Skip to content

Commit d3a4b72

Browse files
WorksButNotTestedYour Name
WorksButNotTested
and
Your Name
authored
Added qemu_cmin (#1572)
Co-authored-by: Your Name <[email protected]>
1 parent 9755d18 commit d3a4b72

File tree

12 files changed

+906
-0
lines changed

12 files changed

+906
-0
lines changed

‎fuzzers/qemu_cmin/.gitignore

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
libpng-*
2+
libpng_harness
3+
libpng_harness_crashing
4+
zlib-*
5+
crashes
6+
target
7+
output
8+
corpus/

‎fuzzers/qemu_cmin/Cargo.toml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
[package]
2+
name = "qemu_cmin"
3+
version = "0.11.1"
4+
authors = ["Andrea Fioraldi <[email protected]>", "Dominik Maier <[email protected]>", "WorksButNotTested"]
5+
edition = "2021"
6+
7+
[profile.release]
8+
#lto = true
9+
#codegen-units = 1
10+
#opt-level = 3
11+
debug = true
12+
13+
[features]
14+
default = ["std"]
15+
std = []
16+
be = ["libafl_qemu/be"]
17+
arm = ["libafl_qemu/arm"]
18+
x86_64 = ["libafl_qemu/x86_64"]
19+
i386 = ["libafl_qemu/i386"]
20+
aarch64 = ["libafl_qemu/aarch64"]
21+
mips = ["libafl_qemu/mips"]
22+
ppc = ["libafl_qemu/ppc", "be"]
23+
24+
[build-dependencies]
25+
vergen = { version = "8.2.1", features = ["build", "cargo", "git", "gitcl", "rustc", "si"] }
26+
27+
[dependencies]
28+
clap = { version = "4.3.0", features = ["derive", "string"]}
29+
libafl = { path = "../../libafl/" }
30+
libafl_bolts = { path = "../../libafl_bolts/" }
31+
libafl_qemu = { path = "../../libafl_qemu/", features = ["usermode"] }
32+
log = {version = "0.4.20" }
33+
rangemap = { version = "1.3" }

‎fuzzers/qemu_cmin/Makefile.toml

Lines changed: 323 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,323 @@
1+
[env]
2+
PROFILE = { value = "release", condition = {env_not_set = ["PROFILE"]} }
3+
PROFILE_DIR = {value = "release", condition = {env_not_set = ["PROFILE_DIR"] }}
4+
CROSS_CC = "x86_64-linux-gnu-gcc"
5+
CROSS_CXX = "x86_64-linux-gnu-g++"
6+
CROSS_CFLAGS = ""
7+
TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/x86_64"
8+
LIBPNG_ARCH = "x86_64"
9+
LIBPNG_OPTIMIZATIONS = "yes"
10+
FEATURE = "x86_64"
11+
#LIBAFL_DEBUG_OUTPUT = "1"
12+
#CUSTOM_QEMU_DIR= "~/qemu-libafl-bridge"
13+
14+
[env.arm]
15+
CROSS_CC = "arm-linux-gnueabi-gcc"
16+
CROSS_CXX = "arm-linux-gnueabi-g++"
17+
CROSS_CFLAGS = ""
18+
TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/arm"
19+
LIBPNG_ARCH = "arm"
20+
LIBPNG_OPTIMIZATIONS = "yes"
21+
FEATURE = "arm"
22+
23+
[env.aarch64]
24+
CROSS_CC = "aarch64-linux-gnu-gcc"
25+
CROSS_CXX = "aarch64-linux-gnu-g++"
26+
CROSS_CFLAGS = ""
27+
TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/aarch64"
28+
LIBPNG_ARCH = "aarch64"
29+
LIBPNG_OPTIMIZATIONS = "yes"
30+
FEATURE = "aarch64"
31+
32+
[env.x86_64]
33+
CROSS_CC = "x86_64-linux-gnu-gcc"
34+
CROSS_CXX = "x86_64-linux-gnu-g++"
35+
CROSS_CFLAGS = ""
36+
TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/x86_64"
37+
LIBPNG_ARCH = "x86_64"
38+
LIBPNG_OPTIMIZATIONS = "yes"
39+
FEATURE = "x86_64"
40+
41+
[env.i386]
42+
CROSS_CC = "x86_64-linux-gnu-gcc"
43+
CROSS_CXX = "x86_64-linux-gnu-g++"
44+
CROSS_CFLAGS = "-m32"
45+
TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/i386"
46+
LIBPNG_ARCH = "i386"
47+
LIBPNG_OPTIMIZATIONS = "yes"
48+
FEATURE = "i386"
49+
50+
[env.mips]
51+
CROSS_CC = "mipsel-linux-gnu-gcc"
52+
CROSS_CXX = "mipsel-linux-gnu-g++"
53+
CROSS_CFLAGS = ""
54+
TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/mips"
55+
LIBPNG_ARCH = "mips"
56+
LIBPNG_OPTIMIZATIONS = "yes"
57+
FEATURE = "mips"
58+
59+
[env.ppc]
60+
CROSS_CC = "powerpc-linux-gnu-gcc"
61+
CROSS_CXX = "powerpc-linux-gnu-g++"
62+
CROSS_CFLAGS = ""
63+
TARGET_DIR = "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/ppc"
64+
LIBPNG_ARCH = "ppc"
65+
LIBPNG_OPTIMIZATIONS = "no"
66+
FEATURE = "ppc"
67+
68+
[tasks.unsupported]
69+
script_runner="@shell"
70+
script='''
71+
echo "Qemu fuzzer not supported on windows/mac"
72+
'''
73+
74+
75+
[tasks.target_dir]
76+
condition = { files_not_exist = [ "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}" ] }
77+
script_runner="@shell"
78+
script='''
79+
mkdir ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}
80+
'''
81+
82+
[tasks.deps_dir]
83+
dependencies = ["target_dir"]
84+
condition = { files_not_exist = [ "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/" ] }
85+
script_runner="@shell"
86+
script='''
87+
mkdir ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/
88+
'''
89+
90+
[tasks.arch_target_dir]
91+
dependencies = ["target_dir"]
92+
condition = { files_not_exist = [ "${TARGET_DIR}" ] }
93+
script_runner="@shell"
94+
script='''
95+
mkdir ${TARGET_DIR}
96+
'''
97+
98+
[tasks.zlib]
99+
linux_alias = "zlib_unix"
100+
mac_alias = "unsupported"
101+
windows_alias = "unsupported"
102+
103+
[tasks.zlib_unix_wget]
104+
dependencies = ["deps_dir"]
105+
condition = { files_not_exist = [ "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13" ] }
106+
script_runner="@shell"
107+
# NOTE: There's no specific reason we're using an old version of zlib,
108+
# but newer versions get moved to fossils/ after a while.
109+
script='''
110+
wget \
111+
-O "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13.tar.gz" \
112+
https://zlib.net/fossils/zlib-1.2.13.tar.gz
113+
114+
tar \
115+
zxvf ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13.tar.gz \
116+
-C ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/
117+
'''
118+
119+
[tasks.zlib_unix]
120+
dependencies = ["arch_target_dir", "zlib_unix_wget" ]
121+
condition = { files_not_exist = [ "${TARGET_DIR}/build-zlib/libz.a" ] }
122+
script_runner="@shell"
123+
script='''
124+
rm -rf ${TARGET_DIR}/build-zlib/
125+
126+
mkdir ${TARGET_DIR}/build-zlib/
127+
128+
cd ${TARGET_DIR}/build-zlib/ && \
129+
CC=$CROSS_CC \
130+
CFLAGS=${CROSS_CFLAGS} \
131+
${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/zlib-1.2.13/configure \
132+
--prefix=./zlib
133+
134+
make install
135+
'''
136+
137+
[tasks.libpng]
138+
linux_alias = "libpng_unix"
139+
mac_alias = "unsupported"
140+
windows_alias = "unsupported"
141+
142+
[tasks.libpng_unix_wget]
143+
dependencies = ["deps_dir"]
144+
condition = { files_not_exist = [ "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/libpng-1.6.37" ] }
145+
script_runner="@shell"
146+
script='''
147+
wget \
148+
-O "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/libpng-1.6.37.tar.xz" \
149+
https://deac-fra.dl.sourceforge.net/project/libpng/libpng16/1.6.37/libpng-1.6.37.tar.xz
150+
151+
tar \
152+
-xvf "${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/libpng-1.6.37.tar.xz" \
153+
-C ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/
154+
'''
155+
156+
[tasks.libpng_unix]
157+
dependencies = [ "arch_target_dir", "zlib", "libpng_unix_wget" ]
158+
condition = { files_not_exist = [ "${TARGET_DIR}/build-png/.libs/libpng16.a" ] }
159+
script_runner="@shell"
160+
script='''
161+
rm -rf ${TARGET_DIR}/build-png/
162+
163+
mkdir ${TARGET_DIR}/build-png/
164+
165+
cd ${TARGET_DIR}/build-png/ && \
166+
CC=$CROSS_CC \
167+
CFLAGS="${CROSS_CFLAGS} -I"${TARGET_DIR}/build-zlib/zlib/lib"" \
168+
LDFLAGS=-L"${TARGET_DIR}/build-zlib/zlib/lib" \
169+
${CARGO_MAKE_CRATE_TARGET_DIRECTORY}/deps/libpng-1.6.37/configure \
170+
--enable-shared=no \
171+
--with-pic=yes \
172+
--enable-hardware-optimizations=${LIBPNG_OPTIMIZATIONS} \
173+
--host=${LIBPNG_ARCH} \
174+
175+
make
176+
'''
177+
178+
[tasks.build]
179+
linux_alias = "build_unix"
180+
mac_alias = "build_unix"
181+
windows_alias = "unsupported"
182+
183+
[tasks.build_unix]
184+
command = "cargo"
185+
args = [
186+
"build",
187+
"--profile",
188+
"${PROFILE}",
189+
"--features", "${FEATURE}",
190+
"--target-dir", "${TARGET_DIR}"
191+
]
192+
193+
[tasks.fuzzer]
194+
dependencies = ["build"]
195+
script_runner="@shell"
196+
script='''
197+
rm -f ${TARGET_DIR}/${PROFILE_DIR}/qemu_cmin-${CARGO_MAKE_PROFILE}
198+
mv ${TARGET_DIR}/${PROFILE_DIR}/qemu_cmin ${TARGET_DIR}/${PROFILE_DIR}/qemu_cmin-${CARGO_MAKE_PROFILE}
199+
'''
200+
201+
[tasks.harness]
202+
linux_alias = "harness_unix"
203+
mac_alias = "unsupported"
204+
windows_alias = "unsupported"
205+
206+
[tasks.harness_unix]
207+
script_runner="@shell"
208+
script='''
209+
${CROSS_CXX} \
210+
./harness.cc \
211+
$CROSS_CFLAGS \
212+
"${TARGET_DIR}/build-png/.libs/libpng16.a" \
213+
"${TARGET_DIR}/build-zlib/libz.a" \
214+
-I"${TARGET_DIR}/build-png" \
215+
-I"${TARGET_DIR}/build-zlib/zlib/lib" \
216+
-L"${TARGET_DIR}/build-zlib/zlib/lib" \
217+
-o"${TARGET_DIR}/libpng-harness-${CARGO_MAKE_PROFILE}" \
218+
-lm \
219+
-static
220+
'''
221+
dependencies = [ "libpng" ]
222+
223+
[tasks.run]
224+
linux_alias = "run_unix"
225+
mac_alias = "unsupported"
226+
windows_alias = "unsupported"
227+
228+
[tasks.run_unix]
229+
command = "${TARGET_DIR}/${PROFILE_DIR}/qemu_cmin-${CARGO_MAKE_PROFILE}"
230+
args = [
231+
"--output", "./output",
232+
"--input", "./corpus",
233+
"--verbose",
234+
"--",
235+
"${TARGET_DIR}/libpng-harness-${CARGO_MAKE_PROFILE}",
236+
]
237+
dependencies = [ "harness", "fuzzer" ]
238+
239+
[tasks.test]
240+
linux_alias = "test_unix"
241+
mac_alias = "unsupported"
242+
windows_alias = "unsupported"
243+
244+
[tasks.test_unix]
245+
dependencies = [ "all" ]
246+
# Tidy up after we've run our tests so we don't hog all the disk space
247+
command = "cargo"
248+
args = [
249+
"make",
250+
"clean",
251+
]
252+
253+
[tasks.clean]
254+
linux_alias = "clean_unix"
255+
mac_alias = "clean_unix"
256+
windows_alias = "unsupported"
257+
258+
[tasks.clean_unix]
259+
# Disable default `clean` definition
260+
clear = true
261+
script_runner="@shell"
262+
script='''
263+
rm -rf ${CARGO_MAKE_CRATE_TARGET_DIRECTORY}
264+
cargo clean
265+
'''
266+
267+
[tasks.arm]
268+
command = "cargo"
269+
args = [
270+
"make",
271+
"-p", "arm",
272+
"run",
273+
]
274+
275+
[tasks.aarch64]
276+
command = "cargo"
277+
args = [
278+
"make",
279+
"-p", "aarch64",
280+
"run",
281+
]
282+
283+
[tasks.x86_64]
284+
command = "cargo"
285+
args = [
286+
"make",
287+
"-p", "x86_64",
288+
"run",
289+
]
290+
291+
[tasks.i386]
292+
command = "cargo"
293+
args = [
294+
"make",
295+
"-p", "i386",
296+
"run",
297+
]
298+
299+
[tasks.mips]
300+
command = "cargo"
301+
args = [
302+
"make",
303+
"-p", "mips",
304+
"run",
305+
]
306+
307+
[tasks.ppc]
308+
command = "cargo"
309+
args = [
310+
"make",
311+
"-p", "ppc",
312+
"run",
313+
]
314+
315+
[tasks.all]
316+
dependencies = [
317+
"arm",
318+
"aarch64",
319+
"x86_64",
320+
"i386",
321+
"mips",
322+
"ppc"
323+
]

0 commit comments

Comments
 (0)