LibAFL Fuzzing Modular con Rust

use libafl::prelude::*;
use libafl_bolts::prelude::*;
use libafl_targets::{
    libfuzzer_test_one_input,
    std_edges_map_observer
};

/// Mutador personalizado para mensajes TLV
/// Conoce la estructura: [Tag:2][Len:2][Value:Len]
pub struct TlvMutator;

impl<S> Mutator<BytesInput, S> for TlvMutator
where S: HasRand,
{
    fn mutate(
        &mut self,
        state: &mut S,
        input: &mut BytesInput,
    ) -> Result<MutationResult, Error> {
        let buf = input.bytes_mut();
        if buf.len() < 4 { return Ok(MutationResult::Skipped); }

        let r = state.rand_mut();
        match r.below(5) {
            0 => { // Overflow length field
                buf[2] = 0xFF;
                buf[3] = 0xFF;
            }
            1 => { // Nested TLV injection
                let nested = vec![0x30, 0x82, 0x01, 0x00];
                buf.splice(4..4, nested);
            }
            2 => { // Zero-length value with non-zero tag
                buf[2] = 0x00;
                buf[3] = 0x00;
            }
            3 => { // Mutate tag bytes (unknown tags)
                buf[0] ^= 0x80;
            }
            _ => { // Random byte flip in value
                let i = r.below(buf.len() as u64) as usize;
                buf[i] ^= r.below(256) as u8;
            }
        }
        Ok(MutationResult::Mutated)
    }
}

#[no_mangle]
pub extern "C" fn libafl_main() {
    let mut run_client = |state: Option<_>,
                          mut mgr, _core_id| {
        // Observers
        let edges_obs = HitcountsMapObserver::new(
            unsafe { std_edges_map_observer("edges") }
        ).track_indices();
        let time_obs = TimeObserver::new("time");
        let bt_obs = BacktraceObserver::owned(
            "bt",
            HarnessType::InProcess
        );

        // Feedback: cobertura + tiempo
        let mut feedback = feedback_or!(
            MaxMapFeedback::new(&edges_obs),
            TimeFeedback::new(&time_obs)
        );

        // Objetivo: crash único por backtrace
        let mut objective = feedback_and!(
            feedback_or_fast!(
                CrashFeedback::new(),
                TimeoutFeedback::new()
            ),
            NewHashFeedback::new(&bt_obs)
        );

        // Estado con corpus en disco
        let mut state = state.unwrap_or_else(|| {
            StdState::new(
                StdRand::new(),
                InMemoryOnDiskCorpus::new(
                    "corpus/"
                ).unwrap(),
                OnDiskCorpus::new(
                    "crashes/"
                ).unwrap(),
                &mut feedback,
                &mut objective,
            ).unwrap()
        });

        // Mutadores: TLV custom + havoc
        let mutator = StdScheduledMutator::new(
            havoc_mutations()
                .merge(tokens_mutations())
                .merge(tuple_list!(TlvMutator))
        );

        let mut harness = |input: &BytesInput| {
            let buf = input.target_bytes().as_slice();
            libfuzzer_test_one_input(buf);
            ExitKind::Ok
        };

        // Lanzar con 32 cores
        Launcher::builder()
            .run_client(&mut run_client)
            .cores(&Cores::from_cmdline("0-31").unwrap())
            .build()
            .launch()
            .unwrap();
    };
}

#!/usr/bin/env bash
# Build NexaFuzzer — NexaCore libnexaparse
set -euo pipefail

# ── 1. Entorno ──────────────────────────────
export LLVM_CONFIG=llvm-config-17
export CC=clang-17
export CXX=clang++-17
export RUSTFLAGS="-C linker=/usr/bin/clang-17"

# ── 2. Compilar LibAFL wrapper ───────────────
echo "[*] Building LibAFL compiler wrapper..."
cd nexa_fuzzer
cargo build --release
cd ..

FUZZER_CC=./nexa_fuzzer/target/release/libafl_cc
FUZZER_CXX=./nexa_fuzzer/target/release/libafl_cxx

# ── 3. Build libnexaparse (estática) ─────────
echo "[*] Building libnexaparse static lib..."
cd libnexaparse-1.4.2
CC=$FUZZER_CC CXX=$FUZZER_CXX \
  ./configure --enable-shared=no \
              --disable-tests
make -j$(nproc)
cd ..

# ── 4. Compile harness ───────────────────────
echo "[*] Compiling harness..."
$FUZZER_CXX -DNO_MAIN -g -O2 \
  -I libnexaparse-1.4.2/include \
  harness/nexaparse_fuzz.cc \
  libnexaparse-1.4.2/.libs/libnexaparse.a \
  -o nexafuzz

echo "[+] Build OK → ./nexafuzz"

#!/usr/bin/env bash
# Campaña de 72h — 32 cores — NexaCore
set -euo pipefail

CORES="0-31"
INPUT="seeds/"
OUTPUT="corpus/"
CRASHES="crashes/"
DICT="dicts/tlv_iso8583.dict"
TIMEOUT=2000  # ms

mkdir -p $OUTPUT $CRASHES

# Seeds: mensajes TLV válidos de prueba
cp testdata/iso8583_sample_*.bin $INPUT/

echo "[*] Starting NexaFuzzer — 32 cores, 72h..."
echo "[*] Coverage target: >85% edges"
echo "[*] Dictionary: $DICT"
echo

./nexafuzz \
  --cores $CORES \
  --input $INPUT \
  --output $OUTPUT \
  --crashes $CRASHES \
  --timeout $TIMEOUT \
  -x $DICT \
  --tui 1 \
  &

FUZZER_PID=$!
echo "[+] Fuzzer PID: $FUZZER_PID"

# Monitorizar crashrate
watch -n 60 "ls crashes/ | wc -l"

# Tokens ISO 8583 / TLV para guided fuzzing
"\x30\x82"          # TLV sequence header
"\x02\x01"          # INTEGER tag + len=1
"\x04\x00"          # OCTET STRING empty
"\xff\xff"          # Max length overflow
"\x69\x73\x6f\x38" # "iso8" magic
"ISOAMT"
"TXNREF"
"CARDNO"
"F001"             # FIX field 1
"35=\x01"          # FIX tag 35 separator