| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 1 | # IPC Fuzzer |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 2 | |
| qyearsley | c0dc6f4 | 2016-12-02 22:13:39 | [diff] [blame] | 3 | A Chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 4 | under `src/tools/ipc_fuzzer/` and is running on ClusterFuzz. A previous version |
| 5 | of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new |
| 6 | version is doing smarter mutations and generational fuzzing. To do so, each |
| 7 | `ParamTraits<Type>` needs a corresponding `FuzzTraits<Type>`. Feel free to |
| 8 | contribute. |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 9 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 10 | [TOC] |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 11 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 12 | ## Working with the fuzzer |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 13 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 14 | ### Build instructions |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 15 | |
| Daniel Bratell | f73f0df | 2018-09-24 13:52:49 | [diff] [blame] | 16 | * Run `gn args` and add `enable_ipc_fuzzer = true` to your args.gn. |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 17 | * build `ipc_fuzzer_all` target |
| 18 | * component builds are currently broken, sorry |
| 19 | * Debug builds are broken; only Release mode works. |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 20 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 21 | ### Replaying ipcdumps |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 22 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 23 | * `tools/ipc_fuzzer/scripts/play_testcase.py path/to/testcase.ipcdump` |
| 24 | * more help: `tools/ipc_fuzzer/scripts/play_testcase.py -h` |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 25 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 26 | ### Listing messages in ipcdump |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 27 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 28 | * `out/<Build>/ipc_message_util --dump path/to/testcase.ipcdump` |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 29 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 30 | ### Updating fuzzers in ClusterFuzz |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 31 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 32 | * `tools/ipc_fuzzer/scripts/cf_package_builder.py` |
| 33 | * upload `ipc_fuzzer_mut.zip` and `ipc_fuzzer_gen.zip` under build directory |
| 34 | to ClusterFuzz |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 35 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 36 | ### Contributing FuzzTraits |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 37 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 38 | * add them to `tools/ipc_fuzzer/fuzzer/fuzzer.cc` |
| 39 | * thanks! |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 40 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 41 | ## Components |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 42 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 43 | ### ipcdump logger |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 44 | |
| Daniel Bratell | f73f0df | 2018-09-24 13:52:49 | [diff] [blame] | 45 | * add `enable_ipc_fuzzer = true` to `args.gn` |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 46 | * build `chrome` and `ipc_message_dump` targets |
| 47 | * run chrome with |
| 48 | `--no-sandbox --ipc-dump-directory=/path/to/ipcdump/directory` |
| 49 | * ipcdumps will be created in this directory for each renderer using the |
| 50 | format `_pid_.ipcdump` |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 51 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 52 | ### ipcdump replay |
| andybons | 3322f76 | 2015-08-24 21:37:09 | [diff] [blame] | 53 | |
| andybons | ad92aa3 | 2015-08-31 02:27:44 | [diff] [blame] | 54 | Lives under `ipc_fuzzer/replay`. The renderer is replaced with |
| 55 | `ipc_fuzzer_replay` using `--renderer-cmd-prefix`. This is done automatically |
| 56 | with the `ipc_fuzzer/play_testcase.py` convenience script. |
| 57 | |
| 58 | ### ipcdump mutator / generator |
| 59 | |
| 60 | Lives under `ipc_fuzzer/fuzzer`. This is the code that runs on ClusterFuzz. It |
| 61 | uses `FuzzTraits<Type>` to mutate ipcdumps or generate them out of thin air. |
| 62 | |
| 63 | ## Problems, questions, suggestions |
| 64 | |
| 65 | Send them to mbarbella@chromium.org. |
