AFL学习(一)-补充QEMU模式

QEMU模式测试

编译QEMU

参考README.qemu

$./build_qemu_support.sh

# Cannot use 'python', Python 2.6 or later is required.Note that Python 3 or later is not yet supported.
# 安装依赖，将python链接到python2上
$ sudo apt-get install libtool,libtool-bin,bison,libgtk2.0-dev,python2



=================================================
AFL binary-only instrumentation QEMU build script
=================================================

[*] Performing basic sanity checks...
[+] All checks passed!
[+] Cryptographic signature on qemu-2.10.0.tar.xz checks out.
[*] Uncompressing archive (this will take a while)...
[+] Unpacking successful.
[*] Configuring QEMU for ...
[*] Applying patches...
patching file linux-user/elfload.c
patching file accel/tcg/cpu-exec.c
patching file linux-user/syscall.c
patching file configure
patching file util/memfd.c
[+] Patching done.
Install prefix    /usr/local
BIOS directory    /usr/local/share/qemu
binary directory  /usr/local/bin
library directory /usr/local/lib
module directory  /usr/local/lib/qemu
libexec directory /usr/local/libexec
include directory /usr/local/include
config directory  /usr/local/etc
local state directory   /usr/local/var
Manual directory  /usr/local/share/man
ELF interp prefix /usr/gnemul/qemu-%M
Source path       /home/workhome/AFL/qemu_mode/qemu-2.10.0
C compiler        cc
Host C compiler   cc
C++ compiler      c++
Objective-C compiler cc
ARFLAGS           rv
CFLAGS            -O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -g -O3 -ggdb
QEMU_CFLAGS       -I/usr/include/pixman-1 -I$(SRC_PATH)/dtc/libfdt -pthread -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include -fPIE -DPIE -m64 -mcx16 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-common -fwrapv  -Wexpansion-to-defined -Wendif-labels -Wno-shift-negative-value -Wno-missing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Wold-style-definition -Wtype-limits -fstack-protector-strong
LDFLAGS           -Wl,--warn-common -Wl,-z,relro -Wl,-z,now -pie -m64 -g
make              make
install           install
python            python -B
smbd              /usr/sbin/smbd
module support    no
host CPU          x86_64
host big endian   no
target list       x86_64-linux-user
gprof enabled     no
sparse enabled    no
strip binaries    yes
profiler          no
static build      no
pixman            system
SDL support       no
GTK support       no
GTK GL support    no
VTE support       no
TLS priority      NORMAL
GNUTLS support    no
GNUTLS rnd        no
libgcrypt         no
libgcrypt kdf     no
nettle            no
nettle kdf        no
libtasn1          no
curses support    no
virgl support     no
curl support      no
mingw32 support   no
Audio drivers     oss
Block whitelist (rw)
Block whitelist (ro)
VirtFS support
VNC support       no
xen support       no
brlapi support    no
bluez  support    no
Documentation     no
PIE               yes
vde support       no
netmap support    no
Linux AIO support no
ATTR/XATTR support yes
Install blobs     yes
KVM support       yes
HAX support       no
TCG support       yes
TCG debug enabled no
TCG interpreter   no
RDMA support      no
fdt support       yes
preadv support    yes
fdatasync         yes
madvise           yes
posix_madvise     yes
libcap-ng support no
vhost-net support yes
vhost-scsi support yes
vhost-vsock support yes
vhost-user support yes
Trace backends    log
spice support     no
rbd support       no
xfsctl support    no
smartcard support no
libusb            no
usb net redir     no
OpenGL support    no
OpenGL dmabufs    no
libiscsi support  no
libnfs support    no
build guest agent yes
QGA VSS support   no
QGA w32 disk info no
QGA MSI support   no
seccomp support   no
coroutine backend ucontext
coroutine pool    yes
debug stack usage no
crypto afalg      no
GlusterFS support no
gcov              gcov
gcov enabled      no
TPM support       yes
libssh2 support   no
TPM passthrough   yes
QOM debugging     yes
Live block migration yes
lzo support       no
snappy support    no
bzip2 support     no
NUMA host support no
tcmalloc support  no
jemalloc support  no
avx2 optimization yes
replication support yes
VxHS block device no
[+] Configuration complete.

gettid 错误

error: static declaration of ‘gettid’ follows non-static declaration 261 | _syscall0(int, gettid)

AFL QEMU模式安装报错（afl-2.52b & qemu-2.10.0）[已解决]

util/memfd.c:40:12: error: static declaration of ‘memfd_create 错误

【AFL-qemu安装问题】出现util/memfd.c:40:12: error: static declaration of ‘memfd_create’ follows non-static d

$ ./build_qemu_support.sh
········
省略编译过程
········
[+] Build process successful!
[*] Copying binary...
-rwxr-xr-x 1 root root 14238392 Apr 10 07:54 ../afl-qemu-trace
[+] Successfully created '../afl-qemu-trace'.
[*] Testing the build...
[+] Instrumentation tests passed.
[+] All set, you can now use the -Q mode in afl-fuzz!
# 将afl-qemu-trace 放到与afl-fuzz 同目录下(/usr/local/bin) 并将此目录添加到环境变量即可

编写C++代码测试

#include <iostream>
#include <string>
#include <signal.h>
using namespace std;


void test (string buf) {

    int len = buf.length();
    if (( len == 6  && buf[0] == 's' && buf[1]=='i' && buf[2]=='z')||(len >=7 && buf[0]=='x' && buf[1]=='i' && buf[2]=='d' && buf[3]=='i'&& buf[4]=='a' && buf[5]=='n')){
        cout<<"awesome found sizaif !"<<endl;
        raise(SIGSEGV);
    }
    else{
        cout<<"sorry not"<<endl;
    }

}

int main(int argc, char *argv[]) {

    string buf = "";
    cin>>buf;
    test(buf);
    return 0;
}

编译并进行fuzz

$ root@2d34b521fdd5:/home/workhome/afl-test/insc++# afl-fuzz -Q -i in -o crash_qemu ./afltestc++2
afl-fuzz 2.57b by <lcamtuf@google.com>
[+] You have 16 CPU cores and 4 runnable tasks (utilization: 25%).
[+] Try parallel jobs - see /usr/local/share/doc/afl/parallel_fuzzing.txt.
[*] Checking CPU core loadout...
[+] Found a free CPU core, binding to #0.
[*] Checking core_pattern...
[*] Setting up output directories...
[+] Output directory exists but deemed OK to reuse.
[*] Deleting old session data...
[+] Output dir cleanup successful.
[*] Scanning 'in'...
[+] No auto-generated dictionary tokens to reuse.
[*] Creating hard links for all input files...
[*] Validating target binary...
[*] Attempting dry run with 'id:000000,orig:t.txt'...
[*] Spinning up the fork server...
[+] All right - fork server is up.
    len = 6, map size = 58, exec speed = 3060 us
[+] All test cases processed.

[+] Here are some useful stats:

    Test case count : 1 favored, 0 variable, 1 total
       Bitmap range : 58 to 58 bits (average: 58.00 bits)
        Exec timing : 3060 to 3060 us (average: 3060 us)

[*] No -t option specified, so I'll use exec timeout of 20 ms.
[+] All set and ready to roll!

crash