aflplusplus: Add optional build with nyx mode

  wine ? null,

  cmocka,

  llvmPackages,

  withNyx ? false,

}:

# wine fuzzing is only known to work for win32 binaries, and using a mixture of

# a full 32bit version of this package if you want to do wine fuzzing

assert (wine != null) -> (stdenv.targetPlatform.system == "i686-linux");

# nyx mode is only available on x86_64-linux,

# see nyx_mode/build_nyx_support.sh in source code of aflplusplus

assert withNyx -> (stdenv.targetPlatform.system == "x86_64-linux");

let

  aflplusplus-qemu = callPackage ./qemu.nix { };

  qemu-exe-name =

      throw "aflplusplus: no support for ${stdenv.targetPlatform.system}!";

  libdislocator = callPackage ./libdislocator.nix { inherit aflplusplus; };

  libtokencap = callPackage ./libtokencap.nix { inherit aflplusplus; };

  libnyx =

    if withNyx then callPackage ./nyx_mode/libnyx/libnyx.nix { inherit aflplusplus; } else null;

  qemu-nyx =

    if withNyx then callPackage ./nyx_mode/QEMU-Nyx/qemu-nyx.nix { inherit aflplusplus; } else null;

  nyx-packer =

    if withNyx then

      callPackage ./nyx_mode/packer/packer.nix { inherit aflplusplus qemu-nyx; }

    else

      null;

  aflplusplus = stdenvNoCC.mkDerivation rec {

    pname = "aflplusplus";

    version = "4.35c";

      owner = "AFLplusplus";

      repo = "AFLplusplus";

      tag = "v${version}";

      hash = "sha256-j5YH39JKcjYuDqyl+KRMtgn3UoeWEW1z7m4ysf2uilc=";

      hash =

        if withNyx then

          "sha256-srHrYPEb0UAP/G9cOxJOZ9D6v9pxqez28suPsa70E2M="

        else

          "sha256-j5YH39JKcjYuDqyl+KRMtgn3UoeWEW1z7m4ysf2uilc=";

      fetchSubmodules = withNyx;

    };

    enableParallelBuilding = true;

    # warning: "_FORTIFY_SOURCE" redefined

    hardeningDisable = [ "fortify" ];

    # We build nyx mode dependencies ourselves, so this patch skips

    # build_nyx_support.sh in the aflplusplus source code. It also skips

    # test-nyx-mode.sh because we can't test nyx mode in the sandbox.

    patches = lib.optional withNyx ./nyx_mode/nyx_mode.patch;

    postPatch = ''

      # Don't care about this.

      rm Android.bp

      substituteInPlace GNUmakefile.llvm \

        --replace-fail "\$(LLVM_BINDIR)/clang" "${clang}/bin/clang"

    ''

    + lib.optionalString withNyx ''

      patchShebangs nyx_mode/build_nyx_support.sh

    '';

    env.NIX_CFLAGS_COMPILE = toString [

        --replace-fail "cgdelete" "${libcgroup}/bin/cgdelete"

      patchShebangs $out/bin

    ''

    + lib.optionalString withNyx ''

      # Use same FHS as if built from source using build_nyx_support.sh. This

      # means libnyx.so must be next to afl binaries and nyx_mode dependencies

      # are in nyx_mode/.

      cp ${libnyx}/lib/libnyx.so $out/bin

      mkdir $out/nyx_mode

      ln -s ${nyx-packer} $out/nyx_mode/packer

      ln -s ${qemu-nyx} $out/nyx_mode/QEMU-Nyx

    ''

    + lib.optionalString (wine != null) ''

      substitute afl-wine-trace $out/bin/afl-wine-trace \

      file

      cmocka

    ];

    doInstallCheck = true;

    installCheckPhase = ''

      runHook preInstallCheck

    '';

    passthru = {

      inherit libdislocator libtokencap;

      inherit

        libdislocator

        libtokencap

        libnyx

        nyx-packer

        qemu-nyx

        ;

      qemu = aflplusplus-qemu;

    };

{

  stdenv,

  lib,

  fetchFromGitHub,

  python3,

  pkg-config,

  flex,

  bison,

  glib,

  pixman,

  aflplusplus,

}:

# this derivation assumes x86_64-linux

assert stdenv.targetPlatform.system == "x86_64-linux";

stdenv.mkDerivation {

  version = builtins.readFile (aflplusplus.src + "/nyx_mode/QEMU_NYX_VERSION");

  pname = "QEMU-Nyx";

  src = aflplusplus.src;

  postUnpack = ''

    sourceRoot="$sourceRoot/nyx_mode/QEMU-Nyx"

  '';

  # same flags for ./configure as ./compile_qemu_nyx.sh static would set

  configureFlags = [

    "--target-list=x86_64-softmmu"

    "--disable-docs"

    "--disable-gtk"

    "--disable-werror"

    "--disable-capstone"

    "--disable-libssh"

    "--disable-tools"

    "--enable-nyx"

    "--enable-nyx-static"

  ];

  nativeBuildInputs = [

    python3

    pkg-config

    flex

    bison

  ];

  buildInputs = [

    glib

    pixman

  ];

  enableParallelBuilding = true;

  preConfigure = ''

    CAPSTONE_ROOT=$PWD/capstone_v4

    LIBXDC_ROOT=$PWD/libxdc

    make -C $CAPSTONE_ROOT -j$(nproc)

    make -C $LIBXDC_ROOT -j$(nproc) clean

    # For some reason the Makefile of libxdc clears LDFLAGS; we remove that line

    # so ld can find libcapstone.so.4

    sed -i '3d' $LIBXDC_ROOT/Makefile

    NO_LTO=1 LDFLAGS="-L$CAPSTONE_ROOT -L$LIBXDC_ROOT" CFLAGS="-I$CAPSTONE_ROOT/include/" make -C $LIBXDC_ROOT -j$(nproc)

    export LIBS="-L$CAPSTONE_ROOT -L$LIBXDC_ROOT/"

    export QEMU_CFLAGS="-I$CAPSTONE_ROOT/include/ -I$LIBXDC_ROOT/ $QEMU_CFLAGS"

  '';

  meta = {

    homepage = "https://github.com/nyx-fuzz/QEMU-Nyx";

    description = "Nyx's fork of QEMU";

    license = lib.licenses.gpl2Only;

    platforms = lib.platforms.x86_64;

    maintainers = with lib.maintainers; [ ekzyis ];

  };

}

{

  lib,

  stdenv,

  rustPlatform,

  aflplusplus,

  python3,

}:

rustPlatform.buildRustPackage {

  version = builtins.readFile (aflplusplus.src + "/nyx_mode/LIBNYX_VERSION");

  pname = "libnyx";

  src = aflplusplus.src;

  postUnpack = ''

    sourceRoot="$sourceRoot/nyx_mode/libnyx/libnyx"

    cp ${./Cargo.lock} "$sourceRoot/Cargo.lock"

  '';

  cargoLock = {

    lockFile = ./Cargo.lock;

  };

  doCheck = false;

  installPhase = ''

    runHook preInstall

    mkdir -p $out/lib

    cp "target/${stdenv.hostPlatform.rust.rustcTarget}/release/liblibnyx.so" $out/lib/libnyx.so

    runHook postInstall

  '';

  meta = {

    homepage = "https://github.com/nyx-fuzz/libnyx";

    description = "Rust library to build hypervisor-based snapshot fuzzers";

    license = lib.licenses.gpl2Only;

    platforms = lib.platforms.linux;

    maintainers = with lib.maintainers; [ ekzyis ];

  };

}

diff --git a/nyx_mode/build_nyx_support.sh b/nyx_mode/build_nyx_support.sh

index 9b75b7bf..b7ec92e8 100755

--- a/nyx_mode/build_nyx_support.sh

+++ b/nyx_mode/build_nyx_support.sh

@@ -7,7 +7,8 @@ echo "           Nyx build script"

 echo "================================================="

 echo

-echo "[*] Performing basic sanity checks..."

+echo "[+] Nyx mode dependencies are built in other derivations, skipping ..."

+exit 1

 if [ "$CI" = "true" ]; then

diff --git a/test/test-nyx-mode.sh b/test/test-nyx-mode.sh

index 7aaa8c5b..5f624ada 100755

--- a/test/test-nyx-mode.sh

+++ b/test/test-nyx-mode.sh

@@ -4,78 +4,7 @@

 $ECHO "$BLUE[*] Testing: nyx_mode"

-test "$CI" = "true" && {

-  $ECHO "$YELLOW[-] nyx_mode cannot be tested in the Github CI, skipping ..."

-} || {

-

- unset AFL_CC

-

- test -e ../libnyx.so && {

-  ../afl-cc -o test-instr ../test-instr.c > errors 2>&1

-  test -e test-instr && {

-    {

-      rm -rf nyx-test in out

-      $ECHO "$GREY[*] running nyx_packer"

-      python3 ../nyx_mode/packer/packer/nyx_packer.py \

-        ./test-instr \

-        nyx-test \

-        afl \

-        instrumentation \

-        --fast_reload_mode \

-        --purge > /dev/null 2>&1

-

-      test -e nyx-test/test-instr && {

-

-        $ECHO "$GREY[*] running nyx_config_gen"

-        python3 ../nyx_mode/packer/packer/nyx_config_gen.py nyx-test Kernel > /dev/null 2>&1

-        

-        test -e nyx-test/config.ron && {

-          sudo modprobe -r kvm-intel

-          sudo modprobe -r kvm

-          sudo modprobe  kvm enable_vmware_backdoor=y

-          sudo modprobe  kvm-intel

-          #cat /sys/module/kvm/parameters/enable_vmware_backdoor 

-

-          mkdir -p in

-          echo 00000 > in/in

-          $ECHO "$GREY[*] running afl-fuzz for nyx_mode, this will take approx 10 seconds"

-          {

-            AFL_DEBUG=1 ../afl-fuzz -i in -o out -V05 -X -- ./nyx-test >>errors 2>&1

-          } >>errors 2>&1

-          test -n "$( ls out/default/queue/id:000002* 2>/dev/null )" && {

-            $ECHO "$GREEN[+] afl-fuzz is working correctly with nyx_mode"

-            RUNTIME=`grep execs_done out/default/fuzzer_stats | awk '{print$3}'`

-            rm -rf errors nyx-test test-instr in out

-          } || {

-            echo CUT------------------------------------------------------------------CUT

-            cat errors

-            echo CUT------------------------------------------------------------------CUT

-            $ECHO "$RED[!] afl-fuzz is not working correctly with nyx_mode"

-            CODE=1

-          }

-        } || {

-          $ECHO "$RED[!] nyx_packer failed, likely install requirements not met."

-          CODE=1

-        }

-      } || {

-       $ECHO "$RED[!] nyx_packer failed, likely install requirements not met."

-       CODE=1

-      }

-      #rm -rf test-instr in out errors nyx-test

-    }

-  } || {

-    echo CUT------------------------------------------------------------------CUT

-    cat errors

-    echo CUT------------------------------------------------------------------CUT

-    $ECHO "$RED[!] afl-cc compilation of test targets failed - what is going on??"

-    CODE=1

-  }

- } || {

-  $ECHO "$YELLOW[-] nyx_mode is not compiled, cannot test"

-  INCOMPLETE=1

- }

-

-}

+$ECHO "$GREY[-] nyx_mode cannot be tested inside the sandbox"

 . ./test-post.sh