Skip to content

aflplusplus.md

Latest commit

 

History

History
31 lines (28 loc) · 1.78 KB

aflplusplus.md

File metadata and controls

31 lines (28 loc) · 1.78 KB
Raw

SeedUI with AFL++

SeedUI expects the file names of the seeds generated during a fuzzing campaign contains a unique identifier, generated time, and its parent information. As part of this repository, we provided a patch file, in external/rename_seeds_afl.patch, that modifies AFL++ source code to provide this information. You need to apply this patch to AFL++ before running the fuzzing campaign. We provided a utility shell script, external/compile_aflpp.sh, for this purpose.

SeedUI works on the output directory generated by AFL++. After running the fuzzing campaign make sure you persist the afl-out directory. In the following we explain the general knowledge of running AFL++ on a target. We use readelf from binutils-gdb as a target.

AFL++ on readelf

We have provided some example scripts for fuzzing readelf in the examples directory. We recommend running the fuzzing campaign in a docker container using the following commands:

  • Build the docker image (from the root directory of the repository): docker build -t readelf_seed_ui -f examples/readelf/docker/Dockerfile.readelf .
  • Start a docker container and run fuzzing campaigns in background: 
    cd examples/readelf
docker-compose up -d
    We have configured the default timeout of 5 minutes. One can change it to the desired timeout by updating the last command line parameter to the readelf_afl.sh script in examples/readelf/docker-compose.yaml file.
  • After the fuzzing campaign, the generated corpus for the fuzzing run can be found in the examples/readelf/saved_corpus. You may need to modify the folder permissions to access the files using the following command, 
    sudo chmod -R 775 saved_corpus/*
  • Stop the docker containers: 
    docker-compose down