TriforceNetBSDSyscallFuzzer

TriforceAFL is a modified version of AFL that supports fuzzing using QEMU's full system emulation. TriforceNetBSDSyscallFuzzer will be a syscall fuzzer for NetBSD built on top of TriforceAFL.

Building the target

On the NetBSD box , enter the Fuzzer directory and run make. You should also build input files from this directory

    ./genInputs

Building a test image

To build a test image, begin by performing a install of the operating system using qemu. We start by making a disk image in qemu and installing NetBSD on it. We will do the minimal installation using iso-image built for amd64.

After this we will use another NetBSD box where we have the built fuzzer and generated inputs Using this box we make the qemu image suitable for running system call tests.

This can be done using the following commands:

$ su
# vnconfig vnd0 disk.bin
# mount /dev/vnd0a /mnt
# cp $FUZZER/driver /mnt/bin
# cp $FUZZER/inputs/ex1 /mnt/etc
# cat > /mnt/etc/boot.conf <<_EOF_
stty com0 115200
set tty com0
_EOF_
# cat >/mnt/etc/rc <<_EOF_
#
# minimal initialization and then invoke fuzzer driver
# never return / never invoke getty/login.
#

echo "running rc!"
export TERM=vt220
export PATH=/sbin:/bin:/usr/sbin:/usr/bin
mount -u -o rw /

echo warm JIT cache
/bin/driver -tv </etc/ex1

echo start testing
/bin/driver -v
#/bin/testPrivmem
#/bin/testPanic
#/bin/sh -i

echo "exiting"
/sbin/shutdown -p now
_EOF_
# umount /mnt
# vnconfig -u vnd0

This configures the system to boot with a serial console, and to run the driver during the boot process (after making sure the root partition is writable). After preparing the disk image, we downloaded it to our fuzzing host and executed it with runFuzz

The runFuzz attaches the disk.bin as our primary drive and boots from it. It then uses testAfl to run through the inputs from inputs/ex?.

Preparing the Host and Fuzzing

We run the fuzzer on a NetBSD host. On the fuzzer host, install TriforceAFL from pkgsrc(wip/triforceafl). Copy the disk*.bin and kernel image / debugging symbols netbsd.gdb to the $FUZZER directory:

    cp disk.bin $FUZZER/
    cp netbsd.gdb $FUZZER/
    make

Since we are using an older version of QEMU, we need to disable mprotect while fuzzing:

    sysctl -w security.pax.mprotect.enabled=0

Start fuzzing using ./runFuzz -M -M0