Extending Ruzzy with LibAFL

The issue you're encountering with LibAFL is due to how coverage initialization functions are handled differently between LibAFL and LLVM's libFuzzer. Specifically, LibAFL requires the presence of these initialization functions at startup, whereas libFuzzer allows them to be added lazily during runtime.

Understanding Coverage Initialization

Coverage initialization in SanitizerCoverage involves setting up mechanisms like pc-guard, 8bit-counters, etc., which are crucial for tracking code coverage. These mechanisms require specific initialization routines that are typically placed in the .init_array section of an ELF binary. When a fuzzing engine starts, it checks if these initialization functions exist and initializes them accordingly.

Differences Between LibAFL and libFuzzer

• LibAFL:

  • Calls LLVMFuzzerRunDriver, which internally calls fuzz::fuzz.
  • Checks for the presence of coverage counters at startup.
  • If no coverage counters are found, it raises an error: "No maps available; cannot fuzz!"

• libFuzzer:

  • Calls LLVMFuzzerRunDriver as well but does not check for coverage counters at startup.
  • Allows new coverage counter arrays to be included laz

Read the full article at Malware Analysis, News and Indicators - Latest topics

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.