Futag
1.0.0
FUTAG is an automated generation tool for phasing-concrete libertines for software libraries. FUTAG provides the possibility of generating phasesing concentrations both in the absence of contexts of using the tested library, and if any. FUTAG uses, as an external interface, to analyze the source code of libraries tools Clang.
A static analyzer implemented in FUTAG during the assembly of the tested library is performed by:
In the presence of use contexts, Futag searches for calls of functions, makes up the dependences between the chases found and draws up the call contexts.
Futag also implements the possibility of obtaining contexts of using the tested library from a tool to determine the surface of the NATCH attack.
Futag's work is illustrated in the following figure: 
This project is based on LLVM with a static analysis of Clang and is distributed under the "GPL V3 License" license
You can try to assemble FUTAG with ready-made dock files for Ubuntu OS.
~ /futag-llvm$ ./buildAFLplusplus.shThis instruction allows you to collect a copy of the project and launch it in the Unix-like system.
The FUTAG tool is based on LLVM-Project. For the compilation of the project, it is necessary that the next packages are installed in your system:
To obtain more detailed information about the dependencies necessary for the assembly of LLVM, you can familiarize yourself with the documentation under the specified link
The Ubuntu system may need to install packages:
~ $ git clone https://github.com/ispras/Futag ~ /Futag/custom-llvm$ ./prepare.shThis script creates the Futag/Build directory and copies the Futag/Custom-llvm/Build.sh script in it
~ /Futag/build$ ./build.shAs a result, the tool will be installed in the Futag/Futag-volvm directory
For assembly AFLPLUSPLUS Launch the BuildaflPlusplus.sh script in Futag/Futag-llvm
~ /Futag/futag-llvm$ ./buildAFLplusplus.sh ~ $ pip install -r futag-llvm/python-package/requirements.txt
~ $ pip install futag-llvm/python-package/futag-2.1.0.tar.gz from futag . preprocessor import *
FUTAG_PATH = "/home/futag/Futag-tests/futag-llvm/"
lib_path = "path/to/library/source/code"
build_test = Builder (
FUTAG_PATH ,
lib_path ,
clean = True , # удалить все папки сгенерированные Futag-ом перед сборкой
# intercept=True, # запуск компиляции с инструментом "intercept" для анализа compile_command.json
# processes=4, # количество задач при сборке
# build_ex_params="--with-openssl --with-mhash" # дополнительные параметры при сборке библиотеки
)
build_test . auto_build ()
build_test . analyze () from futag . generator import *
FUTAG_PATH = "/home/futag/Futag-tests/futag-llvm/"
lib_path = "path/to/library/source/code"
generator = Generator (
FUTAG_PATH , # путь к директории "futag-llvm"
lib_path , # путь к директории содержащей исходные кода исследуемого ПО
# target_type=AFLPLUSPLUS,
)
# Генерация фаззинг-оберток
generator . gen_targets (
anonymous = False # опция для генерации фаззинг-обертки для функций, которые не имеют публичный доступ
max_wrappers = 10 # опция для органичения количества сгенерированных фаззинг-оберток для одной функции
)
# Compile fuzz drivers
generator . compile_targets (
4 , # количество задач при сборке
# keep_failed=True, # сохранить не скомпилированные цели
# extra_include="-DHAVE_CONFIG_H", # дополнительные параметры при сборке библиотеки,
# extra_dynamiclink="-lz", # системные библиотеки для линковки
# flags="-ferror-limit=1", # значение по умолчанию: ""
)By defecting, successfully compiled phasing cones for targeted functions are in the Futag-Fuzz-Drivers catalog, where each target function creates its own subscription, which coincides with the name of the target function.
from futag . preprocessor import *
from futag . generator import *
from futag . fuzzer import *
FUTAG_PATH = "/home/futag/Futag/futag-llvm"
library_root = "json-c-json-c-0.16-20220414"
consumer_root = "libstorj-1.0.3"
consumber_builder = ConsumerBuilder (
FUTAG_PATH , # путь к директории "futag-llvm"
library_root , # путь к директории содержащей исходные кода тестируемой библиотеки
consumer_root , # путь к директории содержащей исходные кода потребительской программы
# clean=True,
# processes=16,
)
consumber_builder . auto_build ()
consumber_builder . analyze ()
context_generator = ContextGenerator (
FUTAG_PATH ,
library_root ,
)
context_generator . gen_context () # генерация фаззинг-оберток для контекстов
context_generator . compile_targets ( #компиляция сгенерированных фаззинг-оберток
keep_failed = True ,
)If several phasing-cones was generated for the function, the corresponding directory is created in the subcatal of the target function, where the serial number is added to the name of the target function. The documentation of the Python package is on the link
Such information about the work of FUTAG can be read at the link
Starting scripts can be viewed here
A FUTAG testing was created over libraries (JSON-C, PHP, FREMAGE, etc.), you can test with a pre-container.
CT Trans and S. Kurmangaleev, "Futag: Automated Fuzz Target Generator for Testware Libraries" 2021 iVannikov Memorial Workem, 2021, PP. 80-85, DOI: 10.1109/IVMEM53963.2021.00021.
CT Trans, D. Ponomarev and A. Kuznheesov, "Research on Automatic Generation of Fuzz-Target for Software Library Function", 2022 Ivannikov ISPRAS OPEN Conference (ISPRAS), Moscow, Russian Federal, 2022, PP. 95-99, DOI: 10.1109/ISPRAS57371.2022.10076871.
Studies on automatic generation of phasing concentrations for libraries, open conference of OSP RAS named after V.P. Ivannikova 2022
| Library | Version | Function | Bug Type | Date of Report | Date of Patch |
|---|---|---|---|---|---|
| Libpng | 1.6.37 | png_convert_from_time_t | AddressSanitizer: Deadlysignal | Feb 8, 2021 | SEP 13, 2022 |
| Tinyxml2 | 9.0.0 | Erroridtoname | Addresssanitizer: Global-Buffer-Overflow | Nov 2, 2022 | Nov 12, 2022 |
| Pugixml | 1.13 | Default_allocate | Addresssanitizer: Allocation-Size-too-Big | APR 11, 2023 | APR 15, 2023 |
| Library | Generation time | Stend-in-old-out-beer | Compilation time | Strest of lines of code |
|---|---|---|---|---|
| Lib Json-C | 180 | 3111 | 612 | 280.019 |
| Libpostgres | 105 | 749 | 29 | 84.387 |
| Curl | 4.210 | 152 | 21 | 9.617 |
| Opensl | 2.172 | 269 | 255 | 19.458 |
| Pugixml | 55 | 61 | 58 | 2.815 |
| Libopus | 75 | 422 | 7 | 12.606 |
