|
1 |
| -# Introduction |
| 1 | +# IPC Fuzzer |
2 | 2 |
|
3 |
| -A chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives under `src/tools/ipc_fuzzer/` and is running on ClusterFuzz. A previous version of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new version is doing smarter mutations and generational fuzzing. To do so, each `ParamTraits<Type>` needs a corresponding `FuzzTraits<Type>`. Feel free to contribute. |
| 3 | +A chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives |
| 4 | +under `src/tools/ipc_fuzzer/` and is running on ClusterFuzz. A previous version |
| 5 | +of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new |
| 6 | +version is doing smarter mutations and generational fuzzing. To do so, each |
| 7 | +`ParamTraits<Type>` needs a corresponding `FuzzTraits<Type>`. Feel free to |
| 8 | +contribute. |
4 | 9 |
|
| 10 | +[TOC] |
5 | 11 |
|
6 |
| ---- |
| 12 | +## Working with the fuzzer |
7 | 13 |
|
8 |
| -# Working with the fuzzer |
| 14 | +### Build instructions |
9 | 15 |
|
10 |
| -## Build instructions |
11 |
| - * add `enable_ipc_fuzzer=1` to `GYP_DEFINES` |
12 |
| - * build `ipc_fuzzer_all` target |
13 |
| - * component builds are currently broken, sorry |
14 |
| - * Debug builds are broken; only Release mode works. |
| 16 | +* add `enable_ipc_fuzzer=1` to `GYP_DEFINES` |
| 17 | +* build `ipc_fuzzer_all` target |
| 18 | +* component builds are currently broken, sorry |
| 19 | +* Debug builds are broken; only Release mode works. |
15 | 20 |
|
16 |
| -## Replaying ipcdumps |
17 |
| - * `tools/ipc_fuzzer/scripts/play_testcase.py path/to/testcase.ipcdump` |
18 |
| - * more help: `tools/ipc_fuzzer/scripts/play_testcase.py -h` |
| 21 | +### Replaying ipcdumps |
19 | 22 |
|
20 |
| -## Listing messages in ipcdump |
21 |
| - * `out/`_Build_`/ipc_message_util --dump path/to/testcase.ipcdump` |
| 23 | +* `tools/ipc_fuzzer/scripts/play_testcase.py path/to/testcase.ipcdump` |
| 24 | +* more help: `tools/ipc_fuzzer/scripts/play_testcase.py -h` |
22 | 25 |
|
23 |
| -## Updating fuzzers in ClusterFuzz |
24 |
| - * `tools/ipc_fuzzer/scripts/cf_package_builder.py` |
25 |
| - * upload `ipc_fuzzer_mut.zip` and `ipc_fuzzer_gen.zip` under build directory to ClusterFuzz |
| 26 | +### Listing messages in ipcdump |
26 | 27 |
|
27 |
| -## Contributing FuzzTraits |
28 |
| - * add them to tools/ipc\_fuzzer/fuzzer/fuzzer.cc |
29 |
| - * thanks! |
| 28 | +* `out/<Build>/ipc_message_util --dump path/to/testcase.ipcdump` |
30 | 29 |
|
| 30 | +### Updating fuzzers in ClusterFuzz |
31 | 31 |
|
32 |
| ---- |
| 32 | +* `tools/ipc_fuzzer/scripts/cf_package_builder.py` |
| 33 | +* upload `ipc_fuzzer_mut.zip` and `ipc_fuzzer_gen.zip` under build directory |
| 34 | + to ClusterFuzz |
33 | 35 |
|
34 |
| -# Components |
| 36 | +### Contributing FuzzTraits |
35 | 37 |
|
36 |
| -## ipcdump logger |
37 |
| - * add `enable_ipc_fuzzer=1` to `GYP_DEFINES` |
38 |
| - * build `chrome` and `ipc_message_dump` targets |
39 |
| - * run chrome with `--no-sandbox --ipc-dump-directory=/path/to/ipcdump/directory` |
40 |
| - * ipcdumps will be created in this directory for each renderer using the format _pid_.ipcdump |
| 38 | +* add them to `tools/ipc_fuzzer/fuzzer/fuzzer.cc` |
| 39 | +* thanks! |
41 | 40 |
|
42 |
| -## ipcdump replay |
43 |
| -Lives under `ipc_fuzzer/replay`. The renderer is replaced with `ipc_fuzzer_replay` using `--renderer-cmd-prefix`. This is done automatically with the `ipc_fuzzer/play_testcase.py` convenience script. |
| 41 | +## Components |
44 | 42 |
|
45 |
| -## ipcdump mutator / generator |
46 |
| -Lives under `ipc_fuzzer/fuzzer`. This is the code that runs on ClusterFuzz. It uses `FuzzTraits<Type>` to mutate ipcdumps or generate them out of thin air. |
| 43 | +### ipcdump logger |
47 | 44 |
|
| 45 | +* add `enable_ipc_fuzzer=1` to `GYP_DEFINES` |
| 46 | +* build `chrome` and `ipc_message_dump` targets |
| 47 | +* run chrome with |
| 48 | + `--no-sandbox --ipc-dump-directory=/path/to/ipcdump/directory` |
| 49 | +* ipcdumps will be created in this directory for each renderer using the |
| 50 | + format `_pid_.ipcdump` |
48 | 51 |
|
49 |
| ---- |
| 52 | +### ipcdump replay |
50 | 53 |
|
51 |
| -# Problems, questions, suggestions |
52 |
| - |
| 54 | +Lives under `ipc_fuzzer/replay`. The renderer is replaced with |
| 55 | +`ipc_fuzzer_replay` using `--renderer-cmd-prefix`. This is done automatically |
| 56 | +with the `ipc_fuzzer/play_testcase.py` convenience script. |
| 57 | + |
| 58 | +### ipcdump mutator / generator |
| 59 | + |
| 60 | +Lives under `ipc_fuzzer/fuzzer`. This is the code that runs on ClusterFuzz. It |
| 61 | +uses `FuzzTraits<Type>` to mutate ipcdumps or generate them out of thin air. |
| 62 | + |
| 63 | +## Problems, questions, suggestions |
| 64 | + |
| 65 | + |
0 commit comments