Skip to content

build.md

Latest commit

 

History

History
77 lines (56 loc) · 2.62 KB

build.md

File metadata and controls

77 lines (56 loc) · 2.62 KB
Raw

Build

Dependencies

  • Linux x86-64 (tested on Ubuntu 20.04 / 22.04)
  • Rust stable (install via rustup)
  • LLVM/Clang 13 (recommended; LLVM 12+ may work; LLVM 19+ is not supported)
  • Python 3.10+ (LLM bridge, optional)
  • SVF (callgraph extraction, optional, LLM mode)
  • wllvm (bitcode extraction, optional, LLM mode)

Build Steps

# 1. Set LLVM path
export PATH=/path/to/clang+llvm-13/bin:$PATH
export LD_LIBRARY_PATH=/path/to/clang+llvm-13/lib:$LD_LIBRARY_PATH

# 2. Build LLVM instrumentation passes
cd /path/to/Bulbasaur/afl_llvm_mode
make -j$(nproc)

# 3. Build the fuzzer
cd /path/to/Bulbasaur
cargo build --release
# Binary is at target/release/fuzzer

# 4. System configuration (same as AFL)
echo core | sudo tee /proc/sys/kernel/core_pattern

Compiling Target Programs

Each target program must be compiled into four instrumented variants (basic mode requires only fast/full/trace; LLM mode also requires debug).

For autoconf projects, run ./configure first; for cmake projects, specify the compiler during the cmake configure step (see below).

autoconf projects

export CC=/path/to/Bulbasaur/afl_llvm_mode/afl-cc
export CXX=/path/to/Bulbasaur/afl_llvm_mode/afl-c++
./configure --disable-shared

# Fast target (main fuzzing loop)
make clean && BULBASAUR_INST_MODE=FAST make -j$(nproc)
cp <binary> targets/<program>_fast

# Full target (precise coverage tracking when a new edge is found)
make clean && BULBASAUR_INST_MODE=FULL make -j$(nproc)
cp <binary> targets/<program>_full

# Trace target (TaintFuzz comparison operand recording)
make clean && BULBASAUR_INST_MODE=TRACE make -j$(nproc)
cp <binary> targets/<program>_trace

# Debug target (LLM mode — embeds source location information)
mkdir -p /path/to/output/
make clean && BULBASAUR_INST_MODE=DEBUG BULBASAUR_BRANCH_LOC_PATH=/path/to/output/ make -j$(nproc)
cp <binary> targets/<program>_debug

cmake projects

cmake bakes the compiler into the Makefile at configure time, so the compiler must be specified during cmake and the instrumentation mode during make:

CC=/path/to/Bulbasaur/afl_llvm_mode/afl-cc \
CXX=/path/to/Bulbasaur/afl_llvm_mode/afl-c++ \
cmake -DBUILD_SHARED_LIBS=OFF .

# Then for each target variant:
make clean && BULBASAUR_INST_MODE=FAST make -j$(nproc)
# ...and so on as above

BULBASAUR_BRANCH_LOC_PATH specifies the directory where branch_loc.csv and function_loc.csv are written at compile time. The LLM bridge uses these two files to map runtime branch IDs back to human-readable source locations.