• Stars
    star
    131
  • Rank 275,867 (Top 6 %)
  • Language
    C
  • Created over 4 years ago
  • Updated about 3 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

A Linux Kernel Module that implements a fast snapshot mechanism for fuzzing.

AFL++ Snapshot LKM

A Linux Kernel Module that implements a fast snapshot mechanism for fuzzing. Written by Andrea Fioraldi [email protected]. First port to a LKM written by Nick "kallsyms" Gregory. Originally inspired by https://github.com/sslab-gatech/perf-fuzz.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

PLEASE NOTE: Due to syscall hooking and the never ending changes in the kernel we are unable to maintain it as we are busy working on libafl. If you would like to take over the development, just create an issue and let us start a discussion. We still accept pull requests in the mean time.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Why?

fork() is slow and we want to fuzz faster. The speed gain currently varies between 20-360% depending on the target.

Persistent mode in llvm_mode will give you a better performance bump though, however adding this snapshot module will still be a small improvement.

Speed comparison

project program exec/s with snapshot exec/s normal speed factor
afl++ test-instr 25k 8234 x3
unrar unrar 7044 1938 x3.6
jpeg djpeg 1911 1502 x1.3
tiff thumbnail 5058 3114 x1.6
libxml xmllint 7835 3450 x2.3
afl++ test_persistent_new 106k 89k x1.2

Usage

Load it using ./load.sh, unload it using ./unload.sh.

./load.sh will compile the module for you, you need also python3.

While the module is loaded, AFL++ will detect it and automatically switch from fork() to snapshot mode. (Note: currently llvm_mode only, available from v2.66d/v2.67c onwards)

API

int afl_snapshot_init();

This is the initialization routine that opens the ioctl device.

void afl_snapshot_exclude_vmrange(void* start, void* end);

Add a range of addresses (with page granularity) in the blocklist. These pages will not be snapshotted.

void afl_snapshot_include_vmrange(void* start, void* end);

Add a range of addresses (with page granularity) in the allowlist. These pages will be snapshotted.

int afl_snapshot_take(int config);

Take the snapshot in this program point. Returns 1 when the snapshot is taken, if there is already one snapshot does nothing and return 0.

The config mask can have the following options OR-ed:

  • AFL_SNAPSHOT_MMAP Trace new mmaped ares and unmap them on restore.
  • AFL_SNAPSHOT_BLOCK Do not snapshot any page (by default all writeable not-shared pages are shanpshotted.
  • AFL_SNAPSHOT_FDS Snapshot file descriptor state, close newly opened descriptors
  • AFL_SNAPSHOT_REGS Snapshot registers state
  • AFL_SNAPSHOT_EXIT Perform a restore when exit_group is invoked
  • AFL_SNAPSHOT_NOSTACK Do not snapshot Stack pages
void afl_snapshot_restore(void);

Restore the snapshot. If registers are snapshotted, this function never returns.

void afl_snapshot_clean(void);

Remove the snapshot, you can not call afl_snapshot_take in another program point.

TODOs

  • support for multithreaded applications
  • file descriptors state restore (lseek)
  • switch from kprobe to ftrace for hooking (faster)

More Repositories

1

AFLplusplus

The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!
C
5,054
star
2

LibAFL

Advanced Fuzzing Library - Slot your Fuzzer together in Rust! Scales across cores and machines. For Windows, Android, MacOS, Linux, no_std, ...
Rust
2,017
star
3

Grammar-Mutator

A grammar-based custom mutator for AFL++
Python
223
star
4

LibAFL-legacy

AFL++ as a library: gives you all the tools necessary to craft the best fuzzer for your targets with ease!
C
110
star
5

Fuzz-With-Wine-Demo

A set of helpers and examples to fuzz Win32 binaries with AFL++ QEMU
Python
67
star
6

unicornafl

AFL bindings for Unicorn-Engine
Rust
65
star
7

fuzzer-challenges

Challenging testcases for fuzzers
C++
54
star
8

cargo-libafl

Fuzz Rust code with LibAFL
Rust
53
star
9

StdFuzzer

StdFuzzer is the reference implementation of a generic bit-level fuzzer with LibAFL
Rust
41
star
10

qemu-libafl-bridge

A patched QEMU that exposes an interface for LibAFL-based fuzzers
C
30
star
11

libafl_paper_artifacts

Makefile
17
star
12

tinyinst-rs

Rust bindings for googleprojectzero/TinyInst
Rust
15
star
13

Commit-Fuzzing-Demo

This is an example library to show how to fuzz with AFL++ only the code modified by the last commit.
Python
15
star
14

libafl_fuzzbench

Fuzzers implemented with libafl to evaluate several techniques on fuzzbench
Rust
10
star
15

AFLSmart-Custom-Mutator

An implementation of AFLSmart as a custom mutator for AFL++.
C
9
star
16

Website

the AFL++ website
HTML
6
star