https://github.com/RUB-SysSec/nautilus

a grammar based feedback fuzzer
https://github.com/RUB-SysSec/nautilus

Last synced: 2 months ago
JSON representation

a grammar based feedback fuzzer

• Host: GitHub
• URL: https://github.com/RUB-SysSec/nautilus
• Owner: RUB-SysSec
• License: apache-2.0
• Created: 2019-03-26T09:43:52.000Z (almost 6 years ago)
• Default Branch: master
• Last Pushed: 2023-07-01T01:00:31.000Z (over 1 year ago)
• Last Synced: 2024-08-02T12:21:43.914Z (5 months ago)
• Language: Rust
• Size: 694 KB
• Stars: 160
• Watchers: 15
• Forks: 20
• Open Issues: 4
• Metadata Files:
  • Readme: readme.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-rust-security - nautilus - grammar-based feedback fuzzer from RUB's Systems Security Lab (Vulnerability Assessment / Fuzzing)

README

        
# Nautilus

*NOTE: THIS IS AN OUTDATE REPOSITORY, THE CURRENT RELEASE IS AVAILABLE [HERE](https://github.com/nautilus-fuzz/nautilus). THIS REPO ONLY SERVES AS A REFERENCE FOR THE PAPER*



  

Nautilus is a feedback fuzzer inspired by AFL. However it allows to specify a grammar. Using this grammar, the fuzzer generates and internally uses the abstract syntax tree of the input. This also allows for very complex mutations. Then it converts the tree to the actual input.



Knowing the exact tree shape greatly improves the performance for highly structured input formats, such as many text formats and programming languages. 



 


## Setup

```bash

# set workdir path

export WORKDIR="$(pwd)/nautilus"

# checkout the git:

git clone 'https://github.com/RUB-SysSec/nautilus.git'

# clang instrument wrapper

cd "$WORKDIR/forksrv/instrument/rt"

    sudo apt-get install g++-multilib # only if needed (error 'sys/cdefs.h' file not found)

    make #might need llvm-3.8-dev

cd "$WORKDIR/forksrv/instrument/clang_wrapper"

    make

# target

git clone https://github.com/mruby/mruby.git "$WORKDIR/forksrv/instrument/mruby"

cd "$WORKDIR/forksrv/instrument/mruby"

    sudo apt install ruby bison # if needed

    CC="$WORKDIR/forksrv/instrument/clang_wrapper/redqueen-clang" LD="$WORKDIR/forksrv/instrument/clang_wrapper/redqueen-clang" make

cd "$WORKDIR"

#update paths in config.ron

mkdir -p $WORKDIR/outputs/queue # if your workdir in the config is $WORKDIR, otherwise the fuzzer will crash because the queue is not found

#fix the paths in config.ron (line 14 to 16)

cargo run -p gramophone --release --bin fuzzer 

```