SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix baby fuzzer

Browse Source
This commit is contained in:
Andrea Fioraldi 2021-04-26 09:41:35 +02:00
parent b7de33e922
commit f25862cb90
2 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
fuzzers/baby_fuzzer/README.md
View File

@ -1,3 +1,7 @@
# Baby fuzzer # Baby fuzzer
This is a minimalistic example about how to create a libafl based fuzzer.
It runs on a single core until a crash occurs and then exits.
The tested program is a simple Rust function without any instrumentation.

13
fuzzers/baby_fuzzer/src/main.rs
View File

@ -16,16 +16,21 @@ use libafl::{
utils::{current_nanos, StdRand}, utils::{current_nanos, StdRand},
}; };
// Coverage map with explicit assignments due to the lack of instrumentation
static mut SIGNALS: [u8; 16] = [0; 16]; static mut SIGNALS: [u8; 16] = [0; 16];
fn signals_set(idx: usize) {
unsafe { SIGNALS[idx] = 1 };
}
pub fn main() { pub fn main() {
// The closure that we want to fuzz // The closure that we want to fuzz
let mut harness = |buf: &[u8]| { let mut harness = |buf: &[u8]| {
unsafe { SIGNALS[0] = 1 }; signals_set(0);
if buf.len() > 0 && buf[0] == 'a' as u8 { if buf.len() > 0 && buf[0] == 'a' as u8 {
unsafe { SIGNALS[1] = 1 }; signals_set(1);
if buf.len() > 1 && buf[1] == 'b' as u8 { if buf.len() > 1 && buf[1] == 'b' as u8 {
unsafe { SIGNALS[2] = 1 }; signals_set(2);
if buf.len() > 2 && buf[2] == 'c' as u8 { if buf.len() > 2 && buf[2] == 'c' as u8 {
panic!("=)"); panic!("=)");
} }
@ -52,7 +57,7 @@ pub fn main() {
// Corpus that will be evolved, we keep it in memory for performance // Corpus that will be evolved, we keep it in memory for performance
InMemoryCorpus::new(), InMemoryCorpus::new(),
// Feedbacks to rate the interestingness of an input // Feedbacks to rate the interestingness of an input
tuple_list!(MaxMapFeedback::new(&observer)), tuple_list!(MaxMapFeedback::new_with_observer(&observer)),
// Corpus in which we store solutions (crashes in this example), // Corpus in which we store solutions (crashes in this example),
// on disk so the user can get them after stopping the fuzzer // on disk so the user can get them after stopping the fuzzer
OnDiskCorpus::new(PathBuf::from("./crashes")).unwrap(), OnDiskCorpus::new(PathBuf::from("./crashes")).unwrap(),