diff options
| -rw-r--r-- | custom_mutators/simple_mutator.c | 27 | ||||
| -rw-r--r-- | include/afl-fuzz.h | 16 |
2 files changed, 28 insertions, 15 deletions
diff --git a/custom_mutators/simple_mutator.c b/custom_mutators/simple_mutator.c index 5c40d462..bf655679 100644 --- a/custom_mutators/simple_mutator.c +++ b/custom_mutators/simple_mutator.c @@ -3,9 +3,10 @@ Written by Khaled Yakdan <yakdan@code-intelligence.de> - This a simple mutator that assumes that the generates messages starting with one - of the three strings GET, PUT, or DEL followed by a payload. The mutator randomly - selects a commend and mutates the payload of the seed provided as input. + This a simple mutator that assumes that the generates messages starting with + one of the three strings GET, PUT, or DEL followed by a payload. The mutator + randomly selects a commend and mutates the payload of the seed provided as + input. */ #include <stdint.h> @@ -13,28 +14,36 @@ #include <string.h> static const char *commands[] = { - "GET", - "PUT", - "DEL", + + "GET", + "PUT", + "DEL", + }; static size_t data_size = 100; -size_t afl_custom_mutator (uint8_t *data, size_t size, uint8_t* mutated_out, size_t max_size, unsigned int seed) { +size_t afl_custom_mutator(uint8_t *data, size_t size, uint8_t *mutated_out, + size_t max_size, unsigned int seed) { // Seed the PRNG srand(seed); - // Make sure that the packet size does not exceed the maximum size expected by the fuzzer + // Make sure that the packet size does not exceed the maximum size expected by + // the fuzzer size_t mutated_size = data_size <= max_size ? data_size : max_size; // Randomly select a command string to add as a header to the packet memcpy(mutated_out, commands[rand() % 3], 3); // Mutate the payload of the packet - for (int i = 3 ; i < mutated_size ; i++) { + for (int i = 3; i < mutated_size; i++) { + mutated_out[i] = (data[i] + rand() % 10) & 0xff; + } return mutated_size; + } + diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index 86b97c12..a04402ef 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -426,20 +426,24 @@ u8* (*post_handler)(u8* buf, u32* len); * @param data Input data to be mutated * @param size Size of input data * @param mutated_out Buffer to store the mutated input - * @param max_size Maximum size of the mutated output. The mutation must not produce data larger than max_size. - * @param seed Seed used for the mutation. The mutation should produce the same output given the same seed. + * @param max_size Maximum size of the mutated output. The mutation must not + * produce data larger than max_size. + * @param seed Seed used for the mutation. The mutation should produce the same + * output given the same seed. * @return Size of the mutated output. */ -size_t (*custom_mutator)(u8 *data, size_t size, u8* mutated_out, size_t max_size, unsigned int seed); +size_t (*custom_mutator)(u8* data, size_t size, u8* mutated_out, + size_t max_size, unsigned int seed); /** - * A post-processing function to use right before AFL writes the test case to disk in order to execute the target. - * If this functionality is not needed, Simply don't define this function. + * A post-processing function to use right before AFL writes the test case to + * disk in order to execute the target. If this functionality is not needed, + * Simply don't define this function. * @param data Buffer containing the test case to be executed. * @param size Size of the test case. * @param new_data Buffer to store the test case after processing * @return Size of data after processing. */ -size_t (*pre_save_handler)(u8 *data, size_t size, u8 **new_data); +size_t (*pre_save_handler)(u8* data, size_t size, u8** new_data); /* Interesting values, as per config.h */ |