1*08b48e0bSAndroid Build Coastguard Worker# argv_fuzzing feature 2*08b48e0bSAndroid Build Coastguard WorkerAFL++ supports fuzzing file inputs or standard input. The argv_fuzzing feature 3*08b48e0bSAndroid Build Coastguard Workerallows for the fuzzing of arguments passed to a program from the command line 4*08b48e0bSAndroid Build Coastguard Workerinterface rather than from STDIN. 5*08b48e0bSAndroid Build Coastguard Worker 6*08b48e0bSAndroid Build Coastguard Worker## With source code 7*08b48e0bSAndroid Build Coastguard WorkerWhen the source code is available, a specific macro from the `argv-fuzz-inl.h` 8*08b48e0bSAndroid Build Coastguard Workerheader file can be used to change the program's behavior to build argv from STDIN. 9*08b48e0bSAndroid Build Coastguard Worker 10*08b48e0bSAndroid Build Coastguard Worker### Without persistent mode 11*08b48e0bSAndroid Build Coastguard WorkerConditions needed to use the argv_fuzzing feature: 12*08b48e0bSAndroid Build Coastguard Worker1. Include `argv-fuzz-inl.h` header file (`#include "argv-fuzz-inl.h"`) 13*08b48e0bSAndroid Build Coastguard Worker2. Identify your main function that parses arguments 14*08b48e0bSAndroid Build Coastguard Worker(for example, `int main(int argc, char **argv)`) 15*08b48e0bSAndroid Build Coastguard Worker3. Use one of the following macros (near the beginning of the main function) 16*08b48e0bSAndroid Build Coastguard Workerto initialize argv with the fuzzer's input: 17*08b48e0bSAndroid Build Coastguard Worker - `AFL_INIT_ARGV();` or 18*08b48e0bSAndroid Build Coastguard Worker - `AFL_INIT_SET0("prog_name");` to preserve `argv[0]` 19*08b48e0bSAndroid Build Coastguard Worker (the name of the program being executed) 20*08b48e0bSAndroid Build Coastguard Worker 21*08b48e0bSAndroid Build Coastguard Workersee: [argv_fuzz_demo.c](argv_fuzz_demo.c) 22*08b48e0bSAndroid Build Coastguard Worker 23*08b48e0bSAndroid Build Coastguard Worker### With persistent mode 24*08b48e0bSAndroid Build Coastguard WorkerConditions needed to use the argv_fuzzing feature with persistent mode: 25*08b48e0bSAndroid Build Coastguard Worker1. Ensure your target can handle persistent mode fuzzing 26*08b48e0bSAndroid Build Coastguard Worker2. Follow instructions in the [llvm_mode persistent mode](https://github.com/AFLplusplus/AFLplusplus/blob/stable/instrumentation/README.persistent_mode.md) 27*08b48e0bSAndroid Build Coastguard Worker3. Use one of the following macros near the beginning of the main function and after 28*08b48e0bSAndroid Build Coastguard Workerthe buffer initialization (`unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF`): 29*08b48e0bSAndroid Build Coastguard Worker - `AFL_INIT_ARGV_PERSISTENT(buf)`, if you want to 30*08b48e0bSAndroid Build Coastguard Worker - `AFL_INIT_SET0_PERSISTENT("name_of_binary", buf)` 31*08b48e0bSAndroid Build Coastguard Worker 32*08b48e0bSAndroid Build Coastguard Workersee: [argv_fuzz_persistent_demo.c](argv_fuzz_persistent_demo.c) 33*08b48e0bSAndroid Build Coastguard Worker 34*08b48e0bSAndroid Build Coastguard Worker## Binary only 35*08b48e0bSAndroid Build Coastguard Worker`argvfuzz` tries to provide the same functionality for binaries. When loaded 36*08b48e0bSAndroid Build Coastguard Workerusing `LD_PRELOAD`, it will hook the call to `__libc_start_main` and replace 37*08b48e0bSAndroid Build Coastguard Workerargv using the same logic of `argv-fuzz-inl.h`. 38*08b48e0bSAndroid Build Coastguard Worker 39*08b48e0bSAndroid Build Coastguard WorkerA few conditions need to be fulfilled for this mechanism to work correctly: 40*08b48e0bSAndroid Build Coastguard Worker 41*08b48e0bSAndroid Build Coastguard Worker1. As it relies on hooking the loader, it cannot work on static binaries 42*08b48e0bSAndroid Build Coastguard Worker2. If the target binary does not use the default libc's `_start` implementation 43*08b48e0bSAndroid Build Coastguard Worker (crt1.o), the hook may not run. 44*08b48e0bSAndroid Build Coastguard Worker3. The hook will replace argv with pointers to `.data` of `argvfuzz.so`. 45*08b48e0bSAndroid Build Coastguard WorkerThings may go wrong if the target binary expects argv to live on the stack. 46