solo5
solo5 copied to clipboard
(WiP): Afl gcc
This PR enables building the tenders with afl-gcc and the unikernels with your regular $CC.
- It adds a
--dry-runoption to SPT which was helpful for fuzzing. - I don't really know what I'm doing re: the configure script. I am not attached to any of the changes, the main thing is making
HOSTCCinMakefile.commonbe able to be different fromCC.
I've been using this (for 15 min) to fuzz the spt tender and elftool with these commands:
mkdir fuzz-out fuzz-manifest fuzz-abi
afl-fuzz -i newfuzz-in -o fuzz-out/ -f /dev/shm/foo -t 200 -- ./tenders/spt/solo5-spt --dry-run --mem=2 -- /dev/shm/foo
afl-fuzz -i newfuzz-in -o fuzz-manifest -f /dev/shm/foo.manifest -t 200 -- ./elftool/solo5-elftool query-manifest /dev/shm/foo.manifest
afl-fuzz -i newfuzz-in -o fuzz-abi/ -f /dev/shm/foo.abi -t 500 -- ./elftool/solo5-elftool query-abi /dev/shm/foo.abi
So far it's managed to trigger a few assertions (that's fair), but has not produced any actual crashes (that's good :tada: )
solo5-spt: common/mft.c:145: mft_type_to_string: Assertion `false' failed.
solo5-spt: spt/spt_core.c:158: spt_guest_mprotect: Assertion `addr_start < addr_end' failed.
solo5-elftool: ../tenders/common/elf.c:476: elf_load_note: Assertion `note_size != 0 && note_size <= nhdr.h.n_descsz' failed.
Sometimes the mft_type_to_string assertions are triggered after solo5-elftool query-manifest has started printing JSON though, which may not be ideal.