协议Fuzz工具整合

# First, clone this AFLNet repository to a folder named aflnetgit clone <links to the repository> aflnet# Then move to the source code foldercd aflnetmake clean allcd llvm_mode# The following make command may not work if llvm-config cannot be found# To fix this issue, just set the LLVM_CONFIG env. variable to the specific llvm-config version on your machine# On Ubuntu 18.04, it could be llvm-config-6.0 if you have installed clang using apt-getmake# Move to AFLNet's parent foldercd ../..export AFLNET=$(pwd)/aflnetexport WORKDIR=$(pwd) export PATH=$AFLNET:$PATHexport AFL_PATH=$AFLNET

afl-fuzz -d -i in -o out -N <server info> -x <dictionary file> -P <protocol> -D 10000 -q 3 -s 3 -E -K -R <executable binary and its arguments (e.g., port number)>

cd $WORKDIR# Clone live555 repositorygit clone https://github.com/rgaufman/live555.git# Move to the foldercd live555# Checkout the buggy version of Live555git checkout ceeb4f4# Apply a patch. See the detailed explanation for the patch belowpatch -p1 < $AFLNET/tutorials/live555/ceeb4f4.patch# Generate Makefile./genMakefiles linux# Compile the sourcemake clean all

# Move to the folder keeping the RTSP server and clientcd $WORKDIR/live555/testProgs# Copy sample media source files to the server foldercp $AFLNET/tutorials/live555/sample_media_sources/*.* ./# Run the RTSP server on port 8554./testOnDemandRTSPServer 8554# Run the sample client on another screen/terminal./testRTSPClient rtsp://127.0.0.1:8554/wavAudioTest

cd $WORKDIR/live555/testProgs./testOnDemandRTSPServer 8554

tcpdump -w rtsp.pcap -i lo port 8554

./testRTSPClient rtsp://127.0.0.1:8554/wavAudioTest

cd $WORKDIR/live555/testProgsafl-fuzz -d -i $AFLNET/tutorials/live555/in-rtsp -o out-live555 -N tcp://127.0.0.1/8554 -x $AFLNET/tutorials/live555/rtsp.dict -P RTSP -D 10000 -q 3 -s 3 -E -K -R ./testOnDemandRTSPServer 8554

./afl-replay tutorials/live555/CVE_2019_7314.poc RTSP 8554

# Install clang (required by afl-clang-fast)sudo apt-get install clang# Install graphviz developmentsudo apt-get install graphviz-dev  # First, clone this StateAFL repository to a folder named stateaflgit clone <links to the repository> stateafl# Then move to the source code foldercd stateaflmake clean allcd llvm_mode# The following make command may not work if llvm-config cannot be found# To fix this issue, just set the LLVM_CONFIG env. variable to the specific llvm-config version on your machine# On Ubuntu 18.04, it could be llvm-config-6.0 if you have installed clang using apt-getmake# Move to StateAFL's parent foldercd ../..export STATEAFL=$(pwd)/stateafl

protocol-fuzzing-benchmark├── subjects: this folder contains all protocols included in this benchmark and│   │         each protocol may have more than one target server│   └── RTSP│   └── FTP│   │   └── LightFTP│   │       └── Dockerfile: subject-specific Dockerfile│   │       └── run.sh: (subject-specific) main script to run experiment inside a container│   │       └── cov_script.sh: (subject-specific) script to do code coverage analysis│   │       └── other files (e.g., patches, other subject-specific scripts)│   └── ...└── scripts: this folder contains all scripts to run experiments, collect & analyze results│   └── execution│   │   └── profuzzbench_exec_common.sh: main script to spawn containers and run experiments on them│   │   └── ...│   └── analysis│       └── profuzzbench_generate_csv.sh: this script collect code coverage results from different runs│       └── profuzzbench_plot.py: sample script for plotting└── README.md

git clone https://github.com/profuzzbench/profuzzbench.gitcd profuzzbenchexport PFBENCH=$(pwd)export PATH=$PATH:$PFBENCH/scripts/execution:$PFBENCH/scripts/analysis

cd $PFBENCHcd subjects/FTP/LightFTPdocker build . -t lightftp # 为了提高build效率，可以使用以下命令：# docker build . -t lightftp --build-arg -j4 # 使用StateAFL时，使用的是额外定制Dockfile：Dockerfile-stateafl，所以使用的build命令需要指明使用的dockerfiledocker build . -f Dockerfile-stateafl -t lightftp-stateafl

cd $PFBENCHmkdir results-lightftp profuzzbench_exec_common.sh lightftp 4 results-lightftp aflnet out-lightftp-aflnet "-P FTP -D 10000 -q 3 -s 3 -E -K" 3600 5 &profuzzbench_exec_common.sh lightftp 4 results-lightftp aflnwe out-lightftp-aflnwe "-D 10000 -K" 3600 5

cd $PFBENCH/results-lightftp profuzzbench_generate_csv.sh lightftp 4 aflnet results.csv 0profuzzbench_generate_csv.sh lightftp 4 aflnwe results.csv 1

cd $PFBENCH/results-lightftp profuzzbench_plot.py -i results.csv -p lightftp -r 4 -c 60 -s 1 -o cov_over_time.png