diff --git a/fuzzers/FRET/benchmark/.gitignore b/fuzzers/FRET/benchmark/.gitignore index 0a356bac3c..982e916411 100644 --- a/fuzzers/FRET/benchmark/.gitignore +++ b/fuzzers/FRET/benchmark/.gitignore @@ -6,3 +6,5 @@ mnt .R* *.png *.pdf +.snakemake +bins diff --git a/fuzzers/FRET/benchmark/Snakefile b/fuzzers/FRET/benchmark/Snakefile new file mode 100644 index 0000000000..97b7a07790 --- /dev/null +++ b/fuzzers/FRET/benchmark/Snakefile @@ -0,0 +1,154 @@ +import csv +def_flags="--no-default-features --features std,snapshot_restore,singlecore" + +rule build_showmap: + output: + directory("bins/target_showmap") + shell: + "cargo build --target-dir {output} {def_flags},systemstate" + +rule build_random: + output: + directory("bins/target_random") + shell: + "cargo build --target-dir {output} {def_flags}" + +rule build_feedlongest: + output: + directory("bins/target_feedlongest") + shell: + "cargo build --target-dir {output} {def_flags},feed_longest" + +rule build_feedaflnolongest: + output: + directory("bins/target_feedaflnolongest") + shell: + "cargo build --target-dir {output} {def_flags},feed_afl" + +rule build_afl: + output: + directory("bins/target_afl") + shell: + "cargo build --target-dir {output} {def_flags}" + +rule build_state: + output: + directory("bins/target_state") + shell: + "cargo build --target-dir {output} {def_flags},systemtrace" + +rule build_graph: + output: + directory("bins/target_graph") + shell: + "cargo build --target-dir {output} {def_flags},systemgraph" + +rule run_bench: + input: + "build/{target}.elf", + "bins/target_{fuzzer}" + output: + multiext("timedump/{fuzzer}/{target}.{num}", "", ".log", ".case") + run: + with open('target_symbols.csv') as csvfile: + reader = csv.DictReader(csvfile) + line = next((x for x in reader if x['kernel']==wildcards.target), None) + if line == None: + return False + kernel=line['kernel'] + fuzz_main=line['main_function'] + fuzz_input=line['input_symbol'] + fuzz_len=line['input_size'] + bkp=line['return_function'] + script=""" + mkdir -p $(dirname {output[0]}) + export KERNEL=$(pwd)/{input[0]} + export FUZZ_MAIN={fuzz_main} + export FUZZ_INPUT={fuzz_input} + export FUZZ_INPUT_LEN={fuzz_len} + export BREAKPOINT={bkp} + export SEED_RANDOM=1 + export TIME_DUMP=$(pwd)/{output[0]} + export CASE_DUMP=$(pwd)/{output[2]} + export FUZZ_ITERS=7200 + export FUZZER=$(pwd)/{input[1]}/debug/fret + set +e + ../fuzzer.sh > {output[1]} 2>&1 + exit 0 + """ + if wildcards.fuzzer == 'random': + script="export FUZZ_RANDOM=1\n"+script + shell(script) + +rule run_showmap: + input: + "build/{target}.elf", + "bins/target_showmap", + "timedump/{fuzzer}/{target}.{num}.case" + output: + "timedump/{fuzzer}/{target}.{num}.trace.ron" + run: + with open('target_symbols.csv') as csvfile: + reader = csv.DictReader(csvfile) + line = next((x for x in reader if x['kernel']==wildcards.target), None) + if line == None: + return False + kernel=line['kernel'] + fuzz_main=line['main_function'] + fuzz_input=line['input_symbol'] + fuzz_len=line['input_size'] + bkp=line['return_function'] + script=""" + mkdir -p $(dirname {output}) + export KERNEL=$(pwd)/{input[0]} + export FUZZ_MAIN={fuzz_main} + export FUZZ_INPUT={fuzz_input} + export FUZZ_INPUT_LEN={fuzz_len} + export BREAKPOINT={bkp} + export TRACE_DUMP=$(pwd)/{output} + export FUZZER=$(pwd)/{input[1]}/debug/fret + export DO_SHOWMAP=$(pwd)/{input[2]} + set +e + ../fuzzer.sh + exit 0 + """ + if wildcards.fuzzer == 'random': + script="export FUZZ_RANDOM=1\n"+script + shell(script) + +rule tarnsform_trace: + input: + "timedump/{fuzzer}/{target}.{num}.trace.ron" + output: + "timedump/{fuzzer}/{target}.{num}.trace.csv" + shell: + "$(pwd)/../../../../state2gantt/target/debug/state2gantt {input} > {output[0]}" + +rule trace2gantt: + input: + "timedump/{fuzzer}/{target}.{num}.trace.csv" + output: + "timedump/{fuzzer}/{target}.{num}.trace.csv.png" + shell: + "Rscript --vanilla $(pwd)/../../../../state2gantt/gantt.R {input}" + +rule all_bins: + input: + "bins/target_random", + "bins/target_feedlongest", + "bins/target_feedaflnolongest", + "bins/target_afl", + "bins/target_state", + "bins/target_graph" + +rule all_constructed: + input: + expand("timedump/{fuzzer}/{target}.{num}", fuzzer=['random','afl','state','graph'], target=['tmr'],num=range(0,10)) + +rule all_periodic: + input: + expand("timedump/{fuzzer}/{target}.{num}", fuzzer=['random','afl','state','graph'], target=['waters'],num=range(0,10)) + +rule all_compare_afl_longest: + input: + expand("timedump/{fuzzer}/{target}.{num}", fuzzer=['afl','feedlongest','feedaflnolongest'], target=['waters'],num=range(0,10)) \ No newline at end of file