Extending Ruzzy with LibAFL

Summary: Trail of Bits added LibAFL support to Ruzzy, its coverage-guided fuzzer for pure Ruby code and Ruby C extensions, by building LibAFL as a standalone library and linking libFuzzer.a into Ruzzy's C extension. Two problems had to be worked around: GNU ld rejects the .preinit_array section LibAFL places in a DSO, and LibAFL errors with "No maps available; cannot fuzz!" because Ruzzy's require of the compiled extension loaded the SanitizerCoverage init code too late for LibAFL, which requires coverage state at startup rather than lazily like libFuzzer.
Why it matters: The fix for the .preinit_array error was to swap in LLVM ld, which does not enforce the constraint GNU ld does, and the proper upstream change to toggle the features at build time is still only a pull request. Ruzzy 0.8.0 ships with these workarounds, so anyone adopting it inherits a build that depends on linker choice and load ordering rather than on a merged fix.

Read the original at Trail of Bits Blog ↗