New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
aflplusplus: init at 2.59c #76645
aflplusplus: init at 2.59c #76645
Conversation
As noted in #76762, I should be able to enable unicorn mode, but only after unicorn 1.0.2 is released and makes it to nixpkgs. |
7c3186a
to
1f7fe69
Compare
Added wine support for i686 builds (default off - huge closure addition). @GrahamcOfBorg build aflplusplus |
1f7fe69
to
fbc11b4
Compare
Rebased, added @GrahamcOfBorg build aflplusplus |
# nix's cc wrapper | ||
rm $out/bin/afl-clang-fast++ | ||
cp $out/bin/afl-clang-fast $out/bin/afl-clang-fast++ | ||
for x in $out/bin/afl-clang-fast $out/bin/afl-clang-fast++; do |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For 2.64c the wrapping doesn't seem to be needed anymore, as far as I've seen.
This issue resolves it: AFLplusplus/AFLplusplus#316
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Oh that's cool.
# first though we need to replace the afl-clang-fast++ symlink with | ||
# a real copy to prevent wrapProgram skipping the symlink and confusing | ||
# nix's cc wrapper | ||
rm $out/bin/afl-clang-fast++ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
And consequently, if there's no need for wrapping anymore, there's no need for this hack either.
AFLplusplus/AFLplusplus#318, I made a PR to AFLplusplus to fail instead of silently starting CC in that case as well :)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice
--run 'export AFL_CC=''${AFL_CC:-${clang}/bin/clang} AFL_CXX=''${AFL_CXX:-${clang}/bin/clang++}' | ||
done | ||
# do similar for afl-gcc and afl-gcc-fast | ||
for x in $out/bin/afl-gcc $out/bin/afl-gcc-fast; do |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Did you check if afl-gcc works without wrapping? I thought it did.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think I wouldn't have added it if I didn't find it necessary - perhaps it's not needed for 2.64 though?
@@ -585,6 +585,12 @@ in | |||
stdenv = clangStdenv; | |||
}; | |||
|
|||
aflplusplus = callPackage ../tools/security/aflplusplus { | |||
stdenv = clangStdenv; | |||
python = python37; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why pin to 3.7? Is there a reason for that?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm having to do a bit of archaeology to figure this out, but the readme for the python mutator at the time made specific mention of python 3.7: https://github.com/AFLplusplus/AFLplusplus/blob/939721e2cbcf14f0f9577575c09e16be2ced25fe/python_mutators/README#L4 so I must have assumed some version sensitivity.
@Mindavi these are all good suggestions - if you test this package as it is, and it works for you, I'll merge this and then review your additions and bump to 2.64c (also add yourself as co-maintainer!). I'd like to get this merged first because I've been using it solidly for months and know it's solid. |
Sounds good! I'll test this out as soon as I have time, and then I hope it's good to go. I understand you'd like a well tested version, the new release is just fresh. |
Builds fine on my machine. Just started a testrun, but I'm not expecting much issues. One issue though, it seems like afl-clang++ is not wrapped correctly (try compiling a C++ binary, it will error with missing headers). Not sure about afl-clang, but it probably falls back (as shown earlier in the PR I made against aflplusplus) to the C compiler. Just started a run and aflplusplus seems to run stable with a binary compiled with afl-clang-fast++. So if that wrapping issue is fixed, I think this can be merged. |
Oh - that's exactly the issue which my "copy, don't link" change was supposed to fix. What's happening is the nix cc wrapper isn't detecting that it should run in c++ mode and so isn't including the cpp stdlib (I never experienced the crash you mentioned in AFLplusplus/AFLplusplus#316). I have found that c++ projects are harder to build with afl than c ones, especially ones that use a mix of c/c++. What method of setting the compiler were you using when you tried this? An example of how I successfully afl-compiled a nix c++ package was adding the lines
to the |
Probably related to the patch shown in AFLplusplus/AFLplusplus#318. It's not actually the nix cc wrapper as far as I can tell, rather aflplusplus that silently falls back to the clang c compiler. I guess you missed adding the trick for the afl-clang++ compiler. My test case is simple: #include <new>
#include <iostream>
int main() {
std::cout << "Hi!\n";
return 0;
} Compiled with FYI: afl-clang-fast++ works correctly |
Oh, sorry, yes, I wasn't reading properly. |
Ok, I don't seem to be able to fix it in the same way for some reason. Let's sort it out in the 2.64 bump. |
Motivation for this change
https://github.com/vanhauser-thc/AFLplusplus
AFL++ is a heavily enhanced version of AFL, incorporating many features and improvements from the community.
Package is based on the original AFL packaging, but I've tried to enable many of the optional extras.
cc @thoughtpolice
Things done
sandbox
innix.conf
on non-NixOS linux)nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
./result/bin/
)nix path-info -S
before and after)