StdFuzzer - StdFuzzer is the reference implementation of a generic bit-level fuzzer with LibAFL

Related tags

Overview

StdFuzzer

StdFuzzer is the reference implementation of a generic bit-level fuzzer with LibAFL

Building

Build with

$ cargo build --release

Compiling a target

Compile a target setting the compiler wrappers for C and C++ as compilers in the build system.

For instance:

$ CC=/path/to/StdFuzzer/target/build/libafl_cc CXX=/path/to/StdFuzzer/target/build/libafl_cxx ./configure
$ make

This fuzzer assumes that the target is exporting a LibFuzzer harness (LLVMTestOneInput).

Run the fuzzer

Take the output harness binary and execute with -h to see the required command line:

$ ./harness -h
StdFuzzer 0.1.0
Andrea Fioraldi <[email protected]>
StdFuzzer is the reference implementation of a generic bit-level fuzzer with LibAFL

USAGE:
    harness [OPTIONS] --cores <CORES> --broker-port <PORT>

FLAGS:
    -h, --help       Prints help information
    -V, --version    Prints version information

OPTIONS:
    -c, --cores <CORES>                  Spawn a client in each of the provided cores. Broker runs in the 0th core.
                                         'all' to select all available cores. 'none' to run a client without binding to
                                         any core. eg: '1,2-4,6' selects the cores 1,2,3,4,6.
    -i, --input <INPUT>...               Set an initial corpus directory
    -o, --output <OUTPUT>                Set the output directory, default is ./out [default: ./out]
    -p, --broker-port <PORT>             Choose the broker TCP port, default is 1337
    -a, --remote-broker-addr <REMOTE>    Specify a remote broker
    -t, --timeout <TIMEOUT>              Set the exeucution timeout in milliseconds, default is 1000 [default: 1000]
    -x, --tokens <TOKENS>...             Feed the fuzzer with an user-specified list of tokens (often called
                                         "dictionary"

You might also like...

Rust library to convert RGB 24-bit colors into ANSI 256 (8-bit) color codes with zero dependencies and at compile-time.

rgb2ansi256 rgb2ansi256 is a small Rust library to convert RGB 24-bit colors into ANSI 256 (8-bit) color codes with zero dependencies and const fn. Th

7 Nov 17, 2022

A bit like tee, a bit like script, but all with a fake tty. Lets you remote control and watch a process

teetty teetty is a wrapper binary to execute a command in a pty while providing remote control facilities. This allows logging the stdout of a process

259 Jan 3, 2023

An example fuzzer about how to fuzz a JS engine combinign Nautilus with Token-level fuzzing

LibAFL QuickJS Fuzzing Example An example fuzzer about how to fuzz a JS engine combinign Nautilus with Token-level fuzzing. Prepare Make sure to have

32 Dec 21, 2022

wait-free 4-level 64-bit pagetable for contiguous low-contention concurrent metadata

pagetable Wait-free 4-level page table that maps from a u64 key to an &AtomicU64 value. Page fan-out is 2^16. If a key doesn't exist, intermediate pag

21 Nov 20, 2022

The reference implementation of the Linux FUSE (Filesystem in Userspace) interface

libfuse About FUSE (Filesystem in Userspace) is an interface for userspace programs to export a filesystem to the Linux kernel. The FUSE project consi

4.2k Jan 4, 2023

Reference implementation for the Poseidon Snark-friendly Hash algorithm.

Dusk-Poseidon Reference implementation for the Poseidon Hashing algorithm. Reference Starkad and Poseidon: New Hash Functions for Zero Knowledge Proof

96 Jan 2, 2023

Command line interface for BDSP RNG, primarily used as a reference implementation and as a tool for testing.

BDSP RNG Reference This is a command line interface for BDSP RNG, primarily used as a reference implementation and as a tool for testing. Building Bui

2 Nov 20, 2022

Reference implementation of a full-stack Rust application

Full-stack Rust with WebAssembly Look Ma, No JavaScript !!! My very first Rust project (implementation of the "Connect 5" game), I used as a learning

64 Dec 27, 2022

Reference implementation of a decentralized exchange for custom instruments, risk, and fees

Dexterity What is Dexterity At a high level, Dexterity is a smart contract (or collection of smart contracts) that allow for the creation of a decentr

43 Dec 15, 2022

Neptune-core is the reference implementation for the Neptune protocol

Neptune Core Neptune-core is the reference implementation for the Neptune protocol. The implementation is not complete yet, but already supports many

6 Jul 10, 2023

SD-JWT Rust Reference Implementation

SD-JWT Rust Reference Implementation This is the reference implementation of the IETF SD-JWT specification written in Rust. Supported version: 6. Note

4 Dec 19, 2023

A naive native 128-bit cityhash v102 implementation

Naive CityHash naive-cityhash is a naive native 128-bit cityhash v102 implementation for clickhouse*. Contact Chojan Shang - @PsiACE - psiace@outlook.

5 Apr 4, 2022

A Rust implementation of generic prefix tree (trie) map with wildcard capture support

prefix_tree_map A Rust implementation of generic prefix tree (trie) map with wildcard capture support. Design Trie is a good data structure for storin

3 Dec 6, 2022

Generic k-means implementation written in Rust

RKM - Rust k-means A simple Rust implementation of the k-means clustering algorithm based on a C++ implementation, dkm. This implementation is generic

8 Sep 25, 2021

Generic framebuffer implementation in Rust for use with embedded-graphics library

Fraramebuffer implementation for Rust's Embedded-graphics Framebuffer approach helps to deal with display flickering when you update multiple parts of

9 Nov 29, 2022

A lightweight Rust library for BitVector Rank&Select operations, coupled with a generic Sparse Array implementation

5 Jun 20, 2022

Implementation of generic IBC queries in CosmWasm.

CosmWasm IBC Queries Implements generic IBC queries in CosmWasm. This implementation requires the same contract to be deployed on both chains wishing

17 Oct 6, 2022

A timer toolkit that is generic over the underlying timer implementation.

timer-kit A timer toolkit that is generic over the underlying timer implementation. This crate does not implement any platform-specific timer but uses

4 Mar 4, 2023

a hack implementation of CCS generic arithmetization, won a prize at Zuzalu hackathon 2023 despite incompleteness

ccs-hack CCS (Customized Constraint System) is a generic constraints representation system can simultaneously capture R1CS, Plonkish, and AIR: $$\sum_

27 Jun 1, 2023

Comments

Error when compiling SerenityOS fuzzer multiple definition of __sanitizer_cov_trace_const_cmp

When I compiling SerenityOS with StdFuzzer it return an error. Here is command I used to compile SerenityOS

sudo apt-get install -y libboost-all-dev build-essential cmake curl e2fsprogs libmpfr-dev libmpc-dev libgmp-dev ninja-build unzip qemu-system-i386 qemu-utils ccache rsync libgsf-1-dev
git clone https://github.com/SerenityOS/serenity.git; cd serenity
cmake -GNinja -S Meta/Lagom -B Build/lagom-fuzzers \
  -DBUILD_LAGOM=ON \
  -DENABLE_FUZZER_SANITIZER=ON \
  -DENABLE_ADDRESS_SANITIZER=ON \
  -DCMAKE_CXX_COMPILER=$HOME/StdFuzzer/target/release/libafl_cxx \
  -DCMAKE_C_COMPILER=$HOME/StdFuzzer/target/release/libafl_cc
cd Build/lagom-fuzzers
ninja

Here is the error log

cityoflight@SerenityOS:~/serenity/Build/lagom-fuzzers$ ninja
[0/2] Re-checking globbed directories...
[244/638] Linking CXX executable Fuzzers/FuzzZip
FAILED: Fuzzers/FuzzZip
: && /home/cityoflight/StdFuzzer/target/release/libafl_cxx    -fsanitize=address Fuzzers/CMakeFiles/FuzzZip.dir/FuzzZip.cpp.o  -o Fuzzers/FuzzZip  -Wl,-rpath,/home/cityoflight/serenity/Build/lagom-fuzzers  liblagom-archive.so.0.0.0  liblagom-core.so.0.0.0  -fsanitize=fuzzer  -lcrypt && :
/usr/bin/ld: /home/cityoflight/StdFuzzer/target/release/libstdfuzzer.a(stdfuzzer-02081e40da0c85a2.stdfuzzer.3418a45c-cgu.0.rcgu.o): in function `__sanitizer_cov_trace_pc_guard':
/home/cityoflight/.cargo/git/checkouts/libafl-c33dc6f5ec2f7a70/906bb4e/libafl_targets/src/sancov_pcguard.rs:20: multiple definition of `__sanitizer_cov_trace_pc_guard'; /usr/lib/llvm-13/lib/clang/13.0.1/lib/linux/libclang_rt.fuzzer-x86_64.a(FuzzerTracePC.cpp.o):(.text.__sanitizer_cov_trace_pc_guard+0x0): first defined here
/usr/bin/ld: /home/cityoflight/StdFuzzer/target/release/libstdfuzzer.a(stdfuzzer-02081e40da0c85a2.stdfuzzer.3418a45c-cgu.0.rcgu.o): in function `__sanitizer_cov_trace_pc_guard_init':
/home/cityoflight/.cargo/git/checkouts/libafl-c33dc6f5ec2f7a70/906bb4e/libafl_targets/src/sancov_pcguard.rs:53: multiple definition of `__sanitizer_cov_trace_pc_guard_init'; /usr/lib/llvm-13/lib/clang/13.0.1/lib/linux/libclang_rt.fuzzer-x86_64.a(FuzzerTracePC.cpp.o):(.text.__sanitizer_cov_trace_pc_guard_init+0x0): first defined here
/usr/bin/ld: /home/cityoflight/StdFuzzer/target/release/libstdfuzzer.a(sancov_cmp.o): in function `__sanitizer_cov_trace_cmp1':
/home/cityoflight/.cargo/git/checkouts/libafl-c33dc6f5ec2f7a70/906bb4e/libafl_targets/src/sancov_cmp.c:11: multiple definition of `__sanitizer_cov_trace_cmp1'; /usr/lib/llvm-13/lib/clang/13.0.1/lib/linux/libclang_rt.fuzzer-x86_64.a(FuzzerTracePC.cpp.o):(.text.__sanitizer_cov_trace_cmp1+0x0): first defined here
/usr/bin/ld: /home/cityoflight/StdFuzzer/target/release/libstdfuzzer.a(sancov_cmp.o): in function `__sanitizer_cov_trace_cmp2':
/home/cityoflight/.cargo/git/checkouts/libafl-c33dc6f5ec2f7a70/906bb4e/libafl_targets/src/sancov_cmp.c:27: multiple definition of `__sanitizer_cov_trace_cmp2'; /usr/lib/llvm-13/lib/clang/13.0.1/lib/linux/libclang_rt.fuzzer-x86_64.a(FuzzerTracePC.cpp.o):(.text.__sanitizer_cov_trace_cmp2+0x0): first defined here
/usr/bin/ld: /home/cityoflight/StdFuzzer/target/release/libstdfuzzer.a(sancov_cmp.o): in function `__sanitizer_cov_trace_cmp4':
/home/cityoflight/.cargo/git/checkouts/libafl-c33dc6f5ec2f7a70/906bb4e/libafl_targets/src/sancov_cmp.c:43: multiple definition of `__sanitizer_cov_trace_cmp4'; /usr/lib/llvm-13/lib/clang/13.0.1/lib/linux/libclang_rt.fuzzer-x86_64.a(FuzzerTracePC.cpp.o):(.text.__sanitizer_cov_trace_cmp4+0x0): first defined here
/usr/bin/ld: /home/cityoflight/StdFuzzer/target/release/libstdfuzzer.a(sancov_cmp.o): in function `__sanitizer_cov_trace_cmp8':
/home/cityoflight/.cargo/git/checkouts/libafl-c33dc6f5ec2f7a70/906bb4e/libafl_targets/src/sancov_cmp.c:59: multiple definition of `__sanitizer_cov_trace_cmp8'; /usr/lib/llvm-13/lib/clang/13.0.1/lib/linux/libclang_rt.fuzzer-x86_64.a(FuzzerTracePC.cpp.o):(.text.__sanitizer_cov_trace_cmp8+0x0): first defined here
/usr/bin/ld: /home/cityoflight/StdFuzzer/target/release/libstdfuzzer.a(sancov_cmp.o): in function `__sanitizer_cov_trace_switch':
/home/cityoflight/.cargo/git/checkouts/libafl-c33dc6f5ec2f7a70/906bb4e/libafl_targets/src/sancov_cmp.c:75: multiple definition of `__sanitizer_cov_trace_switch'; /usr/lib/llvm-13/lib/clang/13.0.1/lib/linux/libclang_rt.fuzzer-x86_64.a(FuzzerTracePC.cpp.o):(.text.__sanitizer_cov_trace_switch+0x0): first defined here
/usr/bin/ld: /home/cityoflight/StdFuzzer/target/release/libstdfuzzer.a(sancov_cmp.o): in function `__sanitizer_cov_trace_const_cmp1':
/home/cityoflight/.cargo/git/checkouts/libafl-c33dc6f5ec2f7a70/906bb4e/libafl_targets/src/sancov_cmp.c:113: multiple definition of `__sanitizer_cov_trace_const_cmp1'; /usr/lib/llvm-13/lib/clang/13.0.1/lib/linux/libclang_rt.fuzzer-x86_64.a(FuzzerTracePC.cpp.o):(.text.__sanitizer_cov_trace_const_cmp1+0x0): first defined here
/usr/bin/ld: /home/cityoflight/StdFuzzer/target/release/libstdfuzzer.a(sancov_cmp.o): in function `__sanitizer_cov_trace_const_cmp2':
/home/cityoflight/.cargo/git/checkouts/libafl-c33dc6f5ec2f7a70/906bb4e/libafl_targets/src/sancov_cmp.c:117: multiple definition of `__sanitizer_cov_trace_const_cmp2'; /usr/lib/llvm-13/lib/clang/13.0.1/lib/linux/libclang_rt.fuzzer-x86_64.a(FuzzerTracePC.cpp.o):(.text.__sanitizer_cov_trace_const_cmp2+0x0): first defined here
/usr/bin/ld: /home/cityoflight/StdFuzzer/target/release/libstdfuzzer.a(sancov_cmp.o): in function `__sanitizer_cov_trace_const_cmp4':
/home/cityoflight/.cargo/git/checkouts/libafl-c33dc6f5ec2f7a70/906bb4e/libafl_targets/src/sancov_cmp.c:121: multiple definition of `__sanitizer_cov_trace_const_cmp4'; /usr/lib/llvm-13/lib/clang/13.0.1/lib/linux/libclang_rt.fuzzer-x86_64.a(FuzzerTracePC.cpp.o):(.text.__sanitizer_cov_trace_const_cmp4+0x0): first defined here
/usr/bin/ld: /home/cityoflight/StdFuzzer/target/release/libstdfuzzer.a(sancov_cmp.o): in function `__sanitizer_cov_trace_const_cmp8':
/home/cityoflight/.cargo/git/checkouts/libafl-c33dc6f5ec2f7a70/906bb4e/libafl_targets/src/sancov_cmp.c:125: multiple definition of `__sanitizer_cov_trace_const_cmp8'; /usr/lib/llvm-13/lib/clang/13.0.1/lib/linux/libclang_rt.fuzzer-x86_64.a(FuzzerTracePC.cpp.o):(.text.__sanitizer_cov_trace_const_cmp8+0x0): first defined here
clang: error: linker command failed with exit code 1 (use -v to see invocation)
[246/638] Building CXX object CMakeFiles/LagomJS.dir/hom...ty/Userland/Libraries/LibJS/Runtime/ArrayPrototype.cpp.o
ninja: build stopped: subcommand failed.

opened by CityOfLight77 1