663a33168e
* Associated types for Corpus, State * cleanup * fix no_std * drop unused clauses * Corpus * cleanup * adding things * fixed fuzzer * remove phantom data * python * progress? * more more * oof * wow it builds? * python fixes, tests * fix python fun * black fmt for python * clippy, added Nop things * fixes * fix merge * make it compile (#836) * doc-test fixes, prelude-b-gone for cargo-hack compat * fixes for windows, concolic * really fix windows, maybe * imagine using windows * ... * elide I generic when used with S: State * Elide many, many generics, but at what cost? * progress on push * Constraint HasCorpus, HasSolutions at trait definition * remove unused feature * remove unstable usage since we constrained HasCorpus at definition * compiled, but still no type inference for MaxMapFeedback * cleanup inprocess * resolve some std conflicts * simplify map * undo unnecessary cfg specification * fix breaking test case for CI on no-std * fix concolic build failures * fix macos build * fixes for windows build * timeout fixes for windows build * fix pybindings issues * fixup qemu * fix outstanding local build issues * maybe fix windows inprocess * doc fixes * unbridled fury * de-associate State from Feedback, replace with generic as AT inference is not sufficient to derive specialisation for MapFeedback * merge update * refactor + speed up fuzzer builds by sharing build work * cleanup lingering compiler errors * lol missed one * revert QEMU-Nyx change, not sure how I did that * move HasInput to inputs * HasInput => KnowsInput * update bounds to enforce via associated types * disentangle observers with fuzzer * revert --target; update some fuzzers to match new API * resolve outstanding fuzzer build blockers (that I can run on my system) * fixes for non-linux unixes * fix for windows * Knows => Uses, final fixes for windows * <guttural screaming> * fixes for concolic * loosen bound for frida executor so windows builds correctly * cleanup generics for eventmanager/eventprocessor to drop observers requirement * improve inference over fuzz_one and friends * update migration notes * fixes for python bindings * fixes for generic counts in event managers * finish migration notes * post-merge fix Co-authored-by: Addison Crump <addison.crump@cispa.de>
95 lines
2.2 KiB
Python
95 lines
2.2 KiB
Python
from pylibafl.libafl import *
|
|
import ctypes
|
|
|
|
|
|
class FooObserver(BaseObserver):
|
|
def __init__(self):
|
|
self.n = 0
|
|
|
|
def name(self):
|
|
return "Foo"
|
|
|
|
def pre_exec(self, state, input):
|
|
if self.n % 10000 == 0:
|
|
print("FOO!", self.n, input)
|
|
self.n += 1
|
|
|
|
|
|
class FooFeedback(BaseFeedback):
|
|
def is_interesting(self, state, mgr, input, observers, exit_kind):
|
|
ob = observers.match_name("Foo").unwrap_py()
|
|
return ob.n % 10000 == 0
|
|
|
|
|
|
class FooExecutor(BaseExecutor):
|
|
def __init__(self, harness, observers: ObserversTuple):
|
|
self.h = harness
|
|
self.o = observers
|
|
|
|
def observers(self):
|
|
return self.o
|
|
|
|
def run_target(self, fuzzer, state, mgr, input) -> ExitKind:
|
|
return (self.h)(input)
|
|
|
|
|
|
libc = ctypes.cdll.LoadLibrary("libc.so.6")
|
|
|
|
area_ptr = libc.calloc(1, 4096)
|
|
|
|
observer = StdMapObserverI8("mymap", area_ptr, 4096)
|
|
|
|
m = observer.as_map_observer()
|
|
|
|
observers = ObserversTuple(
|
|
[observer.as_map_observer().as_observer(), FooObserver().as_observer()]
|
|
)
|
|
|
|
feedback = feedback_or(MaxMapFeedbackI8(m).as_feedback(), FooFeedback().as_feedback())
|
|
|
|
objective = feedback_and_fast(
|
|
CrashFeedback().as_feedback(), MaxMapFeedbackI8(m).as_feedback()
|
|
)
|
|
|
|
fuzzer = StdFuzzer(feedback, objective)
|
|
|
|
rand = StdRand.with_current_nanos()
|
|
|
|
state = StdState(
|
|
rand.as_rand(),
|
|
InMemoryCorpus().as_corpus(),
|
|
InMemoryCorpus().as_corpus(),
|
|
feedback,
|
|
objective,
|
|
)
|
|
|
|
monitor = SimpleMonitor(lambda s: print(s))
|
|
|
|
mgr = SimpleEventManager(monitor.as_monitor())
|
|
|
|
|
|
def harness(buf) -> ExitKind:
|
|
# print(buf)
|
|
m[0] = 1
|
|
if len(buf) > 0 and buf[0] == ord("a"):
|
|
m[1] = 1
|
|
if len(buf) > 1 and buf[1] == ord("b"):
|
|
m[2] = 1
|
|
if len(buf) > 2 and buf[2] == ord("c"):
|
|
m[3] = 1
|
|
return ExitKind.crash()
|
|
return ExitKind.ok()
|
|
|
|
|
|
# executor = InProcessExecutor(harness, observers, fuzzer, state, mgr.as_manager())
|
|
|
|
executor = FooExecutor(harness, observers)
|
|
|
|
stage = StdMutationalStage(StdHavocMutator().as_mutator())
|
|
|
|
stage_tuple_list = StagesTuple([stage.as_stage()])
|
|
|
|
fuzzer.add_input(state, executor.as_executor(), mgr.as_manager(), b"\0\0")
|
|
|
|
fuzzer.fuzz_loop(executor.as_executor(), state, mgr.as_manager(), stage_tuple_list)
|