diff options
| author | Andrey Konovalov <andreyknvl@gmail.com> | 2017-06-14 14:13:36 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-06-14 14:13:36 +0200 |
| commit | fbec6b14d43b3885014393d928daa3ef2bbb1e8e (patch) | |
| tree | 4ac9abbbd2216e56e8eb058ef26b2c146f595ac9 /docs/executing_syzkaller_programs.md | |
| parent | 7b96fa44e1a1b0c6c6369f899b378eee7583a419 (diff) | |
| parent | 4731d5a4ac84accb8f4c3e224816d81055041e2b (diff) | |
Merge pull request #231 from xairy/up-docs
Move all documentation to docs/
Diffstat (limited to 'docs/executing_syzkaller_programs.md')
| -rw-r--r-- | docs/executing_syzkaller_programs.md | 47 |
1 files changed, 47 insertions, 0 deletions
diff --git a/docs/executing_syzkaller_programs.md b/docs/executing_syzkaller_programs.md new file mode 100644 index 000000000..bd1570c0e --- /dev/null +++ b/docs/executing_syzkaller_programs.md @@ -0,0 +1,47 @@ +# Executing syzkaller programs + +This page describes how to execute existing syzkaller programs for the purpose of bug reproduction. This way you can replay a single program or a whole execution log with several programs. + +1. Setup Go toolchain (if you don't yet have it, you need version 1.8 or higher): +Download latest Go distribution from (https://golang.org/dl/). Unpack it to `$HOME/go1.8`. +``` bash +$ export GOROOT=$HOME/go1.8 +$ export GOPATH=$HOME/gopath +``` + +2. Download syzkaller sources: +``` bash +$ go get -u -d github.com/google/syzkaller/... +``` + +3. Build necessary syzkaller binaries: +``` bash +$ cd $GOPATH/src/github.com/google/syzkaller +$ make +``` + +4. Copy binaries and the program to test machine: +``` bash +$ scp bin/syz-execprog bin/syz-executor program test@machine +``` + +5. Run the program on the test machine: +``` bash +$ ./syz-execprog -executor ./syz-executor -cover=0 -repeat=0 -procs=16 program +``` + +Several useful `syz-execprog` flags: +``` + -collide + collide syscalls to provoke data races (default true) + -procs int + number of parallel processes to execute programs (default 1) + -repeat int + repeat execution that many times (0 for infinite loop) (default 1) + -sandbox string + sandbox for fuzzing (none/setuid/namespace) (default "setuid") + -threaded + use threaded mode in executor (default true) +``` + +If you pass `-threaded=0 -collide=0`, programs will be executed as a simple single-threaded sequence of syscalls. `-threaded=1` forces execution of each syscall in a separate thread, so that execution can proceed over blocking syscalls. `-collide=0` forces second round of execution of syscalls when pairs of syscalls are executed concurrently. |