-
Notifications
You must be signed in to change notification settings - Fork 162
-
Hi, I recently tried to build and run Jazzer on a physical device but got an error saying:
./data/jazzer_bin_copy/jazzer[11]: ./data/jazzer_bin_copy/jazzer_driver: not executable: 64-bit ELF file
I did file
on it and got:
$ file jazzer_driver
jazzer_driver: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[xxHash]=13ea3a687dc35e6f, with debug_info, not stripped
It seems like it is built for x86 currently. Is there work in progress to build jazzer for ARM?
Or is there another way to run jazzer on ARM?
Beta Was this translation helpful? Give feedback.
All reactions
Replies: 2 comments 4 replies
-
I have never tried running Jazzer on ARM. While Jazzer does use a small snippet of inline assembler (https://github.com/CodeIntelligenceTesting/jazzer/blob/main/driver/sanitizer_hooks_with_pc.cpp), porting it to ARM shouldn't be too difficult. The main challenge would be to figure out how to launch or attach to a JVM on Android. Is there an equivalent of libjvm.so
on Android?
Could you provide more details on how you have tried to build Jazzer for Android?
Beta Was this translation helpful? Give feedback.
All reactions
-
Instead of focusing too much on ARM, I decided to try to run jazzer on an x86_64 emulator.
After building jazzer, I ran patchelf --set-interpreter /system/bin/linker64 jazzer
because on Android the linker is at a different place. Then moved it to the emulator. Then got error: Android 5.0 and later only support position-independent executables (-fPIE).
.
I tried looking for a config which could be disabling pic
in various BUILD.bazel
configs. But couldn't figure out why a PIE executable wasn't being generated...
I previously tried doing values = {"force_pic": "true"}
under config_setting
but that didn't work...
Beta Was this translation helpful? Give feedback.
All reactions
-
With such a config_setting
, you would not set force_pic
, but make it possible for e.g. selects to depend on its value. Could you try again with:
bazel build //:jazzer --force_pic
This gives me:
❯ file bazel-bin/driver/jazzer_driver
bazel-bin/driver/jazzer_driver: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[xxHash]=18d2f7b0ad33a53e, with debug_info, not stripped
Beta Was this translation helpful? Give feedback.
All reactions
-
So, even after doing force_pic
, the binary still didn't work, the error message read:
CANNOT LINK EXECUTABLE "./jazzer": library "libdl.so.2" not found: needed by main executable
I tried following bazel instructions, and ran this command to try building via the NDK (after setting up prerequisites):
./bazelisk-linux-amd64 build //:jazzer_release --force_pic --crosstool_top=@androidndk//:default_crosstool --cpu=x86_64 --host_crosstool_top=@bazel_tools//tools/cpp:toolchain
The resulting binary gave the same errors as without using the NDK.
I also tried to gather the required libraries for my android fuzz target on the host to try and see if I can fuzz it using jazzer locally on x86 linux, but got this error:
Java Exception: java.lang.UnsatisfiedLinkError: 'boolean android.util.Log.isLoggable(java.lang.String, int)'
It's a native method compiled as the target libandroid_runtime
, I tried to make it available to the binary at runtime by putting libandroid_runtime.so
in the same directory as my compiled fuzz target .class
, and trying to provide the path to it as:
Djava.library.path="./lib"
where the .so files were added to the ./lib directory.
But still ran into the same UnsatisfiedLinkError
.
Beta Was this translation helpful? Give feedback.
All reactions
-
So, even after doing
force_pic
, the binary still didn't work, the error message read:CANNOT LINK EXECUTABLE "./jazzer": library "libdl.so.2" not found: needed by main executable
Did you try this with current main
? We dropped the dependency on libdl
in 554bfe4.
It's a native method compiled as the target
libandroid_runtime
, I tried to make it available to the binary at runtime by puttinglibandroid_runtime.so
in the same directory as my compiled fuzz target.class
, and trying to provide the path to it as:Djava.library.path="./lib"
where the .so files were added to the ./lib directory. But still ran into the same
UnsatisfiedLinkError
.
How did you pass this argument to Jazzer? Since Jazzer launches its own JVM, you might have to pass it via --jvm_args
. Alternatively, if this is available on Android, you could add ./lib
(or ideally an absolute path) to LD_LIBRARY_PATH
or even LD_PRELOAD
the native library.
Beta Was this translation helpful? Give feedback.
All reactions
-
-
Reset my local repo to main, but still got the
libdl.so.2
not found error. -
Even after adding
./lib
toLD_LIBRARY_PATH
, still gotUnsatisfiedLinkError
. -
I tried running
jazzer
with--jvm_args=-Djava.library.path= ".../lib/libandroid_runtime.so"
. It showed me./jazzer: Running 1 inputs 1 time(s) each. Running: ...s/lib/libandroid_runtime.so
, but still got theUnsatisfiedLinkError
eventually. -
Adding the library's absolute path to
LD_PRELOAD
also didn't work.
I think the 2 most promising ideas may be using robolectric alongside jazzer, or building jazzer for android. Still a bit surprised why using the ndk to build jazzer didn't work previously.
Beta Was this translation helpful? Give feedback.