LAVA Wiki

The files were originally found here.

Documentation

LAVA is the product of a collaboration between MIT Lincoln Laboratory, NYU, and Northeastern University, designed to provide a method for testing fuzzers and automating the creation of CTFs by injecting security vulnerabilities into source code.

User Guide

Download the LAVA Debian Package here and to install the Python package, use pip install pyroclastic.

Current Bugs Functionality

Checkmark means we know this works. To replicate the result, use the same project and check the logs for injection.

• BUG_PTR_ADD, see example with toy Looks like the implementation is somewhere here

Validating bug 23 of 50 
No known solution for bug with id=942
Bug[942](type=BUG_PTR_ADD, trigger=75, atp=21)
fuzzed = [/mnt/c/Users/andre/OneDrive/Desktop/lava/target_injections/toy/generated-inputs/testsmall-fuzzed-942.bin]
Run modified program: /mnt/c/Users/andre/OneDrive/Desktop/lava/target_injections/toy/bugs/0/toy/lava-install/bin/toy /mnt/c/Users/andre/OneDrive/Desktop/lava/target_injections/toy/generated-inputs/testsmall-fuzzed-942.bin
retval = 139
:type_1 + bug.type
RV indicates memory corruption
Moving crashing input file to /mnt/c/Users/andre/OneDrive/Desktop/lava/target_injections/toy/crashes/testsmall-fuzzed-942.bin

• [] RET_BUFFER
  LLVM implementation seems to be here

• [] REL_WRITE
  Looks like the implementation is somewhere here . It uses the Three DUA Test, as seen here and here, the ACM CCS paper that discusses the 3 DUA test.

• [] PRINTF_LEAK LLVM implementation seems to be here

• MALLOC_OFF_BY_ONE LLVM implementation seems to be here

It is a bit difficult to generate an input for the specific magic value. But! To replicate this, you need to run lava -i 1 toy --bugtypes "malloc_off_by_one". Go to the bugs directory, checkout the build, and at least for toy you should see something like the snippet below.

Yes, it likely won't validate on toy because the header has to be manually updated, but it is obvious that with the right data flow, this would cause a memory issue.

file_entry * parse_record(int *data_flow, FILE *f) {
    file_entry *ret = (file_entry *) malloc((0x51647761 == data_flow[0]) ? (4) : (sizeof(file_entry)));
    if (1 != fread(ret, sizeof(file_entry), 1, f))
        exit(1);
    return ret;
}

Chaff Bugs Confirmation

• [] CHAFF_STACK_UNUSED
• [] CHAFF_STACK_CONST
• [] CHAFF_HEAP_CONST
• [] CHAFF_DIVZERO

Download all relevant QCows

Also, we highly suggest downloading the relevant PANDA QCows, as this can take some time on your first time running LAVA. The commands are provided here.

python3 -c "from pandare.qcows_internal import Qcows;Qcows.get_qcow('x86_64')"
python3 -c "from pandare.qcows_internal import Qcows;Qcows.get_qcow('i386')"
python3 -c "from pandare.qcows_internal import Qcows;Qcows.get_qcow('arm')"
python3 -c "from pandare.qcows_internal import Qcows;Qcows.get_qcow('aarch64')"