{"id":17219386,"url":"https://github.com/andreafioraldi/fuzzamos_todos_arribaaa","last_synced_at":"2025-03-25T14:42:16.009Z","repository":{"id":86885120,"uuid":"162340851","full_name":"andreafioraldi/fuzzamos_todos_arribaaa","owner":"andreafioraldi","description":"My fuzzing stuffs - don't open","archived":false,"fork":false,"pushed_at":"2018-12-19T12:40:30.000Z","size":37014,"stargazers_count":2,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-01-30T13:26:22.080Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/andreafioraldi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-12-18T20:17:39.000Z","updated_at":"2023-09-29T12:07:57.000Z","dependencies_parsed_at":"2023-06-26T23:32:03.009Z","dependency_job_id":null,"html_url":"https://github.com/andreafioraldi/fuzzamos_todos_arribaaa","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andreafioraldi%2Ffuzzamos_todos_arribaaa","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andreafioraldi%2Ffuzzamos_todos_arribaaa/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andreafioraldi%2Ffuzzamos_todos_arribaaa/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andreafioraldi%2Ffuzzamos_todos_arribaaa/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/andreafioraldi","download_url":"https://codeload.github.com/andreafioraldi/fuzzamos_todos_arribaaa/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245484766,"owners_count":20623140,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-15T03:49:45.584Z","updated_at":"2025-03-25T14:42:15.987Z","avatar_url":"https://github.com/andreafioraldi.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"# fuzzamos todos arribaaaaaaa\n\n~~~~{.sh}\ngit clone https://github.com/andreafioraldi/fuzzamos_todos_arribaaa\nmv fuzzamos_todos_arribaaa ~/fuzzamos\n~~~~\n\n## QSYM on docker\n\nSome build tricks + new arguments for run_qsym_afl.\n\n### why?\n\nAFL and docker are not good friends, so with this scripts I can run QSYM on docker (ubuntu 16.04) and AFL on the host (ubuntu 18.04).\n\n### diff\n\n`run_qsym_afl.py` now takes -Q as argument for Qemu mode and you can set `AFL_PATH` to the directory in which is afl-tmin (by default it is qsym/afl).\n\n### build\n\n~~~~{.sh}\ncd afl\nmake\ncd qemu_mode\n./build_qemu_support.sh\ncd ../../\n./qsym/build_z3.sh\necho 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope\ndocker build -t fuzzamos ./\n~~~~\n\n### usage\n\nTerminal 1:\n\n~~~~{.sh}\n/path/to/fuzzamos/prepare_sys.sh\ncd ~/directory/with/fuzzer/target/\nmkdir -p test_input\nmkdir -p test_output\n/path/to/fuzzamos/afl-fuzz -M afl-master -i ./test_input -o ./test_output -- ./fuzz_target\n~~~~\n\nTerminal 2:\n\n~~~~{.sh}\ncd ~/directory/with/fuzzer/target/\n/path/to/fuzzamos/afl-fuzz -S afl-slave -i ./test_input -o ./test_output -- ./fuzz_target\n~~~~\n\nTerminal 3:\n\n~~~~{.sh}\ncd ~/directory/with/fuzzer/target/\ndocker run --cap-add=SYS_PTRACE -v \"`pwd`:/fuzz_dir/\" -it fuzzamos /bin/bash\ncd /fuzz_dir\nrun_qsym_afl -a afl-slave -o ./test_output -n qsym -- ./fuzz_target\n~~~~\n\nFor Qemu mode add -Q to the arguments of afl-fuzz and run_qsym_afl.\n\n## initial test cases generators\n\nSome custom generators for initial test cases, sometimes using angr, sometimes not.\n\nPwntools required on python 2, angr on python 3.\n\n### concrete generator\n\n[generators/concrete_generator.py](generators/concrete_generator.py) is a script (you must have pwntools installed) that you can use to generate testcases recording your input.\n\nSimply type `generators/concrete_generator.py -i ./test_input ./fuzz_target` and interact with a spwaned process of the target binary.\nAt the end of the execution all the input that you have sent to the process is recorded in an input testcase.\n\n### angr generator\n\n[generators/angr_generator.py](generators/angr_generator.py) can be used to generate initial inputs using symbolic execution.\n\nSimply type `generators/angr_generator.py -i ./test_input ./fuzz_target` and hit control-c when you are satisfied of the number of paths in the simulation manager.\n\n### angrgdb generator\n\n[generators/angrgdb_generator.py](generators/angrgdb_generator.py) can be used to generate initial inputs using symbolic execution from a concrete process (see [angrgdb](https://github.com/andreafioraldi/angrgdb)).\n\nStart GDB with the fuzz_target and set a breakpoint in an interesting point before the input.\nThen type `source /path/to/fuzzamos/generators/angrgdb_generator.py` and insert the path to test_input.\nHit control-c when you are satisfied of the number of paths in the simulation manager.\n\n### angrgdb hybrid generator\n\n[generators/angrgdb_hybrid_generator.py](generators/angrgdb_hybrid_generator.py) is the fusion of concrete_generator.py and angrgdb_generator.py.\n\n`generators/angrgdb_hybrid_generator.py -i ./test_input -b breakpoint ./fuzz_target` to record the concrete input until breakpoint and after explore the paths with angr.\n\n## AFL fork by @abiondo\n\nMoar QEMU speed is better.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandreafioraldi%2Ffuzzamos_todos_arribaaa","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fandreafioraldi%2Ffuzzamos_todos_arribaaa","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandreafioraldi%2Ffuzzamos_todos_arribaaa/lists"}