vanhauser-thc / afl-pin Goto Github PK

run AFL with pintool

License: GNU Affero General Public License v3.0

Makefile 2.64% Shell 22.01% C++ 64.74% C 10.61%

pin pintool afl afl-fuzz afl-fuzzer thc fuzzer fuzzing binary-instrument

afl-pin's Introduction

Intro

This is the fastest pintool afl-fuzzer out there currently. And it runs with pintool 3.6 up to 3.11, so 4.x x64 kernels are fine. But ... pintool is super slow. So this is basically only if you have no other option. I am currently developing an alternative with DynamoRIO and is 10x faster - but still, afl qemu mode is 10-50x faster than that ...

Installation

download, compile and install afl => https://github.com/vanhauser-thc/AFLplusplus Optional: 2. download, compile and install dyninst => https://github.com/dyninst/dyninst Optional: 3. download, compile and install afl-dyninst => https://github.com/vanhauser-thc/afl-dyninst
download and unpack pin => https://software.intel.com/en-us/articles/pintool-downloads (download version 3.6 to 3.11)
export PIN_ROOT=/path/to/pin directory
make a symlink to the afl folder in the afl-pin directory named "afl" , e.g. "ln -s ../AFLplusplus afl"
make
make install

Options

-libs also instrument the dynamic libraries -exitpoint target exit the program when this address/function is reached. speeeed! -forkserver install a forkserver. You must set PIN_APP_LD_PRELOAD - or use afl-fuzz-pin.sh -entrypoint target function or address where you want to install the forkserver -alternative a little bit faster but less quality

How to run

Optional: 1. afl-dyninst.sh -i program -o program_instrumented -D It is a good idea to add -e and -E with well selected function addresses to make the fuzzing faster

afl-fuzz-pin.sh [normal afl-fuzz options] If you did not do step 1, add the option -forkserver (-forkserver is faster than afl-dyninst). You can increase speed more by selecting a good "-entrypoint function_name" or "-entrypoing 0x123456" location. That's it! If you fuzzing does not run, afl-fuzz might need more memory, set AFL_MEM to a high value, e.g. 700 for 700MB Using -forkserver requires PIN_APP_LD_PRELOAD=/usr/local/lib/pintool/forkserver.so but afl-fuzz-pin.sh takes care of this.

When to use it

When you have no source code, normal afl-dyninst is crashing the binary, qemu mode -Q is not an option and dynamorio is not working either. Pin is even 90% slower than my dynamorio implementation ...

Limitations

Pin is super slow ... it is the tool of last resort on x86/x64.

Who and where

Marc "van Hauser" Heuse [email protected] || [email protected] https://github.com/vanhauser-thc/afl-pin

afl-pin's People

Contributors

Stargazers

Watchers

Forkers

fuzzamos v-p-b who3411 seabreg amydan-whu cherry-wb 5l1v3r1 microsvuln enheng5

afl-pin's Issues

Build Problems

It should be mentioned in the README, that PIN_ROOT must be set to the Path where pin is deployed.
Furthermore, I cannot build it because it cannot find pin.H. Should the gcc flags include the pin-include directory?

Fork server handshake failed

I want to fuzz a 32bit binary with your tool. So I compiled it with -DTARGET_IA32 flag.
When I try to run it with any target binray I'm getting this error:

$ ../afl-pin/afl-fuzz-pin.sh -i indir/ -o odir/ -forkserver -- ./a.out @@
sysctl: permission denied on key 'kernel.core_pattern'
sysctl: permission denied on key 'kernel.randomize_va_space'
tee: '/sys/devices/system/cpu/cpu*/cpufreq/scaling_governor': No such file or directory
Running: afl-fuzz -m 700 -i indir/ -o odir/ -- /home/ros/pin-3.6-97554-g31f0a167d-gcc-linux//pin -t /usr/local/lib/pintool/afl-pin.so -forkserver -- ./a.out @@
afl-fuzz 2.52b by <[email protected]>
[+] You have 4 CPU cores and 1 runnable tasks (utilization: 25%).
[+] Try parallel jobs - see /usr/local/share/doc/afl/parallel_fuzzing.txt.
[*] Checking CPU core loadout...
[+] Found a free CPU core, binding to #0.
[*] Checking core_pattern...
[*] Setting up output directories...
[+] Output directory exists but deemed OK to reuse.
[*] Deleting old session data...
[+] Output dir cleanup successful.
[*] Scanning 'indir/'...
[+] No auto-generated dictionary tokens to reuse.
[*] Creating hard links for all input files...
[*] Validating target binary...
[*] Attempting dry run with 'id:000000,orig:crash_test.c'...
[*] Spinning up the fork server...

[-] Hmm, looks like the target binary terminated before we could complete a
    handshake with the injected code. There are two probable explanations:

    - The current memory limit (700 MB) is too restrictive, causing an OOM
      fault in the dynamic linker. This can be fixed with the -m option. A
      simple way to confirm the diagnosis may be:

      ( ulimit -Sv $[699 << 10]; /path/to/fuzzed_app )

      Tip: you can use http://jwilk.net/software/recidivm to quickly
      estimate the required amount of virtual memory for the binary.

    - Less likely, there is a horrible bug in the fuzzer. If other options
      fail, poke <[email protected]> for troubleshooting tips.

[-] PROGRAM ABORT : Fork server handshake failed
         Location : init_forkserver(), afl-fuzz.c:2253

I'm unsure about the few error messages at the beginning. Are they relevant?

When running
$ /home/ros/pin-3.6-97554-g31f0a167d-gcc-linux//pin -t /usr/local/lib/pintool/afl-pin.so -forkserver -- ./a.out @@
I'm getting this error:
Error: AFL environment variable __AFL_SHM_ID not set

Thanks

"Fork server handshake failed"

For test purposes I wanted to try out your tool with the GNU Binutils strings command. I get the following output:

$ AFL_MEM=none afl-fuzz-pin.sh -forkserver -Q -i afl_in -o afl_out -M fuzzer01 -- strings @@

kernel.core_pattern = core
kernel.randomize_va_space = 0
Running: afl-fuzz -m none -Q -i afl_in -o afl_out -M fuzzer01 -- /home/afl_user/Tools/pin-intel/pin -t /usr/local/lib/pintool/afl-pin.so -forkserver -- ./strings @@
afl-fuzz 2.52b by <[email protected]>
[+] You have 12 CPU cores and 5 runnable tasks (utilization: 42%).
[+] Try parallel jobs - see /usr/local/share/doc/afl/parallel_fuzzing.txt.
[*] Checking CPU core loadout...
[+] Found a free CPU core, binding to #4.
[*] Checking core_pattern...
[*] Checking CPU scaling governor...
[*] Setting up output directories...
[+] Output directory exists but deemed OK to reuse.
[*] Deleting old session data...
[+] Output dir cleanup successful.
[*] Scanning 'afl_in'...
[+] No auto-generated dictionary tokens to reuse.
[*] Creating hard links for all input files...
[*] Validating target binary...
[*] Attempting dry run with 'id:000000,orig:elf-32bit'...
[*] Spinning up the fork server...

[-] Hmm, looks like the target binary terminated before we could complete a
    handshake with the injected code. Perhaps there is a horrible bug in the
    fuzzer. Poke <[email protected]> for troubleshooting tips.

[-] PROGRAM ABORT : Fork server handshake failed
         Location : init_forkserver(), afl-fuzz.c:2253

I also tried different memory limits, but that changed nothing.

If I understand it correctly by using -forkserver I do not have to additionally instrument the binary.

If I run strings without AFL on the generated test case in fuzzer01/queue, it works as expected.

where is forkserver.so？

Hi,
I tried to use afl-pin with forkserver, but where is forkserver.so, and i found there is no forkserver.cpp file in pin directory.

Support for PIN 3.10

PIN 3.10 changed the API and afl-pin does not compile anymore.

todo: put in some #if's to handle this.

low priority for me so a patch is welcome