1*5d5fbe79SDavid van Moolenbroek 2*5d5fbe79SDavid van MoolenbroekFuzzing the lwIP stack (afl-fuzz requires linux/unix or similar) 3*5d5fbe79SDavid van Moolenbroek 4*5d5fbe79SDavid van MoolenbroekThis directory contains a small app that reads Ethernet frames from stdin and 5*5d5fbe79SDavid van Moolenbroekprocesses them. It is used together with the 'american fuzzy lop' tool (found 6*5d5fbe79SDavid van Moolenbroekat http://lcamtuf.coredump.cx/afl/) and the sample inputs to test how 7*5d5fbe79SDavid van Moolenbroekunexpected inputs are handled. The afl tool will read the known inputs, and 8*5d5fbe79SDavid van Moolenbroektry to modify them to exercise as many code paths as possible, by instrumenting 9*5d5fbe79SDavid van Moolenbroekthe code and keeping track of which code is executed. 10*5d5fbe79SDavid van Moolenbroek 11*5d5fbe79SDavid van MoolenbroekJust running make will produce the test program. 12*5d5fbe79SDavid van Moolenbroek 13*5d5fbe79SDavid van MoolenbroekThen run afl with: 14*5d5fbe79SDavid van Moolenbroek 15*5d5fbe79SDavid van Moolenbroekafl-fuzz -i inputs/<INPUT> -o output ./lwip_fuzz 16*5d5fbe79SDavid van Moolenbroek 17*5d5fbe79SDavid van Moolenbroekand it should start working. It will probably complain about CPU scheduler, 18*5d5fbe79SDavid van Moolenbroekset AFL_SKIP_CPUFREQ=1 to ignore it. 19*5d5fbe79SDavid van MoolenbroekIf it complains about invalid "/proc/sys/kernel/core_pattern" setting, try 20*5d5fbe79SDavid van Moolenbroekexecuting "sudo bash -c 'echo core > /proc/sys/kernel/core_pattern'". 21*5d5fbe79SDavid van Moolenbroek 22*5d5fbe79SDavid van MoolenbroekThe input is split into different subdirectories since they test different 23*5d5fbe79SDavid van Moolenbroekparts of the code, and since you want to run one instance of afl-fuzz on each 24*5d5fbe79SDavid van Moolenbroekcore. 25*5d5fbe79SDavid van Moolenbroek 26*5d5fbe79SDavid van MoolenbroekWhen afl finds a crash or a hang, the input that caused it will be placed in 27*5d5fbe79SDavid van Moolenbroekthe output directory. If you have hexdump and text2pcap tools installed, 28*5d5fbe79SDavid van Moolenbroekrunning output_to_pcap.sh <outputdir> will create pcap files for each input 29*5d5fbe79SDavid van Moolenbroekfile to simplify viewing in wireshark. 30*5d5fbe79SDavid van Moolenbroek 31*5d5fbe79SDavid van MoolenbroekThe lwipopts.h file needs to have checksum checking off, otherwise almost every 32*5d5fbe79SDavid van Moolenbroekpacket will be discarded because of that. The other options can be tuned to 33*5d5fbe79SDavid van Moolenbroekexpose different parts of the code. 34*5d5fbe79SDavid van Moolenbroek 35