Could you provide detailed build info of openSSH

[Br1m4zz]

I'm trying to fuzz openSSH's other version, I found that the openSSH you provide in this repo is compress built binary. I tried to build in source but failed.( The packed target could not work in qemu-nyx) . Could you provide detailed build info of openSSH?
Here's my setup script:

WORKDIR="$PWD/../../1.build-nosv/openssh"
SRCDIR="/home/ubuntu/target-pfb/0.Target-src"
ROOT=$PWD

CC=/home/ubuntu/packer/packer/sv-instrument/afl-clang-fast
CPP=/home/ubuntu/packer/packer/sv-instrument/afl-clang-fast++
PATH="/home/ubuntu/packer/packer/sv-instrument":$PATH
AFL_CC="clang-16"
AFL_CXX="clang++-16"

error () {
  echo "$0: <asan/no_asan>"
  exit 0
}

if test "$#" -ne 1; then
  error
fi

if [ "$1" != "asan" ] && [ "$1" != "no_asan" ] ; then
  error
fi

if test -f "$CC" && test -f "$CPP"; then

  if [ "$1" = "asan" ]; then
    ASAN="-fsanitize=address"
  else 
    ASAN=""
  fi

  rm -rf $WORKDIR

  mkdir $WORKDIR
#   cp cert/*.pem $WORKDIR
  cd $WORKDIR && \
  # git clone https://github.com/openssl/openssl.git && \
  cp -r $SRCDIR/openssl . && \
  cp -r $SRCDIR/openssh . && \

  cd openssl && \
  git checkout 12ad22d && \
  ./Configure linux-x86_64-clang shared --prefix=$WORKDIR/openssl-install && \
  make -j8 && \
  make install && \
  export LD_LIBRARY_PATH="${WORKDIR}/openssl-install/lib" && \
 
  cd ${WORKDIR} && \
  cd openssh && \
  git checkout 7cfea58 && \
  cp ${ROOT}/rand.inc . && \
  patch -p1 < ${ROOT}/rand.patch && \
  sed -i 's/-std=gnu99//g' configure.ac && \
  autoreconf && \
  ./configure \
    CC="$CC" \
    CFLAGS="-std=c90 -g -O3 -I$WORKDIR/openssl-install/include" \
    --prefix=$WORKDIR/install \
    --with-openssl=$WORKDIR/openssl-install \
    --with-ldflags="-L$WORKDIR/openssl-install/lib" \
    --with-privsep-path=$PWD/var-empty \
    --with-sandbox=no \
    --with-privsep-user=ubuntu && \
  make $MAKE_OPT && \
  make install
  unset LD_LIBRARY_PATH
  # after make
  echo "cp sshd_config and installed files..."
  cp sshd_config $ROOT/../../extra_folders/openssh/ && \
  cp -R ../install/ $ROOT/../../extra_folders/openssh/install && \
  cd $ROOT/../../extra_folders/openssh/ && \
  tar -zcvf install.tar.gz install/
  echo "Success"

else
  echo "Error: AFL clang compiler not found:\n\t$CC\n\t$CPP"
fi

Here's the running result from qemu-nyx:

[!] fuzzer: spawning qemu instance #0
[!] libnyx: spawning qemu with:
 /home/lwfdev/workspace/qemu-nyx/x86_64-softmmu/qemu-system-x86_64 -kernel /mnt/data/workspace/packed_target_pfb/packed_targets_sv/bzImage-linux-4.15-rc7 -initrd /mnt/data/workspace/packed_target_pfb/packed_targets_sv/init.cpio.gz -append nokaslr oops=panic nopti ignore_rlimit_data -display none -serial none -enable-kvm -net none -k de -m 1024 -chardev socket,server,path=/tmp/workdir_nyx_proftpd_snap-ctx_1/interface_0,id=kafl_interface -device kafl,chardev=kafl_interface,bitmap_size=69632,worker_id=0,workdir=/tmp/workdir_nyx_proftpd_snap-ctx_1,sharedir=/mnt/data/workspace/packed_target_pfb/packed_targets_sv/nyx_openssh_sv/ -machine kAFL64-v1 -cpu kAFL64-Hypervisor-v1,+vmx
[!] Could not access KVM-PT kernel module!
 [*] Trying vanilla KVM...
NYX runs in fallback mode (no Intel-PT tracing or nested hypercall support)!
[*] Max Dirty Ring Size -> 1048576 (Entries: 65536)
Warning: Attempt to use unsupported CPU model (PT) without KVM-PT (Hint: use '-cpu kAFL64-Hypervisor-v2' instead)
qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.07H:EBX.hle [bit 4]
qemu-system-x86_64: warning: host doesn't support requested feature: CPUID.07H:EBX.rtm [bit 11]
[*] Dirty ring mmap region located at 0x780047c8f000
[hget] 12904 bytes received from hypervisor! (hcat_no_pt)
[hget] 12864 bytes received from hypervisor! (habort_no_pt)
[hget] 126552 bytes received from hypervisor! (ld_preload_fuzz_no_pt.so)
[hcat] Let's get our dependencies...
[hget] 179152 bytes received from hypervisor! (ld-linux-x86-64.so.2)
[hget] 7680 bytes received from hypervisor! (libnyx.so)
[hget] 2361984 bytes received from hypervisor! (libcrypto.so.1.0.0)
[hget] 14560 bytes received from hypervisor! (libdl.so.2)
[hget] 10592 bytes received from hypervisor! (libutil.so.1)
[hget] 116960 bytes received from hypervisor! (libz.so.1)
[hget] 39208 bytes received from hypervisor! (libcrypt.so.1)
[hget] 97072 bytes received from hypervisor! (libresolv.so.2)
[hget] 2030928 bytes received from hypervisor! (libc.so.6)
[hcat] Let's get our target executable...
[hget] 2840120 bytes received from hypervisor! (sshd)
[hcat] Let's get our setup script...
[hget] 546 bytes received from hypervisor! (setup/setup.sh)
[hcat] Executing openssh Setup Script
[hget] 3171 bytes received from hypervisor! (setup/sshd_config)
[hget] 5631841 bytes received from hypervisor! (setup/install.tar.gz)
[hcat] openssh Setup Script finished
[!] all signal handlers are hooked!
[capablities] agent_tracing: 1
[capablities] host_config.bitmap_size: 0x10000
[capablities] host_config.ijon_bitmap_size: 0x1000
[capablities] host_config.payload_buffer_size: 0x20000x
handle_hypercall_kafl_user_abort: USER_ABORT called!
[qemu-nyx] crash detected (pid: 2903302 / signal: 6)
backtrace() returned 13 addresses
/home/lwfdev/workspace/qemu-nyx/x86_64-softmmu/qemu-system-x86_64(qemu_backtrace+0x34) [0x64379d21d4b4]
/home/lwfdev/workspace/qemu-nyx/x86_64-softmmu/qemu-system-x86_64(+0x4c15b0) [0x64379d21d5b0]
/home/lwfdev/workspace/qemu-nyx/x86_64-softmmu/qemu-system-x86_64(+0x4c15ff) [0x64379d21d5ff]
/lib/x86_64-linux-gnu/libc.so.6(+0x42520) [0x78004a242520]
/lib/x86_64-linux-gnu/libc.so.6(pthread_kill+0x12c) [0x78004a2969fc]
/lib/x86_64-linux-gnu/libc.so.6(raise+0x16) [0x78004a242476]
/lib/x86_64-linux-gnu/libc.so.6(abort+0xd3) [0x78004a2287f3]
/home/lwfdev/workspace/qemu-nyx/x86_64-softmmu/qemu-system-x86_64(handle_kafl_hypercall+0xa5d) [0x64379d213ccd]
/home/lwfdev/workspace/qemu-nyx/x86_64-softmmu/qemu-system-x86_64(kvm_cpu_exec+0x28e) [0x64379d1659ce]
/home/lwfdev/workspace/qemu-nyx/x86_64-softmmu/qemu-system-x86_64(+0x3e0fc4) [0x64379d13cfc4]
/home/lwfdev/workspace/qemu-nyx/x86_64-softmmu/qemu-system-x86_64(+0x8c845b) [0x64379d62445b]
/lib/x86_64-linux-gnu/libc.so.6(+0x94ac3) [0x78004a294ac3]
/lib/x86_64-linux-gnu/libc.so.6(+0x126850) [0x78004a326850]
WAITING FOR GDB ATTACH (PID: 2903302...

Here's the gdb debug info:

GNU gdb (Ubuntu 12.1-0ubuntu1~22.04.2) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
attach: No such file or directory.
Attaching to process 2903302
[New LWP 2903303]
[New LWP 2903316]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
0x000078004a318cce in __ppoll (fds=0x64379e368a90, nfds=5, timeout=<optimized out>, timeout@entry=0x7ffd3fa53e60, sigmask=sigmask@entry=0x0) at ../sysdeps/unix/sysv/linux/ppoll.c:42
42      ../sysdeps/unix/sysv/linux/ppoll.c: No such file or directory.
(gdb) bt
#0  0x000078004a318cce in __ppoll (fds=0x64379e368a90, nfds=5, timeout=<optimized out>,
    timeout@entry=0x7ffd3fa53e60, sigmask=sigmask@entry=0x0) at ../sysdeps/unix/sysv/linux/ppoll.c:42
#1  0x000064379d61f642 in ppoll (__ss=0x0, __timeout=0x7ffd3fa53e60, __nfds=<optimized out>, __fds=<optimized out>)
    at /usr/include/x86_64-linux-gnu/bits/poll2.h:64
#2  qemu_poll_ns (fds=<optimized out>, nfds=<optimized out>, timeout=timeout@entry=74047740151000) at util/qemu-timer.c:348
#3  0x000064379d620c68 in os_host_main_loop_wait (timeout=74047740151000) at util/main-loop.c:239
#4  main_loop_wait (nonblocking=nonblocking@entry=0) at util/main-loop.c:520
#5  0x000064379d2be874 in main_loop () at vl.c:1882
#6  0x000064379d0df548 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:469