Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create a build of mddump for fuzzing of the dnmd lib #24

Open
AaronRobinsonMSFT opened this issue Mar 8, 2023 · 3 comments
Open

Create a build of mddump for fuzzing of the dnmd lib #24

AaronRobinsonMSFT opened this issue Mar 8, 2023 · 3 comments
Labels
enhancement New feature or request

Comments

@AaronRobinsonMSFT
Copy link
Owner

AaronRobinsonMSFT commented Mar 8, 2023

See https://llvm.org/docs/LibFuzzer.html

@AaronRobinsonMSFT AaronRobinsonMSFT added the enhancement New feature or request label Mar 8, 2023
@AaronRobinsonMSFT
Copy link
Owner Author

/cc @agocke

@agocke
Copy link

agocke commented Mar 14, 2023

I used afl++ because it's notoriously simple to set up. I'm running Ubuntu 22.04 in WSL2.

Generate with:

cmake -DCMAKE_C_COMPILERC=afl-cc -DCMAKE_CXX_COMPILER=afl-c++ -S . -B artifacts -DCMAKE_BUILD_TYPE=Release

First, install using apt install afl. Next, compile mddump using the instrumenting compilers:

CC=afl-cc CXX=afl-c++ cmake --build artifacts --target mddump

Finally, set up and run AFL. Start by creating a beginning seed. I used the DLL from hello world. Add it to a new seeds_dir.

Then, run AFL with the command

afl-fuzz -i seeds_dir -o output_dir -- artifacts/src/mddump/mddump @@

It will use the files in the seeds_dir to mutate during the fuzzing. The @@ option says "my input is a path to a file", which AFL which generate for you.

This pops up an interactive window that shows you the AFL progress and the crashes it's generating. The output DLLs will be put in output_dir, so you can feed them back into mddump to see the crash in GDB.

@AaronRobinsonMSFT
Copy link
Owner Author

/cc @jkoritzinsky

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants