1616import os
1717import shutil
1818import subprocess
19+
1920from fuzzers import utils
2021
2122
2223def prepare_build_environment ():
2324 """Set environment variables used to build targets for pathAFL-based
2425 fuzzers."""
25- os .environ [' LD_LIBRARY_PATH' ] = ' /path-afl'
26- os .environ ['CC' ] = ' /path-afl/afl-clang-fast'
27- os .environ [' CXX' ] = ' /path-afl/afl-clang-fast++'
26+ os .environ [" LD_LIBRARY_PATH" ] = " /path-afl"
27+ os .environ ["CC" ] = " /path-afl/afl-clang-fast"
28+ os .environ [" CXX" ] = " /path-afl/afl-clang-fast++"
2829 current_directory = os .getcwd ()
2930 os .environ ["BBIDFILE" ] = os .path .join (current_directory , "bbid.txt" )
3031 os .environ ["CALLMAPFILE" ] = os .path .join (current_directory , "callmap.txt" )
3132 os .environ ["CFGFILE" ] = os .path .join (current_directory , "cfg.txt" )
32- os .environ ["FUZZER" ] = ' /path-afl'
33- os .environ ["AFL_LLVM_CALLER" ] = '1'
34- os .environ [' FUZZER_LIB' ] = ' /libAFLDriver.a'
33+ os .environ ["FUZZER" ] = " /path-afl"
34+ os .environ ["AFL_LLVM_CALLER" ] = "1"
35+ os .environ [" FUZZER_LIB" ] = " /libAFLDriver.a"
3536
3637
3738def build ():
@@ -40,110 +41,106 @@ def build():
4041
4142 utils .build_benchmark ()
4243
43- subprocess .run ('cat cfg.txt | grep "BasicBlock: " | wc -l > bbnum.txt' ,
44- shell = True ,
45- check = True )
44+ subprocess .run (
45+ 'cat cfg.txt | grep "BasicBlock: " | wc -l > bbnum.txt' ,
46+ shell = True ,
47+ check = True ,
48+ )
4649 print (f"/out/{ os .getenv ('FUZZ_TARGET' )} " )
47- result = subprocess .run ([
48- "bash" , '/path-afl/fuzzing_support/filterCFGandCallmap.sh' ,
49- f"/out/{ os .getenv ('FUZZ_TARGET' )} "
50- ],
51- check = False ,
52- capture_output = True ,
53- text = True )
50+ result = subprocess .run (
51+ [
52+ "bash" ,
53+ "/path-afl/fuzzing_support/filterCFGandCallmap.sh" ,
54+ f"/out/{ os .getenv ('FUZZ_TARGET' )} " ,
55+ ],
56+ check = False ,
57+ capture_output = True ,
58+ text = True ,
59+ )
5460 print (result .stdout )
5561 print (result .stderr )
56- ...
5762 subprocess .run (
58- 'cat cfg_filtered.txt | grep \" Function: \" | nl -v 0 | awk \' {print $1, $3, $4, $5, $6, $7, $8, $9}\' > function_list.txt' ,
63+ "cat cfg_filtered.txt | grep \" Function: \" | nl -v 0 | "
64+ "awk '{print $1, $3, $4, $5, $6, $7, $8, $9}' > function_list.txt" ,
5965 shell = True ,
60- check = True )
66+ check = True ,
67+ )
6168 subprocess .run (
62- 'g++ -I/path-afl/fuzzing_support /path-afl/fuzzing_support/convert.cpp -o convert' ,
69+ "g++ -I/path-afl/fuzzing_support "
70+ "/path-afl/fuzzing_support/convert.cpp -o convert" ,
6371 shell = True ,
64- check = True )
65- subprocess .run ('./convert' , shell = True , check = True )
72+ check = True ,
73+ )
74+ subprocess .run ("./convert" , shell = True , check = True )
6675
67- print (' [post_build] Copying afl-fuzz to $OUT directory' )
76+ print (" [post_build] Copying afl-fuzz to $OUT directory" )
6877
6978 # Copy out the afl-fuzz binary as a build artifact.
70- shutil .copy ('/path-afl/libpath_reduction.so' , os .environ ['OUT' ])
71- shutil .copy ('/path-afl/afl-fuzz' , os .environ ['OUT' ])
72- shutil .copy ('./top.bin' , os .environ ['OUT' ])
73- shutil .copy ('/libpython3.8.so.1.0' , os .environ ['OUT' ])
74- try :
75- src = '/usr/lib/llvm-17/lib'
76- dst = os .environ ['OUT' ]
77- shutil .copytree (src , dst , dirs_exist_ok = True )
78- except KeyError :
79- print ("Environment variable 'OUT' is not set." )
80- assert False
81- except FileNotFoundError as e :
82- print (f"Source directory not found: { e } " )
83- assert False
84- except PermissionError as e :
85- print (f"Permission error: { e } " )
86- assert False
87- except Exception as e :
88- print (f"An error occurred: { e } " )
89- assert False
79+ shutil .copy ("/path-afl/libpath_reduction.so" , os .environ ["OUT" ])
80+ shutil .copy ("/path-afl/afl-fuzz" , os .environ ["OUT" ])
81+ shutil .copy ("./top.bin" , os .environ ["OUT" ])
82+ shutil .copy ("/libpython3.8.so.1.0" , os .environ ["OUT" ])
83+ src = "/usr/lib/llvm-17/lib"
84+ dst = os .environ ["OUT" ]
85+ shutil .copytree (src , dst , dirs_exist_ok = True )
9086
9187
9288def prepare_fuzz_environment (input_corpus ):
9389 """Prepare to fuzz with AFL or another AFL-based fuzzer."""
9490 # Tell AFL to not use its terminal UI so we get usable logs.
95- os .environ [' AFL_NO_UI' ] = '1'
91+ os .environ [" AFL_NO_UI" ] = "1"
9692 # Skip AFL's CPU frequency check (fails on Docker).
97- os .environ [' AFL_SKIP_CPUFREQ' ] = '1'
93+ os .environ [" AFL_SKIP_CPUFREQ" ] = "1"
9894 # No need to bind affinity to one core, Docker enforces 1 core usage.
99- os .environ [' AFL_NO_AFFINITY' ] = '1'
95+ os .environ [" AFL_NO_AFFINITY" ] = "1"
10096 # AFL will abort on startup if the core pattern sends notifications to
10197 # external programs. We don't care about this.
102- os .environ [' AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES' ] = '1'
98+ os .environ [" AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES" ] = "1"
10399 # Don't exit when crashes are found. This can happen when corpus from
104100 # OSS-Fuzz is used.
105- os .environ [' AFL_SKIP_CRASHES' ] = '1'
101+ os .environ [" AFL_SKIP_CRASHES" ] = "1"
106102 # Shuffle the queue
107- os .environ [' AFL_SHUFFLE_QUEUE' ] = '1'
108- os .environ [' CFG_BIN_FILE' ] = ' ./top.bin'
109- os .environ [
110- 'LD_LIBRARY_PATH' ] = f'./lib:{ os .getcwd ()} :{ os .environ ["LD_LIBRARY_PATH" ]} '
103+ os .environ [" AFL_SHUFFLE_QUEUE" ] = "1"
104+ os .environ [" CFG_BIN_FILE" ] = " ./top.bin"
105+ os .environ ["LD_LIBRARY_PATH" ] = (
106+ f'./lib:{ os .getcwd ()} :{ os .environ ["LD_LIBRARY_PATH" ]} ' )
111107
112108 # AFL needs at least one non-empty seed to start.
113109 utils .create_seed_file_for_empty_corpus (input_corpus )
114110
115111
116- def run_afl_fuzz (input_corpus ,
117- output_corpus ,
118- target_binary ,
119- additional_flags = None ,
120- hide_output = False ):
112+ def run_afl_fuzz (
113+ input_corpus ,
114+ output_corpus ,
115+ target_binary ,
116+ hide_output = False ,
117+ ):
121118 """Run afl-fuzz."""
122119 # Spawn the afl fuzzing process.
123- print (' [run_afl_fuzz] Running target with afl-fuzz' )
120+ print (" [run_afl_fuzz] Running target with afl-fuzz" )
124121 command = [
125- ' ./afl-fuzz' ,
126- '-i' ,
122+ " ./afl-fuzz" ,
123+ "-i" ,
127124 input_corpus ,
128- '-o' ,
125+ "-o" ,
129126 output_corpus ,
130127 # Use no memory limit as ASAN doesn't play nicely with one.
131- '-m' ,
132- ' none' ,
133- '-t' ,
134- ' 1000+' , # Use same default 1 sec timeout, but add '+' to skip hangs.
128+ "-m" ,
129+ " none" ,
130+ "-t" ,
131+ " 1000+" , # Use same default 1 sec timeout, but add '+' to skip hangs.
135132 ]
136133 dictionary_path = utils .get_dictionary_path (target_binary )
137134 if dictionary_path :
138- command .extend (['-x' , dictionary_path ])
135+ command .extend (["-x" , dictionary_path ])
139136 command += [
140- '--' ,
137+ "--" ,
141138 target_binary ,
142139 # Pass INT_MAX to afl the maximize the number of persistent loops it
143140 # performs.
144- ' 2147483647'
141+ " 2147483647" ,
145142 ]
146- print (' [run_afl_fuzz] Running command: ' + ' ' .join (command ))
143+ print (" [run_afl_fuzz] Running command: " + " " .join (command ))
147144 output_stream = subprocess .DEVNULL if hide_output else None
148145 subprocess .check_call (command , stdout = output_stream , stderr = output_stream )
149146
@@ -152,6 +149,6 @@ def fuzz(input_corpus, output_corpus, target_binary):
152149 """Run afl-fuzz on target."""
153150 prepare_fuzz_environment (input_corpus )
154151
155- os .environ ['K' ] = '42'
152+ os .environ ["K" ] = "42"
156153
157154 run_afl_fuzz (input_corpus , output_corpus , target_binary )
0 commit comments