| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 1 | # IPC Fuzzer |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 2 | |
| qyearsley | c0dc6f4 | 2016-12-02 22:13:39 | [diff] [blame] | 3 | A Chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 4 | under `src/tools/ipc_fuzzer/` and is running on ClusterFuzz. A previous version |
| 5 | of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new |
| 6 | version is doing smarter mutations and generational fuzzing. To do so, each |
| 7 | `ParamTraits<Type>` needs a corresponding `FuzzTraits<Type>`. Feel free to |
| 8 | contribute. |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 9 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 10 | [TOC] |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 11 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 12 | ## Working with the fuzzer |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 13 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 14 | ### Build instructions |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 15 | |
| ochang | cc11d0e | 2016-04-26 19:58:26 | [diff] [blame] | 16 | * Run `gn args` and add `enable_ipc_fuzzer = true` to your args.gn. If you use |
| 17 | GYP, add `enable_ipc_fuzzer=1` to `GYP_DEFINES`. |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 18 | * build `ipc_fuzzer_all` target |
| 19 | * component builds are currently broken, sorry |
| 20 | * Debug builds are broken; only Release mode works. |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 21 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 22 | ### Replaying ipcdumps |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 23 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 24 | * `tools/ipc_fuzzer/scripts/play_testcase.py path/to/testcase.ipcdump` |
| 25 | * more help: `tools/ipc_fuzzer/scripts/play_testcase.py -h` |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 26 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 27 | ### Listing messages in ipcdump |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 28 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 29 | * `out/<Build>/ipc_message_util --dump path/to/testcase.ipcdump` |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 30 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 31 | ### Updating fuzzers in ClusterFuzz |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 32 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 33 | * `tools/ipc_fuzzer/scripts/cf_package_builder.py` |
| 34 | * upload `ipc_fuzzer_mut.zip` and `ipc_fuzzer_gen.zip` under build directory |
| 35 | to ClusterFuzz |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 36 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 37 | ### Contributing FuzzTraits |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 38 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 39 | * add them to `tools/ipc_fuzzer/fuzzer/fuzzer.cc` |
| 40 | * thanks! |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 41 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 42 | ## Components |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 43 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 44 | ### ipcdump logger |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 45 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 46 | * add `enable_ipc_fuzzer=1` to `GYP_DEFINES` |
| 47 | * build `chrome` and `ipc_message_dump` targets |
| 48 | * run chrome with |
| 49 | `--no-sandbox --ipc-dump-directory=/path/to/ipcdump/directory` |
| 50 | * ipcdumps will be created in this directory for each renderer using the |
| 51 | format `_pid_.ipcdump` |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 52 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 53 | ### ipcdump replay |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 54 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 55 | Lives under `ipc_fuzzer/replay`. The renderer is replaced with |
| 56 | `ipc_fuzzer_replay` using `--renderer-cmd-prefix`. This is done automatically |
| 57 | with the `ipc_fuzzer/play_testcase.py` convenience script. |
| 58 | |
| 59 | ### ipcdump mutator / generator |
| 60 | |
| 61 | Lives under `ipc_fuzzer/fuzzer`. This is the code that runs on ClusterFuzz. It |
| 62 | uses `FuzzTraits<Type>` to mutate ipcdumps or generate them out of thin air. |
| 63 | |
| 64 | ## Problems, questions, suggestions |
| 65 | |
| 66 | Send them to mbarbella@chromium.org. |
