diff --git a/src/fuzzer/main.cpp b/src/fuzzer/main.cpp index 5d088e56..a426a3cf 100644 --- a/src/fuzzer/main.cpp +++ b/src/fuzzer/main.cpp @@ -47,7 +47,7 @@ namespace struct fuzzer_executer : fuzzer::executer { - windows_emulator emu{{.emulation_root = "./"}}; // TODO: Fix root directory + windows_emulator emu{}; // TODO: Fix root directory std::span emulator_data{}; std::unordered_set visited_blocks{}; const std::function* handler{nullptr}; @@ -66,6 +66,11 @@ namespace utils::buffer_deserializer deserializer{emulator_data}; emu.deserialize(deserializer); emu.save_snapshot(); + + const auto return_address = emu.emu().read_stack(0); + emu.emu().hook_memory_execution(return_address, [&](const uint64_t) { + emu.emu().stop(); // + }); } void restore_emulator() diff --git a/src/fuzzing-engine/fuzzer.cpp b/src/fuzzing-engine/fuzzer.cpp index d08be3da..c5aa4d59 100644 --- a/src/fuzzing-engine/fuzzer.cpp +++ b/src/fuzzing-engine/fuzzer.cpp @@ -50,7 +50,9 @@ namespace fuzzer ++context.executions; context.generator.access_input([&](const std::span input) { uint64_t score{0}; - const auto result = executer.execute(input, [&](uint64_t) { ++score; }); + const auto result = executer.execute(input, [&](uint64_t) { + ++score; // + }); if (result == execution_result::error) { @@ -84,7 +86,9 @@ namespace fuzzer for (size_t i = 0; i < concurrency; ++i) { - this->workers_.emplace_back([&context] { worker(context); }); + this->workers_.emplace_back([&context] { + worker(context); // + }); } } diff --git a/src/fuzzing-engine/input_generator.cpp b/src/fuzzing-engine/input_generator.cpp index 2be1d9ea..f3765281 100644 --- a/src/fuzzing-engine/input_generator.cpp +++ b/src/fuzzing-engine/input_generator.cpp @@ -71,6 +71,11 @@ namespace fuzzer { std::unique_lock lock{this->mutex_}; + if (this->top_scorer_.empty()) + { + return 0.0; + } + double score{0.0}; for (const auto& e : this->top_scorer_) { diff --git a/src/windows-emulator/windows_emulator.cpp b/src/windows-emulator/windows_emulator.cpp index fc2458a8..4e333ee9 100644 --- a/src/windows-emulator/windows_emulator.cpp +++ b/src/windows-emulator/windows_emulator.cpp @@ -638,19 +638,7 @@ void windows_emulator::start(size_t count) } } -void windows_emulator::serialize(utils::buffer_serializer& buffer) const -{ - buffer.write(this->executed_instructions_); - buffer.write(this->switch_thread_); - buffer.write(this->use_relative_time_); - this->emu().serialize_state(buffer, false); - this->memory.serialize_memory_state(buffer, false); - this->mod_manager.serialize(buffer); - this->process.serialize(buffer); - this->dispatcher.serialize(buffer); -} - -void windows_emulator::deserialize(utils::buffer_deserializer& buffer) +void windows_emulator::register_factories(utils::buffer_deserializer& buffer) { buffer.register_factory([this] { return memory_manager_wrapper{this->memory}; // @@ -675,6 +663,23 @@ void windows_emulator::deserialize(utils::buffer_deserializer& buffer) buffer.register_factory([this] { return socket_factory_wrapper{this->socket_factory()}; // }); +} + +void windows_emulator::serialize(utils::buffer_serializer& buffer) const +{ + buffer.write(this->executed_instructions_); + buffer.write(this->switch_thread_); + buffer.write(this->use_relative_time_); + this->emu().serialize_state(buffer, false); + this->memory.serialize_memory_state(buffer, false); + this->mod_manager.serialize(buffer); + this->process.serialize(buffer); + this->dispatcher.serialize(buffer); +} + +void windows_emulator::deserialize(utils::buffer_deserializer& buffer) +{ + this->register_factories(buffer); buffer.read(this->executed_instructions_); buffer.read(this->switch_thread_); @@ -719,6 +724,9 @@ void windows_emulator::restore_snapshot() } utils::buffer_deserializer deserializer{this->process_snapshot_}; + + this->register_factories(deserializer); + this->emu().deserialize_state(deserializer, true); this->memory.deserialize_memory_state(deserializer, true); this->mod_manager.deserialize(deserializer); diff --git a/src/windows-emulator/windows_emulator.hpp b/src/windows-emulator/windows_emulator.hpp index 965d0037..da02e78c 100644 --- a/src/windows-emulator/windows_emulator.hpp +++ b/src/windows-emulator/windows_emulator.hpp @@ -202,4 +202,6 @@ class windows_emulator void setup_hooks(); void setup_process(const application_settings& app_settings); void on_instruction_execution(uint64_t address); + + void register_factories(utils::buffer_deserializer& buffer); };