TriforceAFL doesn't build with gcc 7.2.0 on Ubuntu 17.10

[kirit1193]

While running make on Ubuntu 17.10 and gcc 7.2.0, there's an error in compiling qemu_mode:

/home/intel/TriforceAFL/qemu_mode/qemu/user-exec.c: In function ‘cpu_resume_from_signal’:
/home/intel/TriforceAFL/qemu_mode/qemu/user-exec.c:71:37: error: dereferencing pointer to incomplete type ‘struct ucontext’
         sigprocmask(SIG_SETMASK, &uc->uc_sigmask, NULL);
                                     ^~
/home/intel/TriforceAFL/qemu_mode/qemu/user-exec.c: In function ‘cpu_x86_signal_handler’:
/home/intel/TriforceAFL/qemu_mode/qemu/user-exec.c:213:41: error: dereferencing pointer to incomplete type ‘struct ucontext’
 #define PC_sig(context)       ((context)->uc_mcontext.gregs[REG_RIP])
                                         ^
/home/intel/TriforceAFL/qemu_mode/qemu/user-exec.c:232:10: note: in expansion of macro ‘PC_sig’
     pc = PC_sig(uc);
          ^~~~~~
/home/intel/TriforceAFL/qemu_mode/qemu/user-exec.c:237:1: warning: control reaches end of non-void function [-Wreturn-type]
 }
 ^
/home/intel/TriforceAFL/qemu_mode/qemu/rules.mak:57: recipe for target 'user-exec.o' failed

[jhertz]

this is unfortunate. as TriforceAFL is effectively abandonware currently, i'd suggest using an older version of gcc/clang. @timnewsham may remember which exact compiler version we were using when we were working on this. i believe he may also be continuing to work (or at least partially support) this project under his own github

[kirit1193]

That's sad to hear but I'd guessed as much.
So I guess you would recommend the Syzkaller / Trinity / Qemu approach?

[jhertz]

i mean, i think that it is quite useable in its current state, and i'd encourage you to build/fork/play/fuzz with it, as i'm at least quite fond of it :)

i'd recommend just trying to build it with an older version of gcc, whichever was bundled with the vagrant ubuntu Trusty image should work fine, as that was our dev system at the time (note that @richinseattle also has a bunch of dockerfiles that work for building triforceAFL, see https://github.com/richinseattle/Dockerfiles, you can even pull down already built docker images)

[jhertz]

there's also several new projects taking the idea of fuzzing emulated code and running with it, such as:
https://github.com/RUB-SysSec/kAFL
https://hackernoon.com/afl-unicorn-fuzzing-arbitrary-binary-code-563ca28936bf
https://t.co/j5T05if7XK

happy hacking,
-jh

[T12z]

This is actually not a GCC issue, but libc6-dev - it received some refactoring of name-spaces. Just replace 'struct ucontext' with 'ucontext_t' and it will compile.
In my current (Debian sid) system I also had to add '--disable-xen' to the build-script and remove compilation of the documentation - which might just be due to some odd local setup, bu then again, those parts are just not essential.

Concerning the alternatives, kAFL is an impressive approach, but I spent a few months on/off to get it to work. Though in Nov they also added some documentation for setup, which would've save me heaps of time. Considering all the custom extensions they did, I am very pessimistic on the long-term usability of kAFL.

[eu90h]

For what it's worth, I've recently opened a pull request that should fix this problem.

[jhertz]

if there is any further development on this, please move it to https://github.com/timnewsham/TriforceAFL