syzkaller环境搭建指南

环境Ubuntu18.04、qemu-system

编译syzkaller

由于使用virtualbox搭建的linux虚拟机不支持kvm，需要修改syzkaller后编译
wget https://dl.google.com/go/go1.14.2.linux-amd64.tar.gz
tar -xf go1.14.2.linux-amd64.tar.gz
mv go goroot
mkdir gopath
export GOPATH=pwd/gopath
export GOROOT=pwd/goroot
export PATH=$GOPATH/bin:$PATH
export PATH=$GOROOT/bin:$PATH

go get -u -d github.com/google/syzkaller/prog
cd gopath/src/github.com/google/syzkaller/
make

注释掉 vm/qemu.go 中的 125行（这个文件配置了qemu的一些基本命令）

	"linux/amd64": {
		Qemu:     "qemu-system-x86_64",
   注释掉//QemuArgs: "-enable-kvm -cpu host,migratable=off", 
		// e1000e fails on recent Debian distros with:
		// Initialization of device e1000e failed: failed to find romfile "efi-e1000e.rom
		// But other arches don't use e1000e, e.g. arm64 uses virtio by default.
		NetDev: "e1000",
		RngDev: "virtio-rng-pci",
		CmdLine: []string{
			"root=/dev/sda",
			"console=ttyS0",
		},

编译内核

为了加快速度 可以从gitee的镜像站下载linux内核（5.15.0）
cd linux
make CC="$GCC/bin/gcc" defconfig
编辑 .config 检查以下配置项是否存在,不存在添加

# Coverage collection.
CONFIG_KCOV=y

# Debug info for symbolization.
CONFIG_DEBUG_INFO=y

# Memory bug detector
CONFIG_KASAN=y
CONFIG_KASAN_INLINE=y

# Required for Debian Stretch
CONFIG_CONFIGFS_FS=y
CONFIG_SECURITYFS=y

make CC="$GCC/bin/gcc" -j8
在/arch/x86/boot/bzImage

编译image

去syzkaller的github上粘贴create-image.sh的内容
安装debootstrap
chmod +x create-image.sh
./create-image.sh

测试内核和image

qemu-system-x86_64 \
  -kernel /home/panww/linux-4.5/arch/x86_64/boot/bzImage \
  -append "console=ttyS0 root=/dev/sda debug earlyprintk=serial slub_debug=QUZ"\
  -hda ./stretch.img \
  -net user,hostfwd=tcp::10021-:22 -net nic \
  -nographic \
  -m 2G \
  -smp 2

测试syzkaller

/home/panww/gopath/src/github.com/google/syzkaller/bin/syz-manager -config=my.config -debug

编写配置文件 my.config

{
	"target": "linux/amd64",
	"http": "127.0.0.1:56741",
	"workdir": "/home/panww/gopath/src/github.com/google/syzkaller_work",
	"kernel_obj": "/home/panww/image/linux",
	"image": "/home/panww/image/stretch.img",
	"sshkey": "/home/panww/image/stretch.id_rsa",
	"syzkaller": "/home/panww/gopath/src/github.com/google/syzkaller",
	"procs": 8,
	"type": "qemu",
	"vm": {
		"count": 4,
		"kernel": "/home/panww/image/linux/arch/x86/boot/bzImage",
		"cpu": 2,
		"mem": 2048
	}
}

在127.0.0.1:56741 查看测试情况