ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-10 17:21:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1046 from WorksButNotTested/osx-lib

Browse Source 
Changes to add additional FASAN configurations to osx-lib
This commit is contained in:
van Hauser 2021-07-28 08:34:21 +02:00 committed by GitHub
commit 6d8813eb1a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 195 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
frida_mode/test/osx-lib/GNUmakefile
View File

@ -11,9 +11,15 @@ HARNESS_SRC:=$(PWD)harness.c
HARNESS2_BIN:=$(BUILD_DIR)harness2
HARNESS2_SRC:=$(PWD)harness2.c
HARNESS3_BIN:=$(BUILD_DIR)harness3
HARNESS3_SRC:=$(PWD)harness3.c
LIB_BIN:=$(BUILD_DIR)libcrashme.dylib
LIB_SRC:=$(PWD)lib.c
LIB2_BIN:=$(BUILD_DIR)libcrashme2.dylib
LIB2_SRC:=$(PWD)lib2.c
QEMU_OUT:=$(BUILD_DIR)qemu-out
FRIDA_OUT:=$(BUILD_DIR)frida-out
@ -22,8 +28,10 @@ LIB_CFLAGS:=-dynamiclib
GET_SYMBOL_ADDR:=$(ROOT)frida_mode/util/get_symbol_addr.sh
AFL_FRIDA_MAIN_ADDR=$(shell $(GET_SYMBOL_ADDR) $(HARNESS_BIN) main 0x0)
AFL_FRIDA_MAIN_ADDR2=$(shell $(GET_SYMBOL_ADDR) $(HARNESS2_BIN) main 0x0)
AFL_FRIDA_FUZZ_ADDR=$(shell $(GET_SYMBOL_ADDR) $(HARNESS_BIN) LLVMFuzzerTestOneInput 0x0)
AFL_FRIDA_FUZZ_ADDR2=$(shell $(GET_SYMBOL_ADDR) $(HARNESS2_BIN) LLVMFuzzerTestOneInput 0x0)
AFL_FRIDA_FUZZ_ADDR3=$(shell $(GET_SYMBOL_ADDR) $(HARNESS3_BIN) LLVMFuzzerTestOneInput 0x0)
AFLPP_FRIDA_DRIVER_HOOK_OBJ=$(ROOT)frida_mode/build/frida_hook.so
@ -52,12 +60,20 @@ $(HARNESS_BIN): $(HARNESS_SRC) | $(BUILD_DIR)
$(LIB_BIN): $(LIB_SRC) | $(BUILD_DIR)
$(CC) $(CFLAGS) $(LDFLAGS) $(LIB_CFLAGS) -o $@ $<
$(LIB2_BIN): $(LIB2_SRC) | $(BUILD_DIR)
$(CC) $(CFLAGS) $(LDFLAGS) $(LIB_CFLAGS) -o $@ $<
$(HARNESS2_BIN): $(HARNESS2_SRC) $(LIB_BIN) | $(BUILD_DIR)
$(CC) $(CFLAGS) $(LDFLAGS) $(HARNESS_LDFLAGS) -o $@ $<
$(HARNESS3_BIN): $(HARNESS3_SRC) $(LIB_BIN) | $(BUILD_DIR)
$(CC) $(CFLAGS) $(LDFLAGS) $(HARNESS_LDFLAGS) -L$(BUILD_DIR) -lcrashme -o $@ $<
clean:
rm -rf $(BUILD_DIR)
LIBASAN?=/usr/local/opt/llvm/lib/clang/10.0.1/lib/darwin/libclang_rt.asan_osx_dynamic.dylib
.ONESHELL:
frida_persistent: $(HARNESS_BIN) $(LIB_BIN) $(TESTINSTR_DATA_FILE)
cd $(BUILD_DIR) && \
@ -74,6 +90,25 @@ frida_persistent: $(HARNESS_BIN) $(LIB_BIN) $(TESTINSTR_DATA_FILE)
-- \
$(HARNESS_BIN) $(TEST_FILE)
.ONESHELL:
frida_persistent_asan: $(HARNESS2_BIN) $(LIB2_BIN) $(TESTINSTR_DATA_FILE)
cd $(BUILD_DIR) && \
AFL_PRELOAD=$(LIBASAN) \
AFL_USE_FASAN=1 \
AFL_INST_LIBS=1 \
AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_MAIN_ADDR2) \
AFL_FRIDA_PERSISTENT_CNT=1000000 \
AFL_ENTRYPOINT=$(AFL_FRIDA_MAIN_ADDR2) \
AFL_FRIDA_INST_RANGES=libcrashme2.dylib,harness2 \
$(ROOT)afl-fuzz \
-D \
-O \
-i $(TESTINSTR_DATA_DIR) \
-o $(FRIDA_OUT) \
-f $(TEST_FILE) \
-- \
$(HARNESS2_BIN) $(TEST_FILE)
.ONESHELL:
frida_persistent_hook: $(HARNESS_BIN) $(LIB_BIN) $(AFLPP_DRIVER_DUMMY_INPUT) $(TESTINSTR_DATA_FILE)
cd $(BUILD_DIR) && \
@ -92,14 +127,16 @@ frida_persistent_hook: $(HARNESS_BIN) $(LIB_BIN) $(AFLPP_DRIVER_DUMMY_INPUT) $(T
$(HARNESS_BIN) $(AFLPP_DRIVER_DUMMY_INPUT)
.ONESHELL:
frida_persistent_hook2: $(HARNESS2_BIN) $(LIB_BIN) $(AFLPP_DRIVER_DUMMY_INPUT) $(TESTINSTR_DATA_FILE)
frida_persistent_hook_asan: $(HARNESS2_BIN) $(LIB2_BIN) $(AFLPP_DRIVER_DUMMY_INPUT) $(TESTINSTR_DATA_FILE)
cd $(BUILD_DIR) && \
AFL_PRELOAD=$(LIBASAN) \
AFL_USE_FASAN=1 \
AFL_INST_LIBS=1 \
AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_FUZZ_ADDR2) \
AFL_FRIDA_PERSISTENT_CNT=1000000 \
AFL_ENTRYPOINT=$(AFL_FRIDA_FUZZ_ADDR2) \
AFL_FRIDA_PERSISTENT_HOOK=$(AFLPP_FRIDA_DRIVER_HOOK_OBJ) \
AFL_FRIDA_INST_RANGES=libcrashme.dylib,harness2 \
AFL_FRIDA_INST_RANGES=libcrashme2.dylib,harness2 \
$(ROOT)afl-fuzz \
-D \
-O \
@ -107,3 +144,20 @@ frida_persistent_hook2: $(HARNESS2_BIN) $(LIB_BIN) $(AFLPP_DRIVER_DUMMY_INPUT) $
-o $(FRIDA_OUT) \
-- \
$(HARNESS2_BIN) $(AFLPP_DRIVER_DUMMY_INPUT)
.ONESHELL:
frida_persistent_hook3: $(HARNESS3_BIN) $(LIB_BIN) $(AFLPP_DRIVER_DUMMY_INPUT) $(TESTINSTR_DATA_FILE)
cd $(BUILD_DIR) && \
AFL_INST_LIBS=1 \
AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_FUZZ_ADDR3) \
AFL_FRIDA_PERSISTENT_CNT=1000000 \
AFL_ENTRYPOINT=$(AFL_FRIDA_FUZZ_ADDR3) \
AFL_FRIDA_PERSISTENT_HOOK=$(AFLPP_FRIDA_DRIVER_HOOK_OBJ) \
AFL_FRIDA_INST_RANGES=libcrashme.dylib,harness3 \
$(ROOT)afl-fuzz \
-D \
-O \
-i $(TESTINSTR_DATA_DIR) \
-o $(FRIDA_OUT) \
-- \
$(HARNESS3_BIN) $(AFLPP_DRIVER_DUMMY_INPUT)

47
frida_mode/test/osx-lib/harness2.c
View File

@ -5,15 +5,21 @@
#include <dlfcn.h>
extern void crashme(const uint8_t *Data, size_t Size);
//typedef for our exported target function.
typedef void (*CRASHME)(const uint8_t *Data, size_t Size);
//globals
CRASHME fpn_crashme = NULL;
int LLVMFuzzerTestOneInput(const unsigned char* data, size_t size){
crashme(data, size);
fpn_crashme(data, size);
return 0;
}
void run (int argc, const char * argv[])
int main(int argc, const char * argv[])
{
for (int i = 1; i < argc; i++) {
fprintf(stderr, "Running: %s\n", argv[i]);
FILE *f = fopen(argv[i], "r");
@ -29,12 +35,35 @@ void run (int argc, const char * argv[])
free(buf);
fprintf(stderr, "Done: %s: (%zd bytes)\n", argv[i], n_read);
}
}
int main(int argc, const char * argv[])
{
run(argc, argv);
return 0;
}
__attribute__((constructor()))
void constructor(void) {
// handles to required libs
void *dylib = NULL;
dylib = dlopen("./libcrashme2.dylib", RTLD_NOW);
if (dylib == NULL)
{
printf("[-] Failed to load lib\n");
printf("[-] Dlerror: %s\n", dlerror());
exit(1);
}
printf("[+] Resolve function\n");
fpn_crashme = (CRASHME)dlsym(dylib, "crashme");
if (!fpn_crashme)
{
printf("[-] Failed to find function\n");
exit(1);
}
printf("[+] Found function.\n");
}

40
frida_mode/test/osx-lib/harness3.c Normal file
View File

@ -0,0 +1,40 @@
#include <string.h>
#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>
extern void crashme(const uint8_t *Data, size_t Size);
int LLVMFuzzerTestOneInput(const unsigned char* data, size_t size){
crashme(data, size);
return 0;
}
void run (int argc, const char * argv[])
{
for (int i = 1; i < argc; i++) {
fprintf(stderr, "Running: %s\n", argv[i]);
FILE *f = fopen(argv[i], "r");
assert(f);
fseek(f, 0, SEEK_END);
size_t len = ftell(f);
fseek(f, 0, SEEK_SET);
unsigned char *buf = (unsigned char*)malloc(len);
size_t n_read = fread(buf, 1, len, f);
fclose(f);
assert(n_read == len);
LLVMFuzzerTestOneInput(buf, len);
free(buf);
fprintf(stderr, "Done: %s: (%zd bytes)\n", argv[i], n_read);
}
}
int main(int argc, const char * argv[])
{
run(argc, argv);
return 0;
}

61
frida_mode/test/osx-lib/lib2.c Normal file
View File

@ -0,0 +1,61 @@
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
void __attribute__((noinline)) crashme(const uint8_t *Data, size_t Size) {
if (Size < 1) return;
char *buf = malloc(10);
if (buf == NULL) return;
switch (Data[0]) {
/* Underflow */
case 'U':
printf("Underflow\n");
buf[-1] = '\0';
free(buf);
break;
/* Overflow */
case 'O':
printf("Overflow\n");
buf[10] = '\0';
free(buf);
break;
/* Double free */
case 'D':
printf("Double free\n");
free(buf);
free(buf);
break;
/* Use after free */
case 'A':
printf("Use after free\n");
free(buf);
buf[0] = '\0';
break;
/* Test Limits (OK) */
case 'T':
printf("Test-Limits - No Error\n");
buf[0] = 'A';
buf[9] = 'I';
free(buf);
break;
case 'M':
printf("Memset too many\n");
memset(buf, '\0', 11);
free(buf);
break;
default:
printf("Nop - No Error\n");
break;
}
}