ASSERT-KTH / ASSERT-KTH/slumps

Fuzzing tool for WASM

Open
#48 20 comments 1 reaction 3 assignees Claimed by @olapiv View on GitHub
Dominant language
WebAssembly
Stars
71
Forks
11
PR merge metrics
No merged PRs in 30d

Description

Use [SWAM](https://github.com/satabin/swam) as the core to create a full-fledge fuzzer for WASM. As a big picture here are the milestone to achieve it:

Depends on the WASM coverage tool, see #54

Reference implementations:
- [The Fuzzing Book ](https://www.fuzzingbook.org/)
- [Binaryen built-in fuzzing](https://github.com/WebAssembly/binaryen/wiki/Fuzzing)

Medium priority todos:
- [ ] add support for more than the 4 primitive data-types https://github.com/KTH/slumps/issues/48#issuecomment-674954492
- [ ] activate CI for wasm-fuzzer, add docker build in CI and make sure that it fails if gcc fails
- [ ] Add support for textual report of crashing inputs created by AFL
- [ ] Write shell script to run SWAM a specific input file created by AFL (a test harness)

Low priority todos:

- [ ] Use the server as a top level project in Slumps, use SWAM as a dependency (instead of a fork). Use sbt, so Scala/Java dependencies can be saved in image (not in volume like in current implementation with Mill)
- [ ] Use proper logging, to avoid redundant prints, introduce logging macro
- [ ] Add support for seeding AFL with several input sets (was Make it possible for WASM_ARG_LIST > WASM_ARG_TYPES_LIST, so that AFL has multiple possible starting inputs)
- [ ] Use [fs2-io](https://fs2.io/io.html) for the Socket server instead of standard Socket classes (nio). Very difficult imo - also potentially not necessary if SWAM will only be a dependency.
- [ ] Analyze AFL output —> Write code that generates optimal test-cases for WASM in Javascript
- [ ] support DWARF, see https://github.com/satabin/swam/issues/94
- [ ] add proper protocol between SWAM and AFL (protocolbuffer, messagepack)
- [ ] use the literals available in the WASM binary as seed in AFL

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.