SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

WIP: add simple interrupt time randomizer

Browse Source
This commit is contained in:
Alwin Berger 2023-04-21 17:11:18 +02:00
parent 8a79e12f91
commit a8a6c175c8
3 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fuzzers/FRET/src/clock.rs
View File

@ -212,7 +212,7 @@ where
{
// TODO Replace with match_name_type when stable
let observer = observers.match_name::<QemuClockObserver>(self.name()).unwrap();
self.exec_time = Some(Duration::from_nanos(observer.last_runtime() << 3)); // Assume a somewhat realistic multiplier of clock, it does not matter
self.exec_time = Some(Duration::from_nanos(observer.last_runtime() << 4)); // Assume a somewhat realistic multiplier of clock, it does not matter
Ok(false)
}

6
fuzzers/FRET/src/fuzzer.rs
View File

@ -358,9 +358,9 @@ pub fn fuzz() {
let mutations = havoc_mutations();
// Setup an havoc mutator with a mutational stage
let mutator = StdScheduledMutator::new(mutations);
#[cfg(not(all(feature = "feed_systemtrace", feature = "fuzz_int")))]
let mut stages = tuple_list!(StdMutationalStage::new(mutator));
#[cfg(all(feature = "feed_systemtrace", feature = "fuzz_int"))]
// #[cfg(not(all(feature = "feed_systemtrace", feature = "fuzz_int")))]
// let mut stages = tuple_list!(StdMutationalStage::new(mutator));
// #[cfg(all(feature = "feed_systemtrace", feature = "fuzz_int"))]
let mut stages = tuple_list!(StdMutationalStage::new(mutator),MyStateStage::new());
if env::var("DO_SHOWMAP").is_ok() {

10
fuzzers/FRET/src/mutational.rs
View File

@ -248,7 +248,7 @@ where
let mut suffix = target_bytes.split_off(4 * num_interrupts);
let mut prefix : Vec<[u8; 4]> = vec![];
// let mut suffix : Vec<u8> = vec![];
// #[cfg(feature = "feed_systemtrace")]
#[cfg(feature = "feed_systemtrace")]
{
let tmp = _input.metadata().get::<FreeRTOSSystemStateMetadata>();
if tmp.is_some() {
@ -349,6 +349,14 @@ where
}
}
}
#[cfg(not(feature = "feed_systemtrace"))]
{
let maxtick : u64 = (_input.exec_time().expect("No duration found").as_nanos() >> 4).try_into().unwrap();
let mut numbers : Vec<u32> = vec![];
for i in 0..num_interrupts {
prefix.push(u32::to_le_bytes(myrand.between(0, maxtick)));
}
}
let mut n : Vec<u8> = vec![];
n = [prefix.concat(), suffix].concat();