fuzzer | Python interface to AFL , allowing for easy injection

Use something like this:

The simplest way to "port" a Docker image to Singularity is to build the Singularity image directly from the Docker image: singularity build libpng_1.2.56.sif docker://gcr.io/fuzzbench/runners/afl/libpng-1.2.56-intermediate. If the source docker image has been built locally and is not in a remote registry use docker-daemon:// instead of docker://.

The documentation also has a pretty sizable Singularity and Docker section that goes over using Docker images with Singularity and similarities/differences between a Singularity definition file and a Dockerfile.

If you want to maintain separate Dockerfile and Singularity files for creating images, keep in mind there is not always a direct equivalent. e.g,. --tag in Docker is effectively equivalent to the filename of the Singularity image, buildkit settings are specific to the Docker build process and do not have a counterpart in Singularity.

You've tried to upgrade the version of QEMU that afl-qemu uses. Because afl-qemu makes modifications to QEMU's source, this is not a trivial thing to do. In particular, these commands that you commented out:

As mentioned in comments you are most likely running out of memory: by default all executables are linked statically so lds use a lot of RAM. There are several ways to counteract this:

1. Reduce link parallelism via -DLLVM_PARALLEL_LINK_JOBS=1 to avoid starting too many links in parallel (BTW for generic codebase one could use ld-limiter to achieve the same).

2. Reduce consumed memory by using either or both of -Wl,-no-keep-memory and -Wl,--reduce-memory-overheads linker flags (add them to CMAKE_EXE_LINKER_FLAGS).

3. Switch to Gold (via -fuse-ld=gold) or lld (via -fuse-ld=lld) linkers (add switch to CMAKE_EXE_LINKER_FLAGS).

4. In case you plan to frequently rebuild Clang (e.g. for debugging), you may use -DBUILD_SHARED_LIBS=ON to use shared, instead of static, links. You'll no longer have OOMs and also incremental Clang builds are sped up by 100x (at the cost of 2-3x slower Clang runtimes).

You are not accounting for C++'s name mangling. The symbol for stub_main is likely a string containing main as well as some obfuscated info about arguments, type of function, and return type. In my platform it's __Z9stub_mainiPPc. The symbol for main would likely just be main or main_.

You can try looking how main and stub_main definitions mangle in your platform with objdump -d *.o, and then you can replace these strings with objcopy --redefine-sym.

Alternatively, as matoro said, you can declare the function as extern "C" so that no name mangling takes place.

You have a first issue: all the calls to random or .fuzz() that you put in the content dict are evaluated when the class is imported: each instance will use the exact same values.

In order to perform lazy evaluation, you MUST wrap them in some factory_boy-provided declaration:

To fuzz a binary you should re-compile it's source-code with either afl-gcc (for C-code) or afl-g++ (for C++-code).

You can find more info here.

You could add a predicate that checks how deep the nested expression is, and let the predicate fail if it exceeds a certain number.

For example, you allow a maximum of 3 nested expressions, you could do that like this: