𝛑
𝛑
Posts List
  1. mutators
  2. Fuzzer
    1. AFL
  3. Other Notes
  4. Resources

Fuzzing Learning Notes - Getting Started with AFL

Jul 27, 2019 Felix Zhao 中文 768 words ~4 min read
This post was written in 2019. Tools and versions mentioned may be outdated, though the underlying ideas still hold.

Fuzzing, or fuzz testing, is basically feeding a program with all kinds of mutated inputs. This means figuring out where to inject inputs (binaries, web services, system software, network protocols, filesystems, operating systems), how to keep generating effective inputs (how do you make your inputs more likely to crash the program?), how to analyze what happens when different inputs hit the target, and how to automate this whole pipeline.

Last year there was a paper that surveyed the history of fuzzing techniques, worth checking out: The Art, Science, and Engineering of Fuzzing: A Survey. This blog post is mainly my notes on learning from tutorials, mostly organized from my gist.

mutators

radamsa is used to generate random fuzz vectors (don’t worry about the terminology), though you can also just write code yourself to produce different mutated inputs.

  1. Clone and compile
    git clone https://gitlab.com/akihe/radamsa.git && cd radamsa && make && sudo make install

image

  1. Usage: echo whatever | radamsa to generate attack payloads

image

image

  1. Other usage patterns
  • Generate multiple testcases
    echo "time thief"| radamsa -d 2 -n 10
    Generate 10 cases, one every 2 milliseconds. You can adjust this, like -d 600, whatever works.

image

  • Generate testcases from files
    radamsa -r guest.jpg -o ./1.png

The above shows mutations of the original image.
For resizing images and inline alignment in markdown, you can use:

<img  align="right" src="https://xxx.png" width="200" height="200" />

Fuzzer

There are already many fuzzing tools out there, with the more well-known ones being AFL, DynamoRIO, libfuzzer, oss-fuzz, etc. Here I’ll mainly cover AFL usage. Different tools work differently, and workflows vary. But the principles are pretty similar. You need to explore this yourself. I’m still learning too.

AFL

Not recommended on Mac, because macOS fork is pretty slow.

1.*Nix

This tutorial is done on Ubuntu

$ sudo apt-get install clang-3.8 build-essential llvm-3.8-dev gnuplot-nox
$ sudo update-alternatives --install /usr/bin/clang clang `which clang-3.8` 1
$ sudo update-alternatives --install /usr/bin/clang++ clang++ `which clang++-3.8` 1
$ sudo update-alternatives --install /usr/bin/llvm-config llvm-config `which llvm-config-3.8` 1
$ sudo update-alternatives --install /usr/bin/llvm-symbolizer llvm-symbolizer `which llvm-symbolizer-3.8` 1

Download the latest version

wget http://lcamtuf.coredump.cx/afl/releases/afl-latest.tgz
tar -xf afl-latest.tgz

Then compile

$ cd afl-2.52b 
$ make
$ make -C llvm_mode

To compile qemu mode (for scenarios where you don’t have target program source code), you need to go to qemu_mode separately and compile. Even without source code, you can use QEMU to translate blocks for instrumentation.

When using it, compile with afl-gcc, like CC=afl-gcc CXX=afl-g++ ./configure or CC=afl-clang ./configure, then make.

./afl-fuzz -i testcase_dir -o findings_dir /path/to/program [...params...]
If the params at the end is @@, it means it will be replaced by filenames from your testcase folder
./afl-fuzz -i testcase_dir -o findings_dir /path/to/program @@

AFL also supports distributed runs, you can refer to the commands below

afl-fuzz -i input_dir -o fuzz_output -M master ./test @@
afl-fuzz -i input_dir -o fuzz_output -S slave1 ./test @@
afl-fuzz -i input_dir -o fuzz_output -S slave2 ./test @@ 
afl-fuzz -i input_dir -o fuzz_output -S slave3 ./test @@

If a process exits, you can also use this command to resume, perfect.

afl-fuzz -i- -o fuzz_output -M master ./test @@
afl-fuzz -i- -o fuzz_output -S slave1 ./test @@
afl-fuzz -i- -o fuzz_output -S slave2 ./test @@
afl-fuzz -i- -o fuzz_output -S slave3 ./test @@

You can find all of this in AFL’s readme though.

2.Windows: WinAFL fuzzing VLC with DynamoRIO

The go-to tool on Windows is naturally WinAFL, check it out (though I feel like maybe my computer is too crappy? Can’t really get it to work… doesn’t seem very effective)

afl-fuzz.exe -i C:\Users\i\Desktop\Fuzzing\db -o C:\Users\i\Desktop\Fuzzing\results -D C:\Users\i\Desktop\Fuzzing\DynamoRIO\bin64 -t 20000 -- -fuzz_iterations 5000 -target_module "D:\Program Files (x86)\VideoLAN\VLC\vlc.exe" -target_offset 0x532a0 -nargs 2 -m 1024 -- "D:\Program Files (x86)\VideoLAN\VLC\vlc.exe" @@

image
image
image

Other Notes

Fuzzing to a crash is just the first step, figuring out how to create a payload from the crash is what really matters.

Resources