Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Qemu arm launcher #708

Merged
merged 19 commits into from
Aug 2, 2022
Merged

Qemu arm launcher #708

merged 19 commits into from
Aug 2, 2022

Conversation

TeumessianFox
Copy link
Contributor

Providing a fuzzer crate for the arm qemu linux usermode based on the qemu_launcher fuzzer.

domenukk
domenukk reviewed Jul 25, 2022
View reviewed changes
fuzzers/qemu_arm_launcher/Makefile.toml
@@ -2,6 +2,7 @@
[env]
FUZZER_NAME='libpng_harness'
PROJECT_DIR = { script = ["pwd"] }
CROSS_CC = "arm-linux-gnueabi-gcc"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could probably try to patch build.rs of libafl_qemu to figure this binary out by itself

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree that hardcoding the CROSS_CC is not a good idea. The problem is that this fuzzer needs a CROSS_CC to function. Figuring out which cross_cc is installed is hard and also systems might have multiple cross_cc installed.

Especially for the github workflows it needs to be set.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For the scope of this PR it's more than fine, I was thinking in general

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are right, that would be great. I also thought about it, but there are just so many cross_cc. Already for arm on ubuntu using apt you might have arm-none-eabi-gcc, arm-linux-gnueabi-gcc and arm-linux-gnueabihf-gcc installed. Not even speaking about other targets then arm32 or manually installed cross_cc. I think it is impossible to pick the correct one for the user or do you have any idea on how to?

@TeumessianFox
Copy link
Contributor Author

@andreafioraldi Yesterday before merging your qemu full-system changes into this branch, everything compiled just fine. Now I get a lot of linker errors, because libqemu-partially-linked.o has undefined references. The qemu_launcher works tho. So I expect some weirdness with the cpu_target in libafl_qemu build_linux.rs. Do you have any idea what could cause it?

@andreafioraldi
Copy link
Member

Which undefined references?

@TeumessianFox
Copy link
Contributor Author

TeumessianFox commented Jul 26, 2022 •
edited
Loading

You can probably recreate it by doing cargo make run in qemu_arm_launcher. It worked without an issue before I merged the main branch in.

Compiling qemu_arm_launcher v0.8.0 (LibAFL/fuzzers/qemu_arm_launcher)
error: linking with `cc` failed: exit status: 1
...
/usr/bin/ld: LibAFL/fuzzers/qemu_arm_launcher/target/release/deps/liblibafl_qemu.rlib(libqemu-partially-linked.o): in function `cpu_common_reset':
          LibAFL/fuzzers/qemu_arm_launcher/target/release/build/libafl_qemu-3c3f6f0f5d61973e/out/qemu-libafl-bridge/build/../hw/core/cpu-common.c:139: undefined reference to `tcg_allowed'
...
/usr/bin/ld: LibAFL/fuzzers/qemu_arm_launcher/target/release/deps/liblibafl_qemu.rlib(libqemu-partially-linked.o): in function `gen_helper_atomic_cmpxchgw_be':
          LibAFL/fuzzers/qemu_arm_launcher/target/release/build/libafl_qemu-3c3f6f0f5d61973e/out/qemu-libafl-bridge/accel/tcg/tcg-runtime.h:44: undefined reference to `helper_atomic_cmpxchgw_be'
...
afl_qemu::emu::Emulator::add_edge_hooks':
          LibAFL/libafl_qemu/src/emu.rs:833: undefined reference to `libafl_add_edge_hook'
          collect2: error: ld returned 1 exit status

@TeumessianFox
Copy link
Contributor Author

TeumessianFox commented Jul 27, 2022 •
edited
Loading

@andreafioraldi after a long search I found the reason. In your commit #692 you change the libafl_qemu_bridge commit used from "03e283c85800496b60fb757d68a7df2821fb7a90" to "03fad12e801581536cd10830073acfce69e381fe". Unfortunately, the new one has a tiny mistake for 32-bit emulation targets. I will make a PR in libafl_qemu_bridge (AFLplusplus/qemu-libafl-bridge#10) and as soon as that is merged, this PR should hopefully also work. What is weird is that the libafl_qemu/build_linux.rs asks for the .status() when doing make in libafl_qemu_bridge and even though the make fails, status returns OK. I could not figure out why that is the case.

@andreafioraldi
Copy link
Member

andreafioraldi commented Jul 27, 2022 via email

@TeumessianFox
Copy link
Contributor Author

Does anyone know how to get the arm GCC dependency on mac to work? I have no experience with mac or how to get the github workflow to function.

@TeumessianFox TeumessianFox marked this pull request as ready for review July 29, 2022 13:19
@tokatoka
Copy link
Member

tokatoka commented Aug 1, 2022

it is fixed now, can you merge main into your branch?

@domenukk
Copy link
Member

domenukk commented Aug 2, 2022

Thanks!

@domenukk domenukk merged commit b2a1e03 into AFLplusplus:main Aug 2, 2022
khang06 pushed a commit to khang06/LibAFL that referenced this pull request Oct 11, 2022
@TeumessianFox
Qemu arm launcher (AFLplusplus#708)
fd6cdf5 
* Adding qemu_arm_launcher crate

* Trying to fix qemu arm usermode

* Cargo fmt

* Adding CROSS_CC env

* Remove hardcoded arm-linux-gnueabi-gcc and replace by CROSS_CC

* Adding arm-linux-gnueabi-gcc to github workflows for ubuntu

* Fixing typo in apt install package

* Resetting LR after each fuzzing emulation

* Cargo fmt after merge conflict

* Using GuestAddr

* Compiling, running and running with artificial crash detection

* Adding dependencies for github workflow to cross compile for arm

* Fixing github workflow for ubuntu fuzzer

* arm-linux-binutils for mac in github workflows

* Qemu does not work for mac, no need to compile qemu_arm_launcher harness for it
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@andreafioraldi andreafioraldi andreafioraldi left review comments

@domenukk domenukk domenukk left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@TeumessianFox @andreafioraldi @tokatoka @domenukk