diff options
| author | van Hauser <vh@thc.org> | 2019-09-05 10:06:02 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-09-05 10:06:02 +0200 |
| commit | 5955dd4e25c9f7dd46e19ea246b14734822d1759 (patch) | |
| tree | 802c5b59ee18a2977aa10740105a62e04423a06e /docs | |
| parent | abf61ecc8f1b4ea3de59f818d859139637b29f32 (diff) | |
| parent | e0f9aa35081b0dffba1476192bc071848082c504 (diff) | |
| download | afl++-5955dd4e25c9f7dd46e19ea246b14734822d1759.tar.gz | |
Merge pull request #54 from code-intelligence-gmbh/custom_mutator_docs
Custom mutator docs
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/custom_mutator.txt | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/docs/custom_mutator.txt b/docs/custom_mutator.txt new file mode 100644 index 00000000..3b1b93b9 --- /dev/null +++ b/docs/custom_mutator.txt @@ -0,0 +1,34 @@ +================================================== +Adding custom mutators to AFL using +================================================== +This file describes how you can implement custom mutations to be used in AFL. + +Implemented by Khaled Yakdan from Code Intelligence <yakdan@code-intelligence.de> + + +1) Description +-------------- + +Custom mutator libraries can be passed to afl-fuzz to perform custom mutations +on test cases beyond those available in AFL - for example, to enable structure-aware +fuzzing by using libraries that perform mutations according to a given grammar. + +The custom mutator library is passed to afl-fuzz via the AFL_CUSTOM_MUTATOR_LIBRARY +environment variable. The library must export the afl_custom_mutator() function and +must be compiled as a shared object. For example: + $CC -shared -Wall -O3 <lib-name>.c -o <lib-name>.so + +AFL will call the afl_custom_mutator() function every time it needs to mutate +a test case. For some cases, the format of the mutated data returned from +the custom mutator is not suitable to directly execute the target with this input. +For example, when using libprotobuf-mutator, the data returned is in a protobuf +format which corresponds to a given grammar. In order to execute the target, +the protobuf data must be converted to the plain-text format expected by the target. +In such scenarios, the user can define the afl_pre_save_handler() function. This function +is then transforms the data into the format expected by the API before executing the target. +afl_pre_save_handler is optional and does not have to be implemented if its functionality +is not needed. + +2) Example +---------- +A simple example is provided in ../custom_mutators/ \ No newline at end of file |