deepstate

deepstate copied to clipboard

Front-ends to new fuzzers

9

We currently have a dedicated front-end to Eclipser (https://github.com/trailofbits/deepstate/blob/master/bin/deepstate/eclipser.py), which makes it easy to use Eclipser with DeepState. However, even using AFL (for example) requires a bit more typing and...

agroce

OneOf fails in manticore: Cannot allocate memory Probably too many cached expressions

1

Manticore fails in this particular example, @mossberg is mentioned in the code, maybe he can help us. :smiley: ``` ================================================================================ RUNNING: deepstate-manticore build/examples/OneOf 2019-04-21 22:00:30,717: [16805] m.c.manticore:INFO: Verbosity set to...

ggrieco-tob

Create a more generic single function call fuzzer entry, with choices like exit controlled via DeepState vars, then make libFuzzer entry a wrapper that uses the environment variables.

agroce

Check for ASSERTs not executed

5

Without compiling with coverage, we could have DeepState warn you at finish of internal fuzzer, test directory replay, or symex, if you had ASSERTs in your DeepState harness that never...

agroce

Title says it. Right now takeover of rand won't work if a subject includes (after deepstate) a library using rand().

agroce

Add in something like: ```c #define TRY_REGISTER_CONST(x) \ if (__builtin_constant_p(x)) { \ asm(".pushsection .data.consts; .quad %0; .popsection;" : : "I"(x)); } ``` Then use `TRY_REIGSTER_CONST` in things like `CHECK_EQ(a, b)`,...

pgoodman

Integrate __AFL_INIT into the weak-attributed default main function

3

pgoodman

Handle Sanitizer crashes in test replay consistently

4

DeepState forks during test replay (and other modes) so that crashes don't terminate the testing process in some arbitrary way, but are reported as a crash with an appropriate DeepState...

agroce

Mark symbolic fields in test harnesses as irreducible

2

A test harness is a class that contains common state, setup, and teardown code. Some of that state is likely to be symbolic variables. We need some additional annotations, e.g....

pgoodman

This should just do all the right stuff, and when available, should also generate libFuzzer targets. If we go this route then we can be more certain about the naming...

pgoodman