1Fuzz-testing Litecoin Core
2==========================
3
4A special test harness in `src/test/fuzz/` is provided for each fuzz target to
5provide an easy entry point for fuzzers and the like. In this document we'll
6describe how to use it with AFL and libFuzzer.
7
8## Preparing fuzzing
9
10AFL needs an input directory with examples, and an output directory where it
11will place examples that it found. These can be anywhere in the file system,
12we'll define environment variables to make it easy to reference them.
13
14libFuzzer will use the input directory as output directory.
15
16Extract the example seeds (or other starting inputs) into the inputs
17directory before starting fuzzing.
18
19```
20git clone https://github.com/bitcoin-core/qa-assets
21export DIR_FUZZ_IN=$PWD/qa-assets/fuzz_seed_corpus
22```
23
24Only for AFL:
25
26```
27mkdir outputs
28export AFLOUT=$PWD/outputs
29```
30
31## AFL
32
33### Building AFL
34
35It is recommended to always use the latest version of afl:
36```
37wget http://lcamtuf.coredump.cx/afl/releases/afl-latest.tgz
38tar -zxvf afl-latest.tgz
39cd afl-<version>
40make
41export AFLPATH=$PWD
42```
43
44### Instrumentation
45
46To build Litecoin Core using AFL instrumentation (this assumes that the
47`AFLPATH` was set as above):
48```
49./configure --disable-ccache --disable-shared --enable-tests --enable-fuzz --disable-wallet --disable-bench --with-utils=no --with-daemon=no --with-libs=no --with-gui=no CC=${AFLPATH}/afl-gcc CXX=${AFLPATH}/afl-g++
50export AFL_HARDEN=1
51cd src/
52make
53```
54We disable ccache because we don't want to pollute the ccache with instrumented
55objects, and similarly don't want to use non-instrumented cached objects linked
56in.
57
58The fuzzing can be sped up significantly (~200x) by using `afl-clang-fast` and
59`afl-clang-fast++` in place of `afl-gcc` and `afl-g++` when compiling. When
60compiling using `afl-clang-fast`/`afl-clang-fast++` the resulting
61binary will be instrumented in such a way that the AFL
62features "persistent mode" and "deferred forkserver" can be used. See
63https://github.com/mcarpenter/afl/tree/master/llvm_mode for details.
64
65### Fuzzing
66
67To start the actual fuzzing use:
68
69```
70export FUZZ_TARGET=fuzz_target_foo  # Pick a fuzz_target
71mkdir ${AFLOUT}/${FUZZ_TARGET}
72$AFLPATH/afl-fuzz -i ${DIR_FUZZ_IN}/${FUZZ_TARGET} -o ${AFLOUT}/${FUZZ_TARGET} -m52 -- test/fuzz/${FUZZ_TARGET}
73```
74
75You may have to change a few kernel parameters to test optimally - `afl-fuzz`
76will print an error and suggestion if so.
77
78## libFuzzer
79
80A recent version of `clang`, the address sanitizer and libFuzzer is needed (all
81found in the `compiler-rt` runtime libraries package).
82
83To build all fuzz targets with libFuzzer, run
84
85```
86./configure --disable-ccache --disable-wallet --disable-bench --with-utils=no --with-daemon=no --with-libs=no --with-gui=no --enable-fuzz --with-sanitizers=fuzzer,address CC=clang CXX=clang++
87make
88```
89
90The fuzzer needs some inputs to work on, but the inputs or seeds can be used
91interchangeably between libFuzzer and AFL.
92
93See https://llvm.org/docs/LibFuzzer.html#running on how to run the libFuzzer
94instrumented executable.
95
96Alternatively run the script in `./test/fuzz/test_runner.py` and provide it
97with the `${DIR_FUZZ_IN}` created earlier.
98