aflpin enables afl to fuzz blackbox binaries using a pin tool to trace execution branches.
C++ C Makefile
Permalink
Failed to load latest commit information.
Config
.gitignore
LICENSE
README.md added a minor fix to the README for formating Jan 27, 2015
aflpin.cpp backed out the forkserver work and put it in a seperate branch after … Jan 27, 2015
colors.hpp
crash_test.c redid the make system to have C++11 inclusion portable to pin installs Jan 20, 2015
makefile
makefile.rules initial commit Nov 24, 2014
sleep_test.c fixed up all the logic, cleaned the code, added a sanity check, and u… Jan 18, 2015

README.md

AFLPIN

AFLPIN enables the AFL fuzzer (http://lcamtuf.coredump.cx/afl/) to fuzz non-instrumented binaries using Intel's PIN.

It does so by inserting the same type of branch detection and shared memory mappings that AFL adds to instrumented binaries.
Unfortunately it does so at a large cost to performance of AFL, so expect slow exec times.

Building

First download the current version on the PIN library from https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool

Then build AFLPIN tool's .so file for use with pin:

$ PIN_ROOT=/path/to/pin/root/ make obj-intel64/aflpin.so
$ PIN_ROOT=/path/to/pin/root/ make TARGET=ia32 obj-ia32/aflpin.so

Then a command (to be run as root), to enable pin to be run from userland: echo 0 > /proc/sys/kernel/yama/ptrace_scope

Usage

In order to use the AFLPIN with afl-fuzz I had to comment out a single sanity check because of how pin is invoked from AFL:

in afl-fuzz.c:5578 (afl-1.15b) there is a sanity check:

if (!dumb_mode && !memmem(f_data, f_len, SHM_ENV_VAR, strlen(SHM_ENV_VAR) + 1)) {
 ...
}

Comment this line out and rebuild afl-fuzz.

Then to invoke the pin tool with a target and afl-fuzz:

$ AFL_NO_FORKSRV=1 afl-fuzz -m 500 -i .. -o .. -f .. -- /path/to/pin_app -t /path/to/obj-intel64|obj-ia32/aflpin.so -- TARGETAPP @@

Notes

  • -m 500 is because pin will need a large chunk of memory and you very well might need to tune this for a given target
  • Change out obj-intel64/ for obj-ia32/ if the target is 32 vs 64 bit.

Test programs

crash_test.c is a simple process that reads in a file (as per and argument) that has a simple memcpy() vulnerability. I use this to verify that signals are transfered correctly from the target through pin to afl-fuzz

sleep_test.c is used to verify the branch checking in AFLPIN, you can invoke the pin tool without afl without modifying the arguments. also there is a -debug flag you can pass to the pin binary that will print extra information inside AFLPIN.

If AFL reports that the test case resulted in a crash, check the pin.log file in your current working directory for pin specific errors.