Skip to content

Commit 01dbda5

Browse files
Radon10043Radon10043
committed
docs/linux: add instructions for fuzzing Linux x86-64 kernel on Android virtual device
Add new page for fuzzing Linux x86-64 kernel on Android virtual device. It explains how to build and run Android Generic System Image and Generic Kernel Image on Ubuntu host.
1 parent bd178e5 commit 01dbda5

File tree

2 files changed

+205
-0
lines changed

2 files changed

+205
-0
lines changed

‎docs/linux/setup.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ Instructions for a particular VM type or kernel architecture can be found on the
1010
- [Setup: Linux host, QEMU vm, riscv64 kernel](setup_linux-host_qemu-vm_riscv64-kernel.md)
1111
- [Setup: Linux host, QEMU vm, s390x kernel](setup_linux-host_qemu-vm_s390x-kernel.md)
1212
- [Setup: Linux host, Android device, arm32/64 kernel](setup_linux-host_android-device_arm-kernel.md)
13+
- [Setup: Linux host, Android virtual device, x86-64 kernel](setup_linux-host_android-virtual-device_x86-64-kernel.md)
1314
- [Setup: Linux isolated host](setup_linux-host_isolated.md)
1415
- [Setup: Ubuntu host, VMware vm, x86-64 kernel](setup_ubuntu-host_vmware-vm_x86-64-kernel.md)
1516

‎docs/linux/setup_linux-host_android-virtual-device_x86-64-kernel.md‎

Lines changed: 204 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,204 @@
1+
# Setup: Linux host, Android virtual device, x86-64 kernel
2+
3+
This document details the steps involved in setting up a syzkaller instance fuzzing an `x86-64` linux kernel on an Android virtual device.
4+
5+
In the instructions below, the `$VAR` notation (e.g. `$GSI`, `$GKI`, etc.) is used to denote paths to directories that are either created when executing the instructions, or that you have to create yourself before running the instructions. Substitute the values for those variables manually.
6+
7+
Note:
8+
- All commands below assume root privileges.
9+
- It is recommended to have at least 64 GB of RAM and 500 GB of free disk space.
10+
11+
## Install prerequisites
12+
13+
Command:
14+
``` bash
15+
apt update
16+
apt install sudo git wget curl repo libncurses5 vim gcc make bison bc zip rsync language-pack-en-base
17+
```
18+
19+
## Cuttlefish
20+
21+
It is recommended to use [Cuttlefish](https://github.com/google/android-cuttlefish) to emulate Android devices. Build and install it from source (v1.16.0 as an example):
22+
23+
Command:
24+
``` bash
25+
apt install git devscripts equivs config-package-dev debhelper-compat golang curl
26+
git clone -b v1.16.0 https://github.com/google/android-cuttlefish
27+
cd android-cuttlefish
28+
tools/buildutils/build_packages.sh
29+
dpkg -i ./cuttlefish-base_*_*64.deb || sudo apt-get install -y -f
30+
dpkg -i ./cuttlefish-user_*_*64.deb || sudo apt-get install -y -f
31+
usermod -aG kvm,cvdnetwork,render root
32+
reboot
33+
```
34+
35+
## Generic System Images (GSI)
36+
37+
### Checkout GSI source
38+
39+
The GSI source checkout is close to 90 GB, and the build can take up about 300 GB of disk space.
40+
41+
Command:
42+
``` bash
43+
mkdir android13-gsi
44+
cd android13-gsi
45+
repo init -u https://android.googlesource.com/platform/manifest -b android13-gsi
46+
repo sync -c
47+
```
48+
49+
### Build GSI
50+
51+
Refresh the build environment and select the build target:
52+
53+
Command:
54+
``` bash
55+
source build/envsetup.sh
56+
lunch aosp_cf_x86_64_phone-userdebug
57+
```
58+
59+
The output should be as follows (may vary depending on the host):
60+
61+
``` text
62+
============================================
63+
PLATFORM_VERSION_CODENAME=REL
64+
PLATFORM_VERSION=13
65+
TARGET_PRODUCT=aosp_cf_x86_64_phone
66+
TARGET_BUILD_VARIANT=userdebug
67+
TARGET_BUILD_TYPE=release
68+
TARGET_ARCH=x86_64
69+
TARGET_ARCH_VARIANT=silvermont
70+
TARGET_2ND_ARCH=x86
71+
TARGET_2ND_ARCH_VARIANT=silvermont
72+
HOST_ARCH=x86_64
73+
HOST_2ND_ARCH=x86
74+
HOST_OS=linux
75+
HOST_OS_EXTRA=Linux-6.8.0-65-generic-x86_64-Ubuntu-22.04.4-LTS
76+
HOST_CROSS_OS=windows
77+
HOST_CROSS_ARCH=x86
78+
HOST_CROSS_2ND_ARCH=x86_64
79+
HOST_BUILD_TYPE=release
80+
BUILD_ID=TP1A.220624.019
81+
OUT_DIR=out
82+
PRODUCT_SOONG_NAMESPACES=device/generic/goldfish-opengl device/generic/goldfish device/generic/goldfish-opengl hardware/google/camera hardware/google/camera/devices/EmulatedCamera device/google/cuttlefish/apex/com.google.cf.wifi_hwsim external/mesa3d vendor/google_devices/common/proprietary/confirmatioui_hal
83+
============================================
84+
```
85+
86+
Start building:
87+
88+
Command:
89+
``` bash
90+
m
91+
```
92+
93+
You can test your setup by launching the virtual device:
94+
95+
Command:
96+
```bash
97+
launch_cvd
98+
```
99+
100+
Open [http://localhost:8443](http://localhost:8443) in your browser, you should see a virtual device. Click `Connect` to interact with it as you would with a real phone. Press `Ctrl-C` in the terminal to stop the simulator.
101+
102+
## Kernel
103+
104+
### Checkout Android Generic Kernel Image (GKI) source
105+
106+
Command:
107+
``` bash
108+
mkdir common-android13-5.15
109+
cd common-android13-5.15
110+
repo init -u https://android.googlesource.com/kernel/manifest -b common-android13-5.15
111+
repo sync -c
112+
```
113+
114+
### Build GKI
115+
116+
We need to build the Android Kernel with KASAN and KCOV so that syzkaller can get coverage and bug information during fuzzing.
117+
118+
Command:
119+
``` bash
120+
BUILD_CONFIG=common/build.config.gki_kasan.x86_64 build/build.sh
121+
```
122+
123+
Build vendor modules with KASAN and KCOV:
124+
125+
Command:
126+
``` bash
127+
BUILD_CONFIG=common-modules/virtual-device/build.config.virtual_device_kasan.x86_64 build/build.sh
128+
```
129+
130+
## syzkaller
131+
132+
### Build syzkaller
133+
134+
Build syzkaller as described [here](/docs/linux/setup.md#go-and-syzkaller).
135+
Then create a manager config like the following, replacing the environment
136+
variables `$GOPATH` and `$GKI` with their actual values.
137+
138+
``` json
139+
{
140+
"target": "linux/amd64",
141+
"http": "127.0.0.1:56741",
142+
"workdir": "$GOPATH/src/github.com/google/syzkaller/workdir/android/out",
143+
"kernel_obj": "$GKI/out/android13-5.15/dist",
144+
"syzkaller": "$GOPATH/src/github.com/google/syzkaller",
145+
"cover": true,
146+
"type": "adb",
147+
"vm": {
148+
"devices": ["0.0.0.0:6520"],
149+
"battery_check": true
150+
}
151+
}
152+
```
153+
154+
### Launch the virtual device
155+
156+
Launch the Android system with the KASAN and KCOV kernel.
157+
158+
Command:
159+
``` bash
160+
cd $GSI
161+
source build/envsetup.sh
162+
lunch aosp_cf_x86_64_phone-userdebug
163+
launch_cvd -daemon -kernel_path=$GKI/out/android13-5.15/dist/bzImage -initramfs_path=$GKI/out/android13-5.15/dist/initramfs.img
164+
```
165+
166+
Connect to the virtual device with adb:
167+
168+
Command:
169+
``` bash
170+
adb connect 0.0.0.0:6520
171+
```
172+
173+
List available virtual devices:
174+
175+
Command:
176+
``` bash
177+
adb devices
178+
```
179+
180+
### Run syzkaller
181+
182+
Run syzkaller manager:
183+
184+
Command:
185+
```bash
186+
cd $GOPATH/src/github.com/google/syzkaller
187+
./bin/syz-manager -config=android.cfg
188+
```
189+
190+
Now syzkaller should be running, you can check manager status with your web browser at `127.0.0.1:56741`.
191+
192+
If you get issues after `syz-manager` starts, consider running it with the `-debug` flag.
193+
194+
Here are some useful links:
195+
196+
- [github - google/android-cuttlefish](https://github.com/google/android-cuttlefish)
197+
- [AOSP - Cuttlefish virtual Android devices](https://source.android.com/docs/devices/cuttlefish)
198+
- [AOSP - Cuttlefish: Get started](https://source.android.com/docs/devices/cuttlefish/get-started)
199+
- [AOSP - Download the Android source](https://source.android.com/docs/setup/download)
200+
- [AOSP - Build Android](https://source.android.com/docs/setup/build/building)
201+
- [AOSP - Generic system images](https://source.android.com/docs/core/tests/vts/gsi#building-gsis)
202+
- [AOSP - Architecture overview](https://source.android.com/docs/core/architecture)
203+
- [AOSP - Build kernels](https://source.android.com/docs/setup/build/building-kernels)
204+
- [AOSP - Kernel branches and their build systems](https://source.android.com/docs/setup/reference/bazel-support)

0 commit comments

Comments
 (0)