LLVM  4.0.0
Classes | Public Member Functions | List of all members
fuzzer::MutationDispatcher Class Reference

#include <FuzzerMutate.h>

Public Member Functions

 MutationDispatcher (Random &Rand, const FuzzingOptions &Options)
 
 ~MutationDispatcher ()
 
void StartMutationSequence ()
 Indicate that we are about to start a new sequence of mutations. More...
 
void PrintMutationSequence ()
 Print the current sequence of mutations. More...
 
void RecordSuccessfulMutationSequence ()
 Indicate that the current sequence of mutations was successfull. More...
 
size_t Mutate_Custom (uint8_t *Data, size_t Size, size_t MaxSize)
 Mutates data by invoking user-provided mutator. More...
 
size_t Mutate_CustomCrossOver (uint8_t *Data, size_t Size, size_t MaxSize)
 Mutates data by invoking user-provided crossover. More...
 
size_t Mutate_ShuffleBytes (uint8_t *Data, size_t Size, size_t MaxSize)
 Mutates data by shuffling bytes. More...
 
size_t Mutate_EraseBytes (uint8_t *Data, size_t Size, size_t MaxSize)
 Mutates data by erasing bytes. More...
 
size_t Mutate_InsertByte (uint8_t *Data, size_t Size, size_t MaxSize)
 Mutates data by inserting a byte. More...
 
size_t Mutate_InsertRepeatedBytes (uint8_t *Data, size_t Size, size_t MaxSize)
 Mutates data by inserting several repeated bytes. More...
 
size_t Mutate_ChangeByte (uint8_t *Data, size_t Size, size_t MaxSize)
 Mutates data by chanding one byte. More...
 
size_t Mutate_ChangeBit (uint8_t *Data, size_t Size, size_t MaxSize)
 Mutates data by chanding one bit. More...
 
size_t Mutate_CopyPart (uint8_t *Data, size_t Size, size_t MaxSize)
 Mutates data by copying/inserting a part of data into a different place. More...
 
size_t Mutate_AddWordFromManualDictionary (uint8_t *Data, size_t Size, size_t MaxSize)
 Mutates data by adding a word from the manual dictionary. More...
 
size_t Mutate_AddWordFromTemporaryAutoDictionary (uint8_t *Data, size_t Size, size_t MaxSize)
 Mutates data by adding a word from the temporary automatic dictionary. More...
 
size_t Mutate_AddWordFromTORC (uint8_t *Data, size_t Size, size_t MaxSize)
 Mutates data by adding a word from the TORC. More...
 
size_t Mutate_AddWordFromPersistentAutoDictionary (uint8_t *Data, size_t Size, size_t MaxSize)
 Mutates data by adding a word from the persistent automatic dictionary. More...
 
size_t Mutate_ChangeASCIIInteger (uint8_t *Data, size_t Size, size_t MaxSize)
 Tries to find an ASCII integer in Data, changes it to another ASCII int. More...
 
size_t Mutate_ChangeBinaryInteger (uint8_t *Data, size_t Size, size_t MaxSize)
 Change a 1-, 2-, 4-, or 8-byte integer in interesting ways. More...
 
size_t Mutate_CrossOver (uint8_t *Data, size_t Size, size_t MaxSize)
 CrossOver Data with some other element of the corpus. More...
 
size_t Mutate (uint8_t *Data, size_t Size, size_t MaxSize)
 Applies one of the configured mutations. More...
 
size_t DefaultMutate (uint8_t *Data, size_t Size, size_t MaxSize)
 Applies one of the default mutations. More...
 
size_t CrossOver (const uint8_t *Data1, size_t Size1, const uint8_t *Data2, size_t Size2, uint8_t *Out, size_t MaxOutSize)
 Creates a cross-over of two pieces of Data, returns its size. More...
 
void AddWordToManualDictionary (const Word &W)
 
void AddWordToAutoDictionary (DictionaryEntry DE)
 
void ClearAutoDictionary ()
 
void PrintRecommendedDictionary ()
 
void SetCorpus (const InputCorpus *Corpus)
 
RandomGetRand ()
 

Detailed Description

Definition at line 21 of file FuzzerMutate.h.

Constructor & Destructor Documentation

fuzzer::MutationDispatcher::MutationDispatcher ( Random Rand,
const FuzzingOptions Options 
)
fuzzer::MutationDispatcher::~MutationDispatcher ( )
inline

Definition at line 24 of file FuzzerMutate.h.

Member Function Documentation

void fuzzer::MutationDispatcher::AddWordToAutoDictionary ( DictionaryEntry  DE)
void fuzzer::MutationDispatcher::AddWordToManualDictionary ( const Word W)

Definition at line 512 of file FuzzerMutate.cpp.

References fuzzer::Dictionary::push_back().

Referenced by TestAddWordFromDictionary().

void fuzzer::MutationDispatcher::ClearAutoDictionary ( )

Definition at line 523 of file FuzzerMutate.cpp.

References fuzzer::Dictionary::clear().

Referenced by fuzzer::TraceState::StartTraceRecording().

size_t fuzzer::MutationDispatcher::CrossOver ( const uint8_t *  Data1,
size_t  Size1,
const uint8_t *  Data2,
size_t  Size2,
uint8_t *  Out,
size_t  MaxOutSize 
)

Creates a cross-over of two pieces of Data, returns its size.

Definition at line 20 of file FuzzerCrossOver.cpp.

References assert(), and fuzzer::min().

Referenced by Mutate_CrossOver().

size_t fuzzer::MutationDispatcher::DefaultMutate ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Applies one of the default mutations.

Provided as a service to mutation authors.

Definition at line 478 of file FuzzerMutate.cpp.

Referenced by LLVMFuzzerMutate().

Random& fuzzer::MutationDispatcher::GetRand ( )
inline

Definition at line 92 of file FuzzerMutate.h.

size_t fuzzer::MutationDispatcher::Mutate ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Applies one of the configured mutations.

Returns the new size of data which could be up to MaxSize.

Definition at line 474 of file FuzzerMutate.cpp.

Referenced by TEST().

size_t fuzzer::MutationDispatcher::Mutate_AddWordFromManualDictionary ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Mutates data by adding a word from the manual dictionary.

Definition at line 165 of file FuzzerMutate.cpp.

Referenced by MutationDispatcher(), and TEST().

size_t fuzzer::MutationDispatcher::Mutate_AddWordFromPersistentAutoDictionary ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Mutates data by adding a word from the persistent automatic dictionary.

Definition at line 260 of file FuzzerMutate.cpp.

Referenced by MutationDispatcher().

size_t fuzzer::MutationDispatcher::Mutate_AddWordFromTemporaryAutoDictionary ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Mutates data by adding a word from the temporary automatic dictionary.

Definition at line 171 of file FuzzerMutate.cpp.

Referenced by MutationDispatcher(), and TEST().

size_t fuzzer::MutationDispatcher::Mutate_AddWordFromTORC ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)
size_t fuzzer::MutationDispatcher::Mutate_ChangeASCIIInteger ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Tries to find an ASCII integer in Data, changes it to another ASCII int.

Definition at line 327 of file FuzzerMutate.cpp.

References assert(), B, E, and i.

Referenced by MutationDispatcher(), and TEST().

size_t fuzzer::MutationDispatcher::Mutate_ChangeBinaryInteger ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Change a 1-, 2-, 4-, or 8-byte integer in interesting ways.

Definition at line 386 of file FuzzerMutate.cpp.

References assert().

Referenced by MutationDispatcher(), and TEST().

size_t fuzzer::MutationDispatcher::Mutate_ChangeBit ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Mutates data by chanding one bit.

Definition at line 157 of file FuzzerMutate.cpp.

Referenced by MutationDispatcher(), and TEST().

size_t fuzzer::MutationDispatcher::Mutate_ChangeByte ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Mutates data by chanding one byte.

Definition at line 149 of file FuzzerMutate.cpp.

References fuzzer::RandCh().

Referenced by MutationDispatcher(), and TEST().

size_t fuzzer::MutationDispatcher::Mutate_CopyPart ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Mutates data by copying/inserting a part of data into a different place.

Definition at line 318 of file FuzzerMutate.cpp.

References fuzzer::Random::RandBool().

Referenced by MutationDispatcher(), and TEST().

size_t fuzzer::MutationDispatcher::Mutate_CrossOver ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

CrossOver Data with some other element of the corpus.

Definition at line 400 of file FuzzerMutate.cpp.

References assert(), CrossOver(), and fuzzer::InputCorpus::size().

Referenced by MutationDispatcher().

size_t fuzzer::MutationDispatcher::Mutate_Custom ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Mutates data by invoking user-provided mutator.

Definition at line 71 of file FuzzerMutate.cpp.

References fuzzer::EF, and fuzzer::Random::Rand().

Referenced by MutationDispatcher().

size_t fuzzer::MutationDispatcher::Mutate_CustomCrossOver ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Mutates data by invoking user-provided crossover.

Definition at line 76 of file FuzzerMutate.cpp.

References assert(), fuzzer::EF, Other, fuzzer::Random::Rand(), and fuzzer::InputCorpus::size().

Referenced by MutationDispatcher().

size_t fuzzer::MutationDispatcher::Mutate_EraseBytes ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Mutates data by erasing bytes.

Definition at line 108 of file FuzzerMutate.cpp.

References assert(), and N.

Referenced by MutationDispatcher(), and TEST().

size_t fuzzer::MutationDispatcher::Mutate_InsertByte ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Mutates data by inserting a byte.

Definition at line 121 of file FuzzerMutate.cpp.

References fuzzer::RandCh().

Referenced by MutationDispatcher(), and TEST().

size_t fuzzer::MutationDispatcher::Mutate_InsertRepeatedBytes ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Mutates data by inserting several repeated bytes.

Definition at line 131 of file FuzzerMutate.cpp.

References assert(), i, fuzzer::min(), N, and fuzzer::Random::RandBool().

Referenced by MutationDispatcher(), and TEST().

size_t fuzzer::MutationDispatcher::Mutate_ShuffleBytes ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Mutates data by shuffling bytes.

Definition at line 95 of file FuzzerMutate.cpp.

References assert(), and fuzzer::min().

Referenced by MutationDispatcher(), and TEST().

void fuzzer::MutationDispatcher::PrintMutationSequence ( )

Print the current sequence of mutations.

Definition at line 461 of file FuzzerMutate.cpp.

References fuzzer::DictionaryEntry::GetW(), fuzzer::PrintASCII(), and fuzzer::Printf().

void fuzzer::MutationDispatcher::PrintRecommendedDictionary ( )
void fuzzer::MutationDispatcher::RecordSuccessfulMutationSequence ( )

Indicate that the current sequence of mutations was successfull.

Definition at line 436 of file FuzzerMutate.cpp.

References fuzzer::Dictionary::ContainsWord(), fuzzer::DictionaryEntry::GetW(), fuzzer::DictionaryEntry::IncSuccessCount(), and fuzzer::Dictionary::push_back().

void fuzzer::MutationDispatcher::SetCorpus ( const InputCorpus Corpus)
inline

Definition at line 90 of file FuzzerMutate.h.

void fuzzer::MutationDispatcher::StartMutationSequence ( )

Indicate that we are about to start a new sequence of mutations.

Definition at line 430 of file FuzzerMutate.cpp.


The documentation for this class was generated from the following files: