Park, Geon (re-st)

AFL이 저장할 input이란건 어디서 판단하나

[research] 1 min read

new_coverage는 여기서 판단

1/* Check if the result of an execve() during routine fuzzing is interesting,
2   save or queue the input test case for further analysis if so. Returns 1 if
3   entry is saved, 0 otherwise. */
4static u8 save_if_interesting(char** argv, void* mem, u32 len, u8 fault) {
5	/* 생략 */
6	if (hnb == 2) {
7	  queue_last->has_new_cov = 1;
8	  queued_with_cov++;
9	}

이후 add_to_queue함수에서 저장.

 1/* Append new test case to the queue. */
 2static void add_to_queue(u8* fname, u32 len, u8 passed_det, u64 prox_score) {
 3  struct queue_entry* q = ck_alloc(sizeof(struct queue_entry));
 4
 5  q->fname        = fname;
 6  q->len          = len;
 7  q->depth        = cur_depth + 1;
 8  q->passed_det   = passed_det;
 9  q->prox_score   = prox_score;
10  q->entry_id     = queued_paths;

<< Previous Post

|

Next Post >>

← 뒤로