模糊測試是指將可能無效、意外或隨機的資料提供給程式做為輸入內容，是找出大型軟體系統中錯誤的極有效方法，也是軟體開發生命週期中的重要環節。
Android 的建構系統可透過從 LLVM 編譯器基礎架構專案中加入 libFuzzer 來支援模糊測試。LibFuzzer 會連結至測試中的程式庫，並處理在模糊測試工作階段中發生的所有輸入選取、突變和當機回報。LLVM 的消毒劑可協助偵測記憶體毀損情形，並提供程式碼涵蓋率指標。
本文將介紹 Android 上的 libFuzzer，以及如何執行檢測版本。也包含編寫、執行及自訂模糊測試器的操作說明。
設定和建構
為確保裝置上執行的映像檔可正常運作，您可以下載原廠映像檔並刷新裝置。或者，您也可以下載 Android 開放原始碼計畫來源程式碼，然後按照下方的設定和建構範例操作。
設定範例
本例假設目標裝置是 Pixel (taimen)，且已準備好進行 USB 偵錯 (aosp_taimen-userdebug)。您可以從驅動程式二進位檔下載其他 Pixel 二進位檔。
mkdir ~/binexport PATH=~/bin:$PATHcurl https://storage.googleapis.com/git-repo-downloads/repo > ~/bin/repochmod a+x ~/bin/reporepo init -u https://android.googlesource.com/platform/manifest -b mainrepo sync -c -j8wget https://dl.google.com/dl/android/aosp/google_devices-taimen-qq1a.191205.008-f4537f93.tgztar xvf google_devices-taimen-qq1a.191205.008-f4537f93.tgz./extract-google_devices-taimen.shwget https://dl.google.com/dl/android/aosp/qcom-taimen-qq1a.191205.008-760afa6e.tgztar xvf qcom-taimen-qq1a.191205.008-760afa6e.tgz./extract-qcom-taimen.sh. build/envsetup.shlunch aosp_taimen-userdebug
建構範例
執行模糊測試目標的第一步是取得新的系統映像檔。建議您至少使用最新的 Android 開發人員版本。
- 請發出以下指令，執行初始版本：
m
- 如要刷新裝置，請使用適當的按鍵組合，將裝置啟動至快速啟動模式。
- 使用下列指令解鎖系統啟動載入程式，並閃過新編譯的映像檔。
fastboot oem unlockfastboot flashall
目標裝置現在應該已準備好進行 libFuzzer 模糊測試。
編寫模糊測試器
為說明如何在 Android 中使用 libFuzzer 編寫端對端模糊測試器，請使用下列有安全漏洞的程式碼做為測試案例。這有助於測試模糊測試器、確保所有項目正常運作，並說明當機資料的樣貌。
以下是測試函式。
#include <stdint.h> #include <stddef.h> bool FuzzMe(const char *data, size_t dataSize) { return dataSize >= 3 && data[0] == 'F' && data[1] == 'U' && data[2] == 'Z' && data[3] == 'Z'; // ← Out of bounds access }
如要建構及執行這個測試模糊測試器，請按照下列步驟操作：
- 模糊測試目標包含兩個檔案：建構檔案和模糊測試目標原始碼。請在要進行模糊測試的程式庫旁邊建立檔案。為模糊測試器命名，說明模糊測試器的用途。
- 使用 libFuzzer 編寫模糊測試目標。模糊目標是一種函式，可取得指定大小的資料 Blob，並將其傳遞給要模糊處理的函式。以下是針對有安全漏洞的測試函式，提供基本模糊測試工具：
#include <stddef.h> #include <stdint.h> extern "C" int LLVMFuzzerTestOneInput(const char *data, size_t size) { // ... // Use the data to call the library you are fuzzing. // ... return FuzzMe(data, size); }
- 請 Android 的建構系統建立 fuzzer 二進位檔。如要建構模糊測試器，請將下列程式碼新增至
Android.bp檔案：cc_fuzz { name: "fuzz_me_fuzzer", srcs: [ "fuzz_me_fuzzer.cpp", ], // If the fuzzer has a dependent library, uncomment the following section and // include it. // static_libs: [ // "libfoo", // Dependent library // ], // // The advanced features below allow you to package your corpus and // dictionary files during building. You can find more information about // these features at: // - Corpus: https://llvm.org/docs/LibFuzzer.html#corpus // - Dictionaries: https://llvm.org/docs/LibFuzzer.html#dictionaries // These features are not required for fuzzing, but are highly recommended // to gain extra coverage. // To include a corpus folder, uncomment the following line. // corpus: ["corpus/*"], // To include a dictionary, uncomment the following line. // dictionary: "fuzz_me_fuzzer.dict", }
- 如要讓模糊測試器在目標 (裝置) 上執行：
SANITIZE_TARGET=hwaddress m fuzz_me_fuzzer
- 如何製作在主機上執行的模糊測試器：
SANITIZE_HOST=address m fuzz_me_fuzzer
為方便起見，請定義一些殼層變數，其中包含雜訊目標的路徑和二進位檔名稱 (來自先前撰寫的建構檔案)。
export FUZZER_NAME=your_fuzz_target
完成這些步驟後，您應該會擁有已建構的模糊測試器。fuzzer 的預設位置 (針對本例 Pixel 版本) 如下：
在主機上執行模糊測試器
host_supported: true,
$ANDROID_HOST_OUT/fuzz/x86_64/$FUZZER_NAME/$FUZZER_NAME
在裝置上執行模糊測試器
我們想使用 adb 將這個檔案複製到您的裝置。
- 如要將這些檔案上傳至裝置上的目錄，請執行下列指令：
adb rootadb sync data - 使用以下指令在裝置上執行測試模糊器：
adb shell /data/fuzz/$(get_build_var TARGET_ARCH)/$FUZZER_NAME/$FUZZER_NAME \ /data/fuzz/$(get_build_var TARGET_ARCH)/$FUZZER_NAME/corpus
這會產生類似下方範例輸出的輸出內容。
INFO: Seed: 913963180
INFO: Loaded 2 modules (16039 inline 8-bit counters): 16033 [0x7041769b88, 0x704176da29), 6 [0x60e00f4df0, 0x60e00f4df6),
INFO: Loaded 2 PC tables (16039 PCs): 16033 [0x704176da30,0x70417ac440), 6 [0x60e00f4df8,0x60e00f4e58),
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
INFO: A corpus is not provided, starting from an empty corpus
#2 INITED cov: 5 ft: 5 corp: 1/1b exec/s: 0 rss: 24Mb
#10 NEW cov: 6 ft: 6 corp: 2/4b lim: 4 exec/s: 0 rss: 24Mb L: 3/3 MS: 3 CopyPart-ChangeByte-InsertByte-
#712 NEW cov: 7 ft: 7 corp: 3/9b lim: 8 exec/s: 0 rss: 24Mb L: 5/5 MS: 2 InsertByte-InsertByte-
#744 REDUCE cov: 7 ft: 7 corp: 3/7b lim: 8 exec/s: 0 rss: 25Mb L: 3/3 MS: 2 ShuffleBytes-EraseBytes-
#990 REDUCE cov: 8 ft: 8 corp: 4/10b lim: 8 exec/s: 0 rss: 25Mb L: 3/3 MS: 1 ChangeByte-
==18631==ERROR: HWAddressSanitizer: tag-mismatch on address 0x0041e00b4183 at pc 0x0060e00c5144
READ of size 1 at 0x0041e00b4183 tags: f8/03 (ptr/mem) in thread T0
#0 0x60e00c5140 (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0xf140)
#1 0x60e00ca130 (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0x14130)
#2 0x60e00c9b8c (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0x13b8c)
#3 0x60e00cb188 (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0x15188)
#4 0x60e00cbdec (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0x15dec)
#5 0x60e00d8fbc (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0x22fbc)
#6 0x60e00f0a98 (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0x3aa98)
#7 0x7041b75d34 (/data/fuzz/arm64/lib/libc.so+0xa9d34)
[0x0041e00b4180,0x0041e00b41a0) is a small allocated heap chunk; size: 32 offset: 3
0x0041e00b4183 is located 0 bytes to the right of 3-byte region [0x0041e00b4180,0x0041e00b4183)
allocated here:
#0 0x70418392bc (/data/fuzz/arm64/lib/libclang_rt.hwasan-aarch64-android.so+0x212bc)
#1 0x60e00ca040 (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0x14040)
#2 0x60e00c9b8c (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0x13b8c)
#3 0x60e00cb188 (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0x15188)
#4 0x60e00cbdec (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0x15dec)
#5 0x60e00d8fbc (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0x22fbc)
#6 0x60e00f0a98 (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0x3aa98)
#7 0x7041b75d34 (/data/fuzz/arm64/lib/libc.so+0xa9d34)
#8 0x60e00c504c (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0xf04c)
#9 0x70431aa9c4 (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0x519c4)
Thread: T1 0x006700006000 stack: [0x007040c55000,0x007040d4ecc0) sz: 1023168 tls: [0x000000000000,0x000000000000)
Thread: T0 0x006700002000 stack: [0x007fe51f3000,0x007fe59f3000) sz: 8388608 tls: [0x000000000000,0x000000000000)
Memory tags around the buggy address (one tag corresponds to 16 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
08 00 cf 08 dc 08 cd 08 b9 08 1a 1a 0b 00 04 3f
=> 27 00 08 00 bd bd 2d 07 [03] 73 66 66 27 27 20 f6 <=
5b 5b 87 87 03 00 01 00 4f 04 24 24 03 39 2c 2c
05 00 04 00 be be 85 85 04 00 4a 4a 05 05 5f 5f
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Tags for short granules around the buggy address (one tag corresponds to 16 bytes):
04 .. .. cf .. dc .. cd .. b9 .. .. 3f .. 57 ..
=> .. .. 21 .. .. .. .. 2d [f8] .. .. .. .. .. .. .. <=
.. .. .. .. 9c .. e2 .. .. 4f .. .. 99 .. .. ..
See https://clang.llvm.org/docs/HardwareAssistedAddressSanitizerDesign.html#short-granules for a description of short granule tags
Registers where the failure occurred (pc 0x0060e00c5144):
x0 f8000041e00b4183 x1 000000000000005a x2 0000000000000006 x3 000000704176d9c0
x4 00000060e00f4df6 x5 0000000000000004 x6 0000000000000046 x7 000000000000005a
x8 00000060e00f4df0 x9 0000006800000000 x10 0000000000000001 x11 00000060e0126a00
x12 0000000000000001 x13 0000000000000231 x14 0000000000000000 x15 000e81434c909ede
x16 0000007041838b14 x17 0000000000000003 x18 0000007042b80000 x19 f8000041e00b4180
x20 0000006800000000 x21 000000000000005a x22 24000056e00b4000 x23 00000060e00f5200
x24 00000060e0128c88 x25 00000060e0128c20 x26 00000060e0128000 x27 00000060e0128000
x28 0000007fe59f16e0 x29 0000007fe59f1400 x30 00000060e00c5144
SUMMARY: HWAddressSanitizer: tag-mismatch (/data/fuzz/arm64/example_fuzzer/example_fuzzer+0xf140)
MS: 1 ChangeByte-; base unit: e09f9c158989c56012ccd88111b82f778a816eae
0x46,0x55,0x5a,
FUZ
artifact_prefix='./'; Test unit written to ./crash-0eb8e4ed029b774d80f2b66408203801cb982a60
Base64: RlVa
在範例輸出內容中，第 10 行的 fuzz_me_fuzzer.cpp 導致當機：
data[3] == 'Z'; // :(
如果 data 的長度為 3，這就是一個簡單的越界讀取。
執行模糊測試器後，輸出內容通常會導致應用程式當機，而導致問題的輸入內容會儲存在字體庫中，並附上 ID。在範例輸出內容中，這個值為 crash-0eb8e4ed029b774d80f2b66408203801cb982a60。
如要在裝置上執行模糊測試時擷取當機資訊，請發出以下指令，並指定當機 ID：
adb pull /data/fuzz/arm64/fuzz_me_fuzzer/corpus/CRASH_ID
在主機上執行雜訊測試時，當系統執行雜訊產生器的本機資料夾中，會顯示當機資訊。
產生行覆蓋率
程式碼行涵蓋率對開發人員來說非常實用，因為他們可以找出程式碼中未涵蓋的部分，並據此更新模糊測試器，以便在日後的模糊測試執行中測試這些部分。
- 如要產生模糊測試涵蓋率報告，請執行下列步驟：
CLANG_COVERAGE=true NATIVE_COVERAGE_PATHS='*' make ${FUZZER_NAME} - 將模糊測試器及其依附元件推送至裝置後，請使用
LLVM_PROFILE_FILE執行模糊測試目標，如下所示：DEVICE_TRACE_PATH=/data/fuzz/$(get_build_var TARGET_ARCH)/${FUZZER_NAME}/data.profrawadb shell LLVM_PROFILE_FILE=${DEVICE_TRACE_PATH} /data/fuzz/$(get_build_var TARGET_ARCH)/${FUZZER_NAME}/${FUZZER_NAME} -runs=1000 - 產生涵蓋率報告的方法是先從裝置中提取 profraw 檔案，然後在名為 coverage-html 的資料夾中產生 HTML 報告，如下所示：
adb pull ${DEVICE_TRACE_PATH} data.profrawllvm-profdata merge --sparse data.profraw --output data.profdatallvm-cov show --format=html --instr-profile=data.profdata \ symbols/data/fuzz/$(get_build_var TARGET_ARCH)/${FUZZER_NAME}/${FUZZER_NAME} \ --output-dir=coverage-html --path-equivalence=/proc/self/cwd/,$ANDROID_BUILD_TOP