Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(481)

Side by Side Diff: docs/ipc_fuzzer.md

Issue 1309473002: WIP: Migrate Wiki content over to src/docs (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 5 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « docs/installazione_su_vmware.md ('k') | docs/kiosk_mode.md » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
(Empty)
1 # Introduction
2
3 A chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives under `src/tools/ipc_fuzzer/` and is running on ClusterFuzz. A previous version of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new versi on is doing smarter mutations and generational fuzzing. To do so, each `ParamTra its<Type>` needs a corresponding `FuzzTraits<Type>`. Feel free to contribute.
4
5
6 ---
7
8 # Working with the fuzzer
9
10 ## Build instructions
11 * add `enable_ipc_fuzzer=1` to `GYP_DEFINES`
12 * build `ipc_fuzzer_all` target
13 * component builds are currently broken, sorry
14 * Debug builds are broken; only Release mode works.
15
16 ## Replaying ipcdumps
17 * `tools/ipc_fuzzer/scripts/play_testcase.py path/to/testcase.ipcdump`
18 * more help: `tools/ipc_fuzzer/scripts/play_testcase.py -h`
19
20 ## Listing messages in ipcdump
21 * `out/`_Build_`/ipc_message_util --dump path/to/testcase.ipcdump`
22
23 ## Updating fuzzers in ClusterFuzz
24 * `tools/ipc_fuzzer/scripts/cf_package_builder.py`
25 * upload `ipc_fuzzer_mut.zip` and `ipc_fuzzer_gen.zip` under build directory t o ClusterFuzz
26
27 ## Contributing FuzzTraits
28 * add them to tools/ipc\_fuzzer/fuzzer/fuzzer.cc
29 * thanks!
30
31
32 ---
33
34 # Components
35
36 ## ipcdump logger
37 * add `enable_ipc_fuzzer=1` to `GYP_DEFINES`
38 * build `chrome` and `ipc_message_dump` targets
39 * run chrome with `--no-sandbox --ipc-dump-directory=/path/to/ipcdump/director y`
40 * ipcdumps will be created in this directory for each renderer using the forma t _pid_.ipcdump
41
42 ## ipcdump replay
43 Lives under `ipc_fuzzer/replay`. The renderer is replaced with `ipc_fuzzer_repla y` using `--renderer-cmd-prefix`. This is done automatically with the `ipc_fuzze r/play_testcase.py` convenience script.
44
45 ## ipcdump mutator / generator
46 Lives under `ipc_fuzzer/fuzzer`. This is the code that runs on ClusterFuzz. It u ses `FuzzTraits<Type>` to mutate ipcdumps or generate them out of thin air.
47
48
49 ---
50
51 # Problems, questions, suggestions
52 Send them to mbarbella@chromium.org.
OLDNEW
« no previous file with comments | « docs/installazione_su_vmware.md ('k') | docs/kiosk_mode.md » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698