Files
bacnet_stack/apps/fuzz-afl
Steve Karg 1520f2c612 Add core stack headers into bacdef.h and cleanup includes. (#602)
* Added dependent BACnet stack headers into bacdef.h file.

* Changed bacdef.h and other stack includes in c/h files to have a common pattern.

* Moved bits.h, bytes.h, and bacnet_stack_exports.h under bacnet/basic/sys/ folder.
2024-03-15 16:58:52 -05:00
..
2023-11-08 15:54:18 -06:00
2023-07-17 10:06:32 -05:00

Getting Started

  • Install AFL, ensure afl-gcc exists on the system:
$ afl-gcc
afl-cc 2.57b by <lcamtuf@google.com>
  • Build via make fuzz-afl from repository root
  • Clone a decent corpus
  • Start AFL and feed it the input/output directories along with target executable
afl-fuzz -i </path/to/corpus/> -o </path/to/output_dir/> -m none ./apps/fuzz-afl/fuzz-afl

Caveats:

  • This builds the target with ASAN (Address Sanitizer). This makes AFL require the -m none to not interpret ASAN's behavior as a crash
  • AFL uses a fork/exec model to launch the target. This is nice because each testcase is from a clean state. But this also brings in a lot of overhead. If you need something faster, check out ../fuzz-libfuzzer/