Herbert Rocha

Install Crucible

Wed, 08 Jul 2020 11:48:00 +0000

Install Crucible for C Programs

This post is based on text from Crucible repository.

Crucible is a language-agnostic library for performing forward symbolic execution of imperative programs. It provides a collection of data-structures and APIs for expressing programs as control-flow graphs. Programs expressed as CFGs in this way can be automatically explored by the symbolic execution engine. In addition, new data types and operations can be added to the symbolic simulator by implementing fresh primitives directly in Haskell. Check out the GitHub at https://github.com/GaloisInc/crucible

For the next steps, we adopted a Linux docker container, aiming to keep a pattern for our commands.

Install docker, checking out this LINK
Create our container:

foo@bar:~$ docker run -it --name crucible ubuntu:18.04 /bin/bash
Unable to find image "ubuntu:18.04" locally
18.04: Pulling from library/ubuntu
423ae2b273f4: Pull complete 
de83a2304fa1: Pull complete 
f9a83bce3af0: Pull complete 
b6b53be908de: Pull complete 
...
root@a3cbc72a4874:/#

Install Crucible and fetching the dependencies. In this step, we’ll install tools, such as ghc (Haskell compiler) v8.6.5, Boost library (libboost-all-dev), Number Theory Library (libntl-dev) development files, and GNU Linear Programming Kit. Let’s go to the commands:

root@a3cbc72a4874:/# apt update
root@a3cbc72a4874:/# apt install software-properties-common -y
root@a3cbc72a4874:/# add-apt-repository ppa:hvr/ghc -y
root@a3cbc72a4874:/# apt update
root@a3cbc72a4874:/# apt install ghc-8.6.5 -y
root@a3cbc72a4874:/# ln -s /opt/ghc/bin/ghc-8.6.5 /usr/bin/ghc
root@a3cbc72a4874:/# apt install cabal-install-3.0 -y
root@a3cbc72a4874:/# ln -s /opt/cabal/bin/cabal-3.0 /bin/cabal
root@a3cbc72a4874:/# apt install git -y
root@a3cbc72a4874:/# apt install libboost-all-dev -y
root@a3cbc72a4874:/# apt install libntl-dev -y
root@a3cbc72a4874:/# apt install libglpk-dev -y
root@a3cbc72a4874:/# apt install libncurses5-dev -y
root@a3cbc72a4874:/# cd home
root@a3cbc72a4874:/# git clone https://github.com/GaloisInc/crucible.git
root@a3cbc72a4874:/# cd crucible

From the Crucible repository, we’ll get the following Haskell packages: crucible, crucible-llvm, crucible-saw, crucible-syntax, and crux. Additionally, the crux-llvm library/executable package that is a standalone frontend for executing C and C++ programs in the crucible symbolic simulator. The front-end invokes clang to produce LLVM bitcode and runs the resulting programs using the crucible-llvm language frontend.
Let’s build the Crucible packages, starting to fetch all the latest git versions of immediate dependencies of libraries in this repository:

root@a3cbc72a4874:/# ./scripts/build-sandbox.sh
...
Submodule 'abc-build' (https://github.com/GaloisInc/abc.git) registered for path 'dependencies/what4/dependencies/abcBridge/abc-build'
Cloning into '/home/crucible/dependencies/what4/dependencies/abcBridge/abc-build'...
Submodule path 'dependencies/what4/dependencies/abcBridge/abc-build': checked out 'c78ee31186ab4da49f348f1262c27c0a048bba82'
Submodule path 'dependencies/what4/dependencies/aig': checked out 'b59077c065b659e985ee25966809dd448a0d595a'
Submodule path 'dependencies/what4/dependencies/blt': checked out 'd0c8d9d14fe1bb43045ca04d6961a6290af637b7'
Submodule path 'dependencies/cryptol-verifier': checked out 'f33f4f234da9f48664f61bd9492b09259c78b60f'
Submodule path 'dependencies/jvm-parser': checked out '5368a84117dc28e0002003e8d8a491dd8756b421'

Update the Haskell packages and build the Crucible packages.

root@a3cbc72a4874:/# cabal update
root@a3cbc72a4874:/# cabal new-configure
...
crux-llvm-0.3.2 (test:crux-llvm-test) (first run)
crux-llvm-0.3.2 (exe:crux-llvm-svcomp) (first run)
crux-llvm-0.3.2 (exe:crux-llvm) (first run)
crucible-mc-0.1.0.0 (exe:crucible-mc) (first run)
cryptol-verifier-0.1 (exe:css) (first run)
cryptol-verifier-0.1 (test:cryptol-verifier-tc-test) (first run)
crucible-server-0.1 (first run)

root@a3cbc72a4874:/# cabal new-build crucible
...
[50 of 50] Compiling Lang.Crucible.Vector ( src/Lang/Crucible/Vector.hs, /home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crucible-0.5/build/Lang/Crucible/Vector.o )

root@a3cbc72a4874:/# cabal new-build crucible-llvm
...
[44 of 44] Compiling Lang.Crucible.LLVM.Ctors ( src/Lang/Crucible/LLVM/Ctors.hs, /home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crucible-llvm-0.3/build/Lang/Crucible/LLVM/Ctors.o )

root@a3cbc72a4874:/# cabal new-build crucible-saw
...
[1 of 1] Compiling Lang.Crucible.Backend.SAWCore ( src/Lang/Crucible/Backend/SAWCore.hs, /home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crucible-saw-0.1/build/Lang/Crucible/Backend/SAWCore.o )

root@a3cbc72a4874:/# cabal new-build crucible-syntax
...
[1 of 1] Compiling Main             ( crucible-syntax/Main.hs, /home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crucible-syntax-0.1/x/crucibler/build/crucibler/crucibler-tmp/Main.o )
Linking /home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crucible-syntax-0.1/x/crucibler/build/crucibler/crucibler ...

root@a3cbc72a4874:/# cabal new-build crux
...
[18 of 18] Compiling Crux             ( src/Crux.hs, /home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crux-0.1/build/Crux.o )

root@a3cbc72a4874:/# cabal new-build crux-llvm
...
[1 of 1] Compiling Main             ( svcomp/Main.hs, /home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crux-llvm-0.3.2/x/crux-llvm-svcomp/build/crux-llvm-svcomp/crux-llvm-svcomp-tmp/Main.o )
Linking /home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crux-llvm-0.3.2/x/crux-llvm/build/crux-llvm/crux-llvm ...
Linking /home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crux-llvm-0.3.2/x/crux-llvm-svcomp/build/crux-llvm-svcomp/crux-llvm-svcomp ...

It’s done.

Install LLVM v8

The LLVM tool, e.g., Clang-8 allows the Crucible to execute the C code verification.

root@a3cbc72a4874:/home/crucible# apt install -y build-essential subversion cmake ninja-build python-minimal wget
root@a3cbc72a4874:/home/crucible# echo "deb http://apt.llvm.org/xenial/ llvm-toolchain-xenial-8 main" >> /etc/apt/sources.list
root@a3cbc72a4874:/home/crucible# echo "deb-src http://apt.llvm.org/xenial/ llvm-toolchain-xenial-8 main" >> /etc/apt/sources.list
root@a3cbc72a4874:/home/crucible# wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key|apt-key add -
root@a3cbc72a4874:/home/crucible# apt update
root@a3cbc72a4874:/home/crucible# apt install aptitude -y
root@a3cbc72a4874:/home/crucible# aptitude install libllvm-8-ocaml-dev libllvm8 llvm-8 llvm-8-dev llvm-8-doc llvm-8-examples llvm-8-runtime -y
root@a3cbc72a4874:/home/crucible# aptitude install clang-8 clang-tools-8 clang-8-doc libclang-common-8-dev libclang-8-dev libclang1-8 clang-format-8 python-clang-8 -y
root@a3cbc72a4874:/home/crucible# ln -s /usr/bin/clang-8 /usr/bin/clang
root@a3cbc72a4874:/home/crucible# ln -s /usr/bin/opt-8 /usr/bin/opt
root@a3cbc72a4874:/home/crucible# ln -s /usr/bin/llvm-link-8 /usr/bin/llvm-link

Install a Solver

In this case, we’ll install Yices as an SMT solver. Further details at https://yices.csl.sri.com/

root@a3cbc72a4874:/home/crucible# add-apt-repository ppa:sri-csl/formal-methods -y
root@a3cbc72a4874:/home/crucible# apt-get update
root@a3cbc72a4874:/home/crucible# apt-get install yices2 -y

Testing Crucible LLVM

In this step we’ll adopt the following code using SV-COMP rules to check a given code:

Setting up:

root@a3cbc72a4874:/home/crucible# cd dist-newstyle/build/x86_64-linux/ghc-8.6.5/crux-llvm-0.3.2/x/crux-llvm/build/crux-llvm/
root@a3cbc72a4874:/home/crucible# cp -r /home/crucible/crux-llvm/c-src .

// test.c code
#include <stdint.h>
#include <crucible.h>

int8_t f(int8_t x) {
  return x + 1;
}

int main() {
  int8_t x = crucible_int8_t("x");

  assuming(x < 100);
  check(f(x) < 100);
  return 0;
}

Running:

root@a3cbc72a4874:/home/crucible# ./crux-llvm test.c -x
...
[CLANG] clang "-c" "-g" "-emit-llvm" "-O1" "-I" "." "-I" "c-src/includes" "-o" "test.bc" "test.c"
[Crux] Simulating function "main"
[Crux] Attempting to prove verification conditions.
[Crux] Goal status:
[Crux]   Total: 1
[Crux]   Proved: 0
[Crux]   Disproved: 1
[Crux]   Incomplete: 0
[Crux]   Unknown: 0
[Crux] Overall status: Invalid.

NOTE: The crucible.h API allows for better explanations by a) allowing user-specified names for non-deterministic variables, and b) ensuring that the conditions used in assertions are directly available and not obscured by a conditional wrapper around an error function. It’s possible you need to fix the header path, e.g., replace by "crucible.h".

Testing Crucible LLVM using SV-COMP definitions

The following example.c code has the __VERIFIER_ERROR() function the points an error location in the code. This way, the goal of the code verification is found values to reach code location.

extern void __VERIFIER_error() __attribute__((__noreturn__));
extern int __VERIFIER_nondet_int(void);

int main(){
    
  int a = __VERIFIER_nondet_int();
  int b = __VERIFIER_nondet_int();

  if( (a+b) > 42 ){
      __VERIFIER_error();
  }
  
  return 0;
}

Running:

root@a3cbc72a4874:/home/crucible# ./crux-llvm example.c -x
[CLANG] clang "-c" "-g" "-emit-llvm" "-O1" "-I" "." "-I" "c-src/includes" "-o" "example.bc" "example.c"
[Crux] Simulating function "main"
[Crux] Attempting to prove verification conditions.
[Crux] Goal status:
[Crux]   Total: 2
[Crux]   Proved: 0
[Crux]   Disproved: 2
[Crux]   Incomplete: 0
[Crux]   Unknown: 0
[Crux] Overall status: Invalid.

NOTE: In this code verification Crucible set to verification condition: overflow, and reach check. Now let’s check the report:

root@a3cbc72a4874:/home/crucible# cat results/example/report.js
var goals = [{"status": "fail","counter-example": [ {"name": "X","loc": {"file": "/home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crux-llvm-0.3.2/x/crux-llvm/build/crux-llvm/example.c","line": "6","col": "13"},"val": "BV 2147483648","bits": "32"}
, {"name": "X","loc": {"file": "/home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crux-llvm-0.3.2/x/crux-llvm/build/crux-llvm/example.c","line": "7","col": "13"},"val": "BV 2147483648","bits": "32"}
]
,"goal": "LLVM Poison value created\nSigned addition caused wrapping even though the `nsw` flag was set","location": {"file": "/home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crux-llvm-0.3.2/x/crux-llvm/build/crux-llvm/example.c","line": "9","col": "11"},"assumptions": [],"trivial": false,"path": []},{"status": "fail","counter-example": [ {"name": "X","loc": {"file": "/home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crux-llvm-0.3.2/x/crux-llvm/build/crux-llvm/example.c","line": "6","col": "13"},"val": "BV 0","bits": "32"}
, {"name": "X","loc": {"file": "/home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crux-llvm-0.3.2/x/crux-llvm/build/crux-llvm/example.c","line": "7","col": "13"},"val": "BV 1073741824","bits": "32"}
]
,"goal": "__VERIFIER_error","location": {"file": "/home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crux-llvm-0.3.2/x/crux-llvm/build/crux-llvm/example.c","line": "10","col": "9"},"assumptions": [{"loc": {"file": "/home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crux-llvm-0.3.2/x/crux-llvm/build/crux-llvm/example.c","line": "9","col": "9"}}],"trivial": false,"path": [{"loop": [1],"loc": {"file": "/home/crucible/dist-newstyle/build/x86_64-linux/ghc-8.6.5/crux-llvm-0.3.2/x/crux-llvm/build/crux-llvm/example.c","line": "9","col": "9"}}]}]

Let’s focus on the values generated to reach the line:
- “line”: “6”,”col”: “13”},”val”: “BV 0”
- “line”: “7”,”col”: “13”},”val”: “BV 1073741824”

Aiming to get a better way to visualize you should see the files at path results/example/

Goal 1 to check, possible overflow

Goal 2 to check, reach check

Project Flutter A to Z

Mon, 27 Apr 2020 18:00:00 +0000

Project Flutter A to Z

Keep Watching

I’ve been writing some APPs examples using Flutter CI/CD adopting GitHub actions. The steps of the main flow of the project are:

Adopting GitHub as version control from the source code project, thus each commit on branch master is analyzed using flutter analyze
Running the tests, including widget tests and unit testing
The results of the tests are then sent to CodeCov (https://codecov.io/) service to analyze the code coverage
All previously items are done, then the App APK is built in the GitHub repository generating the draft release
Finally, adopting the GitHub actions, the App is deployed in the GitHub pages using Flutter Web

Checking out the project: https://github.com/hbgit/flutter_a_z

Install and Setting up Flutter Devel

Wed, 01 Apr 2020 19:18:00 +0000

Installing Flutter to write APPs on Linux

Do you know how to use flutter on Linux?

If your answer is I don’t, no problem. More details about Flutter at https://flutter.dev
In the future, I’ll present some examples, but for now, let’s set up our devel environment on Linux
In this post we’ll learn how to install all basic requirements to write your APPs using Flutter on Linux, this include:
- Install Flutter SDK
- Install Android SDK
- How to use sdkmanager tool to install Android platforms-tools
- Setting up Visual Code to Flutter and Dart that is the programming language

STEP 0: Install Flutter

Install flutter from the website, in this case, go to https://flutter.dev/docs/get-started/install/linux , there you find all system requirements, e.g., disk space 600 MB, but personally I rather 2 GB, this because of the additional libraries and IDE. Thus, let’s start.
Create a directory to save the files to install Flutter:

foo@bar:~$ mkdir ~/development
foo@bar:~$ cd ~/development
foo@bar:development/$ wget https://storage.googleapis.com/flutter_infra/releases/stable/linux/flutter_linux_v1.12.13+hotfix.7-stable.tar.xz 
foo@bar:development/$ tar xf flutter_linux_v1.12.13+hotfix.9-stable.tar.xz
# In this point we have
foo@bar:development/$ ls
flutter

Update your path

You can update your PATH variable for the current session at the command line, but You’ll probably want to update this variable permanently, so you can run flutter commands in any terminal session, this way try:

Determine the directory where you placed the Flutter SDK

foo@bar:development/$ cd flutter
foo@bar:development/flutter/$ pwd
/home/foo/development/flutter/

Open (or create) the rc file for your shell. For example, Linux uses the Bash shell by default, so edit $HOME/.bashrc. If you are using a different shell, the file path and filename will be different on your machine.

Add the following line in your $HOME/.bashrc:

export PATH="$PATH:/home/foo/development/flutter/bin"

NOTE: the PATH /home/foo/development/flutter/ should be replaced by your path, so in this case foo is your Linux user.

Run source $HOME/. to refresh the current window or open a new terminal window to automatically source the file.
Verify that the flutter/bin directory is now in your PATH by running:

foo@bar:~$ cd ~/development
foo@bar:development/$ echo $PATH
# Verify that the flutter command is available by running:
foo@bar:development/$ which flutter

If every it’s OKAY, let’s try some commands with Flutter SDK:

foo@bar:~$ cd ~/development
foo@bar:development/$ flutter precache
foo@bar:development/$ flutter doctor
[-] Android toolchain - develop for Android devices
    • Android SDK at /Users/obiwan/Library/Android/sdk
    ✗ Android SDK is missing command line tools; download from https://goo.gl/XxQghQ
    • Try re-installing or updating your Android SDK,
      visit https://flutter.dev/setup/#android-setup for detailed instructions.

Run the last command to see if there are any dependencies you need to install to complete the setup (for verbose output, add the -v flag).

STEP 1: Install JAVA

In case you have Java already installed on your computer, I would suggest you jump to the next step, in other cases let’s install Java 8.
Why Java 8, the new java version, e.g., 10 and 11 has some issues with Flutter checkout https://github.com/flutter/flutter/issues/25811

Install on Ubuntu:

foo@bar:development/$ sudo apt install openjdk-8-jdk

Install on Fedora:

# JRE
foo@bar:development/$ sudo dnf install java-1.8.0-openjdk
# JDK
foo@bar:development/$ sudo dnf install java-1.8.0-openjdk-devel

Managing Java

In case, you have other java versions installed, in another way you can jump to the next step. You can configure which version is the default for use on the command line by using the update-alternatives command.

foo@bar:development/$ sudo update-alternatives --config java

You can do this for other Java commands, such as the compiler (javac):

foo@bar:development/$ sudo update-alternatives --config javac

STEP 2: Install Android SDK

One easy way to install the Android SDK is to install Android Studio, see https://developer.android.com/studio , but in this post, our focus is to adopt the Visual Code to write our Flutter APPs.
Therefore, we choose to install only the Android SDK, this way you can go to https://developer.android.com/studio in the section Command line tools only and get the Linux version. Unfortunately, we have noted some issues with the latest versions. This way, adopt a specific version of the Android SDK from Google repo:

# NOTE: at this moment, we are inside the development directory
foo@bar:development/$ wget https://dl.google.com/android/repository/sdk-tools-linux-4333796.zip
foo@bar:development/$ unzip sdk-tools-linux-4333796.zip 
foo@bar:development/$ cd tools/bin/ 
foo@bar:development/tools/bin/$ 

Now we’ll install some tools to run our Flutter APPs on Android, e.g., the emulator, OS version and libraries. Thus, we’ll use the sdkmanager tool. This step can take a little time according to your internet speed.

foo@bar:development/tools/bin/$ ./sdkmanager "tools" "build-tools;29.0.3" "emulator" "platform-tools" "platforms;android-29" "system-images;android-29;google_apis_playstore;x86_64"

NOTE: At this moment, it’s possible to get some issues to break the Android SDK installation, one example of common issues and solution, you can try and repeat the install:

No space left on device, details at https://bytefreaks.net/applications/android-studio-no-space-left-on-device , SOLUTION:

foo@bar:development/tools/bin/$ sudo mount -o remount,size=8G,noatime /tmp;

OPTIONAL: This is optional, but highly recommended, to confirm all licenses from Android SDK.

foo@bar:development/tools/bin/$ ./sdkmanager --licenses

Install Android Debug Bridge (adb)

Android Debug Bridge (adb) is a versatile command-line tool that lets you communicate with a device. The adb command facilitates a variety of device actions, such as installing and debugging apps, and it provides access to a Unix shell that you can use to run a variety of commands on a device. More details at https://developer.android.com/studio/command-line/adb
Install on Ubuntu:

foo@bar:development/tools/bin/$ sudo apt-get install android-tools-adb 

Install on Fedora:

foo@bar:development/tools/bin/$ sudo dnf install adb 

STEP 3: Update your path with the Android SDK

Add the following line in your $HOME/.bashrc:

ANDROID_HOME=/home/foo/development/tools

export PATH=$PATH:$ANDROID_HOME:$ANDROID_HOME:$ANDROID_HOME/tools/bin:$ANDROID_HOME/platform-tools

Now to check if Flutter see Android SDK

foo@bar:development/tools/bin/$ flutter doctor -v

STEP 4: Install Flutter plugin on Visual Code

Opening Visual Code and go to “Extensions” or Ctrl+Shift+X, then in Search look for Flutter and click and install, as follows:

Install Dart plugin on VS still in “Extensions” on Visual Code, for Dart and click and install, as follows:

We are all ready to write our Flutter APPs using Visual Code on Linux

STEP 5: Create a Hello World APP in Flutter

In the future, I’ll explain in detail the code but for now, we focus on how to run a Flutter APP in our devel environment.
Let’s create a directory (inside development) to organize our APP

foo@bar:development/tools/bin/$ cd ../../
foo@bar:development/$ mkdir hello_app 
foo@bar:development/$ cd hello_app
foo@bar:development/$ flutter create .
Creating project .... androidx: true
  android/build.gradle (created)
  android/app/build.gradle (created)
  android/app/src/main/kotlin/com/example/hello_app/MainActivity.kt (created)
  android/hello_app_android.iml (created)
  lib/main.dart (created)
  ...
  ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata (created)
  .metadata (created)
  hello_app.iml (created)
Running "flutter pub get" in hello_app...                           4.0s
Wrote 77 files.
...

In order to run your application, type:

  $ cd .
  $ flutter run

Your application code is in ./lib/main.dart.

Opening the source code in the Visual Code, you need to go in the menu File -> Open Folder

That’s all folks.

Using AFL and libFuzzer

Wed, 11 Mar 2020 16:36:00 +0000

Using AFL and libFuzzer

This post is based on text from f-secure blog.

The tools for bug hunting have been adopted fuzzing as a very effective technique. In this text, we keep our focus on tools such as American Fuzzy Lop (AFL), LLVM libFuzzer.

Using AFL

For the next steps, we adopted a Linux docker container, aiming to keep a pattern for our commands.

Install docker, checking out this LINK
Create our container:

foo@bar:~$ docker run -it --name afl ubuntu:18.04 /bin/bash
Unable to find image "ubuntu:18.04" locally
18.04: Pulling from library/ubuntu
423ae2b273f4: Pull complete 
de83a2304fa1: Pull complete 
f9a83bce3af0: Pull complete 
b6b53be908de: Pull complete 
...
root@a3cbc72a4874:/#

Install AFL and get the source code of libxml2-utils

root@a3cbc72a4874:/# apt-get update
root@a3cbc72a4874:/# apt-get install -y afl
root@a3cbc72a4874:/# cd home
root@a3cbc72a4874:/# cp /etc/apt/sources.list /etc/apt/sources.list.bkp
root@a3cbc72a4874:/# sed -Ei "s/^# deb-src /deb-src /" /etc/apt/sources.list
root@a3cbc72a4874:/# apt-get update
root@a3cbc72a4874:/# apt-get source libxml2-utils

We configure libxml2 build to use AFL compilers and compile the xmllint utility

root@a3cbc72a4874:/# apt-get install build-essential -y
root@a3cbc72a4874:/# apt-get install automake -y
root@a3cbc72a4874:/# apt-get install zlib1g-dev -y
root@a3cbc72a4874:/# apt-get install pkg-config -y
root@a3cbc72a4874:/# apt-get install libtool -y
root@a3cbc72a4874:/# cd libxml2-2.9.4+dfsg1/
root@a3cbc72a4874:/# ./configure CC=afl-gcc CXX=afl-g++
# in case of error, try run ./autogen.sh
root@a3cbc72a4874:/# make xmllint
...
afl-as 2.52b by <lcamtuf@google.com>
[+] Instrumented 18 locations (64-bit, non-hardened mode, ratio 100%).
CC       schematron.lo
afl-cc 2.52b by <lcamtuf@google.com>
afl-as 2.52b by <lcamtuf@google.com>
[+] Instrumented 566 locations (64-bit, non-hardened mode, ratio 100%).
CC       xzlib.lo
afl-cc 2.52b by <lcamtuf@google.com>
afl-as 2.52b by <lcamtuf@google.com>
[!] WARNING: No instrumentation targets found.
CCLD     libxml2.la
afl-cc 2.52b by <lcamtuf@google.com>
ar: `u' modifier ignored since `D' is the default (see `U')
CCLD     xmllint
afl-cc 2.52b by <lcamtuf@google.com>

Now we create a sample file (to run AFL fuzzing) with content <a></a> for AFL to start with and run the afl-fuzz.

root@a3cbc72a4874:/# mkdir in
root@a3cbc72a4874:/# echo "<a></a>" > in/sample
# some flag to skip erros to run afl in docker, more details at https://github.com/mirrorer/afl/blob/master/docs/env_variables.txt
root@a3cbc72a4874:/# export AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
root@a3cbc72a4874:/# export AFL_SKIP_CPUFREQ=1
root@a3cbc72a4874:/# LD_LIBRARY_PATH=./.libs/ afl-fuzz -i ./in -o ./out -- ./.libs/xmllint -o /dev/null @@

AFL will continue fuzzing indefinitely, writing inputs that trigger new code coverage in ./out/queue/, crash triggering inputs in ./out/crashes/ and inputs causing hangs in /out/hangs/. For more information on how to interpret the AFL’s status screen, see: http://lcamtuf.coredump.cx/afl/status_screen.txt

Fuzzing with LLVM libFuzzer

Let’s now adopting LLVM libFuzzer. To start fuzzing, you’ll first need to introduce a target function, LLVMFuzzerTestOneInput, that receives the fuzzed input buffer from libFuzzer. The LibFuzzer implementation works by creating a custom entry point, which contains an array of bytes (of uint8_t). The code looks like this.

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 DoSomethingInterestingWithMyAPI(Data, Size);
 return 0; // Non-zero return values are reserved for future use.
}

For fuzzing libxml2, Google’s fuzzer test suite provides a good example fuzzing function.

// Copyright 2016 Google Inc. All Rights Reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
#include <string>
#include <vector>
#include "libxml/xmlversion.h"
#include "libxml/parser.h"
#include "libxml/HTMLparser.h"
#include "libxml/tree.h"

void ignore (void * ctx, const char * msg, ...) {}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 xmlSetGenericErrorFunc(NULL, &ignore);
 if (auto doc = xmlReadMemory(reinterpret_cast(data), size, "noname.xml", NULL, 0))
 xmlFreeDoc(doc);
 return 0;
}

We make our work simple, we adopt the code from GitHub repo. This way, we start from the last step with AFL

root@a3cbc72a4874:/home/libxml2-2.9.4+dfsg1# cd ..
root@a3cbc72a4874:/home# apt-get install git -y
root@a3cbc72a4874:/home# git clone https://github.com/GNOME/libxml2 libxml2
root@a3cbc72a4874:/home# cd libxml2

Recent versions of Clang (starting from 6.0) include libFuzzer, and no extra installation is necessary.
In order to build your fuzzer binary, use the -fsanitize=fuzzer flag during the compilation and linking. In most cases, you may want to combine libFuzzer with AddressSanitizer (ASAN), UndefinedBehaviorSanitizer (UBSAN), or both. You can also build with MemorySanitizer (MSAN), but support is experimental:

root@a3cbc72a4874:/home/libxml2# apt-get install clang-6.0 -y
# dependece of libxml2
root@a3cbc72a4874:/home/libxml2# apt-get install python-dev -y 

Setting up FLAGS to build libxml2. Here you could explore different kinds of coverage-guided (using, clang coverage), which tries to maximize the code coverage of a program. For example, the inline-8bit-counters option from LLVM (SanitizerCoverage) for code coverage instrumentation built-in, where the compiler will insert inline counter that should be incremented on every edge.

root@a3cbc72a4874:/home/libxml2# export CXXFLAGS="-fsanitize=address,undefined -fsanitize-coverage=edge,indirect-calls,trace-pc-guard,trace-cmp"
root@a3cbc72a4874:/home/libxml2# export CXX="clang++-6.0"
root@a3cbc72a4874:/home/libxml2# export CFLAGS="-fsanitize=address,undefined -fsanitize-coverage=edge,indirect-calls,trace-pc-guard,trace-cmp"
root@a3cbc72a4874:/home/libxml2# export CC="clang-6.0"
root@a3cbc72a4874:/home/libxml2# export LDFLAGS="-fsanitize=address,undefined -fsanitize-coverage=edge,indirect-calls,trace-pc-guard,trace-cmp"

Building LIBXML2

root@a3cbc72a4874:/home/libxml2# ./autogen.sh
root@a3cbc72a4874:/home/libxml2# make

Now we need to write the libfuzz test, then we adopt from Google’s fuzzer test suite.

root@a3cbc72a4874:/home/libxml2# apt-get install wget -y
root@a3cbc72a4874:/home/libxml2# wget https://raw.githubusercontent.com/google/fuzzer-test-suite/master/libxml2-v2.9.2/target.cc
root@a3cbc72a4874:/home/libxml2# $CXX $CXXFLAGS -std=c++11 target.cc -Iinclude -L.libs -lxml2 -fsanitize=fuzzer -o libxml-fuzzer

Now we are ready to run our fuzzer.

root@a3cbc72a4874:/home/libxml2# mkdir ./output
root@a3cbc72a4874:/home/libxml2# ./libxml-fuzzer ./output/

All inputs that trigger new coverage are stored as sample files in ./output. As libFuzzer runs in-process, if a bug is found, it saves the test case and exits. For more information on how to interpret the output to see: http://llvm.org/docs/LibFuzzer.html#output

Welcome!

Mon, 11 Feb 2019 16:36:00 +0000

Hello, I am Herbert Oliveira Rocha.

Currently, I am a professor in the Departament of Computer Science at Federal University of Roraima. My research focuses on the development of automated verification and software testing techniques for software systems. In particular, I am interested in the verification and testing of the critical embedded systems.

INTERESTS IN COMPUTING:

Software Quality
Verification and Validation of Software
Testing Software
Model Checking
Embedded Systems
Operating Systems
Open-Source
Programming Languages
Regular Expressions
Web Systems, and
Design and Art