SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ScheduledMutator Fix with_max_stack_pow (#3148)

Browse Source 
* ScheduledMutator Fix with_max_stack_pow

* Renamed StdScheduledMutator to HavocScheduledMutator

* Added SingleChoiceScheduledMutator

* Changed HavocScheduledMutator description

* Added rename in migration

* Missed renaming

* cargo fmt fix

* cargo fmt fix 2

* Clippy duplicate code and safer test

* cargo fmt fix 3

* Removed my hallucination
This commit is contained in:
Francesco Cirillo 2025-04-12 20:35:31 +02:00 committed by GitHub
parent 7ea4070338
commit 796ce20cd8
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
73 changed files with 355 additions and 207 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
MIGRATION.md
View File

@ -16,6 +16,7 @@
- `MultipartInput` is now implemented as key-value tuples in a `ListInput`. The interface slightly changed, all functionality is maintained.
- Instead of names, `MultipartInput` uses generic `key`s (function names were changed accordingly).
- If you don't need the keys to identify individual parts, consider using `ListInput` directly.
- `StdScheduledMutator` has been renamed to `HavocScheduledMutator`.
## 0.14.1 -> 0.15.0

4
docs/listings/baby_fuzzer/listing-06/src/main.rs
View File

@ -12,7 +12,7 @@ use libafl::{
generators::RandPrintablesGenerator,
inputs::{BytesInput, HasTargetBytes},
monitors::SimpleMonitor,
mutators::scheduled::{havoc_mutations, StdScheduledMutator},
mutators::scheduled::{havoc_mutations, HavocScheduledMutator},
observers::StdMapObserver,
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -107,7 +107,7 @@ fn main() {
/* ANCHOR: mutational_stage */
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

4
fuzzers/baby/baby_fuzzer/src/main.rs
View File

@ -14,7 +14,7 @@ use libafl::{
fuzzer::{Fuzzer, StdFuzzer},
generators::RandPrintablesGenerator,
inputs::{BytesInput, HasTargetBytes},
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::StdMapObserver,
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -128,7 +128,7 @@ pub fn main() {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

4
fuzzers/baby/baby_fuzzer_custom_executor/src/main.rs
View File

@ -15,7 +15,7 @@ use libafl::{
fuzzer::{Fuzzer, StdFuzzer},
generators::RandPrintablesGenerator,
inputs::HasTargetBytes,
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::StdMapObserver,
schedulers::QueueScheduler,
stages::{mutational::StdMutationalStage, AflStatsStage, CalibrationStage},
@ -155,7 +155,7 @@ pub fn main() {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(
calibration_stage,
StdMutationalStage::new(mutator),

6
fuzzers/baby/baby_fuzzer_minimizing/src/main.rs
View File

@ -97,8 +97,8 @@ pub fn main() -> Result<(), Error> {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let minimizer = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let minimizer = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(
StdMutationalStage::new(mutator),
StdTMinMutationalStage::new(minimizer, factory, 128)
@ -124,7 +124,7 @@ pub fn main() -> Result<(), Error> {
let mut mgr = SimpleEventManager::new(mon);
let minimizer = StdScheduledMutator::new(havoc_mutations());
let minimizer = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdTMinMutationalStage::new(
minimizer,
CrashFeedback::new(),

4
fuzzers/baby/baby_fuzzer_swap_differential/src/main.rs
View File

@ -17,7 +17,7 @@ use libafl::{
fuzzer::{Fuzzer, StdFuzzer},
generators::RandPrintablesGenerator,
inputs::{BytesInput, HasTargetBytes},
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::StdMapObserver,
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -262,7 +262,7 @@ pub fn main() {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
while state.solutions().is_empty() {

4
fuzzers/baby/baby_fuzzer_unicode/src/main.rs
View File

@ -14,7 +14,7 @@ use libafl::{
fuzzer::{Fuzzer, StdFuzzer},
inputs::{BytesInput, HasTargetBytes},
mutators::{
StdScheduledMutator, UnicodeCategoryRandMutator, UnicodeInput,
HavocScheduledMutator, UnicodeCategoryRandMutator, UnicodeInput,
UnicodeSubcategoryRandMutator,
},
observers::StdMapObserver,
@ -128,7 +128,7 @@ pub fn main() {
.unwrap();
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(tuple_list!(
let mutator = HavocScheduledMutator::new(tuple_list!(
UnicodeCategoryRandMutator,
UnicodeSubcategoryRandMutator,
UnicodeSubcategoryRandMutator,

4
fuzzers/baby/backtrace_baby_fuzzers/c_code_with_fork_executor/src/main.rs
View File

@ -10,7 +10,7 @@ use libafl::{
generators::RandPrintablesGenerator,
inputs::{BytesInput, HasTargetBytes},
monitors::SimpleMonitor,
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::{BacktraceObserver, ConstMapObserver},
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -118,7 +118,7 @@ pub fn main() {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

4
fuzzers/baby/backtrace_baby_fuzzers/c_code_with_inprocess_executor/src/main.rs
View File

@ -10,7 +10,7 @@ use libafl::{
generators::RandPrintablesGenerator,
inputs::{BytesInput, HasTargetBytes},
monitors::SimpleMonitor,
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::{BacktraceObserver, ConstMapObserver},
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -103,7 +103,7 @@ pub fn main() {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

4
fuzzers/baby/backtrace_baby_fuzzers/command_executor/src/main.rs
View File

@ -17,7 +17,7 @@ use libafl::{
generators::RandPrintablesGenerator,
inputs::{BytesInput, HasTargetBytes},
monitors::SimpleMonitor,
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::{get_asan_runtime_flags, AsanBacktraceObserver, StdMapObserver},
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -129,7 +129,7 @@ pub fn main() {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

4
fuzzers/baby/backtrace_baby_fuzzers/forkserver_executor/src/main.rs
View File

@ -10,7 +10,7 @@ use libafl::{
generators::RandPrintablesGenerator,
inputs::BytesInput,
monitors::SimpleMonitor,
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::{AsanBacktraceObserver, ConstMapObserver, HitcountsMapObserver},
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -110,7 +110,7 @@ pub fn main() {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

4
fuzzers/baby/backtrace_baby_fuzzers/rust_code_with_fork_executor/src/main.rs
View File

@ -12,7 +12,7 @@ use libafl::{
generators::RandPrintablesGenerator,
inputs::{BytesInput, HasTargetBytes},
monitors::SimpleMonitor,
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::{BacktraceObserver, StdMapObserver},
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -131,7 +131,7 @@ pub fn main() {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

4
fuzzers/baby/backtrace_baby_fuzzers/rust_code_with_inprocess_executor/src/main.rs
View File

@ -12,7 +12,7 @@ use libafl::{
generators::RandPrintablesGenerator,
inputs::{BytesInput, HasTargetBytes},
monitors::SimpleMonitor,
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::{BacktraceObserver, StdMapObserver},
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -124,7 +124,7 @@ pub fn main() {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

13
fuzzers/binary_only/frida_executable_libpng/src/fuzzer.rs
View File

@ -16,7 +16,7 @@ use libafl::{
monitors::MultiMonitor,
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{tokens_mutations, StdScheduledMutator},
scheduled::{tokens_mutations, HavocScheduledMutator},
token_mutations::{I2SRandReplace, Tokens},
},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
@ -194,7 +194,8 @@ unsafe fn fuzz(
}
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator =
HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
// A minimization+queue policy to get testcasess from the corpus
let scheduler =
@ -323,7 +324,8 @@ unsafe fn fuzz(
}
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator =
HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
// A minimization+queue policy to get testcasess from the corpus
let scheduler =
@ -373,7 +375,7 @@ unsafe fn fuzz(
let tracing = ShadowTracingStage::new();
// Setup a randomic Input2State stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
@ -467,7 +469,8 @@ unsafe fn fuzz(
}
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator =
HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
// A minimization+queue policy to get testcasess from the corpus
let scheduler =

9
fuzzers/binary_only/frida_libpng/src/fuzzer.rs
View File

@ -16,7 +16,7 @@ use libafl::{
monitors::MultiMonitor,
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{tokens_mutations, StdScheduledMutator},
scheduled::{tokens_mutations, HavocScheduledMutator},
token_mutations::{I2SRandReplace, Tokens},
},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
@ -184,7 +184,7 @@ fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
}
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
// A minimization+queue policy to get testcasess from the corpus
let scheduler =
@ -221,8 +221,9 @@ fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
let tracing = ShadowTracingStage::new();
// Setup a randomic Input2State stage
let i2s =
StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(I2SRandReplace::new())));
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
// In case the corpus is empty (on first run), reset
if state.must_load_initial_inputs() {

13
fuzzers/binary_only/frida_windows_gdiplus/src/fuzzer.rs
View File

@ -26,7 +26,7 @@ use libafl::{
monitors::MultiMonitor,
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{tokens_mutations, StdScheduledMutator},
scheduled::{tokens_mutations, HavocScheduledMutator},
token_mutations::{I2SRandReplace, Tokens},
},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
@ -177,7 +177,8 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
}
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator =
HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
// A minimization+queue policy to get testcasess from the corpus
let scheduler =
@ -299,7 +300,8 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
}
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator =
HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
// A minimization+queue policy to get testcasess from the corpus
let scheduler =
@ -347,7 +349,7 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
let tracing = ShadowTracingStage::new();
// Setup a randomic Input2State stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
@ -439,7 +441,8 @@ unsafe fn fuzz(options: &FuzzerOptions) -> Result<(), Error> {
}
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator =
HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
// A minimization+queue policy to get testcasess from the corpus
let scheduler =

8
fuzzers/binary_only/fuzzbench_fork_qemu/src/fuzzer.rs
View File

@ -24,8 +24,8 @@ use libafl::{
inputs::{BytesInput, HasTargetBytes},
monitors::SimpleMonitor,
mutators::{
havoc_mutations, token_mutations::I2SRandReplace, tokens_mutations, StdMOptMutator,
StdScheduledMutator, Tokens,
havoc_mutations, token_mutations::I2SRandReplace, tokens_mutations, HavocScheduledMutator,
StdMOptMutator, Tokens,
},
observers::{CanTrack, ConstMapObserver, HitcountsMapObserver, TimeObserver},
schedulers::{
@ -308,7 +308,9 @@ fn fuzz(
});
// Setup a randomic Input2State stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(I2SRandReplace::new())));
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
// Setup a MOPT mutator
let mutator = StdMOptMutator::new(

8
fuzzers/binary_only/fuzzbench_qemu/src/fuzzer.rs
View File

@ -22,8 +22,8 @@ use libafl::{
inputs::{BytesInput, HasTargetBytes},
monitors::SimpleMonitor,
mutators::{
havoc_mutations, token_mutations::I2SRandReplace, tokens_mutations, StdMOptMutator,
StdScheduledMutator, Tokens,
havoc_mutations, token_mutations::I2SRandReplace, tokens_mutations, HavocScheduledMutator,
StdMOptMutator, Tokens,
},
observers::{CanTrack, HitcountsMapObserver, TimeObserver, VariableMapObserver},
schedulers::{
@ -319,7 +319,9 @@ fn fuzz(
});
// Setup a randomic Input2State stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(I2SRandReplace::new())));
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
// Setup a MOPT mutator
let mutator = StdMOptMutator::new(

4
fuzzers/binary_only/intel_pt_baby_fuzzer/src/main.rs
View File

@ -16,7 +16,7 @@ use libafl::{
fuzzer::{Fuzzer, StdFuzzer},
generators::RandPrintablesGenerator,
inputs::{BytesInput, HasTargetBytes},
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::StdMapObserver,
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -145,7 +145,7 @@ pub fn main() {
.expect("Failed to generate the initial corpus");
// Set up a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

4
fuzzers/binary_only/intel_pt_command_executor/src/main.rs
View File

@ -14,7 +14,7 @@ use libafl::{
generators::RandPrintablesGenerator,
inputs::BytesInput,
monitors::SimpleMonitor,
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::StdMapObserver,
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -147,7 +147,7 @@ pub fn main() {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

8
fuzzers/binary_only/qemu_launcher/src/instance.rs
View File

@ -15,8 +15,8 @@ use libafl::{
inputs::{BytesInput, Input},
monitors::Monitor,
mutators::{
havoc_mutations, token_mutations::I2SRandReplace, tokens_mutations, StdMOptMutator,
StdScheduledMutator, Tokens,
havoc_mutations, token_mutations::I2SRandReplace, tokens_mutations, HavocScheduledMutator,
StdMOptMutator, Tokens,
},
observers::{
CanTrack, HitcountsMapObserver, ObserversTuple, TimeObserver, VariableMapObserver,
@ -319,7 +319,7 @@ impl<M: Monitor> Instance<'_, M> {
let tracing = ShadowTracingStage::new();
// Setup a randomic Input2State stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
@ -359,7 +359,7 @@ impl<M: Monitor> Instance<'_, M> {
)?;
// Setup an havoc mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let power: StdPowerMutationalStage<_, _, BytesInput, _, _, _> =
StdPowerMutationalStage::new(mutator);
let mut stages = tuple_list!(calibration, power, stats_stage);

4
fuzzers/binary_only/tinyinst_simple/src/main.rs
View File

@ -6,7 +6,7 @@ use libafl::{
feedbacks::{CrashFeedback, ListFeedback},
inputs::BytesInput,
monitors::SimpleMonitor,
mutators::{havoc_mutations, StdScheduledMutator},
mutators::{havoc_mutations, HavocScheduledMutator},
observers::ListObserver,
schedulers::RandScheduler,
stages::StdMutationalStage,
@ -73,7 +73,7 @@ fn main() {
.build(tuple_list!(observer))
.unwrap();
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer
.fuzz_loop(&mut stages, &mut executor, &mut state, &mut mgr)

4
fuzzers/forkserver/baby_fuzzer_with_forkexecutor/src/main.rs
View File

@ -11,7 +11,7 @@ use libafl::{
generators::RandPrintablesGenerator,
inputs::{BytesInput, HasTargetBytes},
monitors::SimpleMonitor,
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::StdMapObserver,
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -125,7 +125,7 @@ pub fn main() {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

4
fuzzers/forkserver/forkserver_libafl_cc/src/main.rs
View File

@ -11,7 +11,7 @@ use libafl::{
fuzzer::{Fuzzer, StdFuzzer},
inputs::BytesInput,
monitors::SimpleMonitor,
mutators::{havoc_mutations, tokens_mutations, StdScheduledMutator, Tokens},
mutators::{havoc_mutations, tokens_mutations, HavocScheduledMutator, Tokens},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
schedulers::{IndexesLenTimeMinimizerScheduler, QueueScheduler},
stages::mutational::StdMutationalStage,
@ -207,7 +207,7 @@ pub fn main() {
// Setup a mutational stage with a basic bytes mutator
let mutator =
StdScheduledMutator::with_max_stack_pow(havoc_mutations().merge(tokens_mutations()), 6);
HavocScheduledMutator::with_max_stack_pow(havoc_mutations().merge(tokens_mutations()), 6);
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

4
fuzzers/forkserver/forkserver_simple/src/main.rs
View File

@ -12,7 +12,7 @@ use libafl::{
fuzzer::{Fuzzer, StdFuzzer},
inputs::BytesInput,
monitors::SimpleMonitor,
mutators::{StdScheduledMutator, Tokens, havoc_mutations, tokens_mutations},
mutators::{HavocScheduledMutator, Tokens, havoc_mutations, tokens_mutations},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
schedulers::{IndexesLenTimeMinimizerScheduler, QueueScheduler},
stages::mutational::StdMutationalStage,
@ -202,7 +202,7 @@ pub fn main() {
// Setup a mutational stage with a basic bytes mutator
let mutator =
StdScheduledMutator::with_max_stack_pow(havoc_mutations().merge(tokens_mutations()), 6);
HavocScheduledMutator::with_max_stack_pow(havoc_mutations().merge(tokens_mutations()), 6);
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

9
fuzzers/forkserver/fuzzbench_forkserver/src/main.rs
View File

@ -18,8 +18,8 @@ use libafl::{
inputs::BytesInput,
monitors::SimpleMonitor,
mutators::{
havoc_mutations, token_mutations::I2SRandReplace, tokens_mutations, StdMOptMutator,
StdScheduledMutator, Tokens,
havoc_mutations, token_mutations::I2SRandReplace, tokens_mutations, HavocScheduledMutator,
StdMOptMutator, Tokens,
},
observers::{CanTrack, HitcountsMapObserver, StdCmpObserver, StdMapObserver, TimeObserver},
schedulers::{
@ -371,8 +371,9 @@ fn fuzz(
let tracing = TracingStage::new(cmplog_executor);
// Setup a randomic Input2State stage
let i2s =
StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(I2SRandReplace::new())));
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
// The order of the stages matter!
let mut stages = tuple_list!(calibration, tracing, i2s, power);

9
fuzzers/forkserver/fuzzbench_forkserver_sand/src/main.rs
View File

@ -18,8 +18,8 @@ use libafl::{
inputs::BytesInput,
monitors::SimpleMonitor,
mutators::{
havoc_mutations, token_mutations::I2SRandReplace, tokens_mutations, StdMOptMutator,
StdScheduledMutator, Tokens,
havoc_mutations, token_mutations::I2SRandReplace, tokens_mutations, HavocScheduledMutator,
StdMOptMutator, Tokens,
},
observers::{CanTrack, HitcountsMapObserver, StdCmpObserver, StdMapObserver, TimeObserver},
schedulers::{
@ -418,8 +418,9 @@ fn fuzz(
let tracing = TracingStage::new(cmplog_executor);
// Setup a randomic Input2State stage
let i2s =
StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(I2SRandReplace::new())));
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
// The order of the stages matter!
let mut stages = tuple_list!(calibration, tracing, i2s, power);

4
fuzzers/forkserver/libafl-fuzz/src/fuzzer.rs
View File

@ -23,7 +23,7 @@ use libafl::{
},
fuzzer::StdFuzzer,
inputs::{BytesInput, NopTargetBytesConverter},
mutators::{havoc_mutations, tokens_mutations, AFLppRedQueen, StdScheduledMutator, Tokens},
mutators::{havoc_mutations, tokens_mutations, AFLppRedQueen, HavocScheduledMutator, Tokens},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
schedulers::{
powersched::{BaseSchedule, PowerSchedule},
@ -263,7 +263,7 @@ define_run_client!(state, mgr, fuzzer_dir, core_id, opt, is_main_node, {
// Create our Mutational Stage.
// We can either have a simple MutationalStage (for Queue scheduling)
// Or one that utilizes scheduling metadadata (Weighted Random scheduling)
let mutation = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutation = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let inner_mutational_stage = if opt.sequential_queue {
SupportedMutationalStages::StdMutational(StdMutationalStage::new(mutation), PhantomData)
} else {

6
fuzzers/full_system/nyx_launcher/src/instance.rs
View File

@ -13,7 +13,7 @@ use libafl::{
inputs::BytesInput,
monitors::Monitor,
mutators::{
havoc_mutations, tokens_mutations, I2SRandReplace, StdMOptMutator, StdScheduledMutator,
havoc_mutations, tokens_mutations, HavocScheduledMutator, I2SRandReplace, StdMOptMutator,
Tokens,
},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
@ -188,7 +188,7 @@ impl<M: Monitor> Instance<'_, M> {
let mut executor = ShadowExecutor::new(executor, tuple_list!(cmplog_observer));
// Setup a randomic Input2State stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
@ -214,7 +214,7 @@ impl<M: Monitor> Instance<'_, M> {
let mut executor = NyxExecutor::builder().build(helper, observers);
// Setup an havoc mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mut stages = tuple_list!(StdMutationalStage::new(mutator));

4
fuzzers/full_system/nyx_libxml2_parallel/src/main.rs
View File

@ -6,7 +6,7 @@ use libafl::{
feedbacks::{CrashFeedback, MaxMapFeedback},
inputs::BytesInput,
monitors::MultiMonitor,
mutators::{havoc_mutations, StdScheduledMutator},
mutators::{havoc_mutations, HavocScheduledMutator},
observers::StdMapObserver,
schedulers::RandScheduler,
stages::StdMutationalStage,
@ -64,7 +64,7 @@ fn main() {
});
println!("We're a client, let's fuzz :)");
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
// A fuzzer with feedbacks and a corpus scheduler

4
fuzzers/full_system/nyx_libxml2_standalone/src/main.rs
View File

@ -6,7 +6,7 @@ use libafl::{
feedbacks::{CrashFeedback, MaxMapFeedback},
inputs::BytesInput,
monitors::tui::TuiMonitor,
mutators::{havoc_mutations, StdScheduledMutator},
mutators::{havoc_mutations, HavocScheduledMutator},
observers::StdMapObserver,
schedulers::RandScheduler,
stages::StdMutationalStage,
@ -44,7 +44,7 @@ fn main() {
let mut mgr = SimpleEventManager::new(monitor);
let mut executor = NyxExecutor::builder().build(helper, tuple_list!(observer));
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
// start fuzz

4
fuzzers/full_system/qemu_baremetal/src/fuzzer_breakpoint.rs
View File

@ -11,7 +11,7 @@ use libafl::{
fuzzer::{Fuzzer, StdFuzzer},
inputs::BytesInput,
monitors::MultiMonitor,
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::{CanTrack, HitcountsMapObserver, TimeObserver, VariableMapObserver},
schedulers::{IndexesLenTimeMinimizerScheduler, QueueScheduler},
stages::{CalibrationStage, StdMutationalStage},
@ -180,7 +180,7 @@ pub fn fuzz() {
let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);
// Setup an havoc mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let calibration_feedback = MaxMapFeedback::new(&edges_observer);
let mut stages = tuple_list!(
StdMutationalStage::new(mutator),

4
fuzzers/full_system/qemu_baremetal/src/fuzzer_low_level.rs
View File

@ -11,7 +11,7 @@ use libafl::{
fuzzer::{Fuzzer, StdFuzzer},
inputs::{BytesInput, HasTargetBytes},
monitors::MultiMonitor,
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::{CanTrack, HitcountsMapObserver, TimeObserver, VariableMapObserver},
schedulers::{IndexesLenTimeMinimizerScheduler, QueueScheduler},
stages::StdMutationalStage,
@ -262,7 +262,7 @@ pub fn fuzz() {
}
// Setup an havoc mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

4
fuzzers/full_system/qemu_baremetal/src/fuzzer_sync_exit.rs
View File

@ -10,7 +10,7 @@ use libafl::{
fuzzer::{Fuzzer, StdFuzzer},
inputs::BytesInput,
monitors::MultiMonitor,
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::{CanTrack, HitcountsMapObserver, TimeObserver, VariableMapObserver},
schedulers::{IndexesLenTimeMinimizerScheduler, QueueScheduler},
stages::{CalibrationStage, StdMutationalStage},
@ -118,7 +118,7 @@ pub fn fuzz() {
let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);
// Setup an havoc mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let calibration_feedback = MaxMapFeedback::new(&edges_observer);
let mut stages = tuple_list!(
StdMutationalStage::new(mutator),

6
fuzzers/full_system/qemu_linux_kernel/src/fuzzer.rs
View File

@ -14,7 +14,7 @@ use libafl::{
fuzzer::{Fuzzer, StdFuzzer},
inputs::{BytesInput, HasTargetBytes},
monitors::MultiMonitor,
mutators::{havoc_mutations, scheduled::StdScheduledMutator, I2SRandReplaceBinonly},
mutators::{havoc_mutations, scheduled::HavocScheduledMutator, I2SRandReplaceBinonly},
observers::{CanTrack, HitcountsMapObserver, TimeObserver, VariableMapObserver},
schedulers::{IndexesLenTimeMinimizerScheduler, QueueScheduler},
stages::{ShadowTracingStage, StdMutationalStage},
@ -227,13 +227,13 @@ pub fn fuzz() {
}
// a CmpLog-based mutational stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplaceBinonly::new()
)));
// Setup an havoc mutator with a mutational stage
let tracing = ShadowTracingStage::new();
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(tracing, i2s, StdMutationalStage::new(mutator),);
match fuzzer.fuzz_loop(&mut stages, &mut executor, &mut state, &mut mgr) {

6
fuzzers/full_system/qemu_linux_process/src/fuzzer.rs
View File

@ -14,7 +14,7 @@ use libafl::{
fuzzer::{Fuzzer, StdFuzzer},
inputs::{BytesInput, HasTargetBytes},
monitors::MultiMonitor,
mutators::{havoc_mutations, I2SRandReplaceBinonly, StdScheduledMutator},
mutators::{havoc_mutations, HavocScheduledMutator, I2SRandReplaceBinonly},
observers::{CanTrack, HitcountsMapObserver, TimeObserver, VariableMapObserver},
schedulers::{IndexesLenTimeMinimizerScheduler, QueueScheduler},
stages::{ShadowTracingStage, StdMutationalStage},
@ -235,13 +235,13 @@ pub fn fuzz() {
}
// a CmpLog-based mutational stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplaceBinonly::new()
)));
// Setup an havoc mutator with a mutational stage
let tracing = ShadowTracingStage::new();
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(tracing, i2s, StdMutationalStage::new(mutator),);
match fuzzer.fuzz_loop(&mut stages, &mut executor, &mut state, &mut mgr) {

4
fuzzers/full_system/unicorn/src/main.rs
View File

@ -10,7 +10,7 @@ use libafl::{
generators::RandBytesGenerator,
inputs::{BytesInput, HasTargetBytes},
monitors::MultiMonitor,
mutators::{havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations, scheduled::HavocScheduledMutator},
nonzero,
observers::{ConstMapObserver, HitcountsMapObserver, TimeObserver},
schedulers::QueueScheduler,
@ -310,7 +310,7 @@ fn fuzzer(should_emulate: bool, arch: Arch) {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

4
fuzzers/fuzz_anything/baby_fuzzer_wasm/src/lib.rs
View File

@ -9,7 +9,7 @@ use libafl::{
generators::RandPrintablesGenerator,
inputs::{BytesInput, HasTargetBytes},
monitors::SimpleMonitor,
mutators::{havoc_mutations, StdScheduledMutator},
mutators::{havoc_mutations, HavocScheduledMutator},
observers::StdMapObserver,
schedulers::QueueScheduler,
stages::{RetryCountRestartHelper, StdMutationalStage},
@ -143,7 +143,7 @@ pub fn fuzz() {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
while state.solutions().is_empty() {

4
fuzzers/fuzz_anything/baby_no_std/src/main.rs
View File

@ -18,7 +18,7 @@ use libafl::{
generators::RandPrintablesGenerator,
inputs::{BytesInput, HasTargetBytes},
monitors::SimpleMonitor,
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::ConstMapObserver,
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -148,7 +148,7 @@ pub extern "C" fn main(_argc: isize, _argv: *const *const u8) -> isize {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

9
fuzzers/fuzz_anything/libafl_atheris/src/lib.rs
View File

@ -23,7 +23,7 @@ use libafl::{
monitors::MultiMonitor,
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{tokens_mutations, StdScheduledMutator},
scheduled::{tokens_mutations, HavocScheduledMutator},
token_mutations::{I2SRandReplace, Tokens},
},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
@ -221,11 +221,12 @@ pub extern "C" fn LLVMFuzzerRunDriver(
let tracing = ShadowTracingStage::new();
// Setup a randomic Input2State stage
let i2s =
StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(I2SRandReplace::new())));
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
// Setup a basic mutator
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutational = StdMutationalStage::new(mutator);
// The order of the stages matter!

4
fuzzers/fuzz_anything/push_harness/src/main.rs
View File

@ -12,7 +12,7 @@ use libafl::{
generators::RandPrintablesGenerator,
inputs::{BytesInput, HasTargetBytes},
monitors::SimpleMonitor,
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::StdMapObserver,
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -101,7 +101,7 @@ fn input_generator() {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

4
fuzzers/fuzz_anything/push_stage_harness/src/main.rs
View File

@ -15,7 +15,7 @@ use libafl::{
fuzzer::StdFuzzer,
inputs::{BytesInput, HasTargetBytes},
monitors::SimpleMonitor,
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::StdMapObserver,
schedulers::{QueueScheduler, Scheduler},
stages::push::{PushStageSharedState, StdMutationalPushStage},
@ -89,7 +89,7 @@ pub fn main() {
// .expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let exit_kind = Rc::new(Cell::new(None));

6
fuzzers/inprocess/fuzzbench/src/lib.rs
View File

@ -26,7 +26,7 @@ use libafl::{
inputs::{BytesInput, HasTargetBytes},
monitors::SimpleMonitor,
mutators::{
StdMOptMutator, StdScheduledMutator, Tokens, havoc_mutations,
HavocScheduledMutator, StdMOptMutator, Tokens, havoc_mutations,
token_mutations::I2SRandReplace, tokens_mutations,
},
observers::{CanTrack, HitcountsMapObserver, TimeObserver},
@ -295,7 +295,9 @@ fn fuzz(
}
// Setup a randomic Input2State stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(I2SRandReplace::new())));
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
// Setup a MOPT mutator
let mutator = StdMOptMutator::new(

8
fuzzers/inprocess/fuzzbench_ctx/src/lib.rs
View File

@ -25,8 +25,8 @@ use libafl::{
inputs::{BytesInput, HasTargetBytes},
monitors::SimpleMonitor,
mutators::{
havoc_mutations, token_mutations::I2SRandReplace, tokens_mutations, StdMOptMutator,
StdScheduledMutator, Tokens,
havoc_mutations, token_mutations::I2SRandReplace, tokens_mutations, HavocScheduledMutator,
StdMOptMutator, Tokens,
},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
schedulers::{
@ -304,7 +304,9 @@ fn fuzz(
}
// Setup a randomic Input2State stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(I2SRandReplace::new())));
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
// Setup a MOPT mutator
let mutator = StdMOptMutator::new(

12
fuzzers/inprocess/fuzzbench_text/src/lib.rs
View File

@ -32,7 +32,7 @@ use libafl::{
},
havoc_mutations,
token_mutations::I2SRandReplace,
tokens_mutations, StdMOptMutator, StdScheduledMutator, Tokens,
tokens_mutations, HavocScheduledMutator, StdMOptMutator, Tokens,
},
observers::{CanTrack, HitcountsMapObserver, TimeObserver},
schedulers::{
@ -364,7 +364,9 @@ fn fuzz_binary(
}
// Setup a randomic Input2State stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(I2SRandReplace::new())));
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
// Setup a MOPT mutator
let mutator = StdMOptMutator::new(
@ -572,7 +574,9 @@ fn fuzz_text(
}
// Setup a randomic Input2State stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(I2SRandReplace::new())));
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
// Setup a MOPT mutator
let mutator = StdMOptMutator::new(
@ -585,7 +589,7 @@ fn fuzz_text(
let power: StdPowerMutationalStage<_, _, BytesInput, _, _, _> =
StdPowerMutationalStage::new(mutator);
let grimoire_mutator = StdScheduledMutator::with_max_stack_pow(
let grimoire_mutator = HavocScheduledMutator::with_max_stack_pow(
tuple_list!(
GrimoireExtensionMutator::new(),
GrimoireRecursiveReplacementMutator::new(),

4
fuzzers/inprocess/libfuzzer_libmozjpeg/src/lib.rs
View File

@ -17,7 +17,7 @@ use libafl::{
monitors::SimpleMonitor,
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{tokens_mutations, StdScheduledMutator},
scheduled::{tokens_mutations, HavocScheduledMutator},
token_mutations::Tokens,
},
observers::StdMapObserver,
@ -134,7 +134,7 @@ fn fuzz(corpus_dirs: &[PathBuf], objective_dir: PathBuf, broker_port: u16) -> Re
}
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
// A random policy to get testcasess from the corpus

4
fuzzers/inprocess/libfuzzer_libpng/src/lib.rs
View File

@ -16,7 +16,7 @@ use libafl::{
monitors::MultiMonitor,
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{tokens_mutations, StdScheduledMutator},
scheduled::{tokens_mutations, HavocScheduledMutator},
token_mutations::Tokens,
},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
@ -144,7 +144,7 @@ fn fuzz(corpus_dirs: &[PathBuf], objective_dir: PathBuf, broker_port: u16) -> Re
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let power: StdPowerMutationalStage<_, _, BytesInput, _, _, _> =
StdPowerMutationalStage::new(mutator);

4
fuzzers/inprocess/libfuzzer_libpng_accounting/src/lib.rs
View File

@ -17,7 +17,7 @@ use libafl::{
monitors::MultiMonitor,
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{tokens_mutations, StdScheduledMutator},
scheduled::{tokens_mutations, HavocScheduledMutator},
token_mutations::Tokens,
},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
@ -194,7 +194,7 @@ pub extern "C" fn libafl_main() {
}
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
// A minimization+queue policy to get testcasess from the corpus

4
fuzzers/inprocess/libfuzzer_libpng_centralized/src/lib.rs
View File

@ -20,7 +20,7 @@ use libafl::{
monitors::MultiMonitor,
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{tokens_mutations, StdScheduledMutator},
scheduled::{tokens_mutations, HavocScheduledMutator},
token_mutations::Tokens,
},
observers::{CanTrack, HitcountsMapObserver, TimeObserver},
@ -196,7 +196,7 @@ pub extern "C" fn libafl_main() {
}
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
// A minimization+queue policy to get testcasess from the corpus

4
fuzzers/inprocess/libfuzzer_libpng_cmin/src/lib.rs
View File

@ -19,7 +19,7 @@ use libafl::{
monitors::MultiMonitor,
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{tokens_mutations, StdScheduledMutator},
scheduled::{tokens_mutations, HavocScheduledMutator},
token_mutations::Tokens,
},
observers::{CanTrack, HitcountsMapObserver, TimeObserver},
@ -141,7 +141,7 @@ fn fuzz(corpus_dirs: &[PathBuf], objective_dir: PathBuf, broker_port: u16) -> Re
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let power: StdPowerMutationalStage<_, _, BytesInput, _, _, _> =
StdPowerMutationalStage::new(mutator);

4
fuzzers/inprocess/libfuzzer_libpng_launcher/src/lib.rs
View File

@ -17,7 +17,7 @@ use libafl::{
monitors::{MultiMonitor, OnDiskTomlMonitor},
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{tokens_mutations, StdScheduledMutator},
scheduled::{tokens_mutations, HavocScheduledMutator},
token_mutations::Tokens,
},
observers::{CanTrack, HitcountsMapObserver, TimeObserver},
@ -198,7 +198,7 @@ pub extern "C" fn libafl_main() {
}
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
// A minimization+queue policy to get testcasess from the corpus

4
fuzzers/inprocess/libfuzzer_libpng_norestart/src/lib.rs
View File

@ -22,7 +22,7 @@ use libafl::{
monitors::{MultiMonitor, OnDiskTomlMonitor},
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{tokens_mutations, StdScheduledMutator},
scheduled::{tokens_mutations, HavocScheduledMutator},
token_mutations::Tokens,
},
observers::{CanTrack, HitcountsMapObserver, TimeObserver},
@ -216,7 +216,7 @@ pub extern "C" fn libafl_main() {
}
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
// A minimization+queue policy to get testcasess from the corpus

4
fuzzers/inprocess/libfuzzer_libpng_tcp_manager/src/lib.rs
View File

@ -16,7 +16,7 @@ use libafl::{
monitors::MultiMonitor,
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{tokens_mutations, StdScheduledMutator},
scheduled::{tokens_mutations, HavocScheduledMutator},
token_mutations::Tokens,
},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
@ -141,7 +141,7 @@ fn fuzz(corpus_dirs: &[PathBuf], objective_dir: PathBuf, broker_port: u16) -> Re
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let power: StdPowerMutationalStage<_, _, BytesInput, _, _, _> =
StdPowerMutationalStage::new(mutator);

8
fuzzers/inprocess/libfuzzer_stb_image/src/main.rs
View File

@ -16,7 +16,7 @@ use libafl::{
inputs::{BytesInput, HasTargetBytes},
monitors::MultiMonitor,
mutators::{
havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator,
havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator,
token_mutations::I2SRandReplace,
},
observers::{CanTrack, TimeObserver},
@ -155,10 +155,12 @@ fn fuzz(corpus_dirs: &[PathBuf], objective_dir: PathBuf, broker_port: u16) -> Re
let tracing = ShadowTracingStage::new();
// Setup a randomic Input2State stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(I2SRandReplace::new())));
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
// Setup a basic mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mutational = StdMutationalStage::new(mutator);
// The order of the stages matter!

4
fuzzers/inprocess/libfuzzer_windows_asan/src/lib.rs
View File

@ -12,7 +12,7 @@ use libafl::{
monitors::MultiMonitor,
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{tokens_mutations, StdScheduledMutator},
scheduled::{tokens_mutations, HavocScheduledMutator},
},
observers::{CanTrack, HitcountsMapObserver, TimeObserver},
schedulers::{
@ -108,7 +108,7 @@ fn fuzz(corpus_dirs: &[PathBuf], objective_dir: PathBuf, broker_port: u16) -> Re
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let power: StdPowerMutationalStage<_, _, BytesInput, _, _, _> =
StdPowerMutationalStage::new(mutator);

4
fuzzers/inprocess/sqlite_centralized_multi_machine/src/lib.rs
View File

@ -20,7 +20,7 @@ use libafl::{
monitors::MultiMonitor,
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{tokens_mutations, StdScheduledMutator},
scheduled::{tokens_mutations, HavocScheduledMutator},
token_mutations::Tokens,
},
observers::{CanTrack, HitcountsMapObserver, TimeObserver},
@ -212,7 +212,7 @@ pub extern "C" fn libafl_main() {
}
// Setup a basic mutator with a mutational stage
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
// A minimization+queue policy to get testcasess from the corpus

4
fuzzers/structure_aware/baby_fuzzer_custom_input/src/main.rs
View File

@ -19,7 +19,7 @@ use libafl::{
feedbacks::{CrashFeedback, MaxMapFeedback},
fuzzer::{Fuzzer, StdFuzzer},
monitors::SimpleMonitor,
mutators::scheduled::StdScheduledMutator,
mutators::scheduled::HavocScheduledMutator,
observers::StdMapObserver,
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -197,7 +197,7 @@ pub fn main() {
.prepend(ToggleBooleanMutator);
// Scheduling layer for the mutations
let mutator_scheduler = StdScheduledMutator::new(mutators);
let mutator_scheduler = HavocScheduledMutator::new(mutators);
// Defining the mutator stage
let mut stages = tuple_list!(StdMutationalStage::new(mutator_scheduler));

4
fuzzers/structure_aware/baby_fuzzer_gramatron/src/main.rs
View File

@ -17,7 +17,7 @@ use libafl::{
monitors::SimpleMonitor,
mutators::{
GramatronRandomMutator, GramatronRecursionMutator, GramatronSpliceMutator,
StdScheduledMutator,
HavocScheduledMutator,
},
observers::StdMapObserver,
schedulers::QueueScheduler,
@ -145,7 +145,7 @@ pub fn main() {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::with_max_stack_pow(
let mutator = HavocScheduledMutator::with_max_stack_pow(
tuple_list!(
GramatronRandomMutator::new(&generator),
GramatronRandomMutator::new(&generator),

6
fuzzers/structure_aware/baby_fuzzer_grimoire/src/main.rs
View File

@ -11,7 +11,7 @@ use libafl::{
inputs::{BytesInput, GeneralizedInputMetadata, HasTargetBytes},
monitors::SimpleMonitor,
mutators::{
havoc_mutations, scheduled::StdScheduledMutator, GrimoireExtensionMutator,
havoc_mutations, scheduled::HavocScheduledMutator, GrimoireExtensionMutator,
GrimoireRandomDeleteMutator, GrimoireRecursiveReplacementMutator,
GrimoireStringReplacementMutator, Tokens,
},
@ -142,8 +142,8 @@ pub fn main() {
.expect("Failed to create the Executor");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::with_max_stack_pow(havoc_mutations(), 2);
let grimoire_mutator = StdScheduledMutator::with_max_stack_pow(
let mutator = HavocScheduledMutator::with_max_stack_pow(havoc_mutations(), 2);
let grimoire_mutator = HavocScheduledMutator::with_max_stack_pow(
tuple_list!(
GrimoireExtensionMutator::new(),
GrimoireRecursiveReplacementMutator::new(),

4
fuzzers/structure_aware/baby_fuzzer_multi/src/main.rs
View File

@ -14,7 +14,7 @@ use libafl::{
feedbacks::{CrashFeedback, MaxMapFeedback, MinMapFeedback},
fuzzer::{Fuzzer, StdFuzzer},
inputs::{BytesInput, HasTargetBytes, MultipartInput},
mutators::{havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator},
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
observers::ConstMapObserver,
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -152,7 +152,7 @@ pub fn main() {
.unwrap();
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
fuzzer

5
fuzzers/structure_aware/baby_fuzzer_nautilus/src/main.rs
View File

@ -13,7 +13,8 @@ use libafl::{
inputs::NautilusInput,
monitors::SimpleMonitor,
mutators::{
NautilusRandomMutator, NautilusRecursionMutator, NautilusSpliceMutator, StdScheduledMutator,
HavocScheduledMutator, NautilusRandomMutator, NautilusRecursionMutator,
NautilusSpliceMutator,
},
observers::StdMapObserver,
schedulers::QueueScheduler,
@ -145,7 +146,7 @@ pub fn main() {
}
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::with_max_stack_pow(
let mutator = HavocScheduledMutator::with_max_stack_pow(
tuple_list!(
NautilusRandomMutator::new(&context),
NautilusRandomMutator::new(&context),

4
fuzzers/structure_aware/baby_fuzzer_tokens/src/main.rs
View File

@ -10,7 +10,7 @@ use libafl::{
fuzzer::{Evaluator, Fuzzer, StdFuzzer},
inputs::{EncodedInput, InputDecoder, InputEncoder, NaiveTokenizer, TokenInputEncoderDecoder},
monitors::SimpleMonitor,
mutators::{encoded_mutations::encoded_mutations, scheduled::StdScheduledMutator},
mutators::{encoded_mutations::encoded_mutations, scheduled::HavocScheduledMutator},
observers::StdMapObserver,
schedulers::QueueScheduler,
stages::mutational::StdMutationalStage,
@ -119,7 +119,7 @@ pub fn main() {
.expect("Failed to create the Executor");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::with_max_stack_pow(encoded_mutations(), 2);
let mutator = HavocScheduledMutator::with_max_stack_pow(encoded_mutations(), 2);
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
println!("Decoder {:?} ...", &encoder_decoder);

6
fuzzers/structure_aware/forkserver_simple_nautilus/src/main.rs
View File

@ -15,8 +15,8 @@ use libafl::{
inputs::{NautilusInput, NautilusTargetBytesConverter},
monitors::SimpleMonitor,
mutators::{
NautilusRandomMutator, NautilusRecursionMutator, NautilusSpliceMutator,
StdScheduledMutator, Tokens,
HavocScheduledMutator, NautilusRandomMutator, NautilusRecursionMutator,
NautilusSpliceMutator, Tokens,
},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
schedulers::{IndexesLenTimeMinimizerScheduler, QueueScheduler},
@ -207,7 +207,7 @@ pub fn main() {
state.add_metadata(tokens);
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::with_max_stack_pow(
let mutator = HavocScheduledMutator::with_max_stack_pow(
tuple_list!(
NautilusRandomMutator::new(&context),
NautilusRandomMutator::new(&context),

8
fuzzers/structure_aware/libfuzzer_stb_image_concolic/fuzzer/src/main.rs
View File

@ -20,7 +20,7 @@ use libafl::{
inputs::{BytesInput, HasTargetBytes, Input},
monitors::MultiMonitor,
mutators::{
havoc_mutations::havoc_mutations, scheduled::StdScheduledMutator,
havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator,
token_mutations::I2SRandReplace,
},
observers::{
@ -193,10 +193,12 @@ fn fuzz(
let tracing = ShadowTracingStage::new();
// Setup a randomic Input2State stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(I2SRandReplace::new())));
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
// Setup a basic mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mutational = StdMutationalStage::new(mutator);
if concolic {

5
fuzzers/structure_aware/nautilus_sync/src/lib.rs
View File

@ -18,7 +18,8 @@ use libafl::{
inputs::{NautilusInput, NautilusToBytesInputConverter},
monitors::SimpleMonitor,
mutators::{
NautilusRandomMutator, NautilusRecursionMutator, NautilusSpliceMutator, StdScheduledMutator,
HavocScheduledMutator, NautilusRandomMutator, NautilusRecursionMutator,
NautilusSpliceMutator,
},
none_input_converter,
schedulers::QueueScheduler,
@ -216,7 +217,7 @@ pub extern "C" fn libafl_main() {
.expect("Failed to generate the initial corpus");
// Setup a mutational stage with a basic bytes mutator
let mutator = StdScheduledMutator::with_max_stack_pow(
let mutator = HavocScheduledMutator::with_max_stack_pow(
tuple_list!(
NautilusRandomMutator::new(&context),
NautilusRandomMutator::new(&context),

4
libafl/src/lib.rs
View File

@ -124,7 +124,7 @@ mod tests {
fuzzer::Fuzzer,
inputs::BytesInput,
monitors::SimpleMonitor,
mutators::{StdScheduledMutator, mutations::BitFlipMutator},
mutators::{HavocScheduledMutator, mutations::BitFlipMutator},
schedulers::RandScheduler,
stages::StdMutationalStage,
state::{HasCorpus, StdState},
@ -178,7 +178,7 @@ mod tests {
)
.unwrap();
let mutator = StdScheduledMutator::new(tuple_list!(BitFlipMutator::new()));
let mutator = HavocScheduledMutator::new(tuple_list!(BitFlipMutator::new()));
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
for i in 0..1000 {

155
libafl/src/mutators/scheduled.rs
View File

@ -99,19 +99,18 @@ where
/// A [`Mutator`] that schedules one of the embedded mutations on each call.
#[derive(Debug)]
pub struct StdScheduledMutator<MT> {
pub struct SingleChoiceScheduledMutator<MT> {
name: Cow<'static, str>,
mutations: MT,
max_stack_pow: usize,
}
impl<MT> Named for StdScheduledMutator<MT> {
impl<MT> Named for SingleChoiceScheduledMutator<MT> {
fn name(&self) -> &Cow<'static, str> {
&self.name
}
}
impl<I, MT, S> Mutator<I, S> for StdScheduledMutator<MT>
impl<I, MT, S> Mutator<I, S> for SingleChoiceScheduledMutator<MT>
where
MT: MutatorsTuple<I, S>,
S: HasRand,
@ -122,7 +121,7 @@ where
}
}
impl<MT> ComposedByMutations for StdScheduledMutator<MT> {
impl<MT> ComposedByMutations for SingleChoiceScheduledMutator<MT> {
type Mutations = MT;
/// Get the mutations
#[inline]
@ -137,7 +136,85 @@ impl<MT> ComposedByMutations for StdScheduledMutator<MT> {
}
}
impl<I, MT, S> ScheduledMutator<I, S> for StdScheduledMutator<MT>
impl<I, MT, S> ScheduledMutator<I, S> for SingleChoiceScheduledMutator<MT>
where
MT: MutatorsTuple<I, S>,
S: HasRand,
{
/// Compute the number of iterations used to apply stacked mutations
fn iterations(&self, _state: &mut S, _: &I) -> u64 {
1
}
/// Get the next mutation to apply
fn schedule(&self, state: &mut S, _: &I) -> MutationId {
debug_assert_ne!(self.mutations.len(), 0);
// # Safety
// We check for empty mutations
state
.rand_mut()
.below(unsafe { NonZero::new(self.mutations.len()).unwrap_unchecked() })
.into()
}
}
impl<MT> SingleChoiceScheduledMutator<MT>
where
MT: NamedTuple,
{
/// Create a new [`SingleChoiceScheduledMutator`] instance specifying mutations
pub fn new(mutations: MT) -> Self {
SingleChoiceScheduledMutator {
name: Cow::from(format!(
"SingleChoiceScheduledMutator[{}]",
mutations.names().join(", ")
)),
mutations,
}
}
}
/// A [`Mutator`] that stacks embedded mutations in a havoc manner on each call.
#[derive(Debug)]
pub struct HavocScheduledMutator<MT> {
name: Cow<'static, str>,
mutations: MT,
max_stack_pow: usize,
}
impl<MT> Named for HavocScheduledMutator<MT> {
fn name(&self) -> &Cow<'static, str> {
&self.name
}
}
impl<I, MT, S> Mutator<I, S> for HavocScheduledMutator<MT>
where
MT: MutatorsTuple<I, S>,
S: HasRand,
{
#[inline]
fn mutate(&mut self, state: &mut S, input: &mut I) -> Result<MutationResult, Error> {
self.scheduled_mutate(state, input)
}
}
impl<MT> ComposedByMutations for HavocScheduledMutator<MT> {
type Mutations = MT;
/// Get the mutations
#[inline]
fn mutations(&self) -> &MT {
&self.mutations
}
// Get the mutations (mutable)
#[inline]
fn mutations_mut(&mut self) -> &mut MT {
&mut self.mutations
}
}
impl<I, MT, S> ScheduledMutator<I, S> for HavocScheduledMutator<MT>
where
MT: MutatorsTuple<I, S>,
S: HasRand,
@ -159,15 +236,15 @@ where
}
}
impl<MT> StdScheduledMutator<MT>
impl<MT> HavocScheduledMutator<MT>
where
MT: NamedTuple,
{
/// Create a new [`StdScheduledMutator`] instance specifying mutations
/// Create a new [`HavocScheduledMutator`] instance specifying mutations
pub fn new(mutations: MT) -> Self {
StdScheduledMutator {
HavocScheduledMutator {
name: Cow::from(format!(
"StdScheduledMutator[{}]",
"HavocScheduledMutator[{}]",
mutations.names().join(", ")
)),
mutations,
@ -175,15 +252,12 @@ where
}
}
/// Create a new [`StdScheduledMutator`] instance specifying mutations and the maximun number of iterations
///
/// # Errors
/// Will return [`Error::IllegalArgument`] for `max_stack_pow` of 0.
/// Create a new [`HavocScheduledMutator`] instance specifying mutations and the maximun number of iterations
#[inline]
pub fn with_max_stack_pow(mutations: MT, max_stack_pow: usize) -> Self {
Self {
name: Cow::from(format!(
"StdScheduledMutator[{}]",
"HavocScheduledMutator[{}]",
mutations.names().join(", ")
)),
mutations,
@ -198,7 +272,7 @@ pub fn tokens_mutations() -> tuple_list_type!(TokenInsert, TokenReplace) {
tuple_list!(TokenInsert::new(), TokenReplace::new())
}
/// A logging [`Mutator`] that wraps around a [`StdScheduledMutator`].
/// A logging [`Mutator`] that wraps around a [`HavocScheduledMutator`].
#[derive(Debug)]
pub struct LoggerScheduledMutator<SM> {
name: Cow<'static, str>,
@ -317,8 +391,10 @@ mod tests {
feedbacks::ConstFeedback,
inputs::{BytesInput, HasMutatorBytes},
mutators::{
Mutator, havoc_mutations::havoc_mutations, mutations::SpliceMutator,
scheduled::StdScheduledMutator,
Mutator,
havoc_mutations::havoc_mutations,
mutations::SpliceMutator,
scheduled::{HavocScheduledMutator, SingleChoiceScheduledMutator},
},
state::StdState,
};
@ -379,7 +455,7 @@ mod tests {
)
.unwrap();
let mut havoc = StdScheduledMutator::new(havoc_mutations());
let mut havoc = HavocScheduledMutator::new(havoc_mutations());
assert_eq!(input, input_prior);
@ -397,4 +473,45 @@ mod tests {
assert_ne!(equal_in_a_row, 5);
}
}
#[test]
fn test_single_choice() {
let rand = StdRand::with_seed(0x1337);
let mut corpus: InMemoryCorpus<BytesInput> = InMemoryCorpus::new();
corpus.add(Testcase::new(b"abc".to_vec().into())).unwrap();
corpus.add(Testcase::new(b"def".to_vec().into())).unwrap();
let mut input = corpus.cloned_input_for_id(corpus.first().unwrap()).unwrap();
let input_prior = input.clone();
let mut feedback = ConstFeedback::new(false);
let mut objective = ConstFeedback::new(false);
let mut state = StdState::new(
rand,
corpus,
InMemoryCorpus::new(),
&mut feedback,
&mut objective,
)
.unwrap();
let mut mutator = SingleChoiceScheduledMutator::new(havoc_mutations());
assert_eq!(input, input_prior);
let mut equal_in_a_row = 0;
for _ in 0..100 {
mutator.mutate(&mut state, &mut input).unwrap();
// Make sure we actually mutate something, at least sometimes
equal_in_a_row = if input == input_prior {
equal_in_a_row + 1
} else {
0
};
assert_ne!(equal_in_a_row, 20);
}
}
}

4
libafl_frida/src/lib.rs
View File

@ -341,7 +341,7 @@ mod tests {
feedback_and_fast, feedback_or_fast,
feedbacks::ConstFeedback,
inputs::{BytesInput, HasTargetBytes},
mutators::{StdScheduledMutator, mutations::BitFlipMutator},
mutators::{HavocScheduledMutator, mutations::BitFlipMutator},
schedulers::StdScheduler,
stages::StdMutationalStage,
state::{HasSolutions, StdState},
@ -517,7 +517,7 @@ mod tests {
Rc::clone(&frida_helper),
);
let mutator = StdScheduledMutator::new(tuple_list!(BitFlipMutator::new()));
let mutator = HavocScheduledMutator::new(tuple_list!(BitFlipMutator::new()));
let mut stages = tuple_list!(StdMutationalStage::with_max_iterations(
mutator,
NonZero::new(1).unwrap()

22
libafl_libfuzzer/runtime/src/lib.rs
View File

@ -156,7 +156,7 @@ macro_rules! fuzz_with {
mutators::{
GrimoireExtensionMutator, GrimoireRecursiveReplacementMutator, GrimoireRandomDeleteMutator,
GrimoireStringReplacementMutator, havoc_crossover, havoc_mutations, havoc_mutations_no_crossover,
I2SRandReplace, StdScheduledMutator, UnicodeCategoryRandMutator, UnicodeSubcategoryRandMutator,
I2SRandReplace, HavocScheduledMutator, UnicodeCategoryRandMutator, UnicodeSubcategoryRandMutator,
UnicodeCategoryTokenReplaceMutator, UnicodeSubcategoryTokenReplaceMutator, Tokens, tokens_mutations,
UnicodeInput,
},
@ -302,7 +302,7 @@ macro_rules! fuzz_with {
// Set up a string category analysis stage for unicode mutations
let unicode_used = $options.unicode();
let unicode_mutator = StdScheduledMutator::new(
let unicode_mutator = HavocScheduledMutator::new(
tuple_list!(
UnicodeCategoryRandMutator,
UnicodeSubcategoryRandMutator,
@ -311,7 +311,7 @@ macro_rules! fuzz_with {
UnicodeSubcategoryRandMutator,
)
);
let unicode_replace_mutator = StdScheduledMutator::new(
let unicode_replace_mutator = HavocScheduledMutator::new(
tuple_list!(
UnicodeCategoryTokenReplaceMutator,
UnicodeSubcategoryTokenReplaceMutator,
@ -345,17 +345,17 @@ macro_rules! fuzz_with {
// Setup a randomic Input2State stage, conditionally within a custom mutator
let i2s =
StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(I2SRandReplace::new())));
StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(I2SRandReplace::new())));
let i2s = IfStage::new(|_, _, _, _| Ok((!mutator_status.custom_mutation).into()), (i2s, ()));
let cm_i2s = StdMutationalStage::new(unsafe {
LLVMCustomMutator::mutate_unchecked(StdScheduledMutator::new(tuple_list!(
LLVMCustomMutator::mutate_unchecked(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)))
});
let cm_i2s = IfStage::new(|_, _, _, _| Ok(mutator_status.custom_mutation.into()), (cm_i2s, ()));
// TODO configure with mutation stacking options from libfuzzer
let std_mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let std_mutator = HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let std_power: StdPowerMutationalStage<_, _, BytesInput, _, _, _> = StdPowerMutationalStage::new(std_mutator);
let std_power = IfStage::new(|_, _, _, _| Ok(mutator_status.std_mutational.into()), (std_power, ()));
@ -374,10 +374,10 @@ macro_rules! fuzz_with {
// we opt not to use crossover in the LLVMFuzzerMutate and instead have a second crossover pass,
// though it is likely an error for fuzzers to provide custom mutators but not custom crossovers
let custom_mutator = unsafe {
LLVMCustomMutator::mutate_unchecked(StdScheduledMutator::new(havoc_mutations_no_crossover().merge(tokens_mutations())))
LLVMCustomMutator::mutate_unchecked(HavocScheduledMutator::new(havoc_mutations_no_crossover().merge(tokens_mutations())))
};
// Safe to unwrap: stack pow is not 0.
let std_mutator_no_mutate = StdScheduledMutator::with_max_stack_pow(havoc_crossover(),3);
let std_mutator_no_mutate = HavocScheduledMutator::with_max_stack_pow(havoc_crossover(),3);
let cm_power: StdPowerMutationalStage<_, _, BytesInput, _, _, _> = StdPowerMutationalStage::new(custom_mutator);
let cm_power = IfStage::new(|_, _, _, _| Ok(mutator_status.custom_mutation.into()), (cm_power, ()));
@ -390,12 +390,12 @@ macro_rules! fuzz_with {
// we handle it here explicitly anyways
// Safe to unwrap: stack pow is not 0.
let custom_crossover = unsafe {
LLVMCustomMutator::crossover_unchecked(StdScheduledMutator::with_max_stack_pow(
LLVMCustomMutator::crossover_unchecked(HavocScheduledMutator::with_max_stack_pow(
havoc_mutations_no_crossover().merge(tokens_mutations()),
3,
))
};
let std_mutator_no_crossover = StdScheduledMutator::new(havoc_mutations_no_crossover().merge(tokens_mutations()));
let std_mutator_no_crossover = HavocScheduledMutator::new(havoc_mutations_no_crossover().merge(tokens_mutations()));
let cc_power = StdMutationalStage::new(custom_crossover);
let cc_power = IfStage::new(|_, _, _, _| Ok(mutator_status.custom_crossover.into()), (cc_power, ()));
@ -404,7 +404,7 @@ macro_rules! fuzz_with {
IfStage::new(|_, _, _, _| Ok(mutator_status.std_no_crossover.into()), (cc_std_power, ()));
// Safe to unwrap: stack pow is not 0.
let grimoire_mutator = StdScheduledMutator::with_max_stack_pow(
let grimoire_mutator = HavocScheduledMutator::with_max_stack_pow(
tuple_list!(
GrimoireExtensionMutator::new(),
GrimoireRecursiveReplacementMutator::new(),

6
libafl_libfuzzer/runtime/src/tmin.rs
View File

@ -10,7 +10,7 @@ use libafl::{
executors::{ExitKind, inprocess_fork::InProcessForkExecutor},
feedbacks::{CrashFeedback, TimeoutFeedback},
inputs::{BytesInput, HasMutatorBytes, HasTargetBytes},
mutators::{Mutator, StdScheduledMutator, havoc_mutations_no_crossover},
mutators::{HavocScheduledMutator, Mutator, havoc_mutations_no_crossover},
schedulers::QueueScheduler,
stages::StdTMinMutationalStage,
state::{HasCorpus, StdState},
@ -165,13 +165,13 @@ pub fn minimize_crash(
// TODO configure with mutation stacking options from libfuzzer
if mutator_status.custom_mutation {
let custom_mutator = unsafe {
LLVMCustomMutator::mutate_unchecked(StdScheduledMutator::new(
LLVMCustomMutator::mutate_unchecked(HavocScheduledMutator::new(
havoc_mutations_no_crossover(),
))
};
minimize_crash_with_mutator(options, harness, custom_mutator, state)
} else {
let std_mutator = StdScheduledMutator::new(havoc_mutations_no_crossover());
let std_mutator = HavocScheduledMutator::new(havoc_mutations_no_crossover());
minimize_crash_with_mutator(options, harness, std_mutator, state)
}
}

7
libafl_sugar/src/forkserver.rs
View File

@ -15,7 +15,7 @@ use libafl::{
monitors::MultiMonitor,
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{StdScheduledMutator, tokens_mutations},
scheduled::{HavocScheduledMutator, tokens_mutations},
token_mutations::Tokens,
},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
@ -247,7 +247,8 @@ impl ForkserverBytesCoverageSugar<'_> {
if self.tokens_file.is_some() {
// Setup a basic mutator
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator =
HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutational = StdMutationalStage::new(mutator);
// The order of the stages matter!
@ -268,7 +269,7 @@ impl ForkserverBytesCoverageSugar<'_> {
}
} else {
// Setup a basic mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mutational = StdMutationalStage::new(mutator);
// The order of the stages matter!

9
libafl_sugar/src/inmemory.rs
View File

@ -21,7 +21,7 @@ use libafl::{
monitors::MultiMonitor,
mutators::{
havoc_mutations::havoc_mutations,
scheduled::{StdScheduledMutator, tokens_mutations},
scheduled::{HavocScheduledMutator, tokens_mutations},
token_mutations::{I2SRandReplace, Tokens},
},
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
@ -264,13 +264,14 @@ where
let tracing = ShadowTracingStage::new();
// Setup a randomic Input2State stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
if self.tokens_file.is_some() {
// Setup a basic mutator
let mutator = StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutator =
HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutational = StdMutationalStage::new(mutator);
// The order of the stages matter!
@ -307,7 +308,7 @@ where
}
} else {
// Setup a basic mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mutational = StdMutationalStage::new(mutator);
// The order of the stages matter!

12
libafl_sugar/src/qemu.rs
View File

@ -20,7 +20,7 @@ use libafl::{
mutators::{
I2SRandReplace,
havoc_mutations::havoc_mutations,
scheduled::{StdScheduledMutator, tokens_mutations},
scheduled::{HavocScheduledMutator, tokens_mutations},
token_mutations::Tokens,
},
observers::{CanTrack, HitcountsMapObserver, TimeObserver, VariableMapObserver},
@ -302,14 +302,14 @@ where
let tracing = ShadowTracingStage::new();
// Setup a randomic Input2State stage
let i2s = StdMutationalStage::new(StdScheduledMutator::new(tuple_list!(
let i2s = StdMutationalStage::new(HavocScheduledMutator::new(tuple_list!(
I2SRandReplace::new()
)));
if self.tokens_file.is_some() {
// Setup a basic mutator
let mutator =
StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutational = StdMutationalStage::new(mutator);
// The order of the stages matter!
@ -330,7 +330,7 @@ where
}
} else {
// Setup a basic mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mutational = StdMutationalStage::new(mutator);
// The order of the stages matter!
@ -423,7 +423,7 @@ where
if self.tokens_file.is_some() {
// Setup a basic mutator
let mutator =
StdScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
HavocScheduledMutator::new(havoc_mutations().merge(tokens_mutations()));
let mutational = StdMutationalStage::new(mutator);
// The order of the stages matter!
@ -444,7 +444,7 @@ where
}
} else {
// Setup a basic mutator
let mutator = StdScheduledMutator::new(havoc_mutations());
let mutator = HavocScheduledMutator::new(havoc_mutations());
let mutational = StdMutationalStage::new(mutator);
// The order of the stages matter!