AFLplusplus / AFLplusplus/LibAFL
Don't require entries in the corpus
- 主要语言
- Rust
- 星标
- 2.6k
- 派生
- 481
- 平均合并
- 2 天 30 分钟
- 30 天内合并 PR
- 16
描述
When writing a generative (e.g., black-box, grammar-based) fuzzer that doesn't do mutations, I use `ConstFeedback::False` as the feedback, because I don't need to save any inputs that don't cause crashes. But I can't just leave the corpus empty. In particular, this fuzzer panics:
```rust
use libafl::feedbacks::ConstFeedback;
use libafl::monitors::SimpleMonitor;
use libafl::{
corpus::InMemoryCorpus,
events::SimpleEventManager,
executors::{inprocess::InProcessExecutor, ExitKind},
feedbacks::CrashFeedback,
fuzzer::{Fuzzer, StdFuzzer},
generators::RandPrintablesGenerator,
inputs::BytesInput,
schedulers::QueueScheduler,
stages::generation::GenStage,
state::StdState,
};
use libafl_bolts::{current_nanos, rands::StdRand, tuples::tuple_list};
pub fn main() {
let mut harness = |_input: &BytesInput| ExitKind::Ok;
let mut feedback = ConstFeedback::False;
let mut objective = CrashFeedback::new();
let mut state = StdState::new(
StdRand::with_seed(current_nanos()),
InMemoryCorpus::new(),
InMemoryCorpus::new(),
&mut feedback,
&mut objective,
)
.unwrap();
let mon = SimpleMonitor::new(|s| println!("{s}"));
let mut mgr = SimpleEventManager::new(mon);
let scheduler = QueueScheduler::new();
let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);
let mut executor = InProcessExecutor::new(&mut harness, (), &mut fuzzer, &mut state, &mut mgr)
.expect("Failed to create the Executor");
let generator = RandPrintablesGenerator::new(32);
// state
// .generate_initial_inputs(&mut fuzzer, &mut executor, &mut generator, &mut mgr, 1)
// .expect("Failed to generate the initial corpus");
let mut stages = tuple_list!(GenStage::new(generator));
fuzzer
.fuzz_loop(&mut stages, &mut executor, &mut state, &mut mgr)
.expect("Error in the fuzzing loop");
}
```
```
thread 'main' panicked at src/main.rs:43:10:
Error in the fuzzing loop: Empty("No entries in corpus. This often implies the target is not properly instrumented.", ErrorBacktrace)
stack backtrace:
0: rust_begin_unwind
at /rustc/9b00956e56009bab2aa15d7bff10916599e3d6d6/library/std/src/panicking.rs:645:5
1: core::panicking::panic_fmt
at /rustc/9b00956e56009bab2aa15d7bff10916599e3d6d6/library/core/src/panicking.rs:72:14
2: core::result::unwrap_failed
at /rustc/9b00956e56009bab2aa15d7bff10916599e3d6d6/library/core/src/result.rs:1654:5
3: core::result::Result::expect
at /rustc/9b00956e56009bab2aa15d7bff10916599e3d6d6/library/core/src/result.rs:1034:23
4: no_entries::main
at ./src/main.rs:41:5
5: core::ops::function::FnOnce::call_once
at /rustc/9b00956e56009bab2aa15d7bff10916599e3d6d6/library/core/src/ops/function.rs:250:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
```
Note that the error message is also misleading. This panics because I didn't do `generate_initial_inputs{,_forced}`, not because of instrumentation. However, I shouldn't *need* to `generate_initial_inputs_forced`, because I don't need them in my corpus!
**Describe the solution you'd like**
Don't panic in this case
**Describe alternatives you've considered**
Status quo
贡献指南
评估
这个 Issue 还没有评估数据。