ASSERT-KTH / ASSERT-KTH/slumps
Fuzzing tool for WASM
- Dominant language
- WebAssembly
- Stars
- 71
- Forks
- 11
- PR merge metrics
- No merged PRs in 30d
Description
Use [SWAM](https://github.com/satabin/swam) as the core to create a full-fledge fuzzer for WASM. As a big picture here are the milestone to achieve it:
Depends on the WASM coverage tool, see #54
Reference implementations:
- [The Fuzzing Book ](https://www.fuzzingbook.org/)
- [Binaryen built-in fuzzing](https://github.com/WebAssembly/binaryen/wiki/Fuzzing)
Medium priority todos:
- [ ] add support for more than the 4 primitive data-types https://github.com/KTH/slumps/issues/48#issuecomment-674954492
- [ ] activate CI for wasm-fuzzer, add docker build in CI and make sure that it fails if gcc fails
- [ ] Add support for textual report of crashing inputs created by AFL
- [ ] Write shell script to run SWAM a specific input file created by AFL (a test harness)
Low priority todos:
- [ ] Use the server as a top level project in Slumps, use SWAM as a dependency (instead of a fork). Use sbt, so Scala/Java dependencies can be saved in image (not in volume like in current implementation with Mill)
- [ ] Use proper logging, to avoid redundant prints, introduce logging macro
- [ ] Add support for seeding AFL with several input sets (was Make it possible for WASM_ARG_LIST > WASM_ARG_TYPES_LIST, so that AFL has multiple possible starting inputs)
- [ ] Use [fs2-io](https://fs2.io/io.html) for the Socket server instead of standard Socket classes (nio). Very difficult imo - also potentially not necessary if SWAM will only be a dependency.
- [ ] Analyze AFL output —> Write code that generates optimal test-cases for WASM in Javascript
- [ ] support DWARF, see https://github.com/satabin/swam/issues/94
- [ ] add proper protocol between SWAM and AFL (protocolbuffer, messagepack)
- [ ] use the literals available in the WASM binary as seed in AFL
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.