Angora
Angora is a mutation-based coverage guided fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution.
Published Work
Arxiv: Angora: Efficient Fuzzing by Principled Search, S&P 2018.
Building Angora
Build Requirements
- Linux-amd64 (Tested on Ubuntu 16.04/18.04 and Debian Buster)
- Rust stable (>= 1.31), can be obtained using rustup
- LLVM 4.0.0 - 7.1.0 : run
PREFIX=/path-to-install ./build/install_llvm.sh.
Environment Variables
Append the following entries in the shell configuration file (~/.bashrc, ~/.zshrc).
export PATH=/path-to-clang/bin:$PATH
export LD_LIBRARY_PATH=/path-to-clang/lib:$LD_LIBRARY_PATH
Fuzzer Compilation
The build script will resolve most dependencies and setup the runtime environment.
./build/build.sh
System Configuration
As with AFL, system core dumps must be disabled.
echo core | sudo tee /proc/sys/kernel/core_pattern
Test
Test if Angora is builded successfully.
cd /path-to-angora/tests
./test.sh mini
Running Angora
Build Target Program
Angora compiles the program into two separate binaries, each with their respective instrumentation. Using autoconf programs as an example, here are the steps required.
# Use the instrumenting compilers
CC=/path/to/angora/bin/angora-clang \
CXX=/path/to/angora/bin/angora-clang++ \
LD=/path/to/angora/bin/angora-clang \
PREFIX=/path/to/target/directory \
./configure --disable-shared
# Build with taint tracking support
USE_TRACK=1 make -j
make install
# Save the compiled target binary into a new directory
# and rename it with .taint postfix, such as uniq.taint
# Build with light instrumentation support
make clean
USE_FAST=1 make -j
make install
# Save the compiled binary into the directory previously
# created and rename it with .fast postfix, such as uniq.fast
If you fail to build by this approach, try wllvm and gllvm described in Build a target program.
Also, we have implemented taint analysis with libdft64 instead of DFSan (Use libdft64 for taint tracking).
Fuzzing
./angora_fuzzer -i input -o output -t path/to/taint/program -- path/to/fast/program [argv]
For more information, please refer to the documentation under the docs/ directory.
25 Sep 11, 2022
290 Dec 24, 2022
79 Dec 24, 2022
52 Dec 25, 2022
117 Jan 06, 2023
148 Nov 30, 2022
55 Dec 05, 2022
211 Dec 25, 2022
43 Nov 07, 2022
175 Dec 30, 2022
104 Oct 26, 2022
124 Jan 04, 2023
9 Nov 18, 2022
26 Nov 24, 2022
1k Jan 06, 2023
136 Dec 28, 2022
46 Dec 12, 2022
0 Jan 20, 2022
3 Aug 08, 2021
2 Jan 20, 2022