这篇主要是记录根据Google官方文档 通过 libFuzzer 进行模糊测试 来尝试在AOSP上使用libfuzzer的记录
0 环境准备
- 设备：Pixel 4
- aosp源码：android-13.0.0_r7（这个源码是之前就下载好了的，所以我这里就不去下载main/master分支的了）
- 下面命令中的驱动程序二进制文件可以根据自己的手机环境下载相应的文件。
mkdir ~/bin
export PATH=~/bin:$PATH
curl https://storage.googleapis.com/git-repo-downloads/repo > ~/bin/repo
chmod a+x ~/bin/repo
repo init -u https://android.googlesource.com/platform/manifest -b android-13.0.0_r7
repo sync -c -j8
wget https://dl.google.com/dl/android/aosp/google_devices-flame-tp1a.221005.002.b2-22399ead.tgz
tar xvf google_devices-flame-tp1a.221005.002.b2-22399ead.tgz
./extract-google_devices-flame.sh
wget https://dl.google.com/dl/android/aosp/qcom-flame-tp1a.221005.002.b2-358af558.tgz
tar xvf qcom-flame-tp1a.221005.002.b2-358af558.tgz
./extract-qcom-flame.sh
. build/envsetup.sh
lunch
注意：lunch命令中选择相应的选项，我这里是flame。选择相应选项后，会设置一些环境变量。
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ lunch
You're building on Linux
Lunch menu .. Here are the common combinations:
1. aosp_arm-eng
2. aosp_arm64-eng
......
22. aosp_flame-userdebug
23. aosp_flame_car-userdebug
......
Which would you like? [aosp_arm-eng]
Pick from common choices above (e.g. 13) or specify your own (e.g. aosp_barbet-eng): 22
Hint: next time you can simply run 'lunch aosp_flame-userdebug'
============================================
PLATFORM_VERSION_CODENAME=REL
PLATFORM_VERSION=13
TARGET_PRODUCT=aosp_flame
TARGET_BUILD_VARIANT=userdebug
TARGET_BUILD_TYPE=release
TARGET_ARCH=arm64
TARGET_ARCH_VARIANT=armv8-a
TARGET_CPU_VARIANT=generic
TARGET_2ND_ARCH=arm
TARGET_2ND_ARCH_VARIANT=armv8-a
TARGET_2ND_CPU_VARIANT=generic
HOST_ARCH=x86_64
HOST_2ND_ARCH=x86
HOST_OS=linux
HOST_OS_EXTRA=Linux-5.19.0-46-generic-x86_64-Ubuntu-22.04.2-LTS
HOST_CROSS_OS=windows
HOST_CROSS_ARCH=x86
HOST_CROSS_2ND_ARCH=x86_64
HOST_BUILD_TYPE=release
BUILD_ID=TP1A.221005.002
OUT_DIR=out
PRODUCT_SOONG_NAMESPACES=hardware/google/av hardware/google/camera hardware/google/interfaces hardware/google/pixel device/google/coral hardware/qcom/sm8150/display hardware/qcom/sm8150/data/ipacfg-mgr hardware/qcom/sm8150/gps vendor/google/airbrush/floral vendor/google/biometrics/face/florence vendor/google/camera vendor/google/darwinn vendor/google_devices/common/proprietary/confirmatioui_hal vendor/google_nos/host/android vendor/qcom/sm8150 vendor/qcom/sm8150/proprietary/commonsys/telephony-apps/DataStatusNotification vendor/qcom/sm8150/proprietary/gps vendor/qcom/sm8150/proprietary/qmi vendor/qcom/sm8150/codeaurora/location vendor/google/interfaces vendor/google_nos/test/system-test-harness vendor/qcom/sensors vendor/google/tools/sensors vendor/qcom/sm7250/codeaurora/commonsys/telephony/ims/ims-ext-common vendor/qcom/sm7250/codeaurora/dataservices/rmnetctl vendor/qcom/sm7250/proprietary/commonsys/qcrilOemHook vendor/qcom/sm7250/proprietary/commonsys/telephony-apps/ims vendor/qcom/sm7250/proprietary/commonsys/telephony-apps/QtiTelephonyService vendor/qcom/sm7250/proprietary/commonsys/telephony-apps/xdivert vendor/qcom/sm7250/proprietary/qcril-data-hal vendor/qcom/sm7250/proprietary/qcril-hal vendor/qcom/sm7250/proprietary/data vendor/qcom/proprietary/bluetooth/hidl_client vendor/qcom/flame/proprietary
============================================
1 编译并刷入镜像
# 编译/构建
m
# 进入fastboot模式
adb reboot bootloader
# fastboot命令查看设备，确认fastboot命令是否能正常使用
fastboot device
# 解锁引导加载程序（如果之前就解锁过，不执行该条命令也可以）
fastboot oem unlock
# 刷入新编译的映像
fastboot flashall
探索1：fastboot device报错无权限
如果fastboot device报错如下：
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ fastboot devices
no permissions (missing udev rules? user is in the plugdev group); see [http://developer.android.com/tools/device.html] fastboot
解决办法如下：
# 查看usb设备信息，可以看到idVendor是18d1，idProduct是4ee0
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ lsusb
Bus 004 Device 004: ID 18d1:4ee0 Google Inc. Nexus/Pixel Device (fastboot)
Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 003 Device 003: ID 0489:e0cd Foxconn / Hon Hai Wireless_Device
Bus 003 Device 002: ID 04f3:0c4b Elan Microelectronics Corp. ELAN:Fingerprint
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 003: ID 5986:212b Acer, Inc Integrated Camera
Bus 001 Device 002: ID 046d:c542 Logitech, Inc. Wireless Receiver
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
# 查看之前为解决adb device报错无权限而添加的规则文件
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ sudo cat /etc/udev/rules.d/90-android.rules
SUBSYSTEM=="usb",ATTRS{idVendor}=="18d1",ATTRS{idProduct}=="4ee7",MODE="0666",GROUP="plugdev",SYMLINK+="android",SYMLINK+="android_adb"
# 复制一份，命名为91-android.rules
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ sudo cp /etc/udev/rules.d/90-android.rules /etc/udev/rules.d/91-android.rules
# 编辑新规则文件，idVendor仍然是18d1，修改idProduct为4ee0
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ sudo vim /etc/udev/rules.d/91-android.rules
# 刷新规则，重启udev服务
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ sudo udevadm control --reload-rules
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ sudo service udev restart
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ sudo udevadm trigger
# 再次尝试fastboot device，成功
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ fastboot devices
9B081FFAZ0052M fastboot
如果是adb遇到了这个错误，还要重启adb。
探索2： fastboot flashall 是怎么刷镜像的？
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ fastboot --help
usage: fastboot [OPTION...] COMMAND...
flashing:
......
flashall Flash all partitions from $ANDROID_PRODUCT_OUT.
On A/B devices, flashed slot is set as active.
Secondary images may be flashed to inactive slot.
可以看到flashall选项是将环境变量$ANDROID_PRODUCT_OUT中的内容刷到设备中，而该环境变量是在执行. build/envsetup.sh和lunch命令的时候，根据选择的选项而设置的。
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ echo $ANDROID_PRODUCT_OUT
/home/ztree/aosp/android-13.0.0_r7/out/target/product/flame
2 编译一个Google自有的libfuzzer脚本（手机）
先尝试在手机上跑libfuzzer，因为有些模块会不支持在host上编译和运行
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ SANITIZE_TARGET=hwaddress m metadataretriever_fuzzer
......
[100% 595/595] Install out/target/product/flame/system/lib64/libstagefright.so
#### build completed successfully (03:08 (mm:ss)) ####
这个fuzzer是在 frameworks/av/media/libmediaplayerservice/fuzzer/Android.bp 中定义的，也可以从这里查看。
3 运行（手机）
# 手机进入root模式
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ adb root
# 同步更新data目录下的文件到手机（主要是把data/fuzz目录同步到手机上去，该目录包含fuzzer和一些库文件）
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ adb sync data
/data/: 140 files pushed, 0 skipped. 278.6 MB/s (353442745 bytes in 1.210s)
# 进入手机shell，执行libfuzzer
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ adb shell
flame:/ # cd /data/fuzz/
flame:/data/fuzz # ls
arm64
flame:/data/fuzz # cd arm64/
flame:/data/fuzz/arm64 # ls
lib metadataretriever_fuzzer
flame:/data/fuzz/arm64 # cd metadataretriever_fuzzer/
flame:/data/fuzz/arm64/metadataretriever_fuzzer # ls
config.json metadataretriever_fuzzer
1|flame:/data/fuzz/arm64/metadataretriever_fuzzer # mkdir corpus
flame:/data/fuzz/arm64/metadataretriever_fuzzer # ./metadataretriever_fuzzer ./corpus/
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 3179219735
......
INFO: 0 files found in ./corpus/
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
INFO: A corpus is not provided, starting from an empty corpus
#2 INITED cov: 809 ft: 792 corp: 1/1b exec/s: 0 rss: 67Mb
NEW_FUNC[1/19]: 0x7c1515b130 (/data/fuzz/arm64/lib/libdatasource.so+0xc130) (BuildId: e0f84a9199bae756b2cabb11bc30efe4)
......
探索3：adb sync
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ adb --help
Android Debug Bridge version 1.0.41
Version 34.0.1-9680074
Installed as /home/ztree/Android/Sdk/platform-tools/adb
......
file transfer:
......
sync [-l] [-z ALGORITHM] [-Z] [all|data|odm|oem|product|system|system_ext|vendor]
sync a local build from $ANDROID_PRODUCT_OUT to the device (default all)
-n: dry run: push files to device without storing to the filesystem
-l: list files that would be copied, but don't copy them
-z: enable compression with a specified algorithm (any/none/brotli/lz4/zstd)
-Z: disable compression
# 该环境变量前面也看过了，是在执行. build/envsetup.sh和lunch命令时设置好的
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ echo $ANDROID_PRODUCT_OUT
/home/ztree/aosp/android-13.0.0_r7/out/target/product/flame
4 尝试编译host版本的libfuzzer
# 在Android.bp中加上支持host的编译选项
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ vim frameworks/av/media/libmediaplayerservice/fuzzer/Android.bp
cc_fuzz {
name: "metadataretriever_fuzzer",
host_supported: true, // 加上这一行
srcs: [
"metadataretriever_fuzzer.cpp",
],
defaults: [
"libmediaplayerserviceFuzzer_defaults",
],
static_libs: [
"libplayerservice_datasource",
],
shared_libs: [
"libdatasource",
"libdrmframework",
],
}
# 编译
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ SANITIZE_HOST=address m metadataretriever_fuzzer
报错如下，也就是依赖的库文件没有x86-64的版本：
error: frameworks/av/media/libmediaplayerservice/fuzzer/Android.bp:77:1: dependency "libmediaplayerservice" of "metadataretriever_fuzzer" missing variant:
os:linux_glibc,arch:x86_64,link:static
available variants:
os:android,image:,arch:arm64_armv8-a (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm64_armv8-a,sdk: (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm64_armv8-a,sdk:,link:static
os:android,image:,arch:arm64_armv8-a,sdk:,link:shared (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:
os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:latest (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a,sdk: (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a,sdk:,link:static
os:android,image:,arch:arm_armv8-a,sdk:,link:shared (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:
os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:latest (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
error: frameworks/av/media/libmediaplayerservice/fuzzer/Android.bp:77:1: dependency "libplayerservice_datasource" of "metadataretriever_fuzzer" missing variant:
os:linux_glibc,arch:x86_64,link:static
available variants:
os:android,image:,arch:arm64_armv8-a (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:static)
os:android,image:,arch:arm64_armv8-a,sdk: (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:static)
os:android,image:,arch:arm64_armv8-a,sdk:,link:static
os:android,image:,arch:arm_armv8-a (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:static)
os:android,image:,arch:arm_armv8-a,sdk: (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:static)
os:android,image:,arch:arm_armv8-a,sdk:,link:static
error: frameworks/av/media/libmediaplayerservice/fuzzer/Android.bp:77:1: dependency "libmedia" of "metadataretriever_fuzzer" missing variant:
os:linux_glibc,arch:x86_64,link:shared
available variants:
os:android,image:,arch:arm64_armv8-a (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm64_armv8-a,sdk: (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm64_armv8-a,sdk:,link:static
os:android,image:,arch:arm64_armv8-a,sdk:,link:shared (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:
os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:latest (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a,sdk: (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a,sdk:,link:static
os:android,image:,arch:arm_armv8-a,sdk:,link:shared (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:
os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:latest (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
error: frameworks/av/media/libmediaplayerservice/fuzzer/Android.bp:77:1: dependency "libstagefright" of "metadataretriever_fuzzer" missing variant:
os:linux_glibc,arch:x86_64,link:shared
available variants:
os:android,image:,arch:arm64_armv8-a (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm64_armv8-a,sdk: (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm64_armv8-a,sdk:,link:static
os:android,image:,arch:arm64_armv8-a,sdk:,link:shared (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:
os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:latest (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a,sdk: (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a,sdk:,link:static
os:android,image:,arch:arm_armv8-a,sdk:,link:shared (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:
os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:latest (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
error: frameworks/av/media/libmediaplayerservice/fuzzer/Android.bp:77:1: dependency "libdatasource" of "metadataretriever_fuzzer" missing variant:
os:linux_glibc,arch:x86_64,link:shared
available variants:
os:android,image:,arch:arm64_armv8-a (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm64_armv8-a,sdk: (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm64_armv8-a,sdk:,link:static
os:android,image:,arch:arm64_armv8-a,sdk:,link:shared (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:
os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:latest (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a,sdk: (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a,sdk:,link:static
os:android,image:,arch:arm_armv8-a,sdk:,link:shared (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:
os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:latest (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
error: frameworks/av/media/libmediaplayerservice/fuzzer/Android.bp:77:1: dependency "libdrmframework" of "metadataretriever_fuzzer" missing variant:
os:linux_glibc,arch:x86_64,link:shared
available variants:
os:android,image:,arch:arm64_armv8-a (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm64_armv8-a,sdk: (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm64_armv8-a,sdk:,link:shared (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:
os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:latest (alias to os:android,image:,arch:arm64_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a,sdk: (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a,sdk:,link:shared (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:
os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:latest (alias to os:android,image:,arch:arm_armv8-a,sdk:,link:shared,version:)
20:11:52 soong bootstrap failed with: exit status 1
#### failed to build some targets (14 seconds) ####
那重新执行一下lunch命令，选择x86-64版本会咋样？
# 目标设备选择x64版本的
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ lunch aosp_x86_64-eng
============================================
PLATFORM_VERSION_CODENAME=REL
PLATFORM_VERSION=13
TARGET_PRODUCT=aosp_x86_64
TARGET_BUILD_VARIANT=eng
TARGET_BUILD_TYPE=release
TARGET_ARCH=x86_64
TARGET_ARCH_VARIANT=x86_64
TARGET_2ND_ARCH=x86
TARGET_2ND_ARCH_VARIANT=x86_64
HOST_ARCH=x86_64
HOST_2ND_ARCH=x86
HOST_OS=linux
HOST_OS_EXTRA=Linux-5.19.0-46-generic-x86_64-Ubuntu-22.04.2-LTS
HOST_CROSS_OS=windows
HOST_CROSS_ARCH=x86
HOST_CROSS_2ND_ARCH=x86_64
HOST_BUILD_TYPE=release
BUILD_ID=TP1A.221005.002
OUT_DIR=out
PRODUCT_SOONG_NAMESPACES=device/generic/goldfish device/generic/goldfish-opengl hardware/google/camera hardware/google/camera/devices/EmulatedCamera
# 重新编译
ztree@ubuntu2:~/aosp/android-13.0.0_r7$ SANITIZE_HOST=address m metadataretriever_fuzzer
......
error: frameworks/av/media/libmediaplayerservice/fuzzer/Android.bp:77:1: dependency "libdrmframework" of "metadataretriever_fuzzer" missing variant:
os:linux_glibc,arch:x86_64,link:shared
available variants:
os:android,image:,arch:x86_64 (alias to os:android,image:,arch:x86_64,sdk:,link:shared,version:)
os:android,image:,arch:x86_64,sdk: (alias to os:android,image:,arch:x86_64,sdk:,link:shared,version:)
os:android,image:,arch:x86_64,sdk:,link:shared (alias to os:android,image:,arch:x86_64,sdk:,link:shared,version:)
os:android,image:,arch:x86_64,sdk:,link:shared,version:
os:android,image:,arch:x86_64,sdk:,link:shared,version:latest (alias to os:android,image:,arch:x86_64,sdk:,link:shared,version:)
os:android,image:,arch:x86_x86_64 (alias to os:android,image:,arch:x86_x86_64,sdk:,link:shared,version:)
os:android,image:,arch:x86_x86_64,sdk: (alias to os:android,image:,arch:x86_x86_64,sdk:,link:shared,version:)
os:android,image:,arch:x86_x86_64,sdk:,link:shared (alias to os:android,image:,arch:x86_x86_64,sdk:,link:shared,version:)
os:android,image:,arch:x86_x86_64,sdk:,link:shared,version:
os:android,image:,arch:x86_x86_64,sdk:,link:shared,version:latest (alias to os:android,image:,arch:x86_x86_64,sdk:,link:shared,version:)
20:18:15 soong bootstrap failed with: exit status 1
#### failed to build some targets (13 seconds) ####
还是不行，可以看到目标依赖是os:linux_glibc，而可用的依赖版本是os:android。暂时不知道哪些模块是可以host上运行libfuzzer，以后遇上再补充吧。