$ sudo apt update
$ sudo apt install git make build-essential clang ninja-build pkg-config libglib2.0-dev libpixman-1-dev
$ git clone https://github.com/AFLplusplus/AFLplusplus.git
$ cd AFLplusplus
$ make all
$ cd qemu_mode
$ CPU_TARGET=arm ./build_qemu_support.sh # 这里编译ARM架构的
$ binwalk -Me tpra_sr20v1_us-up-ver1-2-1-P522_20180518-rel77140_2018-05-21_08.42.04.bin
$ QEMU_LD_PREFIX=./squashfs-root/ /root/桌面/AFLplusplus/afl-fuzz \
-Q \
-i bmp-input \
-o bmp-output \
-- ./squashfs-root/usr/bin/bmp2tiff @@ /dev/null
-Q:适用qemu模式
-i:输入文件夹
-o:输出文件夹
@@:表示将用来替换的样本
/dev/null:忽略错误信息
John Smith Ola Nordmann Langgt 234000 Stavanger Norway Empire Burlesque Special Edition 1 10.90 Hide your heart 1 9.90
$ /root/桌面/my_firmwares/_RV130X_FW_1.0.3.55.bin.extracted/
$ QEMU_LD_PREFIX=./squashfs-root/ /root/桌面/AFLplusplus/afl-fuzz \
-Q \
-i input-xml/ \
-o output-xml/ \
-- ./squashfs-root/usr/sbin/xmlparser1 -f @@
-Q:在 Qemu 模式下使用 AFL++
-i:输入目录的路径
-o:输出目录的路径。此目录将包含触发二进制文件上有趣行为的文件,例如崩溃或挂起
在运行时,AFL++ 会将@@ 参数替换为输入文件的名称
{"name":"Jason Ray","profession":"Software Engineer","age":31,"address":{"city":"New York","postalCode":64780,"Country":"USA"},"socialProfiles":[{"name":"Twitter","link":"https://twitter.com"},{"name":"Facebook","link":"https://www.facebook.com"}]}
$ /root/桌面/my_firmwares/_RV130X_FW_1.0.3.55.bin.extracted/
QEMU_LD_PREFIX=./squashfs-root/ /root/桌面/AFLplusplus/afl-fuzz \
-Q \
-i input-json \
-o output-json \
-- ./squashfs-root/usr/sbin/jsonparse @@
GitHub - AFLplusplus/AFLplusplus: The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!
Fuzzing IoT binaries with AFL++ - Part I (attify.com)
Fuzzing IoT binaries with AFL++ - Part II (attify.com)
IOT Fuzzing框架AFL++ (上)-安全客 - 安全资讯平台 (anquanke.com)