microsoft
/
ebpf-for-windows
зеркало из https://github.com/microsoft/ebpf-for-windows.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
ebpf-for-windows/tests/libfuzzer
История
Anurag Saxena 8cb62b3fd7
Support for multiple implementations of global helper functions (#1761) 
* fix

* add native test

* cleanup

* CR comments

* update expected files

* fix

* cr comments
 		2022-12-31 10:56:28 -07:00
..
bpf2c Add version check to native images (#1720) 2022-12-19 20:51:07 -07:00
core_helper_fuzzer Support for multiple implementations of global helper functions (#1761) 2022-12-31 10:56:28 -07:00
execution_context Visual Studio 2022 porting (#1521) 2022-12-08 20:06:57 -07:00
include Add libfuzzer based fuzzer. (#1117) 2022-05-27 16:31:04 -07:00
verifier Visual Studio 2022 porting (#1521) 2022-12-08 20:06:57 -07:00
README.md Add fuzzer for core helper functions (#1153) 2022-06-10 16:32:31 -06:00

README.md

libFuzzer based fuzzing tools

Overview

LibFuzzer is an in-process, coverage-guided, evolutionary fuzzing engine. It uses a set of starting data (the corpus) to generate new test cases, measures the code-coverage of the new test, and re-combines it form new test cases.

There are now four libFuzzer-based binaries:

  • bpf2c_fuzzer
  • core_helper_fuzzer
  • execution_context_fuzzer
  • verifier_fuzzer

Usage

  1. Copy the libFuzzer binary and existing corpus to a test machine (currently only Windows 10 and Server 2019 are supported).
  2. Start the libFuzzer binary, pass the path to the corpus folder, and maximum time to run:
  • bpf2c_fuzzer.exe bpf2c_fuzzer_corpus -use_value_profile=1 -max_total_time=1800
  • core_helper_fuzzer.exe core_helper_fuzzer core_helper_corpus -max_len=139 -runs=2000 -use_value_profile=1
  • execution_context_fuzzer.exe execution_context_fuzzer_corpus -use_value_profile=1 -max_total_time=1800
  • verifier_fuzzer.exe verifier_corpus -use_value_profile=1 -max_total_time=1800
  1. If the fuzzer hits an issue, it will display the stack trace and create a file containing the input that triggered the crash.
  2. Copy any new test cases and check them into the repo.

Reproducing a crash

When the fuzzer finds an input that triggers a crash it will create a file with a "crash-" prefix followed by the SHA1 of the input that caused the crash. To reproduce the crash (for debugging), run the fuzzer again, passing the file name in place of the corpus folder.

Future

Once funding is available, we should set up a OneFuzz cluster and have the CI/CD pipeline deploy to it.