-
Notifications
You must be signed in to change notification settings - Fork 245
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Add libfuzzer based fuzzer. See: https://www.llvm.org/docs/LibFuzzer.html Signed-off-by: Alan Jowett <alan.jowett@microsoft.com> * Fix ELF parsing bugs found by fuzzer Signed-off-by: Dave Thaler <dthaler@microsoft.com> * Make verifier fuzzer compile in Debug configuration Signed-off-by: Dave Thaler <dthaler@microsoft.com> * Cleanup fuzzer code Signed-off-by: Alan Jowett <alan.jowett@microsoft.com> * PR feedback Signed-off-by: Alan Jowett <alan.jowett@microsoft.com> * Setup/cleanup state for fuzzing Signed-off-by: Alan Jowett <alan.jowett@microsoft.com> * Fix debug build of execution_context_fuzzer Signed-off-by: Alan Jowett <alan.jowett@microsoft.com> * Fix verifier Signed-off-by: Dave Thaler <dthaler@microsoft.com> * Pickup latest ebpf-verifier Signed-off-by: Alan Jowett <alan.jowett@microsoft.com> * Remove corpus from git Signed-off-by: Alan Jowett <alan.jowett@microsoft.com> * Fix CR/LF mangling in ELF files Signed-off-by: Alan Jowett <alan.jowett@microsoft.com> * PR feedback Signed-off-by: Alan Jowett <alan.jowett@microsoft.com> * Remove corpus from git Signed-off-by: Alan Jowett <alan.jowett@microsoft.com> * Fix build break Signed-off-by: Alan Jowett <alan.jowett@microsoft.com> * Enable debug fuzzer build Signed-off-by: Alan Jowett <alan.jowett@microsoft.com> * Update to latest verifier Signed-off-by: Dave Thaler <dthaler@microsoft.com> * Update test based on latest verifier changes Signed-off-by: Dave Thaler <dthaler@microsoft.com> * Fix execution context fuzzer Signed-off-by: Dave Thaler <dthaler@microsoft.com> Co-authored-by: Alan Jowett <alan.jowett@microsoft.com> Co-authored-by: Dave Thaler <dthaler@microsoft.com> Co-authored-by: saxena-anurag <43585259+saxena-anurag@users.noreply.github.com>
- Loading branch information
4 people
authored
May 27, 2022
1 parent
82db455
commit c62b083
Showing
24 changed files
with
1,145 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -12,3 +12,4 @@ | |
| *.sln text eol=crlf | ||
| *.vcxproj text eol=crlf | ||
| *.vcxproj.filters text eol=crlf | ||
| *.o -text | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Submodule ebpf-verifier
updated
3 files
| +0 −14 | .github/codecov.yml | |
| +0 −8 | .github/workflows/coverage.yml | |
| +22 −3 | src/asm_files.cpp |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,6 +2,7 @@ | |
|
|
||
| # File extensions that don't support embedding license info | ||
| .*\.md$ | ||
| .*\.o$ | ||
| .*\.png$ | ||
| .*\.proj$ | ||
| .*\.rc$ | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| # libFuzzer based fuzzing tools | ||
|
|
||
| ## Overview | ||
| [LibFuzzer](https://www.llvm.org/docs/LibFuzzer.html) is an in-process, coverage-guided, evolutionary fuzzing engine. It uses a set of starting data (the corpus) | ||
| to generate new test cases, measures the code-coverage of the new test, and re-combines it form new test cases. | ||
|
|
||
| ## Usage | ||
| 1) Copy the libFuzzer binary and existing corpus to a test machine (currently only Windows 10 and Server 2019 are supported). | ||
| 2) Start the libFuzzer binary, pass the path to the corpus folder, and maximum time to run: ```execution_context_fuzzer.exe execution_context_fuzzer_corpus -use_value_profile=1 -max_total_time=1800``` | ||
| 3) If the the fuzzer hits an issue, it will display the stack trace and create a file containing the input that triggered the crash. | ||
| 4) Copy any new test cases and check them into the repo. | ||
|
|
||
| ## Reproducing a crash | ||
| When the fuzzer finds an input that triggers a crash it will create a file with a "crash-" prefix followed by the SHA1 | ||
| of the input that caused the crash. To reproduce the crash (for debugging), run the fuzzer again, passing the file | ||
| name in place of the corpus folder. | ||
|
|
||
| ## Future | ||
| Once funding is available, we should set up a OneFuzz cluster and have the CI/CD pipeline deploy to it. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,95 @@ | ||
| <?xml version="1.0" encoding="utf-8"?> | ||
| <!-- | ||
| Copyright (c) Microsoft Corporation | ||
| SPDX-License-Identifier: MIT | ||
| --> | ||
| <Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> | ||
| <ItemGroup Label="ProjectConfigurations"> | ||
| <ProjectConfiguration Include="Debug|x64"> | ||
| <Configuration>Debug</Configuration> | ||
| <Platform>x64</Platform> | ||
| </ProjectConfiguration> | ||
| <ProjectConfiguration Include="Release|x64"> | ||
| <Configuration>Release</Configuration> | ||
| <Platform>x64</Platform> | ||
| </ProjectConfiguration> | ||
| </ItemGroup> | ||
| <PropertyGroup Label="Globals"> | ||
| <VCProjectVersion>16.0</VCProjectVersion> | ||
| <Keyword>Win32Proj</Keyword> | ||
| <ProjectGuid>{a0a0d663-dcf7-4bb1-9ddb-7964c3c31603}</ProjectGuid> | ||
| <RootNamespace>fuzz2</RootNamespace> | ||
| <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion> | ||
| <ProjectName>bpf2c_fuzzer</ProjectName> | ||
| </PropertyGroup> | ||
| <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> | ||
| <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration"> | ||
| <ConfigurationType>Application</ConfigurationType> | ||
| <UseDebugLibraries>true</UseDebugLibraries> | ||
| <PlatformToolset>v142</PlatformToolset> | ||
| <CharacterSet>Unicode</CharacterSet> | ||
| <EnableASAN>true</EnableASAN> | ||
| </PropertyGroup> | ||
| <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> | ||
| <ConfigurationType>Application</ConfigurationType> | ||
| <UseDebugLibraries>false</UseDebugLibraries> | ||
| <PlatformToolset>v142</PlatformToolset> | ||
| <WholeProgramOptimization>true</WholeProgramOptimization> | ||
| <CharacterSet>Unicode</CharacterSet> | ||
| <EnableASAN>true</EnableASAN> | ||
| <SpectreMitigation>false</SpectreMitigation> | ||
| </PropertyGroup> | ||
| <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> | ||
| <ImportGroup Label="ExtensionSettings"> | ||
| </ImportGroup> | ||
| <ImportGroup Label="Shared"> | ||
| </ImportGroup> | ||
| <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> | ||
| <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> | ||
| </ImportGroup> | ||
| <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> | ||
| <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> | ||
| </ImportGroup> | ||
| <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> | ||
| <ClCompile> | ||
| <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> | ||
| <AdditionalIncludeDirectories>$(SolutionDir)tests\libfuzzer\include;$(SolutionDir)include;$(SolutionDir)external\ebpf-verifier\external\ELFIO;$(SolutionDir)external\ubpf\vm;$(OutDir);$(SolutionDir)external\ebpf-verifier\src;$(SolutionDir)tools\bpf2c;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> | ||
| <AdditionalOptions>/fsanitize-coverage=inline-bool-flag /fsanitize-coverage=edge /fsanitize-coverage=trace-cmp /fsanitize-coverage=trace-div %(AdditionalOptions)</AdditionalOptions> | ||
| </ClCompile> | ||
| <Link> | ||
| <SubSystem>Console</SubSystem> | ||
| <AdditionalDependencies>mincore.lib;;%(AdditionalDependencies)</AdditionalDependencies> | ||
| <AdditionalLibraryDirectories>$(VCToolsInstallDir)lib\$(Platform)</AdditionalLibraryDirectories> | ||
| </Link> | ||
| </ItemDefinitionGroup> | ||
| <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> | ||
| <ClCompile> | ||
| <PreprocessorDefinitions>NDEBUG;_CONSOLE;NO_CATCH;%(PreprocessorDefinitions)</PreprocessorDefinitions> | ||
| <AdditionalIncludeDirectories>$(SolutionDir)tests\libfuzzer\include;$(SolutionDir)include;$(SolutionDir)external\ebpf-verifier\external\ELFIO;$(SolutionDir)external\ubpf\vm;$(OutDir);$(SolutionDir)external\ebpf-verifier\src;$(SolutionDir)tools\bpf2c;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories> | ||
| <AdditionalOptions>/fsanitize-coverage=inline-bool-flag /fsanitize-coverage=edge /fsanitize-coverage=trace-cmp /fsanitize-coverage=trace-div %(AdditionalOptions)</AdditionalOptions> | ||
| </ClCompile> | ||
| <Link> | ||
| <SubSystem>Console</SubSystem> | ||
| <GenerateDebugInformation>true</GenerateDebugInformation> | ||
| <AdditionalDependencies>mincore.lib;;%(AdditionalDependencies)</AdditionalDependencies> | ||
| </Link> | ||
| </ItemDefinitionGroup> | ||
| <ItemGroup> | ||
| <ClCompile Include="..\..\..\tools\bpf2c\bpf_code_generator.cpp" /> | ||
| <ClCompile Include="libfuzz_harness.cpp" /> | ||
| </ItemGroup> | ||
| <ItemGroup> | ||
| <ClInclude Include="..\..\..\tools\bpf2c\bpf_code_generator.h" /> | ||
| <ClInclude Include="..\..\libs\thunk\mock\mock.h" /> | ||
| <ClInclude Include="..\end_to_end\test_helper.hpp" /> | ||
| <ClInclude Include="..\include\libfuzzer.h" /> | ||
| </ItemGroup> | ||
| <ItemGroup> | ||
| <ProjectReference Include="..\..\..\external\ebpf-verifier\build\ebpfverifier.vcxproj"> | ||
| <Project>{7d5b4e68-c0fa-3f86-9405-f6400219b440}</Project> | ||
| </ProjectReference> | ||
| </ItemGroup> | ||
| <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> | ||
| <ImportGroup Label="ExtensionTargets"> | ||
| </ImportGroup> | ||
| </Project> |
Oops, something went wrong.