From 7addb9205a2b30d00a9fa693d101788f918a0fcd Mon Sep 17 00:00:00 2001 From: Jacarte Date: Fri, 21 Aug 2020 14:28:24 +0200 Subject: [PATCH 01/31] Executing no docker wafl --- wasm-fuzzer/fuzzing-client-afl/build.sh | 4 +++ .../fuzzing-client-afl/entrypoint_afl.sh | 8 +++-- wasm-fuzzer/fuzzing-client-afl/interface.cpp | 29 +++++++++++++-- wasm-fuzzer/fuzzing-client-afl/run_locally.sh | 35 +++++++++++++++++++ 4 files changed, 71 insertions(+), 5 deletions(-) create mode 100755 wasm-fuzzer/fuzzing-client-afl/build.sh create mode 100755 wasm-fuzzer/fuzzing-client-afl/run_locally.sh diff --git a/wasm-fuzzer/fuzzing-client-afl/build.sh b/wasm-fuzzer/fuzzing-client-afl/build.sh new file mode 100755 index 00000000..33415088 --- /dev/null +++ b/wasm-fuzzer/fuzzing-client-afl/build.sh @@ -0,0 +1,4 @@ +g++ -o cpp_out/prepare_wasm_input.out ./prepare_wasm_input.cpp ./utils.cpp +g++ -o cpp_out/getFileSize.out ./getFileSize.cpp ./utils.cpp +g++ -o cpp_out/wait_for_server.out ./wait_for_server.cpp ./utils.cpp ./socket_client.cpp +g++ -o cpp_out/interface.out ./interface.cpp ./socket_client.cpp ./utils.cpp diff --git a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh index f5445ac4..2fabf661 100644 --- a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh +++ b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh @@ -27,11 +27,15 @@ if [ $? != 0 ]; then exit 1 fi +if [[ $LOCAL_AFL != "True" ]]; then + AFL='afl-fuzz' +fi + # AFL Docs: # afl-fuzz starts by performing an array of deterministic fuzzing steps, # which can take several days, but tend to produce neat test cases. # If you want quick & dirty results right away - akin to zzuf and other # traditional fuzzers - add the -d option to the command line. -echo "afl-fuzz -i $DOCKER_AFL_INPUT -o $DOCKER_AFL_OUTPUT $RANK -d -- ${DOCKER_INTERFACE_SRC}/interface.out @@ $REQUIRED_BYTES" -exec afl-fuzz -i $DOCKER_AFL_INPUT -o $DOCKER_AFL_OUTPUT $RANK -d -- "${DOCKER_INTERFACE_SRC}/interface.out" @@ $REQUIRED_BYTES +echo "$AFL -i $DOCKER_AFL_INPUT -o $DOCKER_AFL_OUTPUT $RANK -t 4000 -d -- ${DOCKER_INTERFACE_SRC}/interface.out @@ $REQUIRED_BYTES" +$AFL -i "$DOCKER_AFL_INPUT" -o $DOCKER_AFL_OUTPUT $RANK -d -- "${DOCKER_INTERFACE_SRC}/interface.out" @@ $REQUIRED_BYTES diff --git a/wasm-fuzzer/fuzzing-client-afl/interface.cpp b/wasm-fuzzer/fuzzing-client-afl/interface.cpp index 81c7be4c..8498a9c3 100644 --- a/wasm-fuzzer/fuzzing-client-afl/interface.cpp +++ b/wasm-fuzzer/fuzzing-client-afl/interface.cpp @@ -1,4 +1,5 @@ #include "interface.h" +#include #define AFL_SHM_SIZE 65536 @@ -71,8 +72,10 @@ void main_fuzz( uint8_t *trace_bits, int requiredBytes) { - + //LOG("Entering"); + std::string DOCKER_LOGS = parseEnvVariables((char *)"DOCKER_LOGS"); std::string DUMMY_TESTING_AFL = parseEnvVariables((char *)"DUMMY_TESTING_AFL"); + if (DUMMY_TESTING_AFL == "True") { fillTraceDummyData(trace_bits); @@ -80,17 +83,25 @@ void main_fuzz( } // TODO: Replace sendBuffer by + + //LOG("Buffer to send"); char sendBuffer[requiredBytes]; readBinaryToBuffer(sendBuffer, sizeof(sendBuffer), (std::string)fuzzed_input_path); + + //logBuffer(DOCKER_LOGS + "/interface.log", requiredBytes, sendBuffer); // std::reverse(sendBuffer, &sendBuffer[sizeof(sendBuffer)]); // Reverse order of tempBuffer + LOG("Read buffer"); char readBuffer[AFL_SHM_SIZE + 1]; // + 1 for exit code + ///logBuffer(DOCKER_LOGS + "/interface.log", AFL_SHM_SIZE + 1, readBuffer); std::string SWAM_SOCKET_HOST = parseEnvVariables((char *)"SWAM_SOCKET_HOST"); std::string SWAM_SOCKET_PORT = parseEnvVariables((char *)"SWAM_SOCKET_PORT"); + LOG("Run client"); runClient(sizeof(sendBuffer), sendBuffer, sizeof(readBuffer), readBuffer, &SWAM_SOCKET_HOST[0], std::stoi(SWAM_SOCKET_PORT)); + LOG("Passing data to afl..."); pass_data_to_afl(sizeof(readBuffer), readBuffer, trace_bits); // Read exit code from readBuffer and exit with same code @@ -110,13 +121,24 @@ void fork_server(char *fuzzed_input_path, uint8_t *trace_bits, int requiredBytes */ int status = 0; + LOG("Waiting for fd"); // Starting the 'Fork server handshake' // Phone home and tell AFL that we're OK - if (write(199, &status, 4) != 4) + + int w = write(199, &status, 4); + LOG("writing..."); + if ( w != 4) { LOG("Write failed"); + LOG("Signal status: " + std::to_string(status)); + LOG("Signal status: " + std::to_string(w)); + std::string str(strerror(errno)); + + LOG("Errno: " + str); + LOG("WTERMSIG(status): " + std::to_string(WTERMSIG(status))); + LOG("WSTOPSIG(status): " + std::to_string(WSTOPSIG(status))); close(199); exit(1); } @@ -127,7 +149,7 @@ void fork_server(char *fuzzed_input_path, uint8_t *trace_bits, int requiredBytes { // Wait for AFL by reading from the pipe. // This will block until AFL sends us something. Abort if read fails. - if (read(198, &status, 4) != 4) + if (read(198, &status, 1) != 1) { LOG("Read failed"); close(198); @@ -153,6 +175,7 @@ void fork_server(char *fuzzed_input_path, uint8_t *trace_bits, int requiredBytes // This is the child process close(198); close(199); + LOG("Calling main fuzz"); main_fuzz(fuzzed_input_path, trace_bits, requiredBytes); exit(0); } diff --git a/wasm-fuzzer/fuzzing-client-afl/run_locally.sh b/wasm-fuzzer/fuzzing-client-afl/run_locally.sh new file mode 100755 index 00000000..7062ee6e --- /dev/null +++ b/wasm-fuzzer/fuzzing-client-afl/run_locally.sh @@ -0,0 +1,35 @@ +sudo rm -rf cpp_out + +export DOCKER_INTERFACE_SRC=$(pwd)/cpp_out +export DOCKER_AFL_INPUT=$(pwd)/cpp_out/in +export SWAM_SOCKET_PORT=9999 +export SWAM_SOCKET_HOST=0.0.0.0 + +export DOCKER_AFL_OUTPUT=out +export REQUIRED_BYTES=4 + +export WASM_ARG_TYPES_LIST=Int32,Int32 +export WASM_ARG_LIST=15,15 +export DOCKER_LOGS=$(pwd)/cpp_out/out +export DUMMY_TESTING_AFL=False + +if [ ! -d cpp_out ]; then + mkdir cpp_out + mkdir -p cpp_out/in + bash build.sh +fi + +# Download afl plus plus +if [ ! -d aflpp ]; then + git clone https://github.com/AFLplusplus/AFLplusplus.git aflpp + + cd aflpp + make distrib + sudo make install + cd .. +fi + +export AFL="$(pwd)/aflpp/afl-fuzz" +export LOCAL_AFL="True" + +bash entrypoint_afl.sh \ No newline at end of file From 1d0d7f46bc38e0842754beb750ac110c8d69265b Mon Sep 17 00:00:00 2001 From: Jacarte Date: Fri, 21 Aug 2020 16:52:00 +0200 Subject: [PATCH 02/31] Building locally script --- .gitignore | 3 ++ wasm-fuzzer/.env | 21 ---------- wasm-fuzzer/.gitignore | 2 + wasm-fuzzer/build.sh | 34 ++++++++++++++++ wasm-fuzzer/fuzzing-client-afl/build.sh | 4 -- .../fuzzing-client-afl/entrypoint_afl.sh | 2 +- wasm-fuzzer/fuzzing-client-afl/interface.cpp | 2 +- wasm-fuzzer/fuzzing-client-afl/run_locally.sh | 35 ----------------- wasm-fuzzer/multi-processing.sh | 4 +- wasm-fuzzer/run_locally.sh | 39 +++++++++++++++++++ 10 files changed, 82 insertions(+), 64 deletions(-) create mode 100644 wasm-fuzzer/.gitignore create mode 100755 wasm-fuzzer/build.sh delete mode 100755 wasm-fuzzer/fuzzing-client-afl/build.sh delete mode 100755 wasm-fuzzer/fuzzing-client-afl/run_locally.sh create mode 100755 wasm-fuzzer/run_locally.sh diff --git a/.gitignore b/.gitignore index 28a16866..042b9fda 100644 --- a/.gitignore +++ b/.gitignore @@ -34,3 +34,6 @@ utils/reports wasm-fuzzer/fuzzing-client-afl/afl_out wasm-fuzzer/fuzzing-client-afl/cpp_out wasm-fuzzer/logs/* + +*.log +*.log.txt \ No newline at end of file diff --git a/wasm-fuzzer/.env b/wasm-fuzzer/.env index 3b2e31fb..408e0eaa 100644 --- a/wasm-fuzzer/.env +++ b/wasm-fuzzer/.env @@ -4,33 +4,12 @@ DUMMY_TESTING_AFL=False # (Not being used yet..) Error, Warn, Info, Debug LOG_LEVEL=Error -# Path to the parent directory of our local .wasm/.wat executable -LOCAL_WASM=/tmp/fuzzer-wat_files - -# Name of our local .wasm/.wat executable -WASM_EXECUTABLE=fibo.wat - # Path on our local machine for us to read AFL's output LOCAL_AFL_OUTPUT=/tmp/afl_out # Path on our local machine for us to read our own logs LOCAL_LOGS=/tmp/fuzzer/fuzzerlogs -# Path on our local machine for us to read SWAM's output (if any) -# SWAM_OUTPUT_LOCAL=/tmp/swam-out - -# Function to be executed in .wasm/.wat ("_start" is default) -TARGET_FUNCTION=clever - -# Parameter types for target function. Comma-separated list of types Int32, Int64, Float32, Float64. -WASM_ARG_TYPES_LIST=Int64 - -# Sample input for target function. Comma-separated list of numbers. -WASM_ARG_LIST=14 - -# Executable has wasi format -WASI=False - ##### No need to change: ##### SWAM_SOCKET_PORT=9999 diff --git a/wasm-fuzzer/.gitignore b/wasm-fuzzer/.gitignore new file mode 100644 index 00000000..3e9173c8 --- /dev/null +++ b/wasm-fuzzer/.gitignore @@ -0,0 +1,2 @@ +aflpp +wafl \ No newline at end of file diff --git a/wasm-fuzzer/build.sh b/wasm-fuzzer/build.sh new file mode 100755 index 00000000..c537b493 --- /dev/null +++ b/wasm-fuzzer/build.sh @@ -0,0 +1,34 @@ + +echo "Building SWAM..." + +cd fuzzing-server-swam +./millw cli.assembly +export SWAM_JAR=$(pwd)/fuzzing-server-swam/out/cli/assembly/dest/out.jar +echo $SWAM_JAR +cd .. + + +# Download afl plus plus +if [ ! -d aflpp ]; then + echo "Downloading aflplusplus..." + git clone https://github.com/AFLplusplus/AFLplusplus.git aflpp + + echo "Building aflplusplus..." + cd aflpp + make distrib + sudo make install + cd .. +fi + + +echo "Building the wafl interface..." + +mkdir -p wafl + +g++ -o wafl/prepare_wasm_input.out ./fuzzing-client-afl/prepare_wasm_input.cpp ./fuzzing-client-afl/utils.cpp +g++ -o wafl/getFileSize.out ./fuzzing-client-afl/getFileSize.cpp ./fuzzing-client-afl/utils.cpp +g++ -o wafl/wait_for_server.out ./fuzzing-client-afl/wait_for_server.cpp ./fuzzing-client-afl/utils.cpp ./fuzzing-client-afl/socket_client.cpp +g++ -o wafl/interface.out ./fuzzing-client-afl/interface.cpp ./fuzzing-client-afl/socket_client.cpp ./fuzzing-client-afl/utils.cpp + + +echo "DONE !" \ No newline at end of file diff --git a/wasm-fuzzer/fuzzing-client-afl/build.sh b/wasm-fuzzer/fuzzing-client-afl/build.sh deleted file mode 100755 index 33415088..00000000 --- a/wasm-fuzzer/fuzzing-client-afl/build.sh +++ /dev/null @@ -1,4 +0,0 @@ -g++ -o cpp_out/prepare_wasm_input.out ./prepare_wasm_input.cpp ./utils.cpp -g++ -o cpp_out/getFileSize.out ./getFileSize.cpp ./utils.cpp -g++ -o cpp_out/wait_for_server.out ./wait_for_server.cpp ./utils.cpp ./socket_client.cpp -g++ -o cpp_out/interface.out ./interface.cpp ./socket_client.cpp ./utils.cpp diff --git a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh index 2fabf661..394dee48 100644 --- a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh +++ b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh @@ -37,5 +37,5 @@ fi # If you want quick & dirty results right away - akin to zzuf and other # traditional fuzzers - add the -d option to the command line. -echo "$AFL -i $DOCKER_AFL_INPUT -o $DOCKER_AFL_OUTPUT $RANK -t 4000 -d -- ${DOCKER_INTERFACE_SRC}/interface.out @@ $REQUIRED_BYTES" +echo "$AFL -i $DOCKER_AFL_INPUT -o $DOCKER_AFL_OUTPUT $RANK -d -- ${DOCKER_INTERFACE_SRC}/interface.out @@ $REQUIRED_BYTES" $AFL -i "$DOCKER_AFL_INPUT" -o $DOCKER_AFL_OUTPUT $RANK -d -- "${DOCKER_INTERFACE_SRC}/interface.out" @@ $REQUIRED_BYTES diff --git a/wasm-fuzzer/fuzzing-client-afl/interface.cpp b/wasm-fuzzer/fuzzing-client-afl/interface.cpp index 8498a9c3..91b373fc 100644 --- a/wasm-fuzzer/fuzzing-client-afl/interface.cpp +++ b/wasm-fuzzer/fuzzing-client-afl/interface.cpp @@ -149,7 +149,7 @@ void fork_server(char *fuzzed_input_path, uint8_t *trace_bits, int requiredBytes { // Wait for AFL by reading from the pipe. // This will block until AFL sends us something. Abort if read fails. - if (read(198, &status, 1) != 1) + if (read(198, &status, 4) != 4) { LOG("Read failed"); close(198); diff --git a/wasm-fuzzer/fuzzing-client-afl/run_locally.sh b/wasm-fuzzer/fuzzing-client-afl/run_locally.sh deleted file mode 100755 index 7062ee6e..00000000 --- a/wasm-fuzzer/fuzzing-client-afl/run_locally.sh +++ /dev/null @@ -1,35 +0,0 @@ -sudo rm -rf cpp_out - -export DOCKER_INTERFACE_SRC=$(pwd)/cpp_out -export DOCKER_AFL_INPUT=$(pwd)/cpp_out/in -export SWAM_SOCKET_PORT=9999 -export SWAM_SOCKET_HOST=0.0.0.0 - -export DOCKER_AFL_OUTPUT=out -export REQUIRED_BYTES=4 - -export WASM_ARG_TYPES_LIST=Int32,Int32 -export WASM_ARG_LIST=15,15 -export DOCKER_LOGS=$(pwd)/cpp_out/out -export DUMMY_TESTING_AFL=False - -if [ ! -d cpp_out ]; then - mkdir cpp_out - mkdir -p cpp_out/in - bash build.sh -fi - -# Download afl plus plus -if [ ! -d aflpp ]; then - git clone https://github.com/AFLplusplus/AFLplusplus.git aflpp - - cd aflpp - make distrib - sudo make install - cd .. -fi - -export AFL="$(pwd)/aflpp/afl-fuzz" -export LOCAL_AFL="True" - -bash entrypoint_afl.sh \ No newline at end of file diff --git a/wasm-fuzzer/multi-processing.sh b/wasm-fuzzer/multi-processing.sh index 65da22c7..9f3ac952 100755 --- a/wasm-fuzzer/multi-processing.sh +++ b/wasm-fuzzer/multi-processing.sh @@ -22,7 +22,7 @@ docker run --env-file=./.env \ -v ${LOCAL_AFL_OUTPUT:?err}:/home/client/out/ \ -v ${LOCAL_LOGS:?err}:/home/shared/logs/ \ -d \ - wafl:latest + slumps/wafl:latest if [ $1 -lt 2 ] then @@ -43,6 +43,6 @@ do -v ${LOCAL_AFL_OUTPUT:?err}:/home/client/out/ \ -v ${LOCAL_LOGS:?err}:/home/shared/logs/ \ -d \ - wafl:latest + slumps/wafl:latest done exit 0 diff --git a/wasm-fuzzer/run_locally.sh b/wasm-fuzzer/run_locally.sh new file mode 100755 index 00000000..dcba8eb0 --- /dev/null +++ b/wasm-fuzzer/run_locally.sh @@ -0,0 +1,39 @@ +export DOCKER_INTERFACE_SRC=$(pwd)/wafl +export DOCKER_AFL_INPUT=$(pwd)/wafl/in +export SWAM_SOCKET_PORT=9999 +export SWAM_SOCKET_HOST=0.0.0.0 + +export DOCKER_AFL_OUTPUT=out +export REQUIRED_BYTES=4 + +export WASM_ARG_TYPES_LIST=Int32 +export WASM_ARG_LIST=15 +export DOCKER_LOGS=$(pwd)/wafl/out +export DUMMY_TESTING_AFL=False + + +export AFL="$(pwd)/aflpp/afl-fuzz" +export LOCAL_AFL="True" +export WASI_FILTER="True" +export WASI=True + +mkdir -p $DOCKER_AFL_INPUT + +set -a +source .env +set +x + +if [[ $1 == *.wat ]]; then WAT_ARG="--wat"; fi +if [[ $WASI == "True" ]]; then WASI_ARG="--wasi"; fi +if [[ $WASI_FILTER == "True" ]]; then WASI_ARG="$WASI_ARG -r"; fi + +echo "Running Swam" +pkill -f out.jar + +mkdir -p $DOCKER_AFL_OUTPUT/logs + +java -jar fuzzing-server-swam/out/cli/assembly/dest/out.jar run_server $1 -m $2 --argType Int32 $WASI_ARG 1> $DOCKER_AFL_OUTPUT/logs/swam.std.txt 2> $DOCKER_AFL_OUTPUT/logs/swam.err.txt & + +sleep 2 +echo "Running AFL fuzzing client" +bash fuzzing-client-afl/entrypoint_afl.sh \ No newline at end of file From 77ad9564883d8d6a88fbcdeb7ba64c063f1ab916 Mon Sep 17 00:00:00 2001 From: Jacarte Date: Fri, 21 Aug 2020 16:57:10 +0200 Subject: [PATCH 03/31] Adding timeout and killng the server at the end --- wasm-fuzzer/run_locally.sh | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/wasm-fuzzer/run_locally.sh b/wasm-fuzzer/run_locally.sh index dcba8eb0..96174bad 100755 --- a/wasm-fuzzer/run_locally.sh +++ b/wasm-fuzzer/run_locally.sh @@ -1,3 +1,6 @@ +# TODO ID the instance and the port for several instances + + export DOCKER_INTERFACE_SRC=$(pwd)/wafl export DOCKER_AFL_INPUT=$(pwd)/wafl/in export SWAM_SOCKET_PORT=9999 @@ -8,7 +11,9 @@ export REQUIRED_BYTES=4 export WASM_ARG_TYPES_LIST=Int32 export WASM_ARG_LIST=15 + export DOCKER_LOGS=$(pwd)/wafl/out + export DUMMY_TESTING_AFL=False @@ -16,6 +21,8 @@ export AFL="$(pwd)/aflpp/afl-fuzz" export LOCAL_AFL="True" export WASI_FILTER="True" export WASI=True +export WITH_TIMEOUT="True" +export TIMEOUT=10 # 10 seconds mkdir -p $DOCKER_AFL_INPUT @@ -26,14 +33,21 @@ set +x if [[ $1 == *.wat ]]; then WAT_ARG="--wat"; fi if [[ $WASI == "True" ]]; then WASI_ARG="--wasi"; fi if [[ $WASI_FILTER == "True" ]]; then WASI_ARG="$WASI_ARG -r"; fi +if [[ $WITH_TIMEOUT == "True" ]]; then TIMEOUT="timeout $TIMEOUT"; fi echo "Running Swam" -pkill -f out.jar mkdir -p $DOCKER_AFL_OUTPUT/logs java -jar fuzzing-server-swam/out/cli/assembly/dest/out.jar run_server $1 -m $2 --argType Int32 $WASI_ARG 1> $DOCKER_AFL_OUTPUT/logs/swam.std.txt 2> $DOCKER_AFL_OUTPUT/logs/swam.err.txt & +swamPid=$! + sleep 2 echo "Running AFL fuzzing client" -bash fuzzing-client-afl/entrypoint_afl.sh \ No newline at end of file + +$TIMEOUT bash fuzzing-client-afl/entrypoint_afl.sh + +echo "Killing swam server pid $swamPid" +pkill -f $swamPid + From b8e3c10b01877226338a301be055b130a48190d8 Mon Sep 17 00:00:00 2001 From: Jacarte Date: Tue, 25 Aug 2020 09:38:31 +0200 Subject: [PATCH 04/31] WIP --- .gitmodules | 6 +----- wasm-fuzzer/.gitignore | 3 ++- wasm-fuzzer/run_locally.sh | 28 +++++++++++++++------------- 3 files changed, 18 insertions(+), 19 deletions(-) diff --git a/.gitmodules b/.gitmodules index d7e36960..e225acd0 100644 --- a/.gitmodules +++ b/.gitmodules @@ -9,8 +9,4 @@ [submodule "llvm"] path = llvm url = https://github.com/Jacarte/llvm-project - branch = master -[submodule "wasm-fuzzer/fuzzing-server-swam"] - path = wasm-fuzzer/fuzzing-server-swam - url = https://github.com/KTH/swam - branch = feature/swam-server + branch = master \ No newline at end of file diff --git a/wasm-fuzzer/.gitignore b/wasm-fuzzer/.gitignore index 3e9173c8..e3a90cfc 100644 --- a/wasm-fuzzer/.gitignore +++ b/wasm-fuzzer/.gitignore @@ -1,2 +1,3 @@ aflpp -wafl \ No newline at end of file +wafl +out* \ No newline at end of file diff --git a/wasm-fuzzer/run_locally.sh b/wasm-fuzzer/run_locally.sh index 96174bad..0e25f717 100755 --- a/wasm-fuzzer/run_locally.sh +++ b/wasm-fuzzer/run_locally.sh @@ -1,18 +1,20 @@ -# TODO ID the instance and the port for several instances +currentID=$$ +echo "wafl ID $currentID" export DOCKER_INTERFACE_SRC=$(pwd)/wafl -export DOCKER_AFL_INPUT=$(pwd)/wafl/in +export DOCKER_AFL_INPUT=$DOCKER_INTERFACE_SRC/in-$currentID + export SWAM_SOCKET_PORT=9999 export SWAM_SOCKET_HOST=0.0.0.0 +export DOCKER_AFL_OUTPUT=out-$currentID -export DOCKER_AFL_OUTPUT=out export REQUIRED_BYTES=4 -export WASM_ARG_TYPES_LIST=Int32 -export WASM_ARG_LIST=15 +export WASM_ARG_TYPES_LIST=Int32 # Read from signature retriever +export WASM_ARG_LIST=11 # Read from signature retriever, maybe none -export DOCKER_LOGS=$(pwd)/wafl/out +export DOCKER_LOGS=$DOCKER_INTERFACE_SRC/out export DUMMY_TESTING_AFL=False @@ -22,10 +24,11 @@ export LOCAL_AFL="True" export WASI_FILTER="True" export WASI=True export WITH_TIMEOUT="True" -export TIMEOUT=10 # 10 seconds +export TIMEOUT=60 # 60 seconds mkdir -p $DOCKER_AFL_INPUT +## Replace env variables set -a source .env set +x @@ -33,21 +36,20 @@ set +x if [[ $1 == *.wat ]]; then WAT_ARG="--wat"; fi if [[ $WASI == "True" ]]; then WASI_ARG="--wasi"; fi if [[ $WASI_FILTER == "True" ]]; then WASI_ARG="$WASI_ARG -r"; fi -if [[ $WITH_TIMEOUT == "True" ]]; then TIMEOUT="timeout $TIMEOUT"; fi +if [[ $WITH_TIMEOUT == "True" ]]; then TIMEOUT="timeout --foreground $TIMEOUT"; fi echo "Running Swam" -mkdir -p $DOCKER_AFL_OUTPUT/logs +mkdir -p $DOCKER_INTERFACE_SRC/logs-$currentID -java -jar fuzzing-server-swam/out/cli/assembly/dest/out.jar run_server $1 -m $2 --argType Int32 $WASI_ARG 1> $DOCKER_AFL_OUTPUT/logs/swam.std.txt 2> $DOCKER_AFL_OUTPUT/logs/swam.err.txt & +java -jar fuzzing-server-swam/out/cli/assembly/dest/out.jar run_server $1 --main $2 --argType Int32 $WASI_ARG 1> $DOCKER_INTERFACE_SRC/logs-$currentID/swam.std.txt 2> $DOCKER_INTERFACE_SRC/logs-$currentID/swam.err.txt & swamPid=$! sleep 2 echo "Running AFL fuzzing client" -$TIMEOUT bash fuzzing-client-afl/entrypoint_afl.sh +$TIMEOUT bash fuzzing-client-afl/entrypoint_afl.sh -echo "Killing swam server pid $swamPid" pkill -f $swamPid - +echo "Killing swam server pid $swamPid" From c5358993dc7bcfd7a2c3b4894d61e81481a29d90 Mon Sep 17 00:00:00 2001 From: Jacarte Date: Tue, 25 Aug 2020 09:38:48 +0200 Subject: [PATCH 05/31] RM swam as submodule --- wasm-fuzzer/fuzzing-server-swam | 1 - 1 file changed, 1 deletion(-) delete mode 160000 wasm-fuzzer/fuzzing-server-swam diff --git a/wasm-fuzzer/fuzzing-server-swam b/wasm-fuzzer/fuzzing-server-swam deleted file mode 160000 index 028a7b8d..00000000 --- a/wasm-fuzzer/fuzzing-server-swam +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 028a7b8dac86b1936e692ae0b3c19431bf2ee387 From 1d55457afbb04f6cd440d58606afbdbb6a7f1115 Mon Sep 17 00:00:00 2001 From: Jacarte Date: Tue, 25 Aug 2020 09:44:26 +0200 Subject: [PATCH 06/31] Downloading and building swam in wafl --- wasm-fuzzer/.gitignore | 3 ++- wasm-fuzzer/build.sh | 7 +++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/wasm-fuzzer/.gitignore b/wasm-fuzzer/.gitignore index e3a90cfc..d05ee3b4 100644 --- a/wasm-fuzzer/.gitignore +++ b/wasm-fuzzer/.gitignore @@ -1,3 +1,4 @@ aflpp wafl -out* \ No newline at end of file +out* +fuzzing-server-swam \ No newline at end of file diff --git a/wasm-fuzzer/build.sh b/wasm-fuzzer/build.sh index c537b493..1e094b47 100755 --- a/wasm-fuzzer/build.sh +++ b/wasm-fuzzer/build.sh @@ -1,4 +1,11 @@ +echo "Cloning swam" + + +if [ ! -d fuzzing-server-swam ]; then + git clone --single-branch --branch feature/swam-server https://github.com/KTH/swam.git fuzzing-server-swam +fi + echo "Building SWAM..." cd fuzzing-server-swam From 102fbff00e2e28fc5ded4c09168bc4d896b14285 Mon Sep 17 00:00:00 2001 From: Jacarte Date: Tue, 25 Aug 2020 10:17:45 +0200 Subject: [PATCH 07/31] Infering init values from seed all equal --- wasm-fuzzer/build.sh | 1 + .../fuzzing-client-afl/entrypoint_afl.sh | 2 +- wasm-fuzzer/{run_locally.sh => wafl.sh} | 38 ++++++++++++++++--- 3 files changed, 35 insertions(+), 6 deletions(-) rename wasm-fuzzer/{run_locally.sh => wafl.sh} (51%) diff --git a/wasm-fuzzer/build.sh b/wasm-fuzzer/build.sh index 1e094b47..839f22f7 100755 --- a/wasm-fuzzer/build.sh +++ b/wasm-fuzzer/build.sh @@ -9,6 +9,7 @@ fi echo "Building SWAM..." cd fuzzing-server-swam +git pull ./millw cli.assembly export SWAM_JAR=$(pwd)/fuzzing-server-swam/out/cli/assembly/dest/out.jar echo $SWAM_JAR diff --git a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh index 394dee48..2f4004d2 100644 --- a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh +++ b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh @@ -38,4 +38,4 @@ fi # traditional fuzzers - add the -d option to the command line. echo "$AFL -i $DOCKER_AFL_INPUT -o $DOCKER_AFL_OUTPUT $RANK -d -- ${DOCKER_INTERFACE_SRC}/interface.out @@ $REQUIRED_BYTES" -$AFL -i "$DOCKER_AFL_INPUT" -o $DOCKER_AFL_OUTPUT $RANK -d -- "${DOCKER_INTERFACE_SRC}/interface.out" @@ $REQUIRED_BYTES +$AFL -i "$DOCKER_AFL_INPUT" -o $DOCKER_AFL_OUTPUT $RANK -t 5000 -d -- "${DOCKER_INTERFACE_SRC}/interface.out" @@ $REQUIRED_BYTES diff --git a/wasm-fuzzer/run_locally.sh b/wasm-fuzzer/wafl.sh similarity index 51% rename from wasm-fuzzer/run_locally.sh rename to wasm-fuzzer/wafl.sh index 0e25f717..88b40757 100755 --- a/wasm-fuzzer/run_locally.sh +++ b/wasm-fuzzer/wafl.sh @@ -11,8 +11,6 @@ export DOCKER_AFL_OUTPUT=out-$currentID export REQUIRED_BYTES=4 -export WASM_ARG_TYPES_LIST=Int32 # Read from signature retriever -export WASM_ARG_LIST=11 # Read from signature retriever, maybe none export DOCKER_LOGS=$DOCKER_INTERFACE_SRC/out @@ -23,7 +21,9 @@ export AFL="$(pwd)/aflpp/afl-fuzz" export LOCAL_AFL="True" export WASI_FILTER="True" export WASI=True -export WITH_TIMEOUT="True" +export WITH_TIMEOUT="False" +export INFER_INIT_VALUES="True" +export INIT_VALUES_SEED="0" export TIMEOUT=60 # 60 seconds mkdir -p $DOCKER_AFL_INPUT @@ -36,13 +36,41 @@ set +x if [[ $1 == *.wat ]]; then WAT_ARG="--wat"; fi if [[ $WASI == "True" ]]; then WASI_ARG="--wasi"; fi if [[ $WASI_FILTER == "True" ]]; then WASI_ARG="$WASI_ARG -r"; fi -if [[ $WITH_TIMEOUT == "True" ]]; then TIMEOUT="timeout --foreground $TIMEOUT"; fi +if [[ $WITH_TIMEOUT == "True" ]]; then TIMEOUT="timeout --foreground $TIMEOUT"; else TIMEOUT=""; fi + +echo "Infering signature for wasm" + +echo "java -jar fuzzing-server-swam/out/cli/assembly/dest/out.jar infer $WAT_ARG $1 $2" + + +export WASM_ARG_TYPES_LIST=$(java -jar fuzzing-server-swam/out/cli/assembly/dest/out.jar infer $WAT_ARG $1 $2) # Read from signature retriever echo "Running Swam" +ALL_ARG_TYPES="" +ALL_ARG_VALUES="" +IFS=',' read -r -a array <<< "$WASM_ARG_TYPES_LIST" +for element in "${array[@]}" +do + ALL_ARG_TYPES="$ALL_ARG_TYPES --argType $element"; + # TODO init values should be provided + + if [[ $INFER_INIT_VALUES == "True" ]] + then + ALL_ARG_VALUES="$ALL_ARG_VALUES,$INIT_VALUES_SEED"; + fi + +done +ALL_ARG_VALUES=${ALL_ARG_VALUES:1} +echo "ALL_ARG_TYPES: $ALL_ARG_TYPES" +echo "ALL_ARG_INIT_VALUES: $ALL_ARG_VALUES" + +export WASM_ARG_LIST=$ALL_ARG_VALUES + mkdir -p $DOCKER_INTERFACE_SRC/logs-$currentID -java -jar fuzzing-server-swam/out/cli/assembly/dest/out.jar run_server $1 --main $2 --argType Int32 $WASI_ARG 1> $DOCKER_INTERFACE_SRC/logs-$currentID/swam.std.txt 2> $DOCKER_INTERFACE_SRC/logs-$currentID/swam.err.txt & +pkill -f out.jar +java -jar fuzzing-server-swam/out/cli/assembly/dest/out.jar run_server $1 --main $2 $ALL_ARG_TYPES $WASI_ARG 1> $DOCKER_INTERFACE_SRC/logs-$currentID/swam.std.txt 2> $DOCKER_INTERFACE_SRC/logs-$currentID/swam.err.txt & swamPid=$! From 78082ac7ef639589369c47116451e0f66bb456d7 Mon Sep 17 00:00:00 2001 From: Jacarte Date: Tue, 25 Aug 2020 10:26:12 +0200 Subject: [PATCH 08/31] HOTFIX: LOG function not found --- wasm-fuzzer/fuzzing-client-afl/interface.cpp | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/wasm-fuzzer/fuzzing-client-afl/interface.cpp b/wasm-fuzzer/fuzzing-client-afl/interface.cpp index 12bba6cf..9d2bc0e2 100644 --- a/wasm-fuzzer/fuzzing-client-afl/interface.cpp +++ b/wasm-fuzzer/fuzzing-client-afl/interface.cpp @@ -116,7 +116,7 @@ void main_fuzz( } } - LOG("Passing data to afl..."); + //LOG("Passing data to afl..."); pass_data_to_afl(sizeof(readBuffer), readBuffer, trace_bits); // Read exit code from readBuffer and exit with same code @@ -149,14 +149,11 @@ void fork_server(char *fuzzed_input_path, uint8_t *trace_bits, int requiredBytes log_default("Forkserver's PID: " + forkServerPIDString, INFO); int status = 0; - LOG("Waiting for fd"); - // Starting the 'Fork server handshake' // Phone home and tell AFL that we're OK int w = write(199, &status, 4); - LOG("writing..."); if ( w != 4) { log_default("Write failed", ERROR); From a602a057cd7da265ff32ca02099704d72a334a4b Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Thu, 27 Aug 2020 18:58:28 +0200 Subject: [PATCH 09/31] Removed everything related to docker-compose --- wasm-fuzzer/docker-compose.base.yml | 29 ------------------- wasm-fuzzer/docker-compose.stack.yml | 34 ----------------------- wasm-fuzzer/docker-compose.yml | 17 ------------ wasm-fuzzer/fuzzing-client-afl/Dockerfile | 22 --------------- 4 files changed, 102 deletions(-) delete mode 100644 wasm-fuzzer/docker-compose.base.yml delete mode 100644 wasm-fuzzer/docker-compose.stack.yml delete mode 100644 wasm-fuzzer/docker-compose.yml delete mode 100644 wasm-fuzzer/fuzzing-client-afl/Dockerfile diff --git a/wasm-fuzzer/docker-compose.base.yml b/wasm-fuzzer/docker-compose.base.yml deleted file mode 100644 index 0553860d..00000000 --- a/wasm-fuzzer/docker-compose.base.yml +++ /dev/null @@ -1,29 +0,0 @@ -# This file does not work by itself - -version: '3.7' - -services: - swam_server: - entrypoint: /home/swam/entrypoint_mill_server.sh - env_file: - - ./.env - volumes: - - maven_data:/root/.cache/coursier/v1/https/repo1.maven.org/maven2 - - compiled_sources:/home/server/src/out/ - - ${LOCAL_WASM:?err}:/home/wasm/ - - afl_interface: - entrypoint: /home/interface/entrypoint_afl.sh - env_file: - - ./.env - environment: - SWAM_SOCKET_HOST: swam_server - volumes: - - ${LOCAL_AFL_OUTPUT:?err}:/home/out/ - - ${LOCAL_LOGS:?err}:/home/logs/ - depends_on: - - swam_server - -volumes: - maven_data: - compiled_sources: \ No newline at end of file diff --git a/wasm-fuzzer/docker-compose.stack.yml b/wasm-fuzzer/docker-compose.stack.yml deleted file mode 100644 index d5be88e3..00000000 --- a/wasm-fuzzer/docker-compose.stack.yml +++ /dev/null @@ -1,34 +0,0 @@ -# WARNING: -# This is still in testing! It still requires to set up AFL's Master-Slave mechanism. -# Also, the Socket Server does not seem to be running concurrently yet (even with a -# thread per request). - -# Create/update stack on the swarm: -# set -a -# source .env -# set +a -# docker stack deploy --compose-file docker-compose.base.yml -c docker-compose.stack.yml afl_swam - -# View all (multi-instance) services of stack: -# docker service ls - -# View live logs of (multi-instance) service: -# docker service logs -f {NAME_OF_THE_SERVICE} - -# Remove stack from the swarm -# docker stack rm afl_swam - -version: '3.7' - -services: - swam_server: - image: fuzzer_swam_server - - afl_interface: - image: fuzzer_afl_interface - deploy: - replicas: 6 - -volumes: - compiled_sources: - maven_data: diff --git a/wasm-fuzzer/docker-compose.yml b/wasm-fuzzer/docker-compose.yml deleted file mode 100644 index f23ccea3..00000000 --- a/wasm-fuzzer/docker-compose.yml +++ /dev/null @@ -1,17 +0,0 @@ -# WARNING: -# The env variables used in this file (e.g. LOCAL_WASM) can only -# be read by a file named ".env". This is standard Docker behaviour. - -# 1. Configure ./.env file -# 2. docker-compose -f docker-compose.base.yml -f docker-compose.yml up --build - -version: '3.7' - -services: - swam_server: - build: ./fuzzing-server-swam - expose: - - ${SWAM_SOCKET_PORT:?err} - - afl_interface: - build: ./fuzzing-client-afl diff --git a/wasm-fuzzer/fuzzing-client-afl/Dockerfile b/wasm-fuzzer/fuzzing-client-afl/Dockerfile deleted file mode 100644 index 86ddeb15..00000000 --- a/wasm-fuzzer/fuzzing-client-afl/Dockerfile +++ /dev/null @@ -1,22 +0,0 @@ -FROM aflplusplus/aflplusplus - -ENV DOCKER_INTERFACE_SRC=/home/interface -ENV DOCKER_AFL_INPUT=/home/in -ENV DOCKER_AFL_OUTPUT=/home/out -ENV DOCKER_LOGS=/home/logs - -# Create the appropriate directories -RUN mkdir -p $DOCKER_INTERFACE_SRC -RUN mkdir -p $DOCKER_AFL_INPUT -RUN mkdir -p $DOCKER_AFL_OUTPUT -RUN mkdir -p $DOCKER_LOGS -WORKDIR $DOCKER_INTERFACE_SRC - -ADD ./ $DOCKER_INTERFACE_SRC - -RUN g++ -o ./prepare_wasm_input.out ./prepare_wasm_input.cpp ./utils.cpp -RUN g++ -o ./getFileSize.out ./getFileSize.cpp ./utils.cpp -RUN g++ -o ./wait_for_server.out ./wait_for_server.cpp ./utils.cpp ./socket_client.cpp -RUN g++ -o ./interface.out ./interface.cpp ./socket_client.cpp ./utils.cpp - -RUN chmod +x $DOCKER_INTERFACE_SRC/entrypoint_afl.sh From ee8b0ada8c7db4b2a9fa9b10a9b7d375c4333681 Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Thu, 27 Aug 2020 18:59:08 +0200 Subject: [PATCH 10/31] Put SWAM_SOCKET_HOST into ./env --- wasm-fuzzer/.env | 1 + wasm-fuzzer/README.md | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/wasm-fuzzer/.env b/wasm-fuzzer/.env index 29f1e2b7..56464fcd 100644 --- a/wasm-fuzzer/.env +++ b/wasm-fuzzer/.env @@ -11,6 +11,7 @@ LOCAL_AFL_OUTPUT=/tmp/afl_out LOCAL_LOGS=/tmp/fuzzer/fuzzerlogs ##### No need to change: ##### +SWAM_SOCKET_HOST=localhost SWAM_SOCKET_PORT=9999 # Filter out WASI diff --git a/wasm-fuzzer/README.md b/wasm-fuzzer/README.md index ab1aff35..a636496e 100644 --- a/wasm-fuzzer/README.md +++ b/wasm-fuzzer/README.md @@ -110,8 +110,7 @@ docker build -t wafl . 3. Run the Docker image. ```bash - docker run -it --rm --env-file=./.env \ - -e SWAM_SOCKET_HOST=localhost \ + docker run --rm --env-file=./.env \ -v maven_data:/root/.cache/coursier/v1/https/repo1.maven.org/maven2 \ -v compiled_sources:/home/server/src/out/ \ -v ${LOCAL_WASM:?err}:/home/server/wasm/ \ From 8de7ae4e348660cec708d080faee5e41f6315c91 Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Thu, 27 Aug 2020 19:00:42 +0200 Subject: [PATCH 11/31] Being sure about CURRENT_DIR in build.sh && included run_client.cpp --- wasm-fuzzer/build.sh | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/wasm-fuzzer/build.sh b/wasm-fuzzer/build.sh index 839f22f7..912b18f6 100755 --- a/wasm-fuzzer/build.sh +++ b/wasm-fuzzer/build.sh @@ -1,17 +1,17 @@ +#!/bin/bash -echo "Cloning swam" - +CURRENT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +echo "Cloning SWAM" if [ ! -d fuzzing-server-swam ]; then git clone --single-branch --branch feature/swam-server https://github.com/KTH/swam.git fuzzing-server-swam fi -echo "Building SWAM..." - +echo "Building SWAM" cd fuzzing-server-swam git pull ./millw cli.assembly -export SWAM_JAR=$(pwd)/fuzzing-server-swam/out/cli/assembly/dest/out.jar +export SWAM_JAR=$(CURRENT_DIR)/fuzzing-server-swam/out/cli/assembly/dest/out.jar echo $SWAM_JAR cd .. @@ -36,7 +36,7 @@ mkdir -p wafl g++ -o wafl/prepare_wasm_input.out ./fuzzing-client-afl/prepare_wasm_input.cpp ./fuzzing-client-afl/utils.cpp g++ -o wafl/getFileSize.out ./fuzzing-client-afl/getFileSize.cpp ./fuzzing-client-afl/utils.cpp g++ -o wafl/wait_for_server.out ./fuzzing-client-afl/wait_for_server.cpp ./fuzzing-client-afl/utils.cpp ./fuzzing-client-afl/socket_client.cpp +g++ -o wafl/run_client.out ./fuzzing-client-aflrun_client.cpp ./socket_client.cpp ./utils.cpp g++ -o wafl/interface.out ./fuzzing-client-afl/interface.cpp ./fuzzing-client-afl/socket_client.cpp ./fuzzing-client-afl/utils.cpp - echo "DONE !" \ No newline at end of file From e7e2fd8a6b23430e0432ce7b33a88632cc44bb21 Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Thu, 27 Aug 2020 19:03:13 +0200 Subject: [PATCH 12/31] Renamed DOCKER_ envs && put wafl.sh as entrypoint --- wasm-fuzzer/Dockerfile | 46 ++++++++++--------- wasm-fuzzer/fuzzing-client-afl/interface.cpp | 4 +- .../fuzzing-client-afl/prepare_wasm_input.cpp | 8 ++-- wasm-fuzzer/fuzzing-client-afl/run_test.sh | 9 ++-- wasm-fuzzer/fuzzing-client-afl/utils.cpp | 4 +- wasm-fuzzer/multi-processing.sh | 2 - wasm-fuzzer/supervisord.conf | 4 +- 7 files changed, 37 insertions(+), 40 deletions(-) diff --git a/wasm-fuzzer/Dockerfile b/wasm-fuzzer/Dockerfile index e090537d..cf5a654b 100644 --- a/wasm-fuzzer/Dockerfile +++ b/wasm-fuzzer/Dockerfile @@ -30,58 +30,60 @@ WORKDIR /root ##### fuzzing-server-swam ###### ################################ -ENV DOCKER_SWAM_SRC=/home/server/src -ENV DOCKER_WASM=/home/server/wasm +ENV SRC_SWAM_DIR=/home/server/src +ENV WASM_DIR=/home/server/wasm # Create the appropriate directories -RUN mkdir -p $DOCKER_SWAM_SRC -RUN mkdir -p $DOCKER_WASM +RUN mkdir -p $SRC_SWAM_DIR +RUN mkdir -p $WASM_DIR -WORKDIR $DOCKER_SWAM_SRC +WORKDIR $SRC_SWAM_DIR # TODO: Find way of installing dependencies with Mill without copying over entire repo # See: https://stackoverflow.com/questions/62834693/mill-build-tool-install-dependencies-without-compiling-source-code -ADD ./fuzzing-server-entry/entrypoint_mill_server.sh $DOCKER_SWAM_SRC +ADD ./fuzzing-server-entry/entrypoint_mill_server.sh $SRC_SWAM_DIR # DOWNLOAD latest version of SWAM cli jar file -ADD https://github.com/KTH/swam/releases/download/v0.6.0-RC3/cli-0.6.0-RC3.jar $DOCKER_SWAM_SRC +ADD https://github.com/KTH/swam/releases/download/v0.6.0-RC3/cli-0.6.0-RC3.jar $SRC_SWAM_DIR -RUN chmod +x $DOCKER_SWAM_SRC/entrypoint_mill_server.sh +RUN chmod +x $SRC_SWAM_DIR/entrypoint_mill_server.sh ############################# #### fuzzing-client-afl ##### ############################# -ENV DOCKER_INTERFACE_SRC=/home/client/interface -ENV DOCKER_AFL_INPUT=/home/client/in -ENV DOCKER_AFL_OUTPUT=/home/client/out +ENV SRC_INTERFACE_DIR=/home/client/interface +ENV INPUT_AFL_DIR=/home/client/in +ENV OUTPUT_AFL_DIR=/home/client/out # Create the appropriate directories -RUN mkdir -p $DOCKER_INTERFACE_SRC -RUN mkdir -p $DOCKER_AFL_INPUT -RUN mkdir -p $DOCKER_AFL_OUTPUT -WORKDIR $DOCKER_INTERFACE_SRC +RUN mkdir -p $SRC_INTERFACE_DIR +RUN mkdir -p $INPUT_AFL_DIR +RUN mkdir -p $OUTPUT_AFL_DIR +WORKDIR $SRC_INTERFACE_DIR -ADD ./fuzzing-client-afl $DOCKER_INTERFACE_SRC +ADD ./fuzzing-client-afl $SRC_INTERFACE_DIR RUN g++ -o ./prepare_wasm_input.out ./prepare_wasm_input.cpp ./utils.cpp RUN g++ -o ./getFileSize.out ./getFileSize.cpp ./utils.cpp RUN g++ -o ./wait_for_server.out ./wait_for_server.cpp ./utils.cpp ./socket_client.cpp RUN g++ -o ./interface.out ./interface.cpp ./socket_client.cpp ./utils.cpp -RUN chmod +x $DOCKER_INTERFACE_SRC/entrypoint_afl.sh +RUN chmod +x $SRC_INTERFACE_DIR/entrypoint_afl.sh ######################### ######## Shared ######### ######################### -ADD supervisord.conf /etc/supervisor/conf.d/supervisord.conf +ENV LOGS_DIR=/home/shared/logs -ENV DOCKER_SHARED=/home/shared -ENV DOCKER_LOGS=$DOCKER_SHARED/logs +RUN mkdir -p $LOGS_DIR -RUN mkdir -p $DOCKER_LOGS +ADD supervisord.conf /etc/supervisor/conf.d/supervisord.conf +ADD wafl.sh /home/wafl.sh -ENTRYPOINT ["/usr/bin/supervisord"] \ No newline at end of file +RUN chmod +x /home/wafl.sh + +ENTRYPOINT ["/home/wafl.sh"] diff --git a/wasm-fuzzer/fuzzing-client-afl/interface.cpp b/wasm-fuzzer/fuzzing-client-afl/interface.cpp index 9d2bc0e2..3675cc5c 100644 --- a/wasm-fuzzer/fuzzing-client-afl/interface.cpp +++ b/wasm-fuzzer/fuzzing-client-afl/interface.cpp @@ -68,7 +68,7 @@ void main_fuzz( pid_t forkServerPID) { //LOG("Entering"); - std::string DOCKER_LOGS = parseEnvVariables((char *)"DOCKER_LOGS"); + std::string LOGS_DIR = parseEnvVariables((char *)"LOGS_DIR"); std::string DUMMY_TESTING_AFL = parseEnvVariables((char *)"DUMMY_TESTING_AFL"); if (DUMMY_TESTING_AFL == "True") @@ -82,7 +82,7 @@ void main_fuzz( char readBuffer[AFL_SHM_SIZE + 1]; // + 1 for exit code - ///logBuffer(DOCKER_LOGS + "/interface.log", AFL_SHM_SIZE + 1, readBuffer); + ///logBuffer(LOGS_DIR + "/interface.log", AFL_SHM_SIZE + 1, readBuffer); std::string SWAM_SOCKET_HOST = parseEnvVariables((char *)"SWAM_SOCKET_HOST"); std::string SWAM_SOCKET_PORT = parseEnvVariables((char *)"SWAM_SOCKET_PORT"); diff --git a/wasm-fuzzer/fuzzing-client-afl/prepare_wasm_input.cpp b/wasm-fuzzer/fuzzing-client-afl/prepare_wasm_input.cpp index 5ba2889a..248e6c1f 100644 --- a/wasm-fuzzer/fuzzing-client-afl/prepare_wasm_input.cpp +++ b/wasm-fuzzer/fuzzing-client-afl/prepare_wasm_input.cpp @@ -94,13 +94,13 @@ int main(int argc, char *argv[]) std::string filePath = (std::string) argv[1]; clearFile(filePath); - std::string WASM_ARG_TYPES_LIST = parseEnvVariables((char *)"WASM_ARG_TYPES_LIST"); - std::string WASM_ARG_LIST = parseEnvVariables((char *)"WASM_ARG_LIST"); + std::string WASM_ARG_TYPES_CSV = parseEnvVariables((char *)"WASM_ARG_TYPES_CSV"); + std::string WASM_ARG_CSV = parseEnvVariables((char *)"WASM_ARG_CSV"); // TODO: Escape commas that are in arrays // TODO: Delete whitespaces - std::vector typeArray = split(WASM_ARG_TYPES_LIST, ','); - std::vector argArray = split(WASM_ARG_LIST, ','); + std::vector typeArray = split(WASM_ARG_TYPES_CSV, ','); + std::vector argArray = split(WASM_ARG_CSV, ','); if (typeArray.size() != argArray.size()) { diff --git a/wasm-fuzzer/fuzzing-client-afl/run_test.sh b/wasm-fuzzer/fuzzing-client-afl/run_test.sh index 8aea665f..67bedd1a 100755 --- a/wasm-fuzzer/fuzzing-client-afl/run_test.sh +++ b/wasm-fuzzer/fuzzing-client-afl/run_test.sh @@ -1,6 +1,6 @@ #!/bin/bash -# TODO: Since now all logging is to a file (using env var DOCKER_LOGS), this script cannot be run locally anymore. Fix this. +# TODO: Since now all logging is to a file (using env var LOGS_DIR), this script cannot be run locally anymore. Fix this. # For testing the integration of prepare_wasm_input.cpp and socket_client.cpp. @@ -8,13 +8,10 @@ # >> mill -i cli.run run_server --wat --argType Int64 --main naive --out ./ /Users/vincent/not_in_cloud/Codes/KTH/swam/examples/docs/fibo.wat # Configured for fibo.wat: -export WASM_ARG_TYPES_LIST=Int64 -export WASM_ARG_LIST=15 +export WASM_ARG_TYPES_CSV=Int64 +export WASM_ARG_CSV=15 mkdir -p ./cpp_out -g++ -o ./cpp_out/prepare_wasm_input.out ./prepare_wasm_input.cpp ./utils.cpp -g++ -o ./cpp_out/run_client.out ./run_client.cpp ./socket_client.cpp ./utils.cpp - ./cpp_out/prepare_wasm_input.out "./cpp_out/prepared_input.dat" ./cpp_out/run_client.out "./cpp_out/prepared_input.dat" diff --git a/wasm-fuzzer/fuzzing-client-afl/utils.cpp b/wasm-fuzzer/fuzzing-client-afl/utils.cpp index ccd03456..fc0969ed 100644 --- a/wasm-fuzzer/fuzzing-client-afl/utils.cpp +++ b/wasm-fuzzer/fuzzing-client-afl/utils.cpp @@ -21,7 +21,7 @@ LogEnum getLogLevel() } LogEnum DEFAULT_LOG_LEVEL_ENUM = getLogLevel(); -std::string DOCKER_LOGS_DIR = parseEnvVariables((char *)"DOCKER_LOGS"); +std::string LOGS_DIR = parseEnvVariables((char *)"LOGS_DIR"); void log_default(std::string someString, LogEnum log_level) { @@ -53,7 +53,7 @@ void log_default(std::string someString, LogEnum log_level) break; } } - log(DOCKER_LOGS_DIR + "/afl.log", actualLog); + log(LOGS_DIR + "/afl.log", actualLog); } void log(std::string filename, std::string someString) diff --git a/wasm-fuzzer/multi-processing.sh b/wasm-fuzzer/multi-processing.sh index 9f3ac952..9357b280 100755 --- a/wasm-fuzzer/multi-processing.sh +++ b/wasm-fuzzer/multi-processing.sh @@ -14,7 +14,6 @@ set +a echo "Running #1" docker run --env-file=./.env \ - -e SWAM_SOCKET_HOST=localhost \ -e MASTER_AFL_NODE=True \ -v maven_data:/root/.cache/coursier/v1/https/repo1.maven.org/maven2 \ -v compiled_sources:/home/server/src/out/ \ @@ -35,7 +34,6 @@ do sleep 30s echo "Running #${i}" docker run --env-file=./.env \ - -e SWAM_SOCKET_HOST=localhost \ -e MASTER_AFL_NODE=False \ -v maven_data:/root/.cache/coursier/v1/https/repo1.maven.org/maven2 \ -v compiled_sources:/home/server/src/out/ \ diff --git a/wasm-fuzzer/supervisord.conf b/wasm-fuzzer/supervisord.conf index 5a364a24..96e31b69 100644 --- a/wasm-fuzzer/supervisord.conf +++ b/wasm-fuzzer/supervisord.conf @@ -3,14 +3,14 @@ nodaemon=true user=root [program:swam_server] -command=%(ENV_DOCKER_SWAM_SRC)s/entrypoint_mill_server.sh +command=%(ENV_SRC_SWAM_DIR)s/entrypoint_mill_server.sh stdout_logfile=/dev/stdout stderr_logfile=/dev/stderr stdout_logfile_maxbytes=0 stderr_logfile_maxbytes=0 [program:afl_client] -command=%(ENV_DOCKER_INTERFACE_SRC)s/entrypoint_afl.sh +command=%(ENV_SRC_INTERFACE_DIR)s/entrypoint_afl.sh stdout_logfile=/dev/stdout stderr_logfile=/dev/stderr stdout_logfile_maxbytes=0 From a25094494902d9287b625e6a2baf156d1fe9464a Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Thu, 27 Aug 2020 19:05:07 +0200 Subject: [PATCH 13/31] Placed all directory preparations from wafl to prepare_env && placed supervisord into wafl && made entrypoint_mill_server executable by itself --- .../fuzzing-client-afl/entrypoint_afl.sh | 36 ++++---- .../entrypoint_mill_server.sh | 32 +++---- wasm-fuzzer/prepare_env.sh | 45 ++++++++++ wasm-fuzzer/wafl.sh | 84 ++----------------- 4 files changed, 87 insertions(+), 110 deletions(-) mode change 100644 => 100755 wasm-fuzzer/fuzzing-server-entry/entrypoint_mill_server.sh create mode 100755 wasm-fuzzer/prepare_env.sh diff --git a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh index 8b7e558d..da0e5196 100644 --- a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh +++ b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh @@ -1,25 +1,26 @@ #!/bin/bash -cd $DOCKER_INTERFACE_SRC +cd $SRC_INTERFACE_DIR -PREPARED_INPUT_PATH="$DOCKER_AFL_INPUT/prepared_input.dat" +PREPARED_INPUT_PATH="$INPUT_AFL_DIR/prepared_input.dat" ./prepare_wasm_input.out $PREPARED_INPUT_PATH # TODO: Remove everything related to REQUIRED_BYTES REQUIRED_BYTES=$(./getFileSize.out $PREPARED_INPUT_PATH) # Parallel fuzzing: https://github.com/mirrorer/afl/blob/master/docs/parallel_fuzzing.txt -if [[ ! -z "$MASTER_AFL_NODE" ]] -then - DOCKER_CONTAINER_ID=$(/dev/null 2>&1 && pwd )" + +# Check if inside Docker: https://stackoverflow.com/a/25518345/9068781 +if ! [ -f /.dockerenv ]; then + echo "Not inside a Docker container"; + + export SRC_INTERFACE_DIR=$CURRENT_DIR/fuzzing-client-afl + export SRC_SWAM_DIR=$CURRENT_DIR/fuzzing-server-swam + + export INPUT_AFL_DIR=$SRC_INTERFACE_DIR/$currentID + export OUTPUT_AFL_DIR=$LOCAL_AFL_OUTPUT/$currentID + + export LOGS_DIR=$LOCAL_LOGS/$currentID + + export BIN_AFL="$CURRENT_DIR/aflpp/afl-fuzz" + export SWAM_CMD="java -jar $SRC_SWAM_DIR/out/cli/assembly/dest/out.jar" + + # mkdir -p $INPUT_AFL_DIR + # mkdir -p $OUTPUT_AFL_DIR + # mkdir -p $LOGS_DIR +else + echo "Inside a Docker container - env's are pre-defined"; + SWAM_CMD='mill cli.run' +fi + +# TODO: Make this CLI-dependent +export WASI_FILTER=True +export WASI=True + +# TODO: Adjust README to add arguments to Docker run +# TODO: Check if empty +export WASM_OR_WAT_FILE=$1 +export TARGET_FUNCTION=$2 +export WASM_ARG_CSV=$3 + +export ENV_PREPARED=True diff --git a/wasm-fuzzer/wafl.sh b/wasm-fuzzer/wafl.sh index 88b40757..4fdf7d6f 100755 --- a/wasm-fuzzer/wafl.sh +++ b/wasm-fuzzer/wafl.sh @@ -1,83 +1,11 @@ -currentID=$$ +#!/bin/bash -echo "wafl ID $currentID" - -export DOCKER_INTERFACE_SRC=$(pwd)/wafl -export DOCKER_AFL_INPUT=$DOCKER_INTERFACE_SRC/in-$currentID - -export SWAM_SOCKET_PORT=9999 -export SWAM_SOCKET_HOST=0.0.0.0 -export DOCKER_AFL_OUTPUT=out-$currentID - -export REQUIRED_BYTES=4 - - -export DOCKER_LOGS=$DOCKER_INTERFACE_SRC/out - -export DUMMY_TESTING_AFL=False - - -export AFL="$(pwd)/aflpp/afl-fuzz" -export LOCAL_AFL="True" -export WASI_FILTER="True" -export WASI=True -export WITH_TIMEOUT="False" -export INFER_INIT_VALUES="True" -export INIT_VALUES_SEED="0" -export TIMEOUT=60 # 60 seconds - -mkdir -p $DOCKER_AFL_INPUT - -## Replace env variables -set -a -source .env -set +x - -if [[ $1 == *.wat ]]; then WAT_ARG="--wat"; fi -if [[ $WASI == "True" ]]; then WASI_ARG="--wasi"; fi -if [[ $WASI_FILTER == "True" ]]; then WASI_ARG="$WASI_ARG -r"; fi -if [[ $WITH_TIMEOUT == "True" ]]; then TIMEOUT="timeout --foreground $TIMEOUT"; else TIMEOUT=""; fi +./prepare_env.sh $@ +# TODO: Put this into entrypoint_afl.sh + call function directly in Scala at server startup echo "Infering signature for wasm" - -echo "java -jar fuzzing-server-swam/out/cli/assembly/dest/out.jar infer $WAT_ARG $1 $2" - - -export WASM_ARG_TYPES_LIST=$(java -jar fuzzing-server-swam/out/cli/assembly/dest/out.jar infer $WAT_ARG $1 $2) # Read from signature retriever - -echo "Running Swam" - -ALL_ARG_TYPES="" -ALL_ARG_VALUES="" -IFS=',' read -r -a array <<< "$WASM_ARG_TYPES_LIST" -for element in "${array[@]}" -do - ALL_ARG_TYPES="$ALL_ARG_TYPES --argType $element"; - # TODO init values should be provided - - if [[ $INFER_INIT_VALUES == "True" ]] - then - ALL_ARG_VALUES="$ALL_ARG_VALUES,$INIT_VALUES_SEED"; - fi - -done -ALL_ARG_VALUES=${ALL_ARG_VALUES:1} -echo "ALL_ARG_TYPES: $ALL_ARG_TYPES" -echo "ALL_ARG_INIT_VALUES: $ALL_ARG_VALUES" - -export WASM_ARG_LIST=$ALL_ARG_VALUES - -mkdir -p $DOCKER_INTERFACE_SRC/logs-$currentID - +echo "$SWAM_CMD infer $WAT_ARG $WASM_OR_WAT_FILE $TARGET_FUNCTION" +export WASM_ARG_TYPES_CSV=$($SWAM_CMD infer $WAT_ARG $WASM_OR_WAT_FILE $TARGET_FUNCTION) # Read from signature retriever pkill -f out.jar -java -jar fuzzing-server-swam/out/cli/assembly/dest/out.jar run_server $1 --main $2 $ALL_ARG_TYPES $WASI_ARG 1> $DOCKER_INTERFACE_SRC/logs-$currentID/swam.std.txt 2> $DOCKER_INTERFACE_SRC/logs-$currentID/swam.err.txt & - -swamPid=$! - -sleep 2 -echo "Running AFL fuzzing client" - -$TIMEOUT bash fuzzing-client-afl/entrypoint_afl.sh -pkill -f $swamPid -echo "Killing swam server pid $swamPid" +/usr/bin/supervisord -c ./supervisord.conf From d30dcdaf989ea04a8da5da0af0a310a3019bdc43 Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Thu, 27 Aug 2020 23:48:46 +0200 Subject: [PATCH 14/31] Added arguments to docker run; Adjusted README; Re-did .env for Docker setting --- wasm-fuzzer/.env | 22 ++++++++++++++++------ wasm-fuzzer/README.md | 13 +++++++------ wasm-fuzzer/multi-processing.sh | 32 ++++++++++++++++---------------- 3 files changed, 39 insertions(+), 28 deletions(-) diff --git a/wasm-fuzzer/.env b/wasm-fuzzer/.env index 56464fcd..557887f1 100644 --- a/wasm-fuzzer/.env +++ b/wasm-fuzzer/.env @@ -4,15 +4,25 @@ DUMMY_TESTING_AFL=False # Enum: ERROR, WARNING, INFO, DEBUG LOG_LEVEL=INFO +# Filter out WASI coverage +WASI_FILTER=True + +######################################## +##### Necessary for Docker volumes ##### +######################################## + # Path on our local machine for us to read AFL's output -LOCAL_AFL_OUTPUT=/tmp/afl_out +LOCAL_AFL_OUTPUT_DIR=/tmp/afl_out # Path on our local machine for us to read our own logs -LOCAL_LOGS=/tmp/fuzzer/fuzzerlogs +LOCAL_LOGS_DIR=/tmp/fuzzer/fuzzerlogs + +# Path on our local machine where wasm/wat file is located +LOCAL_WASM_DIR=/tmp/wasm + +############################# +##### No need to change ##### +############################# -##### No need to change: ##### SWAM_SOCKET_HOST=localhost SWAM_SOCKET_PORT=9999 - -# Filter out WASI -WASI_FILTER=True diff --git a/wasm-fuzzer/README.md b/wasm-fuzzer/README.md index a636496e..32360dce 100644 --- a/wasm-fuzzer/README.md +++ b/wasm-fuzzer/README.md @@ -110,13 +110,14 @@ docker build -t wafl . 3. Run the Docker image. ```bash - docker run --rm --env-file=./.env \ + docker run --env-file=./.env \ -v maven_data:/root/.cache/coursier/v1/https/repo1.maven.org/maven2 \ -v compiled_sources:/home/server/src/out/ \ - -v ${LOCAL_WASM:?err}:/home/server/wasm/ \ - -v ${LOCAL_AFL_OUTPUT:?err}:/home/client/out/ \ - -v ${LOCAL_LOGS:?err}:/home/shared/logs/ \ - wafl:latest + -v ${LOCAL_WASM_DIR:?err}:/home/server/wasm/ \ + -v ${LOCAL_AFL_OUTPUT_DIR:?err}:/home/client/out/ \ + -v ${LOCAL_LOGS_DIR:?err}:/home/shared/logs/ \ + wafl:latest \ + <.wasm/.wat filename> ``` ### Multi-processing @@ -125,7 +126,7 @@ AFLplusplus is encouraged to be run with multiple instances if multiple cores ar ```bash # 3 for the number of AFL instances. -./multi-processing.sh 3 +./multi-processing.sh 3 <.wasm/.wat filename> ``` ## Building & running without Docker diff --git a/wasm-fuzzer/multi-processing.sh b/wasm-fuzzer/multi-processing.sh index 9357b280..66070dd7 100755 --- a/wasm-fuzzer/multi-processing.sh +++ b/wasm-fuzzer/multi-processing.sh @@ -1,7 +1,6 @@ #!/bin/bash -if [ -z "$1" ] -then +if [ -z "$1" ]; then echo "Specifiy the number of AFL instances as argument!" exit 1 fi @@ -12,35 +11,36 @@ set -a source ./.env set +a +mkdir -p $LOCAL_WASM_DIR +mkdir -p $LOCAL_AFL_OUTPUT_DIR +mkdir -p $LOCAL_LOGS_DIR/1 + echo "Running #1" docker run --env-file=./.env \ -e MASTER_AFL_NODE=True \ -v maven_data:/root/.cache/coursier/v1/https/repo1.maven.org/maven2 \ -v compiled_sources:/home/server/src/out/ \ - -v ${LOCAL_WASM:?err}:/home/server/wasm/ \ - -v ${LOCAL_AFL_OUTPUT:?err}:/home/client/out/ \ - -v ${LOCAL_LOGS:?err}:/home/shared/logs/ \ - -d \ - slumps/wafl:latest + -v ${LOCAL_WASM_DIR:?err}:/home/server/wasm/ \ + -v ${LOCAL_AFL_OUTPUT_DIR:?err}:/home/client/out/ \ + -v ${LOCAL_LOGS_DIR:?err}/1:/home/shared/logs/ \ + -d slumps/wafl:latest $2 $3 $4 -if [ $1 -lt 2 ] -then +if [ $1 -lt 2 ]; then exit 0 fi -for i in $(seq 2 $1) -do +for i in $(seq 2 $1); do echo "Waiting for previous mill server to compile..." sleep 30s + mkdir -p $LOCAL_LOGS_DIR/${i} echo "Running #${i}" docker run --env-file=./.env \ -e MASTER_AFL_NODE=False \ -v maven_data:/root/.cache/coursier/v1/https/repo1.maven.org/maven2 \ -v compiled_sources:/home/server/src/out/ \ - -v ${LOCAL_WASM:?err}:/home/server/wasm/ \ - -v ${LOCAL_AFL_OUTPUT:?err}:/home/client/out/ \ - -v ${LOCAL_LOGS:?err}:/home/shared/logs/ \ - -d \ - slumps/wafl:latest + -v ${LOCAL_WASM_DIR:?err}:/home/server/wasm/ \ + -v ${LOCAL_AFL_OUTPUT_DIR:?err}:/home/client/out/ \ + -v ${LOCAL_LOGS_DIR:?err}/${i}:/home/shared/logs/ \ + -d slumps/wafl:latest $2 $3 $4 done exit 0 From 9f1270fd3946a64a6484deb0c06029c58120ce18 Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Thu, 27 Aug 2020 23:50:55 +0200 Subject: [PATCH 15/31] Using default temp DIR when running locally; Also parsing arguments when in Docker --- .../fuzzing-client-afl/entrypoint_afl.sh | 7 +++--- wasm-fuzzer/prepare_env.sh | 23 ++++++++++++------- 2 files changed, 18 insertions(+), 12 deletions(-) diff --git a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh index da0e5196..1b9f6149 100644 --- a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh +++ b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh @@ -2,11 +2,10 @@ cd $SRC_INTERFACE_DIR -PREPARED_INPUT_PATH="$INPUT_AFL_DIR/prepared_input.dat" -./prepare_wasm_input.out $PREPARED_INPUT_PATH +./prepare_wasm_input.out "$INPUT_AFL_DIR/prepared_input.dat" # TODO: Remove everything related to REQUIRED_BYTES -REQUIRED_BYTES=$(./getFileSize.out $PREPARED_INPUT_PATH) +REQUIRED_BYTES=$(./getFileSize.out $INPUT_AFL_DIR/prepared_input.dat) # Parallel fuzzing: https://github.com/mirrorer/afl/blob/master/docs/parallel_fuzzing.txt # TODO: Refactor this to work in non-Docker environment as well @@ -40,4 +39,4 @@ fi echo "$BIN_AFL -i $INPUT_AFL_DIR -o $OUTPUT_AFL_DIR $RANK -d -- ${SRC_INTERFACE_DIR}/interface.out @@ $REQUIRED_BYTES" -$BIN_AFL -i "$INPUT_AFL_DIR" -o $OUTPUT_AFL_DIR $RANK -t 12000 -d -- "${SRC_INTERFACE_DIR}/interface.out" @@ $REQUIRED_BYTES +$BIN_AFL -i "$INPUT_AFL_DIR" -o $OUTPUT_AFL_DIR $RANK -d -- "${SRC_INTERFACE_DIR}/interface.out" @@ $REQUIRED_BYTES diff --git a/wasm-fuzzer/prepare_env.sh b/wasm-fuzzer/prepare_env.sh index ab3e5abd..1e77af4f 100755 --- a/wasm-fuzzer/prepare_env.sh +++ b/wasm-fuzzer/prepare_env.sh @@ -13,23 +13,31 @@ CURRENT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" if ! [ -f /.dockerenv ]; then echo "Not inside a Docker container"; + TEMP_DIR=$CURRENT_DIR/wafl-temp + export SRC_INTERFACE_DIR=$CURRENT_DIR/fuzzing-client-afl export SRC_SWAM_DIR=$CURRENT_DIR/fuzzing-server-swam - export INPUT_AFL_DIR=$SRC_INTERFACE_DIR/$currentID - export OUTPUT_AFL_DIR=$LOCAL_AFL_OUTPUT/$currentID + export INPUT_AFL_DIR=$TEMP_DIR/afl-input/$currentID + export OUTPUT_AFL_DIR=$TEMP_DIR/afl-output/$currentID + + export LOGS_DIR=$TEMP_DIR/logs/$currentID - export LOGS_DIR=$LOCAL_LOGS/$currentID + export WASM_OR_WAT_FILE=$1 export BIN_AFL="$CURRENT_DIR/aflpp/afl-fuzz" export SWAM_CMD="java -jar $SRC_SWAM_DIR/out/cli/assembly/dest/out.jar" - # mkdir -p $INPUT_AFL_DIR - # mkdir -p $OUTPUT_AFL_DIR - # mkdir -p $LOGS_DIR + mkdir -p $INPUT_AFL_DIR + mkdir -p $OUTPUT_AFL_DIR + mkdir -p $LOGS_DIR else echo "Inside a Docker container - env's are pre-defined"; - SWAM_CMD='mill cli.run' + + # Get filename from $1 + export WASM_OR_WAT_FILE=$WASM_DIR/$(basename $1) + + export SWAM_CMD='mill cli.run' fi # TODO: Make this CLI-dependent @@ -38,7 +46,6 @@ export WASI=True # TODO: Adjust README to add arguments to Docker run # TODO: Check if empty -export WASM_OR_WAT_FILE=$1 export TARGET_FUNCTION=$2 export WASM_ARG_CSV=$3 From ab62b5c6a7fa225a53a8809a0a721be7bba587a4 Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Thu, 27 Aug 2020 23:55:22 +0200 Subject: [PATCH 16/31] Uncommented multi-processing again --- .../fuzzing-client-afl/entrypoint_afl.sh | 22 +++++++++---------- wasm-fuzzer/prepare_env.sh | 1 - 2 files changed, 11 insertions(+), 12 deletions(-) diff --git a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh index 1b9f6149..f7b6c612 100644 --- a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh +++ b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh @@ -9,17 +9,17 @@ REQUIRED_BYTES=$(./getFileSize.out $INPUT_AFL_DIR/prepared_input.dat) # Parallel fuzzing: https://github.com/mirrorer/afl/blob/master/docs/parallel_fuzzing.txt # TODO: Refactor this to work in non-Docker environment as well -# if [[ ! -z "$MASTER_AFL_NODE" ]] -# then -# DOCKER_CONTAINER_ID=$( Date: Fri, 28 Aug 2020 00:33:29 +0200 Subject: [PATCH 17/31] Moved all cpp_out into wafl-temp folder --- .gitignore | 4 +--- wasm-fuzzer/Dockerfile | 10 ++++++---- wasm-fuzzer/build.sh | 16 +++++++++------- wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh | 4 ++-- wasm-fuzzer/prepare_env.sh | 10 ++++++++-- 5 files changed, 26 insertions(+), 18 deletions(-) diff --git a/.gitignore b/.gitignore index 042b9fda..9c5dca46 100644 --- a/.gitignore +++ b/.gitignore @@ -31,9 +31,7 @@ traces utils/reports ### Wasm-Fuzzer ### -wasm-fuzzer/fuzzing-client-afl/afl_out -wasm-fuzzer/fuzzing-client-afl/cpp_out -wasm-fuzzer/logs/* +wasm-fuzzer/wafl-temp/* *.log *.log.txt \ No newline at end of file diff --git a/wasm-fuzzer/Dockerfile b/wasm-fuzzer/Dockerfile index cf5a654b..77ade53d 100644 --- a/wasm-fuzzer/Dockerfile +++ b/wasm-fuzzer/Dockerfile @@ -55,21 +55,23 @@ RUN chmod +x $SRC_SWAM_DIR/entrypoint_mill_server.sh ############################# ENV SRC_INTERFACE_DIR=/home/client/interface +ENV OUT_INTERFACE_DIR=/home/client/interface/cpp_out ENV INPUT_AFL_DIR=/home/client/in ENV OUTPUT_AFL_DIR=/home/client/out # Create the appropriate directories RUN mkdir -p $SRC_INTERFACE_DIR +RUN mkdir -p $OUT_INTERFACE_DIR RUN mkdir -p $INPUT_AFL_DIR RUN mkdir -p $OUTPUT_AFL_DIR WORKDIR $SRC_INTERFACE_DIR ADD ./fuzzing-client-afl $SRC_INTERFACE_DIR -RUN g++ -o ./prepare_wasm_input.out ./prepare_wasm_input.cpp ./utils.cpp -RUN g++ -o ./getFileSize.out ./getFileSize.cpp ./utils.cpp -RUN g++ -o ./wait_for_server.out ./wait_for_server.cpp ./utils.cpp ./socket_client.cpp -RUN g++ -o ./interface.out ./interface.cpp ./socket_client.cpp ./utils.cpp +RUN g++ -o $OUT_INTERFACE_DIR/prepare_wasm_input.out ./prepare_wasm_input.cpp ./utils.cpp +RUN g++ -o $OUT_INTERFACE_DIR/getFileSize.out ./getFileSize.cpp ./utils.cpp +RUN g++ -o $OUT_INTERFACE_DIR/wait_for_server.out ./wait_for_server.cpp ./utils.cpp ./socket_client.cpp +RUN g++ -o $OUT_INTERFACE_DIR/interface.out ./interface.cpp ./socket_client.cpp ./utils.cpp RUN chmod +x $SRC_INTERFACE_DIR/entrypoint_afl.sh diff --git a/wasm-fuzzer/build.sh b/wasm-fuzzer/build.sh index 912b18f6..a3581557 100755 --- a/wasm-fuzzer/build.sh +++ b/wasm-fuzzer/build.sh @@ -31,12 +31,14 @@ fi echo "Building the wafl interface..." -mkdir -p wafl - -g++ -o wafl/prepare_wasm_input.out ./fuzzing-client-afl/prepare_wasm_input.cpp ./fuzzing-client-afl/utils.cpp -g++ -o wafl/getFileSize.out ./fuzzing-client-afl/getFileSize.cpp ./fuzzing-client-afl/utils.cpp -g++ -o wafl/wait_for_server.out ./fuzzing-client-afl/wait_for_server.cpp ./fuzzing-client-afl/utils.cpp ./fuzzing-client-afl/socket_client.cpp -g++ -o wafl/run_client.out ./fuzzing-client-aflrun_client.cpp ./socket_client.cpp ./utils.cpp -g++ -o wafl/interface.out ./fuzzing-client-afl/interface.cpp ./fuzzing-client-afl/socket_client.cpp ./fuzzing-client-afl/utils.cpp +mkdir -p $CURRENT_DIR/wafl-temp +CPP_OUT_DIR=$CURRENT_DIR/wafl-temp/cpp-out +mkdir -p $CPP_OUT_DIR + +g++ -o $CPP_OUT_DIR/prepare_wasm_input.out ./fuzzing-client-afl/prepare_wasm_input.cpp ./fuzzing-client-afl/utils.cpp +g++ -o $CPP_OUT_DIR/getFileSize.out ./fuzzing-client-afl/getFileSize.cpp ./fuzzing-client-afl/utils.cpp +g++ -o $CPP_OUT_DIR/wait_for_server.out ./fuzzing-client-afl/wait_for_server.cpp ./fuzzing-client-afl/utils.cpp ./fuzzing-client-afl/socket_client.cpp +g++ -o $CPP_OUT_DIR/run_client.out ./fuzzing-client-aflrun_client.cpp ./socket_client.cpp ./utils.cpp +g++ -o $CPP_OUT_DIR/interface.out ./fuzzing-client-afl/interface.cpp ./fuzzing-client-afl/socket_client.cpp ./fuzzing-client-afl/utils.cpp echo "DONE !" \ No newline at end of file diff --git a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh index f7b6c612..4c94c2c4 100644 --- a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh +++ b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh @@ -38,5 +38,5 @@ fi # traditional fuzzers - add the -d option to the command line. -echo "$BIN_AFL -i $INPUT_AFL_DIR -o $OUTPUT_AFL_DIR $RANK -d -- ${SRC_INTERFACE_DIR}/interface.out @@ $REQUIRED_BYTES" -$BIN_AFL -i "$INPUT_AFL_DIR" -o $OUTPUT_AFL_DIR $RANK -d -- "${SRC_INTERFACE_DIR}/interface.out" @@ $REQUIRED_BYTES +echo "$BIN_AFL -i $INPUT_AFL_DIR -o $OUTPUT_AFL_DIR $RANK -d -- ${OUT_INTERFACE_DIR}/interface.out @@ $REQUIRED_BYTES" +$BIN_AFL -i "$INPUT_AFL_DIR" -o $OUTPUT_AFL_DIR $RANK -d -- "${OUT_INTERFACE_DIR}/interface.out" @@ $REQUIRED_BYTES diff --git a/wasm-fuzzer/prepare_env.sh b/wasm-fuzzer/prepare_env.sh index 1dbe84e0..155ff93b 100755 --- a/wasm-fuzzer/prepare_env.sh +++ b/wasm-fuzzer/prepare_env.sh @@ -15,11 +15,17 @@ if ! [ -f /.dockerenv ]; then TEMP_DIR=$CURRENT_DIR/wafl-temp + mkdir -p $TEMP_DIR/afl-in + mkdir -p $TEMP_DIR/afl-out + mkdir -p $TEMP_DIR/logs + export SRC_INTERFACE_DIR=$CURRENT_DIR/fuzzing-client-afl export SRC_SWAM_DIR=$CURRENT_DIR/fuzzing-server-swam - export INPUT_AFL_DIR=$TEMP_DIR/afl-input/$currentID - export OUTPUT_AFL_DIR=$TEMP_DIR/afl-output/$currentID + export OUT_INTERFACE_DIR=$TEMP_DIR/cpp-out + + export INPUT_AFL_DIR=$TEMP_DIR/afl-in/$currentID + export OUTPUT_AFL_DIR=$TEMP_DIR/afl-out/$currentID export LOGS_DIR=$TEMP_DIR/logs/$currentID From d9f99f01efc46a6575d9b8cc224c547e5607c066 Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Fri, 28 Aug 2020 00:45:20 +0200 Subject: [PATCH 18/31] Sourcing prepare_env.sh --- wasm-fuzzer/wafl.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wasm-fuzzer/wafl.sh b/wasm-fuzzer/wafl.sh index 4fdf7d6f..4c4cc7e3 100755 --- a/wasm-fuzzer/wafl.sh +++ b/wasm-fuzzer/wafl.sh @@ -1,6 +1,6 @@ #!/bin/bash -./prepare_env.sh $@ +source ./prepare_env.sh $@ # TODO: Put this into entrypoint_afl.sh + call function directly in Scala at server startup echo "Infering signature for wasm" From fe12ffe34a0af2e482324bf4944a8b4fc97addcd Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Fri, 28 Aug 2020 13:53:17 +0200 Subject: [PATCH 19/31] Fixed supervisord path in Dockerfile --- wasm-fuzzer/.dockerignore | 3 ++- wasm-fuzzer/Dockerfile | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/wasm-fuzzer/.dockerignore b/wasm-fuzzer/.dockerignore index 0ccb0e5f..c8aa20be 100644 --- a/wasm-fuzzer/.dockerignore +++ b/wasm-fuzzer/.dockerignore @@ -1,2 +1,3 @@ *.out -*.dat \ No newline at end of file +*.dat +./fuzzing-server-swam/out diff --git a/wasm-fuzzer/Dockerfile b/wasm-fuzzer/Dockerfile index 77ade53d..779405a3 100644 --- a/wasm-fuzzer/Dockerfile +++ b/wasm-fuzzer/Dockerfile @@ -9,6 +9,7 @@ FROM aflplusplus/aflplusplus RUN yes | apt-get install curl RUN apt-get update RUN DEBIAN_FRONTEND="noninteractive" apt-get -y install tzdata wget +RUN apt-get update RUN yes | apt-get install software-properties-common RUN apt-get update RUN yes | add-apt-repository ppa:openjdk-r/ppa @@ -83,9 +84,11 @@ ENV LOGS_DIR=/home/shared/logs RUN mkdir -p $LOGS_DIR -ADD supervisord.conf /etc/supervisor/conf.d/supervisord.conf +ADD supervisord.conf /home/supervisord.conf ADD wafl.sh /home/wafl.sh +ADD prepare_env.sh /home/prepare_env.sh RUN chmod +x /home/wafl.sh +RUN chmod +x /home/prepare_env.sh ENTRYPOINT ["/home/wafl.sh"] From 94d80ae705e7c1ef7dfc26154a80e030f8b108d1 Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Fri, 28 Aug 2020 13:53:55 +0200 Subject: [PATCH 20/31] Changed SWAM_CMD --- wasm-fuzzer/prepare_env.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/wasm-fuzzer/prepare_env.sh b/wasm-fuzzer/prepare_env.sh index 155ff93b..7d9e1f2a 100755 --- a/wasm-fuzzer/prepare_env.sh +++ b/wasm-fuzzer/prepare_env.sh @@ -42,8 +42,8 @@ else # Get filename from $1 export WASM_OR_WAT_FILE=$WASM_DIR/$(basename $1) - - export SWAM_CMD='mill cli.run' + # export SWAM_CMD='mill cli.run' + export SWAM_CMD="java -jar $SRC_SWAM_DIR/cli-0.6.0-RC3.jar" fi # TODO: Make this CLI-dependent From 96a9b891062d456cf509dcd1705d4c922bbf8759 Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Fri, 28 Aug 2020 13:54:21 +0200 Subject: [PATCH 21/31] Adjusted references to files --- wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh | 6 +++--- wasm-fuzzer/wafl.sh | 6 ++++-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh index 4c94c2c4..ce299be9 100644 --- a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh +++ b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh @@ -2,10 +2,10 @@ cd $SRC_INTERFACE_DIR -./prepare_wasm_input.out "$INPUT_AFL_DIR/prepared_input.dat" +$OUT_INTERFACE_DIR/prepare_wasm_input.out "$INPUT_AFL_DIR/prepared_input.dat" # TODO: Remove everything related to REQUIRED_BYTES -REQUIRED_BYTES=$(./getFileSize.out $INPUT_AFL_DIR/prepared_input.dat) +REQUIRED_BYTES=$($OUT_INTERFACE_DIR/getFileSize.out $INPUT_AFL_DIR/prepared_input.dat) # Parallel fuzzing: https://github.com/mirrorer/afl/blob/master/docs/parallel_fuzzing.txt # TODO: Refactor this to work in non-Docker environment as well @@ -21,7 +21,7 @@ then fi fi -./wait_for_server.out +$OUT_INTERFACE_DIR/wait_for_server.out if [ $? != 0 ]; then exit 1 diff --git a/wasm-fuzzer/wafl.sh b/wasm-fuzzer/wafl.sh index 4c4cc7e3..6a4a0211 100755 --- a/wasm-fuzzer/wafl.sh +++ b/wasm-fuzzer/wafl.sh @@ -1,6 +1,8 @@ #!/bin/bash -source ./prepare_env.sh $@ +CURRENT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" + +source ${CURRENT_DIR}/prepare_env.sh $@ # TODO: Put this into entrypoint_afl.sh + call function directly in Scala at server startup echo "Infering signature for wasm" @@ -8,4 +10,4 @@ echo "$SWAM_CMD infer $WAT_ARG $WASM_OR_WAT_FILE $TARGET_FUNCTION" export WASM_ARG_TYPES_CSV=$($SWAM_CMD infer $WAT_ARG $WASM_OR_WAT_FILE $TARGET_FUNCTION) # Read from signature retriever pkill -f out.jar -/usr/bin/supervisord -c ./supervisord.conf +exec /usr/bin/supervisord -c ${CURRENT_DIR}/supervisord.conf From 22bca93a32a7620bc1660a075304e92fc906111a Mon Sep 17 00:00:00 2001 From: Jacarte Date: Fri, 28 Aug 2020 13:56:45 +0200 Subject: [PATCH 22/31] SWAM in master branch --- wasm-fuzzer/build.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wasm-fuzzer/build.sh b/wasm-fuzzer/build.sh index a3581557..0a40fb2a 100755 --- a/wasm-fuzzer/build.sh +++ b/wasm-fuzzer/build.sh @@ -4,7 +4,7 @@ CURRENT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" echo "Cloning SWAM" if [ ! -d fuzzing-server-swam ]; then - git clone --single-branch --branch feature/swam-server https://github.com/KTH/swam.git fuzzing-server-swam + git clone --single-branch --branch master https://github.com/KTH/swam.git fuzzing-server-swam fi echo "Building SWAM" From 6382e454ea037949de14be5e5b756fdc306099fa Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Fri, 28 Aug 2020 13:59:07 +0200 Subject: [PATCH 23/31] Fixed Code references in build.sh --- wasm-fuzzer/build.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wasm-fuzzer/build.sh b/wasm-fuzzer/build.sh index a3581557..9ba9b688 100755 --- a/wasm-fuzzer/build.sh +++ b/wasm-fuzzer/build.sh @@ -38,7 +38,7 @@ mkdir -p $CPP_OUT_DIR g++ -o $CPP_OUT_DIR/prepare_wasm_input.out ./fuzzing-client-afl/prepare_wasm_input.cpp ./fuzzing-client-afl/utils.cpp g++ -o $CPP_OUT_DIR/getFileSize.out ./fuzzing-client-afl/getFileSize.cpp ./fuzzing-client-afl/utils.cpp g++ -o $CPP_OUT_DIR/wait_for_server.out ./fuzzing-client-afl/wait_for_server.cpp ./fuzzing-client-afl/utils.cpp ./fuzzing-client-afl/socket_client.cpp -g++ -o $CPP_OUT_DIR/run_client.out ./fuzzing-client-aflrun_client.cpp ./socket_client.cpp ./utils.cpp +g++ -o $CPP_OUT_DIR/run_client.out ./fuzzing-client-afl/run_client.cpp ./fuzzing-client-afl/socket_client.cpp ./fuzzing-client-afl/utils.cpp g++ -o $CPP_OUT_DIR/interface.out ./fuzzing-client-afl/interface.cpp ./fuzzing-client-afl/socket_client.cpp ./fuzzing-client-afl/utils.cpp echo "DONE !" \ No newline at end of file From 34fc295b99e9d57b01c2cdf20bd8f64bbe538670 Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Fri, 28 Aug 2020 14:23:30 +0200 Subject: [PATCH 24/31] Using pwd for mounting Docker volumes --- wasm-fuzzer/.env | 6 ------ wasm-fuzzer/README.md | 4 ++-- wasm-fuzzer/multi-processing.sh | 8 ++++---- 3 files changed, 6 insertions(+), 12 deletions(-) diff --git a/wasm-fuzzer/.env b/wasm-fuzzer/.env index 557887f1..53105208 100644 --- a/wasm-fuzzer/.env +++ b/wasm-fuzzer/.env @@ -11,12 +11,6 @@ WASI_FILTER=True ##### Necessary for Docker volumes ##### ######################################## -# Path on our local machine for us to read AFL's output -LOCAL_AFL_OUTPUT_DIR=/tmp/afl_out - -# Path on our local machine for us to read our own logs -LOCAL_LOGS_DIR=/tmp/fuzzer/fuzzerlogs - # Path on our local machine where wasm/wat file is located LOCAL_WASM_DIR=/tmp/wasm diff --git a/wasm-fuzzer/README.md b/wasm-fuzzer/README.md index 32360dce..679574c5 100644 --- a/wasm-fuzzer/README.md +++ b/wasm-fuzzer/README.md @@ -114,8 +114,8 @@ docker build -t wafl . -v maven_data:/root/.cache/coursier/v1/https/repo1.maven.org/maven2 \ -v compiled_sources:/home/server/src/out/ \ -v ${LOCAL_WASM_DIR:?err}:/home/server/wasm/ \ - -v ${LOCAL_AFL_OUTPUT_DIR:?err}:/home/client/out/ \ - -v ${LOCAL_LOGS_DIR:?err}:/home/shared/logs/ \ + -v ${pwd}/afl-out:/home/client/out/ \ + -v ${pwd}/logs:/home/shared/logs/ \ wafl:latest \ <.wasm/.wat filename> ``` diff --git a/wasm-fuzzer/multi-processing.sh b/wasm-fuzzer/multi-processing.sh index 66070dd7..7979dd3a 100755 --- a/wasm-fuzzer/multi-processing.sh +++ b/wasm-fuzzer/multi-processing.sh @@ -21,8 +21,8 @@ docker run --env-file=./.env \ -v maven_data:/root/.cache/coursier/v1/https/repo1.maven.org/maven2 \ -v compiled_sources:/home/server/src/out/ \ -v ${LOCAL_WASM_DIR:?err}:/home/server/wasm/ \ - -v ${LOCAL_AFL_OUTPUT_DIR:?err}:/home/client/out/ \ - -v ${LOCAL_LOGS_DIR:?err}/1:/home/shared/logs/ \ + -v ${pwd}/afl-out:/home/client/out/ \ + -v ${pwd}/logs/1:/home/shared/logs/ \ -d slumps/wafl:latest $2 $3 $4 if [ $1 -lt 2 ]; then @@ -39,8 +39,8 @@ for i in $(seq 2 $1); do -v maven_data:/root/.cache/coursier/v1/https/repo1.maven.org/maven2 \ -v compiled_sources:/home/server/src/out/ \ -v ${LOCAL_WASM_DIR:?err}:/home/server/wasm/ \ - -v ${LOCAL_AFL_OUTPUT_DIR:?err}:/home/client/out/ \ - -v ${LOCAL_LOGS_DIR:?err}/${i}:/home/shared/logs/ \ + -v ${pwd}/afl-out:/home/client/out/ \ + -v ${pwd}/logs/${i}:/home/shared/logs/ \ -d slumps/wafl:latest $2 $3 $4 done exit 0 From 9b77e6eff6bddbe3ffc7de0c904be30773c0b909 Mon Sep 17 00:00:00 2001 From: Jacarte Date: Fri, 28 Aug 2020 14:25:50 +0200 Subject: [PATCH 25/31] HOTFIX: build script looking for server-wasm swam --- wasm-fuzzer/build.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wasm-fuzzer/build.sh b/wasm-fuzzer/build.sh index 06117527..16573c43 100755 --- a/wasm-fuzzer/build.sh +++ b/wasm-fuzzer/build.sh @@ -4,7 +4,7 @@ CURRENT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" echo "Cloning SWAM" if [ ! -d fuzzing-server-swam ]; then - git clone --single-branch --branch master https://github.com/KTH/swam.git fuzzing-server-swam + git clone --single-branch --branch master https://github.com/KTH/swam.git master fi echo "Building SWAM" From 3ed56bb3a712f1b13a52e09f66fcb029688358f5 Mon Sep 17 00:00:00 2001 From: Jacarte Date: Fri, 28 Aug 2020 15:14:28 +0200 Subject: [PATCH 26/31] FIX --- wasm-fuzzer/fuzzing-server-entry/entrypoint_mill_server.sh | 2 +- wasm-fuzzer/prepare_env.sh | 4 +++- wasm-fuzzer/wafl.sh | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/wasm-fuzzer/fuzzing-server-entry/entrypoint_mill_server.sh b/wasm-fuzzer/fuzzing-server-entry/entrypoint_mill_server.sh index 97037f5b..56c67ea2 100755 --- a/wasm-fuzzer/fuzzing-server-entry/entrypoint_mill_server.sh +++ b/wasm-fuzzer/fuzzing-server-entry/entrypoint_mill_server.sh @@ -5,7 +5,7 @@ # TODO: Put this into entrypoint_afl.sh as well as soon as the server infers the signature itself. # So that this script can be run by itself as # well (same commands as wafl.sh) -if [[ ENV_PREPARED != "True" ]]; then +if [[ $ENV_PREPARED != "True" ]]; then echo "Preparing environment!" source ../prepare_env.sh $@ fi diff --git a/wasm-fuzzer/prepare_env.sh b/wasm-fuzzer/prepare_env.sh index 7d9e1f2a..1a2f20ee 100755 --- a/wasm-fuzzer/prepare_env.sh +++ b/wasm-fuzzer/prepare_env.sh @@ -4,7 +4,7 @@ currentID=$$ echo "wafl ID $currentID" set -a -source ../.env +source .env set +a CURRENT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" @@ -21,6 +21,8 @@ if ! [ -f /.dockerenv ]; then export SRC_INTERFACE_DIR=$CURRENT_DIR/fuzzing-client-afl export SRC_SWAM_DIR=$CURRENT_DIR/fuzzing-server-swam + export SRC_SWAM_DIR=$CURRENT_DIR/fuzzing-server-swam + export OUT_INTERFACE_DIR=$TEMP_DIR/cpp-out diff --git a/wasm-fuzzer/wafl.sh b/wasm-fuzzer/wafl.sh index 6a4a0211..48446c4e 100755 --- a/wasm-fuzzer/wafl.sh +++ b/wasm-fuzzer/wafl.sh @@ -10,4 +10,5 @@ echo "$SWAM_CMD infer $WAT_ARG $WASM_OR_WAT_FILE $TARGET_FUNCTION" export WASM_ARG_TYPES_CSV=$($SWAM_CMD infer $WAT_ARG $WASM_OR_WAT_FILE $TARGET_FUNCTION) # Read from signature retriever pkill -f out.jar -exec /usr/bin/supervisord -c ${CURRENT_DIR}/supervisord.conf +SUPERVISORD_BIN=$(which supervisord) +exec $SUPERVISORD_BIN -c ${CURRENT_DIR}/supervisord.conf From 201b65f9e47b152784ab57cb75cabd57d457ca34 Mon Sep 17 00:00:00 2001 From: Jacarte Date: Fri, 28 Aug 2020 15:25:45 +0200 Subject: [PATCH 27/31] FIX: Fixing mill-server-entrypoint script with logs --- wasm-fuzzer/build.sh | 2 +- .../{fuzzing-server-entry => }/entrypoint_mill_server.sh | 2 +- wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh | 0 wasm-fuzzer/prepare_env.sh | 1 - wasm-fuzzer/supervisord.conf | 4 ++-- 5 files changed, 4 insertions(+), 5 deletions(-) rename wasm-fuzzer/{fuzzing-server-entry => }/entrypoint_mill_server.sh (92%) mode change 100644 => 100755 wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh diff --git a/wasm-fuzzer/build.sh b/wasm-fuzzer/build.sh index 16573c43..06117527 100755 --- a/wasm-fuzzer/build.sh +++ b/wasm-fuzzer/build.sh @@ -4,7 +4,7 @@ CURRENT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" echo "Cloning SWAM" if [ ! -d fuzzing-server-swam ]; then - git clone --single-branch --branch master https://github.com/KTH/swam.git master + git clone --single-branch --branch master https://github.com/KTH/swam.git fuzzing-server-swam fi echo "Building SWAM" diff --git a/wasm-fuzzer/fuzzing-server-entry/entrypoint_mill_server.sh b/wasm-fuzzer/entrypoint_mill_server.sh similarity index 92% rename from wasm-fuzzer/fuzzing-server-entry/entrypoint_mill_server.sh rename to wasm-fuzzer/entrypoint_mill_server.sh index 56c67ea2..8c48c838 100755 --- a/wasm-fuzzer/fuzzing-server-entry/entrypoint_mill_server.sh +++ b/wasm-fuzzer/entrypoint_mill_server.sh @@ -30,4 +30,4 @@ cd $SRC_SWAM_DIR LOGGING_ARG="1> $LOGS_DIR/swam.std.txt 2> $LOGS_DIR/swam.err.txt &" echo "$SWAM_CMD run_server $WASM_OR_WAT_FILE --main $TARGET_FUNCTION $WAT_ARG $WASI_ARG $ALL_ARG_TYPES $LOGGING_ARG" -exec $SWAM_CMD run_server $WASM_OR_WAT_FILE --main $TARGET_FUNCTION $WAT_ARG $WASI_ARG $ALL_ARG_TYPES $LOGGING_ARG +exec $SWAM_CMD run_server $WASM_OR_WAT_FILE --main $TARGET_FUNCTION $WAT_ARG $WASI_ARG $ALL_ARG_TYPES 1> $LOGS_DIR/swam.std.txt 2> $LOGS_DIR/swam.err.txt diff --git a/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh b/wasm-fuzzer/fuzzing-client-afl/entrypoint_afl.sh old mode 100644 new mode 100755 diff --git a/wasm-fuzzer/prepare_env.sh b/wasm-fuzzer/prepare_env.sh index 1a2f20ee..ec269e9d 100755 --- a/wasm-fuzzer/prepare_env.sh +++ b/wasm-fuzzer/prepare_env.sh @@ -21,7 +21,6 @@ if ! [ -f /.dockerenv ]; then export SRC_INTERFACE_DIR=$CURRENT_DIR/fuzzing-client-afl export SRC_SWAM_DIR=$CURRENT_DIR/fuzzing-server-swam - export SRC_SWAM_DIR=$CURRENT_DIR/fuzzing-server-swam export OUT_INTERFACE_DIR=$TEMP_DIR/cpp-out diff --git a/wasm-fuzzer/supervisord.conf b/wasm-fuzzer/supervisord.conf index 96e31b69..884f65df 100644 --- a/wasm-fuzzer/supervisord.conf +++ b/wasm-fuzzer/supervisord.conf @@ -1,9 +1,9 @@ [supervisord] nodaemon=true -user=root +user=root # Check if this is needed in docker remove otherwise [program:swam_server] -command=%(ENV_SRC_SWAM_DIR)s/entrypoint_mill_server.sh +command=%(ENV_SRC_SWAM_DIR)s/../entrypoint_mill_server.sh stdout_logfile=/dev/stdout stderr_logfile=/dev/stderr stdout_logfile_maxbytes=0 From 201addd76df166db763b3dba53ae5da41e1fd44d Mon Sep 17 00:00:00 2001 From: Jacarte Date: Fri, 28 Aug 2020 15:28:39 +0200 Subject: [PATCH 28/31] Changing supervisord entrypoin script location --- wasm-fuzzer/supervisord.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wasm-fuzzer/supervisord.conf b/wasm-fuzzer/supervisord.conf index 884f65df..73f10b4d 100644 --- a/wasm-fuzzer/supervisord.conf +++ b/wasm-fuzzer/supervisord.conf @@ -3,7 +3,7 @@ nodaemon=true user=root # Check if this is needed in docker remove otherwise [program:swam_server] -command=%(ENV_SRC_SWAM_DIR)s/../entrypoint_mill_server.sh +command=%(ENV_PWD)s/entrypoint_mill_server.sh stdout_logfile=/dev/stdout stderr_logfile=/dev/stderr stdout_logfile_maxbytes=0 From 1b6824d3a4af44a4e05061b9b989d45123f871a4 Mon Sep 17 00:00:00 2001 From: Jacarte Date: Fri, 28 Aug 2020 15:39:57 +0200 Subject: [PATCH 29/31] Updating Dockerfile for wafl --- wasm-fuzzer/.dockerignore | 1 + wasm-fuzzer/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/wasm-fuzzer/.dockerignore b/wasm-fuzzer/.dockerignore index c8aa20be..70c908be 100644 --- a/wasm-fuzzer/.dockerignore +++ b/wasm-fuzzer/.dockerignore @@ -1,3 +1,4 @@ *.out *.dat ./fuzzing-server-swam/out +./wafl-temp \ No newline at end of file diff --git a/wasm-fuzzer/Dockerfile b/wasm-fuzzer/Dockerfile index 779405a3..d917ab4e 100644 --- a/wasm-fuzzer/Dockerfile +++ b/wasm-fuzzer/Dockerfile @@ -43,7 +43,7 @@ WORKDIR $SRC_SWAM_DIR # TODO: Find way of installing dependencies with Mill without copying over entire repo # See: https://stackoverflow.com/questions/62834693/mill-build-tool-install-dependencies-without-compiling-source-code -ADD ./fuzzing-server-entry/entrypoint_mill_server.sh $SRC_SWAM_DIR +ADD entrypoint_mill_server.sh $SRC_SWAM_DIR # DOWNLOAD latest version of SWAM cli jar file ADD https://github.com/KTH/swam/releases/download/v0.6.0-RC3/cli-0.6.0-RC3.jar $SRC_SWAM_DIR From 7157857ae7b108e8c2a82c7fa41779a05debaf41 Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Fri, 28 Aug 2020 16:01:59 +0200 Subject: [PATCH 30/31] Adjusted entrypoint_mill_server.sh reference in Dockerfile --- wasm-fuzzer/Dockerfile | 8 ++++---- wasm-fuzzer/README.md | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/wasm-fuzzer/Dockerfile b/wasm-fuzzer/Dockerfile index d917ab4e..0ad5a97d 100644 --- a/wasm-fuzzer/Dockerfile +++ b/wasm-fuzzer/Dockerfile @@ -43,13 +43,11 @@ WORKDIR $SRC_SWAM_DIR # TODO: Find way of installing dependencies with Mill without copying over entire repo # See: https://stackoverflow.com/questions/62834693/mill-build-tool-install-dependencies-without-compiling-source-code -ADD entrypoint_mill_server.sh $SRC_SWAM_DIR - # DOWNLOAD latest version of SWAM cli jar file ADD https://github.com/KTH/swam/releases/download/v0.6.0-RC3/cli-0.6.0-RC3.jar $SRC_SWAM_DIR - -RUN chmod +x $SRC_SWAM_DIR/entrypoint_mill_server.sh +ADD entrypoint_mill_server.sh /home +RUN chmod +x /home/entrypoint_mill_server.sh ############################# #### fuzzing-client-afl ##### @@ -80,6 +78,8 @@ RUN chmod +x $SRC_INTERFACE_DIR/entrypoint_afl.sh ######## Shared ######### ######################### +WORKDIR /home + ENV LOGS_DIR=/home/shared/logs RUN mkdir -p $LOGS_DIR diff --git a/wasm-fuzzer/README.md b/wasm-fuzzer/README.md index 679574c5..efdbb516 100644 --- a/wasm-fuzzer/README.md +++ b/wasm-fuzzer/README.md @@ -114,8 +114,8 @@ docker build -t wafl . -v maven_data:/root/.cache/coursier/v1/https/repo1.maven.org/maven2 \ -v compiled_sources:/home/server/src/out/ \ -v ${LOCAL_WASM_DIR:?err}:/home/server/wasm/ \ - -v ${pwd}/afl-out:/home/client/out/ \ - -v ${pwd}/logs:/home/shared/logs/ \ + -v ${PWD}/wafl-temp/afl-out:/home/client/out/ \ + -v ${PWD}/wafl-temp/logs:/home/shared/logs/ \ wafl:latest \ <.wasm/.wat filename> ``` From 89cf88bd11af13e45a115dd877ac62cdfc2a48b1 Mon Sep 17 00:00:00 2001 From: Vincent Lohse Date: Fri, 28 Aug 2020 16:05:03 +0200 Subject: [PATCH 31/31] Adjusted multi-processing.sh with wafl-temp dir --- wasm-fuzzer/multi-processing.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/wasm-fuzzer/multi-processing.sh b/wasm-fuzzer/multi-processing.sh index 7979dd3a..3157f560 100755 --- a/wasm-fuzzer/multi-processing.sh +++ b/wasm-fuzzer/multi-processing.sh @@ -21,8 +21,8 @@ docker run --env-file=./.env \ -v maven_data:/root/.cache/coursier/v1/https/repo1.maven.org/maven2 \ -v compiled_sources:/home/server/src/out/ \ -v ${LOCAL_WASM_DIR:?err}:/home/server/wasm/ \ - -v ${pwd}/afl-out:/home/client/out/ \ - -v ${pwd}/logs/1:/home/shared/logs/ \ + -v ${PWD}/wafl-temp/afl-out:/home/client/out/ \ + -v ${PWD}/wafl-temp/logs/1:/home/shared/logs/ \ -d slumps/wafl:latest $2 $3 $4 if [ $1 -lt 2 ]; then @@ -39,8 +39,8 @@ for i in $(seq 2 $1); do -v maven_data:/root/.cache/coursier/v1/https/repo1.maven.org/maven2 \ -v compiled_sources:/home/server/src/out/ \ -v ${LOCAL_WASM_DIR:?err}:/home/server/wasm/ \ - -v ${pwd}/afl-out:/home/client/out/ \ - -v ${pwd}/logs/${i}:/home/shared/logs/ \ + -v ${PWD}/wafl-temp/afl-out:/home/client/out/ \ + -v ${PWD}/wafl-temp/logs/${i}:/home/shared/logs/ \ -d slumps/wafl:latest $2 $3 $4 done exit 0