heruix / nautilus

a grammar based feedback fuzzer

Setup

# set workdir path
export WORKDIR="$(pwd)/nautilus"

# checkout the git:
git clone 'https://github.com/RUB-SysSec/nautilus.git'

# clang instrument wrapper
cd "$WORKDIR/forksrv/instrument/rt"
    sudo apt-get install g++-multilib # only if needed (error 'sys/cdefs.h' file not found)
    make #might need llvm-3.8-dev
cd "$WORKDIR/forksrv/instrument/clang_wrapper"
    make

# target
git clone https://github.com/mruby/mruby.git "$WORKDIR/forksrv/instrument/mruby"
cd "$WORKDIR/forksrv/instrument/mruby"
    sudo apt install ruby bison # if needed
    CC="$WORKDIR/forksrv/instrument/clang_wrapper/redqueen-clang" LD="$WORKDIR/forksrv/instrument/clang_wrapper/redqueen-clang" make
cd "$WORKDIR"
#update paths in config.ron
mkdir $WORKDIR/outputs/queue # if your workdir in the config is $WORKDIR, otherwise the fuzzer will crash because the queue is not found
		cargo run -p gramophone --release --bin fuzzer 

Project Structure

Git

All dependencies are added as git submodule.
These are just git repos referenced in the parent repo.
Commits made in submodules must be pushed as they are referenced in the parent repository.

The following commands will automatically include submodules in pull / push operations:

Pull

git pull --recurse-submodules

Push

git push --recurse-submodules=on-demand

Cargo

The cargo file in the parent repository contains a workspace with all sub-projects.
You can simply add -p $PROJECT to run cargo within the selected project.

Example

cargo build --release # will build all projects
cargo -p gramophone build --release # will build only gramophone (and dependencies)

Run the fuzzer

cd "$WORKDIR"
git clean -xdf outputs/
cargo build --release
python scripts/local_snapshotter.py outputs $HOME/tmp/gfsnapshots cargo -p gramophone run --release --bin fuzzer -- forksrv/instrument/mruby/bin/mruby antlr_parser/src/ruby_new_antlr_grammar.json

Coverage

cd "$WORKDIR/forksrv/instrument"
git clone -b mruby-cov https://redmine.trust.cased.de/git/gramfuzz mruby-cov
cd mruby-cov
make CFLAGS='--coverage' LDFLAGS='--coverage'

cd "$WORKDIR"
git clone https://github.com/mrash/afl-cov.git

# wait a few hours/days

./snapshot_process_mruby.sh $HOME/tmp/gfsnapshots

AFL

cd "$WORKDIR/forksrv/instrument/mruby"
git worktree add ../mruby-afl
cd ../mruby-afl
make CC=/usr/local/bin/afl-clang CFLAGS='-fPIC'

cd "$WORKDIR"
python scripts/local_snapshotter.py ~/tmp/aflout ~/tmp/aflsnapshots afl/run_afl.sh


# wait a few hours/days

./snapshot_process_mruby.sh $HOME/tmp/aflsnapshots

Coverage diff

python "$WORKDIR/scripts/lcov_diff.py" $HOME/tmp/aflsnapshots/$timestamp/cov/lcov/trace.lcov_info_final $HOME/tmp/gfsnapshots/$timestamp/cov/lcov/trace.lcov_info_final tmp
genhtml --no-function-coverage --no-branch-coverage --output-directory $outputdir tmp

ASan

cd "$WORKDIR/forksrv/instrument/mruby"
git worktree add ../mruby-asan
cd ../mruby-asan
make CC="$WORKDIR/forksrv/instrument/clang_wrapper/redqueen-clang" LD="$WORKDIR/forksrv/instrument/clang_wrapper/redqueen-clang" CFLAGS='-fsanitize=address' LDFLAGS='-fsanitize=address'

git worktree add ../mruby-asan-afl
cd ../mruby-asan-afl
make CC=/usr/local/bin/afl-clang CFLAGS='-fsanitize=address' LDFLAGS='-fsanitize=address'
make CC=/usr/local/bin/afl-clang CFLAGS='-fsanitize=address' LDFLAGS='-fsanitize=address' CFLAGS='-fPIC'

Convert ANTLR to JSON

cd "$WORKDIR"
cargo run -p antlr_parser antlr_parser/src/ruby_antlr.g4 output.json