Android Platform

Honggfuzz (as of version 0.6) supports Android OS (NDK cross-compilation) using
both ptrace() API and POSIX signals interface. When ptrace() API is enabled,
honggfuzz's engine prevents monitored signals from reaching the debugger (no
logcat backtraces & tombstones), since the fuzzer's runtime analysis is
affected.

Requirements

• Android NDK: User has to
  manually install NDK and set environment PATH
• libunwind: In case of first
  build an upstream git fork is executed followed by required patches
• capstone: In case of first
  build an upstream git fork is executed

Compatibility list

It has been tested under the following CPU architectures:

*) libunwind fails to extract frames if fuzzing target is 32bit. Prefer a32bit build for such targets.

Cross-Compiling

Dependencies

A series of helper bash scripts have been created under the
third_party/android/scripts directory to automate the dependencies
configuration & build process. The scripts are automatically invoked from the
makefile, based on the selected target CPU. Normally you'll not need to manually
execute or modify them.

Building

All CPUs

For convenience the master makefile defines an android-all target that
automatically builds honggfuzz (and its dependencies) for all the supported
Android CPUs.

From the root directory execute the following. Build output is available under
the libs directory.

$ make android-all
...
$ tree libs/
libs/
├── arm64-v8a
│   ├── android_api.txt
│   ├── honggfuzz
│   ├── libhfuzz.a
│   └── ndk_toolchain.txt
├── armeabi
│   ├── android_api.txt
│   ├── honggfuzz
│   ├── libhfuzz.a
│   └── ndk_toolchain.txt
├── armeabi-v7a
│   ├── android_api.txt
│   ├── honggfuzz
│   ├── libhfuzz.a
│   └── ndk_toolchain.txt
├── x86
│   ├── android_api.txt
│   ├── honggfuzz
│   ├── libhfuzz.a
│   └── ndk_toolchain.txt
└── x86_64
    ├── android_api.txt
    ├── honggfuzz
    ├── libhfuzz.a
    └── ndk_toolchain.txt

5 directories, 20 files

Specific CPU

To build for a specific CPU use the android target with one of the supported
ABI descriptions. Again the dependencies are automatically build.

$ make android ANDROID_APP_ABI=<arch>
...

Were <arch> can be:

• armeabi
• armeabi-v7a (**default**)
• arm64-v8a
• x86
• x86_64

Android specific flags

1) If false, POSIX signals interface is used instead of PTRACE API

2) Due to bionic incompatibilities, only APIs >= 21 are supported