OLD | NEW |
1 # Introduction | 1 # IPC Fuzzer |
2 | 2 |
3 A chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives
under `src/tools/ipc_fuzzer/` and is running on ClusterFuzz. A previous version
of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new versi
on is doing smarter mutations and generational fuzzing. To do so, each `ParamTra
its<Type>` needs a corresponding `FuzzTraits<Type>`. Feel free to contribute. | 3 A chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives |
| 4 under `src/tools/ipc_fuzzer/` and is running on ClusterFuzz. A previous version |
| 5 of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new |
| 6 version is doing smarter mutations and generational fuzzing. To do so, each |
| 7 `ParamTraits<Type>` needs a corresponding `FuzzTraits<Type>`. Feel free to |
| 8 contribute. |
4 | 9 |
| 10 [TOC] |
5 | 11 |
6 --- | 12 ## Working with the fuzzer |
7 | 13 |
8 # Working with the fuzzer | 14 ### Build instructions |
9 | 15 |
10 ## Build instructions | 16 * add `enable_ipc_fuzzer=1` to `GYP_DEFINES` |
11 * add `enable_ipc_fuzzer=1` to `GYP_DEFINES` | 17 * build `ipc_fuzzer_all` target |
12 * build `ipc_fuzzer_all` target | 18 * component builds are currently broken, sorry |
13 * component builds are currently broken, sorry | 19 * Debug builds are broken; only Release mode works. |
14 * Debug builds are broken; only Release mode works. | |
15 | 20 |
16 ## Replaying ipcdumps | 21 ### Replaying ipcdumps |
17 * `tools/ipc_fuzzer/scripts/play_testcase.py path/to/testcase.ipcdump` | |
18 * more help: `tools/ipc_fuzzer/scripts/play_testcase.py -h` | |
19 | 22 |
20 ## Listing messages in ipcdump | 23 * `tools/ipc_fuzzer/scripts/play_testcase.py path/to/testcase.ipcdump` |
21 * `out/`_Build_`/ipc_message_util --dump path/to/testcase.ipcdump` | 24 * more help: `tools/ipc_fuzzer/scripts/play_testcase.py -h` |
22 | 25 |
23 ## Updating fuzzers in ClusterFuzz | 26 ### Listing messages in ipcdump |
24 * `tools/ipc_fuzzer/scripts/cf_package_builder.py` | |
25 * upload `ipc_fuzzer_mut.zip` and `ipc_fuzzer_gen.zip` under build directory t
o ClusterFuzz | |
26 | 27 |
27 ## Contributing FuzzTraits | 28 * `out/<Build>/ipc_message_util --dump path/to/testcase.ipcdump` |
28 * add them to tools/ipc\_fuzzer/fuzzer/fuzzer.cc | |
29 * thanks! | |
30 | 29 |
| 30 ### Updating fuzzers in ClusterFuzz |
31 | 31 |
32 --- | 32 * `tools/ipc_fuzzer/scripts/cf_package_builder.py` |
| 33 * upload `ipc_fuzzer_mut.zip` and `ipc_fuzzer_gen.zip` under build directory |
| 34 to ClusterFuzz |
33 | 35 |
34 # Components | 36 ### Contributing FuzzTraits |
35 | 37 |
36 ## ipcdump logger | 38 * add them to `tools/ipc_fuzzer/fuzzer/fuzzer.cc` |
37 * add `enable_ipc_fuzzer=1` to `GYP_DEFINES` | 39 * thanks! |
38 * build `chrome` and `ipc_message_dump` targets | |
39 * run chrome with `--no-sandbox --ipc-dump-directory=/path/to/ipcdump/director
y` | |
40 * ipcdumps will be created in this directory for each renderer using the forma
t _pid_.ipcdump | |
41 | 40 |
42 ## ipcdump replay | 41 ## Components |
43 Lives under `ipc_fuzzer/replay`. The renderer is replaced with `ipc_fuzzer_repla
y` using `--renderer-cmd-prefix`. This is done automatically with the `ipc_fuzze
r/play_testcase.py` convenience script. | |
44 | 42 |
45 ## ipcdump mutator / generator | 43 ### ipcdump logger |
46 Lives under `ipc_fuzzer/fuzzer`. This is the code that runs on ClusterFuzz. It u
ses `FuzzTraits<Type>` to mutate ipcdumps or generate them out of thin air. | |
47 | 44 |
| 45 * add `enable_ipc_fuzzer=1` to `GYP_DEFINES` |
| 46 * build `chrome` and `ipc_message_dump` targets |
| 47 * run chrome with |
| 48 `--no-sandbox --ipc-dump-directory=/path/to/ipcdump/directory` |
| 49 * ipcdumps will be created in this directory for each renderer using the |
| 50 format `_pid_.ipcdump` |
48 | 51 |
49 --- | 52 ### ipcdump replay |
50 | 53 |
51 # Problems, questions, suggestions | 54 Lives under `ipc_fuzzer/replay`. The renderer is replaced with |
52 Send them to mbarbella@chromium.org. | 55 `ipc_fuzzer_replay` using `--renderer-cmd-prefix`. This is done automatically |
| 56 with the `ipc_fuzzer/play_testcase.py` convenience script. |
| 57 |
| 58 ### ipcdump mutator / generator |
| 59 |
| 60 Lives under `ipc_fuzzer/fuzzer`. This is the code that runs on ClusterFuzz. It |
| 61 uses `FuzzTraits<Type>` to mutate ipcdumps or generate them out of thin air. |
| 62 |
| 63 ## Problems, questions, suggestions |
| 64 |
| 65 Send them to mbarbella@chromium.org. |
OLD | NEW |