google / honggfuzz

Security oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)
https://honggfuzz.dev
Apache License 2.0
3.09k stars 517 forks source link

Does not support Apple Silicon #477

Open yaroslavyaroslav opened 2 years ago

yaroslavyaroslav commented 2 years ago

It fails to build because of there's no build case for Apple silicon.

make
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/cc -c -O3 -mtune=native -funroll-loops -std=c11 -I/usr/local/include -D_GNU_SOURCE -Wall -Wextra -Werror -Wno-format-truncation -Wno-override-init -I. -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX13.0.sdk -x objective-c -pedantic -fblocks -Wno-unused-parameter -Wimplicit -Wunused -Wcomment -Wchar-subscripts -Wuninitialized -Wreturn-type -Wpointer-arith -Wno-gnu-case-range -Wno-gnu-designator -Wno-deprecated-declarations -Wno-unknown-pragmas -Wno-attributes -Wno-embedded-directive -Wno-initializer-overrides -Wno-unknown-warning-option -Wno-gnu-empty-initializer -Wno-format-pedantic -Wno-gnu-statement-expression -mllvm -inline-threshold=2000 -D_HF_ARCH_DARWIN -fblocks -o mac/arch.o mac/arch.c
mac/arch.c:699:5: error: unknown type name 'x86_thread_state_t'; did you mean 'arm_thread_state_t'?
    x86_thread_state_t* platform_in_state = ((x86_thread_state_t*)(void*)in_state);
    ^~~~~~~~~~~~~~~~~~
    arm_thread_state_t
/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX13.0.sdk/usr/include/mach/arm/thread_status.h:101:36: note: 'arm_thread_state_t' declared here
typedef _STRUCT_ARM_THREAD_STATE   arm_thread_state_t;
                                   ^
mac/arch.c:699:66: error: expected expression
    x86_thread_state_t* platform_in_state = ((x86_thread_state_t*)(void*)in_state);
                                                                 ^
mac/arch.c:699:47: error: use of undeclared identifier 'x86_thread_state_t'
    x86_thread_state_t* platform_in_state = ((x86_thread_state_t*)(void*)in_state);
                                              ^
mac/arch.c:699:68: error: expected expression
    x86_thread_state_t* platform_in_state = ((x86_thread_state_t*)(void*)in_state);
                                                                   ^
mac/arch.c:701:50: error: no member named 'tsh' in 'struct __darwin_arm_thread_state'
    if (x86_THREAD_STATE32 == platform_in_state->tsh.flavor) {
                              ~~~~~~~~~~~~~~~~~  ^
mac/arch.c:701:9: error: use of undeclared identifier 'x86_THREAD_STATE32'
    if (x86_THREAD_STATE32 == platform_in_state->tsh.flavor) {
        ^
mac/arch.c:702:38: error: no member named 'uts' in 'struct __darwin_arm_thread_state'
        run->pc = platform_in_state->uts.ts32.__eip;
                  ~~~~~~~~~~~~~~~~~  ^
mac/arch.c:704:38: error: no member named 'uts' in 'struct __darwin_arm_thread_state'
        run->pc = platform_in_state->uts.ts64.__rip;
                  ~~~~~~~~~~~~~~~~~  ^
8 errors generated.
make: *** [mac/arch.o] Error 1
robertswiecki commented 2 years ago

I think this code is used for getting instruction pointer. If your C-fu is strong enough, I'd suggest surrounding it with ifdef's for given CPU arch, like here

https://github.com/google/honggfuzz/blob/master/linux/trace.c#L80

and send me a PR with correct code?

yaroslavyaroslav commented 2 years ago

Well my C-fu is quite opposite, actually, but I guess this one I could have handled with some time. For now (totally noob about this codebase) this kind of work looks more boilerplate rather than the one that requires any deep knowledge about that.

devnexen commented 2 years ago

I think this code is used for getting instruction pointer. If your C-fu is strong enough, I'd suggest surrounding it with ifdef's for given CPU arch, like here

https://github.com/google/honggfuzz/blob/master/linux/trace.c#L80

There is that but ultimately there is also the fact that CrashReport* binaries are for x86 arch ?

robertswiecki commented 2 years ago

Yeah, I don't know where to get aarch64 crashwrangler libs - I merely compile it on some mac to verify that it builds, I'm not sure how it exactly works.

FWIW I added code here https://github.com/google/honggfuzz/commit/d9e70def49f628f066df01e473a5ab924d65184c - but one will have to find relevant lib and put it here https://github.com/google/honggfuzz/tree/master/third_party/mac for it to compile

awakened1712 commented 1 year ago

Yeah, I don't know where to get aarch64 crashwrangler libs - I merely compile it on some mac to verify that it builds, I'm not sure how it exactly works.

FWIW I added code here d9e70de - but one will have to find relevant lib and put it here https://github.com/google/honggfuzz/tree/master/third_party/mac for it to compile

Any updates? Do we have a new crashwrangler?

devnexen commented 1 year ago

in the "old days" there was the crashwrangler source code if you had a apple license seems no longer the case (I might be wrong) to be able to provide the object file but I would not be surprised if it did not compile on arm64 (again can be wrong here), maybe in the long run the solution is to find a replacement.

robertswiecki commented 1 year ago

Could POSIX code work instead?

OS=POSIX make clean all

??

devnexen commented 1 year ago

wish it did but there is no such timer_t type in macOs.

robertswiecki commented 1 year ago

I don't think it was used anywhere? Please try at HEAD, I removed it with https://github.com/google/honggfuzz/commit/2880d456829bbd6739b69ee1b8f48f07275373e2

devnexen commented 1 year ago

another failure, libhfcommon/util.c <link.h> header does not exist. I ll see at some point if it s doable.

raefko commented 4 months ago

Hello, using OS=POSIX make clean all I am able to compile. But when I run the fuzzer with a simple code I have some errors [2024-08-02T11:13:15+0200][E][41243] subproc_PrepareExecv():317 lseek(_HF_INPUT_FD=1021, 0, SEEK_SET): Illegal seek [2024-08-02T11:13:15+0200][E][41243] subproc_New():403 subproc_PrepareExecv() failed [2024-08-02T11:13:15+0200][W][35940] input_setSize():57 ftruncate(run->dynfile->fd=8, sz=0): Invalid argument ^C[2024-08-02T11:13:15+0200][W][35940] input_setSize():57 ftruncate(run->dynfile->fd=7, sz=0): Invalid argument [2024-08-02T11:13:15+0200][W][35940] input_setSize():57 ftruncate(run->dynfile->fd=7, sz=8): Invalid argument

Any fix for this? Thanks !