modify build.sh and add document
ADD
qbdi_mode/README.md
+# qbdi-based binary-only instrumentation for afl-fuzz
+
+## 1) Introduction
+
+The code in ./qbdi_mode allows you to build a standalone feature that
+using the QBDI framework to fuzz android native library.
+
+
+## 2) Build
+
+First download the Android NDK
+
+```
+https://developer.android.com/ndk/downloads
+https://dl.google.com/android/repository/android-ndk-r20-linux-x86_64.zip
+```
+
+Then unzip it and build the standalone-toolchain
+For x86_64 standalone-toolchain
+
+```
+unzip android-ndk-r20-linux-x86_64.zip
+cd android-ndk-r20/
+./build/tools/make_standalone_toolchain.py --arch x86_64 --api 21 --install-dir ../android-standalone-toolchain-x86_64
+```
+
+For x86 standalone-toolchain
+
+```
+./build/tools/make_standalone_toolchain.py --arch x86 --api 21 --install-dir ../android-standalone-toolchain-x86
+```
+
+Then download the QBDI SDK from website
+
+```
+https://qbdi.quarkslab.com/
+```
+
+For Android x86_64
+```
+https://github.com/QBDI/QBDI/releases/download/v0.7.0/QBDI-0.7.0-android-X86_64.tar.gz
+```
+
+Then decompress the sdk
+
+```
+mkdir android-qbdi-sdk-x86_64
+cp QBDI-0.7.0-android-X86_64.tar.gz android-qbdi-sdk-x86_64/
+cd android-qbdi-sdk-x86_64/
+tar xvf QBDI-0.7.0-android-X86_64.tar.gz
+```
+
+Now set the `STANDALONE_TOOLCHAIN_PATH` to the path of standalone-toolchain
+
+```
+export STANDALONE_TOOLCHAIN_PATH=/home/hac425/workspace/android-standalone-toolchain-x86_64
+```
+
+set the `QBDI_SDK_PATH` to the path of QBDI SDK
+
+```
+export QBDI_SDK_PATH=/home/hac425/workspace/AFLplusplus/qbdi_mode/android-qbdi-sdk-x86_64/
+```
+
+Then run the build.sh
+
+```
+./build.sh x86_64
+```
+
+this could build the afl-fuzz and also the qbdi template for android x86_64
+
+
+### Example
+
+The demo-so.c is an vulnerable library, it has a function for test
+
+```
+int target_func(char *buf, int size)
+{
+ printf("buffer:%p, size:%p\n", buf, size);
+ switch (buf[0])
+ {
+ case 1:
+ puts("222");
+ if (buf[1] == '\x44')
+ {
+ puts("null ptr deference");
+ *(char *)(0) = 1;
+ }
+ break;
+ case 0xff:
+ if (buf[2] == '\xff')
+ {
+ if (buf[1] == '\x44')
+ {
+ puts("crash....");
+ *(char *)(0xdeadbeef) = 1;
+ }
+ }
+ break;
+ default:
+ puts("default action");
+ break;
+ }
+
+ return 1;
+}
+```
+
+This could be build to `libdemo.so`.
+
+Then we should load the library in template.cpp and find the `target` function address.
+```
+ void *handle = dlopen(lib_path, RTLD_LAZY);
+ ..........................................
+ ..........................................
+ ..........................................
+ p_target_func = (target_func)dlsym(handle, "target_func");
+```
+
+then we read the data from file and call the function in `fuzz_func`
+
+```
+QBDI_NOINLINE int fuzz_func()
+{
+ // afl forkserver stuff
+ if (afl_setup())
+ {
+ afl_forkserver();
+ }
+
+ // read the data from file(argv[2])
+ unsigned long len = 0;
+ char *data = read_file(FPATH, &len);
+
+
+ printf("In fuzz_func\n");
+
+ // call the target function with input data.
+ p_target_func(data, len);
+ return 1;
+}
+```
+
+Just compile it
+```
+./build.sh x86_64
+```
+
+Then push the `afl-fuzz`, `loader`, `libdemo.so`, the `libQBDI.so` from the QBDI SDK and the `libc++_shared.so` from android-standalone-toolchain to android device
+
+```
+adb push afl-fuzz /data/local/tmp
+adb push libdemo.so /data/local/tmp
+adb push loader /data/local/tmp
+adb push android-qbdi-sdk-x86_64/usr/local/lib/libQBDI.so /data/local/tmp
+adb push ../../android-standalone-toolchain-x86_64/sysroot/usr/lib/x86_64-linux-android/libc++_shared.so
+/data/local/tmp
+```
+
+In android adb shell, we could try to run the loader
+```
+export LD_LIBRARY_PATH=/data/local/tmp
+./loader /data/local/tmp/libdemo.so init
+```
+the normal output like
+
+```
+# ./loader /data/local/tmp/libdemo.so init p_target_func:0x7b41ac26e600
+In fuzz_func
+ offset:0x600
+ offset:0x580
+buffer:0x7b41abe2b050, size:0x4
+ offset:0x628
+ offset:0x646
+ offset:0x64b
+ offset:0x65c
+ offset:0x6df
+ offset:0x590
+default action
+ offset:0x6eb
+```
+
+now run `afl-fuzz` to fuzz the library
+
+```
+mkdir in
+echo xxxx > in/1
+./afl-fuzz -i in -o out -- ./loader /data/local/tmp/libdemo.so @@
+```
+
+the snapshot
+
+![image-20191114222336674](assets/image-20191114222336674.png)
+
+good job.
\ No newline at end of file

MODIFY
qbdi_mode/build.sh
qbdi_mode/build.sh
-compiler_prefix="/home/hac425/workspace/android-standalone-toolchain-21-x86/bin/i686-linux-android-"
-CFLAGS="-Iusr/local/include/ -Lusr/local/lib/"
+if [ -z ${STANDALONE_TOOLCHAIN_PATH} ]; then
+ echo "please set the android-standalone-toolchain path in STANDALONE_TOOLCHAIN_PATH environmental variable"
+ echo "for example: "
+ echo " export STANDALONE_TOOLCHAIN_PATH=/home/android-standalone-toolchain-21/"
+ exit
+fi
-# for x86-64 android
-# compiler_prefix="/home/hac425/workspace/android-standalone-toolchain-21/bin/x86_64-linux-android-"
-# CFLAGS="-Iandroid-x64/usr/local/include/ -Landroid-x64/usr/local/lib/"
+if [ -z ${QBDI_SDK_PATH} ]; then
+ echo "please set the qbdi sdk path in QBDI_SDK_PATH environmental variable"
+ echo "for example: "
+ echo " export QBDI_SDK_PATH=/home/QBDI-Android/"
+ exit
+fi
+
+
+if [ "$1" = "x86" ]; then
+ echo "build x86 qbdi"
+ compiler_prefix="${STANDALONE_TOOLCHAIN_PATH}/bin/i686-linux-android-"
+elif [ "$1" = "x86_64" ]; then
+ echo "build x86_64 qbdi"
+ compiler_prefix="${STANDALONE_TOOLCHAIN_PATH}/bin/x86_64-linux-android-"
+else
+ echo "usage: ./build.sh arch[x86, x86_64]"
+ exit
+fi
+
+
+CFLAGS="-I${QBDI_SDK_PATH}/usr/local/include/ -L${QBDI_SDK_PATH}/usr/local/lib/"
+
+# build the qbdi template
${compiler_prefix}g++ -o loader template.cpp -lQBDI -ldl -w -g ${CFLAGS}
+
+# build the demo share library
${compiler_prefix}gcc -shared -o libdemo.so demo-so.c -w -g
+# build afl-fuzz
cd ..
${compiler_prefix}gcc -O3 -funroll-loops -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -I include/ -DAFL_PATH=\"/usr/local/lib/afl\" -DBIN_PATH=\"/usr/local/bin\" -DDOC_PATH=\"/usr/local/share/doc/afl\" -Wno-unused-function src/afl-fuzz-misc.c src/afl-fuzz-extras.c src/afl-fuzz-queue.c src/afl-fuzz-one.c src/afl-fuzz-python.c src/afl-fuzz-stats.c src/afl-fuzz-init.c src/afl-fuzz.c src/afl-fuzz-bitmap.c src/afl-fuzz-run.c src/afl-fuzz-globals.c src/afl-common.c src/afl-sharedmem.c src/afl-forkserver.c -o qbdi_mode/afl-fuzz -ldl -w

MODIFY
qbdi_mode/demo-so.c
qbdi_mode/demo-so.c
#include <stdio.h>
-
-
// gcc -shared -o libdemo.so demo-so.c -w
-
-
-int target_func(char* buf, int size){
-
+int target_func(char *buf, int size)
+{
printf("buffer:%p, size:%p\n", buf, size);
-
switch (buf[0])
{
case 1:
puts("222");
- if(buf[1]=='\x44'){
- puts("aaaaaaaaaaaaaaaaaaaaa");
+ if (buf[1] == '\x44')
+ {
+ puts("null ptr deference");
*(char *)(0) = 1;
}
break;
- case '\xfe':
- // assert(0);
- if(buf[4]=='\xf0'){
- puts("xxxiiii");
- }
- break;
case 0xff:
- if(buf[2]=='\xff'){
- if(buf[1]=='\x44'){
+ if (buf[2] == '\xff')
+ {
+ if (buf[1] == '\x44')
+ {
+ puts("crash....");
*(char *)(0xdeadbeef) = 1;
- }else{
- puts("kkkkkk");
}
}
- puts("xxxx");
break;
default:
- puts("xxxxxxx");
+ puts("default action");
break;
}
return 1;
}
-
-
-

MODIFY
qbdi_mode/template.cpp
qbdi_mode/template.cpp
#include <sys/shm.h>
#include "../config.h"
-
-
-
#include <QBDI.h>
using namespace QBDI;
@@ -38,13 +35,14 @@ unsigned char *afl_area_ptr = NULL; /* Exported for afl_gen_trace */
unsigned long afl_prev_loc = 0;
-
/* Set up SHM region and initialize other stuff. */
-int afl_setup(void) {
+int afl_setup(void)
+{
char *id_str = getenv(SHM_ENV_VAR);
int shm_id;
- if (id_str) {
+ if (id_str)
+ {
shm_id = atoi(id_str);
afl_area_ptr = (unsigned char *)shmat(shm_id, NULL, 0);
if (afl_area_ptr == (void *)-1)
@@ -54,7 +52,6 @@ int afl_setup(void) {
return 1;
}
-
/* Fork server logic, invoked once we hit _start. */
static void afl_forkserver()
{
@@ -74,7 +71,6 @@ static void afl_forkserver()
if (read(FORKSRV_FD, &was_killed, 4) != 4)
exit(2);
-
child_pid = fork();
if (child_pid < 0)
exit(4);
@@ -101,15 +97,18 @@ static void afl_forkserver()
}
}
-void afl_maybe_log(unsigned long cur_loc) {
- if(afl_area_ptr == NULL){
+void afl_maybe_log(unsigned long cur_loc)
+{
+ if (afl_area_ptr == NULL)
+ {
return;
}
unsigned long afl_idx = cur_loc ^ afl_prev_loc;
afl_area_ptr[afl_idx % MAP_SIZE]++;
afl_prev_loc = cur_loc >> 1;
}
-char* read_file(char* path, unsigned long* length) {
+char *read_file(char *path, unsigned long *length)
+{
FILE *pFile = fopen(path, "rb");
char *pBuf;
fseek(pFile, 0, SEEK_END);
@@ -127,7 +126,8 @@ char FPATH[200];
QBDI_NOINLINE int fuzz_func()
{
- if(afl_setup()){
+ if (afl_setup())
+ {
afl_forkserver();
}
@@ -139,12 +139,8 @@ QBDI_NOINLINE int fuzz_func()
return 1;
}
-
-
-
-
-
-static QBDI::VMAction bbcallback(QBDI::VMInstanceRef vm, const QBDI::VMState *state, QBDI::GPRState *gprState, QBDI::FPRState *fprState, void *data) {
+static QBDI::VMAction bbcallback(QBDI::VMInstanceRef vm, const QBDI::VMState *state, QBDI::GPRState *gprState, QBDI::FPRState *fprState, void *data)
+{
// errno = SAVED_ERRNO;
#ifdef __x86_64__
@@ -155,7 +151,9 @@ static QBDI::VMAction bbcallback(QBDI::VMInstanceRef vm, const QBDI::VMState *st
unsigned long pc = gprState->pc;
#endif
- if(pc >= module_base && pc <= module_end){
+ // just log the module path
+ if (pc >= module_base && pc <= module_end)
+ {
unsigned long offset = pc - module_base;
printf("\toffset:%p\n", offset);
afl_maybe_log(offset);
@@ -166,6 +164,12 @@ static QBDI::VMAction bbcallback(QBDI::VMInstanceRef vm, const QBDI::VMState *st
int main(int argc, char **argv)
{
+ if (argc < 3)
+ {
+ puts("usage: ./loader library_path input_file_path");
+ exit(0);
+ }
+
const char *lib_path;
lib_path = argv[1];
// FPATH = argv[2];
@@ -183,7 +187,7 @@ int main(int argc, char **argv)
lib_name = strrchr(lib_name, '/') + 1;
// printf("library name:%s\n", lib_name);
-
+ // load library module address for log path
for (MemoryMap &map : getCurrentProcessMaps())
{
// printf("module:%s\n", map.name.c_str());
@@ -212,10 +216,8 @@ int main(int argc, char **argv)
vm.addInstrumentedModuleFromAddr(module_base);
vm.addInstrumentedModuleFromAddr((rword)&main);
-
vm.addVMEventCB(BASIC_BLOCK_ENTRY, bbcallback, nullptr);
-
// QBDI::simulateCall(state, FAKE_RET_ADDR);
// vm.run((rword)&fuzz_func, (rword)FAKE_RET_ADDR);

modify build.sh and add document