Skip to content

Commit

Permalink
Merge
Browse files Browse the repository at this point in the history
Robert Swiecki committed Oct 9, 2015
1 parent 36da498 commit c8c32db
Showing 18 changed files with 464 additions and 799 deletions.
2 changes: 1 addition & 1 deletion Makefile
Original file line number Diff line number Diff line change
@@ -22,7 +22,7 @@
BIN := honggfuzz
COMMON_CFLAGS := -D_GNU_SOURCE -Wall -Werror
COMMON_LDFLAGS := -lm
COMMON_SRCS := honggfuzz.c display.c log.c files.c fuzz.c report.c mangle.c util.c
COMMON_SRCS := honggfuzz.c cmdline.c display.c log.c files.c fuzz.c report.c mangle.c util.c
INTERCEPTOR_SRCS := $(wildcard interceptor/*.c)

OS ?= $(shell uname -s)
3 changes: 0 additions & 3 deletions display.c
Original file line number Diff line number Diff line change
@@ -133,8 +133,5 @@ static void display_displayLocked(honggfuzz_t * hfuzz)

extern void display_display(honggfuzz_t * hfuzz)
{
/* Don't mix up logs and display at this point */
log_mutexLock();
display_displayLocked(hfuzz);
log_mutexUnLock();
}
12 changes: 6 additions & 6 deletions docs/FeedbackDrivenFuzzing.md
Original file line number Diff line number Diff line change
@@ -13,10 +13,10 @@ Developers can provide their own initial file (-f flag) which will be gradually
# Examples #
The main fuzzing strategy is quite simple. It tries to maximize the number of perf events while mangling the file which servers as an input for fuzzing.

## Instruction counting (-LD i) ##
## Instruction counting (-LDi) ##

```
$ honggfuzz -q -LD i -f /usr/share/doc/texlive-doc/latex/ctable/penguin.jpg -- ./djpeg.static ___FILE___
$ honggfuzz -q -LDi -f /usr/share/doc/texlive-doc/latex/ctable/penguin.jpg -- ./djpeg.static ___FILE___
...
[INFO] Launched new process, pid: 21168, (5/5)
[INFO] File size (New/Best): 2789/2789, Perf feedback: Best: 1 / New: 1174343
@@ -36,12 +36,12 @@ $ honggfuzz -q -LD i -f /usr/share/doc/texlive-doc/latex/ctable/penguin.jpg -- .

It will start with some initial file (or with no file at all), and subsequent fuzzing iterations will try to maximize the number of instructions spent on parsing it.

## Branch counting (-LD b) ##
## Branch counting (-LDb) ##

As above, it will try to maximize the number of branches taken by CPU on behalf of the fuzzed process (here: djpeg.static) while performing the fuzzing process.

```
$ honggfuzz -q -LD b -f /usr/share/doc/texlive-doc/latex/ctable/penguin.jpg -- ./djpeg.static ___FILE___
$ honggfuzz -q -LDb -f /usr/share/doc/texlive-doc/latex/ctable/penguin.jpg -- ./djpeg.static ___FILE___
...
[INFO] Launched new process, pid: 21391, (5/5)
[INFO] File size (New/Best): 2789/2789, Perf feedback: Best: 1 / New: 115586
@@ -58,11 +58,11 @@ $ honggfuzz -q -LD b -f /usr/share/doc/texlive-doc/latex/ctable/penguin.jpg -- .
```

## Unique branch points counting (-LD p) / Unique branch pair (edges) counting (-LD e) ##
## Unique branch points counting (-LDp) / Unique branch pair (edges) counting (-LDe) ##
This is the most powerfull mode of feedback-driven counting that honggfuzz supports. It utilizes Intel's BTS (Branch Trace Store) feature to record all branch events (edges) inside the fuzzed process. Later, honggfuzz will de-duplicate those entries. The resulting number of branch pairs (edges) is good approximation of how much code of a given tool have been actively executed/used (code coverage).

```
$ honggfuzz -q -LD p -f /usr/share/doc/texlive-doc/latex/ctable/penguin.jpg -- ./djpeg.static ___FILE___
$ honggfuzz -q -LDp -f /usr/share/doc/texlive-doc/latex/ctable/penguin.jpg -- ./djpeg.static ___FILE___
...
[INFO] Launched new process, pid: 21715, (5/5)
[INFO] Launched new process, pid: 21719, (5/5)
Loading

0 comments on commit c8c32db

Please sign in to comment.