trace2syz
Hi! This is tool converts strace output to Syzkaller programs. It is adapted from MoonShine which can be found here.
Getting Started
The following setup instructions have been tested on Ubuntu 16.04. Let us know if there are issues on other versions or distributions.
Requirements
Go
Trace2Syz is written in Go so the first step is to setup Go. You can either follow the below instructions or follow the Official Go Installation Guide .
$ wget https://dl.google.com/go/go1.10.3.linux-amd64.tar.gz
$ sudo tar -C /usr/local -xzf go1.10.3.linux-amd64.tar.gz
$ export PATH=$PATH:/usr/local/go/bin
$ go version
go version go1.10.3 linux/amd64
After installing Go, setup your Go workspace. Your Go workspace is where all Go project binary and source code is stored. By default, Go expects the workspace to be under $HOME/go
so either create the directory $HOME/go
or install to a custom location and set $GOPATH
(Note: If you have already setup Syzkaller then this step can be skipped since Syzkaller is a Go project)
Ragel
Trace2Syz uses ragel (variation of lex) to scan/parse traces.
sudo apt-get update
sudo apt-get install ragel
Goyacc
Trace2Syz uses goyacc (variation of yacc) to scan/parse traces.
go get golang.org/x/tools/cmd/goyacc
goyacc gets installed in $HOME/go/bin
(or $GOPATH/bin
if workspace is not in the home directory). Make sure this directory is on your $PATH.
$ export PATH=$PATH:$HOME/go/bin
Build and Run Trace2Syz
Build
go get -u -d github.com/shankarapailoor/trace2syz/...
cd $GOPATH/src/github.com/shankarapailoor/trace2syz/
make
Run
Once trace2syz has been successfully built, we can generate seeds for Syzkaller as follows:
$ ./bin/trace2syz -dir [tracedir] -distill [distillConfig.json]
The arguments are explained below:
-dir
is a directory for traces to be parsed. We have provided a tarball of sample traces on Google Drive to get started. To run the example below, download the tarball, move it to thegetting-started/
directory, and unpack.-distill
is a config file that specifies the distillation strategy (e.g. implicit, explicit only). If the traces don't have call coverage information or you simply don't want to distill, then this parameter should be ommitted and trace2syz will generate traces "as is". We have provided an example config undergetting-started/distill.json