针对官方文档https://github.com/google/syzkaller和网上教程不是很详细，在一个新的虚拟机配置时总会出现错误。我们从新建虚拟机开始进行讲解

1.安装虚拟机Ubuntu 18.04.4虚拟机

硬盘空间给到40G。

2.安装好虚拟机后先更换国内源

我们更换清华源

sudo su 
cd /etc/apt/
echo ``>sources.list
vi sources.list

#复制以下内容
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic main restricted universe multiverse
# deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic main restricted universe multiverse
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-updates main restricted universe multiverse
# deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-updates main restricted universe multiverse
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-backports main restricted universe multiverse
# deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-backports main restricted universe multiverse
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-security main restricted universe multiverse
# deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-security main restricted universe multiverse

：wq #保存退出

#重新打开一个终端
sudo apt-get update
sudo apt-get upgrade

3.安装基本依赖

sudo apt-get install debootstrap
sudo apt install qemu-kvm
sudo apt-get install subversion
sudo apt-get install git
sudo apt-get install make
sudo apt-get install qemu
sudo apt install libssl-dev libelf-dev
sudo apt-get install flex bison libc6-dev libc6-dev-i386 linux-libc-dev linux-libc-dev:i386 libgmp3-dev libmpfr-dev libmpc-dev
apt-get install g++
apt-get install build-essential 

4.安装GCC 8.1.0

CC编译需要mpfr和mpc(-->gmp、-->mpfr)库的支持，依次安装这几个库，其中mpfr可直接安装，安装mpc依赖mpfr和gmp库(对版本有要求，建议安装最新版本)，然后执行configure时指定mpfr和gmp的include、lib路径。
下载 MPFR (mpfr-4.0.1), MPFR_patch、GMP (gmp-6.1.2) 和MPC（mpc-1.1.0），链接：https://gmplib.org/ https://www.mpfr.org/mpfr-current/#download

我这里用的 GCC 8.1.0 (https://ftp.gnu.org/gnu/gcc/gcc-8.1.0/gcc-8.1.0.tar.gz)；GMP：6.1.0；MPFR 3.1.4；MPC 1.0.3
一：安装gmp

sudo su
cd /usr/local
cp /mnt/hgfs/Ubuntu-tool/gcc-tool/gmp6.1.2.tar.bz2/ ./ -r #将文件拷贝到/usr/local目录
 tar jxvf gmp-6.1.2.tar.bz2
cd gmp-6.1.2
 ./configure  #这一部错误需要 sudo apt-get install m4
make 
make install

二:安装mpfr

cd ..
cp /mnt/hgfs/Ubuntu-tool/gcc-tool/mpfr-4.0.1.tar.gz/ ./ -r
tar zxvf mpfr-4.0.1.tar.gz
cd mpfr-4.0.1
 ./configure
make
make install

三：安装MPC

cd ..
cp /mnt/hgfs/Ubuntu-tool/gcc-tool/mpc-1.1.0.tar.gz / ./ -r
tar zxvf mpc-1.1.0.tar.gz
cd mpc-1.1.0
./configure --with-gmp-include=/usr/local/include --with-gmp-lib=/usr/local/lib --with-mpfr-include=/usr/local/include    --with-mpfr-lib=/usr/local/lib
make
make install

四:安装GCC
新建一个终端

cd
vi .bash_profile  
#拷贝进去
export C_INCLUDE_PATH=/usr/local/include:$C_INCLUDE_PATH
export LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH
:wq

回到刚才的终端

cd ..
source   /root/.bash_profile
cp /mnt/hgfs/Ubuntu-tool/gcc-tool/gcc-8.1.0.tar.gz/ ./ -r
tar -zxvf gcc-8.1.0.tar.gz
mkdir gcc_temp
cd gcc_temp
sudo apt-get install gcc-multilib
../configure --prefix=/usr   --with-gmp=/usr/local --with-mpfr=/usr/local --with-mpc=/usr/local   
make          #很慢
make install
安装完成后 gcc -v可以查看版本

5.配置GO环境编译Syzkaller

这一步官方文档讲的很详细
打开一个终端

wget https://dl.google.com/go/go1.14.2.linux-amd64.tar.gz
tar -xf go1.14.2.linux-amd64.tar.gz
mv go goroot
mkdir gopath
export GOPATH=`pwd`/gopath
export GOROOT=`pwd`/goroot
export PATH=$GOPATH/bin:$PATH
export PATH=$GOROOT/bin:$PATH#配了零时环境变量，所以换了终端要重新配置
go get -u -d github.com/google/syzkaller/prog  #很慢
cd gopath/src/github.com/google/syzkaller/
make

成果后/bin/syz-manger文件

6.编译内核和准备镜像

git clone https://mirrors.tuna.tsinghua.edu.cn/git/linux.git
cd ~/source/linux

make CC="/usr/bin/gcc" defconfig
make CC="/usr/bin/gcc" kvmconfig

完成后在当前的目录下找到 .config 文件，如果没有按 ctrl+H 显示隐藏文件，在文档的相应位置加入以下字段，保存。

CONFIG_KCOV=y
CONFIG_DEBUG_INFO=y
CONFIG_KASAN=y
CONFIG_KASAN_INLINE=y
CONFIG_CONFIGFS_FS=y
CONFIG_SECURITYFS=y

make CC="/usr/bin/gcc" olddefconfig
make CC="/usr/bin/gcc" -j64

准备镜像

sudo apt-get install debootstrap
mkdir image
cd image/
wget https://raw.githubusercontent.com/google/syzkaller/master/tools/create-image.sh -O create-image.sh
chmod +x create-image.sh
./create-image.sh -s 1024
最后会得到 ./stretch.img 镜像文件

7.配置虚拟环境（QEMU）

sudo usermod -aG kvm $USER
sudo apt-get install qemu-system-x86

#重新打开终端，测试qemu、内核、镜像
qemu-system-x86_64 \
 -kernel $KERNEL/arch/x86/boot/bzImage \
 -append "console=ttyS0 root=/dev/sda debug earlyprintk=serial slub_debug=QUZ"\
 -hda $IMAGE/stretch.img \
 -net user,hostfwd=tcp::10021-:22 -net nic \
 -enable-kvm \
 -nographic \
 -m 2G \
 -smp 2 \
 -pidfile vm.pid \
 2>&1 | tee vm.log
#KVM找不到或无法启动 尝试利用管理员权限或者打开IntelPT在vmware处理器设置部分

开始模糊测试

#返回syzkaller文件目录下，建立 my.cfg 文件
{
    "target": "linux/amd64",
    "http": "127.0.0.1:56741",
    "workdir": "~/fuzz/syzkalls/workdir/",
    "kernel_obj": "~/source/linux/",
    "image": "~/source/image/stretch.img",
    "sshkey": "~/source/image/stretch.id_rsa",
    "syzkaller": "~/fuzz/syzkaller",
    "procs": 8,
    "type": "qemu",
    "vm": {
        "count": 4,
        "kernel": "~/source/linux/arch/x86/boot/bzImage",
        "cpu": 2,
        "mem": 2048
    }
}
#启动manager
mkdir workdir
sudo ./bin/syz-manager -config my.cfg

image.png

有问题欢迎留言，还有很多小细节可能有遗漏。
参考：
https://www.secshi.com/16256.html
https://i-m.dev/posts/20200313-143737.html
https://www.cnblogs.com/joeat1/p/11081601.html
https://blog.csdn.net/weixin_42108484/article/details/83021957
https://blog.csdn.net/flyfish778/article/details/35276883
https://hicookie.me/2019/10/22/Syzkaller-Setup/
https://www.secshi.com/12092.html