CoreSight Mode

Relevant source files

The following files were used as context for generating this wiki page:

• coresight_mode/README.md
• src/afl-fuzz.c
• include/afl-fuzz.h
• src/afl-fuzz-init.c
• src/afl-analyze.c

CoreSight mode is a feature in AFL++ that enables binary-only fuzzing on ARM64 Linux platforms by leveraging ARM's CoreSight hardware tracing technology. This mode is designed for situations where source code is unavailable, providing an alternative to QEMU-based or other emulation-based instrumentation methods.

Currently, CoreSight mode is in an early development stage and is not recommended for production use. It has been tested on specific hardware boards. The implementation relies on coresight-trace for trace collection and employs a patched glibc to enable the AFL++ fork server for binary-only targets, a design inspired by PTrix.

Sources: coresight_mode/README.md

Supported Hardware

CoreSight mode is dependent on specific hardware capabilities. The following boards are currently supported:

Vendor	Board Model	SoC
NVIDIA	Jetson TX2	NVIDIA Parker
NVIDIA	Jetson Nano	NVIDIA Tegra X1
GIGABYTE	R181-T90	Marvell ThunderX2 CN99XX

Sources: coresight_mode/README.md:6-9

Architecture

The CoreSight mode architecture integrates hardware tracing capabilities into the AFL++ fuzzing loop. It involves several key components working together.

Sources: coresight_mode/README.md

This diagram illustrates the main components and their interactions in CoreSight mode.

• afl-fuzz: The main fuzzer process, initiated with the -A flag to enable CoreSight mode.
• afl-cs-proxy: A proxy application that afl-fuzz executes. This proxy is responsible for managing the coresight-trace library and controlling the execution of the target binary.
• coresight-trace: A submodule and library that provides the low-level interface to ARM's CoreSight hardware tracing functionality.
• Patched Target Binary: The target ELF binary is modified using patchelf to re-link against a patched version of glibc.
• Patched glibc: This modified C library is required to support the AFL++ fork server, which significantly reduces the overhead of exec system calls during the fuzzing loop.

Sources: coresight_mode/README.md:14-20, src/afl-fuzz.c:1018-1027

Setup and Usage

Setting up and using CoreSight mode involves building the necessary components, patching the target binary, and running afl-fuzz with the correct options.

This flowchart outlines the steps to get started with CoreSight mode.

1. Prerequisites

Before building, ensure the Capstone disassembler library is installed, as it is a dependency for coresight-trace.

Sources: coresight_mode/README.md:12

2. Build coresight-trace

First, initialize and update the git submodules, then build the coresight-trace component.

# Check out all git submodules in the cs_mode directory
git submodule update --init --recursive

# Run make in the cs_mode directory
make build

This process creates the cs-proxy binary, which must be placed in the AFL++ root directory as afl-cs-proxy.

Sources: coresight_mode/README.md:22-30

3. Patch Target Binary

To enable the fork server for a binary-only target, the binary must be patched. This requires patchelf and a patched version of glibc, which are built automatically.

make patch TARGET=$BIN

This command will produce a patched binary, typically named $BIN.patched.

Sources: coresight_mode/README.md:33-37

4. Run afl-fuzz

Finally, run afl-fuzz with the -A option to enable CoreSight mode. The fuzzer must be run with sudo privileges to access the CoreSight hardware.

sudo afl-fuzz -A -i input -o output -- /path/to/target.patched @@

Sources: coresight_mode/README.md:40-44, src/afl-fuzz.c:1018-1027

Configuration

CoreSight mode can be configured at runtime using several environment variables.

Variable	Description	Default Value
AFL_CS_CUSTOM_BIN	Overrides the path to the proxy application. If not set, afl-cs-proxy is used.	afl-cs-proxy
AFLCS_COV	Specifies the coverage type for trace decoding. Supported values are edge and path.	edge
AFLCS_UDMABUF	The u-dma-buf device number used for storing trace data in the DMA region.	0

Sources: coresight_mode/README.md:48-55, src/afl-fuzz-init.c:3213-3215

Integration with AFL++

CoreSight mode is activated in afl-fuzz and afl-analyze via a command-line flag.

Command-Line Activation

The -A flag enables CoreSight mode.

// src/afl-fuzz.c:1018-1027
      case 'A':                                           /* CoreSight mode */

  #if !defined(__aarch64__) || !defined(__linux__)
        FATAL("-A option is not supported on this platform");
  #endif

        if (afl->is_main_node || afl->is_secondary_node) {

          FATAL("ARM CoreSight mode is not supported with -M / -S");

        }

        if (afl->fsrv.cs_mode) { FATAL("Multiple -A options not supported"); }

        afl->fsrv.cs_mode = 1;

        break;

This flag sets the cs_mode field in the afl_forkserver_t struct to 1. The mode is mutually exclusive with distributed fuzzing (-M/-S).

Sources: src/afl-fuzz.c:1018-1027, include/afl-fuzz.h:111

Execution Flow

When cs_mode is enabled, afl-fuzz uses the get_cs_argv helper function to prepare the command-line arguments for launching the afl-cs-proxy instead of the target binary directly.

The following diagram shows the sequence of events when afl-fuzz starts a run in CoreSight mode.

Future Development

The CoreSight mode is under active development. The planned improvements include:

• Eliminating the dependency on a modified glibc.
• Adding support for parallel fuzzing.

Sources: coresight_mode/README.md:59-61