Valentin Huber

Make havoc_mutations Available for Custom Inputs

34

I have a custom `Input` type I'm doing fuzzing with. It contains two fields in the shape of a `Vec`. I'd love to be able to use havoc mutations on...

Improving Handling of Custom Inputs

5

I've finally gotten around to doing something about #2202. It's currently still very much work in progress. Still missing: - [x] Optional `Input` parts and crossover mutations - [x] Ideally,...

OnDiskCorpus files be configurable to contain a human readable representation of the input

12

Most fuzzers will likely use some form of `OnDiskCorpus` (incl. `InMemoryOnDiskCorpus`, `CachedOnDiskCorpus`, etc.) for their solutions. To then figure out, what the problem actually was, one would need to know...

Deriving Mapping Mutators

13

I'm attempting to derive everything necessary for havoc-style mutators on custom inputs using mapping mutators introduced in #2422. Still to do: - [ ] Fix current bug - [ ]...

When we plan our blocks, we assign one person to be responsible for the block ("boss") and others who contribute/support. There is no way to distinguish between the two at...

I'm running current MacOS (Apple Silicon, Xcode command-line tools installed), current Rust, current LibAFL. Logs for `just fuzzer > out.log 2>&1`: [libfuzzer_libpng.log](https://github.com/user-attachments/files/19709602/out.log) [libfuzzer_libpng_centralized.log](https://github.com/user-attachments/files/19710015/libfuzzer_libpng_centralized.log)

Derive Named

8

A lot of structs within LibAFL implement `Named`. And all of those are done manually, leading to a lot of code duplication. Would it make sense to create a derive...

One may want to use two (or more) nested `MappingMutator`s, one to map from a complex input type to a primitive that can be mutated by built-in mutators such as...

OnDiskCorpus actually only evicts the input from memory, not the entire Testcase

5

From the docs of `OnDiskCorpus`: https://github.com/AFLplusplus/LibAFL/blob/2842f95e2aa4e0c665df3c99f1e46a5f4db52fbd/libafl/src/corpus/ondisk.rs#L1-L6 `OnDiskCorpus` uses `CachedOnDiskCorpus` under the hood: https://github.com/AFLplusplus/LibAFL/blob/2842f95e2aa4e0c665df3c99f1e46a5f4db52fbd/libafl/src/corpus/cached.rs#L1 However, both these docs are wrong: `CachedOnDiskCorpus` only ever evicts the actual input from memory, the rest...

Unify and Fix Pseudo-Coverage in Example Fuzzers

1

`static_mut_refs` are going to break soon. This needs fixing. See discussion [here](https://github.com/AFLplusplus/LibAFL/pull/2784#discussion_r1893727318) and [here](https://github.com/AFLplusplus/LibAFL/pull/2770#discussion_r1885707774). Additionally, handling of the pseudo-coverage is different between example fuzzers. The names, the extraction of necessary...