/AFL-Snapshot-LKM-snappy

A Linux Kernel Module that implements a fast snapshot mechanism for fuzzing.

Primary LanguageC

AFL++ Snapshot LKM

A Linux Kernel Module that implements a fast snapshot mechanism for fuzzing. Written by Andrea Fioraldi andreafioraldi@gmail.com. First port to a LKM written by Nick "kallsyms" Gregory. Originally inspired by https://github.com/sslab-gatech/perf-fuzz.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

PLEASE NOTE: Due to syscall hooking and the never ending changes in the kernel we are unable to maintain it as we are busy working on libafl. If you would like to take over the development, just create an issue and let us start a discussion. We still accept pull requests in the mean time.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Why?

fork() is slow and we want to fuzz faster. The speed gain currently varies between 20-360% depending on the target.

Persistent mode in llvm_mode will give you a better performance bump though, however adding this snapshot module will still be a small improvement.

Speed comparison

project program exec/s with snapshot exec/s normal speed factor
afl++ test-instr 25k 8234 x3
unrar unrar 7044 1938 x3.6
jpeg djpeg 1911 1502 x1.3
tiff thumbnail 5058 3114 x1.6
libxml xmllint 7835 3450 x2.3
afl++ test_persistent_new 106k 89k x1.2
afl++ emmu_fuzz 10k-20k 40 x250-x500

TODO: Rerun the others with improved version?

Usage

Load it using ./load.sh, unload it using ./unload.sh.

./load.sh will compile the module for you, you need also python3.

While the module is loaded, AFL++ will detect it and automatically switch from fork() to snapshot mode. (Note: currently llvm_mode only, available from v2.66d/v2.67c onwards)

API

int afl_snapshot_init();

This is the initialization routine that opens the ioctl device.

void afl_snapshot_exclude_vmrange(void* start, void* end);

Add a range of addresses (with page granularity) in the blocklist. These pages will not be snapshotted.

void afl_snapshot_include_vmrange(void* start, void* end);

Add a range of addresses (with page granularity) in the allowlist. These pages will be snapshotted.

int afl_snapshot_take(int config);

Take the snapshot in this program point. Returns 1 when the snapshot is taken, if there is already one snapshot does nothing and return 0.

The config mask can have the following options OR-ed:

  • AFL_SNAPSHOT_MMAP Trace new mmaped ares and unmap them on restore.
  • AFL_SNAPSHOT_BLOCK Do not snapshot any page (by default all writeable not-shared pages are shanpshotted.
  • AFL_SNAPSHOT_FDS Snapshot file descriptor state, close newly opened descriptors
  • AFL_SNAPSHOT_REGS Snapshot registers state
  • AFL_SNAPSHOT_EXIT Perform a restore when exit_group is invoked
  • AFL_SNAPSHOT_NOSTACK Do not snapshot Stack pages
void afl_snapshot_restore(void);

Restore the snapshot. If registers are snapshotted, this function never returns.

void afl_snapshot_clean(void);

Remove the snapshot, you can not call afl_snapshot_take in another program point.

TODOs

  • support for multithreaded applications
  • file descriptors state restore (lseek)
  • switch from kprobe to ftrace for hooking (faster)