Skip to content

Latest commit

 

History

History
65 lines (43 loc) · 1.98 KB

ipc_fuzzer.md

File metadata and controls

65 lines (43 loc) · 1.98 KB
Raw

IPC Fuzzer

A Chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives under src/tools/ipc_fuzzer/ and is running on ClusterFuzz. A previous version of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new version is doing smarter mutations and generational fuzzing. To do so, each ParamTraits<Type> needs a corresponding FuzzTraits<Type>. Feel free to contribute.

[TOC]

Working with the fuzzer

Build instructions

  • Run gn args and add enable_ipc_fuzzer = true to your args.gn.
  • build ipc_fuzzer_all target
  • component builds are currently broken, sorry
  • Debug builds are broken; only Release mode works.

Replaying ipcdumps

  • tools/ipc_fuzzer/scripts/play_testcase.py path/to/testcase.ipcdump
  • more help: tools/ipc_fuzzer/scripts/play_testcase.py -h

Listing messages in ipcdump

  • out/<Build>/ipc_message_util --dump path/to/testcase.ipcdump

Updating fuzzers in ClusterFuzz

  • tools/ipc_fuzzer/scripts/cf_package_builder.py
  • upload ipc_fuzzer_mut.zip and ipc_fuzzer_gen.zip under build directory to ClusterFuzz

Contributing FuzzTraits

  • add them to tools/ipc_fuzzer/fuzzer/fuzzer.cc
  • thanks!

Components

ipcdump logger

  • add enable_ipc_fuzzer = true to args.gn
  • build chrome and ipc_message_dump targets
  • run chrome with --no-sandbox --ipc-dump-directory=/path/to/ipcdump/directory
  • ipcdumps will be created in this directory for each renderer using the format _pid_.ipcdump

ipcdump replay

Lives under ipc_fuzzer/replay. The renderer is replaced with ipc_fuzzer_replay using --renderer-cmd-prefix. This is done automatically with the ipc_fuzzer/play_testcase.py convenience script.

ipcdump mutator / generator

Lives under ipc_fuzzer/fuzzer. This is the code that runs on ClusterFuzz. It uses FuzzTraits<Type> to mutate ipcdumps or generate them out of thin air.

Problems, questions, suggestions

Send them to mbarbella@chromium.org.