From f405845de85dbdbdc95165b73167bb43c14dc801 Mon Sep 17 00:00:00 2001 From: Vitalii Akolzin Date: Fri, 16 Aug 2024 11:28:36 +0300 Subject: [PATCH 1/4] minor fix --- Examples/Crusher/Linux/OpenSSL_mod_client/plugins/conf.py | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/Examples/Crusher/Linux/OpenSSL_mod_client/plugins/conf.py b/Examples/Crusher/Linux/OpenSSL_mod_client/plugins/conf.py index 0600b1a..a4e885a 100644 --- a/Examples/Crusher/Linux/OpenSSL_mod_client/plugins/conf.py +++ b/Examples/Crusher/Linux/OpenSSL_mod_client/plugins/conf.py @@ -1,8 +1,5 @@ """ -This configurator script provides for firefox unique value of "-P" (profile) option. -This avoids conflicts when multiple firefox instances are running. -We assume that these profiles already exist - they must be created manually or with environment script (env.py), -which is run before this script. +This configurator script provides differential fuzzing by replacing of target binaries in some instances with sanitized ones. """ import json From c54a46e3f2b1528b1e4b6f7126caa23aca40fca1 Mon Sep 17 00:00:00 2001 From: Vitalii Akolzin Date: Mon, 7 Oct 2024 16:16:57 +0300 Subject: [PATCH 2/4] update openssl-mod-client --- .../Crusher/Linux/OpenSSL_mod_client/README.md | 6 ++---- .../OpenSSL_mod_client/client/client.patch | 8 ++++---- .../client/mod-client-api/libmodclient.a | Bin 22890 -> 0 bytes .../client/mod-client-api/mod-client-api.h | 8 -------- 4 files changed, 6 insertions(+), 16 deletions(-) delete mode 100644 Examples/Crusher/Linux/OpenSSL_mod_client/client/mod-client-api/libmodclient.a delete mode 100644 Examples/Crusher/Linux/OpenSSL_mod_client/client/mod-client-api/mod-client-api.h diff --git a/Examples/Crusher/Linux/OpenSSL_mod_client/README.md b/Examples/Crusher/Linux/OpenSSL_mod_client/README.md index 8756661..268c4f6 100644 --- a/Examples/Crusher/Linux/OpenSSL_mod_client/README.md +++ b/Examples/Crusher/Linux/OpenSSL_mod_client/README.md @@ -196,8 +196,7 @@ $ git checkout 5c3c8369f3b42ce4b816606bb9bbad00c664a416 value = mutate_int(value, len); ``` -Также необходимо скопировать `mod-client-api/` в `openssl/` -и добавить соответствующий include в файлы с мутациями. +Также необходимо скопировать `crusher/mod-client-api/` в `openssl/` и добавить соответствующий include в файлы с мутациями. Все патчи - см. `client/client.patch`. Применим их: ```shell @@ -210,8 +209,7 @@ $ git apply ../client.patch ```shell $ make clean && make distclean $ ./config no-shared no-tests -# В Makefile в правило для сборки цели apps/openssl в конце добавить mod-client-api/libmodclient.a -$ make -j +$ make -j EX_LIBS=./mod-client-api/libmodclient.a $ cp apps/openssl ../openssl-clean ``` diff --git a/Examples/Crusher/Linux/OpenSSL_mod_client/client/client.patch b/Examples/Crusher/Linux/OpenSSL_mod_client/client/client.patch index c3ac7dc..9bc5f60 100644 --- a/Examples/Crusher/Linux/OpenSSL_mod_client/client/client.patch +++ b/Examples/Crusher/Linux/OpenSSL_mod_client/client/client.patch @@ -1,5 +1,5 @@ diff --git a/apps/s_client.c b/apps/s_client.c -index a6c5a559a9..e4b2b34856 100644 +index a6c5a559a9..96ec761687 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -48,6 +48,42 @@ typedef unsigned int u_int; @@ -49,7 +49,7 @@ index a6c5a559a9..e4b2b34856 100644 return 0; } -+#include "../../mod-client-api/mod-client-api.h" ++#include "../mod-client-api/mod-client-api.h" + +#include + @@ -103,14 +103,14 @@ index a6c5a559a9..e4b2b34856 100644 size_t outlen = user_data->buflen; diff --git a/crypto/packet.c b/crypto/packet.c -index ac5c2e33f8..147dc1f563 100644 +index ac5c2e33f8..6bece6a57f 100644 --- a/crypto/packet.c +++ b/crypto/packet.c @@ -207,9 +207,14 @@ int WPACKET_set_flags(WPACKET *pkt, unsigned int flags) return 1; } -+#include "../../mod-client-api/mod-client-api.h" ++#include "../mod-client-api/mod-client-api.h" + /* Store the |value| of length |len| at location |data| */ static int put_value(unsigned char *data, uint64_t value, size_t len) diff --git a/Examples/Crusher/Linux/OpenSSL_mod_client/client/mod-client-api/libmodclient.a b/Examples/Crusher/Linux/OpenSSL_mod_client/client/mod-client-api/libmodclient.a deleted file mode 100644 index 2389037537af257a7bdabada467699e66a8a7098..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 22890 zcmeI44Rlo1wSdn|Kw?CL78NVC1EPXLNJ#jJq76S6E*gFW(jw3fLo$JpOp?wI5;aOY zv}GK5X7$x4eOjNb_HWf%yZRPOd0GOb2H#`3(rPuf=`td=sYzGUme#x$vV`|PvNx#ymH=S(Kek0k21-c&L(l%L8));X7dL!pXURaK74 zrV^!8wNj&-|K2}aqN#9wQ!Lt?3ddU-q6+g{qRrvPSd)`UL|dC8Z6=@G8V|Ro5-JgC zZV1PkQz{81bS4>%HYhN{_F~O3M~e2eajojubMuYqJMT1A*QXO;v^AXyCu4U;Red^{ zYKey%TN2yC$!KDGG@(+_L_F3UNjct;>!_ezuiqMLY6!Q+-~&F2#g|rpOjY zoL8YK<>H1&DiY>KYlAJ#spt-HFq%xpTAITR>3D0n(X~fXjDs%P6m51YB0)-B5@#xBy8a;MMwkpr06ljYskOp1o+JlD0nj2#E z(WKjuxWl45^vJ?oeM@s=%;_%7>PX%{(@Q2F<3|s>2Y~VUBKo@Cs^XI!FCQ+Qo&nOZVwu?dnX;^r>bn7tE>MTK5J0S5e8*eVu3J z?Kn1bR@&nWYa4H;7xb0}XX(Czu9}+Rdd{?;R68!rU5x#gvrYzjvbtH$*vTLLrq+@J z#h|VShk-Yn)3M!7Y(QzSu!ot>fGxT%r<`gjrcUj~PaG%4`l5nu&UBuO!7@YCuJ6ge zLbbnCgS|(4XsX~)oC`s4`j;v+F<1j`6dU_^@hmc4%`}qiVRLS0e`4l{0v-&GAy@27 zSMdf@S^jK+bxk*QU1sbTjND*@QNYP=mC5p)Y)F34vIk-I+OJd)CXScfd&EhAl!5rr z&FJ*to!vMp*nKo)|3__#0cPx)C|1x|fC(>1_giNa+RpgXQQ&y#t|LKyFa13=$GIv@ z`<$!dRO-wfixo||4y5oT!m2YR~IDM%TsFOX^P8*|U=W(Lybhq|qPUA_X=IHm%5CFbh-jkz4u{FCgs zjMX2=S^YOyLw9#~bigGzRa}C)N!gLzR$sR@q>bNx0G-f7A>ZX5aHf4&rLW0ZLulCQO^!k3tThA#!$nKLz4kO~WbgxC7_deTj55YfWZF-t z^tc1K@^!9)y;v>It>&t7oyw+h)Hf%G|W8W_BFXZxEfJ;7MWyc4jidq`UOg7sDq z)S=B6dsR|JJ<+#H_gQaIqd(JG`i0Kj*0G)K$5d)OxC)C6UJ+xxZw7$%fM5HuFR}+; zK9=p-(|XF7ou=2Rj_>=?Uq@%!3)x|49R#MZDl~H#n|Tb(57<{i`~p1~q>ObOMj!^J z+UhC&T<`m*PN7C#WJ7xKo=x|Iq#q{y0!z+rYXn?TgR?Q5poZq*_7AI)?_)bm8xIPF z?7#0GXJ@PtY%<#I1Rq8c&v%F=CffR5b%-s2ng1&@ub#VPGAAozQxyvG} z?n#}YpmmaltLP-0s3x$xX6BJoRQ2J66R-2M&otsQT@yU>-Mno3QJ6|`%;c=2Ss0kz zmgBK?9A|Q?Z?N94hNNX$X=e`$wL>|p4@NkQ_)KT99q7e{sr6IvWWYYy4=eIRaDo1m zE{KjyT+i{U?IE}>K%Xy9)XsFx6AtTv34NGT=8omEno$B4cmRf{8fe=HUN!IltlKsW zi&Y#Fj!!r>?6vpU#oEun5$AGpyd25Ihhd5yR&6g~iM-+JTrXm1K^yWEYQV?dZ2A>D zTX)3s%m%^Mq1V^&k?gpf^$N_|P{k2@&#F-{QD=jYfth@`+d6@+4~D>bkfD=Dz&E%k zcSEV+g9F8&l(A00wqC;&+{P!nFzgh4-1K;bw&^rkwSRX)ahjU(1}Z4o)zJc6Fvp z%$ox&h8<7G9)DMi1dOjS_VOnX$1(Rl-E%g2)b~bpejvTkd%!D{I4R?B(HQi*?pox0bUj zS1(%{UbbRY-CDJL!ruo7wANa^eA$WxYpqaOS(!4q8KIT8D7AFaqU%Fb>o%vGQ|VB3Syfs2 zjEc0*RopYHysW&cY}Pb~D}1^c2OoR~v~)!sJpQXrWJU17G~PL=z@4jAV8^(?-&&Ty*|9!J9$Dk zUuep2B>6rm4}RM%e>cgmmGX!w{|L#;q&#Zm&z(WuM{+;^PoAOtM10PMX}A0%B(KktuXp9ok^D+2cf=|LtdHbzDYr63Gz6USO&7wq zrB3h(w~i3W{n}7-2KlBl$aj+5FUF6Ne0iRKi(UUZ&tSj*401g|fNj6}LpWJL@~gjw z1O2Brh}{hCqHl$-f}W<5>8tspDzVX_h)cXHrBPJtW_S*FLua zY!qz|Y9pv~f^_bJb6024{Y9Bk!4_0PoeA*v7L%V2wr4)+EI~!CtKIPxQK5vxZU!L&nuV9}HsLLR16SGl}>V51&hXs)ygKd6A-_GAPvq;Grdqnh!O3ellRajjl{Za#4JIhscNEYy3E z+j?4ag7`(?xPJAfH%MQvO+l#Fm~b2-9-{)xajjFxP7w?jtoL5hx9C_3ypaBQAO1nI z(?#WRe!%n*AN?yyzh7%9bvGR=eDrVf;fsBE9ogRq?Z&j#IjAV{F5(M_Cy0-RBPP9O zgyW})e~h?Z>jLk9e4+R}f8}H6w?6z`AO0TM@27FX?YaosgK;jQiIVwr;#D4g6Y)qF`mmyAOlISo8fpK@ngjGdKvh|#OKqEna5R#_syd5CBB{`vC3xDm|JP7sXlD65)NUamJO%byv9m)5RaxS%$?a>KR$>y zZ`V4!r#zBsi7CiLQhq;2fSuB*SUlR&*br$`N&K0D3Wt-aNd2~O{nl+^d}aFA{A8gu z0Xwf7RU#U1*-k%5$m{B18h;>0Y8xtzf#b@V@Nhdqpc3j`!&NIk$mO9{}+Gh5Qo{MrCx!%{96k7uKfRh_W-{PYD`4M zuNd(63z5w&3Hq7D-{^-BIK1M{h4UBv9s+)Cl%)F<-Cp%m=oDZl@e3kIc#a8{HR>w( zFrSMM5-ij8+YjdRHFfl_hI8hhAkO;qIHc-*^iv*vS{|u3AAMeDp`Wtee-Zjq;hg>9 zbq(rI6Z{pSf1TjPb5PX5)WrBZH@R@?&F8E}@cL+X3@XrZeA^1NEF713p@L59t zDZ!=w^MY3j{Z|E-{^(64pvV1q37lj4t@HwEz^)B();qkgk=u100iC+sg<_SByg+BZ&(zXA2!OI2b?@+K^lLh~l(7#^r ze-r!$!4CF4eBQ^->p~yf%y!-o98dq`Onaw(A-L2( zCAh426e>Z&gN)A%;@)`9^3mTQ^s%b<$RB)O#>93uI9avL$IdRHkEd+sKEcsG$KmsW zOZ{(oI903m`S9m__zwlgdSNrFPHzy$173UV4?bUG!uCr2-w2MUlvRK7;lo1{?GJ3pMm4eHD!RKpCXkY5D6dd)bxu@0(j;Gv@Vd7qY+61>ipW|~Majuu& ze?B1e@mZhs9~AmBo?j9i>t;L83Xb}mI(_)-#L>oN_;9^%d-UmcpnfOx<-C1L@P)$8 zSa>eRWZH{oN?k}C>y_=jROn0pKPs;8K65urK|2K=7-;4*U6K!EYA)DZ!TsepqnW`QqB)@A=RdyeF{z z-;qAHA7vrBBH#DnqsD*|B(MHug5walU27?I1#z@}4ScxXr9vNN{Qb{rAHL3q#|4-5 zCWw3MeMsnIfAQG*vWN3{cv9HGchcbk-gq_&eT*f_F|~R)$N4T{N5=EhLLY6+ zCreo${;;qkOZ|l4($9bP;otG$ z2YmRCeE0+O1swW$Equ6L-xPeK;2Y?@JYGjQ{`q^(C~>qSpF8#l9u{_95qz@XgMx1o z{9VDNekr}L$9f|||8l{lex=}>g?^pjQv^>5UN88k1(*5{3*I2~zb<%G@RtQ|6#UnM z-z@k!^dch&4CDV#@WC{WIL1N7|6;+nfQ!7ZWxsNhQk|CZp=&QZZzh5kEcgoH&wGN)emVDIP=bWpQr?BywI2R zhP2dq?#42lYUl(Re%4Ta6CIi3+5*!~{nyyx_3dLG&f~4q!}}@EN4C%V=J*8&bKW-> zq8B5~dEZ=(hx5LD>fyZqYskZS|JPXRH};eFe@*vr-v5RBxMaI{|5uZT^S-V7J)HN2 zJ?Y_JqvwGh59j?>!yeB2t#IFz^oRFbm3uhv3tQ#kybr6@!+Aeihllh2tbg@z-iP&y zhx2~75fA76Srfp zRhDRRGW9L-IR0bKvgVdlv3?DU8D4TC1V6%jrJC0-EkPt1gE#9Ktm&aZWnQon!xH&hb1rVA*0Pt0vI#YT|Sm z6IE&x)m!5d=OpCGPlr6(^p<~&%GYY|OrelD)n^s(7yZKPOeQWr*3)257XL-AE>F#M zO+0z2bBg}S#O3+85QKa#^?IqiWO(k?T@4I}q}P8g9|D<79Dio`Oo}$W - -// fork -void custom_fork_server(); - -// mut -uint64_t mutate_int(uint64_t value, size_t len); -void mutate_buf(void *buf, uint32_t *len); From cca70cd6f2c418287b4ec2ac946252817587c823 Mon Sep 17 00:00:00 2001 From: Vitalii Akolzin Date: Mon, 7 Oct 2024 20:34:33 +0300 Subject: [PATCH 3/4] minor fix kern_netfilter --- Examples/Crusher/Linux/kern_netfilter/README.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/Examples/Crusher/Linux/kern_netfilter/README.md b/Examples/Crusher/Linux/kern_netfilter/README.md index a093e77..d08ed22 100644 --- a/Examples/Crusher/Linux/kern_netfilter/README.md +++ b/Examples/Crusher/Linux/kern_netfilter/README.md @@ -118,7 +118,7 @@ target4/target/ ```shell ./crusher/bin_x86-64/fuzz_manager --start 20 -i in -o out \ - -I nyx -F --affinity --max-file-size 1 \ + -I nyx -F --max-file-size 1 \ --wait-next-instance 1000 -- ./target/ __DATA__ ``` @@ -128,7 +128,6 @@ target4/target/ - `-o ` - папка с результатами; - `-I ` - тип инструментации; - `-F` - очищать папку с предыдущими результатами; -- `--affinity` - привязка процессов (fuzz, eat) к определённым ядрам; - `--max-file-size ` - ограничение на входные данные; - `--wait-next-instance ` - ожидание перед запуском каждого fuzz/eat процесса. @@ -191,7 +190,7 @@ target7/target/ ```shell ./crusher/bin_x86-64/fuzz_manager --start 10 -i in -o out \ - -I nyx -F --affinity --max-file-size 1 \ + -I nyx -F --max-file-size 1 \ --wait-next-instance 1000 -- ./target/ __DATA__ ``` From 7100ce1aefc44d6a62dd774d791ce7d3715fb932 Mon Sep 17 00:00:00 2001 From: Vitalii Akolzin Date: Thu, 10 Oct 2024 15:38:28 +0300 Subject: [PATCH 4/4] fix nginx_docker --- Examples/Crusher/Linux/nginx_docker/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Examples/Crusher/Linux/nginx_docker/README.md b/Examples/Crusher/Linux/nginx_docker/README.md index ef870b9..ad1a7ce 100644 --- a/Examples/Crusher/Linux/nginx_docker/README.md +++ b/Examples/Crusher/Linux/nginx_docker/README.md @@ -29,7 +29,7 @@ docker build --network host -f Dockerfile . -t nginx-demo -t 10000 --wait-next-instance 2000 -F \ --clean-binary /root/target/nginx-clean/sbin/nginx \ --bitmap-size 65536 \ - -- /target/new_nginx/nginx_build/sbin/nginx + -- /root/target/nginx-fuzz/sbin/nginx ``` Здесь используются следующие опции фаззера: