You've already forked AFLplusplus
mirror of
https://github.com/AdaCore/AFLplusplus.git
synced 2026-02-12 13:08:19 -08:00
Added vorbis test
This commit is contained in:
Your Name
200
frida_mode/test/vorbis/GNUmakefile
Normal file
200
frida_mode/test/vorbis/GNUmakefile
Normal file
@@ -0,0 +1,200 @@
|
||||
PWD:=$(shell pwd)/
|
||||
ROOT:=$(PWD)../../../
|
||||
BUILD_DIR:=$(PWD)build/
|
||||
|
||||
AFLPP_FRIDA_DRIVER_HOOK_OBJ=$(ROOT)frida_mode/build/frida_hook.so
|
||||
AFLPP_QEMU_DRIVER_HOOK_OBJ=$(ROOT)frida_mode/build/qemu_hook.so
|
||||
|
||||
OGG_GIT_REPO:=https://github.com/xiph/ogg.git
|
||||
OGG_BUILD_DIR:=$(BUILD_DIR)ogg/
|
||||
OGG_DIR:=$(OGG_BUILD_DIR)ogg/
|
||||
OGG_INSTALL:=$(OGG_BUILD_DIR)install/
|
||||
OGG_LIB:=$(OGG_INSTALL)lib/libogg.a
|
||||
|
||||
VORBIS_GIT_REPO:=https://github.com/xiph/vorbis.git
|
||||
VORBIS_BUILD_DIR:=$(BUILD_DIR)vorbis/
|
||||
VORBIS_DIR:=$(VORBIS_BUILD_DIR)vorbis/
|
||||
VORBIS_INSTALL:=$(VORBIS_BUILD_DIR)install/
|
||||
VORBIS_LIB:=$(VORBIS_INSTALL)lib/libvorbis.a
|
||||
VORBISFILE_LIB:=$(VORBIS_INSTALL)lib/libvorbisfile.a
|
||||
|
||||
DECODE_URL:=https://raw.githubusercontent.com/google/oss-fuzz/688aadaf44499ddada755562109e5ca5eb3c5662/projects/vorbis/decode_fuzzer.cc
|
||||
DECODE_SRC:=$(BUILD_DIR)decode_fuzzer.cc
|
||||
DECODE_OBJ:=$(BUILD_DIR)decode_fuzzer.o
|
||||
|
||||
HARNESS_URL:=https://raw.githubusercontent.com/llvm/llvm-project/main/compiler-rt/lib/fuzzer/standalone/StandaloneFuzzTargetMain.c
|
||||
HARNESS_SRC:=$(BUILD_DIR)StandaloneFuzzTargetMain.c
|
||||
HARNESS_OBJ:=$(BUILD_DIR)StandaloneFuzzTargetMain.o
|
||||
|
||||
LDFLAGS += -lpthread
|
||||
|
||||
TEST_BIN:=$(BUILD_DIR)decode_fuzzer
|
||||
ifeq "$(shell uname)" "Darwin"
|
||||
TEST_BIN_LDFLAGS:=-undefined dynamic_lookup -Wl,-no_pie
|
||||
endif
|
||||
|
||||
TEST_DATA_DIR:=$(BUILD_DIR)in/
|
||||
TEST_DATA_SRC:=https://github.com/google/fuzzbench/blob/master/benchmarks/vorbis-2017-12-11/seeds/sound.ogg?raw=true
|
||||
TEST_DATA_FILE:=$(TEST_DATA_DIR)sound.ogg
|
||||
DUMMY_DATA_FILE:=$(BUILD_DIR)default_seed
|
||||
|
||||
FRIDA_OUT:=$(BUILD_DIR)frida-out
|
||||
QEMU_OUT:=$(BUILD_DIR)qemu-out
|
||||
|
||||
ifndef ARCH
|
||||
|
||||
ARCH=$(shell uname -m)
|
||||
ifeq "$(ARCH)" "aarch64"
|
||||
ARCH:=arm64
|
||||
endif
|
||||
|
||||
ifeq "$(ARCH)" "i686"
|
||||
ARCH:=x86
|
||||
endif
|
||||
endif
|
||||
|
||||
GET_SYMBOL_ADDR:=$(ROOT)frida_mode/util/get_symbol_addr.sh
|
||||
|
||||
AFL_QEMU_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x4000000000)
|
||||
|
||||
ifeq "$(ARCH)" "aarch64"
|
||||
AFL_FRIDA_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x0000aaaaaaaaa000)
|
||||
endif
|
||||
|
||||
ifeq "$(ARCH)" "x86_64"
|
||||
AFL_FRIDA_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x0000555555554000)
|
||||
endif
|
||||
|
||||
ifeq "$(ARCH)" "x86"
|
||||
AFL_FRIDA_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x56555000)
|
||||
endif
|
||||
|
||||
.PHONY: all clean frida hook
|
||||
|
||||
all: $(TEST_BIN)
|
||||
make -C $(ROOT)frida_mode/
|
||||
|
||||
32:
|
||||
CXXFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
|
||||
|
||||
$(BUILD_DIR):
|
||||
mkdir -p $@
|
||||
|
||||
########## OGG #######
|
||||
|
||||
$(OGG_BUILD_DIR): | $(BUILD_DIR)
|
||||
mkdir -p $@
|
||||
|
||||
$(OGG_DIR): | $(OGG_BUILD_DIR)
|
||||
git clone $(OGG_GIT_REPO) $@
|
||||
git -C $(OGG_DIR) checkout c8391c2b267a7faf9a09df66b1f7d324e9eb7766
|
||||
|
||||
$(OGG_LIB): | $(OGG_DIR)
|
||||
cd $(OGG_DIR) && ./autogen.sh
|
||||
cd $(OGG_DIR) && ./configure \
|
||||
--prefix=$(OGG_INSTALL) \
|
||||
--enable-static \
|
||||
--disable-shared \
|
||||
--disable-crc
|
||||
make -C $(OGG_DIR) install
|
||||
|
||||
ogg: $(OGG_LIB)
|
||||
|
||||
########## VORBIS #######
|
||||
|
||||
$(VORBIS_BUILD_DIR): | $(BUILD_DIR)
|
||||
mkdir -p $@
|
||||
|
||||
$(VORBIS_DIR): | $(VORBIS_BUILD_DIR)
|
||||
git clone $(VORBIS_GIT_REPO) $@
|
||||
git -C $(VORBIS_DIR) checkout c1c2831fc7306d5fbd7bc800324efd12b28d327f
|
||||
|
||||
$(VORBIS_LIB): $(OGG_LIB) | $(VORBIS_DIR)
|
||||
cd $(VORBIS_DIR) && ./autogen.sh
|
||||
cd $(VORBIS_DIR) && ./configure \
|
||||
--prefix=$(VORBIS_INSTALL) \
|
||||
--enable-static \
|
||||
--disable-shared \
|
||||
--with-ogg=$(OGG_INSTALL)
|
||||
make -C $(VORBIS_DIR) install
|
||||
|
||||
vorbis: $(VORBIS_LIB)
|
||||
|
||||
########## HARNESS #######
|
||||
|
||||
$(DECODE_SRC):
|
||||
wget -O $@ $(DECODE_URL)
|
||||
|
||||
$(DECODE_OBJ): $(DECODE_SRC)
|
||||
$(CXX) -o $@ -c $< -I$(VORBIS_DIR)include/ -I$(OGG_DIR)include/
|
||||
|
||||
decode: $(DECODE_OBJ)
|
||||
|
||||
########## HARNESS #######
|
||||
|
||||
$(HARNESS_SRC):
|
||||
wget -O $@ $(HARNESS_URL)
|
||||
|
||||
$(HARNESS_OBJ): $(HARNESS_SRC)
|
||||
$(CC) -o $@ -c $<
|
||||
|
||||
harness: $(HARNESS_OBJ)
|
||||
|
||||
########## TEST #######
|
||||
|
||||
$(TEST_BIN): $(VORBIS_LIB) $(OGG_LIB) $(HARNESS_OBJ) $(DECODE_OBJ)
|
||||
$(CXX) \
|
||||
$(CXXFLAGS) \
|
||||
-std=c++11 \
|
||||
$(DECODE_OBJ) \
|
||||
$(HARNESS_OBJ) \
|
||||
$(VORBISFILE_LIB) \
|
||||
$(VORBIS_LIB) \
|
||||
$(OGG_LIB) \
|
||||
-o $@
|
||||
|
||||
########## DUMMY #######
|
||||
|
||||
$(TEST_DATA_DIR): | $(BUILD_DIR)
|
||||
mkdir -p $@
|
||||
|
||||
$(DUMMY_DATA_FILE): | $(TEST_DATA_DIR)
|
||||
dd if=/dev/zero bs=1048576 count=1 of=$@
|
||||
|
||||
###### TEST DATA #######
|
||||
|
||||
$(TEST_DATA_FILE):
|
||||
wget -O $@ $(TEST_DATA_SRC)
|
||||
|
||||
clean:
|
||||
rm -rf $(BUILD_DIR)
|
||||
|
||||
frida: $(TEST_BIN) $(AFLPP_FRIDA_DRIVER_HOOK_OBJ) $(TEST_DATA_FILE) $(DUMMY_DATA_FILE)
|
||||
AFL_FRIDA_PERSISTENT_CNT=1000000 \
|
||||
AFL_FRIDA_PERSISTENT_HOOK=$(AFLPP_FRIDA_DRIVER_HOOK_OBJ) \
|
||||
AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR) \
|
||||
AFL_ENTRYPOINT=$(AFL_FRIDA_PERSISTENT_ADDR) \
|
||||
$(ROOT)afl-fuzz \
|
||||
-i $(TEST_DATA_DIR) \
|
||||
-o $(FRIDA_OUT) \
|
||||
-m none \
|
||||
-d \
|
||||
-O \
|
||||
-V 30 \
|
||||
-- \
|
||||
$(TEST_BIN) $(DUMMY_DATA_FILE)
|
||||
|
||||
qemu: $(TEST_BIN) $(AFLPP_QEMU_DRIVER_HOOK_OBJ) $(TEST_DATA_FILE) $(DUMMY_DATA_FILE)
|
||||
AFL_QEMU_PERSISTENT_CNT=1000000 \
|
||||
AFL_QEMU_PERSISTENT_HOOK=$(AFLPP_QEMU_DRIVER_HOOK_OBJ) \
|
||||
AFL_QEMU_PERSISTENT_ADDR=$(AFL_QEMU_PERSISTENT_ADDR) \
|
||||
AFL_ENTRYPOINT=$(AFL_QEMU_PERSISTENT_ADDR) \
|
||||
$(ROOT)afl-fuzz \
|
||||
-i $(TEST_DATA_DIR) \
|
||||
-o $(QEMU_OUT) \
|
||||
-m none \
|
||||
-d \
|
||||
-Q \
|
||||
-V 30 \
|
||||
-- \
|
||||
$(TEST_BIN) $(DUMMY_DATA_FILE)
|
||||
13
frida_mode/test/vorbis/Makefile
Normal file
13
frida_mode/test/vorbis/Makefile
Normal file
@@ -0,0 +1,13 @@
|
||||
all:
|
||||
@echo trying to use GNU make...
|
||||
@gmake all || echo please install GNUmake
|
||||
|
||||
32:
|
||||
@echo trying to use GNU make...
|
||||
@gmake 32 || echo please install GNUmake
|
||||
|
||||
clean:
|
||||
@gmake clean
|
||||
|
||||
frida:
|
||||
@gmake frida
|
||||
36
frida_mode/test/vorbis/get_symbol_addr.py
Executable file
36
frida_mode/test/vorbis/get_symbol_addr.py
Executable file
@@ -0,0 +1,36 @@
|
||||
#!/usr/bin/python3
|
||||
import argparse
|
||||
from elftools.elf.elffile import ELFFile
|
||||
|
||||
def process_file(file, symbol, base):
|
||||
with open(file, 'rb') as f:
|
||||
elf = ELFFile(f)
|
||||
symtab = elf.get_section_by_name('.symtab')
|
||||
mains = symtab.get_symbol_by_name(symbol)
|
||||
if len(mains) != 1:
|
||||
print ("Failed to find main")
|
||||
return 1
|
||||
|
||||
main_addr = mains[0]['st_value']
|
||||
main = base + main_addr
|
||||
print ("0x%016x" % main)
|
||||
return 0
|
||||
|
||||
def hex_value(x):
|
||||
return int(x, 16)
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description='Process some integers.')
|
||||
parser.add_argument('-f', '--file', dest='file', type=str,
|
||||
help='elf file name', required=True)
|
||||
parser.add_argument('-s', '--symbol', dest='symbol', type=str,
|
||||
help='symbol name', required=True)
|
||||
parser.add_argument('-b', '--base', dest='base', type=hex_value,
|
||||
help='elf base address', required=True)
|
||||
|
||||
args = parser.parse_args()
|
||||
return process_file (args.file, args.symbol, args.base)
|
||||
|
||||
if __name__ == "__main__":
|
||||
ret = main()
|
||||
exit(ret)
|
||||
Reference in New Issue
Block a user