Hi everyone,
I am currently trying to add a fuzzer to Genode in order to fuzz different sessions. Fuzzers come in many different flavours, but it is generally most efficient to instrument the existing source code. Further the fuzzer needs to support GCC. So AFL++ seemed like a good candidate. It is widely used, has many optimizations/features and comes with built in GCC support. In order for the fuzzer to work properly, the code to be tested needs to be instrumented with custom gcc/g++ compilers.
There is one challenge I am stuck at, which lead to this forum post.
TL;DR:
When compiling with custom compilers and running core
, the needed memory (stack, bss…) never gets assigned. Core
then tries to write to the unassigned memory and thus crashes.
In more detail:
Currently core
is being built and run like this:
make core CUSTOM_CC=/path/to/afl-gcc-fast CUSTOM_CXX=/path/to/afl-g++-fast
./core/linux/core-linux
This leads to an error Segmentation fault (core dumped)
.
After executing the binary in gdb
we get a bit more information. Here _start
refers to the program entry-point:
Starting program: /home/g-user/code/genode/build/x86_64/core/linux/core-linux
Program received signal SIGSEGV, Segmentation fault.
_start () at /home/g-user/code/genode/repos/base/src/lib/startup/spec/x86_64/crt0.s:61
/* init_rtld relocates the linker */
61 call init_rtld
Upon further investigation it turns out that call init_rtld
tries to write to the memory region .bss
but the stack and memory has never been assigned any memory, as seen in the process information (/proc/<id>/maps
). The write therefore leads to a crash.
Additional information:
- Genode is being run and a Linux x86 Debian VM.
- The compiler requires many
libc
functionalities. In order to have a successful build, I created my own implementation that is not completely finished. This is then statically linked to the custom compilers. This should probably not matter, as the execution crashes so early.
Exactly pin-pointing the issue is quite difficult as I’m fairly new to Genode. My current best guess is, that the problem lies with the linker. Maybe the AFL compiler does not link to the correct functionality that core needs.
Does anyone have any ideas or hunches how to solve this problem?
Cheers and thanks for your time