Is possible to collect crashes info without stopping a fuzzer?

[sadovnikovsergey]

Hi,

There is feature to save crashes samples using ignore_crashes option. Is it possible to do the same using jazzer. I have not found an option that could be responsible for this. If this function is not supported, is it possible to implement it, or is its absence due to some implementation problems?

I am also interested in what role libFuzzer plays in fuzzing, namely, what causes the need to use it while jazzer works.

[fmeum]

Could you try --keep_going=<some number>? That is a Jazzer-specific feature that lets the fuzzer continue running until that number of crashes have been found.

Regarding libFuzzer: We use libFuzzer as the underlying fuzzing engine, e.g. to handle corpus management and track the fuzzer's progress via code instrumentation.

[sadovnikovsergey]

Option --keep_going=<some number> solves my problem, thanks!

Can you suggest, if it possible, which class is responsible for the logic related to collecting coverage (I mean the connection between libFizzer and jazzer)?

[fmeum]

It's not just one class, there is a bunch of logic that molds a Java fuzz target into a libfuzzer target.

The instrumentation logic lives in https://github.com/CodeIntelligenceTesting/jazzer/tree/main/src/main/java/com/code_intelligence/jazzer/instrumentor, the bridge to libFuzzer lives in native code (https://github.com/CodeIntelligenceTesting/jazzer/blob/main/src/main/native/com/code_intelligence/jazzer/driver/coverage_tracker.cpp and https://github.com/CodeIntelligenceTesting/jazzer/blob/main/src/main/native/com/code_intelligence/jazzer/driver/jazzer_fuzzer_callbacks.cpp).

[sadovnikovsergey]

Thank you for answers!

[ghost]

@sadovnikovsergey - thank you for your questions, and it looks like @fmeum was able to answer your questions. I'm curious what is underlying your question: you asked how Jazzer and LibFuzzer work together for collecting coverage. What were you trying to understand/solve? Can you help me by adding more context to your question?

I know that you asked several months ago, but I'm still curious :D

Feel free to email as well if you wish. david[dot]merian[at]code-intelligence[dot]com

Cheers,
Dave