Integrate LibFuzzer #267

henrybear327 · 2023-11-17T09:24:25Z

By leveraging the LLVM's LibFuzzer, we will be able to test our emulator code more thoroughly.

The seed corpus being added automatically are all the elf files in the build folder.

Major changes:

Conditional compilation for the main function, as the fuzzer will generate its own main function
Add Clang to the Dockerfile
Introduce loading binary stream as elf file, as the input from fuzzer will be passed into the emulator directly instead of going through a file

Minor changes:

Fixed ELF verification logic

Currently, known improvements are:

Fix the Makefile to handle the compilation flags and compile coexisting .c and .cc files correctly

henrybear327 · 2023-11-17T09:25:16Z

Based on the initial fuzzer runs, I think the ELF loader logic doesn't check for invalid ELF strictly yet.

For example, this is one of the crashes produced by the fuzzer

Executed with failure
src/elf.c:145:52: runtime error: member access within misaligned address 0x1000078803437 for type 'const struct Elf32_Shdr', which requires 4 byte alignment
0x1000078803437: note: pointer points here
<memory cannot be printed>
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/elf.c:145:52 in 
src/elf.c:145:52: runtime error: load of misaligned address 0x1000078803437 for type 'const Elf32_Word' (aka 'const unsigned int'), which requires 4 byte alignment
0x1000078803437: note: pointer points here
<memory cannot be printed>
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/elf.c:145:52 in 
AddressSanitizer:DEADLYSIGNAL

This PR was also created based on the fuzzer's crash log.

github-advanced-security

Cppcheck (reported by Codacy) found more than 10 potential problems in the proposed changes. Check the Files changed tab for more details.

src/fuzzer/fuzzer.md

Makefile

run_fuzzer.sh

src/elf.c

src/fuzzer/fuzzer.md

src/riscv.h

docs/fuzzer.md

henrybear327 · 2023-11-17T14:58:37Z

Resolve the issues reported by Codacy.

I tried to resolve most, but there are some that are hard to understand what the error is about, or, some don't make sense to fix (single exit point per function, use the output of fprintf, don't use abort() in fuzzer, etc.) .

.ci/riscv-fuzz.sh

docs/fuzzer.md

src/elf.c

src/fuzz_target.cc

.ci/fuzz.sh

docs/fuzzer.md

src/main.c

jserv · 2023-11-23T07:04:05Z

Rather than creating a separate standalone fuzzer program, we can explore the option of integrating the fuzzing components as a feature activated by a command-line option. This approach aims to minimize the necessary changes for fuzzer integration. If we opt for this method, we will need to address the linkage between the C++-based LibFuzzer and the existing C codebase.

See src/feature.h for the use of macro RV32_HAS.

henrybear327 · 2023-11-23T16:38:37Z

Rather than creating a separate standalone fuzzer program, we can explore the option of integrating the fuzzing components as a feature activated by a command-line option. This approach aims to minimize the necessary changes for fuzzer integration. If we opt for this method, we will need to address the linkage between the C++-based LibFuzzer and the existing C codebase.

See src/feature.h for the use of macro RV32_HAS.

I am not aware of how we can merge both main() functions.

My current understanding is that for the LibFuzzer to work, we will need to provide an implementation of LLVMFuzzerTestOneInput, and during complication, a separate main() will be generated and be used for driving the actions for the fuzzer.

If there is more information or hints for merging the fuzzer into the current binary, I am happy to learn! :)

src/main.c

+        char *optarg = args[idx + 1];
+
+        switch (opt) {
+        case 's':  // binary string


src/main.c

jserv · 2023-11-24T09:33:33Z

It seems that C-only source files are compatible with libFuzzer. e.g., libFuzzer-examples.

src/main.c

+            elf_strlen = atoi(optarg);
+            emu_argc++;
+            break;
+        case 'k':  /* max execution cycle (since some program won't terminate, e.g. while(1) {} */


src/fuzz-target.cc

By leveraging the LLVM's LibFuzzer, we will be able to test our emulator code more thoroughly. The seed corpus being added automatically are all the elf files in the build folder. Major changes: - Conditional compilation for the main function, as the fuzzer will generate its own main function - Need to use the clang toolchain - Introduce loading buffer as elf file, as the input from fuzzer will be passed into the emulator directly instead of going through a file - Fixed ELF verification logic as the fuzzer already breaks the code Other minor changes are: - Fix Codacy issue "rejecting SARIF, as there are more runs than allowed"

jserv · 2023-12-16T07:16:27Z

I am closing this pull request because we have not made a clear decision on how we can effectively utilize libFuzzer to identify potential issues.

henrybear327 force-pushed the feat/fuzzer branch from 72918d9 to 72edab7 Compare November 17, 2023 09:26

github-advanced-security bot found potential problems Nov 17, 2023

View reviewed changes

henrybear327 requested a review from jserv November 17, 2023 10:08

henrybear327 self-assigned this Nov 17, 2023

henrybear327 requested a review from qwe661234 November 17, 2023 10:08

henrybear327 force-pushed the feat/fuzzer branch 2 times, most recently from 07fa043 to adeed6e Compare November 17, 2023 10:16

jserv reviewed Nov 17, 2023

View reviewed changes

Makefile Outdated Show resolved Hide resolved

jserv reviewed Nov 17, 2023

View reviewed changes

run_fuzzer.sh Outdated Show resolved Hide resolved

jserv reviewed Nov 17, 2023

View reviewed changes

src/elf.c Outdated Show resolved Hide resolved

jserv reviewed Nov 17, 2023

View reviewed changes

src/fuzzer/fuzzer.md Outdated Show resolved Hide resolved

jserv reviewed Nov 17, 2023

View reviewed changes

src/riscv.h Outdated Show resolved Hide resolved

This comment was marked as outdated.

Sign in to view

jserv changed the title ~~Introduce fuzzer~~ Integrate fuzzer Nov 17, 2023

github-advanced-security bot found potential problems Nov 17, 2023

View reviewed changes

henrybear327 force-pushed the feat/fuzzer branch 2 times, most recently from 08b2788 to d8ff776 Compare November 17, 2023 14:18

github-advanced-security bot found potential problems Nov 17, 2023

View reviewed changes

docs/fuzzer.md Fixed Show resolved Hide resolved

henrybear327 requested a review from jserv November 17, 2023 14:58

henrybear327 force-pushed the feat/fuzzer branch 2 times, most recently from 298a641 to 014255a Compare November 17, 2023 15:11