| Index: docs/ipc_fuzzer.md
|
| diff --git a/docs/ipc_fuzzer.md b/docs/ipc_fuzzer.md
|
| index 17a80c6dd9645f884c0e902d611ce46982a337ba..0ab9ce9f150dc161883015e6d245286ebb0c15de 100644
|
| --- a/docs/ipc_fuzzer.md
|
| +++ b/docs/ipc_fuzzer.md
|
| @@ -1,52 +1,65 @@
|
| -# Introduction
|
| +# IPC Fuzzer
|
|
|
| -A chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives under `src/tools/ipc_fuzzer/` and is running on ClusterFuzz. A previous version of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new version is doing smarter mutations and generational fuzzing. To do so, each `ParamTraits<Type>` needs a corresponding `FuzzTraits<Type>`. Feel free to contribute.
|
| +A chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives
|
| +under `src/tools/ipc_fuzzer/` and is running on ClusterFuzz. A previous version
|
| +of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new
|
| +version is doing smarter mutations and generational fuzzing. To do so, each
|
| +`ParamTraits<Type>` needs a corresponding `FuzzTraits<Type>`. Feel free to
|
| +contribute.
|
|
|
| +[TOC]
|
|
|
| ----
|
| +## Working with the fuzzer
|
|
|
| -# Working with the fuzzer
|
| +### Build instructions
|
|
|
| -## Build instructions
|
| - * add `enable_ipc_fuzzer=1` to `GYP_DEFINES`
|
| - * build `ipc_fuzzer_all` target
|
| - * component builds are currently broken, sorry
|
| - * Debug builds are broken; only Release mode works.
|
| +* add `enable_ipc_fuzzer=1` to `GYP_DEFINES`
|
| +* build `ipc_fuzzer_all` target
|
| +* component builds are currently broken, sorry
|
| +* Debug builds are broken; only Release mode works.
|
|
|
| -## Replaying ipcdumps
|
| - * `tools/ipc_fuzzer/scripts/play_testcase.py path/to/testcase.ipcdump`
|
| - * more help: `tools/ipc_fuzzer/scripts/play_testcase.py -h`
|
| +### Replaying ipcdumps
|
|
|
| -## Listing messages in ipcdump
|
| - * `out/`_Build_`/ipc_message_util --dump path/to/testcase.ipcdump`
|
| +* `tools/ipc_fuzzer/scripts/play_testcase.py path/to/testcase.ipcdump`
|
| +* more help: `tools/ipc_fuzzer/scripts/play_testcase.py -h`
|
|
|
| -## Updating fuzzers in ClusterFuzz
|
| - * `tools/ipc_fuzzer/scripts/cf_package_builder.py`
|
| - * upload `ipc_fuzzer_mut.zip` and `ipc_fuzzer_gen.zip` under build directory to ClusterFuzz
|
| +### Listing messages in ipcdump
|
|
|
| -## Contributing FuzzTraits
|
| - * add them to tools/ipc\_fuzzer/fuzzer/fuzzer.cc
|
| - * thanks!
|
| +* `out/<Build>/ipc_message_util --dump path/to/testcase.ipcdump`
|
|
|
| +### Updating fuzzers in ClusterFuzz
|
|
|
| ----
|
| +* `tools/ipc_fuzzer/scripts/cf_package_builder.py`
|
| +* upload `ipc_fuzzer_mut.zip` and `ipc_fuzzer_gen.zip` under build directory
|
| + to ClusterFuzz
|
|
|
| -# Components
|
| +### Contributing FuzzTraits
|
|
|
| -## ipcdump logger
|
| - * add `enable_ipc_fuzzer=1` to `GYP_DEFINES`
|
| - * build `chrome` and `ipc_message_dump` targets
|
| - * run chrome with `--no-sandbox --ipc-dump-directory=/path/to/ipcdump/directory`
|
| - * ipcdumps will be created in this directory for each renderer using the format _pid_.ipcdump
|
| +* add them to `tools/ipc_fuzzer/fuzzer/fuzzer.cc`
|
| +* thanks!
|
|
|
| -## ipcdump replay
|
| -Lives under `ipc_fuzzer/replay`. The renderer is replaced with `ipc_fuzzer_replay` using `--renderer-cmd-prefix`. This is done automatically with the `ipc_fuzzer/play_testcase.py` convenience script.
|
| +## Components
|
|
|
| -## ipcdump mutator / generator
|
| -Lives under `ipc_fuzzer/fuzzer`. This is the code that runs on ClusterFuzz. It uses `FuzzTraits<Type>` to mutate ipcdumps or generate them out of thin air.
|
| +### ipcdump logger
|
|
|
| +* add `enable_ipc_fuzzer=1` to `GYP_DEFINES`
|
| +* build `chrome` and `ipc_message_dump` targets
|
| +* run chrome with
|
| + `--no-sandbox --ipc-dump-directory=/path/to/ipcdump/directory`
|
| +* ipcdumps will be created in this directory for each renderer using the
|
| + format `_pid_.ipcdump`
|
|
|
| ----
|
| +### ipcdump replay
|
|
|
| -# Problems, questions, suggestions
|
| -Send them to mbarbella@chromium.org.
|
| +Lives under `ipc_fuzzer/replay`. The renderer is replaced with
|
| +`ipc_fuzzer_replay` using `--renderer-cmd-prefix`. This is done automatically
|
| +with the `ipc_fuzzer/play_testcase.py` convenience script.
|
| +
|
| +### ipcdump mutator / generator
|
| +
|
| +Lives under `ipc_fuzzer/fuzzer`. This is the code that runs on ClusterFuzz. It
|
| +uses `FuzzTraits<Type>` to mutate ipcdumps or generate them out of thin air.
|
| +
|
| +## Problems, questions, suggestions
|
| +
|
| +Send them to mbarbella@chromium.org.
|
|
|