afl-persistent-config Linux support + documentation
MODIFY
GNUmakefile
GNUmakefile
@@ -32,7 +32,7 @@ VERSION = $(shell grep '^$(HASH)define VERSION ' ../config.h | cut -d '"' -f
# PROGS intentionally omit afl-as, which gets installed elsewhere.
PROGS = afl-fuzz afl-showmap afl-tmin afl-gotcpu afl-analyze
-SH_PROGS = afl-plot afl-cmin afl-cmin.bash afl-whatsup afl-system-config
+SH_PROGS = afl-plot afl-cmin afl-cmin.bash afl-whatsup afl-system-config afl-persistent-config
MANPAGES=$(foreach p, $(PROGS) $(SH_PROGS), $(p).8) afl-as.8
ASAN_OPTIONS=detect_leaks=0

MODIFY
README.md
README.md
@@ -623,6 +623,13 @@ system for optimal speed - which afl-fuzz checks and bails otherwise.
Set `export AFL_SKIP_CPUFREQ=1` for afl-fuzz to skip this check if you cannot
run afl-system-config with root privileges on the host for whatever reason.
+Note there is also `sudo afl-persistent-config` which sets additional permanent
+boot options for a much better fuzzing performance.
+
+Note that both scripts improve your fuzzing performance but also decrease your
+system protection against attacks! So set strong firewall rules and only
+expose SSH as a network service if you use these (which is highly recommended).
+
If you have an input corpus from step 2 then specify this directory with the `-i`
option. Otherwise create a new directory and create a file with any content
as test data in there.

MODIFY
afl-persistent-config
afl-persistent-config
# written by jhertz
#
-PLATFORM=`uname -s`
-
+test "$1" = "-h" -o "$1" = "-hh" && {
+ echo 'afl-persistent-config'
+ echo
+ echo $0
+ echo
+ echo afl-persistent-config has no command line options
+ echo
+ echo afl-persistent-config permanently reconfigures the system to a high performance fuzzing state.
+ echo "WARNING: this reduces the security of the system!"
+ echo
+ echo Note that there is also afl-system-config which sets additional runtime
+ echo configuration options.
+ exit 0
+}
-# check that we're on Mac
-if [[ ! "$PLATFORM" = "Darwin" ]] ; then
- echo "This script is for Mac OS"
+echo
+echo "WARNING: This scripts makes permanent configuration changes to the system to"
+echo " increase the performance for fuzzing. As a result, the system also"
+echo " becomes less secure against attacks! If you use this script, setup"
+echo " strong firewall rules and only make SSH available as a network"
+echo " service!"
+echo
+echo -n "Type \"YES\" to continue: "
+read ANSWER
+if [[ "$ANSWER" != "YES" ]]; then
+ echo Input was not YES, aborting ...
exit 1
fi
+echo
+PLATFORM=`uname -s`
+
+# check that we're on Mac
+if [[ "$PLATFORM" = "Darwin" ]] ; then
+
# check if UID == 0
-if [[ $EUID -ne 0 ]]; then
- echo "You really should be root to do this"
+ if [[ "$EUID" -ne 0 ]]; then
+ echo "You need to be root to do this. E.g. use \"sudo\""
exit 1
fi
# check if SIP is disabled
if [[ ! $(csrutil status | grep "disabled") ]]; then
- echo "SIP needs to be disabled"
+ echo "SIP needs to be disabled. Restart and press Command-R at reboot, Utilities => Terminal => enter \"csrutil disable\""
exit 1
fi
-echo "Okay cool, checks passed"
+ echo "Checks passed."
-echo "Installing plist"
+ echo "Installing /Library/LaunchDaemons/shm_setup.plist"
cat << EOF > /Library/LaunchDaemons/shm_setup.plist
<?xml version="1.0" encoding="UTF-8"?>
@@ -55,5 +81,52 @@ cat << EOF > /Library/LaunchDaemons/shm_setup.plist
</plist>
EOF
+ echo
echo "Reboot and enjoy your fuzzing"
+ exit 0
+fi
+
+if [[ "$PLATFORM" = "Linux" ]] ; then
+ # check if UID == 0
+ if [[ "$EUID" -ne 0 ]]; then
+ echo "You need to be root to do this. E.g. use \"sudo\""
+ exit 1
+ fi
+
+ echo "Checks passed."
+
+ test -d /etc/sysctl.d || echo Error: /etc/sysctl.d directory not found, cannot install shmem config
+ test -d /etc/sysctl.d -a '!' -e /etc/sysctl.d/99-fuzzing && {
+ echo "Installing /etc/sysctl.d/99-fuzzing"
+ cat << EOF > /etc/sysctl.d/99-fuzzing
+kernel.core_uses_pid=0
+kernel.core_pattern=core
+kernel.randomize_va_space=0
+kernel.sched_child_runs_first=1
+kernel.sched_autogroup_enabled=1
+kernel.sched_migration_cost_ns=50000000
+kernel.sched_latency_ns=250000000
+EOF
+ }
+
+ egrep -q '^GRUB_CMDLINE_LINUX_DEFAULT=' /etc/default/grub 2>/dev/null || echo Error: /etc/default/grub with GRUB_CMDLINE_LINUX_DEFAULT is not present, cannot set boot options
+ egrep -q '^GRUB_CMDLINE_LINUX_DEFAULT=' /etc/default/grub 2>/dev/null && {
+ egrep '^GRUB_CMDLINE_LINUX_DEFAULT=' /etc/default/grub | egrep -q hardened_usercopy=off || {
+ echo "Configuring performance boot options"
+ LINE=`egrep '^GRUB_CMDLINE_LINUX_DEFAULT=' /etc/default/grub | sed 's/^GRUB_CMDLINE_LINUX_DEFAULT=//' | tr -d '"'`
+ OPTIONS="$LINE ibpb=off ibrs=off kpti=off l1tf=off mds=off mitigations=off no_stf_barrier noibpb noibrs nopcid nopti nospec_store_bypass_disable nospectre_v1 nospectre_v2 pcid=off pti=off spec_store_bypass_disable=off spectre_v2=off stf_barrier=off srbds=off noexec=off noexec32=off tsx=on tsx=on tsx_async_abort=off mitigations=off audit=0 hardened_usercopy=off ssbd=force-off"
+ echo Setting boot options in /etc/default/grub to GRUB_CMDLINE_LINUX_DEFAULT=\"$OPTIONS\"
+ sed -i "s|^GRUB_CMDLINE_LINUX_DEFAULT=.*|GRUB_CMDLINE_LINUX_DEFAULT=\"$OPTIONS\"|" /etc/default/grub
+ }
+ }
+
+ echo
+ echo "Reboot and enjoy your fuzzing"
+ exit 0
+fi
+
+
+
+echo "Error: Unknown platform \"$PLATFORM\", currently supported are Linux and MacOS."
+exit 1

MODIFY
afl-system-config
afl-system-config
@@ -6,10 +6,12 @@ test "$1" = "-h" -o "$1" = "-hh" && {
echo
echo afl-system-config has no command line options
echo
- echo afl-system reconfigures the system to a high performance fuzzing state
+ echo afl-system-config reconfigures the system to a high performance fuzzing state.
echo "WARNING: this reduces the security of the system!"
echo
- exit 1
+ echo Note that there is also afl-persistent-config which sets additional permanent
+ echo configuration options.
+ exit 0
}
DONE=

MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -13,6 +13,9 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
custom_mutators
- added optimin, a faster and better corpus minimizer by
Adrian Herrera. Thank you!
+ - added afl-persistent-config script to set perform permanent system
+ configuration setting for fuzzing, for Linux and Macos.
+ thanks to jhertz!
### Version ++3.14c (release)

MODIFY
docs/perf_tips.md
docs/perf_tips.md
@@ -170,6 +170,7 @@ spectre_v2=off stf_barrier=off
```
In most Linux distributions you can put this into a `/etc/default/grub`
variable.
+ You can use `sudo afl-persistent-config` to set these options for you.
The following list of changes are made when executing `afl-system-config`:

afl-persistent-config Linux support + documentation