infra: add support for non-persistent mode AFL #7343

DavidKorczynski · 2022-03-01T19:30:15Z

Also adds an example of using it.

DavidKorczynski · 2022-03-01T19:34:23Z

@vanhauser-thc I would like to add some fuzzers that uses non-persistent afl++ fuzzing, and by the looks of it this could be achieved without major changes. I added a simple example from binutils (but have some other examples to include down the line). Could you give this a review?

projects/binutils/fuzz_readelf_non_persistent.c

jonathanmetzman · 2022-03-01T21:51:23Z

infra/base-images/base-runner/run_fuzzer

@@ -132,6 +132,10 @@ if [[ "$FUZZING_ENGINE" = afl ]]; then

  CMD_LINE="$OUT/afl-fuzz $AFL_FUZZER_ARGS -i $CORPUS_DIR -o $FUZZER_OUT $(get_dictionary) $* -- $OUT/$FUZZER"

+  if [[ "$FUZZER" == *"non_persistent"* ]]; then


Maybe put a TODO here to reference an issue for a long term solution to identifying non-persistent AFL fuzz targets.

@vanhauser-thc Do you have an ideas about how we can identify if a fuzz target uses persistent mode or not?
We can't just look for __afl_manual_init can we?
Note that LLVMFuzzerTestOneInput will also be in the binary so that the rest of the infra can identify it as a fuzz target.

Thanks, can you change this to TODO(https://github.com/google/oss-fuzz/issues/7347):...?

the AFL way is to check for the string ##SIG_AFL_PERSISTENT## in the binary. if that is present, then it is persistent.
for deferred forkserver it is ##SIG_AFL_DEFER_FORKSRV##
note that you can have the forkserver (well you should have one, better performance) without persistent mode - and vice versa.

note that you can have the forkserver (well you should have one, better performance) without persistent mode - and vice versa.

Interesting -- is this by setting N here to 1 https://github.com/AFLplusplus/AFLplusplus/blob/1d4f1e48797c064ee71441ba555b29fc3f467983/utils/aflpp_driver/aflpp_driver.c#L336 using this logic https://github.com/AFLplusplus/AFLplusplus/blob/1d4f1e48797c064ee71441ba555b29fc3f467983/utils/aflpp_driver/aflpp_driver.c#L306 ?

no.
if you use the aflpp driver you automatically have persistent mode. (and a deferred forkserver).
for non-persistent mode you dont need to (and you should not) use aflppdriver

Hey David can you implement a solution based on Marc's feedback.
Basically check if the binary doesn't contain ##SIG_AFL_PERSISTENT## and then treat it as non-persistent.

jonathanmetzman · 2022-03-02T06:58:03Z

Related: #7347

projects/binutils/fuzz_readelf_non_persistent.c

jonathanmetzman

lgtm except for my main gripe

jonathanmetzman · 2022-10-20T14:57:17Z

infra/base-images/base-runner/run_fuzzer

@@ -132,6 +132,10 @@ if [[ "$FUZZING_ENGINE" = afl ]]; then

  CMD_LINE="$OUT/afl-fuzz $AFL_FUZZER_ARGS -i $CORPUS_DIR -o $FUZZER_OUT $(get_dictionary) $* -- $OUT/$FUZZER"

+  if [[ "$FUZZER" == *"non_persistent"* ]]; then


Hey David can you implement a solution based on Marc's feedback.
Basically check if the binary doesn't contain ##SIG_AFL_PERSISTENT## and then treat it as non-persistent.

DavidKorczynski · 2022-10-20T15:11:01Z

lgtm except for my main gripe

will fix this up shortly.

Do you prefer for me to remake this as a PR on a non-fork?

vanhauser-thc · 2022-10-20T15:56:22Z

infra/base-images/base-runner/run_fuzzer

+  # TODO: come up with a better solution for indicating when a
+  # fuzzer is not in persistent mode.
+  if [[ "$FUZZER" == *"non_persistent"* ]]; then
+    CMD_LINE="$CMD_LINE @@"


are all non-persistent targets called like this: ./target inputfile? without any other command line options? If not maybe this needs a `target.nonpersistent" config file that defines how the target is to be called.
and note that afl++ can also send on stdin

Yeah exactly, I'm going to make an API for doing this in the .options file we already support.

Why don't we always add the @@ here? That way we don't need to scan the binary, oss fuzz doesn't have to care

a) because otherwise it is not needed, b) I am not sure if the current commit on oss-fuzz of afl++ is one that works fine, or is an older one that has that strong performance decrease otherwise. I want to push an update, but not before next week.

Understood.
I'm just saying, not having to grep through a potentially Chrome-sized binary vs adding an needless commandline flag may be worth it
Of course only makes sense if the target still works then (latest AFL++ version). Maybe keep it in mind :)

jonathanmetzman · 2022-10-20T16:31:43Z

Do you prefer for me to remake this as a PR on a non-fork?

Could you clarify this, not sure what it means?

DavidKorczynski · 2022-10-20T21:27:53Z

Could you clarify this, not sure what it means?

Ref: #7351 (comment)

If I should make this as a branch on github.com/google/oss-fuzz instead of github.com/DavidKorczynski/oss-fuzz so you can run trial builds?

jonathanmetzman · 2022-10-31T18:24:23Z

Could you clarify this, not sure what it means?

Ref: #7351 (comment)

If I should make this as a branch on github.com/google/oss-fuzz instead of github.com/DavidKorczynski/oss-fuzz so you can run trial builds?

Sorry for the late reply.
We can run trial builds on forks now.

DavidKorczynski · 2022-10-31T19:43:27Z

lgtm except for my main gripe

Fixed check if the binary doesn't contain ##SIG_AFL_PERSISTENT## and then treat it as non-persistent. in base runner. Can confirm it works.

evverx · 2023-05-02T13:25:43Z

It would be great if it was possible to resurrect this PR. The systemd project added a test based on a corpus produced by AFL++ in systemd/systemd#27458 the other day. It kind of works but the problem is that the binary has to be built and run manually elsewhere to be able to keep the corpus up to date. It would be easier if it was possible to offload that onto OSS-Fuzz.

evverx · 2023-05-07T15:59:59Z

Before I forget apart from systemd I think elfutils could benefit from this too. Its fuzz targets have blind spots: https://sourceware.org/pipermail/elfutils-devel/2023q1/005957.html and the easiest way to cover them would be to fuzz the binaries. (admittedly it wouldn't be the most efficient way to fuzz it though but until proper fuzz targets are implemented this approach could be used instead).

DavidKorczynski changed the title ~~infra: add support for persistent mode AFL~~ infra: add support for non-persistent mode AFL Mar 1, 2022

infra: add support for non-persistent mode AFL

1ee8bf1

Also adds an example of using it.

DavidKorczynski force-pushed the aflpp-non-persistent branch from ffba437 to 1ee8bf1 Compare March 1, 2022 19:31

jonathanmetzman reviewed Mar 1, 2022

View reviewed changes

DavidKorczynski added 3 commits March 1, 2022 22:24

make magic string explicit

1b3ec2f

add TODO

fffadd7

Only compile non_persistent fuzzer in afl mode

5ae7cc5

vanhauser-thc reviewed Mar 2, 2022

View reviewed changes

projects/binutils/fuzz_readelf_non_persistent.c Show resolved Hide resolved

DavidKorczynski mentioned this pull request Oct 20, 2022

Add the possibility to run binaries instead of libfuzzer harnesses #8818

Open

jonathanmetzman reviewed Oct 20, 2022

View reviewed changes

vanhauser-thc reviewed Oct 20, 2022

View reviewed changes

DavidKorczynski added 3 commits October 31, 2022 18:32

properly check fuzzer type

33fa484

Merge remote-tracking branch 'upstream/master' into aflpp-non-persistent

be05f2d

fix build

ca1074d

evverx mentioned this pull request Jun 11, 2023

Nallocfuzz: fuzzing engine to test allocations failure #9902

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

infra: add support for non-persistent mode AFL #7343

infra: add support for non-persistent mode AFL #7343

DavidKorczynski commented Mar 1, 2022 •

edited

Loading

DavidKorczynski commented Mar 1, 2022 •

edited

Loading

jonathanmetzman Mar 1, 2022

jonathanmetzman Mar 2, 2022

vanhauser-thc Mar 2, 2022

DavidKorczynski Mar 2, 2022

vanhauser-thc Mar 2, 2022

jonathanmetzman Oct 20, 2022

jonathanmetzman commented Mar 2, 2022

jonathanmetzman left a comment

jonathanmetzman Oct 20, 2022

DavidKorczynski commented Oct 20, 2022

vanhauser-thc Oct 20, 2022

jonathanmetzman Oct 20, 2022

domenukk Nov 9, 2022

vanhauser-thc Nov 9, 2022

domenukk Nov 9, 2022 •

edited

Loading

jonathanmetzman commented Oct 20, 2022

DavidKorczynski commented Oct 20, 2022

jonathanmetzman commented Oct 31, 2022

DavidKorczynski commented Oct 31, 2022

evverx commented May 2, 2023 •

edited

Loading

evverx commented May 7, 2023

		@@ -132,6 +132,10 @@ if [[ "$FUZZING_ENGINE" = afl ]]; then

		CMD_LINE="$OUT/afl-fuzz $AFL_FUZZER_ARGS -i $CORPUS_DIR -o $FUZZER_OUT $(get_dictionary) $* -- $OUT/$FUZZER"

		if [[ "$FUZZER" == "non_persistent" ]]; then

infra: add support for non-persistent mode AFL #7343

Are you sure you want to change the base?

infra: add support for non-persistent mode AFL #7343

Conversation

DavidKorczynski commented Mar 1, 2022 • edited Loading

DavidKorczynski commented Mar 1, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jonathanmetzman commented Mar 2, 2022

jonathanmetzman left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DavidKorczynski commented Oct 20, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

domenukk Nov 9, 2022 • edited Loading

Choose a reason for hiding this comment

jonathanmetzman commented Oct 20, 2022

DavidKorczynski commented Oct 20, 2022

jonathanmetzman commented Oct 31, 2022

DavidKorczynski commented Oct 31, 2022

evverx commented May 2, 2023 • edited Loading

evverx commented May 7, 2023

DavidKorczynski commented Mar 1, 2022 •

edited

Loading

DavidKorczynski commented Mar 1, 2022 •

edited

Loading

domenukk Nov 9, 2022 •

edited

Loading

evverx commented May 2, 2023 •

edited

Loading