{"id":21270077,"url":"https://github.com/ant4g0nist/manufuzzer","last_synced_at":"2025-04-05T05:07:15.684Z","repository":{"id":48590823,"uuid":"381453538","full_name":"ant4g0nist/ManuFuzzer","owner":"ant4g0nist","description":"Binary code-coverage fuzzer for macOS, based on libFuzzer and LLVM","archived":false,"fork":false,"pushed_at":"2024-11-06T07:21:01.000Z","size":417,"stargazers_count":147,"open_issues_count":1,"forks_count":17,"subscribers_count":7,"default_branch":"main","last_synced_at":"2025-03-29T04:08:45.425Z","etag":null,"topics":["apple","fuzzing","libfuzzer","llvm-mc","macos"],"latest_commit_sha":null,"homepage":"","language":"Objective-C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ant4g0nist.png","metadata":{"files":{"readme":"Readme.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-06-29T17:59:34.000Z","updated_at":"2025-02-03T01:58:43.000Z","dependencies_parsed_at":"2022-09-04T10:32:06.537Z","dependency_job_id":null,"html_url":"https://github.com/ant4g0nist/ManuFuzzer","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ant4g0nist%2FManuFuzzer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ant4g0nist%2FManuFuzzer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ant4g0nist%2FManuFuzzer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ant4g0nist%2FManuFuzzer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ant4g0nist","download_url":"https://codeload.github.com/ant4g0nist/ManuFuzzer/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247289428,"owners_count":20914464,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apple","fuzzing","libfuzzer","llvm-mc","macos"],"created_at":"2024-11-21T08:15:16.827Z","updated_at":"2025-04-05T05:07:15.650Z","avatar_url":"https://github.com/ant4g0nist.png","language":"Objective-C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ManuFuzzer\nBinary code-coverage fuzzer for macOS, based on libFuzzer and LLVM\n\n[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/ant4g0nist/ManuFuzzer/pulls)\n[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/ant4g0nist/ManuFuzzer/blob/main/LICENSE)\n[![Follow Twitter](https://img.shields.io/twitter/follow/ant4g0nist?style=social)](https://twitter.com/ant4g0nist)\n\n\n## What is ManuFuzzer?\nManuFuzzer is an LLVM-based binary, coverage-guided fuzzing framework similar. It is simple to integrate coverage-guided fuzzing with ManuFuzzer: just define a special function, update some build flags, and you have instant binary-only, coverage-guided fuzzing (only basic-block coverage). Using ManuFuzzer, you can instrument one or more selected frameworks for coverage and fuzz the target functions/library.\n\n## How ManuFuzzer works?\nManuFuzzer makes use of custom breakpoint handler. When you select a module to instrument, ManuFuzzer replaces the branch instructions with breakpoint instruction at each and every basic-block by disassembling the module runtime using LLVM MC and stores the original bytes in a shadow memory mapping, whose address is fixed and can be computed from any address of the modified library and executes the program. Everytime any breakpoint gets hit, ManuFuzzer updates the coverage for the basic-block using custom breakpoint handler setup for SIGTRAP, deletes the breakpoint and resumes execution.\n\n## How to build ManuFuzzer?\nManuFuzzer is dependent on LLVM MC for disassembly and LLVM libFuzzer for fuzzing. ManuFuzzer patches LLVM-MC to increase the speed and evaluate an instruction type. ManuFuzzer pulls LLVM version 12.0.1-rc3 from https://github.com/llvm/llvm-project and applies llvm_ManuFuzzer.patch to LLVM MC and libFuzzer.\n\n```sh\n➜ git clone https://github.com/ant4g0nist/ManuFuzzer\n```\n\nTo compile with debug logs:\n```sh\n➜ cd ManuFuzzer\n➜ make\n➜ make install\n```\n\nTo compile without debug logs, pass FUZZ=1 in env:\n```sh\n➜ cd ManuFuzzer\n➜ FUZZ=1 make\n➜ make install\n```\n\n## How to use ManuFuzzer?\nFor examples, let's try fuzzing CGFontCreateWithDataProvider function from CoreGraphics. This seems to be an easy target to reach.\n\nManuFuzzer exports 4 functions we need to use in our harness.\n\n```C\nvoid installHandlers(void);\nvoid libFuzzerCleanUp(void);\nint instrumentMe(const char * module);\nint libFuzzerStart(int argc, char **argv, UserCallback LLVMFuzzerTestOneInput);\n```\n\n- `instrumentMe(const char * module)` function is used to instrument a target module. \n- `installHandlers` function installs the breakpoint handler required by ManuFuzzer to handle breakpoints.\n- `libFuzzerStart` is the main entry point to libFuzzer that takes argc, argv and a function `LLVMFuzzerTestOneInput` with signature `LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)`\n- `libFuzzerCleanUp` just cleans up the mallocs.\n\nThese functions can be used in our harness as shown here:\n\n```CPP\n#include \u003cstring.h\u003e\n#include \u003cunistd.h\u003e\n#include \u003cdlfcn.h\u003e\n#import \u003cFoundation/Foundation.h\u003e\n#import \u003cCoreGraphics/CoreGraphics.h\u003e\n\n#include \"libManuFuzzer.h\"\n\nextern uint16_t previousLoc;\n\nvoid LLVMFuzzerInitialize(int *argc, char ***argv) {\n    installHandlers();\n\n    instrumentMe(\"/System/Library/Frameworks/ImageIO.framework/Versions/A/ImageIO\");\n    instrumentMe(\"/System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics\");\n    instrumentMe(\"/System/Library/Frameworks/CoreText.framework/Versions/A/CoreText\");\n    instrumentMe(\"/System/Library/PrivateFrameworks/FontServices.framework/libFontParser.dylib\");\n}\n\nint LLVMFuzzerTestOneInput(const uint8_t *fuzz_buff, size_t size)\n{\n    previousLoc = 0;\n\n    NSData *inData = [[NSData alloc] initWithBytes:fuzz_buff length:size];\n    CFErrorRef error;\n    \n    CGDataProviderRef provider = CGDataProviderCreateWithCFData((__bridge CFDataRef)inData);\n    \n    CGFontRef font = CGFontCreateWithDataProvider(provider);\n    \n    if (font)\n        CFRelease(font);\n \n    CFRelease(provider);\n\n    [inData release];\n\n    return 0;\n}\n\nint main(int argc, char* argv[])\n{\n    LLVMFuzzerInitialize(\u0026argc, \u0026argv);\n    libFuzzerStart(argc, argv, LLVMFuzzerTestOneInput);\n    libFuzzerCleanUp();\n\n    return 0;\n}\n```\n\nMakefile to compile above sample code:\n```make\nexample.o: examples/main.mm\n\tSDKROOT=$(SDKROOT) $(CXX) -c -o bin/$@ examples/main.mm\n\t\nexample: example.o\n\tSDKROOT=$(SDKROOT) $(CXX) $(FUZZ_EXAMPLE_CFLAGS) ./bin/example.o -o bin/example\n\trm bin/*.o\n```\n\nTo compile the example:\n```sh\n➜ make example\n```\n\n## Demo\n![](demo.gif)\n\n\n## TODO\n- [x] replace Capstone with LLVM MC\n- [x] make support for macOS on M1 public\n- [ ] make support for macOS on Intel public\n- [ ] clean the setup\n- [ ] test, test and tesssttt\n- [ ] fuzz, fuzzzz and more fuzzzzz\n\n## Trophies\nlet me know if you have found any vulnerabilities using this and will add it here :)\n\n## Thanks 🙌🏻🙌🏻\n- [@r3dsm0k3](https://twitter.com/r3dsm0k3) \n- [Samuel Groß](https://twitter.com/5aelo)\n- [Madhu](https://twitter.com/madhuakula)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fant4g0nist%2Fmanufuzzer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fant4g0nist%2Fmanufuzzer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fant4g0nist%2Fmanufuzzer/lists"}