Angora
Angora is a mutation-based coverage guided fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution.
Published Work
Arxiv: Angora: Efficient Fuzzing by Principled Search, S&P 2018.
Building Angora
Build Requirements
- Linux-amd64 (Tested on Ubuntu 16.04/18.04 and Debian Buster)
- Rust stable (>= 1.31), can be obtained using rustup
- LLVM 4.0.0 - 7.1.0 : run
PREFIX=/path-to-install ./build/install_llvm.sh.
Environment Variables
Append the following entries in the shell configuration file (~/.bashrc, ~/.zshrc).
export PATH=/path-to-clang/bin:$PATH
export LD_LIBRARY_PATH=/path-to-clang/lib:$LD_LIBRARY_PATH
Fuzzer Compilation
The build script will resolve most dependencies and setup the runtime environment.
./build/build.sh
System Configuration
As with AFL, system core dumps must be disabled.
echo core | sudo tee /proc/sys/kernel/core_pattern
Test
Test if Angora is builded successfully.
cd /path-to-angora/tests
./test.sh mini
Running Angora
Build Target Program
Angora compiles the program into two separate binaries, each with their respective instrumentation. Using autoconf programs as an example, here are the steps required.
# Use the instrumenting compilers
CC=/path/to/angora/bin/angora-clang \
CXX=/path/to/angora/bin/angora-clang++ \
LD=/path/to/angora/bin/angora-clang \
PREFIX=/path/to/target/directory \
./configure --disable-shared
# Build with taint tracking support
USE_TRACK=1 make -j
make install
# Save the compiled target binary into a new directory
# and rename it with .taint postfix, such as uniq.taint
# Build with light instrumentation support
make clean
USE_FAST=1 make -j
make install
# Save the compiled binary into the directory previously
# created and rename it with .fast postfix, such as uniq.fast
If you fail to build by this approach, try wllvm and gllvm described in Build a target program.
Also, we have implemented taint analysis with libdft64 instead of DFSan (Use libdft64 for taint tracking).
Fuzzing
./angora_fuzzer -i input -o output -t path/to/taint/program -- path/to/fast/program [argv]
For more information, please refer to the documentation under the docs/ directory.
81 Dec 27, 2022
20.2k Jan 8, 2023
29 Nov 16, 2022
190 Dec 11, 2022
172 Dec 18, 2022
104 Sep 28, 2022
158 Dec 28, 2022
253 Dec 24, 2022
1.3k Dec 31, 2022
8 Dec 4, 2022
13 Dec 23, 2022
300 Dec 28, 2022
28 Jan 4, 2023
626 Jan 6, 2023
356 Dec 23, 2022
328 Dec 26, 2022