You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1LuB
dbc698415f
|
6 months ago | |
|---|---|---|
| .. | ||
| test_examples | 6 months ago | |
| Makefile | 6 months ago | |
| README.md | 6 months ago | |
| symcc.c | 6 months ago | |
README.md
custum mutator: symcc
This uses the symcc to find new paths into the target.
Note that this is a just a proof of concept example! It is better to use the fuzzing helpers of symcc, symqemu, Fuzzolic, etc. rather than this.
Also the symqemu custom mutator is better than this.
To use this custom mutator follow the steps in the symcc repository https://github.com/eurecom-s3/symcc/ on how to build symcc and how to instrument a target binary (the same target that you are fuzzing).
The target program compiled with symcc has to be pointed to with the
SYMCC_TARGET environment variable.
just type make to build this custom mutator.
SYMCC_TARGET=/prg/to/symcc/compiled/target AFL_CUSTOM_MUTATOR_LIBRARY=custom_mutators/symcc/symcc-mutator.so afl-fuzz ...