Angora
Angora is a mutation-based coverage guided fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution.
Published Work
Arxiv: Angora: Efficient Fuzzing by Principled Search, S&P 2018.
Building Angora
Build Requirements
- Linux-amd64 (Tested on Ubuntu 16.04/18.04 and Debian Buster)
- Rust stable (>= 1.31), can be obtained using rustup
- LLVM 4.0.0 - 7.1.0 : run
PREFIX=/path-to-install ./build/install_llvm.sh.
Environment Variables
Append the following entries in the shell configuration file (~/.bashrc, ~/.zshrc).
export PATH=/path-to-clang/bin:$PATH
export LD_LIBRARY_PATH=/path-to-clang/lib:$LD_LIBRARY_PATH
Fuzzer Compilation
The build script will resolve most dependencies and setup the runtime environment.
./build/build.sh
System Configuration
As with AFL, system core dumps must be disabled.
echo core | sudo tee /proc/sys/kernel/core_pattern
Test
Test if Angora is builded successfully.
cd /path-to-angora/tests
./test.sh mini
Running Angora
Build Target Program
Angora compiles the program into two separate binaries, each with their respective instrumentation. Using autoconf programs as an example, here are the steps required.
# Use the instrumenting compilers
CC=/path/to/angora/bin/angora-clang \
CXX=/path/to/angora/bin/angora-clang++ \
LD=/path/to/angora/bin/angora-clang \
PREFIX=/path/to/target/directory \
./configure --disable-shared
# Build with taint tracking support
USE_TRACK=1 make -j
make install
# Save the compiled target binary into a new directory
# and rename it with .taint postfix, such as uniq.taint
# Build with light instrumentation support
make clean
USE_FAST=1 make -j
make install
# Save the compiled binary into the directory previously
# created and rename it with .fast postfix, such as uniq.fast
If you fail to build by this approach, try wllvm and gllvm described in Build a target program.
Also, we have implemented taint analysis with libdft64 instead of DFSan (Use libdft64 for taint tracking).
Fuzzing
./angora_fuzzer -i input -o output -t path/to/taint/program -- path/to/fast/program [argv]
For more information, please refer to the documentation under the docs/ directory.
116 Nov 09, 2022
16 Nov 03, 2022
249 Jan 03, 2023
177 Dec 12, 2022
2 Nov 14, 2022
85 Jan 04, 2023
47 Nov 08, 2022
393 Dec 29, 2022
6 Sep 23, 2022
10 Aug 19, 2022
220 Jan 05, 2023
5 Jul 17, 2020
329 Dec 30, 2022
60 Dec 20, 2022
4 Dec 14, 2021
2 Dec 19, 2022
340 Dec 30, 2022
31 Dec 22, 2022
39 Dec 30, 2022
269 Dec 21, 2022