roughenough-fuzz

This crate is for fuzzing Roughenough, a Rust implementation of the Roughtime secure time synchronization protocol.

Building and Installation

Fuzzing uses American fuzzy lop via afl.rs, libFuzzer via cargo-fuzz, and honggfuzz via honggfuzz-rs.

Rust Nightly is needed to compile this crate. The nightly-only -Z compiler flag is required by cargo-fuzz. MacOS users also need nightly to compile afl.rs.

To install:

• cargo install afl cargo-fuzz honggfuzz

FYI, Ubuntu 17.10 needed the binutils-dev and libunwind-dev packages to compile cargo-fuzz. YMMV.

Running

``` $ cd roughenough-fuzz

Run AFL

$ cargo afl build --release $ cargo afl fuzz -i in -o out -x dictionary.txt target/release/roughenough-fuzz

Run libFuzzer

$ cargo fuzz run -O fuzztarget1 -- -dict=dictionary.txt -max_len=2048

Run honggfuzz

$ HFUZZRUNARGS="--dict dictionary.txt --maxfilesize 2048 --input in/" cargo hfuzz run hfuzz_target ```

Links

• Roughenough Github repo
• Roughtime project
• Rust Fuzzing Authority
• libFuzzer Tutorial

Contributors

• Stuart Stock (stuart {at} int08h.com)

Copyright and License

roughenough-fuzz is copyright (c) 2018 int08h LLC. All rights reserved.

int08h LLC licenses roughenough-fuzz (the "Software") to you under the Apache License, version 2.0 (the "License"); you may not use this Software except in compliance with the License. You may obtain a copy of the License from the LICENSE file included with the Software or at:

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.