Skip to content

Commit 24e3621

Browse files
author
Dawin Schmidt
committed
Rename fuzzing harness
1 parent ca2e8a1 commit 24e3621

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

qemu_mode/README.deferred_initialization_example.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -40,21 +40,21 @@ ALPINE_ROOT=<your-alpine-sysroot-directory>
4040
FUZZ=<your-path-to-the-code>
4141
sudo systemd-nspawn -D $ALPINE_ROOT --bind=$FUZZ:/fuzz
4242
CC=$(which clang) CFLAGS="-g" LDSHARED="clang -shared" python3 -m pip install /fuzz
43-
clang $(python3-config --embed --cflags) $(python3-config --embed --ldflags) -o /fuzz/fuzz_harness.a /fuzz/fuzz_harness.c
43+
clang $(python3-config --embed --cflags) $(python3-config --embed --ldflags) -o /fuzz/fuzz_harness /fuzz/fuzz_harness.c
4444
exit
4545
```
4646

4747
Manually trigger bug:
4848
```bash
49-
echo -n "FUZZ" | qemu-arm-static -L $ALPINE_ROOT $FUZZ/fuzz_harness.a
49+
echo -n "FUZZ" | qemu-arm-static -L $ALPINE_ROOT $FUZZ/fuzz_harness
5050
```
5151

5252
## Run AFL++
5353
Make sure to start the forkserver *after* loading all the shared objects by setting the `AFL_ENTRYPOINT` environment variable (see [here](https://aflplus.plus/docs/env_variables/#5-settings-for-afl-qemu-trace) for details):
5454

5555
Choose an address just before the `while()` loop, for example:
5656
```bash
57-
qemu-arm-static -L $ALPINE_ROOT $ALPINE_ROOT/usr/bin/objdump -d $FUZZ/fuzz_harness.a | grep -A 1 "PyObject_GetAttrString"
57+
qemu-arm-static -L $ALPINE_ROOT $ALPINE_ROOT/usr/bin/objdump -d $FUZZ/fuzz_harness | grep -A 1 "PyObject_GetAttrString"
5858

5959
00000584 <PyObject_GetAttrString@plt>:
6060
584: e28fc600 add ip, pc, #0, 12
@@ -71,13 +71,13 @@ Check Qemu memory maps using the instructions from [here](https://aflplus.plus/d
7171
7272
Setup Python environment variables and run `afl-qemu-trace`:
7373
```bash
74-
PYTHONPATH=$ALPINE_ROOT/usr/lib/python3.10/ PYTHONHOME=$ALPINE_ROOT/usr/bin/ QEMU_LD_PREFIX=$ALPINE_ROOT AFL_QEMU_DEBUG_MAPS=1 afl-qemu-trace $FUZZ/fuzz_harness.a
74+
PYTHONPATH=$ALPINE_ROOT/usr/lib/python3.10/ PYTHONHOME=$ALPINE_ROOT/usr/bin/ QEMU_LD_PREFIX=$ALPINE_ROOT AFL_QEMU_DEBUG_MAPS=1 afl-qemu-trace $FUZZ/fuzz_harness
7575
7676
...
77-
40000000-40001000 r-xp 00000000 103:03 8002276 fuzz_harness.a
77+
40000000-40001000 r-xp 00000000 103:03 8002276 fuzz_harness
7878
40001000-4001f000 ---p 00000000 00:00 0
79-
4001f000-40020000 r--p 0000f000 103:03 8002276 fuzz_harness.a
80-
40020000-40021000 rw-p 00010000 103:03 8002276 fuzz_harness.a
79+
4001f000-40020000 r--p 0000f000 103:03 8002276 fuzz_harness
80+
40020000-40021000 rw-p 00010000 103:03 8002276 fuzz_harness
8181
40021000-40022000 ---p 00000000 00:00 0
8282
40022000-40023000 rw-p 00000000 00:00 0
8383
```
@@ -91,7 +91,7 @@ export QEMU_LD_PREFIX=$ALPINE_ROOT
9191
... and run AFL++:
9292
```bash
9393
mkdir -p $FUZZ/in && echo -n "FU" > $FUZZ/in/seed
94-
AFL_ENTRYPOINT=0x400007cc afl-fuzz -i $FUZZ/in -o $FUZZ/out -Q -- $FUZZ/fuzz_harness.a
94+
AFL_ENTRYPOINT=0x400007cc afl-fuzz -i $FUZZ/in -o $FUZZ/out -Q -- $FUZZ/fuzz_harness
9595
```
9696
9797
## Resources

0 commit comments

Comments
 (0)