实验小项目招新：通过fuzzing&测例分析并查找Rust/C-based OS相关的bug

[chyyuu]

Rust语言虽然比C语言在安全上做了很大改进，但依然存在各种bug，特别是操作系统的特殊性带来的各种类型的bug。我们需要研究fuzzing，符号执行等技术，设计相关的静态/动态分析工具，来查找其中各种Rust-based OS中的bug。目前一个有意思的情况是，有不少参加全国大学生OS比赛内核赛道的OS 内核项目，直接支持Linux syscall，且都支持运行多种Linux 应用。但由于完成时间有限，会有大量的bug，是分析并查找Rust-based OS相关的bug非常好的对象。另外一个比较实际的办法是，通过syzkaller linux kernel fuzzing工具，生成上万个linux测试用例，来测试支持Linux应用的各种Rust OS，，对执行结果进行分析和比较，从而发现它们中的bug。

参考：

• bug相关的论文列表
• fuzzing相关论文列表

LIbAFL相关：

• https://github.com/AFLplusplus/LibAFL
• https://aflplus.plus/libafl-book/libafl.html
• https://www.atredis.com/blog/2023/12/4/a-libafl-introductory-workshop
• https://epi052.gitlab.io/notes-to-self/blog/2021-11-01-fuzzing-101-with-libafl/
• paper：LibAFL: A Framework to Build Modular and Reusable Fuzzers
• paper: LibAFL QEMU: A Library for Fuzzing-oriented Emulation

注：偏学术研究类

如有兴趣一起来探索，请联系我 yuchen AT tsinghua.edu.cn OR 微信 id chyyuu

[elliott10]

内核测试用例

基于x86_64 musl libc的内核测试用例，可用于测试内核实现的syscall的功能测试验证。
https://github.com/rcore-os/testsuits-for-oskernel/releases/tag/final-x86_64

[mengmengjiang1999]

【论文相关】

阅读笔记：

https://github.com/mengmengjiang1999/record/tree/main/papers

todo list：

https://github.com/mengmengjiang1999/record/blob/main/papers/todo-list.md

[mengmengjiang1999]

常用工具及其使用方法，以及报错记录

https://github.com/mengmengjiang1999/record/tree/main/tools

[mengmengjiang1999]

李羽飞工作⬇️

https://github.com/LearningOS/osbiglab-2024s-fuzzingkernel/tree/main

[werkeytom]

https://github.com/werkeytom/fuzzing-record

[chyyuu]

什么是stage?

===============================================
https://aflplus.plus/libafl-book/core_concepts/stage.html 给出了stage的定义：

A Stage is an entity that operates on a single Input received from the Corpus.

For instance, a Mutational Stage, given an input of the corpus, applies a Mutator and executes the generated input one or more times. How many times this has to be done can be scheduled, AFL for instance uses a performance score of the input to choose how many times the havoc mutator should be invoked. This can depend also on other parameters, for instance, the length of the input if we want to just apply a sequential bitflip, or a fixed value.

A stage can also be an analysis stage, for instance, the Colorization stage of Redqueen that aims to introduce more entropy in a testcase or the Trimming stage of AFL that aims to reduce the size of a testcase.

There are several stages in the LibAFL codebase implementing the Stage trait.

===============================================
https://docs.rs/libafl/latest/libafl/stages/trait.Stage.html 中给出了 stage的定义:

A stage is one step in the fuzzing process. Multiple stages will be scheduled one by one for each input.

===============================================
论文：LibAFL: A Framework to Build Modular and Reusable Fuzzers 中，给出了stage的说明：

第三节： stage是libAFL中9个基本entity(实体)之一。
Stage – The Stage is a component defining an action to perform on a single testcase from the corpus. Usually, the scheduler selects a testcase and then the fuzzer executes every stage on that given input. The Stage is a very broad entity and in existing fuzzers, it is usually the component that invokes one or more times a mutator on the input (e.g., the random havoc stage in AFL) or an analysis stage that, for instance, perform taint tracking to gather information in a white-box fuzzer [17]. Another widely known stage adopted by many fuzzers is the minimization phase, introduced in AFL, reduces the size of a testcase obtained from the corpus while maintaining the triggered coverage points.
第四节的 figure 1, 给出了stage 在libAFL Core Arch中的位置和执行点。

===============================================
源代码 LibAFL/fuzzers/baby_fuzzer/src/main.rs 中，127～130行，给出了如何定义和使用stage 实体。

[ZhiyuanSue]

更新目前搜集到的资源整理
建议的主要的学习资源
https://aflplus.plus/libafl-book/
https://rust-fuzz.github.io/book/cargo-fuzz.html
https://epi052.gitlab.io/notes-to-self/blog/2021-11-01-fuzzing-101-with-libafl/
https://www.fuzzingbook.org/
https://www.atredis.com/blog/2023/12/4/a-libafl-introductory-workshop

一些paper
http://www.wingtecher.com/themes/WingTecherResearch/assets/papers/Emsoft22_Tardis.pdf
https://dl.acm.org/doi/pdf/10.1145/3391202
https://github.com/sslab-gatech/hydra?tab=readme-ov-file

其他
https://rk700.github.io/2017/12/28/afl-internals/
https://media.ccc.de/v/37c3-12102-fuzz_everything_everywhere_all_at_once
https://github.com/firmianay/CTF-All-In-One/tree/master
https://gugesay.com/archives/986

同学和老师整理的相关内容链接（包含阅读、实践踩坑记录、各种链接等）

https://github.com/LearningOS/osbiglab-2024s-fuzzingkernel/tree/main
https://github.com/mengmengjiang1999/record/tree/main

https://github.com/chyyuu/aos_course_info/blob/master/filesystem-bug-related.md
https://github.com/chyyuu/aos_course_info/blob/master/fuzzing-related.md
https://github.com/chyyuu/aos_course_info/blob/master/difference-testing-or-semantic-bug.md

[nine-point-eight-p]

2024年OS比赛决赛阶段fuzzing方向开发日志：https://docs.qq.com/doc/DV01iRkJLT0FIR1RE