ELF Snapshotting and Fuzzing #102

Kasimir123 · 2022-05-30T00:43:20Z

PR to add support for ELF files to WTF. For full usage instructions and a demo check out the README in the linux_mode directory.

Added files:

raw2dmp
- Program that converts the raw dump from qemu into a mem.dmp that can be read by WTF.
scripts
- fuzzbkpt.py
  - Creates a class used to set the breakpoint in our executable file.
  - Sets up memory so that it can be dumped once the breakpoint is hit.
- kernel.py
  - Allows us to access structures using gdb.
  - Lets us read from and write to memory.
- qemu.py
  - Sets up the cpu command so that we can create the regs.json and symbol-store.json file after the dump is performed.
- utils.py
  - Utility that lets us update the json files.
setup.sh
- Sets up the environment for taking a snapshot of an elf file.
- Installs dependencies for qemu and the python scripts.
- Clones and builds the debug version of qemu for x86_64.
- Makes the raw2dmp executable.
snapshot
- bpkt.py
  - File used to set the breakpoint in our executable.
  - Needs to be updated with a file name and an address to break on.
- gdb_client.sh
  - Connects to the remote gdb server and runs bpkt.py.
- gdb_server.sh
  - Starts up the qemu image inside of gdb.
  - Can be used whenever you need to access the image.
- move_to_fuzzer.sh
  - Converts the raw file to mem.dmp.
  - Creates a directory in targets and sets it up for fuzzing with required directories.
  - Moves mem.dmp, regs.json, and symbol-store.json into states.
  - Moves over the recompile_wtf script.
- qemu_file_upload.sh
  - Moves a file from the local machine into the qemu image so that it can be used for snapshotting.
- recompile_wtf.sh
  - Compiles the elf version of WTF and moves it into the target directory.
vars
- Contains all of the variables needed by the other scripts.

Modified Files:

utils.cc
- Modified the file to check for a preprocessor definition to change between the normal WTF build and the elf WTF build.
- Tested switching between the two builds. You will need to make clean and remove the cmake cache files but it will build the two versions with the same code base.

…and added scripts to make things easier

0vercl0k · 2022-05-30T04:01:42Z

Woot this looks awesome, thank you for sending this in 🙏🏽🎊!

I need to finish investigating another issue that came earlier but then I will get on reviewing this 🙂.

Cheers

0vercl0k

Okay I took a first stab at this, and to me it feels the below are the main areas that needs addressing:

Let's find out what's going on w/ the segment registers on Linux. Once understood this means, there is no need for the ifdef and means we don't need a specific script to build wtf in this magic configuration.
Let's try to merge the gdb/qemu logic in a single Python file. The way it is split is a little bit confusing (to me) and I think it'd be clearer if we could have one (or two if necessary) script instead.
It'd be great if we could generate the dump automatically once the breakpoint is hit. It also means we can transparently transform the raw dump into a 'dmp' file directly from Python and get rid of raw2dump, its Makefile and the relevant bits to build it into the various scripts.

Also, let me know if you are interested to work on those otherwise, I am happy to directly push changes / address the above on your branch directly :)

0vercl0k · 2022-06-04T23:01:09Z

.gitignore

@@ -31,7 +31,7 @@
 *.out
 *.app

-src/wtf/fuzzer_*
+# src/wtf/fuzzer_*


I think we should revert this change - it allows users to have their own fuzzers and is a cheap safeguard to not publish them by mistakes.

0vercl0k · 2022-06-04T23:02:10Z

.gitignore

I don't think this one is relevant either.

0vercl0k · 2022-06-04T23:04:30Z

src/wtf/utils.cc


-  Seg_t *Segments[] = {&CpuState.Es, &CpuState.Fs, &CpuState.Cs,
-                       &CpuState.Gs, &CpuState.Ss, &CpuState.Ds};
+  #if ELF_COMPILATION != 1


Okay, I think we shouldn't need this. Either there is a bug in my sanitization below, or there is something weird going on in Linux's segment registers. Either or, it's something that should probably fixed somewhere else.

Do you have more details on this? Like which register fails the sanitization and what is their values? Happy to investigate.

0vercl0k · 2022-06-04T23:06:20Z

linux_mode/raw2dmp/raw2dmp.cc

@@ -0,0 +1,72 @@
+#include "../../src/libs/kdmp-parser/src/lib/kdmp-parser-structs.h"


All right, I think it might be better to have this being done directly in the Python script that generate the memory dump. Based on the README this is currently done manually via a connection to the QEMU monitor, but is this something that could be automated once the breakpoint is hit?

This means it's transparent for the user, it also means we don't need to figure out CMakefiles / Makefile for this.

0vercl0k · 2022-06-04T23:09:28Z

linux_mode/raw2dmp/.gitignore

@@ -0,0 +1 @@
+raw2dmp


This change should be gone once raw2dump's logic is merged into the Python script.

0vercl0k · 2022-06-04T23:14:21Z

linux_mode/scripts/utils.py

@@ -0,0 +1,28 @@
+# imports


Same for this file, let's merge it into a single file where all the gdb / dump logic is implemented.

0vercl0k · 2022-06-04T23:18:31Z

linux_mode/setup.sh

+# compile raw2dmp
+cd ../../raw2dmp
+make


Could be remove if raw2dump's logic included in a Python script.

0vercl0k · 2022-06-04T23:19:29Z

linux_mode/snapshot/move_to_fuzzer.sh

+# convert the raw dump to mem.dmp
+../raw2dmp/raw2dmp raw
+


That part should hopefully disappear

0vercl0k · 2022-06-04T23:20:50Z

linux_mode/snapshot/move_to_fuzzer.sh

+# sets the target folder for fuzzing
+TARGET_FOLDER=${WTF}/targets/$1
+
+# creates the target folder
+mkdir ${TARGET_FOLDER}
+
+# create the required directories for wtf
+mkdir ${TARGET_FOLDER}/crashes
+mkdir ${TARGET_FOLDER}/inputs
+mkdir ${TARGET_FOLDER}/outputs
+mkdir ${TARGET_FOLDER}/state
+
+# move created files into the target folder
+mv mem.dmp ${TARGET_FOLDER}/state/
+mv regs.json ${TARGET_FOLDER}/state/
+mv symbol-store.json ${TARGET_FOLDER}/state/
+
+# move recompilation script to target folder
+cp recompile_wtf.sh ${TARGET_FOLDER}/


Again, I think some of that logic should be moved at the dump stage. It makes it one less step for the user to remember to run and it looks fairly easy to automate this.

Also removing the ifdef in wtf mean that it doesn't need to be recompiled either so we shouldn't need that part either.

0vercl0k · 2022-06-04T23:21:38Z

linux_mode/snapshot/recompile_wtf.sh

@@ -0,0 +1,17 @@
+#!/bin/bash


I think that if we find out what's going on w/ the registers, we shouldn't need another build script for wtf and be able to get rid of this.

This is based on Kasamir123's pull request at 0vercl0k#102 plus some scripts in snapchange for automatically setting up a Linux VM target. The following improvements have been made as compared to Kasamir123's original pull request: * Fixed bug when calling mlockall, allowing us to remove page touching code * Code requires no custom #ifdefs in wtf * Linux snapshots work w/fuzzing via KVM. Kasamir123's code had some issues with gathering segment registers, and our updates fix these issues, allowing for KVM support * Kasamir123's code injects shellcode into the target process by overwriting code, but never restored the original code. We now restore the original code * Snapshotting is more streamlined, only taking a few manual steps once everything is configured * Some improvements from 0vercl0k's suggestions from ELF Snapshotting and Fuzzing 0vercl0k#102, like implementing raw2dmp in Python * Support for setting breakpoints on symbols in ELF targets plus use of symbols in fuzz harnesses * IDA script for generating coverage breakpoints list so that targets can be fuzzed with KVM * Target VM can run with HW acceleration enabled, Kasamir123's scripts for running the VM and taking a snapshot only worked with SW emulation * Works with recent Linux kernel versions

0vercl0k · 2024-02-19T17:32:55Z

Closing this as superseded by #192

mgayanov and others added 7 commits April 25, 2022 16:23

Remove segment's registers check

30b371e

Add linux_mode

2c031b8

Skip guard pages from vmmap

5a0cf5f

merging in mgayanov's work

b448cb0

Updated python scripts, commented all of the code from the old repo, …

98a2aa3

…and added scripts to make things easier

Updated files with the readme

79f8c44

added minor tweaks after testing

0406ec6

0vercl0k requested changes Jun 4, 2022

View reviewed changes

0vercl0k mentioned this pull request Oct 3, 2022

Cannot reproduce the snapshot for HEVD fuzzer #134

Closed

jasocrow mentioned this pull request Jan 24, 2024

Add support for Linux userland ELF snapshots and fuzzing #192

Merged

0vercl0k closed this Feb 19, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ELF Snapshotting and Fuzzing #102

ELF Snapshotting and Fuzzing #102

Kasimir123 commented May 30, 2022

0vercl0k commented May 30, 2022

0vercl0k left a comment

0vercl0k Jun 4, 2022

0vercl0k Jun 4, 2022

0vercl0k Jun 4, 2022

0vercl0k Jun 4, 2022

0vercl0k Jun 4, 2022

0vercl0k Jun 4, 2022

0vercl0k Jun 4, 2022

0vercl0k Jun 4, 2022

0vercl0k Jun 4, 2022

0vercl0k Jun 4, 2022

0vercl0k commented Feb 19, 2024

		@@ -0,0 +1,72 @@
		#include "../../src/libs/kdmp-parser/src/lib/kdmp-parser-structs.h"

ELF Snapshotting and Fuzzing #102

ELF Snapshotting and Fuzzing #102

Conversation

Kasimir123 commented May 30, 2022

0vercl0k commented May 30, 2022

0vercl0k left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

0vercl0k commented Feb 19, 2024