solo5 icon indicating copy to clipboard operation
solo5 copied to clipboard

(WiP): Afl gcc

Open cfcs opened this issue 6 years ago • 0 comments

This PR enables building the tenders with afl-gcc and the unikernels with your regular $CC.

  1. It adds a --dry-run option to SPT which was helpful for fuzzing.
  2. I don't really know what I'm doing re: the configure script. I am not attached to any of the changes, the main thing is making HOSTCC in Makefile.common be able to be different from CC.

I've been using this (for 15 min) to fuzz the spt tender and elftool with these commands:

mkdir fuzz-out fuzz-manifest fuzz-abi

afl-fuzz -i newfuzz-in -o fuzz-out/ -f /dev/shm/foo -t 200 -- ./tenders/spt/solo5-spt --dry-run --mem=2 -- /dev/shm/foo

afl-fuzz -i newfuzz-in -o fuzz-manifest -f /dev/shm/foo.manifest -t 200 -- ./elftool/solo5-elftool query-manifest /dev/shm/foo.manifest

afl-fuzz -i newfuzz-in -o fuzz-abi/ -f /dev/shm/foo.abi -t 500 -- ./elftool/solo5-elftool query-abi /dev/shm/foo.abi

So far it's managed to trigger a few assertions (that's fair), but has not produced any actual crashes (that's good :tada: )

solo5-spt: common/mft.c:145: mft_type_to_string: Assertion `false' failed.

solo5-spt: spt/spt_core.c:158: spt_guest_mprotect: Assertion `addr_start < addr_end' failed.


solo5-elftool: ../tenders/common/elf.c:476: elf_load_note: Assertion `note_size != 0 && note_size <= nhdr.h.n_descsz' failed.

Sometimes the mft_type_to_string assertions are triggered after solo5-elftool query-manifest has started printing JSON though, which may not be ideal.

cfcs avatar Sep 25 '19 02:09 cfcs