Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/vanhauser-thc/afl-pin

run AFL with pintool
https://github.com/vanhauser-thc/afl-pin

afl afl-fuzz afl-fuzzer binary-instrument fuzzer fuzzing pin pintool thc

Last synced: about 2 months ago
JSON representation

run AFL with pintool

Awesome Lists containing this project

README

        

Intro
=====
This is the fastest pintool afl-fuzzer out there currently.
And it runs with pintool 3.6 up to 3.11, so 4.x x64 kernels are fine.
But ... pintool is super slow.
So this is basically only if you have no other option.
I am currently developing an alternative with DynamoRIO and is 10x faster -
but still, afl qemu mode is 10-50x faster than that ...

Installation
============
1. download, compile and install afl => https://github.com/vanhauser-thc/AFLplusplus
Optional: 2. download, compile and install dyninst => https://github.com/dyninst/dyninst
Optional: 3. download, compile and install afl-dyninst => https://github.com/vanhauser-thc/afl-dyninst
4. download and unpack pin => https://software.intel.com/en-us/articles/pintool-downloads (download version 3.6 to 3.11)
5. export PIN_ROOT=/path/to/pin directory
6. make a symlink to the afl folder in the afl-pin directory named "afl" , e.g. "ln -s ../AFLplusplus afl"
7. make
8. make install

Options
=======
-libs also instrument the dynamic libraries
-exitpoint target exit the program when this address/function is reached. speeeed!
-forkserver install a forkserver. You must set PIN_APP_LD_PRELOAD - or use afl-fuzz-pin.sh
-entrypoint target function or address where you want to install the forkserver
-alternative a little bit faster but less quality

How to run
==========
Optional: 1. afl-dyninst.sh -i program -o program_instrumented -D
It is a good idea to add -e and -E with well selected function addresses to
make the fuzzing faster

2. afl-fuzz-pin.sh [normal afl-fuzz options]
If you did not do step 1, add the option -forkserver (-forkserver is faster
than afl-dyninst). You can increase speed more by selecting a good
"-entrypoint function_name" or "-entrypoing 0x123456" location.
That's it! If you fuzzing does not run, afl-fuzz might need more memory, set
AFL_MEM to a high value, e.g. 700 for 700MB
Using -forkserver requires
PIN_APP_LD_PRELOAD=/usr/local/lib/pintool/forkserver.so
but afl-fuzz-pin.sh takes care of this.

When to use it
==============
When you have no source code, normal afl-dyninst is crashing the binary,
qemu mode -Q is not an option and dynamorio is not working either.
Pin is even 90% slower than my dynamorio implementation ...

Limitations
===========
Pin is super slow ... it is the tool of last resort on x86/x64.

Who and where
=============
Marc "van Hauser" Heuse ||
https://github.com/vanhauser-thc/afl-pin