Building afl++ with nyx mode on NixOS

[ekzyis]

AFL++ needs to be built with nyx mode to follow the quick start guide in the README and run setup-nyx.sh.

I'm on NixOS. Unfortunately, aflplusplus in nixpkgs does not include nyx mode.

The instructions to build AFL++ with nyx mode run build_nyx_support.sh, which calls nyx-fuzz/packer/init_ramfs/pack.sh, which expects shared libraries to be at specific locations.

I'm creating this issue to mention that I'm working on this. Maybe there are (or will be) others on NixOS who run into this.

[morehouse]

I ran into the shared library issue on Fedora as well. This patch works for me: nyx-fuzz/packer#34, though upstream appears to be unmaintained.

[ekzyis]

I was able to build afl++ v4.35c with nyx mode on NixOS now.

I had to heavily patch the build process (see ekzyis/nixpkgs@8e67c32).

I agree that nyx-fuzz/packer appears to be unmaintained. I also ran into compile_qemu_nyx.sh passing LDFLAGS to the Makefile of libxdc here, but the Makefile resets them here. Had to remove that line in the Makefile.

I also ran into nyx-fuzz/packer#35. I ran touch nyx.ini in the current working directory to get around this. It's not used anyway afaict. It will still use the nyx.ini at the default location.

I'm not sure if I built it correctly though. I followed the README, but when I want to start fuzzing, it's stuck at "Booting VM to start fuzzing...":

$ /nix/store/klrb4afsliccqmq06d1512i2mkl8r645-aflplusplus-4.35c/bin/afl-fuzz -X -i /tmp/smite-seeds -o /tmp/smite-out -- /tmp/smite-nyx/
afl-fuzz++4.35c based on afl by Michal Zalewski and a large online community
[+] AFL++ is maintained by Marc "van Hauser" Heuse, Dominik Maier, Andrea Fioraldi and Heiko "hexcoder" Eißfeldt
[+] AFL++ is open source, get it at https://github.com/AFLplusplus/AFLplusplus
[+] NOTE: AFL++ >= v3 has changed defaults and behaviours - see README.md
[+] AFL++ Nyx mode is enabled (developed and maintained by Sergej Schumilo)
[+] Nyx is open source, get it at https://github.com/Nyx-Fuzz
[+] No -M/-S set, autoconfiguring for "-S default"
[*] Getting to work...
[+] Using exploration-based constant power schedule (EXPLORE)
[+] Enabled testcache with 50 MB
[+] Generating fuzz data with a length of min=1 max=1048576
[*] Trying to load libnyx.so plugin...
[+] libnyx plugin is ready!
[+] You have 20 CPU cores and 1 runnable tasks (utilization: 5%).
[+] Try parallel jobs - see /nix/store/klrb4afsliccqmq06d1512i2mkl8r645-aflplusplus-4.35c/share/doc/afl/fuzzing_in_depth.md#c-using-multiple-cores
[*] Setting up output directories...
[+] Output directory exists but deemed OK to reuse.
[*] Deleting old session data...
[+] Output dir cleanup successful.
[*] Checking CPU core loadout...
[+] Found a free CPU core, try binding to #0.
[*] Validating target binary...
[*] Scanning '/tmp/smite-seeds'...
[*] Creating hard links for all input files...
[+] Loaded a total of 1 seeds.
[*] Spinning up the NYX backend...
[!] libnyx: spawning qemu with:
 /nix/store/klrb4afsliccqmq06d1512i2mkl8r645-aflplusplus-4.35c/nyx_mode/QEMU-Nyx/x86_64-softmmu/qemu-system-x86_64 -kernel /nix/store/klrb4afsliccqmq06d1512i2mkl8r645-aflplusplus-4.35c/nyx_mode/packer/linux_initramfs/bzImage-linux-4.15-rc7 -initrd /nix/store/klrb4afsliccqmq06d1512i2mkl8r645-aflplusplus-4.35c/nyx_mode/packer/linux_initramfs/init.cpio.gz -append nokaslr oops=panic nopti ignore_rlimit_data -display none -serial none -enable-kvm -net none -k de -m 4096 -chardev socket,server,path=/tmp/smite-out/workdir/interface_0,id=nyx_interface -device nyx,chardev=nyx_interface,bitmap_size=65536,input_buffer_size=1048576,worker_id=0,workdir=/tmp/smite-out/workdir,sharedir=/tmp/smite-nyx/,aux_buffer_size=4096
-machine kAFL64-v1 -cpu kAFL64-Hypervisor-v1 -fast_vm_reload path=/tmp/smite-out/workdir/snapshot/,load=off,skip_serialization=on
[QEMU-Nyx] Could not access KVM-PT kernel module!
[QEMU-Nyx] Trying vanilla KVM...
[QEMU-Nyx] NYX runs in fallback mode (no Intel-PT tracing or nested hypercall support)!
[QEMU-NYX] Max Dirty Ring Size -> 1048576 (Entries: 65536)
[QEMU-Nyx] Warning: Attempt to use unsupported CPU model (PT) without KVM-PT (Hint: use '-cpu kAFL64-Hypervisor-v2' instead)
qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.07H:EBX.hle [bit 4]
qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.07H:EBX.rtm [bit 11]
[QEMU-NYX] Dirty ring mmap region located at 0x7f31ce68d000
[QEMU-NYX] Booting VM to start fuzzing...

Not sure if the warnings are related. Any idea where the issue might be just based on this output?

Happy to share more information, but I'm also aware that this might be something specific to how I built it on NixOS, so not sure how much you can help me with this.

[morehouse]

The warnings are normal.

I hit the same hang at "Booting VM to start fuzzing..." when debugging this for Fedora. For me the issue was that the initramfs was missing necessary shared libraries. nyx-fuzz/packer#34 fixed it on my system.

[ekzyis]

I have been trying to get this to work for the past few days.

Thank you for pointing me to nyx-fuzz/packer#34 again. I thought the patch was only relevant to the build, so after the build succeeded, I didn't compare it with what I had. However, it still hangs at "Booting VM to start fuzzing..." with that patch.

Here is the output of ls -lR rootTemplate/lib* in pack.sh after copying the shared libraries into rootTemplate:

ls -lR rootTemplate/lib*

rootTemplate/lib:
total 252
drwxr-xr-x 2 nixbld nixbld   4096 Apr  1 15:36 i386-linux-gnu
-r-xr-xr-x 1 nixbld nixbld 245960 Apr  1 15:36 ld-linux.so.2
drwxr-xr-x 2 nixbld nixbld   4096 Apr  1 15:36 x86_64-linux-gnu

rootTemplate/lib/i386-linux-gnu:
total 0

rootTemplate/lib/x86_64-linux-gnu:
total 2404
-r-xr-xr-x 1 nixbld nixbld 2395960 Apr  1 15:36 libc.so.6
-r-xr-xr-x 1 nixbld nixbld   15688 Apr  1 15:36 libdl.so.2
-r-xr-xr-x 1 nixbld nixbld   45456 Apr  1 15:36 libnss_compat.so.2

rootTemplate/lib32:
total 20084
-rwxr-xr-x 1 nixbld nixbld 7491296 Jan  1  1970 libasan.so.4
-r-xr-xr-x 1 nixbld nixbld 2620160 Apr  1 15:36 libc.so.6
-r-xr-xr-x 1 nixbld nixbld   14876 Apr  1 15:36 libdl.so.2
-rw-r--r-- 1 nixbld nixbld  341556 Jan  1  1970 libm.so.6
-rwxr-xr-x 1 nixbld nixbld  955940 Jan  1  1970 libpthread.so.0
-rwxr-xr-x 1 nixbld nixbld   34436 Jan  1  1970 librt.so.1
-rwxr-xr-x 1 nixbld nixbld 9095296 Jan  1  1970 libstdc++.so.6

rootTemplate/lib64:
total 2656
-r-xr-xr-x 1 nixbld nixbld  254240 Apr  1 15:36 ld-linux-x86-64.so.2
-r-xr-xr-x 1 nixbld nixbld 2395960 Apr  1 15:36 libc.so.6
-r-xr-xr-x 1 nixbld nixbld   15688 Apr  1 15:36 libdl.so.2
-r-xr-xr-x 1 nixbld nixbld   45456 Apr  1 15:36 libnss_compat.so.2

pack.sh patch

diff --git a/linux_initramfs/pack.sh b/linux_initramfs/pack.sh
index e042bb5..dccbaef 100644
--- a/linux_initramfs/pack.sh
+++ b/linux_initramfs/pack.sh
@@ -31,6 +31,7 @@ fi

 cd ../packer/linux_x86_64-userspace/
 sh compile_loader.sh
+sh compile_64.sh
 cd -
 cp ../packer/linux_x86_64-userspace/bin64/loader rootTemplate/loader
 chmod +x rootTemplate/loader
@@ -40,16 +41,19 @@ mkdir rootTemplate/lib/i386-linux-gnu/
 mkdir rootTemplate/lib/x86_64-linux-gnu/

 cp -L /lib/ld-linux.so.2 rootTemplate/lib/ld-linux.so.2
-cp -L /lib64/ld-linux-x86-64.so.2 rootTemplate/lib64/ld-linux-x86-64.so.2
 cp -L /lib/x86_64-linux-gnu/libdl.so.2 rootTemplate/lib/x86_64-linux-gnu/libdl.so.2
 cp -L /lib/x86_64-linux-gnu/libc.so.6 rootTemplate//lib/x86_64-linux-gnu/libc.so.6
+cp -L /lib64/ld-linux-x86-64.so.2 rootTemplate/lib64/ld-linux-x86-64.so.2
+cp -L /lib64/libdl.so.2 rootTemplate/lib64/libdl.so.2
+cp -L /lib64/libc.so.6 rootTemplate/lib64/libc.so.6
 cp -L /lib32/libc.so.6  rootTemplate//lib32/libc.so.6
-cp -L /lib/ld-linux.so.2 rootTemplate/lib/ld-linux.so.2
 cp -L /lib32/libdl.so.2 rootTemplate/lib32/libdl.so.2

 # fix nasty nss bugs (getpwnam_r, ...)
 cp /lib/x86_64-linux-gnu/libnss_compat.so.2 rootTemplate//lib/x86_64-linux-gnu/
+cp /lib64/libnss_compat.so.2 rootTemplate/lib64/

+ls -lR "rootTemplate"/lib*
 cp -r "rootTemplate" "init"
 sed '/START/c\./loader' init/init_template > init/init
 chmod 755 "init/init"

_{I included sh compile_64.sh in pack.sh to build the packer binaries in the build phase (a NixOS thing), not when running the tests. I think my issue is unrelated to this.}

But I think even if ls -lR rootTemplate/lib* would match your output, it doesn't mean that there isn't still something that I need to patch for my system to get it to run.

Other things I tried but didn't help:

• I noticed rootTemplate/lib/x86_64-linux-gnu was missing ld-linux-x86-64.so.2 as in rootTemplate/lib64/, so I included it there, too
• This line looked quite suspicious, since I'm on x86_64, so I removed it

$ uname -a
Linux ekzyis-pc 6.12.77 #1-NixOS SMP PREEMPT_DYNAMIC Fri Mar 13 16:20:49 UTC 2026 x86_64 GNU/Linux

I'll continue to look into it.

[ekzyis]

I am getting somewhere by manually running qemu-system-x86_64.

For example, I found the issue of the booting VM by running qemu-system-x86_64 with -nographic and console=ttyS0 added to -append:

$ /nix/store/ac55y1cw4rbrfcb4xkl1xj8lzp39rmwd-aflplusplus-4.35c/nyx_mode/QEMU-Nyx/x86_64-softmmu/qemu-system-x86_64 \
    -kernel /nix/store/ac55y1cw4rbrfcb4xkl1xj8lzp39rmwd-aflplusplus-4.35c/nyx_mode/packer/linux_initramfs/bzImage-linux-4.15-rc7 \
    -initrd /nix/store/ac55y1cw4rbrfcb4xkl1xj8lzp39rmwd-aflplusplus-4.35c/nyx_mode/packer/linux_initramfs/init.cpio.gz \
    -append "nokaslr oops=panic nopti ignore_rlimit_data console=ttyS0" \
    -enable-kvm -net none -k de -m 4096 -machine kAFL64-v1 -cpu kAFL64-Hypervisor-v1 -fast_vm_reload path=/tmp/smite-out/workdir/snapshot/,load=off,skip_serialization=on \
    -nographic
[... boot logs ...]
[    0.398063] Failed to execute /init (error -2)

I then unpacked packer/linux_initramfs/init.cpio.gz and noticed the init script shebang points to /nix/store. NixOS patches shebangs of executable files to point there:

$ cd $(mktemp -d)
$ zcat /nix/store/ac55y1cw4rbrfcb4xkl1xj8lzp39rmwd-aflplusplus-4.35c/nyx_mode/packer/linux_initramfs/init.cpio.gz | cpio -idmv
$ head -1 init
#!/nix/store/6ph0zypyfc09fw6hlc1ygjvk2hv4j9vd-bash-5.3p3/bin/sh

After fixing that, attaching the shared directory + nowait for chardev, I'm now here:

boot logs

[QEMU-Nyx] Could not access KVM-PT kernel module!
[QEMU-Nyx] Trying vanilla KVM...
[QEMU-Nyx] NYX runs in fallback mode (no Intel-PT tracing or nested hypercall support)!
[QEMU-NYX] Max Dirty Ring Size -> 1048576 (Entries: 65536)
[QEMU-Nyx] Warning: Attempt to use unsupported CPU model (PT) without KVM-PT (Hint: use '-cpu kAFL64-Hypervisor-v2' instead)
qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.07H:EBX.hle [bit 4]
qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.07H:EBX.rtm [bit 11]
[QEMU-NYX] Dirty ring mmap region located at 0x7f0d45c20000
[QEMU-NYX] Booting VM to start fuzzing...
SeaBIOS (version rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org)
Booting from ROM..
[    0.000000] Linux version 4.15.0-rc7 (sergej@Intel-PT-Server-2) (gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.4)) #1 SMP Mon Jan 8 14:19:58 CET 2018
[    0.000000] Command line: nokaslr oops=panic nopti ignore_rlimit_data console=ttyS0
[    0.000000] KERNEL supported cpus:
[    0.000000]   Intel GenuineIntel
[    0.000000]   AMD AuthenticAMD
[    0.000000]   Centaur CentaurHauls
[    0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
[    0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
[    0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
[    0.000000] x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
[    0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'standard' format.
[    0.000000] e820: BIOS-provided physical RAM map:
[    0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
[    0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
[    0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
[    0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000bffdffff] usable
[    0.000000] BIOS-e820: [mem 0x00000000bffe0000-0x00000000bfffffff] reserved
[    0.000000] BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved
[    0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
[    0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000013fffffff] usable
[    0.000000] NX (Execute Disable) protection: active
[    0.000000] random: fast init done
[    0.000000] SMBIOS 2.8 present.
[    0.000000] DMI: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[    0.000000] Hypervisor detected: KVM
[    0.000000] e820: last_pfn = 0x140000 max_arch_pfn = 0x400000000
[    0.000000] x86/PAT: Configuration [0-7]: WB  WC  UC- UC  WB  WP  UC- WT  
[    0.000000] e820: last_pfn = 0xbffe0 max_arch_pfn = 0x400000000
[    0.000000] found SMP MP-table at [mem 0x000f5ab0-0x000f5abf] mapped at [        (ptrval)]
[    0.000000] Scanning 1 areas for low memory corruption
[    0.000000] RAMDISK: [mem 0xbf37b000-0xbffdffff]
[    0.000000] ACPI: Early table checksum verification disabled
[    0.000000] ACPI: RSDP 0x00000000000F58C0 000014 (v00 BOCHS )
[    0.000000] ACPI: RSDT 0x00000000BFFE156F 000030 (v01 BOCHS  BXPCRSDT 00000001 BXPC 00000001)
[    0.000000] ACPI: FACP 0x00000000BFFE144B 000074 (v01 BOCHS  BXPCFACP 00000001 BXPC 00000001)
[    0.000000] ACPI: DSDT 0x00000000BFFE0040 00140B (v01 BOCHS  BXPCDSDT 00000001 BXPC 00000001)
[    0.000000] ACPI: FACS 0x00000000BFFE0000 000040
[    0.000000] ACPI: APIC 0x00000000BFFE14BF 000078 (v01 BOCHS  BXPCAPIC 00000001 BXPC 00000001)
[    0.000000] ACPI: HPET 0x00000000BFFE1537 000038 (v01 BOCHS  BXPCHPET 00000001 BXPC 00000001)
[    0.000000] No NUMA configuration found
[    0.000000] Faking a node at [mem 0x0000000000000000-0x000000013fffffff]
[    0.000000] NODE_DATA(0) allocated [mem 0x13fff8000-0x13fffcfff]
[    0.000000] kvm-clock: cpu 0, msr 1:3ffef001, primary cpu clock
[    0.000000] kvm-clock: Using msrs 4b564d01 and 4b564d00
[    0.000000] kvm-clock: using sched offset of 97474455 cycles
[    0.000000] clocksource: kvm-clock: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000000001000-0x0000000000ffffff]
[    0.000000]   DMA32    [mem 0x0000000001000000-0x00000000ffffffff]
[    0.000000]   Normal   [mem 0x0000000100000000-0x000000013fffffff]
[    0.000000]   Device   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000001000-0x000000000009efff]
[    0.000000]   node   0: [mem 0x0000000000100000-0x00000000bffdffff]
[    0.000000]   node   0: [mem 0x0000000100000000-0x000000013fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000001000-0x000000013fffffff]
[    0.000000] Reserved but unavailable: 98 pages
[    0.000000] ACPI: PM-Timer IO Port: 0x608
[    0.000000] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1])
[    0.000000] IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23
[    0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl)
[    0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level)
[    0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
[    0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level)
[    0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level)
[    0.000000] Using ACPI (MADT) for SMP configuration information
[    0.000000] ACPI: HPET id: 0x8086a201 base: 0xfed00000
[    0.000000] smpboot: Allowing 1 CPUs, 0 hotplug CPUs
[    0.000000] PM: Registered nosave memory: [mem 0x00000000-0x00000fff]
[    0.000000] PM: Registered nosave memory: [mem 0x0009f000-0x0009ffff]
[    0.000000] PM: Registered nosave memory: [mem 0x000a0000-0x000effff]
[    0.000000] PM: Registered nosave memory: [mem 0x000f0000-0x000fffff]
[    0.000000] PM: Registered nosave memory: [mem 0xbffe0000-0xbfffffff]
[    0.000000] PM: Registered nosave memory: [mem 0xc0000000-0xfeffbfff]
[    0.000000] PM: Registered nosave memory: [mem 0xfeffc000-0xfeffffff]
[    0.000000] PM: Registered nosave memory: [mem 0xff000000-0xfffbffff]
[    0.000000] PM: Registered nosave memory: [mem 0xfffc0000-0xffffffff]
[    0.000000] e820: [mem 0xc0000000-0xfeffbfff] available for PCI devices
[    0.000000] Booting paravirtualized kernel on KVM
[    0.000000] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645519600211568 ns
[    0.000000] setup_percpu: NR_CPUS:512 nr_cpumask_bits:512 nr_cpu_ids:1 nr_node_ids:1
[    0.000000] percpu: Embedded 45 pages/cpu @        (ptrval) s146072 r8192 d30056 u2097152
[    0.000000] KVM setup async PF for cpu 0
[    0.000000] kvm-stealtime: cpu 0, msr 13fc16200
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 1032041
[    0.000000] Policy zone: Normal
[    0.000000] Kernel command line: nokaslr oops=panic nopti ignore_rlimit_data console=ttyS0
[    0.000000] Memory: 4022700K/4193784K available (12300K kernel code, 1530K rwdata, 3856K rodata, 1664K init, 1196K bss, 171084K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] ftrace: allocating 37760 entries in 148 pages
[    0.004000] Hierarchical RCU implementation.
[    0.004000] 	RCU restricting CPUs from NR_CPUS=512 to nr_cpu_ids=1.
[    0.004000] RCU: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=1
[    0.004000] NR_IRQS: 33024, nr_irqs: 256, preallocated irqs: 16
[    0.004000] Console: colour VGA+ 80x25
[    0.004000] console [ttyS0] enabled
[    0.004000] ACPI: Core revision 20170831
[    0.004000] ACPI: 1 ACPI AML tables successfully acquired and loaded
[    0.004000] clocksource: hpet: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604467 ns
[    0.004004] APIC: Switch to symmetric I/O mode setup
[    0.004440] x2apic enabled
[    0.004734] Switched APIC routing to physical x2apic.
[    0.005575] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1
[    0.005952] tsc: Detected 3494.400 MHz processor
[    0.006242] Calibrating delay loop (skipped) preset value.. 6988.80 BogoMIPS (lpj=13977600)
[    0.006242] pid_max: default: 32768 minimum: 301
[    0.006242] Security Framework initialized
[    0.006242] Yama: becoming mindful.
[    0.006242] AppArmor: AppArmor initialized
[    0.008237] Dentry cache hash table entries: 524288 (order: 10, 4194304 bytes)
[    0.008909] Inode-cache hash table entries: 262144 (order: 9, 2097152 bytes)
[    0.009365] Mount-cache hash table entries: 8192 (order: 4, 65536 bytes)
[    0.009780] Mountpoint-cache hash table entries: 8192 (order: 4, 65536 bytes)
[    0.010324] CPU: Physical Processor ID: 0
[    0.010594] mce: CPU supports 10 MCE banks
[    0.010876] Last level iTLB entries: 4KB 0, 2MB 0, 4MB 0
[    0.011209] Last level dTLB entries: 4KB 0, 2MB 0, 4MB 0, 1GB 0
[    0.015195] Freeing SMP alternatives memory: 36K
[    0.015846] smpboot: CPU0: Intel Core (Haswell)            NYX vCPU (NO-PT) (family: 0x6, model: 0x3c, stepping: 0x4)
[    0.016000] Performance Events: unsupported p6 CPU model 60 no PMU driver, software events only.
[    0.016000] Hierarchical SRCU implementation.
[    0.016000] NMI watchdog: Perf event create on CPU 0 failed with -2
[    0.016000] NMI watchdog: Perf NMI watchdog permanently disabled
[    0.016000] smp: Bringing up secondary CPUs ...
[    0.016000] smp: Brought up 1 node, 1 CPU
[    0.016000] smpboot: Max logical packages: 1
[    0.016000] smpboot: Total of 1 processors activated (6988.80 BogoMIPS)
[    0.016000] devtmpfs: initialized
[    0.016000] x86/mm: Memory block size: 128MB
[    0.016246] evm: security.selinux
[    0.016461] evm: security.SMACK64
[    0.016675] evm: security.SMACK64EXEC
[    0.016912] evm: security.SMACK64TRANSMUTE
[    0.017171] evm: security.SMACK64MMAP
[    0.017406] evm: security.apparmor
[    0.017622] evm: security.ima
[    0.017813] evm: security.capability
[    0.018064] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.018680] futex hash table entries: 256 (order: 2, 16384 bytes)
[    0.019051] pinctrl core: initialized pinctrl subsystem
[    0.019425] RTC time: 11:23:41, date: 04/02/26
[    0.019728] NET: Registered protocol family 16
[    0.020019] audit: initializing netlink subsys (disabled)
[    0.020395] cpuidle: using governor ladder
[    0.020652] cpuidle: using governor menu
[    0.020913] ACPI: bus type PCI registered
[    0.021167] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5
[    0.021616] PCI: Using configuration type 1 for base access
[    0.021968] audit: type=2000 audit(1775129021.404:1): state=initialized audit_enabled=0 res=1
[    0.022824] HugeTLB registered 2.00 MiB page size, pre-allocated 0 pages
[    0.023298] ACPI: Added _OSI(Module Device)
[    0.023564] ACPI: Added _OSI(Processor Device)
[    0.023839] ACPI: Added _OSI(3.0 _SCP Extensions)
[    0.024002] ACPI: Added _OSI(Processor Aggregator Device)
[    0.024759] ACPI: Interpreter enabled
[    0.024993] ACPI: (supports S0 S3 S4 S5)
[    0.025250] ACPI: Using IOAPIC for interrupt routing
[    0.025565] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
[    0.026147] ACPI: Enabled 2 GPEs in block 00 to 0F
[    0.027134] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff])
[    0.027506] acpi PNP0A03:00: _OSC: OS supports [ASPM ClockPM Segments MSI]
[    0.027919] acpi PNP0A03:00: _OSC failed (AE_NOT_FOUND); disabling ASPM
[    0.028007] acpi PNP0A03:00: fail to add MMCONFIG information, can't access extended PCI configuration space under this bridge.
[    0.028780] acpiphp: Slot [3] registered
[    0.029024] acpiphp: Slot [4] registered
[    0.029261] acpiphp: Slot [5] registered
[    0.029499] acpiphp: Slot [6] registered
[    0.029745] acpiphp: Slot [7] registered
[    0.029991] acpiphp: Slot [8] registered
[    0.030233] acpiphp: Slot [9] registered
[    0.030474] acpiphp: Slot [10] registered
[    0.030726] acpiphp: Slot [11] registered
[    0.030977] acpiphp: Slot [12] registered
[    0.031228] acpiphp: Slot [13] registered
[    0.031478] acpiphp: Slot [14] registered
[    0.031723] acpiphp: Slot [15] registered
[    0.031977] acpiphp: Slot [16] registered
[    0.032008] acpiphp: Slot [17] registered
[    0.032265] acpiphp: Slot [18] registered
[    0.032509] acpiphp: Slot [19] registered
[    0.032765] acpiphp: Slot [20] registered
[    0.033015] acpiphp: Slot [21] registered
[    0.033268] acpiphp: Slot [22] registered
[    0.033520] acpiphp: Slot [23] registered
[    0.033763] acpiphp: Slot [24] registered
[    0.034003] acpiphp: Slot [25] registered
[    0.034243] acpiphp: Slot [26] registered
[    0.034484] acpiphp: Slot [27] registered
[    0.034730] acpiphp: Slot [28] registered
[    0.034975] acpiphp: Slot [29] registered
[    0.035226] acpiphp: Slot [30] registered
[    0.035469] acpiphp: Slot [31] registered
[    0.035726] PCI host bridge to bus 0000:00
[    0.035970] pci_bus 0000:00: root bus resource [io  0x0000-0x0cf7 window]
[    0.036005] pci_bus 0000:00: root bus resource [io  0x0d00-0xffff window]
[    0.036409] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window]
[    0.036850] pci_bus 0000:00: root bus resource [mem 0xc0000000-0xfebfffff window]
[    0.037292] pci_bus 0000:00: root bus resource [mem 0x140000000-0x1bfffffff window]
[    0.037743] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.039704] pci 0000:00:01.1: legacy IDE quirk: reg 0x10: [io  0x01f0-0x01f7]
[    0.040002] pci 0000:00:01.1: legacy IDE quirk: reg 0x14: [io  0x03f6]
[    0.040412] pci 0000:00:01.1: legacy IDE quirk: reg 0x18: [io  0x0170-0x0177]
[    0.040866] pci 0000:00:01.1: legacy IDE quirk: reg 0x1c: [io  0x0376]
[    0.041549] pci 0000:00:01.3: quirk: [io  0x0600-0x063f] claimed by PIIX4 ACPI
[    0.042004] pci 0000:00:01.3: quirk: [io  0x0700-0x070f] claimed by PIIX4 SMB
[    0.045074] ACPI: PCI Interrupt Link [LNKA] (IRQs 5 *10 11)
[    0.045462] ACPI: PCI Interrupt Link [LNKB] (IRQs 5 *10 11)
[    0.045842] ACPI: PCI Interrupt Link [LNKC] (IRQs 5 10 *11)
[    0.046221] ACPI: PCI Interrupt Link [LNKD] (IRQs 5 10 *11)
[    0.046587] ACPI: PCI Interrupt Link [LNKS] (IRQs *9)
[    0.046958] pci 0000:00:02.0: vgaarb: setting as boot VGA device
[    0.047345] pci 0000:00:02.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none
[    0.047881] pci 0000:00:02.0: vgaarb: bridge control possible
[    0.048003] vgaarb: loaded
[    0.048219] SCSI subsystem initialized
[    0.048474] ACPI: bus type USB registered
[    0.048729] usbcore: registered new interface driver usbfs
[    0.049079] usbcore: registered new interface driver hub
[    0.049405] usbcore: registered new device driver usb
[    0.049735] EDAC MC: Ver: 3.0.0
[    0.049993] PCI: Using ACPI for IRQ routing
[    0.050319] NetLabel: Initializing
[    0.050533] NetLabel:  domain hash size = 128
[    0.050811] NetLabel:  protocols = UNLABELED CIPSOv4 CALIPSO
[    0.051171] NetLabel:  unlabeled traffic allowed by default
[    0.051556] hpet0: at MMIO 0xfed00000, IRQs 2, 8, 0
[    0.051868] hpet0: 3 comparators, 64-bit 100.000000 MHz counter
[    0.054032] clocksource: Switched to clocksource kvm-clock
[    0.055215] VFS: Disk quotas dquot_6.6.0
[    0.055474] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes)
[    0.055934] AppArmor: AppArmor Filesystem Enabled
[    0.056241] pnp: PnP ACPI init
[    0.056564] pnp: PnP ACPI: found 6 devices
[    0.061579] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
[    0.062172] NET: Registered protocol family 2
[    0.062667] TCP established hash table entries: 32768 (order: 6, 262144 bytes)
[    0.063138] TCP bind hash table entries: 32768 (order: 7, 524288 bytes)
[    0.063566] TCP: Hash tables configured (established 32768 bind 32768)
[    0.063978] UDP hash table entries: 2048 (order: 4, 65536 bytes)
[    0.064362] UDP-Lite hash table entries: 2048 (order: 4, 65536 bytes)
[    0.064777] NET: Registered protocol family 1
[    0.065054] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
[    0.065434] pci 0000:00:01.0: PIIX3: Enabling Passive Release
[    0.065804] pci 0000:00:01.0: Activating ISA DMA hang workarounds
[    0.066209] pci 0000:00:02.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff]
[    0.066753] Trying to unpack rootfs image as initramfs...
[    0.169228] Freeing initrd memory: 12692K
[    0.169509] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[    0.169896] software IO TLB [mem 0xbb37b000-0xbf37b000] (64MB) mapped at [00000000f8e1c0eb-0000000080d11f20]
[    0.170526] RAPL PMU: API unit is 2^-32 Joules, 4 fixed counters, 10737418240 ms ovfl timer
[    0.171048] RAPL PMU: hw unit of domain pp0-core 2^-0 Joules
[    0.171397] RAPL PMU: hw unit of domain package 2^-0 Joules
[    0.171746] RAPL PMU: hw unit of domain dram 2^-0 Joules
[    0.172082] RAPL PMU: hw unit of domain pp1-gpu 2^-0 Joules
[    0.172456] Scanning for low memory corruption every 60 seconds
[    0.173043] Initialise system trusted keyrings
[    0.173338] workingset: timestamp_bits=40 max_order=20 bucket_order=0
[    0.174000] zbud: loaded
[    0.174255] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.174643] fuse init (API version 7.26)
[    0.175260] Key type asymmetric registered
[    0.175531] Asymmetric key parser 'x509' registered
[    0.175849] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 247)
[    0.176339] io scheduler noop registered
[    0.176573] io scheduler deadline registered (default)
[    0.176912] io scheduler cfq registered
[    0.177155] io scheduler mq-deadline registered (default)
[    0.177500] io scheduler kyber registered
[    0.177803] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0
[    0.178278] ACPI: Power Button [PWRF]
[    0.178574] Serial: 8250/16550 driver, 32 ports, IRQ sharing enabled
[    0.200429] 00:05: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[    0.201191] Linux agpgart interface v0.103
[    0.201857] brd: module loaded
[    0.202519] loop: module loaded
[    0.203023] scsi host0: ata_piix
[    0.203247] scsi host1: ata_piix
[    0.203459] ata1: PATA max MWDMA2 cmd 0x1f0 ctl 0x3f6 bmdma 0xc000 irq 14
[    0.203895] ata2: PATA max MWDMA2 cmd 0x170 ctl 0x376 bmdma 0xc008 irq 15
[    0.204470] libphy: Fixed MDIO Bus: probed
[    0.204725] tun: Universal TUN/TAP device driver, 1.6
[    0.205048] PPP generic driver version 2.4.2
[    0.205333] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    0.205742] ehci-pci: EHCI PCI platform driver
[    0.206023] ehci-platform: EHCI generic platform driver
[    0.206353] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    0.206744] ohci-pci: OHCI PCI platform driver
[    0.207024] ohci-platform: OHCI generic platform driver
[    0.207348] uhci_hcd: USB Universal Host Controller Interface driver
[    0.207767] i8042: PNP: PS/2 Controller [PNP0303:KBD,PNP0f13:MOU] at 0x60,0x64 irq 1,12
[    0.208771] serio: i8042 KBD port at 0x60,0x64 irq 1
[    0.209079] serio: i8042 AUX port at 0x60,0x64 irq 12
[    0.209399] mousedev: PS/2 mouse device common for all mice
[    0.209848] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input1
[    0.210504] rtc_cmos 00:00: RTC can wake from S4
[    0.210876] rtc_cmos 00:00: rtc core: registered rtc_cmos as rtc0
[    0.211314] rtc_cmos 00:00: alarms up to one day, y3k, 114 bytes nvram, hpet irqs
[    0.211788] i2c /dev entries driver
[    0.212035] device-mapper: uevent: version 1.0.3
[    0.212340] device-mapper: ioctl: 4.37.0-ioctl (2017-09-20) initialised: dm-devel@redhat.com
[    0.212872] ledtrig-cpu: registered to indicate activity on CPUs
[    0.213321] NET: Registered protocol family 10
[    0.213660] Segment Routing with IPv6
[    0.213896] NET: Registered protocol family 17
[    0.214182] Key type dns_resolver registered
[    0.214484] sched_clock: Marking stable (212012688, 0)->(340514989, -128502301)
[    0.214978] registered taskstats version 1
[    0.215238] Loading compiled-in X.509 certificates
[    0.216139] Loaded X.509 cert 'Build time autogenerated kernel key: bf9804cce196c7da79477ddda6b39e0437c314fa'
[    0.216745] zswap: loaded using pool lzo/zbud
[    0.217240] Key type big_key registered
[    0.217589] Key type trusted registered
[    0.217927] Key type encrypted registered
[    0.218170] AppArmor: AppArmor sha1 policy hashing enabled
[    0.218504] ima: No TPM chip found, activating TPM-bypass! (rc=-19)
[    0.218887] evm: HMAC attrs: 0x1
[    0.219125]   Magic number: 6:126:377
[    0.219366] acpi PNP0700:00: hash matches
[    0.219641] rtc_cmos 00:00: setting system clock to 2026-04-02 11:23:41 UTC (1775129021)
[    0.220148] BIOS EDD facility v0.16 2004-Jun-25, 0 devices found
[    0.220513] EDD information not available.
[    0.368362] ata2.00: ATAPI: QEMU DVD-ROM, 2.5+, max UDMA/100
[    0.368997] ata2.00: configured for MWDMA2
[    0.369498] scsi 1:0:0:0: CD-ROM            QEMU     QEMU DVD-ROM     2.5+ PQ: 0 ANSI: 5
[    0.380331] sr 1:0:0:0: [sr0] scsi3-mmc drive: 4x/4x cd/rw xa/form2 tray
[    0.381014] cdrom: Uniform CD-ROM driver Revision: 3.20
[    0.381801] sr 1:0:0:0: Attached scsi generic sg0 type 5
[    0.388045] Freeing unused kernel memory: 1664K
[    0.388840] Write protecting the kernel read-only data: 18432k
[    0.390156] Freeing unused kernel memory: 2008K
[    0.391157] Freeing unused kernel memory: 240K
Password for 'ubuntu' changed
Kernel Panic Handler Address:	18446744071579359342
16472 bytes received from hypervisor! (hget_no_pt)
738 bytes received from hypervisor! (fuzz_no_pt.sh)
./fuzz.sh: line 6: ./hget: not found
./fuzz.sh: line 7: ./hget: not found
chmod: ./hcat: No such file or directory
chmod: ./habort: No such file or directory
./fuzz.sh: line 10: ./hget: not found
./fuzz.sh: line 15: ./hcat: not found
tar: can't open 'container.tar': No such file or directory
mount: mounting /proc on rootfs/proc/ failed: No such file or directory
mount: mounting /sys on rootfs/sys/ failed: No such file or directory
mount: mounting /dev on rootfs/dev/ failed: No such file or directory
./fuzz.sh: line 20: can't create rootfs/etc/hosts: nonexistent directory
./fuzz.sh: line 21: can't create rootfs/etc/hosts: nonexistent directory
./fuzz.sh: line 22: can't create rootfs/etc/resolv.conf: nonexistent directory
chroot: can't execute '/init.sh': No such file or directory
./fuzz.sh: line 24: ./hcat: not found
cat: can't open 'rootfs/init.log': No such file or directory
tail: can't open 'rootfs/init.log': No such file or directory
tail: no files
./fuzz.sh: line 25: ./habort: not found
qemu-system-x86_64: terminating on signal 15 from pid 3287936 ()

running this qemu-system-x86_64 command:

command

AFLPP_STORE_PATH=/nix/store/3l70pbi4q14l88vlr2dgicnmbpblm67b-aflplusplus-4.35c
$AFLPP_STORE_PATH/nyx_mode/QEMU-Nyx/x86_64-softmmu/qemu-system-x86_64 \
    -kernel $AFLPP_STORE_PATH/nyx_mode/packer/linux_initramfs/bzImage-linux-4.15-rc7 \
    -initrd $AFLPP_STORE_PATH/nyx_mode/packer/linux_initramfs/init.cpio.gz \
    -append "nokaslr oops=panic nopti ignore_rlimit_data console=ttyS0" \
    -enable-kvm \
    -net none \
    -k de \
    -m 4096 \
    -machine kAFL64-v1 -cpu kAFL64-Hypervisor-v1 \
    -fast_vm_reload path=/tmp/smite-out/workdir/snapshot/,load=off,skip_serialization=on \
    -nographic \
    -chardev socket,server,nowait,path=/tmp/smite-out/workdir/interface_0,id=nyx_interface \
    -device nyx,chardev=nyx_interface,bitmap_size=65536,input_buffer_size=1048576,worker_id=0,workdir=/tmp/smite-out/workdir,sharedir=/tmp/smite-nyx/,aux_buffer_size=4096

I'll keep documenting for my own sake and for anyone else looking into running this on NixOS.

[ekzyis]

Oof, I finally got it:

afl-fuzz -X -i /tmp/smite-seeds -o /tmp/smite-out -- /tmp/smite-nyx/

$ /nix/store/xi5rl3qdzpdngyz669x60w405p533ncv-aflplusplus-4.35c/bin/afl-fuzz -X -i /tmp/smite-seeds -o /tmp/smite-out -- /tmp/smite-nyx/                                                            19:37 [76/126]
afl-fuzz++4.35c based on afl by Michal Zalewski and a large online community
[+] AFL++ is maintained by Marc "van Hauser" Heuse, Dominik Maier, Andrea Fioraldi and Heiko "hexcoder" Eißfeldt
[+] AFL++ is open source, get it at https://github.com/AFLplusplus/AFLplusplus
[+] NOTE: AFL++ >= v3 has changed defaults and behaviours - see README.md
[+] AFL++ Nyx mode is enabled (developed and maintained by Sergej Schumilo)
[+] Nyx is open source, get it at https://github.com/Nyx-Fuzz
[+] No -M/-S set, autoconfiguring for "-S default"
[*] Getting to work...
[+] Using exploration-based constant power schedule (EXPLORE)
[+] Enabled testcache with 50 MB
[+] Generating fuzz data with a length of min=1 max=1048576
[*] Trying to load libnyx.so plugin...
[+] libnyx plugin is ready!
[+] You have 20 CPU cores and 3 runnable tasks (utilization: 15%).
[+] Try parallel jobs - see /nix/store/xi5rl3qdzpdngyz669x60w405p533ncv-aflplusplus-4.35c/share/doc/afl/fuzzing_in_depth.md#c-using-multiple-cores
[*] Setting up output directories...
[+] Output directory exists but deemed OK to reuse.
[*] Deleting old session data...
[+] Output dir cleanup successful.
[*] Checking CPU core loadout...
[+] Found a free CPU core, try binding to #0.
[*] Validating target binary...
[*] Scanning '/tmp/smite-seeds'...
[*] Creating hard links for all input files...
[+] Loaded a total of 1 seeds.
[*] Spinning up the NYX backend...
[!] libnyx: spawning qemu with:
 /nix/store/xi5rl3qdzpdngyz669x60w405p533ncv-aflplusplus-4.35c/nyx_mode/QEMU-Nyx/x86_64-softmmu/qemu-system-x86_64 -kernel /nix/store/xi5rl3qdzpdngyz669x60w405p533ncv-aflplusplus-4.35c/nyx_mode/packer/linux_initramfs/bzImage-linux-4.15-rc7
 -initrd /nix/store/xi5rl3qdzpdngyz669x60w405p533ncv-aflplusplus-4.35c/nyx_mode/packer/linux_initramfs/init.cpio.gz -append nokaslr oops=panic nopti ignore_rlimit_data -display none -serial none -enable-kvm -net none -k de -m 4096 -chardev
 socket,server,path=/tmp/smite-out/workdir/interface_0,id=nyx_interface -device nyx,chardev=nyx_interface,bitmap_size=65536,input_buffer_size=1048576,worker_id=0,workdir=/tmp/smite-out/workdir,sharedir=/tmp/smite-nyx/,aux_buffer_size=4096
-machine kAFL64-v1 -cpu kAFL64-Hypervisor-v1 -fast_vm_reload path=/tmp/smite-out/workdir/snapshot/,load=off,skip_serialization=on
[QEMU-Nyx] Could not access KVM-PT kernel module!
[QEMU-Nyx] Trying vanilla KVM...
[QEMU-Nyx] NYX runs in fallback mode (no Intel-PT tracing or nested hypercall support)!
[QEMU-NYX] Max Dirty Ring Size -> 1048576 (Entries: 65536)
[QEMU-Nyx] Warning: Attempt to use unsupported CPU model (PT) without KVM-PT (Hint: use '-cpu kAFL64-Hypervisor-v2' instead)
qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.07H:EBX.hle [bit 4]
qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.07H:EBX.rtm [bit 11]
[QEMU-NYX] Dirty ring mmap region located at 0x7f74e768d000
[QEMU-NYX] Booting VM to start fuzzing...
[!] libnyx: input buffer is write protected
[hget] 16528 bytes received from hypervisor! (hcat_no_pt)
[hget] 16528 bytes received from hypervisor! (habort_no_pt)
[hget] 314689536 bytes received from hypervisor! (container.tar)
[hcat] 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
[capablities] host_config.bitmap_size: 0x10000
[capablities] host_config.ijon_bitmap_size: 0x1000
[capablities] host_config.payload_buffer_size: 0x100000x
[init] using TARGET_MAP_SIZE: 410818
[init] scenario not compiled with afl instrumentation

[init] payload buffer is mapped at 0x7ffff7b43000 (size: 0x100000)
[init] taking snapshot
[!] libnyx: coverage mode: compile-time instrumentation
[!] libnyx: qemu #0 is ready:
[*] Target map size: 410818
[*] No auto-generated dictionary tokens to reuse.
[*] Attempting dry run with 'id:000000,time:0,execs:0,orig:seed1'...
[!] WARNING: instability detected during calibration: /tmp/smite-out/default/queue/id:000000,time:0,execs:0,orig:seed1
    len = 5, map size = 23056, exec speed = 1287 us, hash = 4be2d640c3c11d29
[+] All test cases processed.
[+] Here are some useful stats:

    Test case count : 1 favored, 1 variable, 0 ignored, 1 total
       Bitmap range : 23056 to 23056 bits (average: 23056.00 bits)
        Exec timing : 1287 to 1287 us (average: 1287 us)

[*] No -t option specified, so I'll use an exec timeout of 20 ms.
[+] All set and ready to roll!

Had to run patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 on the packer binaries and make sure it loads 64-bit libraries:

--- a/nyx_mode/packer/linux_initramfs/rootTemplate/init_template
+++ b/nyx_mode/packer/linux_initramfs/rootTemplate/init_template
@@ -19,7 +19,7 @@ adduser --gecos "ubuntu" --disabled-password --ingroup ubuntu ubuntu
 echo "ubuntu:ubuntu" | chpasswd

 # multiarch support
-export LD_LIBRARY_PATH=/lib32
+export LD_LIBRARY_PATH=/lib64:/lib32

 START
 #./loader

Closing. ekzyis/nixpkgs@bcfbe13 is the commit where it started working. I might push a cleaned-up commit later. For now, I'm just happy it works.

[morehouse]

Thanks for documenting your debugging steps! This should be helpful for others on NixOS.

[ekzyis]

I cleaned up my nix derivation and created a nixpkgs PR, see NixOS/nixpkgs#514406.

To use my derivation to build AFL++ with nyx mode:

$ git clone --depth=1 --branch=aflplusplus-nyx-mode git@github.com:ekzyis/nixpkgs
$ cd nixpkgs/pkgs/tools/security/aflplusplus
$ nix-build -E "with import <nixpkgs> {}; callPackage ./default.nix { withNyx = true; wine = null; }"

This will print a /nix/store path. Before you can use it with setup-nyx.sh, you need to apply this patch:

diff --git a/scripts/setup-nyx.sh b/scripts/setup-nyx.sh
index 7f8c5ef..a14a422 100755
--- a/scripts/setup-nyx.sh
+++ b/scripts/setup-nyx.sh
@@ -62,7 +62,7 @@ cp "$BINARIES_PATH"/* "$SHAREDIR/"

 # Generate Nyx config
 echo "Generating Nyx config..."
-(cd "$PACKER_PATH" && python3 nyx_config_gen.py "$SHAREDIR" Kernel -m 4096)
+(cd "$PACKER_PATH" && ./nyx_config_gen.py "$SHAREDIR" Kernel -m 4096)

 # Create fuzz_no_pt.sh script
 echo "Creating fuzz_no_pt.sh..."
@@ -103,4 +103,4 @@ ls -lh "$SHAREDIR"
 echo ""
 echo "To start fuzzing, run:"
 echo "  mkdir -p /tmp/smite-seeds && echo 'AAAA' > /tmp/smite-seeds/seed1"
-echo "  $AFLPP_PATH/afl-fuzz -X -i /tmp/smite-seeds -o /tmp/smite-out -- $SHAREDIR"
+echo "  $AFLPP_PATH/bin/afl-fuzz -X -i /tmp/smite-seeds -o /tmp/smite-out -- $SHAREDIR"

Then you can run it like this:

$ bash scripts/setup-nyx.sh /tmp/smite-nyx smite-lnd-encrypted_bytes /nix/store/8h7rf1s4w74jw7bhzls42xrw2jksdr23-aflplusplus-4.35c