diff options
Diffstat (limited to 'nixpkgs/pkgs/tools/security/aflplusplus')
5 files changed, 398 insertions, 0 deletions
diff --git a/nixpkgs/pkgs/tools/security/aflplusplus/default.nix b/nixpkgs/pkgs/tools/security/aflplusplus/default.nix new file mode 100644 index 000000000000..a63f80c68ad1 --- /dev/null +++ b/nixpkgs/pkgs/tools/security/aflplusplus/default.nix @@ -0,0 +1,173 @@ +{ lib, stdenv, stdenvNoCC, fetchFromGitHub, callPackage, makeWrapper +, clang, llvm, gcc, which, libcgroup, python3, perl, gmp +, file, wine ? null +, cmocka +, llvmPackages +}: + +# wine fuzzing is only known to work for win32 binaries, and using a mixture of +# 32 and 64-bit libraries ... complicates things, so it's recommended to build +# a full 32bit version of this package if you want to do wine fuzzing +assert (wine != null) -> (stdenv.targetPlatform.system == "i686-linux"); + +let + aflplusplus-qemu = callPackage ./qemu.nix { }; + qemu-exe-name = if stdenv.targetPlatform.system == "x86_64-linux" then "qemu-x86_64" + else if stdenv.targetPlatform.system == "i686-linux" then "qemu-i386" + else throw "aflplusplus: no support for ${stdenv.targetPlatform.system}!"; + libdislocator = callPackage ./libdislocator.nix { inherit aflplusplus; }; + libtokencap = callPackage ./libtokencap.nix { inherit aflplusplus; }; + aflplusplus = stdenvNoCC.mkDerivation rec { + pname = "aflplusplus"; + version = "4.06c"; + + src = fetchFromGitHub { + owner = "AFLplusplus"; + repo = "AFLplusplus"; + rev = version; + sha256 = "sha256-Gb1nYDBnwLS+m8e1UD0WLIrnp8KRgliGQVvQD22JXrQ="; + }; + enableParallelBuilding = true; + + # Note: libcgroup isn't needed for building, just for the afl-cgroup + # script. + nativeBuildInputs = [ makeWrapper which clang gcc ]; + buildInputs = [ llvm python3 gmp llvmPackages.bintools ] + ++ lib.optional (wine != null) python3.pkgs.wrapPython; + + # Flag is already set by package and causes some compiler warnings. + # warning: "_FORTIFY_SOURCE" redefined + hardeningDisable = [ "fortify" ]; + + postPatch = '' + # Don't care about this. + rm Android.bp + + # Replace the CLANG_BIN variables with the correct path. + # Replace "gcc" and friends with full paths in afl-gcc. + # Prevents afl-gcc picking up any (possibly incorrect) gcc from the path. + # Replace LLVM_BINDIR with a non-existing path to give a hard error when it's used. + substituteInPlace src/afl-cc.c \ + --replace "CLANGPP_BIN" '"${clang}/bin/clang++"' \ + --replace "CLANG_BIN" '"${clang}/bin/clang"' \ + --replace '"gcc"' '"${gcc}/bin/gcc"' \ + --replace '"g++"' '"${gcc}/bin/g++"' \ + --replace 'getenv("AFL_PATH")' "(getenv(\"AFL_PATH\") ? getenv(\"AFL_PATH\") : \"$out/lib/afl\")" + + substituteInPlace src/afl-ld-lto.c \ + --replace 'LLVM_BINDIR' '"/nixpkgs-patched-does-not-exist"' + + # Remove the rest of the line + sed -i 's|LLVM_BINDIR = .*|LLVM_BINDIR = |' utils/aflpp_driver/GNUmakefile + substituteInPlace utils/aflpp_driver/GNUmakefile \ + --replace 'LLVM_BINDIR = ' 'LLVM_BINDIR = ${clang}/bin/' + + substituteInPlace GNUmakefile.llvm \ + --replace "\$(LLVM_BINDIR)/clang" "${clang}/bin/clang" + ''; + + env.NIX_CFLAGS_COMPILE = toString [ + # Needed with GCC 12 + "-Wno-error=use-after-free" + ]; + + makeFlags = [ + "PREFIX=$(out)" + "USE_BINDIR=0" + ]; + buildPhase = '' + runHook preBuild + + common="$makeFlags -j$NIX_BUILD_CORES" + make distrib $common + make -C qemu_mode/libcompcov $common + make -C qemu_mode/unsigaction $common + + runHook postBuild + ''; + + postInstall = '' + # remove afl-clang(++) which are just symlinks to afl-clang-fast + rm $out/bin/afl-clang $out/bin/afl-clang++ + + # the makefile neglects to install unsigaction + cp qemu_mode/unsigaction/unsigaction*.so $out/lib/afl/ + + # Install the custom QEMU emulator for binary blob fuzzing. + ln -s ${aflplusplus-qemu}/bin/${qemu-exe-name} $out/bin/afl-qemu-trace + + # give user a convenient way of accessing libcompconv.so, libdislocator.so, libtokencap.so + cat > $out/bin/get-afl-qemu-libcompcov-so <<END + #!${stdenv.shell} + echo $out/lib/afl/libcompcov.so + END + chmod +x $out/bin/get-afl-qemu-libcompcov-so + ln -s ${libdislocator}/bin/get-libdislocator-so $out/bin/ + ln -s ${libtokencap}/bin/get-libtokencap-so $out/bin/ + + # Install the cgroups wrapper for asan-based fuzzing. + cp utils/asan_cgroups/limit_memory.sh $out/bin/afl-cgroup + chmod +x $out/bin/afl-cgroup + substituteInPlace $out/bin/afl-cgroup \ + --replace "cgcreate" "${libcgroup}/bin/cgcreate" \ + --replace "cgexec" "${libcgroup}/bin/cgexec" \ + --replace "cgdelete" "${libcgroup}/bin/cgdelete" + + patchShebangs $out/bin + + '' + lib.optionalString (wine != null) '' + substitute afl-wine-trace $out/bin/afl-wine-trace \ + --replace "qemu_mode/unsigaction" "$out/lib/afl" + chmod +x $out/bin/afl-wine-trace + + # qemu needs to be fed ELFs, not wrapper scripts, so we have to cheat a bit if we + # detect a wrapped wine + for winePath in ${wine}/bin/.wine ${wine}/bin/wine; do + if [ -x $winePath ]; then break; fi + done + makeWrapperArgs="--set-default 'AFL_WINE_PATH' '$winePath'" \ + wrapPythonProgramsIn $out/bin ${python3.pkgs.pefile} + ''; + + nativeInstallCheckInputs = [ perl file cmocka ]; + doInstallCheck = true; + installCheckPhase = '' + runHook preInstallCheck + + # replace references to tools in build directory with references to installed locations + substituteInPlace test/test-qemu-mode.sh \ + --replace '../libcompcov.so' '`$out/bin/get-afl-qemu-libcompcov-so`' \ + --replace '../afl-qemu-trace' '$out/bin/afl-qemu-trace' \ + --replace '../afl-fuzz' '$out/bin/afl-fuzz' \ + --replace '../qemu_mode/unsigaction/unsigaction32.so' '$out/lib/afl/unsigaction32.so' \ + --replace '../qemu_mode/unsigaction/unsigaction64.so' '$out/lib/afl/unsigaction64.so' + + substituteInPlace test/test-libextensions.sh \ + --replace '../libdislocator.so' '`$out/bin/get-libdislocator-so`' \ + --replace '../libtokencap.so' '`$out/bin/get-libtokencap-so`' + substituteInPlace test/test-llvm.sh \ + --replace '../afl-cmin.bash' '`$out/bin/afl-cmin.bash`' + # perl -pi -e 's|(?<!\.)(?<!-I)(\.\./)([^\s\/]+?)(?<!\.c)(?<!\.s?o)(?=\s)|\$out/bin/\2|g' test/test.sh + patchShebangs . + cd test && ./test-all.sh + + runHook postInstallCheck + ''; + + passthru = { + inherit libdislocator libtokencap; + qemu = aflplusplus-qemu; + }; + + meta = { + description = '' + A heavily enhanced version of AFL, incorporating many features + and improvements from the community + ''; + homepage = "https://aflplus.plus"; + license = lib.licenses.asl20; + platforms = ["x86_64-linux" "i686-linux"]; + maintainers = with lib.maintainers; [ ris mindavi ]; + }; + }; +in aflplusplus diff --git a/nixpkgs/pkgs/tools/security/aflplusplus/libdislocator.nix b/nixpkgs/pkgs/tools/security/aflplusplus/libdislocator.nix new file mode 100644 index 000000000000..6a17ff9703b8 --- /dev/null +++ b/nixpkgs/pkgs/tools/security/aflplusplus/libdislocator.nix @@ -0,0 +1,36 @@ +{ lib, stdenv, aflplusplus}: + +stdenv.mkDerivation { + version = lib.getVersion aflplusplus; + pname = "libdislocator"; + + src = aflplusplus.src; + postUnpack = "chmod -R +w ${aflplusplus.src.name}"; + sourceRoot = "${aflplusplus.src.name}/utils/libdislocator"; + + makeFlags = [ "PREFIX=$(out)" ]; + + preInstall = '' + mkdir -p $out/lib/afl + ''; + + postInstall = '' + mkdir $out/bin + cat > $out/bin/get-libdislocator-so <<END + #!${stdenv.shell} + echo $out/lib/afl/libdislocator.so + END + chmod +x $out/bin/get-libdislocator-so + ''; + + meta = with lib; { + homepage = "https://github.com/vanhauser-thc/AFLplusplus"; + description = '' + Drop-in replacement for the libc allocator which improves + the odds of bumping into heap-related security bugs in + several ways. + ''; + license = lib.licenses.asl20; + maintainers = with maintainers; [ ris ]; + }; +} diff --git a/nixpkgs/pkgs/tools/security/aflplusplus/libtokencap.nix b/nixpkgs/pkgs/tools/security/aflplusplus/libtokencap.nix new file mode 100644 index 000000000000..8bad6c607c2d --- /dev/null +++ b/nixpkgs/pkgs/tools/security/aflplusplus/libtokencap.nix @@ -0,0 +1,32 @@ +{ lib, stdenv, aflplusplus}: + +stdenv.mkDerivation { + version = lib.getVersion aflplusplus; + pname = "libtokencap"; + + src = aflplusplus.src; + postUnpack = "chmod -R +w ${aflplusplus.src.name}"; + sourceRoot = "${aflplusplus.src.name}/utils/libtokencap"; + + makeFlags = [ "PREFIX=$(out)" ]; + + preInstall = '' + mkdir -p $out/lib/afl + mkdir -p $out/share/doc/afl + ''; + postInstall = '' + mkdir $out/bin + cat > $out/bin/get-libtokencap-so <<END + #!${stdenv.shell} + echo $out/lib/afl/libtokencap.so + END + chmod +x $out/bin/get-libtokencap-so + ''; + + meta = with lib; { + homepage = "https://github.com/AFLplusplus/AFLplusplus"; + description = "strcmp & memcmp token capture library"; + license = lib.licenses.asl20; + maintainers = with maintainers; [ ris ]; + }; +} diff --git a/nixpkgs/pkgs/tools/security/aflplusplus/qemu-no-etc-install.patch b/nixpkgs/pkgs/tools/security/aflplusplus/qemu-no-etc-install.patch new file mode 100644 index 000000000000..5dfbfd780f1c --- /dev/null +++ b/nixpkgs/pkgs/tools/security/aflplusplus/qemu-no-etc-install.patch @@ -0,0 +1,13 @@ +diff --git a/Makefile b/Makefile +index d6b9dc1..ce7c493 100644 +--- a/Makefile ++++ b/Makefile +@@ -601,7 +601,7 @@ install-localstatedir: + endif + + +-install: all $(if $(BUILD_DOCS),install-doc) install-datadir install-localstatedir ++install: all $(if $(BUILD_DOCS),install-doc) install-datadir + ifneq ($(TOOLS),) + $(call install-prog,$(subst qemu-ga,qemu-ga$(EXESUF),$(TOOLS)),$(DESTDIR)$(bindir)) + endif diff --git a/nixpkgs/pkgs/tools/security/aflplusplus/qemu.nix b/nixpkgs/pkgs/tools/security/aflplusplus/qemu.nix new file mode 100644 index 000000000000..89e537766ddb --- /dev/null +++ b/nixpkgs/pkgs/tools/security/aflplusplus/qemu.nix @@ -0,0 +1,144 @@ +{ lib +, stdenv +, python3 +, zlib +, pkg-config +, glib +, perl +, texinfo +, libuuid +, flex +, bison +, pixman +, meson +, fetchFromGitHub +, ninja +}: + +let + qemuName = "qemu-5.2.50"; +in +stdenv.mkDerivation { + name = "aflplusplus-${qemuName}"; + + src = fetchFromGitHub { + owner = "AFLplusplus"; + repo = "qemuafl"; + rev = "0569eff8a12dec73642b96757f6b5b51a618a03a"; + sha256 = "sha256-nYWHyRfOH2p9znRxjxsiyw11uZuMBiuJfEc7FHM5X7M="; + fetchSubmodules = true; + }; + + nativeBuildInputs = [ + python3 + perl + pkg-config + flex + bison + meson + texinfo + ninja + ]; + + buildInputs = [ + zlib + glib + pixman + libuuid + ]; + + enableParallelBuilding = true; + + dontUseMesonConfigure = true; # meson's configurePhase isn't compatible with qemu build + preBuild = "cd build"; + preConfigure = '' + # this script isn't marked as executable b/c it's indirectly used by meson. Needed to patch its shebang + chmod +x ./scripts/shaderinclude.pl + patchShebangs . + ''; + + configureFlags = + [ + "--target-list=${stdenv.hostPlatform.uname.processor}-linux-user" + "--sysconfdir=/etc" + "--localstatedir=/var" + "--meson=meson" + "--disable-system" + "--enable-linux-user" + "--enable-pie" + "--audio-drv-list=" + "--disable-blobs" + "--disable-bochs" + "--disable-brlapi" + "--disable-bsd-user" + "--disable-bzip2" + "--disable-cap-ng" + "--disable-cloop" + "--disable-curl" + "--disable-curses" + "--disable-dmg" + "--disable-fdt" + "--disable-gcrypt" + "--disable-glusterfs" + "--disable-gnutls" + "--disable-gtk" + "--disable-guest-agent" + "--disable-iconv" + "--disable-libiscsi" + "--disable-libnfs" + "--disable-libssh" + "--disable-libusb" + "--disable-linux-aio" + "--disable-live-block-migration" + "--disable-lzo" + "--disable-nettle" + "--disable-numa" + "--disable-opengl" + "--disable-parallels" + "--disable-plugins" + "--disable-qcow1" + "--disable-qed" + "--disable-rbd" + "--disable-rdma" + "--disable-replication" + "--disable-sdl" + "--disable-seccomp" + "--disable-sheepdog" + "--disable-smartcard" + "--disable-snappy" + "--disable-spice" + "--disable-system" + "--disable-tools" + "--disable-tpm" + "--disable-usb-redir" + "--disable-vde" + "--disable-vdi" + "--disable-vhost-crypto" + "--disable-vhost-kernel" + "--disable-vhost-net" + "--disable-vhost-scsi" + "--disable-vhost-user" + "--disable-vhost-vdpa" + "--disable-vhost-vsock" + "--disable-virglrenderer" + "--disable-virtfs" + "--disable-vnc" + "--disable-vnc-jpeg" + "--disable-vnc-png" + "--disable-vnc-sasl" + "--disable-vte" + "--disable-vvfat" + "--disable-xen" + "--disable-xen-pci-passthrough" + "--disable-xfsctl" + "--without-default-devices" + ]; + + meta = with lib; { + homepage = "https://github.com/AFLplusplus/qemuafl"; + description = "Fork of QEMU with AFL++ instrumentation support"; + license = licenses.gpl2Plus; + maintainers = with maintainers; [ ris ]; + platforms = platforms.linux; + }; +} |