Problems with running fuzz-harness

[DaSoty]

Good afternoon,

I want to try the “fuzz-harness” tool and I'm having a hard time understanding how it interacts with the scenarios to apply fuzzing.

First of all, it is giving me a lot of problems when creating the container. To do this, I had to run line by line the “docker.sh” commands modifying “HARNESS_DIR” by the absolute path where the folder is located, if I run it this way, it works correctly and creates the container.

Once inside the container, I don't understand what steps to follow to be able to connect the fuzzer to a scenario. I understand that first I have to execute the script “compile.sh” and then “fuzz.sh” but this second one generates permission errors when executing it (it cannot create the “default” folder inside “output”).

The permissions error, I have tried to solve it by executing the initial commands in root, however, following the same steps does not work.

Do you have any documentation or information on how to apply the fuzzer within a scenario?

Thank you very much!

[riebl]

The steps are as follows:

1. Go to tools/fuzz-harness and run the docker.sh script there. This step builds a container for compiling Vanetza and running the fuzz tests inside this container. After calling docker.sh, you will be prompted with a command shell inside the built and now running container.
2. Invoke compile.sh inside the container. This step builds Vanetza in a suitable way for AFLplusplus. Please check the AFLplusplus documentation for details.
3. Run fuzz.sh inside the container. This step runs Vanetza's fuzz harness using data from the input directory. Results are stored in the output directory.

The input and output directories are mapped from the host's tools/harness directory into the container. Same applies to the compile and fuzz scripts.

Maybe you simply need to create the (empty) output directory so docker.sh does not fail?
I just noticed that docker.sh actually creates the output directory if it is missing. So, without more details about the problems you are facing, I cannot give you better advice at the moment.

[DaSoty]

Good morning, Riebl.

Is there any way to run the fuzzing inside a scenario in Artery to be able to analyze the packets sent from the fuzzing to the network?

We would be interested in seeing the packets generated by the fuzzer in order to analyze if a detection module is able to detect it as a possible vehicle attack.

Thank you!

[riebl]

You may use the data from the output directory, which are GeoNetworking packets. In Artery, you could create a special station that directly operates on a radio to send such pre-built packets. A service module is not suitable because it operates on the application layer, and you would thus end up with two GeoNetworking headers per packet.