针对官方文档https://github.com/google/syzkaller和网上教程不是很详细，在一个新的虚拟机配置时总会出现错误。我们从新建虚拟机开始进行讲解
1.安装虚拟机Ubuntu 18.04.4虚拟机
硬盘空间给到40G。
2.安装好虚拟机后先更换国内源
我们更换清华源
sudo su
cd /etc/apt/
echo ``>sources.list
vi sources.list
#复制以下内容
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic main restricted universe multiverse
# deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic main restricted universe multiverse
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-updates main restricted universe multiverse
# deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-updates main restricted universe multiverse
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-backports main restricted universe multiverse
# deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-backports main restricted universe multiverse
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-security main restricted universe multiverse
# deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-security main restricted universe multiverse
：wq #保存退出
#重新打开一个终端
sudo apt-get update
sudo apt-get upgrade
3.安装基本依赖
sudo apt-get install debootstrap
sudo apt install qemu-kvm
sudo apt-get install subversion
sudo apt-get install git
sudo apt-get install make
sudo apt-get install qemu
sudo apt install libssl-dev libelf-dev
sudo apt-get install flex bison libc6-dev libc6-dev-i386 linux-libc-dev linux-libc-dev:i386 libgmp3-dev libmpfr-dev libmpc-dev
apt-get install g++
apt-get install build-essential
4.安装GCC 8.1.0
CC编译需要mpfr和mpc(-->gmp、-->mpfr)库的支持，依次安装这几个库，其中mpfr可直接安装，安装mpc依赖mpfr和gmp库(对版本有要求，建议安装最新版本)，然后执行configure时指定mpfr和gmp的include、lib路径。
下载 MPFR (mpfr-4.0.1), MPFR_patch、GMP (gmp-6.1.2) 和MPC（mpc-1.1.0），链接：https://gmplib.org/ https://www.mpfr.org/mpfr-current/#download
我这里用的 GCC 8.1.0 (https://ftp.gnu.org/gnu/gcc/gcc-8.1.0/gcc-8.1.0.tar.gz)；GMP：6.1.0；MPFR 3.1.4；MPC 1.0.3
一：安装gmp
sudo su
cd /usr/local
cp /mnt/hgfs/Ubuntu-tool/gcc-tool/gmp6.1.2.tar.bz2/ ./ -r #将文件拷贝到/usr/local目录
tar jxvf gmp-6.1.2.tar.bz2
cd gmp-6.1.2
./configure #这一部错误需要 sudo apt-get install m4
make
make install
二:安装mpfr
cd ..
cp /mnt/hgfs/Ubuntu-tool/gcc-tool/mpfr-4.0.1.tar.gz/ ./ -r
tar zxvf mpfr-4.0.1.tar.gz
cd mpfr-4.0.1
./configure
make
make install
三：安装MPC
cd ..
cp /mnt/hgfs/Ubuntu-tool/gcc-tool/mpc-1.1.0.tar.gz / ./ -r
tar zxvf mpc-1.1.0.tar.gz
cd mpc-1.1.0
./configure --with-gmp-include=/usr/local/include --with-gmp-lib=/usr/local/lib --with-mpfr-include=/usr/local/include --with-mpfr-lib=/usr/local/lib
make
make install
四:安装GCC
新建一个终端
cd
vi .bash_profile
#拷贝进去
export C_INCLUDE_PATH=/usr/local/include:$C_INCLUDE_PATH
export LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH
:wq
回到刚才的终端
cd ..
source /root/.bash_profile
cp /mnt/hgfs/Ubuntu-tool/gcc-tool/gcc-8.1.0.tar.gz/ ./ -r
tar -zxvf gcc-8.1.0.tar.gz
mkdir gcc_temp
cd gcc_temp
sudo apt-get install gcc-multilib
../configure --prefix=/usr --with-gmp=/usr/local --with-mpfr=/usr/local --with-mpc=/usr/local
make #很慢
make install
安装完成后 gcc -v可以查看版本
5.配置GO环境编译Syzkaller
这一步官方文档讲的很详细
打开一个终端
wget https://dl.google.com/go/go1.14.2.linux-amd64.tar.gz
tar -xf go1.14.2.linux-amd64.tar.gz
mv go goroot
mkdir gopath
export GOPATH=`pwd`/gopath
export GOROOT=`pwd`/goroot
export PATH=$GOPATH/bin:$PATH
export PATH=$GOROOT/bin:$PATH#配了零时环境变量，所以换了终端要重新配置
go get -u -d github.com/google/syzkaller/prog #很慢
cd gopath/src/github.com/google/syzkaller/
make
成果后/bin/syz-manger文件
6.编译内核和准备镜像
git clone https://mirrors.tuna.tsinghua.edu.cn/git/linux.git
cd ~/source/linux
make CC="/usr/bin/gcc" defconfig
make CC="/usr/bin/gcc" kvmconfig
完成后在当前的目录下找到 .config 文件，如果没有按 ctrl+H 显示隐藏文件，在文档的相应位置加入以下字段，保存。
CONFIG_KCOV=y
CONFIG_DEBUG_INFO=y
CONFIG_KASAN=y
CONFIG_KASAN_INLINE=y
CONFIG_CONFIGFS_FS=y
CONFIG_SECURITYFS=y
make CC="/usr/bin/gcc" olddefconfig
make CC="/usr/bin/gcc" -j64
准备镜像
sudo apt-get install debootstrap
mkdir image
cd image/
wget https://raw.githubusercontent.com/google/syzkaller/master/tools/create-image.sh -O create-image.sh
chmod +x create-image.sh
./create-image.sh -s 1024
最后会得到 ./stretch.img 镜像文件
7.配置虚拟环境（QEMU）
sudo usermod -aG kvm $USER
sudo apt-get install qemu-system-x86
#重新打开终端，测试qemu、内核、镜像
qemu-system-x86_64 \
-kernel $KERNEL/arch/x86/boot/bzImage \
-append "console=ttyS0 root=/dev/sda debug earlyprintk=serial slub_debug=QUZ"\
-hda $IMAGE/stretch.img \
-net user,hostfwd=tcp::10021-:22 -net nic \
-enable-kvm \
-nographic \
-m 2G \
-smp 2 \
-pidfile vm.pid \
2>&1 | tee vm.log
#KVM找不到或无法启动 尝试利用管理员权限或者打开IntelPT在vmware处理器设置部分
开始模糊测试
#返回syzkaller文件目录下，建立 my.cfg 文件
{
"target": "linux/amd64",
"http": "127.0.0.1:56741",
"workdir": "~/fuzz/syzkalls/workdir/",
"kernel_obj": "~/source/linux/",
"image": "~/source/image/stretch.img",
"sshkey": "~/source/image/stretch.id_rsa",
"syzkaller": "~/fuzz/syzkaller",
"procs": 8,
"type": "qemu",
"vm": {
"count": 4,
"kernel": "~/source/linux/arch/x86/boot/bzImage",
"cpu": 2,
"mem": 2048
}
}
#启动manager
mkdir workdir
sudo ./bin/syz-manager -config my.cfg
image.png
有问题欢迎留言，还有很多小细节可能有遗漏。
参考：
https://www.secshi.com/16256.html
https://i-m.dev/posts/20200313-143737.html
https://www.cnblogs.com/joeat1/p/11081601.html
https://blog.csdn.net/weixin_42108484/article/details/83021957
https://blog.csdn.net/flyfish778/article/details/35276883
https://hicookie.me/2019/10/22/Syzkaller-Setup/
https://www.secshi.com/12092.html