fuzz argv-information afl afl-fuzz fuzzer k-means k-means-clustering

Yuan-fuzz

Fuzzer runs with argv information and uses k-means clustering to group seed.

  Written and maintained by zodf0055980 <zodf0055980@gmail.com>
  Based on American Fuzzy Lop by Michal Zalewski

Why I do this?

There are a lot of command line arguments in the common binary, but common fuzzer only runs with one command line argument, so it cannot find some errors through the special command line. For instance, in CVE-2020-27843 I found, it have out of bound read with 8 argv and crafted input. Therefore, I made a fuzzer that can generate argv at runtime.

Technology

Yuan-fuzz is a fuzzer implementing a technique to generate argv in addition fuzzing stage named arg_gen. It can help to fuzz binary target that has a lot of argv can use.

It also can use k-means clustering to the group in the seed pool to improve seed selection, just like the k-means-AFL I made.

TODO

Cannot use -i - to resume fuzzer.
Cannot use without -s xmlfile, maybe you can try k-means-AFL I made.
Allow use other format to write argv info file, likes json
Release English paper, I did in traditional Chinese now.

If you have any other questions, you are welcome to create issue and I will try my best to solve them.

Usage

Install libxml2 first.

Build it.

$ make

Use -h --help to know target program options, and use it to write XML file to help fuzzing. I give some XML examples here, maybe could help to write XML file.

We also implement our seed selection. You should open our seed selection server first if you want to use it.

$ python3 group_seed.py [port]

The command line usage of Yuan-fuzz is similar to AFL.

$ Yuan-fuzz -i [testcase_dir] -o [output_dir] -s [~/XML_PATH/parameters.xml] [-p [port]] -- [Target program]

I also implement two command that can help arg_gen stage.

-w            - let file_path in front of argv
-r            - argv random initial

Example

Use libjpeg-turbo to be example.

$ git clone git@github.com:libjpeg-turbo/libjpeg-turbo.git

Build with instrumentation, you can use other compiler.

$ export CC=~/Yuan-fuzz/afl-gcc                                       
$ export CXX=~/Yuan-fuzz/afl-g++
$ export AFL_USE_ASAN=1 ;
$ cd libjpeg-turbo
$ mkdir build && cd build
$ cmake -G"Unix Makefiles" ..
$ make

Run fuzzer

$ python3 group_seed.py 8888
# Another Terminal
$ Yuan-fuzz -i ./testcases/images/jpeg -o fuzz_output -m none -s ./xml/libjpeg-turbo/djpeg/parameters.xml -p 8888 -- ~/TARGET_PATH/libjpeg-turbo/build/djpeg

If your xml file have a lot of argv, maybe you have to change some define value in parse.h.

parallel fuzzing

Yuan-fuzz can parallel fuzz with other afl-base fuzzer, likely AFLplusplus. However, Yuan-fuzz can only be used in -S mode. And please check argv information file is same with master run.

for example:

# afl++
$ ./afl-fuzz -i ./testcases/images/jpeg -o ~/jpeg-out -M master -m none -- ~/afl-target/libjpeg-turbo/build/djpeg -outfile /dev/null @@

# Yuan-fuzz
$ ./Yuan-fuzz -i ./testcases/images/jpeg -o ~/jpeg-out -S slave1 -m none -s ~/Yuan-fuzz/xml/libjpeg-turbo/djpeg/parameters.xml -- ~/afl-target/libjpeg-turbo/build/djpeg

Interpreting output

It will have addition subdirectories created within the output directory and updated in real time.

queue_info/queue
queue_info/crashes
queue_info/hangs

It save all seed running parameters and one-to-one correspondence with seed in queue, crashes, hangs subdirectories.

Bug reported

libjpeg-turbo

libjpeg-turbo/libjpeg-turbo#441 (CVE-2020-35538)

binutils

libvips (not use fuzz)

Thanks

Use SQ-fuzz to modify.

About

Fuzzing with the generated argument

fuzz argv-information afl afl-fuzz fuzzer k-means k-means-clustering

Apache License 2.0

Languages

Language:C 86.5%Language:Shell 6.8%Language:Makefile 2.7%Language:Python 2.3%Language:C++ 1.0%Language:HTML 0.7%Language:Rich Text Format 0.0%Language:JavaScript 0.0%