remove dummy example

This commit is contained in:
Andrea Fioraldi 2021-02-23 20:56:04 +01:00
parent 5695b4326a
commit ef40abb4b0
4 changed files with 0 additions and 149 deletions

View File

@ -1 +0,0 @@
libpng-*

View File

@ -1,30 +0,0 @@
[package]
name = "libfuzzer_dummy"
version = "0.1.0"
authors = ["Andrea Fioraldi <andreafioraldi@gmail.com>", "Dominik Maier <domenukk@gmail.com>"]
edition = "2018"
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
[features]
default = ["std"]
std = []
[profile.release]
lto = true
codegen-units = 1
opt-level = 3
debug = true
[build-dependencies]
cc = { version = "1.0", features = ["parallel"] }
num_cpus = "1.0"
[dependencies]
libafl = { path = "../../libafl/" }
[[bin]]
name = "libfuzzer_dummy"
path = "./src/mod.rs"
test = false
bench = false

View File

@ -1 +0,0 @@
0000

View File

@ -1,117 +0,0 @@
//! A libfuzzer-like fuzzer with llmp-multithreading support and restarts
//! The example harness is built for libpng.
use std::{path::PathBuf};
use std::io::{self, BufRead};
use libafl::{
bolts::{tuples::tuple_list, shmem::UnixShMem},
corpus::{Corpus, InMemoryCorpus},
events::setup_restarting_mgr,
stats::{SimpleStats},
executors::{inprocess::InProcessExecutor, Executor, ExitKind},
feedbacks::{CrashFeedback, MaxMapFeedback},
inputs::Input,
mutators::{scheduled::HavocBytesMutator, HasMaxSize},
observers::StdMapObserver,
stages::mutational::StdMutationalStage,
state::{HasCorpus, State},
utils::StdRand,
Error, Fuzzer, StdFuzzer,
};
/// The name of the coverage map observer, to find it again in the observer list
const NAME_COV_MAP: &str = "cov_map";
static mut EDGES_MAP: [u8; 32] = [0; 32];
static EDGES_SIZE: u32 = 32;
/// The wrapped harness function, calling out to the llvm-style libfuzzer harness
fn harness<E, I>(_executor: &E, buf: &[u8]) -> ExitKind
where
E: Executor<I>,
I: Input,
{
//println!("{:?}", buf);
unsafe {
EDGES_MAP[0] = 1;
if buf.len() > 0 && buf[0] == 'a' as u8 {
EDGES_MAP[2] = 1;
if buf.len() > 1 && buf[1] == 'b' as u8 {
EDGES_MAP[3] = 1;
//std::process::abort();
}
}
}
ExitKind::Ok
}
/// The main fn, parsing parameters, and starting the fuzzer
pub fn main() {
fuzz(Some(vec![PathBuf::from("./corpus")]), 1337).expect("An error occurred while fuzzing");
}
/// The actual fuzzer
fn fuzz(input: Option<Vec<PathBuf>>, broker_port: u16) -> Result<(), Error> {
let mut rand = StdRand::new(0);
// 'While the stats are state, they are usually used in the broker - which is likely never restarted
let stats = SimpleStats::new(|s| println!("{}", s));
println!("NEW START");
let stdin = io::stdin();
let _ = stdin.lock().lines().next().unwrap().unwrap();
// The restarting state will spawn the same process again as child, then restartet it each time it crashes.
let (state_opt, mut restarting_mgr) =
setup_restarting_mgr::<_, _, _, _, _, _, UnixShMem, _>(stats, broker_port).expect("Failed to setup the restarter".into());
let edges_observer =
StdMapObserver::new_from_ptr(&NAME_COV_MAP, unsafe { &mut EDGES_MAP[0] as *mut u8 }, EDGES_SIZE as usize);
let mut state = match state_opt {
Some(s) => s,
None => {
State::new(
InMemoryCorpus::new(),
tuple_list!(MaxMapFeedback::new_with_observer(
&NAME_COV_MAP,
&edges_observer
)),
InMemoryCorpus::new(),
tuple_list!(CrashFeedback::new()),
)
},
};
println!("We're a client, let's fuzz :)");
let mut mutator = HavocBytesMutator::default();
mutator.set_max_size(4096);
let stage = StdMutationalStage::new(mutator);
let mut fuzzer = StdFuzzer::new(tuple_list!(stage));
// Create the executor
let mut executor = InProcessExecutor::new(
"Libfuzzer",
harness,
tuple_list!(edges_observer),
&mut state,
&mut restarting_mgr,
);
// The actual target run starts here.
// in case the corpus is empty (on first run), reset
if state.corpus().count() < 1 {
match input {
Some(x) => state
.load_initial_inputs(&mut executor, &mut restarting_mgr, &x)
.expect(&format!("Failed to load initial corpus at {:?}", &x)),
None => (),
}
println!("We imported {} inputs from disk.", state.corpus().count());
}
fuzzer.fuzz_loop(&mut rand, &mut executor, &mut state, &mut restarting_mgr)
}