Skip to content
Angora is a mutation-based fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution.
C++ Rust C CMake Python Shell Other
Branch: master
Clone or download
spinpx fix rust warnings. (#82)
* Update derive_more requirement from 0.15 to 0.99
* fix rust warnings.
Latest commit cd5439f Dec 15, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
build Use CMake in llvm_mode (#61) Jun 14, 2019
common update version to 1.2.2 Jul 17, 2019
docs update version to 1.2.2 Jul 17, 2019
fuzzer fix rust warnings. (#82) Dec 16, 2019
llvm_mode Merge pull request #74 from adrianherrera/improvement/assembler-check Sep 4, 2019
pin_mode Use CMake in llvm_mode (#61) Jun 14, 2019
runtime update version to 1.2.2 Jul 17, 2019
runtime_fast fix rust warnings. (#82) Dec 16, 2019
tests Use CMake in llvm_mode (#61) Jun 14, 2019
tools minor fixs Apr 12, 2019
.cirrus.yml
.gitignore fix compatibility in old version cmake Jun 21, 2019
.gitmodules update docker file Apr 2, 2019
Cargo.toml release Dec 28, 2018
Dockerfile Use CMake in llvm_mode (#61) Jun 14, 2019
LICENSE release Dec 28, 2018
README.md Update README Aug 31, 2019
angora_fuzzer
rust-toolchain support rust stable: move thread local out of rust. Jan 2, 2019
rustfmt.toml release Dec 28, 2018

README.md

Angora

License Build Status

Angora is a mutation-based coverage guided fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution.

Published Work

Arxiv: Angora: Efficient Fuzzing by Principled Search, S&P 2018.

Building Angora

Build Requirements

  • Linux-amd64 (Tested on Ubuntu 16.04/18.04 and Debian Buster)
  • Rust stable (>= 1.31), can be obtained using rustup
  • LLVM 4.0.0 - 7.1.0 : run PREFIX=/path-to-install ./build/install_llvm.sh.

Environment Variables

Append the following entries in the shell configuration file (~/.bashrc, ~/.zshrc).

export PATH=/path-to-clang/bin:$PATH
export LD_LIBRARY_PATH=/path-to-clang/lib:$LD_LIBRARY_PATH

Fuzzer Compilation

The build script will resolve most dependencies and setup the runtime environment.

./build/build.sh

System Configuration

As with AFL, system core dumps must be disabled.

echo core | sudo tee /proc/sys/kernel/core_pattern

Test

Test if Angora is builded successfully.

cd /path-to-angora/tests
./test.sh mini

Running Angora

Build Target Program

Angora compiles the program into two separate binaries, each with their respective instrumentation. Using autoconf programs as an example, here are the steps required.

# Use the instrumenting compilers
CC=/path/to/angora/bin/angora-clang \
CXX=/path/to/angora/bin/angora-clang++ \
LD=/path/to/angora/bin/angora-clang \
PREFIX=/path/to/target/directory \
./configure --disable-shared

# Build with taint tracking support 
USE_TRACK=1 make -j
make install

# Save the compiled target binary into a new directory
# and rename it with .taint postfix, such as uniq.taint

# Build with light instrumentation support
make clean
USE_FAST=1 make -j
make install

# Save the compiled binary into the directory previously
# created and rename it with .fast postfix, such as uniq.fast

If you fail to build by this approach, try wllvm and gllvm described in Build a target program.

Also, we have implemented taint analysis with libdft64 instead of DFSan (Use libdft64 for taint tracking).

Fuzzing

./angora_fuzzer -i input -o output -t path/to/taint/program -- path/to/fast/program [argv]

For more information, please refer to the documentation under the docs/ directory.

You can’t perform that action at this time.