Skip to content

fuzzing_with_afl++.md

Latest commit

 

History

History
85 lines (67 loc) · 2.15 KB

fuzzing_with_afl++.md

File metadata and controls

85 lines (67 loc) · 2.15 KB

Fuzzing with AFL++ to Target CVE-2019-2215

AFL++ is a powerful fuzzing tool that can be used as an alternative or complement to Syzkaller for targeting specific kernel subsystems like the binder.

1. Install AFL++

For Debian/Ubuntu-based distributions:

sudo apt-get update
sudo apt-get install -y build-essential python3-dev automake cmake git flex bison libglib2.0-dev libpixman-1-dev python3-setuptools
git clone https://github.com/AFLplusplus/AFLplusplus.git
cd AFLplusplus
make all
sudo make install

For Fedora/RHEL/CentOS:

sudo dnf install -y gcc gcc-c++ git clang python3-devel glib2-devel pixman-devel
git clone https://github.com/AFLplusplus/AFLplusplus.git
cd AFLplusplus
make all
sudo make install

For Arch Linux:

sudo pacman -S gcc make git clang python glib2 pixman
git clone https://github.com/AFLplusplus/AFLplusplus.git
cd AFLplusplus
make all
sudo make install

For openSUSE:

sudo zypper install -y gcc gcc-c++ git clang python3-devel glib2-devel libpixman-1-0-devel
git clone https://github.com/AFLplusplus/AFLplusplus.git
cd AFLplusplus
make all
sudo make install

2. Compile the Harness with AFL++ Instrumentation

cd ~/android-kernel-exploitation-lab/fuzzer
afl-clang-fast -o binder_fuzzer binder_fuzzer.c

3. Create Initial Input Corpus

mkdir -p ~/android-kernel-exploitation-lab/afl_input
cd ~/android-kernel-exploitation-lab/

# Create a simple seed file
echo -ne "\x00\x00\x00\x00\x00\x00\x00\x00" > afl_input/seed1

# Create a more targeted seed file for binder operations
cat > afl_input/seed2 << EOF
\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00
EOF

4. Start the emulator with your custom kernel:

emulator -avd CVE-2019-2215 -kernel ~/android-kernel-exploitation-lab/android-kernel/out/kasan/dist/bzImage -no-snapshot -show-kernel

5. Push the fuzzer to the device:

adb push binder_fuzzer /data/local/tmp/
adb shell chmod 755 /data/local/tmp/binder_fuzzer

6. Run AFL++ with the wrapper

afl-fuzz -i afl_input -o afl_output -n -- fuzzer/fuzzer_wrapper.sh @@