diff options
Diffstat (limited to 'fuzz/README.md')
| -rw-r--r-- | fuzz/README.md | 56 |
1 files changed, 0 insertions, 56 deletions
diff --git a/fuzz/README.md b/fuzz/README.md deleted file mode 100644 index 53f4b93..0000000 --- a/fuzz/README.md +++ /dev/null | |||
| @@ -1,56 +0,0 @@ | |||
| 1 | # fuzz testing | ||
| 2 | |||
| 3 | This repository contains a binary used for fuzz testing. | ||
| 4 | |||
| 5 | # Acknowledgments | ||
| 6 | |||
| 7 | The fuzz setup with AFL++ comes from [Ryan Liptak's](https://www.ryanliptak.com/blog/fuzzing-zig-code/) blog post. See [this example repo](https://github.com/squeek502/zig-fuzzing-example) too. | ||
| 8 | |||
| 9 | # Prerequisites | ||
| 10 | |||
| 11 | To build the fuzz binary we need the `afl-clang-lto` binary in the system path. | ||
| 12 | The recommended way to get that is to [install AFL++](https://github.com/AFLplusplus/AFLplusplus/blob/stable/docs/INSTALL.md). | ||
| 13 | |||
| 14 | If you don't want to install it system-wide you can also do this instead: | ||
| 15 | ``` | ||
| 16 | make PREFIX=$HOME/local install | ||
| 17 | ``` | ||
| 18 | then make sure that `$HOME/local/bin` is in your system path. | ||
| 19 | |||
| 20 | If you installed LLVM from source as described in the [Zig wiki](https://github.com/ziglang/zig/wiki/How-to-build-LLVM,-libclang,-and-liblld-from-source#posix), do this instead: | ||
| 21 | ``` | ||
| 22 | LLVM_CONFIG=$HOME/local/llvm15-release/bin/llvm-config make PREFIX=$HOME/local install | ||
| 23 | ``` | ||
| 24 | |||
| 25 | # Build and run | ||
| 26 | |||
| 27 | Once AFL++ is installed, build the fuzz binary: | ||
| 28 | ``` | ||
| 29 | $ zig build fuzz | ||
| 30 | ``` | ||
| 31 | |||
| 32 | Finally to run the fuzzer do this: | ||
| 33 | ``` | ||
| 34 | $ afl-fuzz -i - -o fuzz/outputs -- ./zig-out/bin/fuzz | ||
| 35 | ``` | ||
| 36 | |||
| 37 | Note that `afl-fuzz` might complain about core dumps being sent to an external utility (usually systemd). | ||
| 38 | |||
| 39 | You'll have to do this as root: | ||
| 40 | ``` | ||
| 41 | # echo core > /proc/sys/kernel/core_pattern | ||
| 42 | ``` | ||
| 43 | |||
| 44 | `afl-fuzz` might also complain about the scaling governor, setting `AFL_SKIP_CPUFREQ` as suggested is good enough: | ||
| 45 | ``` | ||
| 46 | $ AFL_SKIP_CPUFREQ=1 afl-fuzz -i - -o fuzz/outputs -- ./zig-out/bin/fuzz | ||
| 47 | ``` | ||
| 48 | |||
| 49 | # Debugging a crash | ||
| 50 | |||
| 51 | If `afl-fuzz` finds a crash it will be added to `fuzz/outputs/default/crashes.XYZ`. | ||
| 52 | |||
| 53 | To debug the crash you can run the fuzz binary and giving it the content of the crash via stdin, for example: | ||
| 54 | ``` | ||
| 55 | $ ./zig-out/bin/fuzz < 'fuzz/outputs/default/crashes.2021-12-31-12:43:12/id:000000,sig:06,src:000004,time:210548,execs:1011599,op:havoc,rep:2' | ||
| 56 | ``` | ||