diff --git a/fuzzers/FRET/Cargo.toml b/fuzzers/FRET/Cargo.toml index be0d1e4b7a..d4f946f3dc 100644 --- a/fuzzers/FRET/Cargo.toml +++ b/fuzzers/FRET/Cargo.toml @@ -1,5 +1,5 @@ [package] -name = "qemu_systemmode" +name = "fret" version = "0.8.2" authors = ["Andrea Fioraldi ", "Dominik Maier "] edition = "2021" diff --git a/fuzzers/FRET/benchmark/Makefile b/fuzzers/FRET/benchmark/Makefile index b7597901e7..8d0f15b181 100644 --- a/fuzzers/FRET/benchmark/Makefile +++ b/fuzzers/FRET/benchmark/Makefile @@ -1,3 +1,5 @@ +TIME=7200 + corpora/%/seed: mkdir -p $$(dirname $@) LINE=$$(grep "^$$(basename $*)" target_symbols.csv); \ @@ -11,7 +13,7 @@ corpora/%/seed: DUMP_SEED=seed; \ ../fuzzer.sh -timedump/%: corpora/%/seed +timedump/%$(FUZZ_RANDOM): corpora/%/seed mkdir -p $$(dirname $@) LINE=$$(grep "^$$(basename $*)" target_symbols.csv); \ export \ @@ -22,7 +24,9 @@ timedump/%: corpora/%/seed BREAKPOINT=$$(echo $$LINE | cut -d, -f5) \ SEED_DIR=benchmark/corpora/$* \ TIME_DUMP=benchmark/$@; \ - ../fuzzer.sh + + + + + 5 + + + + ../fuzzer.sh + + + + + $(TIME) + + + + +all_sequential: timedump/sequential/mpeg2$(FUZZ_RANDOM) timedump/sequential/dijkstra$(FUZZ_RANDOM) timedump/sequential/epic$(FUZZ_RANDOM) clean: rm -rf corpora timedump \ No newline at end of file diff --git a/fuzzers/FRET/benchmark/target_symbols.csv b/fuzzers/FRET/benchmark/target_symbols.csv index 17e5e598e7..e6fd6afc36 100644 --- a/fuzzers/FRET/benchmark/target_symbols.csv +++ b/fuzzers/FRET/benchmark/target_symbols.csv @@ -1,2 +1,5 @@ kernel,main_function,input_symbol,input_size,return_function -mpeg2,main,mpeg2_oldorgframe,90112,mpeg2_return \ No newline at end of file +mpeg2,main,mpeg2_oldorgframe,90112,mpeg2_return +audiobeam,main,audiobeam_input,11520,audiobeam_return +epic,main,epic_image,4096,epic_return +dijkstra,main,dijkstra_AdjMatrix,10000,dijkstra_return \ No newline at end of file diff --git a/fuzzers/FRET/fuzzer.sh b/fuzzers/FRET/fuzzer.sh index 68c4fc2f6c..1ad94bbf41 100755 --- a/fuzzers/FRET/fuzzer.sh +++ b/fuzzers/FRET/fuzzer.sh @@ -11,4 +11,6 @@ cd "$parent_path" [ -n "$7" -a "$7" != "+" -a -z "$TIME_DUMP" ] && export TIME_DUMP="$7" [ -n "$8" -a "$8" != "+" -a -z "$DO_SHOWMAP" ] && export DO_SHOWMAP="$8" [ -n "$9" -a "$9" != "+" -a -z "$SHOWMAP_TEXTINPUT" ] && export SHOWMAP_TEXTINPUT="$9" -target/debug/qemu_systemmode -icount shift=3,align=off,sleep=off -machine mps2-an385 -monitor null -kernel $KERNEL -serial null -nographic -S -semihosting --semihosting-config enable=on,target=native # -snapshot -drive if=none,format=qcow2,file=dummy.qcow2 \ No newline at end of file + +[ -z "$FUZZER" ] && export FUZZER=target/debug/fret +$FUZZER -icount shift=3,align=off,sleep=off -machine mps2-an385 -monitor null -kernel $KERNEL -serial null -nographic -S -semihosting --semihosting-config enable=on,target=native # -snapshot -drive if=none,format=qcow2,file=dummy.qcow2 \ No newline at end of file diff --git a/fuzzers/FRET/src/fuzzer.rs b/fuzzers/FRET/src/fuzzer.rs index 125a535101..abf22e7b5f 100644 --- a/fuzzers/FRET/src/fuzzer.rs +++ b/fuzzers/FRET/src/fuzzer.rs @@ -28,7 +28,7 @@ use libafl::{ stages::StdMutationalStage, state::{HasCorpus, StdState}, Error, - prelude::{SimpleMonitor, SimpleEventManager, AsMutSlice}, Evaluator, + prelude::{SimpleMonitor, SimpleEventManager, AsMutSlice, RandBytesGenerator, Generator}, Evaluator, }; use libafl_qemu::{ edges, edges::QemuEdgeCoverageHelper, elf::EasyElf, emu::Emulator, GuestPhysAddr, QemuExecutor, @@ -314,9 +314,20 @@ pub fn fuzz() { Ok(t) => { println!("Iterations {}",t); let num = str::parse::(&t).expect("FUZZ_ITERS was not a number"); - fuzzer - .fuzz_loop_for_duration(&mut stages, &mut executor, &mut state, &mut mgr, Duration::from_secs(num)) - .unwrap(); + if let Ok(_) = env::var("FUZZ_RANDOM") { unsafe { + println!("Random Fuzzing, ignore corpus"); + let mut generator = RandBytesGenerator::new(MAX_INPUT_SIZE); + let target_duration = Duration::from_secs(num); + let start_time = std::time::Instant::now(); + while start_time.elapsed() < target_duration { + let inp = generator.generate(&mut state).unwrap(); + fuzzer.evaluate_input(&mut state, &mut executor, &mut mgr, inp).unwrap(); + } + }} else { + fuzzer + .fuzz_loop_for_duration(&mut stages, &mut executor, &mut state, &mut mgr, Duration::from_secs(num)) + .unwrap(); + } if let Ok(td) = env::var("TIME_DUMP") { let mut file = OpenOptions::new() .read(true)