Fuzzing big endian code in little endian environment with libfuzzer

Question

I am trying to fuzz a part of code written for big endian MIPS architecture using libfuzzer.

I have run libfuzzer under a Debian little endian machine and segmentation faults are issued. I think that the results are not a 100% trustworthy. How to use libfuzzer with an emulator for big endian architectures? Is this possible? Are there any other techniques for testing big endian code in little endian architectures by using fuzzing?

Answer 1

You could cross-compile your software to big-endian MIPS on your host machine, and then use QEMU user-mode emulation. In this mode, QEMU runs a single process on the emulated CPU, eliminating all the emulated hardware. Instead, it merely translates system calls to the host kernel, so the process accesses all the host files, networks, etc. -- just like if your host CPU would get the ability to execute MIPS instructions -- it now can mess with your host files etc. too, you have been warned. :)

I'm not familiar with specifically libfuzzer, but this setup should suffice to at least validate already found crashes (supposing one can trust that QEMU simulates MIPS CPU realistically enough). AFAIK libfuzzer is an in-process fuzzer, so unlike AFL, the fuzzed process should not face some problems with communicating to the separate fuzzer process using shared memory, etc.