Page MenuHomePhabricator

[fuzzer] Print reloaded file paths
ClosedPublic

Authored by SweetVishnya on Apr 12 2021, 6:42 AM.

Details

Summary

In order to integrate libFuzzer with a dynamic symbolic execution tool
Sydr we need to print loaded file paths.

Diff Detail

Event Timeline

SweetVishnya requested review of this revision.Apr 12 2021, 6:42 AM
SweetVishnya created this revision.
Herald added a project: Restricted Project. · View Herald TranscriptApr 12 2021, 6:42 AM
Herald added a subscriber: Restricted Project. · View Herald Transcript

Should I reformat the code outside of my patch to make build green?

What are you trying to do with symbolic execution that requires this patch?

Should I reformat the code outside of my patch to make build green?

Not a big deal either way, but feel free to delete the extra line if you want.

We integrated our dynamic symbolic execution tool (Sydr) with libFuzzer. We feed generated inputs from Sydr to libFuzzer corpus. We need to know loaded (good) inputs to:

  1. Evaluate symbolic execution profit. We want to know which files were taken from Sydr.
  2. We should delete files that were not loaded by libFuzzer to keep corpus neat.
  3. Also, we want to know which files exactly made the profit (RELOAD -> +cov/+feature).

We mostly lean on fuzzer to detect crashes and estimate inputs. We want to delete discarded inputs. So, they won't be given to DSE as inputs.

We integrated our dynamic symbolic execution tool (Sydr) with libFuzzer. We feed generated inputs from Sydr to libFuzzer corpus. We need to know loaded (good) inputs to:

  1. Evaluate symbolic execution profit. We want to know which files were taken from Sydr.
  2. We should delete files that were not loaded by libFuzzer to keep corpus neat.
  3. Also, we want to know which files exactly made the profit (RELOAD -> +cov/+feature).

Very cool, makes sense. Any plans to open source this work? I would be very interested in your results.

compiler-rt/lib/fuzzer/FuzzerLoop.cpp
418
426

Since we need the index anyway now, let's refactor the loop to use the index for both AdditionalCorpus and AdditionalCorpusPaths.

SweetVishnya edited the summary of this revision. (Show Details)

Fix all review issues

SweetVishnya marked 2 inline comments as done.Apr 15 2021, 4:47 AM

Very cool, makes sense. Any plans to open source this work? I would be very interested in your results.

It is a closed source project for now, but we have a paper [1] and going to write a new one this Fall. We still try to open source the underlying parts in open source projects like Triton, DynamoRIO, and now LLVM. We are still undecided about the future. Maybe we will open source it partially.

[1] https://arxiv.org/abs/2011.09269

This revision is now accepted and ready to land.Apr 15 2021, 7:53 AM
This revision was automatically updated to reflect the committed changes.