Giter Site home page Giter Site logo

iasthc / yuan-fuzz Goto Github PK

View Code? Open in Web Editor NEW

This project forked from zodf0055980/yuan-fuzz

0.0 0.0 0.0 1.76 MB

Fuzzing with the generated argument

License: Apache License 2.0

Makefile 2.69% C 86.52% Shell 6.83% C++ 1.02% HTML 0.68% JavaScript 0.01% Rich Text Format 0.01% Python 2.26%

yuan-fuzz's Introduction

Yuan-fuzz

Fuzzer runs with argv information and uses k-means clustering to group seed.

  Written and maintained by zodf0055980 <[email protected]>
  Based on American Fuzzy Lop by Michal Zalewski

Why I do this?

There are a lot of command line arguments in the common binary, but common fuzzer only runs with one command line argument, so it cannot find some errors through the special command line. For instance, in CVE-2020-27843 I found, it have out of bound read with 8 argv and crafted input. Therefore, I made a fuzzer that can generate argv at runtime.

Technology

Yuan-fuzz is a fuzzer implementing a technique to generate argv in addition fuzzing stage named arg_gen. It can help to fuzz binary target that has a lot of argv can use.

It also can use k-means clustering to the group in the seed pool to improve seed selection, just like the k-means-AFL I made.

architecture

TODO

  • Cannot use -i - to resume fuzzer.
  • Cannot use without -s xmlfile, maybe you can try k-means-AFL I made.
  • Allow use other format to write argv info file, likes json
  • Release English paper, I did in traditional Chinese now.

If you have any other questions, you are welcome to create issue and I will try my best to solve them.

Usage

Install libxml2 first.

Build it.

$ make

Use -h --help to know target program options, and use it to write XML file to help fuzzing. I give some XML examples here, maybe could help to write XML file.

We also implement our seed selection. You should open our seed selection server first if you want to use it.

$ python3 group_seed.py [port]

The command line usage of Yuan-fuzz is similar to AFL.

$ Yuan-fuzz -i [testcase_dir] -o [output_dir] -s [~/XML_PATH/parameters.xml] [-p [port]] -- [Target program]

I also implement two command that can help arg_gen stage.

-w            - let file_path in front of argv
-r            - argv random initial

Example

Use libjpeg-turbo to be example.

$ git clone [email protected]:libjpeg-turbo/libjpeg-turbo.git

Build with instrumentation, you can use other compiler.

$ export CC=~/Yuan-fuzz/afl-gcc                                       
$ export CXX=~/Yuan-fuzz/afl-g++
$ export AFL_USE_ASAN=1 ;
$ cd libjpeg-turbo
$ mkdir build && cd build
$ cmake -G"Unix Makefiles" ..
$ make

Run fuzzer

$ python3 group_seed.py 8888
# Another Terminal
$ Yuan-fuzz -i ./testcases/images/jpeg -o fuzz_output -m none -s ./xml/libjpeg-turbo/djpeg/parameters.xml -p 8888 -- ~/TARGET_PATH/libjpeg-turbo/build/djpeg

If your xml file have a lot of argv, maybe you have to change some define value in parse.h.

parallel fuzzing

Yuan-fuzz can parallel fuzz with other afl-base fuzzer, likely AFLplusplus. However, Yuan-fuzz can only be used in -S mode. And please check argv information file is same with master run.

for example:

# afl++
$ ./afl-fuzz -i ./testcases/images/jpeg -o ~/jpeg-out -M master -m none -- ~/afl-target/libjpeg-turbo/build/djpeg -outfile /dev/null @@

# Yuan-fuzz
$ ./Yuan-fuzz -i ./testcases/images/jpeg -o ~/jpeg-out -S slave1 -m none -s ~/Yuan-fuzz/xml/libjpeg-turbo/djpeg/parameters.xml -- ~/afl-target/libjpeg-turbo/build/djpeg

Interpreting output

It will have addition subdirectories created within the output directory and updated in real time.

  • queue_info/queue
  • queue_info/crashes
  • queue_info/hangs

It save all seed running parameters and one-to-one correspondence with seed in queue, crashes, hangs subdirectories.

Bug reported

libjpeg-turbo

  1. libjpeg-turbo/libjpeg-turbo#441 (CVE-2020-35538)

binutils

  1. https://sourceware.org/bugzilla/show_bug.cgi?id=26774
  2. https://sourceware.org/bugzilla/show_bug.cgi?id=26805
  3. https://sourceware.org/bugzilla/show_bug.cgi?id=26809

openjpeg

  1. uclouvain/openjpeg#1283 (CVE-2020-27814)
  2. uclouvain/openjpeg#1284 (CVE-2020-27823)
  3. uclouvain/openjpeg#1286 (CVE-2020-27824)
  4. uclouvain/openjpeg#1293 (CVE-2020-27841)
  5. uclouvain/openjpeg#1294 (CVE-2020-27842)
  6. uclouvain/openjpeg#1297 (CVE-2020-27843)
  7. uclouvain/openjpeg#1299 (CVE-2020-27844)
  8. uclouvain/openjpeg#1302 (CVE-2020-27845)

jasper

  1. jasper-software/jasper#252 (CVE-2020-27828)
  2. jasper-software/jasper#263

libsndfile

  1. libsndfile/libsndfile#675

libxls

  1. libxls/libxls#90

aom

  1. https://bugs.chromium.org/p/aomedia/issues/detail?id=2905&q=&can=1
  2. https://bugs.chromium.org/p/aomedia/issues/detail?id=2911&q=&can=1
  3. https://bugs.chromium.org/p/aomedia/issues/detail?id=2912&q=&can=1
  4. https://bugs.chromium.org/p/aomedia/issues/detail?id=2913&q=&can=1
  5. https://bugs.chromium.org/p/aomedia/issues/detail?id=2914&q=&can=1

libredwg

  1. LibreDWG/libredwg#320
  2. LibreDWG/libredwg#323
  3. LibreDWG/libredwg#324
  4. LibreDWG/libredwg#321
  5. LibreDWG/libredwg#325 (non release code-path)

libxml2

  1. https://gitlab.gnome.org/GNOME/libxml2/-/issues/231 (CVE-2021-3516)
  2. https://gitlab.gnome.org/GNOME/libxml2/-/issues/235 (CVE-2021-3517)
  3. https://gitlab.gnome.org/GNOME/libxml2/-/issues/237 (CVE-2021-3518)

libvips (not use fuzz)

  1. libvips/libvips#1867
  2. libvips/libvips#1868

Thanks

Use SQ-fuzz to modify.

yuan-fuzz's People

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.