Home

Awesome

FANS: Fuzzing Android Native System Services

FANS is a fuzzing tool for fuzzing Android native system services. It contains four components: interface collector, interface model extractor, dependency inferer, and fuzzer engine.

For more details, please refer to our USENIX Security'20 paper.

You could follow the following steps to setup FANS. In the following, we use Pixel 2 XL to illustrate the instructions.

Prepare Host

Please prepare a server with

We suggest using FANS on Ubuntu. We tested it on Ubuntu 18.04.

Prepare Android Environment

Please refer to AOSP for

Suppose we have

Before building, we'd better modify some options in the following files to make fuzzing more convenient.

/path/to/aosp/build/core/main.mk

# line 273
## before modifying
ifneq (,$(user_variant))
  # Target is secure in user builds.
  ADDITIONAL_DEFAULT_PROPERTIES += ro.secure=1
  ADDITIONAL_DEFAULT_PROPERTIES += security.perf_harden=1

  ifeq ($(user_variant),user)
    ADDITIONAL_DEFAULT_PROPERTIES += ro.adb.secure=1
  endif
## after modifying
ifneq (,$(user_variant))
  # Target is secure in user builds.
  ADDITIONAL_DEFAULT_PROPERTIES += ro.secure=1
  ADDITIONAL_DEFAULT_PROPERTIES += security.perf_harden=1

  ADDITIONAL_DEFAULT_PROPERTIES += ro.adb.secure=0
  ADDITIONAL_DEFAULT_PROPERTIES += persist.sys.disable_rescue=1

  #ifeq ($(user_variant),user)
  #  ADDITIONAL_DEFAULT_PROPERTIES += ro.adb.secure=1
  #endif

/path/to/aosp/build/make/target/product/core_minimal.mk

# line 170
## before modifying
ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
    tombstoned.max_tombstone_count=50
endif
## after modifying
ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
    tombstoned.max_tombstone_count=99999
endif

Note, when flashing the image, you should use the correct adb and fastboot version corresponding to the Android version. So please install Android SDK according to the version of the target phone. For instance, we are testing Android 9.0.0_r46, so we install the Android SDK for Android 9.0. After installing the SDK, please create the following symbolic links

sudo ln -s /path/to/sdk/platform-tools/adb /usr/bin/fastboot
sudo ln -s /path/to/sdk/platform-tools/adb /usr/bin/adb

Here are some helpful instructions for flashing a device with ASan enabled.

############################# Flash factory image       #############################
# Before flashing the manually build image, 
# you should flash the mobile phone with the corresponding factory image.
# please refer to the offical website for flashing factory image.

############################# Flash AOSP image without ASan #############################

# we need to compile aosp in a bash environment
bash

cd /path/to/aosp
# prepare environment
source build/envsetup.sh
# select the target version.
# 50 corresponding to the aosp_taimen-userdebug
# you can use lunch to see the allowed choices.
lunch 50

# compile AOSP and save the compile commands
# replace the N_PROCS with the number you want, 
# e.g., make -j15 showcommands 2>&1 >cmd.txt
make -j [N_PROCS] showcommands 2>&1 >cmd.txt

## here, you should run your commands to flash the image.

############################# Flash AOSP image with ASan #############################

cd ..
# copy the entire project to another place.
cp /path/to/aosp /path/to/aosp_asan
cd /path/to/aosp_asan
source build/envsetup.sh
lunch 50

# compile the entire AOSP with ASan enabled
# replace the N_PROCS with the number you want, 
# e.g., SANITIZE_TARGET=address make -j15
SANITIZE_TARGET=address make -j [N_PROCS]

## here, you should run your commands to flash the image with ASan enabled.

Config FANS

Then we need to create a config file fans.cfg for FANS. You could utilize the template fans.template.cfg to set up your config. In detail, we need to config the following options of FANS.

Collect Interface and Related Files

Please see Service Related File Collector.

Extract Interface Model

Please see Interface Model Extractor.

Infer Dependency

Please see Dependency Inferer.

Start Fuzzing

Please see Fuzzer Engine.

Results

workdir contains the following results, including

For details, you can refer to the workdir.

As for the fuzzing results, you can refer to Fuzzer Manager.

If you find bugs by running FANS, please let us know by sending a PR.

TODO

See TODO.

Disclaimer

I am not sure what will happen to your device when using FANS. So good luck!

Contact

Baozheng Liu (uromise@gmail.com)