Adding new mutator i.e radamsa

[marcinguy]

Hi!

Can you guide, give some tips how to add a new mutator?

What files and functions need to be modified?

Here is my attempt (with debugs):

https://github.com/marcinguy/frida-fuzzer/tree/radamsa

Somehow radamsa_target is never called.

I tried to figure it out on my own, but did not succeed.

I want to add radamsa via radamsa binary and exec it. I know it will be performance hit, but still want to try it.

I still ask however, what would be the best approach to add radamsa?

Thanks,

[andreafioraldi]

i think this a bad idea, radamsa is slow. If you really want it, you should use libradamsa from aflpp and not execute the randamsa binary every time

[marcinguy]

Maybe you know JS <-> C world better.

Compiled your libradamsa to JS using emscripten

em++       -O3       -Oz       --llvm-lto 1       -s NO_EXIT_RUNTIME=1       -s EXPORTED_FUNCTIONS="['_radamsa']"       libradamsa.bc       -o radamsa.html

Do you happen to know how to call it now from JS?

        var Module = {
          onRuntimeInitialized: function() {
            radamsa = Module.cwrap('radamsa', 'number', ['string', 'number', 'string', 'number', 'number'])
                  ?????
          },
        };

Or you would do it differently, not using emscripten?

[andreafioraldi]

You must use the Frida API, Cmodule or load the libradamsa as a shared library and invoke its routines from JS using a NativeFunction.

[marcinguy]

Would save me hours of finding it out to see a sample.

I saw how you use CModule (couldn't find any references about it while googling)

So I can put radamsa C code in CModule and than use NativeFunction to call it?

Biggest question I have, is how to pass input and output buffer via NativeFunction to radamsa()

Here is function signature:

 n = radamsa((uint8_t *) input, len, (uint8_t *) output, BUFSIZE, seed);

Any tips, points to code samples would be great.

Thank you in advance

[marcinguy]

Managed to add it. Did it like you described.

Performance was affected. Radamsa is 10x slower than havoc and splice in my run.

For Multimedia Format fuzzing i.e HEVC, would you add other mutators than havoc and splice? Or do anything else? Or generally to extend this fuzzer. I can add them in similar approach.

P.S I know this is your PoC fuzzer

[andreafioraldi]

Yes you can try to add other mutators. Personally I don't like radamsa as it is too slow and generates the same inputs many times, but if you add other stuffs like protobuf etc I will accept a PR.