Setup
# set workdir path
export WORKDIR="$(pwd)/nautilus"
# checkout the git:
git clone 'https://github.com/RUB-SysSec/nautilus.git'
# clang instrument wrapper
cd "$WORKDIR/forksrv/instrument/rt"
sudo apt-get install g++-multilib # only if needed (error 'sys/cdefs.h' file not found)
make #might need llvm-3.8-dev
cd "$WORKDIR/forksrv/instrument/clang_wrapper"
make
# target
git clone https://github.com/mruby/mruby.git "$WORKDIR/forksrv/instrument/mruby"
cd "$WORKDIR/forksrv/instrument/mruby"
sudo apt install ruby bison # if needed
CC="$WORKDIR/forksrv/instrument/clang_wrapper/redqueen-clang" LD="$WORKDIR/forksrv/instrument/clang_wrapper/redqueen-clang" make
cd "$WORKDIR"
#update paths in config.ron
mkdir $WORKDIR/outputs/queue # if your workdir in the config is $WORKDIR, otherwise the fuzzer will crash because the queue is not found
cargo run -p gramophone --release --bin fuzzer
Project Structure
Git
All dependencies are added as git submodule
.
These are just git repos referenced in the parent repo.
Commits made in submodules must be pushed as they are referenced in the parent repository.
The following commands will automatically include submodules in pull / push operations:
Pull
git pull --recurse-submodules
Push
git push --recurse-submodules=on-demand
Cargo
The cargo file in the parent repository contains a workspace with all sub-projects.
You can simply add -p $PROJECT
to run cargo
within the selected project.
Example
cargo build --release # will build all projects
cargo -p gramophone build --release # will build only gramophone (and dependencies)
Run the fuzzer
cd "$WORKDIR"
git clean -xdf outputs/
cargo build --release
python scripts/local_snapshotter.py outputs $HOME/tmp/gfsnapshots cargo -p gramophone run --release --bin fuzzer -- forksrv/instrument/mruby/bin/mruby antlr_parser/src/ruby_new_antlr_grammar.json
Coverage
cd "$WORKDIR/forksrv/instrument"
git clone -b mruby-cov https://redmine.trust.cased.de/git/gramfuzz mruby-cov
cd mruby-cov
make CFLAGS='--coverage' LDFLAGS='--coverage'
cd "$WORKDIR"
git clone https://github.com/mrash/afl-cov.git
# wait a few hours/days
./snapshot_process_mruby.sh $HOME/tmp/gfsnapshots
AFL
cd "$WORKDIR/forksrv/instrument/mruby"
git worktree add ../mruby-afl
cd ../mruby-afl
make CC=/usr/local/bin/afl-clang CFLAGS='-fPIC'
cd "$WORKDIR"
python scripts/local_snapshotter.py ~/tmp/aflout ~/tmp/aflsnapshots afl/run_afl.sh
# wait a few hours/days
./snapshot_process_mruby.sh $HOME/tmp/aflsnapshots
Coverage diff
python "$WORKDIR/scripts/lcov_diff.py" $HOME/tmp/aflsnapshots/$timestamp/cov/lcov/trace.lcov_info_final $HOME/tmp/gfsnapshots/$timestamp/cov/lcov/trace.lcov_info_final tmp
genhtml --no-function-coverage --no-branch-coverage --output-directory $outputdir tmp
ASan
cd "$WORKDIR/forksrv/instrument/mruby"
git worktree add ../mruby-asan
cd ../mruby-asan
make CC="$WORKDIR/forksrv/instrument/clang_wrapper/redqueen-clang" LD="$WORKDIR/forksrv/instrument/clang_wrapper/redqueen-clang" CFLAGS='-fsanitize=address' LDFLAGS='-fsanitize=address'
git worktree add ../mruby-asan-afl
cd ../mruby-asan-afl
make CC=/usr/local/bin/afl-clang CFLAGS='-fsanitize=address' LDFLAGS='-fsanitize=address'
make CC=/usr/local/bin/afl-clang CFLAGS='-fsanitize=address' LDFLAGS='-fsanitize=address' CFLAGS='-fPIC'
Convert ANTLR to JSON
cd "$WORKDIR"
cargo run -p antlr_parser antlr_parser/src/ruby_antlr.g4 output.json