Skip to content

Commit

Permalink
solve lint warnings
Browse files Browse the repository at this point in the history
  • Loading branch information
Zekun Wang committed Jan 23, 2025
1 parent 0508c7f commit 1149764
Showing 1 changed file with 67 additions and 70 deletions.
137 changes: 67 additions & 70 deletions fuzzers/path_afl/fuzzer.py
Original file line number Diff line number Diff line change
Expand Up @@ -16,22 +16,23 @@
import os
import shutil
import subprocess

from fuzzers import utils


def prepare_build_environment():
"""Set environment variables used to build targets for pathAFL-based
fuzzers."""
os.environ['LD_LIBRARY_PATH'] = '/path-afl'
os.environ['CC'] = '/path-afl/afl-clang-fast'
os.environ['CXX'] = '/path-afl/afl-clang-fast++'
os.environ["LD_LIBRARY_PATH"] = "/path-afl"
os.environ["CC"] = "/path-afl/afl-clang-fast"
os.environ["CXX"] = "/path-afl/afl-clang-fast++"
current_directory = os.getcwd()
os.environ["BBIDFILE"] = os.path.join(current_directory, "bbid.txt")
os.environ["CALLMAPFILE"] = os.path.join(current_directory, "callmap.txt")
os.environ["CFGFILE"] = os.path.join(current_directory, "cfg.txt")
os.environ["FUZZER"] = '/path-afl'
os.environ["AFL_LLVM_CALLER"] = '1'
os.environ['FUZZER_LIB'] = '/libAFLDriver.a'
os.environ["FUZZER"] = "/path-afl"
os.environ["AFL_LLVM_CALLER"] = "1"
os.environ["FUZZER_LIB"] = "/libAFLDriver.a"


def build():
Expand All @@ -40,110 +41,106 @@ def build():

utils.build_benchmark()

subprocess.run('cat cfg.txt | grep "BasicBlock: " | wc -l > bbnum.txt',
shell=True,
check=True)
subprocess.run(
'cat cfg.txt | grep "BasicBlock: " | wc -l > bbnum.txt',
shell=True,
check=True,
)
print(f"/out/{os.getenv('FUZZ_TARGET')}")
result = subprocess.run([
"bash", '/path-afl/fuzzing_support/filterCFGandCallmap.sh',
f"/out/{os.getenv('FUZZ_TARGET')}"
],
check=False,
capture_output=True,
text=True)
result = subprocess.run(
[
"bash",
"/path-afl/fuzzing_support/filterCFGandCallmap.sh",
f"/out/{os.getenv('FUZZ_TARGET')}",
],
check=False,
capture_output=True,
text=True,
)
print(result.stdout)
print(result.stderr)
...
subprocess.run(
'cat cfg_filtered.txt | grep \"Function: \" | nl -v 0 | awk \'{print $1, $3, $4, $5, $6, $7, $8, $9}\' > function_list.txt',
"cat cfg_filtered.txt | grep \"Function: \" | nl -v 0 | "
"awk '{print $1, $3, $4, $5, $6, $7, $8, $9}' > function_list.txt",
shell=True,
check=True)
check=True,
)
subprocess.run(
'g++ -I/path-afl/fuzzing_support /path-afl/fuzzing_support/convert.cpp -o convert',
"g++ -I/path-afl/fuzzing_support "
"/path-afl/fuzzing_support/convert.cpp -o convert",
shell=True,
check=True)
subprocess.run('./convert', shell=True, check=True)
check=True,
)
subprocess.run("./convert", shell=True, check=True)

print('[post_build] Copying afl-fuzz to $OUT directory')
print("[post_build] Copying afl-fuzz to $OUT directory")

# Copy out the afl-fuzz binary as a build artifact.
shutil.copy('/path-afl/libpath_reduction.so', os.environ['OUT'])
shutil.copy('/path-afl/afl-fuzz', os.environ['OUT'])
shutil.copy('./top.bin', os.environ['OUT'])
shutil.copy('/libpython3.8.so.1.0', os.environ['OUT'])
try:
src = '/usr/lib/llvm-17/lib'
dst = os.environ['OUT']
shutil.copytree(src, dst, dirs_exist_ok=True)
except KeyError:
print("Environment variable 'OUT' is not set.")
assert False
except FileNotFoundError as e:
print(f"Source directory not found: {e}")
assert False
except PermissionError as e:
print(f"Permission error: {e}")
assert False
except Exception as e:
print(f"An error occurred: {e}")
assert False
shutil.copy("/path-afl/libpath_reduction.so", os.environ["OUT"])
shutil.copy("/path-afl/afl-fuzz", os.environ["OUT"])
shutil.copy("./top.bin", os.environ["OUT"])
shutil.copy("/libpython3.8.so.1.0", os.environ["OUT"])
src = "/usr/lib/llvm-17/lib"
dst = os.environ["OUT"]
shutil.copytree(src, dst, dirs_exist_ok=True)


def prepare_fuzz_environment(input_corpus):
"""Prepare to fuzz with AFL or another AFL-based fuzzer."""
# Tell AFL to not use its terminal UI so we get usable logs.
os.environ['AFL_NO_UI'] = '1'
os.environ["AFL_NO_UI"] = "1"
# Skip AFL's CPU frequency check (fails on Docker).
os.environ['AFL_SKIP_CPUFREQ'] = '1'
os.environ["AFL_SKIP_CPUFREQ"] = "1"
# No need to bind affinity to one core, Docker enforces 1 core usage.
os.environ['AFL_NO_AFFINITY'] = '1'
os.environ["AFL_NO_AFFINITY"] = "1"
# AFL will abort on startup if the core pattern sends notifications to
# external programs. We don't care about this.
os.environ['AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES'] = '1'
os.environ["AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES"] = "1"
# Don't exit when crashes are found. This can happen when corpus from
# OSS-Fuzz is used.
os.environ['AFL_SKIP_CRASHES'] = '1'
os.environ["AFL_SKIP_CRASHES"] = "1"
# Shuffle the queue
os.environ['AFL_SHUFFLE_QUEUE'] = '1'
os.environ['CFG_BIN_FILE'] = './top.bin'
os.environ[
'LD_LIBRARY_PATH'] = f'./lib:{os.getcwd()}:{os.environ["LD_LIBRARY_PATH"]}'
os.environ["AFL_SHUFFLE_QUEUE"] = "1"
os.environ["CFG_BIN_FILE"] = "./top.bin"
os.environ["LD_LIBRARY_PATH"] = (
f'./lib:{os.getcwd()}:{os.environ["LD_LIBRARY_PATH"]}')

# AFL needs at least one non-empty seed to start.
utils.create_seed_file_for_empty_corpus(input_corpus)


def run_afl_fuzz(input_corpus,
output_corpus,
target_binary,
additional_flags=None,
hide_output=False):
def run_afl_fuzz(
input_corpus,
output_corpus,
target_binary,
hide_output=False,
):
"""Run afl-fuzz."""
# Spawn the afl fuzzing process.
print('[run_afl_fuzz] Running target with afl-fuzz')
print("[run_afl_fuzz] Running target with afl-fuzz")
command = [
'./afl-fuzz',
'-i',
"./afl-fuzz",
"-i",
input_corpus,
'-o',
"-o",
output_corpus,
# Use no memory limit as ASAN doesn't play nicely with one.
'-m',
'none',
'-t',
'1000+', # Use same default 1 sec timeout, but add '+' to skip hangs.
"-m",
"none",
"-t",
"1000+", # Use same default 1 sec timeout, but add '+' to skip hangs.
]
dictionary_path = utils.get_dictionary_path(target_binary)
if dictionary_path:
command.extend(['-x', dictionary_path])
command.extend(["-x", dictionary_path])
command += [
'--',
"--",
target_binary,
# Pass INT_MAX to afl the maximize the number of persistent loops it
# performs.
'2147483647'
"2147483647",
]
print('[run_afl_fuzz] Running command: ' + ' '.join(command))
print("[run_afl_fuzz] Running command: " + " ".join(command))
output_stream = subprocess.DEVNULL if hide_output else None
subprocess.check_call(command, stdout=output_stream, stderr=output_stream)

Expand All @@ -152,6 +149,6 @@ def fuzz(input_corpus, output_corpus, target_binary):
"""Run afl-fuzz on target."""
prepare_fuzz_environment(input_corpus)

os.environ['K'] = '42'
os.environ["K"] = "42"

run_afl_fuzz(input_corpus, output_corpus, target_binary)

0 comments on commit 1149764

Please sign in to comment.