Angora
Angora is a mutation-based coverage guided fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution.
Published Work
Arxiv: Angora: Efficient Fuzzing by Principled Search, S&P 2018.
Building Angora
Build Requirements
- Linux-amd64 (Tested on Ubuntu 16.04/18.04 and Debian Buster)
- Rust stable (>= 1.31), can be obtained using rustup
- LLVM 4.0.0 - 7.1.0 : run
PREFIX=/path-to-install ./build/install_llvm.sh.
Environment Variables
Append the following entries in the shell configuration file (~/.bashrc, ~/.zshrc).
export PATH=/path-to-clang/bin:$PATH
export LD_LIBRARY_PATH=/path-to-clang/lib:$LD_LIBRARY_PATH
Fuzzer Compilation
The build script will resolve most dependencies and setup the runtime environment.
./build/build.sh
System Configuration
As with AFL, system core dumps must be disabled.
echo core | sudo tee /proc/sys/kernel/core_pattern
Test
Test if Angora is builded successfully.
cd /path-to-angora/tests
./test.sh mini
Running Angora
Build Target Program
Angora compiles the program into two separate binaries, each with their respective instrumentation. Using autoconf programs as an example, here are the steps required.
# Use the instrumenting compilers
CC=/path/to/angora/bin/angora-clang \
CXX=/path/to/angora/bin/angora-clang++ \
LD=/path/to/angora/bin/angora-clang \
PREFIX=/path/to/target/directory \
./configure --disable-shared
# Build with taint tracking support
USE_TRACK=1 make -j
make install
# Save the compiled target binary into a new directory
# and rename it with .taint postfix, such as uniq.taint
# Build with light instrumentation support
make clean
USE_FAST=1 make -j
make install
# Save the compiled binary into the directory previously
# created and rename it with .fast postfix, such as uniq.fast
If you fail to build by this approach, try wllvm and gllvm described in Build a target program.
Also, we have implemented taint analysis with libdft64 instead of DFSan (Use libdft64 for taint tracking).
Fuzzing
./angora_fuzzer -i input -o output -t path/to/taint/program -- path/to/fast/program [argv]
For more information, please refer to the documentation under the docs/ directory.
109 Dec 29, 2022
27 Sep 24, 2022
175 Dec 29, 2022
2 Dec 16, 2021
174 Dec 22, 2022
12 Dec 11, 2022
3 Dec 28, 2021
3.1k Jan 02, 2023
10.1k Dec 30, 2022
1 Jan 12, 2022
4.9k Jan 05, 2023
295 Dec 29, 2022
8 Nov 25, 2022
12 Oct 25, 2022
0 Jan 08, 2022
774 Dec 31, 2022
0 Jul 14, 2021
759 Jan 08, 2023
106 Jan 06, 2023
42 Jan 01, 2023