Skip to content

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

libcurl.so.4: undefined symbol: __afl_area_ptr #2151

Unanswered
zhangnan522 asked this question in Q&A
Discussion options

Explanation of the steps required to compile and test my project successfully:

1.Download the code project named "myproject".
2.Enter the main repository directory of myproject and execute: ./run_cmake.pl -G "Unix Makefiles".
3.This will generate a directory called "myproject-build-make-debug" at the same level as myproject. Enter this directory and run make install -j8.
4.Upon successful execution, a directory named "myproject-install-make-debug" will be created at the same level as myproject.
5.Perform fuzz testing.

For the above compilation, I intend to use AFL++'s compilers:
/home/user/myname/FuzzerTest/AFLplusplus-4.20c/afl-clang-fast /home/user/myname/FuzzerTest/AFLplusplus-4.20c/afl-clang-fast++
Then, to test code coverage, I use:
../afl-cov-0.6.2/afl-cov -d fuzz_out/ --enable-branch-coverage -c . -e "cat AFL_FILE | /home/user/myname/FuzzerTest/myproject-build-make-debug/nacm/cputrack/tool/cputracker/cpu_tracker AFL_FILE"
I followed these steps:
cd myproject
export CC=/home/user/myname/FuzzerTest/AFLplusplus-4.20c/afl-clang-fast export
CXX=/home/user/myname/FuzzerTest/AFLplusplus-4.20c/afl-clang-fast++
./run_cmake.pl -G "Unix Makefiles"
Afterward, I entered the generated build directory and executed make install -j8.
However, when running the fuzz test, an error occurred.
user@user-D830MT:~/myname/FuzzerTest/AFLplusplus-4.20c$ LD_LIBRARY_PATH="/lib:./lib:$LD_LIBRARY_PATH" AFL_DEBUG=1 AFL_MAP_SIZE=10000000 ./afl-fuzz -t 3600000 -i fuzz_in -o fuzz_out -- /home/user/myname/FuzzerTest/myproject-build-make-debug/app/xxxx/src/xxxx --config=etc/nais/xxxx.ini --interface.dbus=true --interface.cpp=true --nds.database=/home/user/myname/FuzzerTest/DB/myDB/ROOT.NDS @@
[+] Enabled environment variable AFL_DEBUG with value 1
[+] Enabled environment variable AFL_DEBUG with value 1
afl-fuzz++4.20c based on afl by Michal Zalewski and a large online community
[+] AFL++ is maintained by Marc "van Hauser" Heuse, Dominik Maier, Andrea Fioraldi and Heiko "hexcoder" Eißfeldt
[+] AFL++ is open source, get it at https://github.com/AFLplusplus/AFLplusplus
[+] NOTE: AFL++ >= v3 has changed defaults and behaviours - see README.md
[+] No -M/-S set, autoconfiguring for "-S default"
[] Getting to work...
[+] Using exponential power schedule (FAST)
[+] Enabled testcache with 50 MB
[+] Generating fuzz data with a length of min=1 max=1048576
[
] Checking core_pattern...
[] Checking CPU scaling governor...
[+] You have 4 CPU cores and 1 runnable tasks (utilization: 25%).
[+] Try parallel jobs - see docs/fuzzing_in_depth.md#c-using-multiple-cores
[
] Setting up output directories...
[+] Output directory exists but deemed OK to reuse.
[] Deleting old session data...
[+] Output dir cleanup successful.
[
] Checking CPU core loadout...
[+] Found a free CPU core, try binding to #0.
[] Scanning 'fuzz_in'...
[+] Loaded a total of 1 seeds.
[
] Creating hard links for all input files...
[] Validating target binary...
[
] Spinning up the fork server...
/home/user/myname/FuzzerTest/myproject-build-make-debug/app/xxxx/src/xxxx: symbol lookup error: /home/user/myname/FuzzerTest/myproject-build-make-debug/external/curl/lib/libcurl.so.4: undefined symbol: __afl_prev_loc

[-] Hmm, looks like the target binary terminated before we could complete a
handshake with the injected code. You can try the following:

- The target binary crashes because necessary runtime conditions it needs
  are not met. Try to:
  1. Run again with AFL_DEBUG=1 set and check the output of the target
     binary for clues.
  2. Run again with AFL_DEBUG=1 and 'ulimit -c unlimited' and analyze the
     generated core dump.

- Possibly the target requires a huge coverage map and has CTORS.
  Retry with setting AFL_MAP_SIZE=10000000.

Otherwise there is a horrible bug in the fuzzer.
Poke the Awesome Fuzzing Discord for troubleshooting tips.

[-] PROGRAM ABORT : Fork server handshake failed
Location : afl_fsrv_start(), src/afl-forkserver.c:1422

The official documentation provides the following guidance:
If your project utilizes a linker script to hide symbols exported by the binary, you may encounter an error resembling:

undefined symbol: __afl_area_ptr

The remedy is to incorporate the following snippet into your linker script:

{
  global:
    __afl_*;
}

This script segment serves to declare __afl_area_ptr along with any other symbols starting with _afl as global, thereby informing the linker that these symbols should be visible externally. This prevents undefined symbol errors during the linking phase.

However, my current program is compiled using run_cmake.pl, which doesn't involve a linker script directly.

I attempted to create a linker.ld file with the necessary script at the following location:
/home/user/myname/work/FuzzerTest/linker.ld

Subsequently, I referenced it using:
export CMAKE_EXE_LINKER_FLAGS="-Wl,--script=/home/user/myname/work/FuzzerTest/linker.ld"

After deleting the previously generated build and install directories, I recompiled my myproject and reran the fuzz testing. Unfortunately, the aforementioned error persisted.
So how should this error be resolved? My tested program did not provide a linker script.

You must be logged in to vote

Replies: 1 comment · 2 replies

Comment options

likely you also need to set LD=afl-clang-fast
and you should always build your target static, not with dynamic libraries.

You must be logged in to vote
2 replies
@zhangnan522
Comment options

Thank you for your reply. I would like to confirm again:
Is LD=afl chuang fast added when we run the test command? Or is it set in the environment variables?
2. How can we ensure that building our target is static

@zhangnan522
Comment options

I have added:
my $CMAKE_C_FLAGS = "-static";
my $CMAKE_CXX_FLAGS = "-static";
$CMAKE_COMMANDLINE = $CMAKE_COMMANDLINE . " -DCMAKE_C_FLAGS="$CMAKE_C_FLAGS" -DCMAKE_CXX_FLAGS="$CMAKE_CXX_FLAGS"";
And then set:
export LD=/home/user/myname/FuzzerTest/AFLplusplus-4.20c/afl-clang-fast
But the problem still exists

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
🙏
Q&A
Labels
None yet
2 participants
Morty Proxy This is a proxified and sanitized view of the page, visit original site.