Skip to content

Commit 29305c6

Browse files
P1umerP1umer
committed
Add extractor for libfuzzer data generator
1 parent 7101192 commit 29305c6

File tree

7 files changed

+356
-0
lines changed

7 files changed

+356
-0
lines changed

‎utils/aflpp_extractor/Makefile‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
ifeq "" "$(LLVM_CONFIG)"
2+
LLVM_CONFIG=llvm-config
3+
endif
4+
5+
ifeq "$(shell uname -s)" "Darwin"
6+
# On some odd MacOS system configurations, the Xcode sdk path is not set correctly
7+
SDK_LD = -L$(shell xcrun --show-sdk-path)/usr/lib
8+
LDFLAGS += $(SDK_LD)
9+
endif
10+
11+
ifeq "" "$(LLVM_CONFIG)"
12+
LLVM_CONFIG := llvm-config
13+
endif
14+
LLVM_BINDIR = $(shell $(LLVM_CONFIG) --bindir 2>/dev/null)
15+
ifneq "" "$(LLVM_BINDIR)"
16+
ifeq "$(shell test -x $(LLVM_BINDIR)/clang && echo 1)" "1"
17+
CC := $(LLVM_BINDIR)/clang
18+
endif
19+
endif
20+
CC := clang
21+
CFLAGS := -O3 -funroll-loops -g -fPIC
22+
23+
all: libAFLExtractor.a reproducer
24+
25+
extractor.o: extractor.c
26+
-$(CC) -I. -I../../include $(CFLAGS) -c extractor.c
27+
28+
extractor_test.o: extractor_test.c
29+
-$(CC) -I. -I../../include $(CFLAGS) -c extractor_test.c
30+
31+
libAFLExtractor.a: extractor.o
32+
@ar rc libAFLExtractor.a extractor.o
33+
# @cp -vf libAFLExtractor.a ../../
34+
35+
libExtractorTest.a: extractor_test.o
36+
@ar rc libExtractorTest.a extractor_test.o
37+
38+
reproducer: libAFLExtractor.a libExtractorTest.a
39+
/Users/p1umer/Git/AFLplusplus/afl-clang-fast -D_DEBUG=\"1\" -I../../include -Wl -funroll-loops -o reproducer libExtractorTest.a libAFLExtractor.a reproducer.c
40+
41+
clean:
42+
rm -f *.o *.a *~ core reproducer

‎utils/aflpp_extractor/afl_ext.h‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// Copyright 2023 P1umer
2+
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
typedef struct mutate_helper {
15+
uint8_t *buf;
16+
size_t len;
17+
} mutate_helper_t;
18+
19+
// extern function used in AFL++
20+
extern mutate_helper_init();
21+
extern size_t mutate_helper_generate(unsigned char *buf, size_t buf_size);
22+
extern uint8_t* mutate_helper_buffer();
23+
extern size_t mutate_helper_buffer_size();
24+
25+

‎utils/aflpp_extractor/extractor.c‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
// Copyright 2023 P1umer
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
#include <signal.h>
16+
#include <execinfo.h>
17+
#include <stdio.h>
18+
#include <stdlib.h>
19+
#include <unistd.h>
20+
21+
#include "extractor.h"
22+
23+
// libFuzzer interface is thin, so we don't include any libFuzzer headers.
24+
__attribute__((weak)) int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
25+
__attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv){
26+
// Default implementation does nothing
27+
return 0;
28+
}
29+
30+
#define INITIAL_SIZE (100)
31+
#define MAX_LENGTH(x, y) ( ((x) > (y)) ? (x) : y )
32+
33+
// #define kMaxAflInputSize (1 * 1024 * 1024)
34+
// static uint8_t AflInputBuf[kMaxAflInputSize];
35+
static mutate_helper_t* afl_mutate_helper;
36+
37+
void fake_init() {
38+
int fake_argc = 3;
39+
40+
char *fake_argv_arr[] = {
41+
"fake1",
42+
"fake2",
43+
"fake3"
44+
};
45+
46+
char **fake_argv = malloc(fake_argc * sizeof(char *));
47+
if (!fake_argv) {
48+
perror("Failed to allocate memory for fake_argv");
49+
// return 1;
50+
}
51+
52+
for (int i = 0; i < fake_argc; i++) {
53+
fake_argv[i] = fake_argv_arr[i];
54+
}
55+
if (LLVMFuzzerInitialize) {
56+
LLVMFuzzerInitialize(&fake_argc, &fake_argv);
57+
}
58+
}
59+
60+
void mutate_helper_init() {
61+
afl_mutate_helper = (mutate_helper_t *)calloc(1, sizeof(mutate_helper_t));
62+
afl_mutate_helper->len = INITIAL_SIZE;
63+
afl_mutate_helper->buf = (uint8_t *)calloc(1, afl_mutate_helper->len);
64+
if (!afl_mutate_helper->buf) perror("mutate_helper_init");
65+
fake_init();
66+
}
67+
68+
size_t mutate_helper_generate(unsigned char *buf, size_t buf_size) {
69+
return LLVMFuzzerTestOneInput(buf, buf_size);
70+
}
71+
72+
void mutate_helper_realloc_buf(size_t length) {
73+
74+
if (afl_mutate_helper->len <= length) {
75+
// double length
76+
size_t old_length = afl_mutate_helper->len;
77+
afl_mutate_helper->len = length * 2;
78+
afl_mutate_helper->buf = (uint8_t *)realloc(afl_mutate_helper->buf, afl_mutate_helper->len);
79+
if (!afl_mutate_helper->buf) {
80+
perror("mutate_helper_realloc");
81+
return;
82+
}
83+
}
84+
85+
memset(afl_mutate_helper->buf, 0, afl_mutate_helper->len);
86+
}
87+
88+
void mutate_helper_buffer_copy(unsigned char *buf, size_t buf_size){
89+
mutate_helper_realloc_buf(buf_size);
90+
// Clear only the newly allocated portion of the buffer
91+
memcpy(afl_mutate_helper->buf, buf, buf_size);
92+
93+
}
94+
95+
uint8_t* mutate_helper_buffer(){
96+
return afl_mutate_helper->buf;
97+
}
98+
99+
size_t mutate_helper_buffer_size(){
100+
return afl_mutate_helper->len;
101+
}
102+
103+
#undef MAX_LENGTH
104+
#undef INITIAL_SIZE
105+

‎utils/aflpp_extractor/extractor.h‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
// Copyright 2023 P1umer
2+
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
#include <stddef.h>
15+
#include <stdint.h>
16+
#include <stdlib.h>
17+
18+
typedef struct mutate_helper {
19+
uint8_t *buf;
20+
size_t len;
21+
} mutate_helper_t;
22+
23+
// extern function used in AFL++
24+
void fake_init();
25+
void mutate_helper_init();
26+
size_t mutate_helper_generate(unsigned char *buf, size_t buf_size);
27+
uint8_t* mutate_helper_buffer();
28+
size_t mutate_helper_buffer_size();
29+
30+
void mutate_helper_realloc_buf(size_t length);
31+
32+
// extern function used in Libfuzzer
33+
void mutate_helper_buffer_copy(unsigned char *buf, size_t buf_size);

‎utils/aflpp_extractor/extractor_test.c‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
// Copyright 2023 P1umer
2+
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
#include <stddef.h>
15+
#include <stdint.h>
16+
#include <stdio.h>
17+
#include <stdlib.h>
18+
#include <string.h>
19+
20+
// Simple target function to check if input contains "++".
21+
int target_function(const uint8_t *data, size_t size) {
22+
for (size_t i = 0; i < size - 1; ++i) {
23+
if (data[i] == '+' && data[i + 1] == '+') {
24+
return 1;
25+
}
26+
}
27+
return 0;
28+
}
29+
30+
#include "fuzzer_ext.h"
31+
32+
// libFuzzer's required entry point.
33+
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
34+
size_t new_size = size + 2; // Adding 2 for "++"
35+
uint8_t *modified_data = (uint8_t *)malloc(new_size);
36+
memcpy(modified_data, data, size);
37+
modified_data[size] = '+';
38+
modified_data[size + 1] = '+';
39+
40+
// extractor start
41+
42+
mutate_helper_buffer_copy(modified_data, size + 2);
43+
44+
// extractor end
45+
46+
// int result = target_function(modified_data, new_size);
47+
48+
free(modified_data);
49+
// return result;
50+
return 0;
51+
}
52+
53+

‎utils/aflpp_extractor/fuzzer_ext.h‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// Copyright 2023 P1umer
2+
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
typedef struct mutate_helper {
15+
uint8_t *buf;
16+
size_t len;
17+
} mutate_helper_t;
18+
19+
#ifdef __cplusplus
20+
extern "C" {
21+
#endif
22+
extern void mutate_helper_buffer_copy(unsigned char *buf, size_t buf_size);
23+
#ifdef __cplusplus
24+
}
25+
#endif

‎utils/aflpp_extractor/reproducer.c‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
// Copyright 2023 P1umer
2+
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
#include <stddef.h>
15+
#include <stdint.h>
16+
#include <stdio.h>
17+
#include <stdlib.h>
18+
19+
#include "afl_ext.h"
20+
21+
int main(int argc, char* argv[]) {
22+
23+
mutate_helper_init();
24+
25+
if (argc < 3) {
26+
fprintf(stderr, "USAGE: %s <input> <output>\n", argv[0]);
27+
return 1;
28+
}
29+
30+
FILE* input = fopen(argv[1], "rb");
31+
32+
if (!input) {
33+
fprintf(stderr, "Failed to open '%s'\n", argv[1]);
34+
return 1;
35+
}
36+
37+
fseek(input, 0, SEEK_END);
38+
size_t size = ftell(input);
39+
fseek(input, 0, SEEK_SET);
40+
41+
uint8_t* data = (uint8_t*)(malloc(size));
42+
if (!data) {
43+
fclose(input);
44+
fprintf(stderr, "Failed to allocate %zu bytes\n", size);
45+
return 1;
46+
}
47+
48+
size_t bytes_read = fread(data, 1, size, input);
49+
fclose(input);
50+
51+
if (bytes_read != (size_t)(size)) {
52+
free(data);
53+
fprintf(stderr, "Failed to read %s\n", argv[1]);
54+
return 1;
55+
}
56+
57+
printf("[+] prev data: %s\n", data);
58+
59+
mutate_helper_generate(data, size);
60+
int result = mutate_helper_buffer_size();
61+
uint8_t* transfer = mutate_helper_buffer();
62+
63+
printf("[+] result data: %d\n %s\n", result,transfer);
64+
65+
FILE* output=fopen(argv[2],"wb");
66+
fwrite(transfer, 1,result, output);
67+
68+
free(data);
69+
70+
// MutateHelper_C_delete();
71+
72+
return result;
73+
}

0 commit comments

Comments
 (0)