OLD | NEW |
(Empty) | |
| 1 # Introduction |
| 2 |
| 3 A chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives
under `src/tools/ipc_fuzzer/` and is running on ClusterFuzz. A previous version
of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new versi
on is doing smarter mutations and generational fuzzing. To do so, each `ParamTra
its<Type>` needs a corresponding `FuzzTraits<Type>`. Feel free to contribute. |
| 4 |
| 5 |
| 6 --- |
| 7 |
| 8 # Working with the fuzzer |
| 9 |
| 10 ## Build instructions |
| 11 * add `enable_ipc_fuzzer=1` to `GYP_DEFINES` |
| 12 * build `ipc_fuzzer_all` target |
| 13 * component builds are currently broken, sorry |
| 14 * Debug builds are broken; only Release mode works. |
| 15 |
| 16 ## Replaying ipcdumps |
| 17 * `tools/ipc_fuzzer/scripts/play_testcase.py path/to/testcase.ipcdump` |
| 18 * more help: `tools/ipc_fuzzer/scripts/play_testcase.py -h` |
| 19 |
| 20 ## Listing messages in ipcdump |
| 21 * `out/`_Build_`/ipc_message_util --dump path/to/testcase.ipcdump` |
| 22 |
| 23 ## Updating fuzzers in ClusterFuzz |
| 24 * `tools/ipc_fuzzer/scripts/cf_package_builder.py` |
| 25 * upload `ipc_fuzzer_mut.zip` and `ipc_fuzzer_gen.zip` under build directory t
o ClusterFuzz |
| 26 |
| 27 ## Contributing FuzzTraits |
| 28 * add them to tools/ipc\_fuzzer/fuzzer/fuzzer.cc |
| 29 * thanks! |
| 30 |
| 31 |
| 32 --- |
| 33 |
| 34 # Components |
| 35 |
| 36 ## ipcdump logger |
| 37 * add `enable_ipc_fuzzer=1` to `GYP_DEFINES` |
| 38 * build `chrome` and `ipc_message_dump` targets |
| 39 * run chrome with `--no-sandbox --ipc-dump-directory=/path/to/ipcdump/director
y` |
| 40 * ipcdumps will be created in this directory for each renderer using the forma
t _pid_.ipcdump |
| 41 |
| 42 ## ipcdump replay |
| 43 Lives under `ipc_fuzzer/replay`. The renderer is replaced with `ipc_fuzzer_repla
y` using `--renderer-cmd-prefix`. This is done automatically with the `ipc_fuzze
r/play_testcase.py` convenience script. |
| 44 |
| 45 ## ipcdump mutator / generator |
| 46 Lives under `ipc_fuzzer/fuzzer`. This is the code that runs on ClusterFuzz. It u
ses `FuzzTraits<Type>` to mutate ipcdumps or generate them out of thin air. |
| 47 |
| 48 |
| 49 --- |
| 50 |
| 51 # Problems, questions, suggestions |
| 52 Send them to mbarbella@chromium.org. |
OLD | NEW |