OLD | NEW |
1 # IPC Fuzzer | 1 # IPC Fuzzer |
2 | 2 |
3 A chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives | 3 A Chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives |
4 under `src/tools/ipc_fuzzer/` and is running on ClusterFuzz. A previous version | 4 under `src/tools/ipc_fuzzer/` and is running on ClusterFuzz. A previous version |
5 of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new | 5 of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new |
6 version is doing smarter mutations and generational fuzzing. To do so, each | 6 version is doing smarter mutations and generational fuzzing. To do so, each |
7 `ParamTraits<Type>` needs a corresponding `FuzzTraits<Type>`. Feel free to | 7 `ParamTraits<Type>` needs a corresponding `FuzzTraits<Type>`. Feel free to |
8 contribute. | 8 contribute. |
9 | 9 |
10 [TOC] | 10 [TOC] |
11 | 11 |
12 ## Working with the fuzzer | 12 ## Working with the fuzzer |
13 | 13 |
(...skipping 43 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
57 with the `ipc_fuzzer/play_testcase.py` convenience script. | 57 with the `ipc_fuzzer/play_testcase.py` convenience script. |
58 | 58 |
59 ### ipcdump mutator / generator | 59 ### ipcdump mutator / generator |
60 | 60 |
61 Lives under `ipc_fuzzer/fuzzer`. This is the code that runs on ClusterFuzz. It | 61 Lives under `ipc_fuzzer/fuzzer`. This is the code that runs on ClusterFuzz. It |
62 uses `FuzzTraits<Type>` to mutate ipcdumps or generate them out of thin air. | 62 uses `FuzzTraits<Type>` to mutate ipcdumps or generate them out of thin air. |
63 | 63 |
64 ## Problems, questions, suggestions | 64 ## Problems, questions, suggestions |
65 | 65 |
66 Send them to mbarbella@chromium.org. | 66 Send them to mbarbella@chromium.org. |
OLD | NEW |