LAVA Wiki

The files were originally found here.

Documentation

LAVA is the product of a collaboration between MIT Lincoln Laboratory, NYU, and Northeastern University, designed to provide a method for testing fuzzers and automating the creation of CTFs by injecting security vulnerabilities into source code.

User Guide

Download the LAVA Debian Package here and to install the Python package, use pip install pyroclastic.

Current Bugs Functionality

Checkmark means we know this works. To replicate the result, use the same project and check the logs for injection.

• BUG_PTR_ADD, see example with toy Looks like the implementation is somewhere here

Validating bug 23 of 50 
No known solution for bug with id=942
Bug[942](type=BUG_PTR_ADD, trigger=75, atp=21)
fuzzed = [/mnt/c/Users/andre/OneDrive/Desktop/lava/target_injections/toy/generated-inputs/testsmall-fuzzed-942.bin]
Run modified program: /mnt/c/Users/andre/OneDrive/Desktop/lava/target_injections/toy/bugs/0/toy/lava-install/bin/toy /mnt/c/Users/andre/OneDrive/Desktop/lava/target_injections/toy/generated-inputs/testsmall-fuzzed-942.bin
retval = 139
:type_1 + bug.type
RV indicates memory corruption
Moving crashing input file to /mnt/c/Users/andre/OneDrive/Desktop/lava/target_injections/toy/crashes/testsmall-fuzzed-942.bin

• RET_BUFFER
  LLVM implementation seems to be here

Validating bug 1 of 50 
No known solution for bug with id=4
Bug[4](type=BUG_RET_BUFFER, trigger=9, atp=1)
fuzzed = [/mnt/c/Users/andre/OneDrive/Desktop/lava/target_injections/toy/generated-inputs/testsmall-fuzzed-4.bin]
Run modified program: /mnt/c/Users/andre/OneDrive/Desktop/lava/target_injections/toy/bugs/2/toy/lava-install/bin/toy /mnt/c/Users/andre/OneDrive/Desktop/lava/target_injections/toy/generated-inputs/testsmall-fuzzed-4.bin
[*] Running: /mnt/c/Users/andre/OneDrive/Desktop/lava/target_injections/toy/bugs/2/toy/lava-install/bin/toy /mnt/c/Users/andre/OneDrive/Desktop/lava/target_injections/toy/generated-inputs/testsmall-fuzzed-4.bin (Log: Memory Capture)
retval = -11
:type_1 + bug.type
RV indicates memory corruption
Moving crashing input file to /mnt/c/Users/andre/OneDrive/Desktop/lava/target_injections/toy/crashes/testsmall-fuzzed-4.bin

It is a bit too easy to spot, it is just injected assembly, alas

if ((0x61486171 == data_flow[2])) {
({
#ifdef __aarch64__
__asm__("mov sp, %0\n\tldr x30, [sp], #8\n\tret" : : "rm" (((const unsigned char *)((*f)._IO_write_ptr) + 4)))
#endif
; 
#ifdef __arm__
__asm__("mov sp, %0\n\tldmfd sp!, {pc}" : : "rm" (((const unsigned char *)((*f)._IO_write_ptr) + 4)))
#endif
; 
#ifdef __x86_64__
__asm__("movq %0, %%rsp\n\tret" : : "rm" (((const unsigned char *)((*f)._IO_write_ptr) + 4)))
#endif
; 
#ifdef __i386__
__asm__("movl %0, %%esp\n\tret" : : "rm" (((const unsigned char *)((*f)._IO_write_ptr) + 4)))
#endif
;});
}
printf("File timestamp: %u\n", head.timestamp);
    if (((*f)._IO_read_ptr)) {
DFLOG(24, *(const unsigned int *)((*f)._IO_read_ptr));
}

• [] REL_WRITE
  Looks like the implementation is somewhere here . It uses the Three DUA Test, as seen here and here, the ACM CCS paper that discusses the 3 DUA test.

• [] PRINTF_LEAK LLVM implementation seems to be here

• MALLOC_OFF_BY_ONE LLVM implementation seems to be here

It is a bit difficult to generate an input for the specific magic value. But! To replicate this, you need to run lava -i 1 toy --bugtypes "malloc_off_by_one". Go to the bugs directory, checkout the build, and at least for toy you should see something like the snippet below.

Yes, it likely won't validate on toy because the header has to be manually updated, but it is obvious that with the right data flow, this would cause a memory issue.

file_entry * parse_record(int *data_flow, FILE *f) {
    file_entry *ret = (file_entry *) malloc((0x51647761 == data_flow[0]) ? (4) : (sizeof(file_entry)));
    if (1 != fread(ret, sizeof(file_entry), 1, f))
        exit(1);
    return ret;
}

Chaff Bugs Confirmation

• [] CHAFF_STACK_UNUSED
• [] CHAFF_STACK_CONST
• [] CHAFF_HEAP_CONST
• [] CHAFF_DIVZERO

Download all relevant QCows

Also, we highly suggest downloading the relevant PANDA QCows, as this can take some time on your first time running LAVA. The commands are provided here.

python3 -c "from pandare.qcows_internal import Qcows;Qcows.get_qcow('x86_64')"
python3 -c "from pandare.qcows_internal import Qcows;Qcows.get_qcow('i386')"
python3 -c "from pandare.qcows_internal import Qcows;Qcows.get_qcow('arm')"
python3 -c "from pandare.qcows_internal import Qcows;Qcows.get_qcow('aarch64')"