eurecom-s3/predictive-cs-fuzzing

Code for the "Predictive Context-sensitive Fuzzing" NDSS'24 paper

Predictive Context-sensitive Fuzzing

This repository hosts the code for the paper Predictive Context-sensitive Fuzzing appeared at NDSS 2024.

Getting started

Install the dependencies with:

# install the dependencies
$ apt-get update && \
apt-get install -y wget libstdc++-5-dev libtool-bin automake flex bison \
                   libglib2.0-dev libpixman-1-dev python3-setuptools unzip \
                   apt-utils apt-transport-https ca-certificates \
                   binutils

# install llvm-10
$ apt install -y lsb-release wget software-properties-common && wget https://apt.llvm.org/llvm.sh && chmod +x llvm.sh && ./llvm.sh 10

# Download and install the latest stable Go (for gllvm)
$ wget https://storage.googleapis.com/golang/getgo/installer_linux && \
    chmod +x ./installer_linux && \
    ./installer_linux
$ export PATH=$PATH:$HOME/.go/bin:/go/bin

# Download and compile afl++ of 08/2020.
$ git clone https://github.com/AFLplusplus/AFLplusplus.git ./afl && \
    cd ./afl && \
    git checkout 2e15661f184c77ac1fbb6f868c894e946cbb7f17

# Build without Python support as we don't need it.
# Set AFL_NO_X86 to skip flaky tests.
$ cd ./afl && unset CFLAGS && unset CXXFLAGS && \
    export CC=clang && export AFL_NO_X86=1 && \
    PYTHON_INCLUDE=/ make LLVM_CONFIG=llvm-config-10 && make install
    
# Build the AFL wrapper with gclang
wget https://raw.githubusercontent.com/llvm/llvm-project/5feb80e748924606531ba28c97fe65145c65372e/compiler-rt/lib/fuzzer/afl/afl_driver.cpp -O afl_driver.cpp
clang++-10 -std=c++11 -O2 -c afl_driver.cpp
ar r libAFLDriver.a afl_driver.o
gclang++ -std=c++11 -O2 -c afl_driver.cpp -o afl_driver_gclang.o
ar r libAFLDriverGclang.a afl_driver_gclang.o

Build the function cloning passes with:

$ export LLVM_DIR="/usr/lib/llvm-10" # or the llvm-10 path
$ ./build.sh

And compile a harness with the drop-in wrapper that we provide in the bin folder: wrap_gclang automatically runs the needed passes.

To set up a correct env for the build process, do the following steps (OUT is your build output directory, we follow the FuzzBench envs):

export CC=./afl/afl-clang-fast
export CXX=./afl/afl-clang-fast++
export FUZZER_LIB=./afl/libAFLDriverGclang.a

export AFL_LLVM_DICT2FILE=$OUT/afl++.dict

export AFL_QUIET=1
export AFL_MAP_SIZE=2621440

export REAL_CC_PATH=$CC
export REAL_CXX_PATH=$CXX
export CC=./bin/wrap-gclang
export CXX=./bin/wrap-gclang++

export LLVM_BITCODE_GENERATION_FLAGS=-flto
export WLLVM_OUTPUT_LEVEL=ERROR

You can tune the env CGC_STRATEGY to change prioritization strategy (default is dataflow) and CGC_MAXMAP to enlarge the max map size.

Now you can compile your target simply using CC/CXX and link with:

$CXX yourfiles.o[...] $FUZZER_LIB -o youroutput.bin

If you want sanitization, we suggest adding -O1 -fsanitize=address -fsanitize=array-bounds,bool,builtin,enum,float-divide-by-zero,function,integer-divide-by-zero,null,object-size,return,returns-nonnull-attribute,shift,signed-integer-overflow,unreachable,vla-bound,vptr.

The last step is just to fuzz with AFL++, we suggest using a CmpLog-instrumented binary in addition.

Cite

@inproceedings{pred-ctx-fuzz,
    author = {Borrello, Pietro and Fioraldi, Andrea and D'Elia, Daniele Cono and Balzarotti, Davide and Querzoni, Leonardo and Giuffrida, Cristiano},
    title = {Predictive Context-sensitive Fuzzing},
    year = {2024},
    booktitle = {Network and Distributed System Security Symposium (NDSS)}
}

predictive-cs-fuzzing's Issues

linker error due to calls from other object file

Hi,
I want to test grep-3.11 using these codes. I first used clang to generate grep.o, and then modify the CC to bin/wrap-gclang in Makefile for linking. I found it didn't work because there are some other necessary .o files such as dfasearch.o. So I manually added them to wrap_gclang.py and it worked well.

However, at the final step, I found grep executable can not be generated because the function names are modified to __cgc_clone_1_xxx, so the callings to these functions from other .o files can not find the right function names, such as 'pattern_file_name' from dfasearch.o.

I think the root cause to link errors is that only the calling sites in grep.o are fixed. Could you tell me if there are existed solutions to automatically fix the calling sites to the right function names at other .o files?