unibench是一个用来评估模糊测试工具的benchmark。这个benchmark集成了20多个常用的测试程序,以及许多模糊测试工具。
这篇文章(https://zhuanlan.zhihu.com/p/421124258)对unibench进行了简单的介绍,本文就不再赘诉,而是侧重于介绍unibench具体是如何用来评估模糊测试工具。
关于unibench更详细的介绍,可以去看2021年发表在Usenix Security上的论文:[https://nesa.zju.edu.cn/download/UNIFUZZ A Holistic and Pragmatic Metrics-Driven Platform for Evaluating Fuzzers.pdf](https://nesa.zju.edu.cn/download/UNIFUZZ A Holistic and Pragmatic Metrics-Driven Platform for Evaluating Fuzzers.pdf)
unibench可以在这里找到:https://github.com/unifuzz
下面将介绍以使用unibench来评估AFL这一经典的模糊测试工具为例来介绍过一下unibench的流程。
1. 构建AFL和测试程序的镜像
运行下面命令,构建AFL和unibench的20个程序的镜像。下面命令需要较长的时间才能完成。
git clone https://github.com/unifuzz/unibench_build.git
cd unibench/afl
docker build -t .
除了上面的方法,unifuzz的作者也在dockerhub上传了build好的镜像可以直接使用。具体可以查看该链接:https://hub.docker.com/r/unifuzz/unibench
docker pull unifuzz/unibench:afl
然后运行下面命令验证是否装好
docker run -it --rm unifuzz/unibench:afl strings /d/p/justafl/exiv2 |grep afl|head
若出现下面的提示信息,则说明已装好
__afl_global_area_ptr
__afl_maybe_log
__afl_area_ptr
__afl_setup
__afl_store
__afl_prev_loc
__afl_return
__afl_setup_failure
__afl_setup_first
__afl_setup_abort
2. 运行模糊测试实验
2.1 系统配置
运行实验前,先进行基础的系统配置
echo "" | sudo tee /proc/sys/kernel/core_pattern # disable generating of core dump file
echo 0 | sudo tee /proc/sys/kernel/core_uses_pid
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope
echo 1 | sudo tee /proc/sys/kernel/sched_child_runs_first # tfuzz require this
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space # vuzzer require this
如果出现No such file or directory的错误信息也没关系,可以无视。
2.2 运行实验
前面搭建好的镜像中已经使用afl-clang插过桩了,所以只需要使用docker run命令来跑afl-fuzz,就可以运行模糊测试的实验了。
mkdir work # 在宿主机创建一个文件夹保留AFL跑实验的结果
cd work
git clone https://github.com/unifuzz/seeds.git # 获取测试程序所需的种子
docker run -it --cpus=1 -w /work -v `pwd`:/work --privileged unifuzz/unibench:afl \
afl-fuzz -i /work/seeds/general_evaluation/mp3 -o output -m none -t 500+ \
--/d/p/justafl/mp3gain @@
下面介绍下docker run各个选项的意思:
- -it:指定交互式终端,并分配伪终端
- —cpus=1:只分配一个CPU核
- -w /work:指定容器内工作目录为/work
- -v
pwd
:/work :挂载当前目录(宿主机)为容器的/work目录,使容器内部对/work的访问实际上是对宿主机当前目录的访问 - —privileged:赋予容器运行时的特权
然后第二行开始的就是afl-fuzz的选项:
- -i /work/seeds/general_evaluation/mp3:指定种子目录为/work/seeds/general_evaluation/mp3
- -o output:指定输出目录为 output
- -m none:不限制内存
- -t 500+:处理种子样例所需的时间
第三行可以理解为AFL会不断fork进程运行第三行的命令,@@则是模糊测试生成的测试样例的占位符。
unibench也给出了其他程序的命令行参数。
data = [
#id, prog, commandline, seed_folder
[1, "exiv2", "@@", "jpg"],
[2,"tiffsplit","@@","tiff"],
[3,"mp3gain","@@","mp3"],
[4,"wav2swf","-o /dev/null @@","wav"],
[5,"pdftotext","@@ /dev/null","pdf"],
[6,"infotocap","-o /dev/null @@","text"],
[7,"mp42aac","@@ /dev/null","mp4"],
[8,"flvmeta","@@","flv"],
[9,"objdump","-S @@","obj"],
[14, "tcpdump", "-e -vv -nr @@", "tcpdump100"],
[15, "ffmpeg", "-y -i @@ -c:v mpeg4 -c:a copy -f mp4 /dev/null", "ffmpeg100"],
[16, "gdk-pixbuf-pixdata", "@@ /dev/null", "pixbuf"],
[17, "cflow", "@@", "cflow"],
[18, "nm-new", "-A -a -l -S -s --special-syms --synthetic --with-symbol-versions -D @@", "nm"],
[19, "sqlite3", " < @@", "sql"],
[20, "lame3.99.5", "@@ /dev/null", "lame3.99.5"],
[21, "jhead", "@@", "jhead"],
[22, "imginfo", "-f @@", "imginfo"],
[23, "jq", ". @@", "json"],
[24, "mujs", "@@", "mujs"],
# below is the LAVA-M settings
[10,"uniq","@@","uniq"],
[11,"base64","-d @@","base64"],
[12,"md5sum","-c @@","md5sum"],
[13,"who","@@","who"],
]
运行完上面命令,就会显示AFL的界面。
如果想后台运行实验,docker run的时候加上-d选项即可
docker run -itd --cpus=1 -w /work -v `pwd`:/work --privileged unifuzz/unibench:afl \
afl-fuzz -i /work/seeds/general_evaluation/mp3 -o output -m none -t 500+ \
--/d/p/justafl/mp3gain @@
3. 分析实验结果
unifuzz提供了一些分析实验结果的脚本。尝试了在宿主机下运行,疯狂报错,看起来需要在docker容器内部运行。