Skip to content
This repository has been archived by the owner on Apr 30, 2021. It is now read-only.

Add Dictionary/Extras Support #15

Open
domenukk opened this issue Sep 1, 2020 · 8 comments
Open

Add Dictionary/Extras Support #15

domenukk opened this issue Sep 1, 2020 · 8 comments

Comments

@domenukk
Copy link
Member

domenukk commented Sep 1, 2020

The main feature lacking in LibAFL right now is Extas support.
This includes the dictionary extras, you would pass to AFL using -x, but also autoextras added during fuzzing, as well as the compile-time autodict feature in AFL LTO builds, and eventually even cmplog.
The important pieces of code are in https://github.com/AFLplusplus/AFLplusplus/blob/stable/src/afl-fuzz-extras.c

@rish9101
Copy link
Collaborator

rish9101 commented Oct 3, 2020

I was looking at doing this. Can you give a little background of how afl generates extras during the fuzzing? taking a dict as a command-line parameter and parsing is pretty straight-forward. But generating them during fuzzing was a bit confusing 😅

@domenukk
Copy link
Member Author

domenukk commented Oct 3, 2020

We can start with the "normal" ones and go from there :)

@rish9101
Copy link
Collaborator

rish9101 commented Oct 3, 2020

Ok. So, if we get a dict, do we need any special mutators for them? Or the havoc ones work(for now)?

@domenukk
Copy link
Member Author

domenukk commented Oct 3, 2020

Havoc needs to take extras into account, that's okay for now. Later we'll probably want redqueen

@rish9101
Copy link
Collaborator

rish9101 commented Oct 3, 2020

👍 I think we'll need a deterministic stage too now?

@domenukk
Copy link
Member Author

domenukk commented Oct 3, 2020

If we want to be close to AFL, eventually yes

@rish9101
Copy link
Collaborator

rish9101 commented Oct 4, 2020

I've started with the deterministic stage and deterministic mutators (Had to introduce a new structure for storing "state" of mutation since it isn't random). You guys can have a look at
add_extras branch

@andreafioraldi
Copy link
Member

Don't code, I have the lock this week, deterministic can be implemented just using the stage_idx parameter to mutate (that was in FFF for this purpose, but was not ported to LibAFL)

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants