Home

Awesome

PTfuzzer

Introduction

Requirements

You may use check-dep.sh to install the dependent packets.

How to install

cd ptfuzzer/
mkdir build
cd build
cmake ../ -DPREFIX=.
make
make install 

This will install all python scripts and binary files to bin in the current directory.

Linux kernel versions

A linux kernel of 4.13 or 4.14 is recommended.

If a kernel >= 4.15 is used, the kernel has to be booted with the "nopti" option. Beginning with 4.15 page table isolation was introduced to protect against meltdown/spectre attacks which prevents intel_pt to trace a specific process if active.

Using a kernel <= 4.9 is not recommended as the intel_pt support is incomplete

How to run

su
echo core >/proc/sys/kernel/core_pattern
cd /sys/devices/system/cpu
echo performance | tee cpu*/cpufreq/scaling_governor
cd ptfuzzer/build
python ./bin/ptfuzzer.py "-i your/input/directory -o your/output/directory" "your/target/program -arguement"

Configurate runtime parameters

You can edit a config file to control the runtime parameters of ptfuzzer. The config file must be named ptfuzzer.conf, and it can be put in the current working directory or /etc/. Here is an example:

#BRANCH_MODE=TNT_MODE
BRANCH_MODE=TIP_MODE
MEM_LIMIT=100            # afl -m argument
PERF_AUX_BUFFER_SIZE=32  # the size of buffer used to store PT packets.

BRANCH_MODE controls the methods ptfuzzer uses to collect branch information. In TIP_MODE, only the control flow change encoded in the TIP packets are recorded, while TNT_MODE also includes the conditional branch encoded in the TNT packets.

MEM_LIMIT controls the memory limits of the target program. It is the "-m" arguments passed to afl.

PERF_AUX_BUFFER_SIZE controls the size of buffer ptfuzzer allocates for storing PT packest. The PT packets may be truncated if the buffer size is not big enough.

Unsolved Issues