Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Running Jazzer on ARM (specifically Android phones) #235

Unanswered
MHA3 asked this question in Q&A
Discussion options

Hi, I recently tried to build and run Jazzer on a physical device but got an error saying:

./data/jazzer_bin_copy/jazzer[11]: ./data/jazzer_bin_copy/jazzer_driver: not executable: 64-bit ELF file

I did file on it and got:

$ file jazzer_driver
jazzer_driver: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[xxHash]=13ea3a687dc35e6f, with debug_info, not stripped

It seems like it is built for x86 currently. Is there work in progress to build jazzer for ARM?
Or is there another way to run jazzer on ARM?

You must be logged in to vote

Replies: 2 comments 4 replies

Comment options

I have never tried running Jazzer on ARM. While Jazzer does use a small snippet of inline assembler (https://github.com/CodeIntelligenceTesting/jazzer/blob/main/driver/sanitizer_hooks_with_pc.cpp), porting it to ARM shouldn't be too difficult. The main challenge would be to figure out how to launch or attach to a JVM on Android. Is there an equivalent of libjvm.so on Android?

Could you provide more details on how you have tried to build Jazzer for Android?

You must be logged in to vote
0 replies
Comment options

Instead of focusing too much on ARM, I decided to try to run jazzer on an x86_64 emulator.

After building jazzer, I ran patchelf --set-interpreter /system/bin/linker64 jazzer because on Android the linker is at a different place. Then moved it to the emulator. Then got error: Android 5.0 and later only support position-independent executables (-fPIE)..

I tried looking for a config which could be disabling pic in various BUILD.bazel configs. But couldn't figure out why a PIE executable wasn't being generated...

I previously tried doing values = {"force_pic": "true"} under config_setting but that didn't work...

You must be logged in to vote
4 replies
Comment options

With such a config_setting, you would not set force_pic, but make it possible for e.g. selects to depend on its value. Could you try again with:

bazel build //:jazzer --force_pic

This gives me:

❯ file bazel-bin/driver/jazzer_driver
bazel-bin/driver/jazzer_driver: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[xxHash]=18d2f7b0ad33a53e, with debug_info, not stripped
Comment options

So, even after doing force_pic, the binary still didn't work, the error message read:

CANNOT LINK EXECUTABLE "./jazzer": library "libdl.so.2" not found: needed by main executable

I tried following bazel instructions, and ran this command to try building via the NDK (after setting up prerequisites):

./bazelisk-linux-amd64 build //:jazzer_release --force_pic --crosstool_top=@androidndk//:default_crosstool --cpu=x86_64 --host_crosstool_top=@bazel_tools//tools/cpp:toolchain

The resulting binary gave the same errors as without using the NDK.

I also tried to gather the required libraries for my android fuzz target on the host to try and see if I can fuzz it using jazzer locally on x86 linux, but got this error:

Java Exception: java.lang.UnsatisfiedLinkError: 'boolean android.util.Log.isLoggable(java.lang.String, int)'

It's a native method compiled as the target libandroid_runtime, I tried to make it available to the binary at runtime by putting libandroid_runtime.so in the same directory as my compiled fuzz target .class, and trying to provide the path to it as:

Djava.library.path="./lib"

where the .so files were added to the ./lib directory.
But still ran into the same UnsatisfiedLinkError.

Comment options

So, even after doing force_pic, the binary still didn't work, the error message read:

CANNOT LINK EXECUTABLE "./jazzer": library "libdl.so.2" not found: needed by main executable

Did you try this with current main? We dropped the dependency on libdl in 554bfe4.

It's a native method compiled as the target libandroid_runtime, I tried to make it available to the binary at runtime by putting libandroid_runtime.so in the same directory as my compiled fuzz target .class, and trying to provide the path to it as:

Djava.library.path="./lib"

where the .so files were added to the ./lib directory. But still ran into the same UnsatisfiedLinkError.

How did you pass this argument to Jazzer? Since Jazzer launches its own JVM, you might have to pass it via --jvm_args. Alternatively, if this is available on Android, you could add ./lib (or ideally an absolute path) to LD_LIBRARY_PATH or even LD_PRELOAD the native library.

Comment options

  1. Reset my local repo to main, but still got the libdl.so.2 not found error.

  2. Even after adding ./lib to LD_LIBRARY_PATH, still got UnsatisfiedLinkError.

  3. I tried running jazzer with --jvm_args=-Djava.library.path= ".../lib/libandroid_runtime.so". It showed me ./jazzer: Running 1 inputs 1 time(s) each. Running: ...s/lib/libandroid_runtime.so, but still got the UnsatisfiedLinkError eventually.

  4. Adding the library's absolute path to LD_PRELOAD also didn't work.

I think the 2 most promising ideas may be using robolectric alongside jazzer, or building jazzer for android. Still a bit surprised why using the ndk to build jazzer didn't work previously.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
None yet
2 participants

AltStyle によって変換されたページ (->オリジナル) /