AFLplusplus / AFLplusplus/LibAFL

Allow for interleaving of harness and fuzzer

未关闭
#2,667 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Rust
星标
2.6k
派生
481
平均合并
2 天 30 分钟
30 天内合并 PR
16

描述

Right now, the executors are written with _atomic_ harnesses in mind -- the observers are prepared, then the harness is executed, then the observers are processed. This may not be optimal for e.g. network or filesystem fuzzing where resources are dynamically requested by the target, situations where we want to observe multiple parts of the harness separately (such as in differential- or property-fuzzing), or where using atomic harnesses may not be as efficient due to the allocation of shared resources (e.g. differential fuzzing [PCRE2](https://github.com/PCRE2Project/pcre2), we would want to avoid compiling the regex twice for the interpreter and the JIT). This also simplifies the job of the fuzzer developer, as they can reuse existing harnesses and only add callbacks to delineate the stages of the harness execution.

With that in mind, we should probably implement the infrastructure to easily implement harness/fuzzer interactions. This is most relevant for in-process executor, where we need to stash the fuzzer/state/executor/etc., do mutability checks, potentially pause/cancel timeouts, etc. in a way that is likely non-obvious for developers that aren't us :slightly_smiling_face:

We can implement this as part of the executor changes originally discussed in #1341 s.t. we have a global representing the current state to be used by more than just the signal handlers.

To implement this, I suggest we extract the global used by the signal handler to a global that is more widely available, then define a `HarnessCallback` trait, generic over executor `E`. Individual support for different executor variants can then be implemented by the executor developers and blanket implemented for the callbacks. The specific callback functions can then be defined by the fuzzer developer + some common ones we can implement by default.

_Originally posted by @addisoncrump in https://github.com/AFLplusplus/LibAFL/discussions/1787_

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。