-
-
Notifications
You must be signed in to change notification settings - Fork 380
add a justfile and readme for fuzzbench_forkserver_cmplog #3314
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
jiuhao47
wants to merge
3
commits into
AFLplusplus:main
Choose a base branch
from
jiuhao47:main
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
3 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,74 @@ | ||
# FuzzBench Forkserver CmpLog Fuzzer | ||
|
||
This is a forkserver-based fuzzer using CmpLog instrumentation for enhanced fuzzing effectiveness. It demonstrates the use of LibAFL with comparative logging (CmpLog) to improve fuzzing by tracking comparison operations in the target program. | ||
|
||
CmpLog instrumentation helps the fuzzer understand comparison operations in the target code, allowing it to generate more meaningful inputs by solving constraints automatically. | ||
|
||
## Build | ||
|
||
You can build this example by running: | ||
```bash | ||
cargo build --release | ||
``` | ||
|
||
This will compile the fuzzer. The test program needs to be compiled separately using AFL++ instrumentation. | ||
|
||
## Compile Test Program | ||
|
||
The test program (`test-cmplog.c`) needs to be compiled with AFL++ instrumentation. You can either: | ||
|
||
1. Use the provided script: | ||
```bash | ||
cd test && ./compile.sh | ||
``` | ||
|
||
2. Or use the justfile (recommended): | ||
```bash | ||
just compile | ||
``` | ||
|
||
This creates two versions of the test program: | ||
- `test-cmplog.afl`: Regular AFL instrumentation | ||
- `test-cmplog.cmplog`: CmpLog instrumentation for comparison tracking | ||
|
||
## Run | ||
|
||
### Using Justfile (Recommended) | ||
|
||
#### List all available commands | ||
```bash | ||
just | ||
``` | ||
|
||
#### Prepare and run everything | ||
```bash | ||
just run | ||
``` | ||
|
||
#### Quick test (10 seconds) | ||
```bash | ||
just quick-test | ||
``` | ||
|
||
#### Run in release mode (faster) | ||
```bash | ||
just run-release | ||
``` | ||
|
||
#### Clean and restart | ||
```bash | ||
just clean && just run | ||
``` | ||
|
||
### Manual Execution | ||
|
||
After building the fuzzer and compiling the test program, you can run: | ||
|
||
```bash | ||
# Create corpus and output directories | ||
mkdir -p corpus output | ||
echo "test" > corpus/test.txt | ||
|
||
# Run the fuzzer | ||
./target/release/fuzzbench_forkserver_cmplog -i ./corpus/ -o ./output/ ./test-cmplog.afl --cmplog ./test-cmplog.cmplog | ||
``` |
111 changes: 111 additions & 0 deletions
111
fuzzers/forkserver/fuzzbench_forkserver_cmplog/justfile
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,111 @@ | ||
# Justfile for LibAFL cmplog demo | ||
# Usage: just <command> | ||
|
||
# Default recipe - show available commands | ||
default: | ||
@just --list | ||
|
||
# Compile the test targets | ||
compile: | ||
@if ! command -v afl-clang-fast >/dev/null 2>&1; then \ | ||
echo "Error: afl-clang-fast not found in PATH. Please install AFL++ and ensure afl-clang-fast is available."; \ | ||
exit 1; \ | ||
fi | ||
@echo "Compiling test targets..." | ||
cd test && afl-clang-fast -O0 test-cmplog.c -o test-cmplog.afl | ||
cd test && AFL_LLVM_CMPLOG=1 afl-clang-fast -O0 test-cmplog.c -o test-cmplog.cmplog | ||
cp -f ./test/test-cmplog.afl . | ||
cp -f ./test/test-cmplog.cmplog . | ||
@echo "Test targets compiled successfully!" | ||
|
||
# Build the Rust fuzzer | ||
build: | ||
@echo "Building Rust fuzzer..." | ||
cargo build | ||
@echo "Rust fuzzer built successfully!" | ||
|
||
# Create necessary directories | ||
setup: | ||
@echo "Setting up directories..." | ||
mkdir -p ./corpus | ||
mkdir -p ./output | ||
@echo "Created corpus and output directories" | ||
|
||
# Initialize corpus with test input | ||
init-corpus: | ||
@echo "Initializing corpus..." | ||
echo "test" > ./corpus/test.txt | ||
@echo "Corpus initialized with test input" | ||
|
||
# Compile everything and set up environment | ||
prepare: compile build setup init-corpus | ||
@echo "Environment prepared successfully!" | ||
|
||
# Run the fuzzer | ||
run: prepare | ||
@echo "Starting fuzzer..." | ||
./target/debug/fuzzbench_forkserver_cmplog -i ./corpus/ -o ./output/ ./test-cmplog.afl --cmplog ./test-cmplog.cmplog | ||
|
||
# Run in release mode (faster) | ||
run-release: compile setup init-corpus | ||
@echo "Building in release mode..." | ||
cargo build --release | ||
@echo "Starting fuzzer in release mode..." | ||
./target/release/fuzzbench_forkserver_cmplog -i ./corpus/ -o ./output/ ./test-cmplog.afl --cmplog ./test-cmplog.cmplog | ||
|
||
# Clean compiled binaries | ||
clean-binaries: | ||
@echo "Cleaning compiled binaries..." | ||
rm -f ./test-cmplog.afl | ||
rm -f ./test-cmplog.cmplog | ||
rm -f ./test/test-cmplog.afl | ||
rm -f ./test/test-cmplog.cmplog | ||
@echo "Binaries cleaned" | ||
|
||
# Clean Rust build artifacts | ||
clean-rust: | ||
@echo "Cleaning Rust build artifacts..." | ||
cargo clean | ||
@echo "Rust artifacts cleaned" | ||
|
||
# Clean corpus and output directories | ||
clean-data: | ||
@echo "Cleaning corpus and output directories..." | ||
rm -rf ./corpus | ||
rm -rf ./output | ||
@echo "Data directories cleaned" | ||
|
||
# Clean log files | ||
clean-logs: | ||
@echo "Cleaning log files..." | ||
rm -f ./libafl.log | ||
rm -f ./.cur_input_* | ||
@echo "Log files cleaned" | ||
|
||
# Clean everything | ||
clean: clean-binaries clean-rust clean-data clean-logs | ||
@echo "All cleaned up!" | ||
|
||
# Kill any running fuzzer processes | ||
kill: | ||
@echo "Killing fuzzer processes..." | ||
@pkill -f fuzzbench_forkserver_cmplog || echo "No fuzzer processes found" | ||
|
||
# Test compilation without running | ||
test-compile: compile | ||
@echo "Testing compiled binaries..." | ||
@if [ -x "./test-cmplog.afl" ]; then \ | ||
echo "✓ test-cmplog.afl compiled successfully"; \ | ||
else \ | ||
echo "✗ test-cmplog.afl compilation failed"; \ | ||
fi | ||
@if [ -x "./test-cmplog.cmplog" ]; then \ | ||
echo "✓ test-cmplog.cmplog compiled successfully"; \ | ||
else \ | ||
echo "✗ test-cmplog.cmplog compilation failed"; \ | ||
fi | ||
|
||
# Quick test run (limited time) | ||
test: prepare | ||
@echo "Running quick test (10 seconds)..." | ||
timeout 10s ./target/debug/fuzzbench_forkserver_cmplog -i ./corpus/ -o ./output/ ./test-cmplog.afl --cmplog ./test-cmplog.cmplog || echo "Quick test completed" | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. No. you have to check the result of the run not ignore it like |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
then you have to install it in this script
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should we really install dependencies in justfiles? Maybe document them?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
maybe no.
but then the installation should be done before this file is run in github ci