Add Input Types and Mutators for Numeric Types #2760

riesentoaster · 2024-12-11T21:30:02Z

No description provided.

* Rules * more * aa

* fixing empty multipart name * fixing clippy * improve flexibility of DumpToDiskStage * adding note to MIGRATION.md

libafl/src/inputs/wrapping.rs

libafl/src/mutators/numeric.rs

libafl/src/inputs/wrapping.rs

riesentoaster · 2024-12-12T15:13:37Z

Turns out Rust has some built-in functionality I did not know about.

riesentoaster · 2024-12-12T15:40:35Z

Let me figure out mapping for these as well.

libafl/src/mutators/numeric.rs

riesentoaster · 2024-12-12T22:47:15Z

Thoughts?

fuzzers/structure_aware/baby_fuzzer_custom_input/src/input.rs

libafl/src/mutators/numeric.rs

domenukk · 2024-12-13T13:53:11Z

Left some more comments (sorry :D)

Also, it probably makes sense to support an "interesting values" mutator(?)

LibAFL/libafl/src/mutators/mutations.rs

Line 95 in be21fae

pub const INTERESTING_32: [i32; 27] = [

Note that stacking mutations probably makes a lot less sense for int mutations btw, no clue how to best model that.

riesentoaster · 2024-12-13T14:08:16Z

Left some more comments (sorry :D)

Thank you for your time!

Also, it probably makes sense to support an "interesting values" mutator(?)

LibAFL/libafl/src/mutators/mutations.rs

Line 95 in be21fae

pub const INTERESTING_32: [i32; 27] = [

Ideally, you'd want to statically generate them at this point, otherwise you'll create a lot of duplicate code. Maybe I'll get around to it at some point. Create an issue and merge this for now?

Note that stacking mutations probably makes a lot less sense for int mutations btw, no clue how to best model that.

Fair enough, but I'm not sure you'd ever use this outside of mapped mutators anyways, and there stacking makes sense again, so 🤷‍♂️.

libafl/src/inputs/value.rs

langston-barrett · 2024-12-13T15:43:14Z

libafl/src/inputs/value.rs

+    use super::{ValueInput, ValueMutRefInput};
+    use crate::mutators::numeric::Numeric;
+
+    fn take_numeric<I: Numeric + Clone>(i: I) {


What is this supposed to test? I wouldn't be at all surprised if the compiler notices that this is all dead code and optimizes it away. Perhaps this should assert_eq! that i.clone.f() is the same as ValueInput::from(i.clone()).f().inner()?

Valid point, this definitely is not a robust testing regime.

To be honest, this was mostly a test during development that the types work out, so the fact that it compiles is the main testing success.

Previous implementations panicked on certain values, and especially min and max values seemed unstable. I don't think this is still possible, but I figured the cost of leaving this here is minimal compared to potential breakage.

Ideally however, we'd prove some of these properties, I have no idea how to do this though.

I have renamed the test to better reflect what it's currently doing.

I'm now also checking if the operations actually change the values. Still not comprehensive, but it's a start.

langston-barrett · 2024-12-13T15:49:23Z

libafl/src/mutators/numeric.rs

+
+    /// Flip the bit at the specified offset.
+    ///
+    /// Has no effect if `offset` is out of bounds for the type.


This seems inconsistent with the impl below, << panics if the RHS is too big (playground)

You're right, I have added a safety notice. Is that enough?

domenukk · 2024-12-15T01:57:16Z

libafl/src/mutators/numeric.rs

+            fn randomize<R: Rand>(&mut self, rand: &mut R) {
+                // flip random bits, no need to reset to zero
+                *self ^= <$t>::from(rand.next());
+                *self ^= <$t>::from(rand.next()) << 64;


This should only be done on values >64 bit. It's useless overhead on anything else

Like, since rand.next() changes the state, it has to be executed even though the value is ignored.

The macro is only called for u128 and i128, I have another implementation with a straight cast for the other types:

*self = rand.next() as $t;

Aaah missed that, nice! <3

could be something like:
*self = (((rand.next() as u128 << 64)) | rand.next() as u128) as $t

Nevermind that guy isn't optimized

*self ^= <$t>::from(rand.next()) << 64 | <$t>::from(rand.next());

This produces the same output, but clippy doesn't complain about infallible casts.

Why xor? Just assign

The casts are all right, fwiw. But I'm fine with either. Shifting in unsigned land is in generally less ... weird.. though, that's why I prefer it. play it safe.

Fair enough.

domenukk · 2024-12-15T14:00:47Z

Thanks!

* fixing empty multipart name * fixing clippy * New rules for the contributing (AFLplusplus#2752) * Rules * more * aa * Improve Flexibility of DumpToDiskStage (AFLplusplus#2753) * fixing empty multipart name * fixing clippy * improve flexibility of DumpToDiskStage * adding note to MIGRATION.md * Introduce WrappingMutator * introducing mutators for int types * fixing no_std * random fixes * Add hash derivation for WrappingInput * Revert fixes that broke things * Derive Default on WrappingInput * Add unit tests * Fixes according to code review * introduce mappable ValueInputs * remove unnecessary comments * Elide more lifetimes * remove dead code * simplify hashing * improve docs * improve randomization * rename method to align with standard library * add typedefs for int types for ValueMutRefInput * rename test * add safety notice to trait function * improve randomize performance for i128/u128 * rename macro * improve comment * actually check return values in test * make 128 bit int randomize even more efficient * shifting signed values --------- Co-authored-by: Dongjia "toka" Zhang <[email protected]> Co-authored-by: Dominik Maier <[email protected]>

* fixing empty multipart name * fixing clippy * New rules for the contributing (#2752) * Rules * more * aa * Improve Flexibility of DumpToDiskStage (#2753) * fixing empty multipart name * fixing clippy * improve flexibility of DumpToDiskStage * adding note to MIGRATION.md * Update bindgen requirement from 0.70.1 to 0.71.1 (#2756) Updates the requirements on [bindgen](https://github.com/rust-lang/rust-bindgen) to permit the latest version. - [Release notes](https://github.com/rust-lang/rust-bindgen/releases) - [Changelog](https://github.com/rust-lang/rust-bindgen/blob/main/CHANGELOG.md) - [Commits](rust-lang/rust-bindgen@v0.70.1...v0.71.1) --- updated-dependencies: - dependency-name: bindgen dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * No Use* from stages (#2745) * no from stage * fixer * doc fix * how was this working???? * more fixes * delete more * rq * cargo-fuzz * m * aa * Update CONTRIBUTING.md MIGRATION.md (#2762) * No Uses* from `fuzzer` (#2761) * go * fixing stuf * hello from windows * more * lolg * lolf * fix * a --------- Co-authored-by: Your Name <[email protected]> * Remove useless cfgs (#2764) * Link libresolv on all Apple OSs (#2767) * Somewhat ugly CI fix... (#2768) * Maybe fix CI * does this help? * Very dirty 'fix' * Add Input Types and Mutators for Numeric Types (#2760) * fixing empty multipart name * fixing clippy * New rules for the contributing (#2752) * Rules * more * aa * Improve Flexibility of DumpToDiskStage (#2753) * fixing empty multipart name * fixing clippy * improve flexibility of DumpToDiskStage * adding note to MIGRATION.md * Introduce WrappingMutator * introducing mutators for int types * fixing no_std * random fixes * Add hash derivation for WrappingInput * Revert fixes that broke things * Derive Default on WrappingInput * Add unit tests * Fixes according to code review * introduce mappable ValueInputs * remove unnecessary comments * Elide more lifetimes * remove dead code * simplify hashing * improve docs * improve randomization * rename method to align with standard library * add typedefs for int types for ValueMutRefInput * rename test * add safety notice to trait function * improve randomize performance for i128/u128 * rename macro * improve comment * actually check return values in test * make 128 bit int randomize even more efficient * shifting signed values --------- Co-authored-by: Dongjia "toka" Zhang <[email protected]> Co-authored-by: Dominik Maier <[email protected]> * Add HashMutator * Fix docs * Fix docs again * introducing bloom filter * fix tests * Implement evaluate_filtered * Add macros to libafl_bolts tuples for mapping and merging types (#2788) * Add macros * Use the macros for havoc_mutations * Fix docs * improve merge_tuple_list_type to accept n items * libafl_cc: Automatically find llvm_ar path (#2790) * imemory_ondisk: Don't fail write under any circumstances if locking is disabled (#2791) * imemory_ondisk: Don't fail write under any circumstances if locking is disabled * fmt * inmemory_ondisk: Add a log message on failure * clippy' * micro optimization * Revert changes to global Cargo.toml * Hide std-dependent dependency behind std feature * Fix example fuzzer * Rename constructor for filtered fuzzer * Reorder generics alphabetically * Rename HashingMutator, add note to MutationResult about filtered fuzzers * Improve StdFuzzer according to feedback * rename hashing mutator * Fix english in comment * Cleanup of old PRs that break the CI * Fix more CI bugs * Code cleanup * Remove unnecessary comments --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Dongjia "toka" Zhang <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Your Name <[email protected]> Co-authored-by: Sharad Khanna <[email protected]> Co-authored-by: Dominik Maier <[email protected]> Co-authored-by: s1341 <[email protected]>

riesentoaster and others added 14 commits December 6, 2024 17:02

fixing empty multipart name

aefb8e3

fixing clippy

a98c981

Merge branch 'main' into main

7acf5a3

New rules for the contributing (AFLplusplus#2752)

2da6dc5

* Rules * more * aa

Improve Flexibility of DumpToDiskStage (AFLplusplus#2753)

1e571a0

* fixing empty multipart name * fixing clippy * improve flexibility of DumpToDiskStage * adding note to MIGRATION.md

Introduce WrappingMutator

b4ff6b6

introducing mutators for int types

8af6280

Merge branch 'main' into numeric-mutators

9806f3f

fixing no_std

21f9177

random fixes

93b79a6

Add hash derivation for WrappingInput

ac648c4

Revert fixes that broke things

aa207ec

Derive Default on WrappingInput

39ae88c

Add unit tests

d54a7d3

domenukk reviewed Dec 12, 2024

View reviewed changes

libafl/src/inputs/wrapping.rs Outdated Show resolved Hide resolved

domenukk reviewed Dec 12, 2024

View reviewed changes

libafl/src/mutators/numeric.rs Outdated Show resolved Hide resolved

domenukk reviewed Dec 12, 2024

View reviewed changes

libafl/src/inputs/wrapping.rs Outdated Show resolved Hide resolved

Fixes according to code review

2ea8132

riesentoaster marked this pull request as draft December 12, 2024 15:40

domenukk reviewed Dec 12, 2024

View reviewed changes

libafl/src/mutators/numeric.rs Outdated Show resolved Hide resolved

riesentoaster added 3 commits December 12, 2024 23:41

introduce mappable ValueInputs

0b093e4

remove unnecessary comments

11981ea

Merge branch 'main' into numeric-mutators

0fa453a

riesentoaster marked this pull request as ready for review December 12, 2024 22:47

Elide more lifetimes

cd5e834

tokatoka requested a review from domenukk December 12, 2024 23:36

domenukk reviewed Dec 13, 2024

View reviewed changes

fuzzers/structure_aware/baby_fuzzer_custom_input/src/input.rs Outdated Show resolved Hide resolved

domenukk reviewed Dec 13, 2024

View reviewed changes

libafl/src/mutators/numeric.rs Show resolved Hide resolved

domenukk reviewed Dec 13, 2024

View reviewed changes

libafl/src/mutators/numeric.rs Outdated Show resolved Hide resolved

remove dead code

90932d1

simplify hashing

4158166

riesentoaster added 2 commits December 13, 2024 15:09

improve docs

829e365

improve randomization

ab97abd

langston-barrett reviewed Dec 13, 2024

View reviewed changes

libafl/src/inputs/value.rs Outdated Show resolved Hide resolved

langston-barrett reviewed Dec 13, 2024

View reviewed changes

riesentoaster added 4 commits December 13, 2024 18:45

rename method to align with standard library

22a26e0

add typedefs for int types for ValueMutRefInput

6ba97db

rename test

25f034d

add safety notice to trait function

faf127c

riesentoaster requested a review from domenukk December 13, 2024 21:07

riesentoaster added 4 commits December 15, 2024 01:01

improve randomize performance for i128/u128

58cf5d0

rename macro

d81ee93

improve comment

56c947a

Merge branch 'main' into numeric-mutators

ed97a73

domenukk reviewed Dec 15, 2024

View reviewed changes

riesentoaster added 2 commits December 15, 2024 03:32

actually check return values in test

ea9e4a1

make 128 bit int randomize even more efficient

8b87945

riesentoaster requested a review from langston-barrett December 15, 2024 02:52

riesentoaster and others added 2 commits December 15, 2024 04:03

shifting signed values

7f513d4

Merge branch 'main' into numeric-mutators

e77d7a5

domenukk merged commit 61e3f0b into AFLplusplus:main Dec 15, 2024
103 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Input Types and Mutators for Numeric Types #2760

Add Input Types and Mutators for Numeric Types #2760

riesentoaster commented Dec 11, 2024

riesentoaster commented Dec 12, 2024

riesentoaster commented Dec 12, 2024

riesentoaster commented Dec 12, 2024

domenukk commented Dec 13, 2024

riesentoaster commented Dec 13, 2024 •

edited

Loading

langston-barrett Dec 13, 2024

riesentoaster Dec 13, 2024

riesentoaster Dec 13, 2024

riesentoaster Dec 15, 2024

langston-barrett Dec 13, 2024

riesentoaster Dec 13, 2024

domenukk Dec 15, 2024

domenukk Dec 15, 2024

riesentoaster Dec 15, 2024

domenukk Dec 15, 2024

domenukk Dec 15, 2024 •

edited

Loading

domenukk Dec 15, 2024

riesentoaster Dec 15, 2024

domenukk Dec 15, 2024

domenukk Dec 15, 2024

riesentoaster Dec 15, 2024

domenukk commented Dec 15, 2024

Add Input Types and Mutators for Numeric Types #2760

Add Input Types and Mutators for Numeric Types #2760

Conversation

riesentoaster commented Dec 11, 2024

riesentoaster commented Dec 12, 2024

riesentoaster commented Dec 12, 2024

riesentoaster commented Dec 12, 2024

domenukk commented Dec 13, 2024

riesentoaster commented Dec 13, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

domenukk Dec 15, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

domenukk commented Dec 15, 2024

riesentoaster commented Dec 13, 2024 •

edited

Loading

domenukk Dec 15, 2024 •

edited

Loading