Fuzzing Scripts For Rust libraries with afl.rs

These are two scripts for fuzzing Rust libraries to cooperate with our fuzz target generator, a patched version of RuMono in Artisan-Lab/RULF adapted to Rust 1.81.0-nightly (nightly-2024-07-21). These two scripts automate the process to fuzz Rust libraries with afl.rs. Because these scripts are initially for personal use, the structures of these scripts are not well designed and there may be some ugly patterns. We may improve this in the future if needed.

We have tried to mention some possible problems that may appear during fuzzing process in this documentation. But we may also miss some conditions. You can submit an issue if you are faced with any problem when fuzzing a Rust library.

Note:

afl.rs has released a new version to depend on an AFL++ latest version. We have checked that the newest afl.rs that our scripts can work with is 0.15.15.

Before using the scripts

Before using these scripts, you need to make sure you have correctly install afl.rs and afl.rs can run properly. You can follow the instructions on rust-fuzz-book.

How to build and install these two scripts?

You can follow below instructions to install these two scripts on Unix-like systems.

WORKDIR=$HOME #You can change this directory according to your own settings
cd $WORKDIR
git clone https://github.com/cppbear/Fuzzing-Scripts
cd Fuzzing-Scripts
cargo install --path afl_scripts
cargo install --path find_literal

How to use our scripts to fuzz libraries?

I will take crate url as an example.

1. Generate fuzz targets for url.

   afl_scripts -p url

   Note: -p option is not always valid (Sadly, most time invalid). I recommend you to follow the fuzz-target-generator instructions to generate targets.
2. Generate initial input files for url

   afl_scripts -f 500 url

3. Compile fuzz targets

   afl_scripts -b url

   You should see output information "check build success" if targets are compiled successfully. Note: All targets need to be compiled successfully before you continue fuzzing. For libraries we have tested, we have fixed all problems confronted during compilation. But for other libraries, there may be some language features we missed. So, you may encounter compilation problems. We suggest personally that you may follow steps below personally.
   • remove fuzz targets that cannot be compiled or manually fix compilation errors from $TEST_DIR/test_files
   • run afl_scripts -clean url to delete previous compilation and fuzzing results (This may corrupt history data)
   • follow the steps from Generate initial input files again.
4. Fuzz all targets. I recommend you that before running thid instruction, open a window with tmux, screen or zellij, for the fuzzing process will last a long time. On my PC, I would like to use zellij -s afl-url

   afl_scripts -fuzz url

   For some crates, the fuzzing process will exit automatically. But for url, you need to manually stop the fuzzing process by typing CTRL C. The fuzzing time is based on your own preference. In our experiments, we will fuzz each target for 24 hours.
5. Analyse the fuzzing results.

   afl_scripts -t url      #reduce test file size
   afl_scripts -cmin url   #reduce test file number
   afl_scripts -s url      #output statistic info
   afl_scripts -r url      #replay crash files