frida-qbdi-fuzzer: API in-memory fuzzing on Android
Frida/QBDI Android API Fuzzer
This experimental fuzzer is meant to be used for API in-memory fuzzing on Android.
The design is highly inspired and based on AFL/AFL++.
ATM the mutator is quite simple, just the AFL’s havoc stage and the seed selection is simply FIFO (no favored paths, no trimming, no extra features). Obviously these features are planned if you want to contribute adding them PR is well accepted.
Download
git clone https://github.com/andreafioraldi/frida-qbdi-fuzzer.git
Use
This fuzzer is known to work in the Android Emulator (tested on x86_64) but should work on any rooted x86 Android device in theory.
Firstly, download the Android x86_64 build of QBDI and extract the archive in a subdirectory of this project namedQBDI.
Then install Frida on your host with pip3 install frida.
Make sure to have the root shell and SELinux disabled on your virtual device:
host$ adb root host$ adb shell setenforce 0
Download the Android x86_64 frida-server from the repo release page and copy it on the device under /data/local/tmp (use adb push).
Copy libQBDI.so always in /data/local/tmp.
Start a shell and run the frida-server:
device# cd /data/local/tmp device# ./frida-server-12.7.22-android-x86_64
Now install the test app tests/app-debug.apk using the drag & drop into the emulator window.
Then, open the app.
Compile the agent script with frida-compile:
host$ frida-compile -x index.js -o frida-fuzz-agent.js
Fuzz the test_func function of the libnative-lib.so library shipped with the test app with the command:
host$ python3 fuzz.py output_folder/ com.example.ndktest1
Both interesting testcases and crashes are saved into output_folder.
Enjoy.
Copyright (C) 2020 Andrea Fioraldi andreafioraldi@gmail.com
All rights reserved.
