This commit is contained in:
Dominik Maier 2021-02-08 18:57:24 +01:00
parent 9dbe4a580a
commit 26ec498de9
3 changed files with 89 additions and 11 deletions

View File

@ -760,6 +760,7 @@ where
Self { llmp_mgr, sender } Self { llmp_mgr, sender }
} }
/*
pub fn temp<C, FT, R>( pub fn temp<C, FT, R>(
stats: ST, stats: ST,
broker_port: u16, broker_port: u16,
@ -840,6 +841,7 @@ where
//Ok(mgr) //Ok(mgr)
todo!("Remove this fn"); todo!("Remove this fn");
} }
*/
} }
/// A restarting state is a combination of restarter and runner, that can be used on systems without `fork`. /// A restarting state is a combination of restarter and runner, that can be used on systems without `fork`.
@ -891,21 +893,26 @@ where
let mut receiver = LlmpReceiver::<AflShmem>::on_existing_from_env(ENV_FUZZER_RECEIVER)?; let mut receiver = LlmpReceiver::<AflShmem>::on_existing_from_env(ENV_FUZZER_RECEIVER)?;
let mut sender = LlmpSender::<AflShmem>::on_existing_from_env(ENV_FUZZER_SENDER)?; let mut sender = LlmpSender::<AflShmem>::on_existing_from_env(ENV_FUZZER_SENDER)?;
todo!("all the things");
/*
// If we're restarting, deserialize the old state. // If we're restarting, deserialize the old state.
let (mut mgr, mut state) = match receiver.recv_buf()? { let (mut mgr, mut state) = match receiver.recv_buf()? {
None => { None => {
println!("First run. Let's set it all up"); println!("First run. Let's set it all up");
// Mgr to send and receive msgs from/to all other fuzzer instances // Mgr to send and receive msgs from/to all other fuzzer instances
let client_mgr = /*let client_mgr =
LlmpEventManager::existing_client_from_env(ENV_FUZZER_BROKER_CLIENT_INITIAL)?; LlmpEventManager::existing_client_from_env(ENV_FUZZER_BROKER_CLIENT_INITIAL)?;
(LlmpRestartingEventManager::new(client_mgr, sender), None) (LlmpRestartingEventManager::new(client_mgr, sender), None)*/
todo!("Do");
} }
// Restoring from a previous run, deserialize state and corpus. // Restoring from a previous run, deserialize state and corpus.
Some((_sender, _tag, msg)) => { Some((_sender, _tag, msg)) => {
println!("Subsequent run. Let's load all data from shmem (received {} bytes from previous instance)", msg.len()); println!("Subsequent run. Let's load all data from shmem (received {} bytes from previous instance)", msg.len());
let (mgr, state) = deserialize_state_mgr(&msg)?; let (mgr, state) = deserialize_state_mgr(&msg)?;
(LlmpRestartingEventManager::new(mgr), Some(state)) todo!("Finish");
//(LlmpRestartingEventManager::new(mgr, sender), Some(state))
} }
}; };
// We reset the sender, the next sender and receiver (after crash) will reuse the page from the initial message. // We reset the sender, the next sender and receiver (after crash) will reuse the page from the initial message.
@ -916,7 +923,9 @@ where
sender.send_buf(_LLMP_TAG_NO_RESTART, []); sender.send_buf(_LLMP_TAG_NO_RESTART, []);
*/ */
(mgr, state) //Ok(state)
todo!("More")
*/
} }
#[cfg(test)] #[cfg(test)]

View File

@ -1,7 +1,9 @@
use crate::{ use crate::{
inputs::{HasBytesVec, Input}, corpus::InMemoryCorpus,
inputs::{BytesInput, HasBytesVec, Input},
mutators::Corpus, mutators::Corpus,
mutators::*, mutators::*,
state::State,
utils::Rand, utils::Rand,
AflError, AflError,
}; };
@ -890,6 +892,14 @@ mod tests {
#[cfg(feature = "std")] #[cfg(feature = "std")]
use crate::mutators::read_tokens_file; use crate::mutators::read_tokens_file;
use super::{
mutation_bitflip, mutation_bytedec, mutation_byteflip, mutation_byteinc,
mutation_byteinteresting, mutation_byteneg, mutation_byterand, mutation_bytesdelete,
mutation_dwordadd, mutation_dwordinteresting, mutation_qwordadd, mutation_wordadd,
mutation_wordinteresting,
};
use crate::{inputs::BytesInput, state::State, utils::StdRand};
#[cfg(feature = "std")] #[cfg(feature = "std")]
#[test] #[test]
fn test_read_tokens() { fn test_read_tokens() {
@ -909,4 +919,60 @@ token2="B"
assert_eq!(res, 2); assert_eq!(res, 2);
let _ = fs::remove_file("test.tkns"); let _ = fs::remove_file("test.tkns");
} }
#[test]
fn test_mutators() {
let inputs = &[
BytesInput::new(vec![0x13, 0x37]),
BytesInput::new(vec![0xFF; 2048]),
BytesInput::new(vec![0x0]),
BytesInput::new(vec![]),
];
let rand = StdRand::new(1337);
let corpus: crate::corpus::InMemoryCorpus::new();
corpus.add(BytesInput::new(vec![0x42; 0x1337]));
let state = State::new(corpus);
let mut mutations = vec![];
mutations.append(mutation_bitflip);
mutations.append(mutation_byteflip);
mutations.append(mutation_byteinc);
mutations.append(mutation_bytedec);
mutations.append(mutation_byteneg);
mutations.append(mutation_byterand);
mutations.append(mutation_byteadd);
mutations.append(mutation_wordadd);
mutations.append(mutation_dwordadd);
mutations.append(mutation_qwordadd);
mutations.append(mutation_byteinteresting);
mutations.append(mutation_wordinteresting);
mutations.append(mutation_dwordinteresting);
mutations.append(mutation_bytesdelete);
mutations.append(mutation_bytesdelete);
mutations.append(mutation_bytesdelete);
mutations.append(mutation_bytesdelete);
mutations.append(mutation_bytesexpand);
mutations.append(mutation_bytesinsert);
mutations.append(mutation_bytesrandinsert);
mutations.append(mutation_bytesset);
mutations.append(mutation_bytesrandset);
mutations.append(mutation_bytescopy);
mutations.append(mutation_bytesswap);
for mutation in mutations {
for input in inputs.iter_mut() {
mutation(None, rand, state, input).unwrap();
}
}
/* TODO
scheduled.add_mutation(mutation_tokeninsert);
scheduled.add_mutation(mutation_tokenreplace);
*/
}
} }

View File

@ -79,12 +79,15 @@ where
let observers_buf = manager.serialize_observers(observers)?; let observers_buf = manager.serialize_observers(observers)?;
// TODO decouple events manager and engine // TODO decouple events manager and engine
manager.fire(Event::NewTestcase { manager.fire(
state,
Event::NewTestcase {
input: input_mut.clone(), input: input_mut.clone(),
observers_buf, observers_buf,
corpus_size: state.corpus().count() + 1, corpus_size: state.corpus().count() + 1,
client_config: "TODO".into(), client_config: "TODO".into(),
})?; },
)?;
state.add_if_interesting(input_mut, fitness)?; state.add_if_interesting(input_mut, fitness)?;
// let _ = corpus.add(testcase); // let _ = corpus.add(testcase);
} else { } else {