fuzzware
fuzzware copied to clipboard
More handlers
Two suggestions for handlers:
Fuzz Return:
Sometimes it would be nice to fuzz the return value of a function instead of replacing it with a static value. I've prototyped this with the inline asm native.inline_asm_024900bfd1f800007047efbe0040
which returns the value of 0x4000beef (a made up peripheral address), but I suspect there may be better ways to do this.
Readable ASM: Rather than specify inline_asm through hex values, it would be nice to have an option to write it out in readable form, and have it assembled, so as to make the config files more readable. This should be pretty easy with the keystone library. Something like
from keystone import Ks,KS_ARCH_ARM,KS_MODE_THUMB
patch = bytes(Ks(KS_ARCH_ARM, KS_MODE_THUMB).asm(readable_patch)[0])
as compared to
patch = binascii.unhexlify(inline_patch_hex)
in emulator/harness/fuzzware_harness/user_hooks/__init__.py
should work