___ ___ ___ ___ ___ ___ ___ /\__\ /\ \ /\__\ /\__\ /\__\ /\__\ /\ \ /:/ _/_ \:\ \ /::| | /::| | /:/ _/_ /:/ _/_ \:\ \ /:/ /\__\ \:\ \ /:/:| | /:/:| | /:/ /\ \ /:/ /\__\ \:\ \ /:/ /:/ / ___ \:\ \ /:/|:| |__ /:/|:| |__ /:/ /::\ \ /:/ /:/ _/_ _____\:\ \ /:/_/:/ / /\ \ \:\__\ /:/ |:| /\__\ /:/ |:| /\__\ /:/__\/\:\__\ /:/_/:/ /\__\ /::::::::\__\ \:\/:/ / \:\ \ /:/ / \/__|:|/:/ / \/__|:|/:/ / \:\ \ /:/ / \:\/:/ /:/ / \:\~~\~~\/__/ \::/__/ \:\ /:/ / |:/:/ / |:/:/ / \:\ /:/ / \::/_/:/ / \:\ \ \:\ \ \:\/:/ / |::/ / |::/ / \:\/:/ / \:\/:/ / \:\ \ \:\__\ \::/ / |:/ / |:/ / \::/ / \::/ / \:\__\ \/__/ \/__/ |/__/ |/__/ \/__/ \/__/ \/__/
FuzzGen - Automatic Fuzzer Generation
FuzzGen, is a tool for automatically synthesizing fuzzers for complex libraries in a given environment. FuzzGen leverages a whole system analysis to infer the library’s interface and synthesizes fuzzers specifically for that library.
FuzzGen is fully automatic and can be applied to a wide range of libraries. The generated fuzzers leverage LibFuzzer to achieve better code coverage and expose bugs that reside deep in the library.
For more details please refer to our USENIX Security'20 paper.
FuzzGen depends on Boost library, which could be installed by command
sudo apt-get install libboost-all-devor compiling from source.
To build FuzzGen, follow the classic
cmake - makeprocess: ```
cd $FUZZGENHOMEDIR mkdir build cd build cmake .. make -j$(nproc) ```
Note that we originally used LLVM 6 to compile the code, while it may work with other versions of LLVM, some code changes will be necessary.
Also don't forget to adjust the following MACROs in
src/compose.haccording to your needs: ```C++
The preprocessor is a clang plugin, so building it requires more effort. First, copy the [preprocessor](./src/preprocessor) directory under `$LLVM_SRC/tools/clang/tools` and change the directory name to fuzzgen, add the following line in `$LLVM_SRC/tools/clang/tools/CMakeLists.txt`:
Then, build the LLVM again. The preprocessor plugin will show up under
The first step to run FuzzGen, is to generate the metadata file. To do this, run the preprocessor as follows:
$BUILD_LLVM_DIR/bin/fuzzgen-preprocessor \ -outfile=$LIBNAME.meta \ -library-root=/path/to/Android/home/ \ $(find /path/to/all/library/source/files/) \
WARNING: In this approach we simply pass all source files in our plugin. However, it is possible for clang to fail (even if running with
-fsyntax-onlyoption) to resolve MACROs and header file names and therefore AST generation may be incomplete. That is, it is possible for some nodes in the AST to be NULL, since clang cannot properly resolve them. This in turn, will result in incomplete information in the metadata file, which is possible to cause FuzzGen to miss information during fuzzer generation. To address this issue, you can use
compile_commands.jsonfile to get the exact set of flags used to build the library, so clang will generate complete ASTs.
The second step is to obtain the Link Time Optimization (LTO) for the target library. That is, to link all individual LLVM-IR files into a single one, so FuzzGen can analyze the whole library at once.
To do that, add the following flags to the
Android.bpto emit the LLVM IR:
cflags: [ "-save-temps", "-S -emit-llvm", "-m64" // for 64 bit data layouts ],
This will produce multiple bitcode (
*.bc) files under Android's root directory. To coalesce all these bitcode files into a single one (LTO) use the
llvm-linktool. This will result in a single bitcode file, but it will not be in readable format. To get the human-readable disassembled LLVM-IR (
llvm-dis. Note that FuzzGen requires the
*.llfile as input.
As mentioned earlier, FuzzGen performs a whole system analysis. For the Android case, it requires access to every source file in Android. To obtain all LLVM-IR files for the whole Android, first build AOSP using
showcommandsto get the exact path to
clang/clang++python executables. Then do the following changes to the clang and clang++ files (at function
clang: ``` 6,7c6 < import subprocess
87,98d85 < < print 'ARGV0', self.argv0 < print 'EXECARG', self.execargs < < try: < subprocess.check_call(self.execargs + ["-save-temps", "-S", "-m64", "-emit-llvm"]) < except subprocess.CalledProcessError: < print 'FAILURE BUT WHO CARES?' < except OSError: < print 'OS FAILURE BUT WHO CARES?' < ```
< import subprocess < < print uniform(1, 10) 89,100d85 < < print 'ARGV0++', self.argv0 < print 'EXECARG++', self.execargs < < try: < subprocess.check_call(self.execargs + ["-save-temps", "-S", "-m64", -emit-llvm"]) < except subprocess.CalledProcessError: < print 'FAILURE BUT WHO CARES?' < except OSError: < print 'OS FAILURE BUT WHO CARES?' < <
Please note that we need to invoke
subprocess.check_callwhich spawns a new process (i.e., actual compiler) and waits till returns. When we dump the bitcode files, no executable is generated, so after this step, we need to execute
os.execv(self.argv0, self.execargs)without the extra arguments as well.
NOTE: If you operate on 32-bits do not add the
The best way to understand how to run FuzzGen is to go through its command line help: ``` OVERVIEW: FuzzGen - Automatic Fuzzer Generation
FuzzGen supports 4 modes of operation. You can choose mode with the '-mode' option.
A) Dump Functions (-mode=dump_functions):
In this mode, FuzzGen dumps all functions declared in the library to a file and exits. Example:
B) Dump API (-mode=dump_api):
In this mode, FuzzGen, dumps inferred API from the library to a file and exits. To do this it requires: i) the consumer directory, ii) the metadata file, iii) the library's root directory and -for Android libs only- iv) the library path inside AOSP. Example:
./fuzzgen -mode=dump_api -consumer-dir=libopus/consumers -meta=libopus.meta \ -lib-root=consumers/AOSP -path=external/libopus libopus/libopus_lto64.ll
C) Generate Fuzzers for Android (-mode=android):
In this mode, FuzzGen synthesizes fuzzers for Android libraries. Example:
./fuzzgen -mode=android -analysis=deep -arch=x64 -no-progressive -lib-name=libhevc \ -meta=libhevc.meta -consumer-dir=libhevc/ext -lib-root=consumers/AOSP \ -path=/external/libhevc -outdir=fuzzers/libhevc -static-libs='libhevcdec' \ libhevc/libhevc_lto64.ll
D) Generage Fuzzers for Debian (-mode=debian): #TODO
USAGE: fuzzgen [options]
Fuzzer Generation Options:
-analysis - Type of analysis to be performed =dumb - DEPRECATED. Dumb fuzzing of all arguments =basic - DataFlow analysis for each argument (not recommended) =deep - DataFlow analysis with deep inspection for each argument (Default) -arch - Processor architecture of the fuzzed device =x86 - 32-bit processor =x64 - 64-bit processor (Default) -consumer-dir=
Fuzzer Generation Options for Android:
-aux-lib= - Auxiliary library's LLVM IR (with LTO) -aux-path= - Auxiliary library's path inside Android source tree -lib-root= - Root directory of the library (or AOSP directory for Android) -no-progressive - Disable progressive fuzzer generation -path=
-mode - FuzzGen operation mode =android - Generate fuzzers for Android (Default) =debian - Generate fuzzers for Debian =dumpfunctions - Dump all library functions and exit =dumpapi - Dump library API and exit Verbosity level: -v0 - Display minimum status information -v1 - Display basic status information (Default) -v2 - Display detailed status information (Recommended) -v3 - Display all status information (Not recommended)
-help - Display available options (-help-hidden for more) -help-list - Display list of available options (-help-list-hidden for more) -version - Display the version of this program
FuzzGen comes with a lot of useful scripts to assist data collection and visualization under aux/ directory. Feel free to experiment with them.
As an example, to aggregate line coverage reports and plot the plot code coverage use the plot_libfuzzer_coverage.py script as follows:
aux/plotlibfuzzercoverage.py \ --fuzzgendir $FUZZGENRESULTS \ --ispodir $MANUALRESULTS \ --fuzzer_name $FUZZERNAME ```