setup-syzkaller.sh

KERNEL=/home/$USER/linux

RELEASE=stretch
IMAGE=/home/$USER/$RELEASE # match the create-image.sh script if you change the dist

sudo apt-get update && sudo apt-get install build-essential debootstrap qemu-system-x86

git clone https://github.com/torvalds/linux.git $HOME/linux

cd $HOME/linux

make defconfig
make kvmconfig

sed -i 's/\#CONFIG_KCOV is not set/CONFIG_KCOV=y/g' $KERNEL/.config
sed -i 's/\#CONFIG_DEBUG_INFO is not set/CONFIG_DEBUG_INFO=y/g' $KERNEL/.config
sed -i 's/\#CONFIG_KASAN is not set/CONFIG_KASAN=y/g' $KERNEL/.config
sed -i 's/\#CONFIG_KASAN_INLINE is not set/CONFIG_KASAN_INLINE=y/g' $KERNEL/.config
sed -i 's/\#CONFIG_CONFIGFS_FS is not set/CONFIG_CONFIGFS_FS=y/g' $KERNEL/.config
sed -i 's/\#CONFIG_SECURITYFS is not set/CONFIG_SECURITYFS=y/g' $KERNEL/.config
sed -i 's/\#CONFIG_KCOV_INSTRUMENT_ALL is not set/CONFIG_KCOV_INSTRUMENT_ALL=y/g' $KERNEL/.config
sed -i 's/\#CONFIG_KCOV_ENABLE_COMPARISONS is not set/CONFIG_KCOV_ENABLE_COMPARISONS=y/g' $KERNEL/.config
sed -i 's/\#CONFIG_DEBUG_FS is not set/CONFIG_DEBUG_FS=y/g' $KERNEL/.config
sed -i 's/\#CONFIG_DEBUG_INFO is not set/CONFIG_DEBUG_INFO=y/g' $KERNEL/.config
sed -i 's/\#CONFIG_KALLSYMS is not set/CONFIG_KALLSYMS=y/g' $KERNEL/.config
sed -i 's/\#CONFIG_KALLSYMS_ALL is not set/CONFIG_KALLSYMS_ALL=y/g' $KERNEL/.config
sed -i 's/\#CONFIG_DEBUG_INFO is not set/CONFIG_DEBUG_INFO=y/g' $KERNEL/.config
sed -i 's/\#CONFIG_DEBUG_VM is not set/CONFIG_DEBUG_VM=y/g' $KERNEL/.config

make oldconfig # save the config file

echo "Making the kernel..."
make -j`nproc -all`

cd $HOME
wget https://raw.githubusercontent.com/google/syzkaller/master/tools/create-image.sh
bash create-image.sh

echo "qemu-system-x86_64 \
  -kernel $KERNEL/arch/x86/boot/bzImage \
  -append "console=ttyS0 root=/dev/sda debug earlyprintk=serial slub_debug=QUZ"\
  -hda $IMAGE/stretch.img \
  -net user,hostfwd=tcp::10021-:22 -net nic \
  -enable-kvm \
  -nographic \
  -m 2G \
  -smp 2 \
  -pidfile vm.pid \
  2>&1 | tee vm.log" > qemu-test.sh

echo 'Check if ssh -i $IMAGE/stretch.id_rsa -p 10021 -o "StrictHostKeyChecking no" root@localhost works.'
echo 'Have another teminal open when you try that. Also to kill it, kill $(cat vm.pid) or killall qemu*'

cd $HOME
wget https://dl.google.com/go/go1.11.1.linux-amd64.tar.gz
tar -xf go1.11.1.linux-amd64.tar.gz
mv go goroot
mkdir gopath

echo "export GOROOT=`pwd`/goroot" >> $HOME/.bashrc
echo "export PATH=$GOROOT/bin:$PATH" >> $HOME/.bashrc
echo "export GOPATH=`pwd`/gopath" >> $HOME/.bashrc
source $HOME/.bashrc

go get -u -d github.com/google/syzkaller/...
cd gopath/src/github.com/google/syzkaller/
mkdir workdir
make

echo '{
	"target": "linux/amd64",\
	"http": "127.0.0.1:56741",\
	"workdir": "$GOPATH/src/github.com/google/syzkaller/workdir",\
	"kernel_obj": "$KERNEL",\
	"image": "$IMAGE/stretch.img",\
	"sshkey": "$IMAGE/stretch.id_rsa",\
	"syzkaller": "$GOPATH/src/github.com/google/syzkaller",\
	"procs": 8,\
	"type": "qemu",\
	"vm": {\
		"count": 4,\
		"kernel": "$KERNEL/arch/x86/boot/bzImage",\
		"cpu": 2,\
		"mem": 2048\
	}\
}' > syz.cfg

echo 'Might be good to go.'
echo 'run syz-manager -config=syz.cfg'