Struct libafl::mutators::mopt_mutator::MOpt

pub struct MOpt {

    pub rand: StdRand,
    pub total_finds: usize,
    pub finds_until_last_swarm: usize,
    pub w_init: f64,
    pub w_end: f64,
    pub w_now: f64,
    pub g_now: f64,
    pub g_max: f64,
    pub operator_num: usize,
    pub swarm_num: usize,
    pub period_pilot: usize,
    pub period_core: usize,
    pub pilot_time: usize,
    pub core_time: usize,
    pub swarm_now: usize,
    pub swarm_fitness: Vec<f64>,
    pub pilot_operator_finds: Vec<Vec<u64>>,
    pub pilot_operator_finds_v2: Vec<Vec<u64>>,
    pub pilot_operator_cycles: Vec<Vec<u64>>,
    pub pilot_operator_cycles_v2: Vec<Vec<u64>>,
    pub pilot_operator_cycles_v3: Vec<Vec<u64>>,
    pub operator_finds_puppet: Vec<u64>,
    pub core_operator_finds: Vec<u64>,
    pub core_operator_finds_v2: Vec<u64>,
    pub core_operator_cycles: Vec<u64>,
    pub core_operator_cycles_v2: Vec<u64>,
    pub core_operator_cycles_v3: Vec<u64>,
    /* private fields */
}

A Struct for managing MOpt-mutator parameters. There are 2 modes for MOpt scheduler, the core fuzzing mode and the pilot fuzzing mode. In short, in the pilot fuzzing mode, the fuzzer employs several swarms to compute the probability to choose the mutation operator. On the other hand, in the core fuzzing mode, the fuzzer chooses the best swarms, which was determined during the pilot fuzzing mode, to compute the probability to choose the operation operator. With the current implementation we are always in the pacemaker fuzzing mode.

Fields

rand: StdRand

Random number generator

total_finds: usize

The number of total findings (unique crashes and unique interesting paths). This is equivalent to state.corpus().count() + state.solutions().count();

finds_until_last_swarm: usize

The number of finds before until last swarm.

w_init: f64

These w_* and g_* values are the coefficients for updating variables according to the PSO algorithms

w_end: f64

These w_* and g_* values are the coefficients for updating variables according to the PSO algorithms

w_now: f64

These w_* and g_* values are the coefficients for updating variables according to the PSO algorithms

g_now: f64

These w_* and g_* values are the coefficients for updating variables according to the PSO algorithms

g_max: f64

These w_* and g_* values are the coefficients for updating variables according to the PSO algorithms

operator_num: usize

The number of mutation operators

swarm_num: usize

The number of swarms that we want to employ during the pilot fuzzing mode

period_pilot: usize

We’ll generate inputs for period_pilot times before we call pso_update in pilot fuzzing module

period_core: usize

We’ll generate inputs for period_core times before we call pso_update in core fuzzing module

pilot_time: usize

The number of testcases generated during this pilot fuzzing mode

core_time: usize

The number of testcases generated during this core fuzzing mode

swarm_now: usize

The swarm identifier that we are currently using in the pilot fuzzing mode

swarm_fitness: Vec<f64>

The fitness for each swarm, we’ll calculate the fitness in the pilot fuzzing mode and use the best one in the core fuzzing mode

pilot_operator_finds: Vec<Vec<u64>>

(Pilot Mode) Finds by each operators. This vector is used in pso_update

pilot_operator_finds_v2: Vec<Vec<u64>>

(Pilot Mode) Finds by each operator till now.

pilot_operator_cycles: Vec<Vec<u64>>

(Pilot Mode) The number of mutation operator used. This vector is used in pso_update

pilot_operator_cycles_v2: Vec<Vec<u64>>

(Pilot Mode) The number of mutation operator used till now

pilot_operator_cycles_v3: Vec<Vec<u64>>

(Pilot Mode) The number of mutation operator used till last execution

operator_finds_puppet: Vec<u64>

Vector used in pso_update

core_operator_finds: Vec<u64>

(Core Mode) Finds by each operators. This vector is used in pso_update

core_operator_finds_v2: Vec<u64>

(Core Mode) Finds by each operator till now.

core_operator_cycles: Vec<u64>

(Core Mode) The number of mutation operator used. This vector is used in pso_update

core_operator_cycles_v2: Vec<u64>

(Core Mode) The number of mutation operator used till now

core_operator_cycles_v3: Vec<u64>

(Core Mode) The number of mutation operator used till last execution

Implementations

impl MOpt

pub fn new( operator_num: usize, swarm_num: usize, rand_seed: u64 ) -> Result<Self, Error>

Creates a new MOpt instance.

pub fn pso_initialize(&mut self) -> Result<(), Error>

initialize pso

pub fn pso_update(&mut self) -> Result<(), Error>

Update the PSO algorithm parameters See https://github.com/puppet-meteor/MOpt-AFL/blob/master/MOpt/afl-fuzz.c#L10623

pub fn select_algorithm(&mut self) -> Result<MutationId, Error>

This function is used to decide the operator that we want to apply next see https://github.com/puppet-meteor/MOpt-AFL/blob/master/MOpt/afl-fuzz.c#L397

Trait Implementations

impl Clone for MOpt

fn clone(&self) -> MOpt

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MOpt

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for MOpt

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl SerdeAny for MOpt

fn as_any(&self) -> &dyn Any

returns this as Any trait

fn as_any_mut(&mut self) -> &mut dyn Any

returns this as mutable Any trait

fn as_any_boxed(self: Box<MOpt>) -> Box<dyn Any>

returns this as boxed Any trait

impl Serialize for MOpt

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.