AHAFuzz Artifacts

AHAFuzz : Intent-aware Fuzzing for Android Hardened Application AHAFuzz is now accepted at ACM CCS 2025. Updated code is available at https://github.com/S2-Lab/AHA-fuzz/ Dependencies Tested on MacOS Sonoma 14.4.1 (23E224) with a 24-core CPU (Apple M2 Ultra) and 192 GB of RAM Android SDK (e.g., adb, aapt, emulator) python3, BPF module (pip3 install BPF) Prerequisites 1. ARM64 android device with root privilege - We test AHAFuzz with an emulator (android-33;google_apis;arm64-v8a-17) - You can download emulator with sdkmanager 2. AOSP build environment - AHAFuzz is based on Monkey, the built-in Android fuzzer. - To build AHAFuzz, the recommended approach is to replace the Monkey code with the AHAFuzz code in AOSP. - Additionally, the Fuzzer directory contains all pre-built versions of the fuzzer. - For more details, refer to the README in the Fuzzer_src directory. 3. bpftools build environment - Because current android kernel are not user-friendly to use eBPF, we have to cross-compile bpftools, which is eBPF framework tools. - Please refer to the following link: https://github.com/facebookexperimental/ExtendedAndroidTools - After building bpftools, you have to increase the probe limit defined in the BCC code. - Additionally, a pre-built bpftools binary named bpftools-arm64.tar.gz is provided. How to Run AHAFuzz 1. Device setting - Build bpftools (see Appendix 1), or use pre-built bpftools-arm64.tar.gz - Upload & setting bpftools // run android device emulator -avd AHAFuzz // example adb push bpftools-arm64.tar.gz /data/local/tmp adb root adb shell cd /data/local/tmp mkdir message tar -xvf bpftools-arm64.tar.gz cd bpftools sh setup.sh 2. Setting AHAFuzz script sh script/setting.sh 3. Install target application - "manifest_analysis.py" collects information that need to fuzz(e.g., UID of target app, intent information defined in manifest file) python3 prototype/manifest_analysis.py {port-number} {apk-path} ex : python3 prototype/manifest_analysis.py emulator-5554 com.example.toy 4. Run eBPF Program adb root && adb shell cd /data/local/tmp/bpftools ./python3 AHAFuzz.py 5. Run fuzzer - Because AHAFuzz is based on monkey fuzzer, usage is also same. - One additional option is "--running-minutes {time}". adb -s emulator-5554 shell CLASSPATH=/data/local/tmp/AHAFuzz.jar /system/bin/app_process /data/local/tmp/ com.android.commands.monkey.Monkey -p {target package name} --running-minutes {fuzzing time} --ape sata // select mode, default = AHAFuzz.jar 6. Get result sh script/GetResult.sh Other directory information - dataset : contains dataset used in evaluation - Evaluation1 : contains script that used in Evaluation #1,2 (section 5.2, 5.3) - Not available yet, because of dataset redistribution guideline - Evaluation3 : contains script that used in Evaluation #3 (section 5.4) - Evaluation4 : contains bug report we found (section 5.5) - Fuzzer : contains pre-built fuzzer with various mode - Fuzzer_src : source code of Fuzzing engine of AHAFuzz - mate : Mate (https://github.com/mate-android-testing/mate) we used - obj_recover : Recovering java object layout (section 3.2.1) - prototype : contains codes of eBPF framework of AHAFuzz - script : contains useful script - bpftools-arm64.tar.gz : pre-built bpftools * Scripts we used are customized our evaluation setting. So, please refer to it Code Description - prototype/AHAFuzz.py : BCC script to run eBPF program - prototype/manifest_analysis.py : python script to collect information required in fuzzing(e.g., intent information defined in manifest, UID of target app) input : argv[1] : android device port (e.g., emulator-5554) argv[2] : target apk path to install (e.g., ~/com.example.toy) - prototype/processing.py : processing information that need to hook AOT-compiled code - prototype/bpf_prog : C code of eBPF program - script/setting.sh : setting script - script/GetResult.sh : After fuzzing, pull fuzzing result - Fuzzer_src/monkey/src/com/android/commands/monkey : main logic of fuzzer part *Appendix 1. How to increase the probe limit defined in the BCC code tar -xvf bpftools-arm64.tar.gz cd bpftools/lib/python3.10/site-packages unzip bcc-0.27.0-py3.10.egg sed -i '' -E 's/(_default_probe_limit = )[0-9]+/\150000/' bcc/__init__.py // change probe limit to 50000 zip -r bcc-0.27.0-py3.10.egg bcc cd ../../../.. tar -czvf bpftools-arm64.tar.gz bpftools 2. How to turn off JIT adb root && adb shell setprop dalvik.vm.usejit false setprop dalvik.vm.usejitprofiles false # getprop | grep jit // output [dalvik.vm.usejit]: [false][dalvik.vm.usejitprofiles]: [false]