use alloc::string::ToString;
use core::{fmt::Debug, marker::PhantomData, time::Duration};
use libafl_bolts::current_time;
use serde::{de::DeserializeOwned, Serialize};
#[cfg(test)]
use crate::inputs::Input;
#[cfg(test)]
use crate::state::NopState;
use crate::{
corpus::{Corpus, CorpusId, HasTestcase, Testcase},
events::{Event, EventConfig, EventFirer, EventProcessor, ProgressReporter},
executors::{Executor, ExitKind, HasObservers},
feedbacks::Feedback,
inputs::UsesInput,
mark_feature_time,
observers::ObserversTuple,
schedulers::Scheduler,
stages::StagesTuple,
start_timer,
state::{
HasCorpus, HasExecutions, HasImported, HasLastReportTime, HasMetadata, HasSolutions,
UsesState,
},
Error,
};
#[cfg(feature = "introspection")]
use crate::{monitors::PerfFeature, state::HasClientPerfMonitor};
const STATS_TIMEOUT_DEFAULT: Duration = Duration::from_secs(15);
pub trait HasScheduler: UsesState
where
Self::State: HasCorpus,
{
type Scheduler: Scheduler<State = Self::State>;
fn scheduler(&self) -> &Self::Scheduler;
fn scheduler_mut(&mut self) -> &mut Self::Scheduler;
}
pub trait HasFeedback: UsesState {
type Feedback: Feedback<Self::State>;
fn feedback(&self) -> &Self::Feedback;
fn feedback_mut(&mut self) -> &mut Self::Feedback;
}
pub trait HasObjective: UsesState {
type Objective: Feedback<Self::State>;
fn objective(&self) -> &Self::Objective;
fn objective_mut(&mut self) -> &mut Self::Objective;
}
pub trait ExecutionProcessor<OT>: UsesState {
fn process_execution<EM>(
&mut self,
state: &mut Self::State,
manager: &mut EM,
input: <Self::State as UsesInput>::Input,
observers: &OT,
exit_kind: &ExitKind,
send_events: bool,
) -> Result<(ExecuteInputResult, Option<CorpusId>), Error>
where
EM: EventFirer<State = Self::State>;
}
pub trait EvaluatorObservers<OT>: UsesState + Sized {
fn evaluate_input_with_observers<E, EM>(
&mut self,
state: &mut Self::State,
executor: &mut E,
manager: &mut EM,
input: <Self::State as UsesInput>::Input,
send_events: bool,
) -> Result<(ExecuteInputResult, Option<CorpusId>), Error>
where
E: Executor<EM, Self> + HasObservers<Observers = OT, State = Self::State>,
EM: EventFirer<State = Self::State>;
}
pub trait Evaluator<E, EM>: UsesState
where
E: UsesState<State = Self::State>,
EM: UsesState<State = Self::State>,
{
fn evaluate_input(
&mut self,
state: &mut Self::State,
executor: &mut E,
manager: &mut EM,
input: <Self::State as UsesInput>::Input,
) -> Result<(ExecuteInputResult, Option<CorpusId>), Error> {
self.evaluate_input_events(state, executor, manager, input, true)
}
fn evaluate_input_events(
&mut self,
state: &mut Self::State,
executor: &mut E,
manager: &mut EM,
input: <Self::State as UsesInput>::Input,
send_events: bool,
) -> Result<(ExecuteInputResult, Option<CorpusId>), Error>;
fn add_input(
&mut self,
state: &mut Self::State,
executor: &mut E,
manager: &mut EM,
input: <Self::State as UsesInput>::Input,
) -> Result<CorpusId, Error>;
}
pub trait Fuzzer<E, EM, ST>: Sized + UsesState
where
Self::State: HasMetadata + HasExecutions + HasLastReportTime,
E: UsesState<State = Self::State>,
EM: ProgressReporter<State = Self::State>,
ST: StagesTuple<E, EM, Self::State, Self>,
{
fn fuzz_one(
&mut self,
stages: &mut ST,
executor: &mut E,
state: &mut EM::State,
manager: &mut EM,
) -> Result<CorpusId, Error>;
fn fuzz_loop(
&mut self,
stages: &mut ST,
executor: &mut E,
state: &mut EM::State,
manager: &mut EM,
) -> Result<(), Error> {
let monitor_timeout = STATS_TIMEOUT_DEFAULT;
loop {
manager.maybe_report_progress(state, monitor_timeout)?;
self.fuzz_one(stages, executor, state, manager)?;
}
}
fn fuzz_loop_for(
&mut self,
stages: &mut ST,
executor: &mut E,
state: &mut EM::State,
manager: &mut EM,
iters: u64,
) -> Result<CorpusId, Error> {
if iters == 0 {
return Err(Error::illegal_argument(
"Cannot fuzz for 0 iterations!".to_string(),
));
}
let mut ret = None;
let monitor_timeout = STATS_TIMEOUT_DEFAULT;
for _ in 0..iters {
manager.maybe_report_progress(state, monitor_timeout)?;
ret = Some(self.fuzz_one(stages, executor, state, manager)?);
}
manager.report_progress(state)?;
Ok(ret.unwrap())
}
}
#[derive(Debug, PartialEq, Eq)]
pub enum ExecuteInputResult {
None,
Corpus,
Solution,
}
#[derive(Debug)]
pub struct StdFuzzer<CS, F, OF, OT>
where
CS: Scheduler,
F: Feedback<CS::State>,
OF: Feedback<CS::State>,
CS::State: HasCorpus,
{
scheduler: CS,
feedback: F,
objective: OF,
phantom: PhantomData<OT>,
}
impl<CS, F, OF, OT> UsesState for StdFuzzer<CS, F, OF, OT>
where
CS: Scheduler,
F: Feedback<CS::State>,
OF: Feedback<CS::State>,
CS::State: HasCorpus,
{
type State = CS::State;
}
impl<CS, F, OF, OT> HasScheduler for StdFuzzer<CS, F, OF, OT>
where
CS: Scheduler,
F: Feedback<CS::State>,
OF: Feedback<CS::State>,
CS::State: HasCorpus,
{
type Scheduler = CS;
fn scheduler(&self) -> &CS {
&self.scheduler
}
fn scheduler_mut(&mut self) -> &mut CS {
&mut self.scheduler
}
}
impl<CS, F, OF, OT> HasFeedback for StdFuzzer<CS, F, OF, OT>
where
CS: Scheduler,
F: Feedback<CS::State>,
OF: Feedback<CS::State>,
CS::State: HasCorpus,
{
type Feedback = F;
fn feedback(&self) -> &Self::Feedback {
&self.feedback
}
fn feedback_mut(&mut self) -> &mut Self::Feedback {
&mut self.feedback
}
}
impl<CS, F, OF, OT> HasObjective for StdFuzzer<CS, F, OF, OT>
where
CS: Scheduler,
F: Feedback<CS::State>,
OF: Feedback<CS::State>,
CS::State: HasCorpus,
{
type Objective = OF;
fn objective(&self) -> &OF {
&self.objective
}
fn objective_mut(&mut self) -> &mut OF {
&mut self.objective
}
}
impl<CS, F, OF, OT> ExecutionProcessor<OT> for StdFuzzer<CS, F, OF, OT>
where
CS: Scheduler,
F: Feedback<CS::State>,
OF: Feedback<CS::State>,
OT: ObserversTuple<CS::State> + Serialize + DeserializeOwned,
CS::State: HasCorpus + HasSolutions + HasExecutions + HasCorpus + HasImported,
{
fn process_execution<EM>(
&mut self,
state: &mut Self::State,
manager: &mut EM,
input: <Self::State as UsesInput>::Input,
observers: &OT,
exit_kind: &ExitKind,
send_events: bool,
) -> Result<(ExecuteInputResult, Option<CorpusId>), Error>
where
EM: EventFirer<State = Self::State>,
{
let mut res = ExecuteInputResult::None;
#[cfg(not(feature = "introspection"))]
let is_solution = self
.objective_mut()
.is_interesting(state, manager, &input, observers, exit_kind)?;
#[cfg(feature = "introspection")]
let is_solution = self
.objective_mut()
.is_interesting_introspection(state, manager, &input, observers, exit_kind)?;
if is_solution {
res = ExecuteInputResult::Solution;
} else {
#[cfg(not(feature = "introspection"))]
let is_corpus = self
.feedback_mut()
.is_interesting(state, manager, &input, observers, exit_kind)?;
#[cfg(feature = "introspection")]
let is_corpus = self
.feedback_mut()
.is_interesting_introspection(state, manager, &input, observers, exit_kind)?;
if is_corpus {
res = ExecuteInputResult::Corpus;
}
}
match res {
ExecuteInputResult::None => {
self.feedback_mut().discard_metadata(state, &input)?;
self.objective_mut().discard_metadata(state, &input)?;
Ok((res, None))
}
ExecuteInputResult::Corpus => {
self.objective_mut().discard_metadata(state, &input)?;
let mut testcase = Testcase::with_executions(input.clone(), *state.executions());
self.feedback_mut()
.append_metadata(state, observers, &mut testcase)?;
let idx = state.corpus_mut().add(testcase)?;
self.scheduler_mut().on_add(state, idx)?;
if send_events {
let observers_buf = if manager.configuration() == EventConfig::AlwaysUnique {
None
} else {
manager.serialize_observers::<OT>(observers)?
};
manager.fire(
state,
Event::NewTestcase {
input,
observers_buf,
exit_kind: *exit_kind,
corpus_size: state.corpus().count(),
client_config: manager.configuration(),
time: current_time(),
executions: *state.executions(),
forward_id: None,
},
)?;
} else {
*state.imported_mut() += 1;
}
Ok((res, Some(idx)))
}
ExecuteInputResult::Solution => {
self.feedback_mut().discard_metadata(state, &input)?;
let mut testcase = Testcase::with_executions(input, *state.executions());
testcase.set_parent_id_optional(*state.corpus().current());
self.objective_mut()
.append_metadata(state, observers, &mut testcase)?;
state.solutions_mut().add(testcase)?;
if send_events {
manager.fire(
state,
Event::Objective {
objective_size: state.solutions().count(),
},
)?;
}
Ok((res, None))
}
}
}
}
impl<CS, F, OF, OT> EvaluatorObservers<OT> for StdFuzzer<CS, F, OF, OT>
where
CS: Scheduler,
OT: ObserversTuple<CS::State> + Serialize + DeserializeOwned,
F: Feedback<CS::State>,
OF: Feedback<CS::State>,
CS::State: HasCorpus + HasSolutions + HasExecutions + HasImported,
{
#[inline]
fn evaluate_input_with_observers<E, EM>(
&mut self,
state: &mut Self::State,
executor: &mut E,
manager: &mut EM,
input: <Self::State as UsesInput>::Input,
send_events: bool,
) -> Result<(ExecuteInputResult, Option<CorpusId>), Error>
where
E: Executor<EM, Self> + HasObservers<Observers = OT, State = Self::State>,
EM: EventFirer<State = Self::State>,
{
let exit_kind = self.execute_input(state, executor, manager, &input)?;
let observers = executor.observers();
self.scheduler.on_evaluation(state, &input, observers)?;
self.process_execution(state, manager, input, observers, &exit_kind, send_events)
}
}
impl<CS, E, EM, F, OF, OT> Evaluator<E, EM> for StdFuzzer<CS, F, OF, OT>
where
CS: Scheduler,
E: HasObservers<State = CS::State, Observers = OT> + Executor<EM, Self>,
EM: EventFirer<State = CS::State>,
F: Feedback<CS::State>,
OF: Feedback<CS::State>,
OT: ObserversTuple<CS::State> + Serialize + DeserializeOwned,
CS::State: HasCorpus + HasSolutions + HasExecutions + HasImported,
{
#[inline]
fn evaluate_input_events(
&mut self,
state: &mut Self::State,
executor: &mut E,
manager: &mut EM,
input: <Self::State as UsesInput>::Input,
send_events: bool,
) -> Result<(ExecuteInputResult, Option<CorpusId>), Error> {
self.evaluate_input_with_observers(state, executor, manager, input, send_events)
}
fn add_input(
&mut self,
state: &mut Self::State,
executor: &mut E,
manager: &mut EM,
input: <Self::State as UsesInput>::Input,
) -> Result<CorpusId, Error> {
let exit_kind = self.execute_input(state, executor, manager, &input)?;
let observers = executor.observers();
let mut testcase = Testcase::with_executions(input.clone(), *state.executions());
#[cfg(not(feature = "introspection"))]
let is_solution = self
.objective_mut()
.is_interesting(state, manager, &input, observers, &exit_kind)?;
#[cfg(feature = "introspection")]
let is_solution = self
.objective_mut()
.is_interesting_introspection(state, manager, &input, observers, &exit_kind)?;
if is_solution {
self.objective_mut()
.append_metadata(state, observers, &mut testcase)?;
let idx = state.solutions_mut().add(testcase)?;
manager.fire(
state,
Event::Objective {
objective_size: state.solutions().count(),
},
)?;
return Ok(idx);
}
self.objective_mut().discard_metadata(state, &input)?;
#[cfg(not(feature = "introspection"))]
let _is_corpus = self
.feedback_mut()
.is_interesting(state, manager, &input, observers, &exit_kind)?;
#[cfg(feature = "introspection")]
let _is_corpus = self
.feedback_mut()
.is_interesting_introspection(state, manager, &input, observers, &exit_kind)?;
self.feedback_mut()
.append_metadata(state, observers, &mut testcase)?;
let idx = state.corpus_mut().add(testcase)?;
self.scheduler_mut().on_add(state, idx)?;
let observers_buf = if manager.configuration() == EventConfig::AlwaysUnique {
None
} else {
manager.serialize_observers::<OT>(observers)?
};
manager.fire(
state,
Event::NewTestcase {
input,
observers_buf,
exit_kind,
corpus_size: state.corpus().count(),
client_config: manager.configuration(),
time: current_time(),
executions: *state.executions(),
forward_id: None,
},
)?;
Ok(idx)
}
}
impl<CS, E, EM, F, OF, OT, ST> Fuzzer<E, EM, ST> for StdFuzzer<CS, F, OF, OT>
where
CS: Scheduler,
E: UsesState<State = CS::State>,
EM: ProgressReporter + EventProcessor<E, Self, State = CS::State>,
F: Feedback<CS::State>,
OF: Feedback<CS::State>,
CS::State:
HasExecutions + HasMetadata + HasCorpus + HasTestcase + HasImported + HasLastReportTime,
ST: StagesTuple<E, EM, CS::State, Self>,
{
fn fuzz_one(
&mut self,
stages: &mut ST,
executor: &mut E,
state: &mut CS::State,
manager: &mut EM,
) -> Result<CorpusId, Error> {
#[cfg(feature = "introspection")]
state.introspection_monitor_mut().start_timer();
let idx = self.scheduler.next(state)?;
#[cfg(feature = "introspection")]
state.introspection_monitor_mut().mark_scheduler_time();
#[cfg(feature = "introspection")]
state.introspection_monitor_mut().reset_stage_index();
stages.perform_all(self, executor, state, manager, idx)?;
#[cfg(feature = "introspection")]
state.introspection_monitor_mut().start_timer();
manager.process(self, state, executor)?;
#[cfg(feature = "introspection")]
state.introspection_monitor_mut().mark_manager_time();
{
let mut testcase = state.testcase_mut(idx)?;
let scheduled_count = testcase.scheduled_count();
testcase.set_scheduled_count(scheduled_count + 1);
}
Ok(idx)
}
}
impl<CS, F, OF, OT> StdFuzzer<CS, F, OF, OT>
where
CS: Scheduler,
F: Feedback<CS::State>,
OF: Feedback<CS::State>,
CS::State: UsesInput + HasExecutions + HasCorpus,
{
pub fn new(scheduler: CS, feedback: F, objective: OF) -> Self {
Self {
scheduler,
feedback,
objective,
phantom: PhantomData,
}
}
pub fn execute_input<E, EM>(
&mut self,
state: &mut CS::State,
executor: &mut E,
event_mgr: &mut EM,
input: &<CS::State as UsesInput>::Input,
) -> Result<ExitKind, Error>
where
E: Executor<EM, Self> + HasObservers<Observers = OT, State = CS::State>,
EM: UsesState<State = CS::State>,
OT: ObserversTuple<CS::State>,
{
start_timer!(state);
executor.observers_mut().pre_exec_all(state, input)?;
mark_feature_time!(state, PerfFeature::PreExecObservers);
start_timer!(state);
let exit_kind = executor.run_target(self, state, event_mgr, input)?;
mark_feature_time!(state, PerfFeature::TargetExecution);
start_timer!(state);
executor
.observers_mut()
.post_exec_all(state, input, &exit_kind)?;
mark_feature_time!(state, PerfFeature::PostExecObservers);
Ok(exit_kind)
}
}
pub trait ExecutesInput<E, EM>: UsesState
where
E: UsesState<State = Self::State>,
EM: UsesState<State = Self::State>,
{
fn execute_input(
&mut self,
state: &mut Self::State,
executor: &mut E,
event_mgr: &mut EM,
input: &<Self::State as UsesInput>::Input,
) -> Result<ExitKind, Error>;
}
impl<CS, E, EM, F, OF> ExecutesInput<E, EM> for StdFuzzer<CS, F, OF, E::Observers>
where
CS: Scheduler,
F: Feedback<CS::State>,
OF: Feedback<CS::State>,
E: Executor<EM, Self> + HasObservers<State = CS::State>,
EM: UsesState<State = CS::State>,
CS::State: UsesInput + HasExecutions + HasCorpus,
{
fn execute_input(
&mut self,
state: &mut CS::State,
executor: &mut E,
event_mgr: &mut EM,
input: &<CS::State as UsesInput>::Input,
) -> Result<ExitKind, Error> {
start_timer!(state);
executor.observers_mut().pre_exec_all(state, input)?;
mark_feature_time!(state, PerfFeature::PreExecObservers);
start_timer!(state);
let exit_kind = executor.run_target(self, state, event_mgr, input)?;
mark_feature_time!(state, PerfFeature::TargetExecution);
start_timer!(state);
executor
.observers_mut()
.post_exec_all(state, input, &exit_kind)?;
mark_feature_time!(state, PerfFeature::PostExecObservers);
Ok(exit_kind)
}
}
#[cfg(test)]
#[derive(Clone, Debug, Default)]
pub(crate) struct NopFuzzer<I> {
phantom: PhantomData<I>,
}
#[cfg(test)]
impl<I> NopFuzzer<I> {
pub fn new() -> Self {
Self {
phantom: PhantomData,
}
}
}
#[cfg(test)]
impl<I> UsesState for NopFuzzer<I>
where
I: Input,
{
type State = NopState<I>;
}
#[cfg(test)]
impl<ST, E, I, EM> Fuzzer<E, EM, ST> for NopFuzzer<I>
where
E: UsesState<State = NopState<I>>,
EM: ProgressReporter<State = NopState<I>>,
I: Input,
ST: StagesTuple<E, EM, NopState<I>, Self>,
{
fn fuzz_one(
&mut self,
_stages: &mut ST,
_executor: &mut E,
_state: &mut EM::State,
_manager: &mut EM,
) -> Result<CorpusId, Error> {
unimplemented!()
}
}
#[cfg(feature = "python")]
#[allow(missing_docs)]
pub mod pybind {
use alloc::{boxed::Box, vec::Vec};
use libafl_bolts::ownedref::OwnedMutPtr;
use pyo3::prelude::*;
use crate::{
events::pybind::PythonEventManager,
executors::pybind::PythonExecutor,
feedbacks::pybind::PythonFeedback,
fuzzer::{Evaluator, Fuzzer, StdFuzzer},
inputs::BytesInput,
observers::pybind::PythonObserversTuple,
schedulers::QueueScheduler,
stages::pybind::PythonStagesTuple,
state::pybind::{PythonStdState, PythonStdStateWrapper},
};
pub type PythonStdFuzzer = StdFuzzer<
QueueScheduler<PythonStdState>,
PythonFeedback,
PythonFeedback,
PythonObserversTuple,
>;
#[pyclass(unsendable, name = "StdFuzzer")]
#[derive(Debug)]
pub struct PythonStdFuzzerWrapper {
pub inner: OwnedMutPtr<PythonStdFuzzer>,
}
impl PythonStdFuzzerWrapper {
pub fn wrap(r: &mut PythonStdFuzzer) -> Self {
Self {
inner: OwnedMutPtr::Ptr(r),
}
}
#[must_use]
pub fn unwrap(&self) -> &PythonStdFuzzer {
self.inner.as_ref()
}
pub fn unwrap_mut(&mut self) -> &mut PythonStdFuzzer {
self.inner.as_mut()
}
}
#[pymethods]
impl PythonStdFuzzerWrapper {
#[new]
fn new(py_feedback: PythonFeedback, py_objective: PythonFeedback) -> Self {
Self {
inner: OwnedMutPtr::Owned(Box::new(StdFuzzer::new(
QueueScheduler::new(),
py_feedback,
py_objective,
))),
}
}
fn add_input(
&mut self,
py_state: &mut PythonStdStateWrapper,
py_executor: &mut PythonExecutor,
py_mgr: &mut PythonEventManager,
input: Vec<u8>,
) -> usize {
self.inner
.as_mut()
.add_input(
py_state.unwrap_mut(),
py_executor,
py_mgr,
BytesInput::new(input),
)
.expect("Failed to add input")
.0
}
fn fuzz_loop(
&mut self,
py_executor: &mut PythonExecutor,
py_state: &mut PythonStdStateWrapper,
py_mgr: &mut PythonEventManager,
stages_tuple: &mut PythonStagesTuple,
) {
self.inner
.as_mut()
.fuzz_loop(stages_tuple, py_executor, py_state.unwrap_mut(), py_mgr)
.expect("Failed to generate the initial corpus");
}
}
pub fn register(_py: Python, m: &PyModule) -> PyResult<()> {
m.add_class::<PythonStdFuzzerWrapper>()?;
Ok(())
}
}