CodeIntelligenceTesting / jazzer

Coverage-guided, in-process fuzzing for the JVM
https://code-intelligence.com
Other
1.03k stars 137 forks source link

Add ability to fuzz bootstrap classes in Android #737

Closed TheCoryBarker closed 1 year ago

TheCoryBarker commented 1 year ago

This work adds a native agent to Jazzer for fuzzing on Android. This will allow us to fuzz classes that are loaded in from the bootstrap classloader. To do this, this agent will

  1. Read DEX files in that have offline instrumented classes (classes that could be in the bootstrap classloader or not).
  2. Hooks the on file load function to swap bytecode of non-instrumented classes with the instrumented version that lives in one of these bootstrap_classes_overrides DEX files.
  3. Since all the BS classes are already loaded into the ArtVM at this point, we will trigger a reload of all of them so we can swap the bytecode.

Since we will be adding instrumentation to the bootstrap classes, we also need to now move the Jazzer sanitizers into the bootstrap, so this agent will also extract the bootstrap jar from the jazzer_standalone_android.apk and inject this into the bootstrap classloader.

fmeum commented 1 year ago

@TheCoryBarker @marktefftech Let me know when you want me to take a look - I am not very knowledgeable about Android internals, but I can ensure that everything is glued up with Jazzer in the right way.

TheCoryBarker commented 1 year ago

@fmeum thank you, can you please take a look when you have a chance?

TheCoryBarker commented 1 year ago

Addressed Marks feedback

TheCoryBarker commented 1 year ago

Thanks Fabian, I addressed the feedback.