diff options
Diffstat (limited to 'docs/custom_mutators.md')
| -rw-r--r-- | docs/custom_mutators.md | 35 |
1 files changed, 22 insertions, 13 deletions
diff --git a/docs/custom_mutators.md b/docs/custom_mutators.md index 3cd874b9..464acbee 100644 --- a/docs/custom_mutators.md +++ b/docs/custom_mutators.md @@ -33,13 +33,14 @@ C/C++: ```c void *afl_custom_init(afl_t *afl, unsigned int seed); size_t afl_custom_fuzz(void *data, uint8_t *buf, size_t buf_size, u8 **out_buf, uint8_t *add_buf, size_t add_buf_size, size_t max_size); -size_t afl_custom_pre_save(void *data, uint8_t *buf, size_t buf_size, uint8_t **out_buf); +size_t afl_custom_post_process(void *data, uint8_t *buf, size_t buf_size, uint8_t **out_buf); int32_t afl_custom_init_trim(void *data, uint8_t *buf, size_t buf_size); size_t afl_custom_trim(void *data, uint8_t **out_buf); int32_t afl_custom_post_trim(void *data, int success) { size_t afl_custom_havoc_mutation(void *data, u8 *buf, size_t buf_size, u8 **out_buf, size_t max_size); uint8_t afl_custom_havoc_mutation_probability(void *data); -uint8_t afl_custom_queue_get(void *data, const uint8_t *filename); void afl_custom_queue_new_entry(void *data, const uint8_t *filename_new_queue, const uint8_t *filename_orig_queue); +uint8_t afl_custom_queue_get(void *data, const uint8_t *filename); +void afl_custom_queue_new_entry(void *data, const uint8_t *filename_new_queue, const uint8_t *filename_orig_queue); void afl_custom_deinit(void *data); ``` @@ -51,7 +52,7 @@ def init(seed): def fuzz(buf, add_buf, max_size): return mutated_out -def pre_save(buf): +def post_process(buf): return out_buf def init_trim(buf): @@ -84,13 +85,16 @@ def queue_new_entry(filename_new_queue, filename_orig_queue): - `queue_get` (optional): - This method determines whether the fuzzer should fuzz the current queue - entry or not + This method determines whether the custom fuzzer should fuzz the current + queue entry or not -- `fuzz` (required): +- `fuzz` (optional): This method performs custom mutations on a given input. It also accepts an additional test case. + Note that this function is optional - but it makes sense to use it. + You would only skip this if `post_process` is used to fix checksums etc. + so you are using it e.g. as a post processing library. - `havoc_mutation` and `havoc_mutation_probability` (optional): @@ -99,7 +103,7 @@ def queue_new_entry(filename_new_queue, filename_orig_queue): `havoc_mutation_probability`, returns the probability that `havoc_mutation` is called in havoc. By default, it is 6%. -- `pre_save` (optional): +- `post_process` (optional): For some cases, the format of the mutated data returned from the custom mutator is not suitable to directly execute the target with this input. @@ -107,13 +111,20 @@ def queue_new_entry(filename_new_queue, filename_orig_queue): protobuf format which corresponds to a given grammar. In order to execute the target, the protobuf data must be converted to the plain-text format expected by the target. In such scenarios, the user can define the - `pre_save` function. This function is then transforms the data into the + `post_process` function. This function is then transforming the data into the format expected by the API before executing the target. - `queue_new_entry` (optional): This methods is called after adding a new test case to the queue. +- `deinit`: + + The last method to be called, deinitializing the state. + +Note that there are also three functions for trimming as described in the +next section. + ### Trimming Support The generic trimming routines implemented in AFL++ can easily destroy the @@ -160,10 +171,8 @@ trimmed input. Here's a quick API description: In any case, this method must return the next trim iteration index (from 0 to the maximum amount of steps you returned in `init_trim`). -`deinit` the last method to be called, deinitializing the state. - -Omitting any of three methods will cause the trimming to be disabled and trigger -a fallback to the builtin default trimming routine. +Omitting any of three trimming methods will cause the trimming to be disabled +and trigger a fallback to the builtin default trimming routine. ### Environment Variables @@ -214,7 +223,7 @@ For C/C++ mutator, the source code must be compiled as a shared object: gcc -shared -Wall -O3 example.c -o example.so ``` Note that if you specify multiple custom mutators, the corresponding functions will -be called in the order in which they are specified. e.g first `pre_save` function of +be called in the order in which they are specified. e.g first `post_process` function of `example_first.so` will be called and then that of `example_second.so` ### Run |