rust-fuzz/afl.rs

Instructions about building from source

Closed this issue · 10 comments

Hi authors,

I want to modify a bit to practice and build the project from source. My command is to go to the cargo-afl directory and then cargo install --path . --force. This should be the same with cargo install cargo-afl.

However, I found differences like I cannot run cargo afl config --build --force when I build from source.
The error message is:

RUST_BACKTRACE=1 cargo afl config --build --force thread 'main' panicked at cargo-afl/src/main.rs:145:34: called `Result::unwrap()` on an `Err` value: Custom { kind: Other, error: Error { kind: NotFound, message: "No such file or directory (os error 2)" } }

While I succeeded when installing it from crates.io.

Can you explain the reason for this? Or is there any instruction about building from source? Thank you!

The error message is: ...

That is not a very helpful error message!

I agree we should have build instructions, but I would like to get to the root cause of the problem you are experiencing now.

I have created a branch use-anyhow that should provide more helpful error messages. Could I trouble you to repeat you experiment using that branch?

git clone https://github.com/rust-fuzz/afl.rs
cd afl.rs
git checkout use-anyhow

If you get an error again, please provide the backtrace.

As a shot in the dark, did you run git submodule update --init before running cargo install ...?

Hi, thanks for your timely reply!

I have run git submodule update --init --recursive to sync all the contents in AFLPlusPlus. I git checkout use-anyhow.

The scenario is that I am running the tutorial case in https://rust-fuzz.github.io/book/afl/tutorial.html or any other simple test case. cargo afl build, cargo afl fuzz .. work well.

Here is the full error message of RUST_BACKTRACE=full cargo afl config --build.

thread 'main' panicked at cargo-afl/src/main.rs:145:34:
called `Result::unwrap()` on an `Err` value: No such file or directory (os error 2)

Stack backtrace:
   0: anyhow::error::<impl core::convert::From<E> for anyhow::Error>::from
   1: cargo_afl::config::config
   2: cargo_afl::main
   3: std::sys_common::backtrace::__rust_begin_short_backtrace
   4: std::rt::lang_start::{{closure}}
   5: core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &F>::call_once
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/ops/function.rs:284:13
   6: std::panicking::try::do_call
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:552:40
   7: std::panicking::try
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:516:19
   8: std::panic::catch_unwind
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panic.rs:142:14
   9: std::rt::lang_start_internal::{{closure}}
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/rt.rs:148:48
  10: std::panicking::try::do_call
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:552:40
  11: std::panicking::try
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:516:19
  12: std::panic::catch_unwind
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panic.rs:142:14
  13: std::rt::lang_start_internal
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/rt.rs:148:20
  14: std::rt::lang_start
  15: __libc_start_main
  16: _start
stack backtrace:
   0:     0x55555561a90c - std::backtrace_rs::backtrace::libunwind::trace::hcbee0be5a8d1f8ef
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/../../backtrace/src/backtrace/libunwind.rs:104:5
   1:     0x55555561a90c - std::backtrace_rs::backtrace::trace_unsynchronized::h1abebdd3c34d4d4a
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x55555561a90c - std::sys_common::backtrace::_print_fmt::h63bf513d067bb0e2
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/sys_common/backtrace.rs:68:5
   3:     0x55555561a90c - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::hcab4db74356364be
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/sys_common/backtrace.rs:44:22
   4:     0x555555641c80 - core::fmt::rt::Argument::fmt::h9a9c12a4d2902604
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/fmt/rt.rs:142:9
   5:     0x555555641c80 - core::fmt::write::h9d7a19e462405218
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/fmt/mod.rs:1120:17
   6:     0x55555561831f - std::io::Write::write_fmt::h527b6a89d2981717
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/io/mod.rs:1762:15
   7:     0x55555561a6f4 - std::sys_common::backtrace::_print::h417b7afaccc8521f
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/sys_common/backtrace.rs:47:5
   8:     0x55555561a6f4 - std::sys_common::backtrace::print::hde49c28b833203cf
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/sys_common/backtrace.rs:34:9
   9:     0x55555561c437 - std::panicking::default_hook::{{closure}}::h264a3a8a1dd6dba2
  10:     0x55555561c19f - std::panicking::default_hook::h16564dedeca1b796
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:292:9
  11:     0x55555561c8b8 - std::panicking::rust_panic_with_hook::hf476aea3e3654c8f
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:779:13
  12:     0x55555561c79e - std::panicking::begin_panic_handler::{{closure}}::he5dc0ef7806c37b3
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:657:13
  13:     0x55555561add6 - std::sys_common::backtrace::__rust_end_short_backtrace::hfd5251f49f061293
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/sys_common/backtrace.rs:171:18
  14:     0x55555561c502 - rust_begin_unwind
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:645:5
  15:     0x55555556b3e5 - core::panicking::panic_fmt::hf6b7340803aacf23
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/panicking.rs:72:14
  16:     0x55555556b883 - core::result::unwrap_failed::he0253f716f2dad50
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/result.rs:1649:5
  17:     0x555555578bf3 - cargo_afl::main::h58220c17eaaecbfb
  18:     0x555555594213 - std::sys_common::backtrace::__rust_begin_short_backtrace::h0df2c6bbc28447fb
  19:     0x55555558f929 - std::rt::lang_start::{{closure}}::h914f114649132a65
  20:     0x5555556122c7 - core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &F>::call_once::hf1d935fdf044ddd0
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/ops/function.rs:284:13
  21:     0x5555556122c7 - std::panicking::try::do_call::h406c33f8e2eb22e2
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:552:40
  22:     0x5555556122c7 - std::panicking::try::h285a58629872385a
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:516:19
  23:     0x5555556122c7 - std::panic::catch_unwind::hbfe3c77751ecb18f
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panic.rs:142:14
  24:     0x5555556122c7 - std::rt::lang_start_internal::{{closure}}::h200769ee17077e71
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/rt.rs:148:48
  25:     0x5555556122c7 - std::panicking::try::do_call::h30de5d9236e6bba8
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:552:40
  26:     0x5555556122c7 - std::panicking::try::h939fb0d6351ac636
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:516:19
  27:     0x5555556122c7 - std::panic::catch_unwind::h099be6e6255d53c5
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panic.rs:142:14
  28:     0x5555556122c7 - std::rt::lang_start_internal::hc8b42c6a6d5b5b8e
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/rt.rs:148:20
  29:     0x55555558f91e - std::rt::lang_start::h39f96946fe61dca6
  30:     0x7ffff7db7d0a - __libc_start_main
  31:     0x55555556bb4a - _start
  32:                0x0 - <unknown>

If I don't build from source, just cargo install cargo-afl and execute the same command, I can successfully run cargo afl config --build, and success message is:

Artifacts written to /home/flash/.local/share/afl.rs/rustc-1.76.0-nightly-a1a3773/afl.rs-0.15.9

In this artifact directory, it contains afl, and afl-llvm. It seems like we successfully build the binaries of aflpp into our system.

Sorry, but I am still having trouble determining the source of the error. Specifically, I cannot tell what this line in the backtrace refers to:

0: anyhow::error::<impl core::convert::From<E> for anyhow::Error>::from

When you install from source, could you add the --debug flag? That should add more details to the backtrace.

Hi, this is the newest error message. It seems like the same error message. The anyhow is the crate you import in the use-anyhow branch.
I build from source by adding the --debug flag. Then RUST_BACKTRACE=full cargo afl config --build --force

thread 'main' panicked at cargo-afl/src/main.rs:145:34:
called `Result::unwrap()` on an `Err` value: No such file or directory (os error 2)

Stack backtrace:
   0: anyhow::error::<impl core::convert::From<E> for anyhow::Error>::from
             at /home/flash/.cargo/registry/src/index.crates.io-6f17d22bba15001f/anyhow-1.0.86/src/error.rs:565:25
   1: <core::result::Result<T,F> as core::ops::try_trait::FromResidual<core::result::Result<core::convert::Infallible,E>>>::from_residual
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/result.rs:1959:27
   2: cargo_afl::config::config
             at /home/flash/Projects/Rust/Fuzzing/afl.rs/cargo-afl/src/config.rs:64:22
   3: cargo_afl::main
             at /home/flash/Projects/Rust/Fuzzing/afl.rs/cargo-afl/src/main.rs:145:13
   4: core::ops::function::FnOnce::call_once
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/ops/function.rs:250:5
   5: std::sys_common::backtrace::__rust_begin_short_backtrace
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/sys_common/backtrace.rs:155:18
   6: std::rt::lang_start::{{closure}}
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/rt.rs:167:18
   7: core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &F>::call_once
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/ops/function.rs:284:13
   8: std::panicking::try::do_call
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:552:40
   9: std::panicking::try
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:516:19
  10: std::panic::catch_unwind
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panic.rs:142:14
  11: std::rt::lang_start_internal::{{closure}}
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/rt.rs:148:48
  12: std::panicking::try::do_call
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:552:40
  13: std::panicking::try
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:516:19
  14: std::panic::catch_unwind
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panic.rs:142:14
  15: std::rt::lang_start_internal
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/rt.rs:148:20
  16: std::rt::lang_start
             at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/rt.rs:166:17
  17: main
  18: __libc_start_main
  19: _start
stack backtrace:
   0:     0x55555573b57c - std::backtrace_rs::backtrace::libunwind::trace::hcbee0be5a8d1f8ef
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/../../backtrace/src/backtrace/libunwind.rs:104:5
   1:     0x55555573b57c - std::backtrace_rs::backtrace::trace_unsynchronized::h1abebdd3c34d4d4a
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x55555573b57c - std::sys_common::backtrace::_print_fmt::h63bf513d067bb0e2
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/sys_common/backtrace.rs:68:5
   3:     0x55555573b57c - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::hcab4db74356364be
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/sys_common/backtrace.rs:44:22
   4:     0x5555557623c0 - core::fmt::rt::Argument::fmt::h9a9c12a4d2902604
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/fmt/rt.rs:142:9
   5:     0x5555557623c0 - core::fmt::write::h9d7a19e462405218
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/fmt/mod.rs:1120:17
   6:     0x555555738f8f - std::io::Write::write_fmt::h527b6a89d2981717
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/io/mod.rs:1762:15
   7:     0x55555573b364 - std::sys_common::backtrace::_print::h417b7afaccc8521f
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/sys_common/backtrace.rs:47:5
   8:     0x55555573b364 - std::sys_common::backtrace::print::hde49c28b833203cf
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/sys_common/backtrace.rs:34:9
   9:     0x55555573d0a7 - std::panicking::default_hook::{{closure}}::h264a3a8a1dd6dba2
  10:     0x55555573ce0f - std::panicking::default_hook::h16564dedeca1b796
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:292:9
  11:     0x55555573d528 - std::panicking::rust_panic_with_hook::hf476aea3e3654c8f
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:779:13
  12:     0x55555573d40e - std::panicking::begin_panic_handler::{{closure}}::he5dc0ef7806c37b3
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:657:13
  13:     0x55555573ba46 - std::sys_common::backtrace::__rust_end_short_backtrace::hfd5251f49f061293
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/sys_common/backtrace.rs:171:18
  14:     0x55555573d172 - rust_begin_unwind
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:645:5
  15:     0x55555557ce25 - core::panicking::panic_fmt::hf6b7340803aacf23
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/panicking.rs:72:14
  16:     0x55555557d3b3 - core::result::unwrap_failed::he0253f716f2dad50
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/result.rs:1649:5
  17:     0x55555557fe9d - core::result::Result<T,E>::unwrap::h568bc0f92159b466
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/result.rs:1073:23
  18:     0x5555555a5789 - cargo_afl::main::hfc159f1d7ae5dd3b
                               at /home/flash/Projects/Rust/Fuzzing/afl.rs/cargo-afl/src/main.rs:145:13
  19:     0x5555555857eb - core::ops::function::FnOnce::call_once::h7de85f36b9f487d0
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/ops/function.rs:250:5
  20:     0x555555581bce - std::sys_common::backtrace::__rust_begin_short_backtrace::h0b2a0cecc79bfbb9
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/sys_common/backtrace.rs:155:18
  21:     0x555555581ba1 - std::rt::lang_start::{{closure}}::h329a94bd1041c526
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/rt.rs:167:18
  22:     0x555555732f37 - core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &F>::call_once::hf1d935fdf044ddd0
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/core/src/ops/function.rs:284:13
  23:     0x555555732f37 - std::panicking::try::do_call::h406c33f8e2eb22e2
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:552:40
  24:     0x555555732f37 - std::panicking::try::h285a58629872385a
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:516:19
  25:     0x555555732f37 - std::panic::catch_unwind::hbfe3c77751ecb18f
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panic.rs:142:14
  26:     0x555555732f37 - std::rt::lang_start_internal::{{closure}}::h200769ee17077e71
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/rt.rs:148:48
  27:     0x555555732f37 - std::panicking::try::do_call::h30de5d9236e6bba8
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:552:40
  28:     0x555555732f37 - std::panicking::try::h939fb0d6351ac636
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panicking.rs:516:19
  29:     0x555555732f37 - std::panic::catch_unwind::h099be6e6255d53c5
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/panic.rs:142:14
  30:     0x555555732f37 - std::rt::lang_start_internal::hc8b42c6a6d5b5b8e
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/rt.rs:148:20
  31:     0x555555581b7a - std::rt::lang_start::hf99385a7e685953f
                               at /rustc/a1a37735cbc3db359d0b24ba9085c9fcbe1bc274/library/std/src/rt.rs:166:17
  32:     0x5555555ab83e - main
  33:     0x7ffff7db7d0a - __libc_start_main
  34:     0x55555557d6ba - _start
  35:                0x0 - <unknown>

So this is where the failure occurs:

let _: u64 = fs_extra::dir::copy(
afl_src_dir,
tempdir.path(),
&fs_extra::dir::CopyOptions {
content_only: true,
..Default::default()
},
)?;

In your checkout of afl.rs, what do you see if you run this?

ls cargo-afl/AFLplusplus

Alternatively, is there anything weird about how your /tmp is set up?

ls cargo-afl/AFLplusplus/
afl-addseeds   afl-persistent-config  afl-whatsup     benchmark     config.h         custom_mutators  docs              GNUmakefile             include          LICENSE   qemu_mode  test          TODO.md       utils
afl-cmin       afl-plot               afl-wine-trace  Changelog.md  CONTRIBUTING.md  dictionaries     dynamic_list.txt  GNUmakefile.gcc_plugin  injections.dic   Makefile  README.md  testcases     types.h
afl-cmin.bash  afl-system-config      Android.bp      CITATION.cff  coresight_mode   Dockerfile       frida_mode        GNUmakefile.llvm        instrumentation  nyx_mode  src        test-instr.c  unicorn_mode

In this case, can you suggest how to create the /tmp directory? Thank you!

I have run git submodule update --init --recursive to sync all the contents in AFLPlusPlus. I git checkout use-anyhow.

Could you please try without the --recursive flag?

I think some of AFL++'s submodules may contain broken links, and that is what is causing the failure.

Hi! You are right, we should remove the --recursive flag. That is my bad. Thank you! You can also remove the use-anyhow branch. Thanks for your kind help!

Let's please keep this issue open until I have had a chance to write build instructions.

Users should not have to figure out that --recursive causes problems (and the code should probably handle that anyway).

Thanks very much for your inquiry! You've revealed some ways in which the code could be improved!