Compare commits

...

10 Commits

Author SHA1 Message Date
a3d99d79a2 fixup! AE results; migrate orgs 2025-09-26 16:17:36 +00:00
0217d9ab78 AE results; migrate orgs 2025-09-26 16:07:12 +00:00
a3707931ba add fixes 2025-09-15 13:45:02 +00:00
979202b7c8 prepare re-run of plot scripts 2025-09-11 07:32:50 +00:00
9531dc1ac0 run_eval.sh: use values a default 2025-09-11 07:31:16 +00:00
892d4f85ce submodule ssh -> https 2025-09-11 08:11:37 +02:00
2454f8d316 update revs 2025-08-18 12:37:08 +00:00
77b94213a9 update 2025-08-18 08:59:01 +00:00
4314103038 update revs 2025-08-16 08:16:39 +00:00
009469766c AE++ 2025-08-16 07:57:08 +00:00
8 changed files with 34 additions and 19 deletions

6
.gitmodules vendored
View File

@ -1,10 +1,10 @@
[submodule "LibAFL"]
path = LibAFL
url = ssh://git@git.cs.tu-dortmund.de:2222/alwin.berger/FRET-LibAFL.git
url = https://git.cs.tu-dortmund.de/SYS-OSS/FRET-LibAFL.git
[submodule "qemu-libafl-bridge"]
path = qemu-libafl-bridge
url = ssh://git@git.cs.tu-dortmund.de:2222/alwin.berger/FRET-qemu.git
url = https://git.cs.tu-dortmund.de/SYS-OSS/FRET-qemu.git
[submodule "FreeRTOS"]
path = FreeRTOS
url = ssh://git@git.cs.tu-dortmund.de:2222/alwin.berger/FRET-FreeRTOS.git
url = https://git.cs.tu-dortmund.de/SYS-OSS/FRET-FreeRTOS.git
branch = wcet-demo

@ -1 +1 @@
Subproject commit 24bba6bde09c45f037c72e8804d5f6867b8d0531
Subproject commit e1179c292dfb5612c8cb7c52f98aac4c8f0371e2

2
LibAFL

@ -1 +1 @@
Subproject commit 36bd06cb99e6fb825519774e6d6db4d40f747bb6
Subproject commit 8e1863847fb5ceb857a770f8cb30253a623a9161

View File

@ -63,8 +63,8 @@ export BENCHDIR="eval_$(date -I)"
# Reproduce the evals in the paper e.g.
snakemake --cores 64 eval_bytes eval_int eval_full waters_multi
# plot the resutls
sh plot_all_benchmarks.sh
snakemake -c20 plot_benchmarks
# See images in $BENCHDIR
sh plot_all_traces.sh
snakemake -c20 plot_traces
# See HTML files in $BENCHDIR/timedump/*/ for traces of the worst cases
```

View File

@ -0,0 +1,8 @@
@inproceedings{
berger2025dynamic,
title={Dynamic Fuzzing-Based Whole-System Timing Analysis},
author={Alwin Berger and Simon Schuster and Peter W{\"a}gemann and Peter Ulbrich},
booktitle={The 46th IEEE Real-Time Systems Symposium, Artifact Evaluation},
year={2025},
url={https://openreview.net/forum?id=LlBXyI12R8}
}

View File

@ -34,7 +34,7 @@ Download our ready-made VM image from [https://sys-sideshow.cs.tu-dortmund.de/do
1. Clone the repository:
```bash
git clone https://git.cs.tu-dortmund.de/alwin.berger/FRET
git clone https://git.cs.tu-dortmund.de/SYS-OSS/FRET
cd FRET
git checkout RTSS25-AE
git submodule update --init
@ -55,8 +55,10 @@ nix develop # or nix-shell for older Nix versions
1. Clone the repository:
```bash
git clone --recursive https://git.cs.tu-dortmund.de/alwin.berger/FRET
git clone --recursive https://git.cs.tu-dortmund.de/SYS-OSS/FRET
cd FRET
git checkout RTSS25-AE
git submodule update --init
```
2. See [Docker/README.md](Docker/README.md)
@ -116,9 +118,13 @@ mkdir -p $TMPDIR
export DUMP=$(mktemp -d)
dd if=/dev/random of=$DUMP/input bs=8K count=1
# fuzz for 10 seconds
cargo run -- -k benchmark/build/waters_seq_full.elf -c benchmark/target_symbols.csv -n $DUMP/output -ta fuzz -t 10 --seed 123456
cargo run -- -k benchmark/build/waters_seq_full.elf \
-c benchmark/target_symbols.csv \
-n $DUMP/output -ta fuzz -t 10 --seed 123456
# Produce a trace for the worst case found
cargo run -- -k benchmark/build/waters_seq_full.elf -c benchmark/target_symbols.csv -n $DUMP/show -trg showmap -i $DUMP/output.case
cargo run -- -k benchmark/build/waters_seq_full.elf \
-c benchmark/target_symbols.csv \
-n $DUMP/show -trg showmap -i $DUMP/output.case
# plot the result
gantt_driver $DUMP/show.trace.ron
# view the gantt chart

Binary file not shown.

View File

@ -1,11 +1,11 @@
#!/usr/bin/env bash
# Configuration
export CORES=64 # Number of physical cores
export RUNTIME=86400 # 24 hours in seconds
export TARGET_REPLICA_NUMBER=12
export RANDOM_REPLICA_NUMBER=3
export MULTIJOB_REPLICA_NUMBER=3
export CORES=${CORES:-64} # Number of physical cores
export RUNTIME=${RUNTIME:-86400} # 24 hours in seconds
export TARGET_REPLICA_NUMBER=${TARGET_REPLICA_NUMBER:-12}
export RANDOM_REPLICA_NUMBER=${RANDOM_REPLICA_NUMBER:-3}
export MULTIJOB_REPLICA_NUMBER=${MULTIJOB_REPLICA_NUMBER:-3}
if [[ -z "$INSIDE_DEVSHELL" ]]; then
echo "This script should be run inside a nix-shell. Run 'nix develop' or 'nix-shell' first."
@ -17,12 +17,13 @@ cd "$SCRIPT_DIR"
cd LibAFL/fuzzers/FRET/benchmark
export BENCHDIR="eval_$(date -I)"
export BENCHDIR="${BENCHDIR:-eval_$(date -I)}"
# prepare all fuzzer configurations
snakemake --keep-incomplete --cores $CORES all_bins
# Run the eval examples from the paper (eval_bytes = Fig. 3, eval_int = Fig. 4, eval_full = Fig. 5, waters_multi = Fig. 6)
snakemake --keep-incomplete --cores $CORES eval_bytes eval_int eval_full waters_multi
# plot the resutls
rm -f $BENCHDIR/bench.sqlite
snakemake --keep-incomplete --cores $CORES plot_benchmarks
# See images in $BENCHDIR
snakemake --keep-incomplete --cores $CORES plot_traces