Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update to AFL++ #66

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Update to AFL++ #66

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
102adff
Update to AFL++
mschessler Jan 6, 2025
799a42c
Merge branch 'master' into aflpp
mschessler Jan 11, 2025
c9ed07c
Merge branch 'master' into aflpp
mschessler Jan 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 22 additions & 21 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,14 +11,14 @@
[license-shield]: https://img.shields.io/badge/license-MIT-blue.svg?style=flat
[license-link]: https://github.com/metalnem/sharpfuzz/blob/master/LICENSE

SharpFuzz is a tool that brings the power of [afl-fuzz]
SharpFuzz is a tool that brings the power of [AFL++]
to .NET platform. If you want to learn more about fuzzing,
my motivation for writing SharpFuzz, the types of bugs
it can find, or the technical details about how the
integration with afl-fuzz works, read my blog post
[SharpFuzz: Bringing the power of afl-fuzz to .NET platform](https://mijailovic.net/2019/01/03/sharpfuzz/).

[afl-fuzz]: http://lcamtuf.coredump.cx/afl/
[AFL++]: https://github.com/AFLplusplus/AFLplusplus

## Table of contents

Expand Down Expand Up @@ -142,44 +142,45 @@ request for the README file, or file an issue.

## Requirements

AFL works on Linux and macOS. If you are using Windows, you can use any Linux distribution
AFL++ works on Linux and macOS. If you are using Windows, you can use any Linux distribution
that works under the [Windows Subsystem for Linux]. For native Windows support, you can use
[libFuzzer](https://github.com/Metalnem/sharpfuzz/blob/master/docs/libFuzzer.md)
instead of AFL.
[libFuzzer] instead of AFL.

You will need GNU make and a working compiler
(gcc or clang) in order to compile afl-fuzz.
You will also need to have the [.NET 8.0]
(gcc or clang) in order to compile afl-fuzz ([Installing AFL++]).
You will also need to have [.NET 8.0]
or greater installed on your machine in order
to instrument .NET assemblies with SharpFuzz.

To simplify your fuzzing experience, it's also
recommended to install [PowerShell].

[libFuzzer]: https://github.com/Metalnem/sharpfuzz/blob/master/docs/libFuzzer.md
[Installing AFL++]: https://github.com/AFLplusplus/AFLplusplus/blob/stable/docs/INSTALL.md
[Windows Subsystem for Linux]: https://docs.microsoft.com/en-us/windows/wsl/install-win10
[.NET 8.0]: https://dotnet.microsoft.com/download
[PowerShell]: https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell

## Installation

You can install afl-fuzz and [SharpFuzz.CommandLine]
global .NET tool by running the following [script]:
global .NET tool by running the following PowerShell [script]:

```shell
#/bin/sh
set -eux

# Download and extract the latest afl-fuzz source package
wget http://lcamtuf.coredump.cx/afl/releases/afl-latest.tgz
tar -xvf afl-latest.tgz
wget https://github.com/AFLplusplus/AFLplusplus/archive/refs/tags/v4.30c.tar.gz
tar -xvzf v4.30c.tar.gz

rm afl-latest.tgz
cd afl-2.52b/
rm v4.30c.tar.gz
cd AFLplusplus-4.30c/

# Install afl-fuzz
sudo make install
cd ..
rm -rf afl-2.52b/
rm -rf AFLplusplus-4.30c/

# Install SharpFuzz.CommandLine global .NET tool
dotnet tool install --global SharpFuzz.CommandLine
Expand All @@ -192,15 +193,15 @@ dotnet tool install --global SharpFuzz.CommandLine

This tutorial assumes that you are somewhat familiar
with afl-fuzz. If you don't know anything about it, you
should first read the [AFL quick start guide] and the
should first read the [afl-fuzz approach] and the
[afl-fuzz README]. If you have enough time, I would
also recommend reading [Understanding the status screen]
and [Technical whitepaper for afl-fuzz].
also recommend reading [Fuzzing in depth]
and [Technical whitepaper for AFL++].

[AFL quick start guide]: http://lcamtuf.coredump.cx/afl/QuickStartGuide.txt
[afl-fuzz README]: http://lcamtuf.coredump.cx/afl/README.txt
[Understanding the status screen]: http://lcamtuf.coredump.cx/afl/status_screen.txt
[Technical whitepaper for afl-fuzz]: http://lcamtuf.coredump.cx/afl/technical_details.txt
[afl-fuzz approach]: https://github.com/AFLplusplus/AFLplusplus/blob/stable/docs/afl-fuzz_approach.md
[afl-fuzz README]: https://github.com/AFLplusplus/AFLplusplus/blob/stable/README.md
[Fuzzing in depth]: https://github.com/AFLplusplus/AFLplusplus/blob/stable/docs/fuzzing_in_depth.md
[Technical whitepaper for AFL++]: https://aflplus.plus/papers/aflpp-woot2020.pdf

As an example, we are going to fuzz [Jil],
which is a fast JSON serializer and deserializer
Expand Down Expand Up @@ -295,7 +296,7 @@ some useful results within minutes, but sometimes
it can take more than a day, so be patient.

The input files responsible for unhandled exceptions will
appear in the ```findings/crashes``` directory. The total
appear in the ```findings/default/crashes``` directory. The total
number of unique crashes will be displayed in red on the
afl-fuzz status screen.

Expand Down
6 changes: 1 addition & 5 deletions docs/miscellaneous.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ terminate and display the following error message:

If you encounter this message during fuzzing, you can recover
the input data that has caused the premature exit from the file
```findings_dir/.cur_input```.
```findings_dir/default/.cur_input```.

There is also an out-of-process version of fuzzer which is
using two different .NET processes: the master process for
Expand Down Expand Up @@ -55,7 +55,3 @@ You can run it using the following command:
afl-tmin -i test_case -o minimized_result \
dotnet path_to_assembly
```

The only change you have to make in your fuzzing
project is to replace the **Fuzzer.Run** call with
the call to **Fuzzer.RunOnce**.
10 changes: 5 additions & 5 deletions scripts/install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,16 @@
set -eux

# Download and extract the latest afl-fuzz source package
wget http://lcamtuf.coredump.cx/afl/releases/afl-latest.tgz
tar -xvf afl-latest.tgz
wget https://github.com/AFLplusplus/AFLplusplus/archive/refs/tags/v4.30c.tar.gz
tar -xvzf v4.30c.tar.gz

rm afl-latest.tgz
cd afl-2.52b/
rm v4.30c.tar.gz
cd AFLplusplus-4.30c/

# Install afl-fuzz
sudo make install
cd ..
rm -rf afl-2.52b/
rm -rf AFLplusplus-4.30c/

# Install SharpFuzz.CommandLine global .NET tool
dotnet tool install --global SharpFuzz.CommandLine
2 changes: 1 addition & 1 deletion scripts/test.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ dotnet publish src/SharpFuzz.CommandLine/SharpFuzz.CommandLine.csproj `
-i corpus `
-command out/SharpFuzz.CommandLine

$output = Get-Content -Path "./findings/.cur_input" -Raw
$output = Get-Content -Path "./findings/default/.cur_input" -Raw
$crasher = "Whoopsie"

if (-not $output.Contains($crasher)) {
Expand Down
Loading