𝛑
𝛑
Posts List
  1. Chromium fuzzing tutorial
  2. ToDo
  3. References

Fuzzing Learning Notes: libfuzzer and Chromium

Jul 27, 2019 Felix Zhao 中文 268 words ~1 min read
This post was written in 2019. Tools and versions mentioned may be outdated, though the underlying ideas still hold.

Following up from the previous post, still organizing from gist.

libfuzzer is a project under llvm

LibFuzzer is in-process, coverage-guided, evolutionary fuzzing engine. LibFuzzer is linked with the library under test, and feeds fuzzed inputs to the library via a specific fuzzing entrypoint (aka “target function”); the fuzzer then tracks which areas of the code are reached, and generates mutations on the corpus of input data in order to maximize the code coverage. The code coverage information for libFuzzer is provided by LLVM’s SanitizerCoverage instrumentation.

Let’s get started

Chromium fuzzing tutorial

ubuntu16.04:


git clone https://chromium.googlesource.com/chromium/tools/depot_tools.git
export PATH="$PATH:/path/to/depot_tools"             # use absolute path
mkdir ~/chromium && cd ~/chromium
fetch --nohooks chromium                           # downloads about 10G
cd src 
./build/install-build-deps.sh                     # install dependencies
gclient runhooks                            # run Chromium-specifices
# prepare build
gn gen out/Default                   # generate ninja files for building

#mount -t tmpfs -o size=20G,nr_inodes=40k,mode=1777 tmpfs /root/chromium/src/out  
# 20G was too small, compilation ran out of space. Need to increase it.

# build
autoninja -C out/Default chrome

image
image

On an 8-core 8GB machine, the initial builds are basically one per second, looks like it might take 9 hours to finish. If we’re lucky.

image

Build complete, size grew to 49G

image

Building libfuzzer

$ gn gen out/libfuzzer '--args=use_libfuzzer=true is_asan=true is_ubsan_security=true is_debug=false enable_nacl=false' --check
$ ninja -C out/libfuzzer v8_json_parser_fuzzer

image

$ ./out/libfuzzer/v8_json_parser_fuzzer ~/chromium/testcases/json_parser_corpus/ --dict=json.dict -jobs=6 -workers=6

image

ToDo

  • gn usage
  • ninja usage

References