Most of the Turbo Tutorial applies when fuzzing shared libraries. For example, you still add seed files and upload versions of your shared library via version add
. Two key changes are required:
argv[0]
in Seed Files
In seed input files, argv[0]
likely will not be the name of the shared libary [^1], so "use-version:true" is inappropriate. Instead, you'll need to write some sort of main driver program that loads your library and invokes the functionalities you wish to fuzz. Specify argv[0]
to be the name of this driver program.
[^1] Some shared libraries are indeed executable as if they were a program. If your library meets this criteria, no changes are necessary to fuzz the executable portions of your library. If some aspects of your library are only available via dynamic linking, continue following the directions on this page.
Telling Turbo the name of your shared libary
Since shared libraries are referred to by name (either via the standard library loading mechanism or via dlopen
mechanisms [^2]), Turbo needs to know how your main driver program will look for the shared library. To inform Turbo of your library name, include in your application configuration used turbo-cli fuzz
the key ld-path-prepend-version
and specify the name of your program. For example, if you were fuzzing libm.so
, you might use this application config file:
name: 'libm config'
ld-path-prepend-version: "libm.so"
Turbo will modify LD_LIBRARY_PATH to so that the dynamic loader will find the uploaded (and prepared) version of libm.so
before any other locations are checked (hence, the key name ld-path-prepend-version
).
[^2] dlopen
support is not yet available.