Skip to content

Commit bbd5b97

Browse files
duytaiduytai
committed
deploy assets
1 parent 4af092b commit bbd5b97

File tree

7 files changed

+75
-14
lines changed

7 files changed

+75
-14
lines changed

‎libfuzzer/Dictionary.cpp

+7-2
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,13 @@ using namespace std;
77
using namespace eth;
88

99
namespace fuzzer {
10-
Dictionary::Dictionary(bytes code) {
10+
void Dictionary::fromAddress(bytes data) {
11+
ExtraData d;
12+
d.data = data;
13+
extras.push_back(d);
14+
}
15+
16+
void Dictionary::fromCode(bytes code) {
1117
int pc = 0;
1218
int size = code.size();
1319
struct bytesComparation {
@@ -30,7 +36,6 @@ namespace fuzzer {
3036
for (auto value : values) {
3137
ExtraData d;
3238
d.data = value;
33-
d.hitCount = 0;
3439
extras.push_back(d);
3540
}
3641
}

‎libfuzzer/Dictionary.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ namespace fuzzer {
1616
class Dictionary {
1717
public:
1818
vector<ExtraData> extras;
19-
Dictionary() {};
20-
Dictionary(bytes code);
19+
void fromCode(bytes code);
20+
void fromAddress(bytes address);
2121
};
2222
}

‎libfuzzer/Fuzzer.cpp

+24-3
Original file line numberDiff line numberDiff line change
@@ -101,8 +101,9 @@ void Fuzzer::showStats(Mutation mutation) {
101101
auto int2 = to_string(fuzzStat.stageFinds[STAGE_INTEREST16]) + "/" + to_string(mutation.stageCycles[STAGE_INTEREST16]);
102102
auto int4 = to_string(fuzzStat.stageFinds[STAGE_INTEREST32]) + "/" + to_string(mutation.stageCycles[STAGE_INTEREST32]);
103103
auto knownInts = padStr(int1 + ", " + int2 + ", " + int4, 30);
104+
auto addrDict1 = to_string(fuzzStat.stageFinds[STAGE_EXTRAS_AO]) + "/" + to_string(mutation.stageCycles[STAGE_EXTRAS_AO]);
104105
auto dict1 = to_string(fuzzStat.stageFinds[STAGE_EXTRAS_UO]) + "/" + to_string(mutation.stageCycles[STAGE_EXTRAS_UO]);
105-
auto dictionary = padStr(dict1, 30);
106+
auto dictionary = padStr(dict1 + ", " + addrDict1, 30);
106107
auto hav1 = to_string(fuzzStat.stageFinds[STAGE_HAVOC]) + "/" + to_string(mutation.stageCycles[STAGE_HAVOC]);
107108
auto havoc = padStr(hav1, 30);
108109
auto random1 = to_string(fuzzStat.stageFinds[STAGE_RANDOM]) + "/" + to_string(mutation.stageCycles[STAGE_RANDOM]);
@@ -193,6 +194,7 @@ FuzzItem Fuzzer::saveIfInterest(TargetExecutive& te, bytes data, int depth) {
193194
/* Start fuzzing */
194195
void Fuzzer::start() {
195196
TargetContainer container;
197+
Dictionary codeDict, addressDict;
196198
for (auto contractInfo : fuzzParam.contractInfo) {
197199
ContractABI ca(contractInfo.abiJson);
198200
auto bin = fromHex(contractInfo.bin);
@@ -202,17 +204,18 @@ void Fuzzer::start() {
202204
auto data = ca.randomTestcase();
203205
auto revisedData = ContractABI::postprocessTestData(data);
204206
executive.deploy(revisedData);
207+
addressDict.fromAddress(executive.addr.asBytes());
205208
} else {
206209
auto contractName = contractInfo.contractName;
207210
boost::filesystem::remove_all(contractName);
208211
boost::filesystem::create_directory(contractName);
209-
Dictionary dict(bin);
212+
codeDict.fromCode(bin);
210213

211214
saveIfInterest(executive, ca.randomTestcase(), 0);
212215
int origHitCount = queues.size();
213216
while (true) {
214217
FuzzItem curItem = queues[fuzzStat.idx];
215-
Mutation mutation(curItem, dict);
218+
Mutation mutation(curItem, make_tuple(codeDict, addressDict));
216219
auto save = [&](bytes data) {
217220
auto item = saveIfInterest(executive, data, curItem.depth);
218221
if (fuzzStat.totalExecs % REFRESH_RATE == 0) showStats(mutation);
@@ -229,45 +232,63 @@ void Fuzzer::start() {
229232
mutation.singleWalkingBit(save);
230233
fuzzStat.stageFinds[STAGE_FLIP1] += queues.size() - origHitCount;
231234
origHitCount = queues.size();
235+
232236
mutation.twoWalkingBit(save);
233237
fuzzStat.stageFinds[STAGE_FLIP2] += queues.size() - origHitCount;
234238
origHitCount = queues.size();
239+
235240
mutation.fourWalkingBit(save);
236241
fuzzStat.stageFinds[STAGE_FLIP4] += queues.size() - origHitCount;
237242
origHitCount = queues.size();
243+
238244
mutation.singleWalkingByte(save);
239245
fuzzStat.stageFinds[STAGE_FLIP8] += queues.size() - origHitCount;
240246
origHitCount = queues.size();
247+
241248
mutation.twoWalkingByte(save);
242249
fuzzStat.stageFinds[STAGE_FLIP16] += queues.size() - origHitCount;
243250
origHitCount = queues.size();
251+
244252
mutation.fourWalkingByte(save);
245253
fuzzStat.stageFinds[STAGE_FLIP32] += queues.size() - origHitCount;
246254
origHitCount = queues.size();
255+
247256
mutation.singleArith(save);
248257
fuzzStat.stageFinds[STAGE_ARITH8] += queues.size() - origHitCount;
249258
origHitCount = queues.size();
259+
250260
mutation.twoArith(save);
251261
fuzzStat.stageFinds[STAGE_ARITH16] += queues.size() - origHitCount;
252262
origHitCount = queues.size();
263+
253264
mutation.fourArith(save);
254265
fuzzStat.stageFinds[STAGE_ARITH32] += queues.size() - origHitCount;
255266
origHitCount = queues.size();
267+
256268
mutation.singleInterest(save);
257269
fuzzStat.stageFinds[STAGE_INTEREST8] += queues.size() - origHitCount;
258270
origHitCount = queues.size();
271+
259272
mutation.twoInterest(save);
260273
fuzzStat.stageFinds[STAGE_INTEREST16] += queues.size() - origHitCount;
261274
origHitCount = queues.size();
275+
262276
mutation.fourInterest(save);
263277
fuzzStat.stageFinds[STAGE_INTEREST32] += queues.size() - origHitCount;
264278
origHitCount = queues.size();
279+
265280
mutation.overwriteWithDictionary(save);
266281
fuzzStat.stageFinds[STAGE_EXTRAS_UO] += queues.size() - origHitCount;
267282
origHitCount = queues.size();
283+
284+
mutation.overwriteWithAddressDictionary(save);
285+
fuzzStat.stageFinds[STAGE_EXTRAS_AO] += queues.size() - origHitCount;
286+
origHitCount = queues.size();
287+
268288
mutation.havoc(tracebits, save);
269289
fuzzStat.stageFinds[STAGE_HAVOC] += queues.size() - origHitCount;
270290
origHitCount = queues.size();
291+
271292
queues[fuzzStat.idx].wasFuzzed = true;
272293
} else {
273294
mutation.havoc(tracebits, save);

‎libfuzzer/Mutation.cpp

+34-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ using namespace fuzzer;
99

1010
int Mutation::stageCycles[32] = {};
1111

12-
Mutation::Mutation(FuzzItem item, Dictionary dict): curFuzzItem(item), dict(dict), dataSize(item.data.size()) {
12+
Mutation::Mutation(FuzzItem item, Dicts dicts): curFuzzItem(item), dicts(dicts), dataSize(item.data.size()) {
1313
effCount = 0;
1414
eff = bytes(effALen(dataSize), 0);
1515
eff[0] = 1;
@@ -369,6 +369,7 @@ void Mutation::fourInterest(OnMutateFunc cb) {
369369
void Mutation::overwriteWithDictionary(OnMutateFunc cb) {
370370
stageShort = "ext_UO";
371371
stageName = "dict (over)";
372+
auto dict = get<0>(dicts);
372373
stageMax = dataSize * dict.extras.size();
373374
stageCur = 0;
374375
/* Start fuzzing */
@@ -409,6 +410,37 @@ void Mutation::overwriteWithDictionary(OnMutateFunc cb) {
409410
}
410411
stageCycles[STAGE_EXTRAS_UO] += stageMax;
411412
}
413+
414+
void Mutation::overwriteWithAddressDictionary(OnMutateFunc cb) {
415+
stageShort = "ext_AO";
416+
stageName = "address (over)";
417+
auto dict = get<1>(dicts);
418+
419+
stageMax = (dataSize / 32) * dict.extras.size();
420+
stageCur = 0;
421+
/* Start fuzzing */
422+
byte *outBuf = curFuzzItem.data.data();
423+
byte inBuf[curFuzzItem.data.size()];
424+
memcpy(inBuf, outBuf, curFuzzItem.data.size());
425+
u32 extrasCount = dict.extras.size();
426+
u32 extrasLen = 20;
427+
for (u32 i = 0; i < (u32)dataSize; i += 32) {
428+
for (u32 j = 0; j < extrasCount; j += 1) {
429+
byte *extrasBuf = dict.extras[j].data.data();
430+
if (!memcmp(extrasBuf, outBuf + i + 12, extrasLen)) {
431+
stageMax --;
432+
continue;
433+
}
434+
memcpy(outBuf + i + 12, extrasBuf, extrasLen);
435+
cb(curFuzzItem.data);
436+
stageCur ++;
437+
}
438+
/* Restore all the clobbered memory. */
439+
memcpy(outBuf + i, inBuf + i, 32);
440+
}
441+
stageCycles[STAGE_EXTRAS_AO] += stageMax;
442+
}
443+
412444
/* Calculate score */
413445
double Mutation::calculateScore(const FuzzItem& item, unordered_set<uint64_t> tracebits) {
414446
double score = 0;
@@ -428,6 +460,7 @@ void Mutation::havoc(unordered_set<uint64_t> tracebits, OnMutateFunc cb) {
428460
stageCur = 0;
429461
int idx = 0;
430462
float perfScore = 1;
463+
auto dict = get<0>(dicts);
431464
vector<FuzzItem> workingQueue;
432465
vector<FuzzItem> candidateQueue;
433466
workingQueue.push_back(curFuzzItem);

‎libfuzzer/Mutation.h

+4-2
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,15 @@ using namespace eth;
1717
using namespace std;
1818

1919
namespace fuzzer {
20+
using Dicts = tuple<Dictionary/* code */, Dictionary/* address */>;
2021
class Mutation {
2122
FuzzItem curFuzzItem;
22-
Dictionary dict;
23+
Dicts dicts;
2324
int effCount;
2425
bytes eff;
2526
void flipbit(int pos);
2627
public:
27-
Mutation(FuzzItem item, Dictionary dict);
28+
Mutation(FuzzItem item, Dicts dicts);
2829
void singleWalkingBit(OnMutateFunc cb);
2930
void twoWalkingBit(OnMutateFunc cb);
3031
void fourWalkingBit(OnMutateFunc cb);
@@ -37,6 +38,7 @@ namespace fuzzer {
3738
void singleInterest(OnMutateFunc cb);
3839
void twoInterest(OnMutateFunc cb);
3940
void fourInterest(OnMutateFunc cb);
41+
void overwriteWithAddressDictionary(OnMutateFunc cb);
4042
void overwriteWithDictionary(OnMutateFunc cb);
4143
void insertWithDictionary(OnMutateFunc cb);
4244
void overwriteWithAutoDictionary(OnMutateFunc cb);

‎libfuzzer/TargetContainer.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,8 @@ namespace fuzzer {
3737
TargetProgram *program;
3838
ContractABI ca;
3939
bytes code;
40-
Address addr;
4140
public:
41+
Address addr;
4242
TargetExecutive(TargetProgram *program, Address addr, ContractABI ca, bytes code) {
4343
this->code = code;
4444
this->ca = ca;

‎libfuzzer/Util.h

+3-3
Original file line numberDiff line numberDiff line change
@@ -73,8 +73,9 @@ namespace fuzzer {
7373
static int STAGE_INTEREST32 = 11;
7474
static int STAGE_EXTRAS_UO = 12;
7575
static int STAGE_EXTRAS_UI = 13;
76-
static int STAGE_HAVOC = 14;
77-
static int STAGE_RANDOM = 15;
76+
static int STAGE_EXTRAS_AO = 14;
77+
static int STAGE_HAVOC = 15;
78+
static int STAGE_RANDOM = 16;
7879
static int HAVOC_STACK_POW2 = 7;
7980
static int HAVOC_CYCLES_INIT = 1024;
8081
static int HAVOC_CYCLES = 256;
@@ -118,6 +119,5 @@ namespace fuzzer {
118119
/* Data struct */
119120
struct ExtraData {
120121
bytes data;
121-
u32 hitCount;
122122
};
123123
}

0 commit comments

Comments
 (0)