about summary refs log tree commit diff
path: root/docs/custom_mutators.md
diff options
context:
space:
mode:
authorvan Hauser <vh@thc.org>2020-11-18 21:25:35 +0100
committerGitHub <noreply@github.com>2020-11-18 21:25:35 +0100
commit4d9eb9bda147a26fc8cbe885b6193cf0c94c6314 (patch)
treec7a903633c7d1b0b5e373535188fd3a458a7f329 /docs/custom_mutators.md
parent4c59c5234aec0469e4dd02561dbd84387bd53155 (diff)
parentcd0a25be5e9b05a2ab6a11592cd95e7f653bf42d (diff)
downloadafl++-4d9eb9bda147a26fc8cbe885b6193cf0c94c6314.tar.gz
Merge pull request #607 from AFLplusplus/dev
push to stable
Diffstat (limited to 'docs/custom_mutators.md')
-rw-r--r--docs/custom_mutators.md13
1 files changed, 13 insertions, 0 deletions
diff --git a/docs/custom_mutators.md b/docs/custom_mutators.md
index 81ee9de4..53f783fe 100644
--- a/docs/custom_mutators.md
+++ b/docs/custom_mutators.md
@@ -42,6 +42,7 @@ size_t afl_custom_havoc_mutation(void *data, unsigned char *buf, size_t buf_size
 unsigned char afl_custom_havoc_mutation_probability(void *data);
 unsigned char afl_custom_queue_get(void *data, const unsigned char *filename);
 void afl_custom_queue_new_entry(void *data, const unsigned char *filename_new_queue, const unsigned int *filename_orig_queue);
+const char* afl_custom_introspection(my_mutator_t *data);
 void afl_custom_deinit(void *data);
 ```
 
@@ -81,6 +82,9 @@ def queue_new_entry(filename_new_queue, filename_orig_queue):
     pass
 ```
 
+def introspection():
+    return string
+
 ### Custom Mutation
 
 - `init`:
@@ -126,10 +130,19 @@ def queue_new_entry(filename_new_queue, filename_orig_queue):
     `post_process` function. This function is then transforming the data into the
     format expected by the API before executing the target.
 
+    This can return any python object that implements the buffer protocol and
+    supports PyBUF_SIMPLE. These include bytes, bytearray, etc.
+
 - `queue_new_entry` (optional):
 
     This methods is called after adding a new test case to the queue.
 
+- `introspection` (optional):
+
+    This method is called after a new queue entry, crash or timeout is
+    discovered if compiled with INTROSPECTION. The custom mutator can then
+    return a string (const char *) that reports the exact mutations used.
+
 - `deinit`:
 
     The last method to be called, deinitializing the state.