2dcdaaa89f
* Add libafl py module * Hardcoded baby_fuzzer * Trait abstraction: MapObserver Send type name as a param as it's needed for extracting the rust struct from the PyObject * Fix merge * Impl traits for python wrappers * Add PythonExecutor Not buildable version * Executor trait bindings * Monitor trait bindings * EventManager trait bindings * Fix warnings * Add corpus trait bindings * Use corpus trait bindings * Rand trait bindings * Remove python feature from default * Add cfg attribute * Fix fmt * No std box * Fix clippy * turn OwnedInProcessExecutor in a simple type alias * remove crate-type from libafl's Cargo.toml * Add python baby_fuzzer * Fix doc * Maturin doc * multiple map observer * fmt * build pylibafl with nightly * macro for map element type * Update py baby_fuzzer & fmt * Mutator bindings * fmt * merge conflicts * StdMutationalStage bindings Not working: Cannot pass mutator to new method because not clonable * Stage bindings * StagesOwnedList bindings Not working: Stage not clonable * Unsafe transmute copy fix * Use Stage bindings in baby_fuzzer * fmt * fmt * Fix doc * fix merge * Remove x86_64 feature from pylibafl Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
70 lines
2.4 KiB
Python
70 lines
2.4 KiB
Python
from pylibafl import libafl
|
|
|
|
# LIBRARY WRAPPER
|
|
|
|
def map_observer_wrapper(map_observer):
|
|
if type(map_observer).__name__ == "OwnedMapObserverI32":
|
|
return libafl.MapObserverI32.new_from_owned(map_observer)
|
|
|
|
def executor_wrapper(executor):
|
|
if type(executor).__name__ == "OwnedInProcessExecutorI32":
|
|
return libafl.ExecutorI32.new_from_inprocess(executor)
|
|
|
|
def monitor_wrapper(monitor):
|
|
if type(monitor).__name__ == "SimpleMonitor":
|
|
return libafl.Monitor.new_from_simple(monitor)
|
|
|
|
def event_manager_wrapper(event_manager):
|
|
if type(event_manager).__name__ == "SimpleEventManager":
|
|
return libafl.EventManagerI32.new_from_simple(event_manager)
|
|
|
|
def corpus_wrapper(corpus):
|
|
if type(corpus).__name__ == "InMemoryCorpus":
|
|
return libafl.Corpus.new_from_in_memory(corpus)
|
|
if type(corpus).__name__ == "OnDiskCorpus":
|
|
return libafl.Corpus.new_from_on_disk(corpus)
|
|
|
|
def rand_wrapper(rand):
|
|
if type(rand).__name__ == "StdRand":
|
|
return libafl.Rand.new_from_std(rand)
|
|
|
|
def stage_wrapper(stage):
|
|
if type(stage).__name__ == "StdScheduledHavocMutationsStageI32":
|
|
return libafl.StageI32.new_from_std_scheduled(stage)
|
|
|
|
# CODE WRITTEN BY USER
|
|
|
|
def harness(inp):
|
|
if len(inp.hex()) >= 2 and inp.hex()[:2] == '61':
|
|
raise Exception("NOOOOOO =)")
|
|
|
|
map_observer = libafl.OwnedMapObserverI32("signals", [0] * 16)
|
|
|
|
feedback_state = libafl.MapFeedbackStateI32.with_observer(map_observer_wrapper(map_observer))
|
|
|
|
feedback = libafl.MaxMapFeedbackI32(feedback_state, map_observer_wrapper(map_observer))
|
|
|
|
state = libafl.StdStateI32(
|
|
rand_wrapper(libafl.StdRand.with_current_nanos()),
|
|
corpus_wrapper(libafl.InMemoryCorpus()),
|
|
corpus_wrapper(libafl.OnDiskCorpus("./crashes")),
|
|
feedback_state
|
|
)
|
|
|
|
monitor = libafl.SimpleMonitor()
|
|
|
|
mgr = libafl.SimpleEventManager(monitor_wrapper(monitor))
|
|
|
|
fuzzer = libafl.StdFuzzerI32(feedback)
|
|
|
|
executor = libafl.OwnedInProcessExecutorI32(harness, map_observer_wrapper(map_observer), fuzzer, state, event_manager_wrapper(mgr))
|
|
|
|
generator = libafl.RandPrintablesGeneratorI32(32)
|
|
|
|
state.generate_initial_inputs(fuzzer, executor_wrapper(executor), generator, event_manager_wrapper(mgr), 8)
|
|
|
|
stage = libafl.StdScheduledHavocMutationsStageI32.new_from_scheduled_havoc_mutations()
|
|
|
|
stage_tuple_list = libafl.StagesOwnedListI32(stage_wrapper(stage))
|
|
|
|
fuzzer.fuzz_loop(executor_wrapper(executor), state, event_manager_wrapper(mgr), stage_tuple_list) |