ACPR/android_system_core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
android_system_core/fastboot/fuzzer
History
Will McVicker b544df0e15 Add support to update the DTB when flashing a vendor_boot ramdisk 
When updating the vendor_boot ramdisk, there may be device tree
dependencies that require updating the device tree with the new ramdisk
which contains the first stage init kernel modules. This patch adds the
support to use the `--dtb /path/to/dtb` option to update the DTB when
updating the vendor_boot ramdisk. To do so, run the command:

  fastboot flash --dtb /path/to/dtb.img \
      vendor_boot:<RAMDISK_NAME> /path/to/ramdisk

Test: fastboot_vendor_boot_img_utils_test
Test: Verifed updating the dtb with the above command on r4
Bug: 368308832
Change-Id: Iaa1867fe64054971a698497a2e3486424fed19fe
2024-10-24 15:03:36 -07:00
..
Android.bp Updated 'cc' field of fuzz_config in Android.bp file 2024-04-10 11:39:05 +05:30
fastboot_fuzzer.cpp Add support to update the DTB when flashing a vendor_boot ramdisk 2024-10-24 15:03:36 -07:00
README.md Added fastboot_fuzzer 2021-10-14 00:32:38 +00:00
socket_mock_fuzz.cpp Added fastboot_fuzzer 2021-10-14 00:32:38 +00:00
socket_mock_fuzz.h Added fastboot_fuzzer 2021-10-14 00:32:38 +00:00

README.md

Fuzzer for libfastboot

Plugin Design Considerations

The fuzzer plugin for libfastboot is designed based on the understanding of the source code and tries to achieve the following:

Maximize code coverage

The configuration parameters are not hardcoded, but instead selected based on incoming data. This ensures more code paths are reached by the fuzzer.

libfastboot supports the following parameters:

  1. Year (parameter name: year)
  2. Month (parameter name: month)
  3. Day (parameter name: day)
  4. Version (parameter name: version)
  5. Fs Option (parameter name: fsOption)
Parameter Valid Values Configured Value
year 2000 to 2127 Value obtained from FuzzedDataProvider
month 1 to 12 Value obtained from FuzzedDataProvider
day 1 to 31 Value obtained from FuzzedDataProvider
version 0 to 127 Value obtained from FuzzedDataProvider
fsOption 0. casefold 1. projid 2. compress Value obtained from FuzzedDataProvider
Maximize utilization of input data

The plugin feeds the entire input data to the module. This ensures that the plugin tolerates any kind of input (empty, huge, malformed, etc) and doesnt exit() on any input and thereby increasing the chance of identifying vulnerabilities.

Build

This describes steps to build fastboot_fuzzer binary.

Android

Steps to build

Build the fuzzer

  $ mm -j$(nproc) fastboot_fuzzer_fuzzer

Steps to run

To run on host

  $ $ANDROID_HOST_OUT/fuzz/${TARGET_ARCH}/fastboot_fuzzer/fastboot_fuzzer CORPUS_DIR

References: