checkout@v4
450459
- uses: ./.github/workflows/windows-tester-prepare
451460
- name: Build fuzzers/binary_only/frida_windows_gdiplus
452-
run: cd fuzzers/binary_only/frida_windows_gdiplus/ && cargo make test && cargo make test_cmplog
461+
run: cd fuzzers/binary_only/frida_windows_gdiplus/ && just test && just test_cmplog
453462

454463
windows-tinyinst-simple:
455464
runs-on: windows-latest
@@ -461,7 +470,7 @@ jobs:
461470
- uses: actions/checkout@v4
462471
- uses: ./.github/workflows/windows-tester-prepare
463472
- name: Build fuzzers/binary_only/tinyinst_simple
464-
run: cd fuzzers/binary_only/tinyinst_simple/ && cargo make test
473+
run: cd fuzzers/binary_only/tinyinst_simple/ && just test
465474

466475
windows-clippy:
467476
runs-on: windows-latest

‎.github/workflows/fuzzer-tester-prepare/action.yml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,6 @@ runs:
2222
- name: Add wasm target
2323
shell: bash
2424
run: rustup target add wasm32-unknown-unknown
25-
- name: install cargo-make
26-
uses: baptiste0928/cargo-install@v3
27-
with:
28-
crate: cargo-make
2925
- name: install just
3026
uses: extractions/setup-just@v2
3127
with:

‎.github/workflows/qemu-fuzzer-tester-prepare/action.yml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,6 @@ runs:
1010
- name: enable mult-thread for `make`
1111
shell: bash
1212
run: export MAKEFLAGS="-j$(expr $(nproc) \+ 1)"
13-
- name: install cargo-make
14-
uses: baptiste0928/cargo-install@v3
15-
with:
16-
crate: cargo-make
1713
- name: install just
1814
uses: extractions/setup-just@v2
1915
with:

‎.github/workflows/windows-tester-prepare/action.yml

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,6 @@ runs:
1515
- name: Set LIBCLANG_PATH
1616
shell: pwsh
1717
run: echo "LIBCLANG_PATH=$((gcm clang).source -replace "clang.exe")" >> $env:GITHUB_ENV
18-
- name: install cargo-make
19-
shell: pwsh
20-
run: cargo install --force cargo-make
2118
- name: install just
2219
uses: extractions/setup-just@v2
2320
with:

‎README.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,8 @@ LibAFL is fast, multi-platform, no_std compatible, and scales over cores and mac
2929
- **LLVM tools**
3030
- The LLVM tools (including clang, clang++) are needed (newer than LLVM 15.0.0 up to LLVM 18.1.3) If you are using Debian/Ubuntu, again, we highly recommmend that you install the package from [here](https://apt.llvm.org/)
3131
- (In `libafl_concolic`, we only support LLVM version newer than 18)
32-
- Cargo-make:
33-
- We use cargo-make to build the fuzzers in `fuzzers/` directory. You can install it with `cargo install cargo-make`
32+
- Just:
33+
- We use [just](https://github.com/casey/just) to build the fuzzers in `fuzzers/` directory. You can find instructions to install it in your environment [in the Just Programmer's Manual](https://just.systems/man/en/packages.html).
3434

3535
#### Clone the LibAFL repository with
3636
```sh
@@ -52,9 +52,9 @@ cd docs && mdbook serve
5252
We collect all example fuzzers in [`./fuzzers`](./fuzzers/).
5353
Be sure to read their documentation (and source), this is *the natural way to get started!*
5454
```sh
55-
cargo make run
55+
just run
5656
```
57-
You can run each example fuzzer with this following command, as long as the fuzzer directory has `Makefile.toml` file. The best-tested fuzzer is [`./fuzzers/inprocess/libfuzzer_libpng`](./fuzzers/inprocess/libfuzzer_libpng), a multicore libfuzzer-like fuzzer using LibAFL for a libpng harness.
57+
You can run each example fuzzer with this following command, as long as the fuzzer directory has a `Justfile` file. The best-tested fuzzer is [`./fuzzers/inprocess/libfuzzer_libpng`](./fuzzers/inprocess/libfuzzer_libpng), a multicore libfuzzer-like fuzzer using LibAFL for a libpng harness.
5858

5959
### Resources
6060
- [Installation guide](./docs/src/getting_started/setup.md)

‎fuzzers/binary_only/frida_executable_libpng/Justfile

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
import "../../../just/libafl.just"
2+
3+
FUZZER_NAME := "libfrida_executable_fuzzer"
4+
FUZZER_LIB := FUZZER + ".so"
5+
6+
[unix]
7+
libpng:
8+
#!/bin/bash
9+
if [ ! -f v1.6.37.tar.gz ]; then
10+
wget https://github.com/glennrp/libpng/archive/refs/tags/v1.6.37.tar.gz
11+
fi
12+
tar -xvf v1.6.37.tar.gz
13+
14+
[unix]
15+
lib: libpng
16+
cd libpng-1.6.37 && ./configure --enable-shared=no --with-pic=yes --enable-hardware-optimizations=yes
17+
make -j -C libpng-1.6.37
18+
19+
[unix]
20+
harness: lib
21+
clang++ -O0 -c -fPIC harness.cc -o harness.o
22+
clang++ -O0 harness.cc libpng-1.6.37/.libs/libpng16.a -lz -o libpng-harness -g
23+
24+
[unix]
25+
build:
26+
cargo build --profile {{ PROFILE }}
27+
28+
[unix]
29+
run: build harness
30+
LD_PRELOAD={{ FUZZER_LIB }} ./libpng-harness -i corpus -o out -H ./libpng-harness
31+
32+
[unix]
33+
test: build harness
34+
#!/bin/bash
35+
36+
rm -rf libafl_unix_shmem_server || true
37+
LD_PRELOAD={{ FUZZER_LIB }} ./libpng-harness -i corpus -o out -H ./libpng-harness > fuzz_stdout.log &
38+
sleep 10s && pkill libpng-harness
39+
if grep -qa "corpus: 30" fuzz_stdout.log; then
40+
echo "Fuzzer is working"
41+
else
42+
echo "Fuzzer does not generate any testcases or any crashes"
43+
exit 1
44+
fi
45+
46+
[unix]
47+
clean:
48+
rm -rf ./libpng-harness
49+
make -C libpng-1.6.37 clean
50+
cargo clean

‎fuzzers/binary_only/frida_executable_libpng/Makefile.toml

Lines changed: 0 additions & 120 deletions
This file was deleted.

‎fuzzers/binary_only/frida_libpng/Justfile

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
import "../../../just/libafl.just"
2+
3+
FUZZER_NAME := "frida_fuzzer"
4+
FUZZER_NAME_WIN := "frida_fuzzer.exe"
5+
6+
set windows-shell := ['cmd.exe', '/c']
7+
set unstable
8+
9+
[unix]
10+
libpng:
11+
#!/bin/bash
12+
if [ ! -f v1.6.37.tar.gz ]; then
13+
wget https://github.com/glennrp/libpng/archive/refs/tags/v1.6.37.tar.gz
14+
fi
15+
tar -xvf v1.6.37.tar.gz
16+
17+
[unix]
18+
lib: libpng
19+
cd libpng-1.6.37 && ./configure --enable-shared=no --with-pic=yes --enable-hardware-optimizations=yes
20+
make -j -C libpng-1.6.37
21+
22+
[unix]
23+
harness: lib
24+
clang++ -O3 -c -fPIC harness.cc -o harness.o
25+
clang++ -O3 harness.o libpng-1.6.37/.libs/libpng16.a -shared -lz -o libpng-harness.so
26+
27+
[windows]
28+
harness:
29+
cl /c harness_win.cpp && link harness_win.obj /dll
30+
31+
[unix]
32+
[windows]
33+
build:
34+
cargo build --profile {{ PROFILE }}
35+
36+
[unix]
37+
run: build harness
38+
{{ FUZZER }} -F LLVMFuzzerTestOneInput -H ./libpng-harness.so -l ./libpng-harness.so
39+
40+
[windows]
41+
run: build harness
42+
{{TARGET_DIR}}\{{PROFILE}}\{{FUZZER_NAME_WIN}} -F LLVMFuzzerTestOneInput -H .\harness_win.dll -l .\harness_win.dll --cores=0
43+
44+
[unix]
45+
test: build harness
46+
#!/bin/bash
47+
48+
rm -rf libafl_unix_shmem_server || true
49+
timeout 30s {{ FUZZER }} -F LLVMFuzzerTestOneInput -H ./libpng-harness.so -l ./libpng-harness.so | tee fuzz_stdout.log 2>/dev/null || true
50+
if grep -qa "corpus: 70" fuzz_stdout.log; then
51+
echo "Fuzzer is working"
52+
else
53+
echo "Fuzzer does not generate any testcases or any crashes"
54+
exit 1
55+
fi
56+
57+
[windows]
58+
[script("cmd.exe", "/c")]
59+
test: build harness
60+
start "" "{{TARGET_DIR}}\{{PROFILE}}\{{FUZZER_NAME_WIN}}" -F LLVMFuzzerTestOneInput -H .\harness_win.dll -l .\harness_win.dll --cores=0
61+
ping -n 10 127.0.0.1>NUL && taskkill /im frida_fuzzer.exe /F
62+
dir /a-d corpus_discovered && (echo Files exist) || (exit /b 1337)
63+
64+
[unix]
65+
clean:
66+
make -C libpng-1.6.37 clean
67+
cargo clean

0 commit comments

Comments
 (0)