SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

trace_abbs and dump path

Browse Source
This commit is contained in:
Alwin Berger 2023-02-15 09:17:48 +01:00
parent 8c8ab7c44e
commit 2593bdf42f
4 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
fuzzers/FRET/Cargo.toml
View File

@ -10,6 +10,7 @@ std = []
snapshot_restore = [] snapshot_restore = []
snapshot_fast = [ "snapshot_restore" ] snapshot_fast = [ "snapshot_restore" ]
singlecore = [] singlecore = []
trace_abbs = []
systemstate = [] systemstate = []
systemgraph = [ "systemstate" ] systemgraph = [ "systemstate" ]
systemtrace = [ "systemstate" ] systemtrace = [ "systemstate" ]

4
fuzzers/FRET/benchmark/Makefile
View File

@ -1,4 +1,4 @@
TIME=5400 TIME=7200
corpora/%/seed: corpora/%/seed:
mkdir -p $$(dirname $@) mkdir -p $$(dirname $@)
@ -24,7 +24,7 @@ timedump/%$(FUZZ_RANDOM)$(SUFFIX): corpora/%/seed
BREAKPOINT=$$(echo $$LINE | cut -d, -f5) \ BREAKPOINT=$$(echo $$LINE | cut -d, -f5) \
SEED_RANDOM=1 \ SEED_RANDOM=1 \
TIME_DUMP=benchmark/$@ \ TIME_DUMP=benchmark/$@ \
CASE_DUMP=benchmark/$@.case; \ CASE_DUMP=benchmark/$@; \
../fuzzer.sh + + + + + $(TIME) + + + > $@_log ../fuzzer.sh + + + + + $(TIME) + + + > $@_log
#SEED_DIR=benchmark/corpora/$* #SEED_DIR=benchmark/corpora/$*

18
fuzzers/FRET/src/fuzzer.rs
View File

@ -28,7 +28,7 @@ use libafl::{
stages::StdMutationalStage, stages::StdMutationalStage,
state::{HasCorpus, StdState, HasMetadata, HasNamedMetadata}, state::{HasCorpus, StdState, HasMetadata, HasNamedMetadata},
Error, Error,
prelude::{SimpleMonitor, SimpleEventManager, AsMutSlice, RandBytesGenerator, Generator, SimpleRestartingEventManager, HasBytesVec}, Evaluator, prelude::{SimpleMonitor, SimpleEventManager, AsMutSlice, RandBytesGenerator, Generator, SimpleRestartingEventManager, HasBytesVec, minimizer::TopRatedsMetadata}, Evaluator,
}; };
use libafl_qemu::{ use libafl_qemu::{
edges, edges::QemuEdgeCoverageHelper, elf::EasyElf, emu::Emulator, GuestPhysAddr, QemuExecutor, edges, edges::QemuEdgeCoverageHelper, elf::EasyElf, emu::Emulator, GuestPhysAddr, QemuExecutor,
@ -404,7 +404,11 @@ pub fn fuzz() {
} }
} }
match worst_input { match worst_input {
Some(wi) => {fs::write(&td,wi).expect("Failed to write worst corpus element");}, Some(wi) => {
let mut cd = String::from(&td);
cd.push_str(".case");
fs::write(&cd,wi).expect("Failed to write worst corpus element");
},
None => (), None => (),
} }
#[cfg(feature = "systemgraph")] #[cfg(feature = "systemgraph")]
@ -415,6 +419,16 @@ pub fn fuzz() {
fs::write(&gd,ron::to_string(&md).expect("Failed to serialize graph")).expect("Failed to write graph"); fs::write(&gd,ron::to_string(&md).expect("Failed to serialize graph")).expect("Failed to write graph");
} }
} }
{
let mut gd = String::from(&td);
if let Some(md) = state.metadata_mut().get_mut::<TopRatedsMetadata>() {
let mut uniq: Vec<usize> = md.map.values().map(|x| x.clone()).collect();
uniq.sort();
uniq.dedup();
gd.push_str(&format!(".{}.toprated", uniq.len()));
fs::write(&gd,ron::to_string(&md.map).expect("Failed to serialize metadata")).expect("Failed to write graph");
}
}
} }
}, },
} }

1
fuzzers/FRET/src/systemstate/helpers.rs
View File

@ -69,6 +69,7 @@ where
QT: QemuHelperTuple<S>, QT: QemuHelperTuple<S>,
{ {
_hooks.instruction(self.kerneladdr, exec_syscall_hook::<QT, S>, false); _hooks.instruction(self.kerneladdr, exec_syscall_hook::<QT, S>, false);
#[cfg(feature = "trace_abbs")]
_hooks.jmps(Some(gen_jmp_is_syscall::<QT, S>), Some(trace_api_call::<QT, S>)); _hooks.jmps(Some(gen_jmp_is_syscall::<QT, S>), Some(trace_api_call::<QT, S>));
} }