ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-11 01:31:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

update ideas

Browse Source
This commit is contained in:
van Hauser 2020-02-28 00:55:44 +01:00
parent 41493b1e3f
commit 2eb7d0d88c
1 changed files with 30 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
docs/ideas.md
View File

@ -1,6 +1,7 @@
# Ideas for afl++
In the following, we describe a variety of ideas that could be implemented for further AFL++ versions.
In the following, we describe a variety of ideas that could be implemented
for future AFL++ versions.
## Flexible Grammar Mutator
@ -19,6 +20,8 @@ common issues of the academic code.
We aim to develop a pluggable grammar mutator for afl++ that combines
various results.
Mentor: andreafioraldi
## Expand on the MOpt mutator
Work on the MOpt mutator that is already in AFL++.
@ -32,12 +35,20 @@ on Redqueen, the Radamsa mutator, the Custom mutator (the user can define
its own mutator) and the work is to generalize MOpt for all the current
and future mutators.
Mentor: vanhauser-thc or andreafioraldi
## perf-fuzz Linux Kernel Module
Port the parts of the Linux Kernel modified by [perf-fuzz](https://gts3.org/assets/papers/2017/xu:os-fuzz.pdf) in a LKM.
Or reimplement it from scratch.
Port the parts of the Linux Kernel modified by
[perf-fuzz](https://gts3.org/assets/papers/2017/xu:os-fuzz.pdf)
into a linux kernel module, so no source in the kernel needs to be changed.
Or write your worn LKM from scratch to do this.
The perf-fuzz kernel can be found at [https://github.com/sslab-gatech/perf-fuzz](https://github.com/sslab-gatech/perf-fuzz)
There also is/was a FreeBSD project at [https://github.com/veracode-research/freebsd-perf-fuzz](https://github.com/veracode-research/freebsd-perf-fuzz)
This enable snapshot fuzzing on Linux with an incredible performance.
This enable snapshot fuzzing on Linux with an incredible performance!
Mentor: any
## QEMU 4-based Instrumentation
@ -49,6 +60,8 @@ This is the cause why, right now, we cannot switch to QEMU 4.2.
Understanding the current instrumentation and fixing the current caching
issues will be needed.
Mentor: andreafioraldi
## WASM Instrumentation
Currently, AFL++ can be used for source code fuzzing and traditional binaries.
@ -58,10 +71,16 @@ This can either be done by inserting instrumentation directly into the
WASM AST, or by patching feedback into a WASM VMs of choice, similar to
the current Unicorn instrumentation.
Mentor: any
## Machine Learning
Something with machine learning, better than NEUZZ :-)
Either improve a single mutator thorugh learning of many different bugs (a bug class) or gather deep insights about a single target beforehand (CFG, DFG, VFG, ...?) and improve performance for a single target.
Something with machine learning, better than [NEUZZ](https://github.com/dongdongshe/neuzz) :-)
Either improve a single mutator thorugh learning of many different bugs
(a bug class) or gather deep insights about a single target beforehand
(CFG, DFG, VFG, ...?) and improve performance for a single target.
Mentor: domenukk
## Reengineer `afl-fuzz` as Thread Safe, Embeddable Library
@ -69,13 +88,18 @@ Right now, afl-fuzz is single threaded, cannot safely be embedded in tools, and
Instead, afl-fuzz could be refactored to contain no global state and globals.
This allows for different use cases that could be implemented during this project.
Mentor: hexcoder- or vanhauser-thc
## Collision-free Binary-Only Maps
AFL++ supports collison-free maps using an LTO (link-time-optimization) pass.
This should be possile to implement for QEMU and Unicorn instrumentations.
As the forkserver parent caches just in time translated translation blocks, adding a simple counter between jumps should be doable.
Mentor: andreafioraldi or domenukk
## Your idea!
Finally, we are open to proposals!
Create an issue at https://github.com/vanhauser-thc/AFLplusplus/issues and let's discuss :-)