mirror of
https://github.com/momo5502/emulator.git
synced 2026-01-18 11:13:57 +00:00
Format all the code
This commit is contained in:
momo5502
@@ -5,128 +5,121 @@
|
||||
|
||||
namespace fuzzer
|
||||
{
|
||||
namespace
|
||||
{
|
||||
class fuzzing_context
|
||||
{
|
||||
public:
|
||||
fuzzing_context(input_generator& generator, fuzzing_handler& handler)
|
||||
: generator(generator)
|
||||
, handler(handler)
|
||||
{
|
||||
}
|
||||
namespace
|
||||
{
|
||||
class fuzzing_context
|
||||
{
|
||||
public:
|
||||
fuzzing_context(input_generator& generator, fuzzing_handler& handler)
|
||||
: generator(generator),
|
||||
handler(handler)
|
||||
{
|
||||
}
|
||||
|
||||
void stop()
|
||||
{
|
||||
this->stop_ = true;
|
||||
}
|
||||
void stop()
|
||||
{
|
||||
this->stop_ = true;
|
||||
}
|
||||
|
||||
bool should_stop()
|
||||
{
|
||||
if (this->stop_)
|
||||
{
|
||||
return true;
|
||||
}
|
||||
bool should_stop()
|
||||
{
|
||||
if (this->stop_)
|
||||
{
|
||||
return true;
|
||||
}
|
||||
|
||||
if (!handler.stop())
|
||||
{
|
||||
return false;
|
||||
}
|
||||
if (!handler.stop())
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
this->stop_ = true;
|
||||
return true;
|
||||
}
|
||||
this->stop_ = true;
|
||||
return true;
|
||||
}
|
||||
|
||||
input_generator& generator;
|
||||
fuzzing_handler& handler;
|
||||
std::atomic_uint64_t executions{0};
|
||||
input_generator& generator;
|
||||
fuzzing_handler& handler;
|
||||
std::atomic_uint64_t executions{0};
|
||||
|
||||
private:
|
||||
std::atomic_bool stop_{false};
|
||||
};
|
||||
private:
|
||||
std::atomic_bool stop_{false};
|
||||
};
|
||||
|
||||
void perform_fuzzing_iteration(fuzzing_context& context, executer& executer)
|
||||
{
|
||||
++context.executions;
|
||||
context.generator.access_input([&](const std::span<const uint8_t> input)
|
||||
{
|
||||
uint64_t score{0};
|
||||
const auto result = executer.execute(input, [&](uint64_t)
|
||||
{
|
||||
++score;
|
||||
});
|
||||
void perform_fuzzing_iteration(fuzzing_context& context, executer& executer)
|
||||
{
|
||||
++context.executions;
|
||||
context.generator.access_input([&](const std::span<const uint8_t> input) {
|
||||
uint64_t score{0};
|
||||
const auto result = executer.execute(input, [&](uint64_t) { ++score; });
|
||||
|
||||
if (result == execution_result::error)
|
||||
{
|
||||
printf("Found error!\n");
|
||||
context.stop();
|
||||
}
|
||||
if (result == execution_result::error)
|
||||
{
|
||||
printf("Found error!\n");
|
||||
context.stop();
|
||||
}
|
||||
|
||||
return score;
|
||||
});
|
||||
}
|
||||
return score;
|
||||
});
|
||||
}
|
||||
|
||||
void worker(fuzzing_context& context)
|
||||
{
|
||||
const auto executer = context.handler.make_executer();
|
||||
void worker(fuzzing_context& context)
|
||||
{
|
||||
const auto executer = context.handler.make_executer();
|
||||
|
||||
while (!context.should_stop())
|
||||
{
|
||||
perform_fuzzing_iteration(context, *executer);
|
||||
}
|
||||
}
|
||||
while (!context.should_stop())
|
||||
{
|
||||
perform_fuzzing_iteration(context, *executer);
|
||||
}
|
||||
}
|
||||
|
||||
struct worker_pool
|
||||
{
|
||||
fuzzing_context* context_{nullptr};
|
||||
std::vector<std::thread> workers_{};
|
||||
struct worker_pool
|
||||
{
|
||||
fuzzing_context* context_{nullptr};
|
||||
std::vector<std::thread> workers_{};
|
||||
|
||||
worker_pool(fuzzing_context& context, const size_t concurrency)
|
||||
: context_(&context)
|
||||
{
|
||||
this->workers_.reserve(concurrency);
|
||||
worker_pool(fuzzing_context& context, const size_t concurrency)
|
||||
: context_(&context)
|
||||
{
|
||||
this->workers_.reserve(concurrency);
|
||||
|
||||
for (size_t i = 0; i < concurrency; ++i)
|
||||
{
|
||||
this->workers_.emplace_back([&context]
|
||||
{
|
||||
worker(context);
|
||||
});
|
||||
}
|
||||
}
|
||||
for (size_t i = 0; i < concurrency; ++i)
|
||||
{
|
||||
this->workers_.emplace_back([&context] { worker(context); });
|
||||
}
|
||||
}
|
||||
|
||||
~worker_pool()
|
||||
{
|
||||
if (this->workers_.empty())
|
||||
{
|
||||
return;
|
||||
}
|
||||
~worker_pool()
|
||||
{
|
||||
if (this->workers_.empty())
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
this->context_->stop();
|
||||
this->context_->stop();
|
||||
|
||||
for (auto& w : this->workers_)
|
||||
{
|
||||
w.join();
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
for (auto& w : this->workers_)
|
||||
{
|
||||
w.join();
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
void run(fuzzing_handler& handler, const size_t concurrency)
|
||||
{
|
||||
input_generator generator{};
|
||||
fuzzing_context context{generator, handler};
|
||||
worker_pool pool{context, concurrency};
|
||||
void run(fuzzing_handler& handler, const size_t concurrency)
|
||||
{
|
||||
input_generator generator{};
|
||||
fuzzing_context context{generator, handler};
|
||||
worker_pool pool{context, concurrency};
|
||||
|
||||
while (!context.should_stop())
|
||||
{
|
||||
std::this_thread::sleep_for(std::chrono::seconds{1});
|
||||
while (!context.should_stop())
|
||||
{
|
||||
std::this_thread::sleep_for(std::chrono::seconds{1});
|
||||
|
||||
const auto executions = context.executions.exchange(0);
|
||||
const auto highest_scorer = context.generator.get_highest_scorer();
|
||||
const auto avg_score = context.generator.get_average_score();
|
||||
printf("Executions/s: %" PRIu64 " - Score: %" PRIx64 " - Avg: %.3f\n", executions, highest_scorer.score,
|
||||
avg_score);
|
||||
}
|
||||
}
|
||||
const auto executions = context.executions.exchange(0);
|
||||
const auto highest_scorer = context.generator.get_highest_scorer();
|
||||
const auto avg_score = context.generator.get_average_score();
|
||||
printf("Executions/s: %" PRIu64 " - Score: %" PRIx64 " - Avg: %.3f\n", executions, highest_scorer.score,
|
||||
avg_score);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -7,33 +7,33 @@
|
||||
|
||||
namespace fuzzer
|
||||
{
|
||||
using coverage_functor = void(uint64_t address);
|
||||
using coverage_functor = void(uint64_t address);
|
||||
|
||||
enum class execution_result
|
||||
{
|
||||
success,
|
||||
error,
|
||||
};
|
||||
enum class execution_result
|
||||
{
|
||||
success,
|
||||
error,
|
||||
};
|
||||
|
||||
struct executer
|
||||
{
|
||||
virtual ~executer() = default;
|
||||
struct executer
|
||||
{
|
||||
virtual ~executer() = default;
|
||||
|
||||
virtual execution_result execute(std::span<const uint8_t> data,
|
||||
const std::function<coverage_functor>& coverage_handler) = 0;
|
||||
};
|
||||
virtual execution_result execute(std::span<const uint8_t> data,
|
||||
const std::function<coverage_functor>& coverage_handler) = 0;
|
||||
};
|
||||
|
||||
struct fuzzing_handler
|
||||
{
|
||||
virtual ~fuzzing_handler() = default;
|
||||
struct fuzzing_handler
|
||||
{
|
||||
virtual ~fuzzing_handler() = default;
|
||||
|
||||
virtual std::unique_ptr<executer> make_executer() = 0;
|
||||
virtual std::unique_ptr<executer> make_executer() = 0;
|
||||
|
||||
virtual bool stop()
|
||||
{
|
||||
return false;
|
||||
}
|
||||
};
|
||||
virtual bool stop()
|
||||
{
|
||||
return false;
|
||||
}
|
||||
};
|
||||
|
||||
void run(fuzzing_handler& handler, size_t concurrency = std::thread::hardware_concurrency());
|
||||
void run(fuzzing_handler& handler, size_t concurrency = std::thread::hardware_concurrency());
|
||||
}
|
||||
|
||||
@@ -4,120 +4,118 @@
|
||||
|
||||
namespace fuzzer
|
||||
{
|
||||
namespace
|
||||
{
|
||||
constexpr size_t MAX_TOP_SCORER = 20;
|
||||
namespace
|
||||
{
|
||||
constexpr size_t MAX_TOP_SCORER = 20;
|
||||
|
||||
void mutate_input(random_generator& rng, std::vector<uint8_t>& input)
|
||||
{
|
||||
if (input.empty() || rng.get(3) == 0)
|
||||
{
|
||||
const auto new_bytes = rng.get_geometric<size_t>() + 1;
|
||||
input.resize(input.size() + new_bytes);
|
||||
}
|
||||
else if (rng.get(10) == 0)
|
||||
{
|
||||
const auto remove_bytes = rng.get_geometric<size_t>() % input.size();
|
||||
input.resize(input.size() - remove_bytes);
|
||||
}
|
||||
void mutate_input(random_generator& rng, std::vector<uint8_t>& input)
|
||||
{
|
||||
if (input.empty() || rng.get(3) == 0)
|
||||
{
|
||||
const auto new_bytes = rng.get_geometric<size_t>() + 1;
|
||||
input.resize(input.size() + new_bytes);
|
||||
}
|
||||
else if (rng.get(10) == 0)
|
||||
{
|
||||
const auto remove_bytes = rng.get_geometric<size_t>() % input.size();
|
||||
input.resize(input.size() - remove_bytes);
|
||||
}
|
||||
|
||||
const auto mutations = (rng.get_geometric<size_t>() + 1) % input.size();
|
||||
const auto mutations = (rng.get_geometric<size_t>() + 1) % input.size();
|
||||
|
||||
for (size_t i = 0; i < mutations; ++i)
|
||||
{
|
||||
const auto index = rng.get<size_t>(input.size());
|
||||
input[index] = rng.get<uint8_t>();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for (size_t i = 0; i < mutations; ++i)
|
||||
{
|
||||
const auto index = rng.get<size_t>(input.size());
|
||||
input[index] = rng.get<uint8_t>();
|
||||
}
|
||||
}
|
||||
}
|
||||
input_generator::input_generator() = default;
|
||||
|
||||
input_generator::input_generator() = default;
|
||||
std::vector<uint8_t> input_generator::generate_next_input()
|
||||
{
|
||||
std::vector<uint8_t> input{};
|
||||
std::unique_lock lock{this->mutex_};
|
||||
|
||||
std::vector<uint8_t> input_generator::generate_next_input()
|
||||
{
|
||||
std::vector<uint8_t> input{};
|
||||
std::unique_lock lock{this->mutex_};
|
||||
if (!this->top_scorer_.empty())
|
||||
{
|
||||
const auto index = this->rng.get<size_t>() % this->top_scorer_.size();
|
||||
input = this->top_scorer_[index].data;
|
||||
}
|
||||
|
||||
if (!this->top_scorer_.empty())
|
||||
{
|
||||
const auto index = this->rng.get<size_t>() % this->top_scorer_.size();
|
||||
input = this->top_scorer_[index].data;
|
||||
}
|
||||
mutate_input(this->rng, input);
|
||||
|
||||
mutate_input(this->rng, input);
|
||||
return input;
|
||||
}
|
||||
|
||||
return input;
|
||||
}
|
||||
void input_generator::access_input(const std::function<input_handler>& handler)
|
||||
{
|
||||
auto next_input = this->generate_next_input();
|
||||
const auto score = handler(next_input);
|
||||
|
||||
void input_generator::access_input(const std::function<input_handler>& handler)
|
||||
{
|
||||
auto next_input = this->generate_next_input();
|
||||
const auto score = handler(next_input);
|
||||
input_entry e{};
|
||||
e.data = std::move(next_input);
|
||||
e.score = score;
|
||||
|
||||
input_entry e{};
|
||||
e.data = std::move(next_input);
|
||||
e.score = score;
|
||||
this->store_input_entry(std::move(e));
|
||||
}
|
||||
|
||||
this->store_input_entry(std::move(e));
|
||||
}
|
||||
input_entry input_generator::get_highest_scorer()
|
||||
{
|
||||
std::unique_lock lock{this->mutex_};
|
||||
return this->highest_scorer_;
|
||||
}
|
||||
|
||||
input_entry input_generator::get_highest_scorer()
|
||||
{
|
||||
std::unique_lock lock{this->mutex_};
|
||||
return this->highest_scorer_;
|
||||
}
|
||||
double input_generator::get_average_score()
|
||||
{
|
||||
std::unique_lock lock{this->mutex_};
|
||||
|
||||
double input_generator::get_average_score()
|
||||
{
|
||||
std::unique_lock lock{this->mutex_};
|
||||
double score{0.0};
|
||||
for (const auto& e : this->top_scorer_)
|
||||
{
|
||||
score += static_cast<double>(e.score);
|
||||
}
|
||||
|
||||
double score{0.0};
|
||||
for (const auto& e : this->top_scorer_)
|
||||
{
|
||||
score += static_cast<double>(e.score);
|
||||
}
|
||||
return score / static_cast<double>(this->top_scorer_.size());
|
||||
}
|
||||
|
||||
return score / static_cast<double>(this->top_scorer_.size());
|
||||
}
|
||||
void input_generator::store_input_entry(input_entry entry)
|
||||
{
|
||||
std::unique_lock lock{this->mutex_};
|
||||
|
||||
void input_generator::store_input_entry(input_entry entry)
|
||||
{
|
||||
std::unique_lock lock{this->mutex_};
|
||||
if (entry.score < this->lowest_score && this->rng.get(40) != 0)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
if (entry.score < this->lowest_score && this->rng.get(40) != 0)
|
||||
{
|
||||
return;
|
||||
}
|
||||
if (entry.score > this->highest_scorer_.score)
|
||||
{
|
||||
this->highest_scorer_ = entry;
|
||||
}
|
||||
|
||||
if (entry.score > this->highest_scorer_.score)
|
||||
{
|
||||
this->highest_scorer_ = entry;
|
||||
}
|
||||
if (this->top_scorer_.size() < MAX_TOP_SCORER)
|
||||
{
|
||||
this->top_scorer_.emplace_back(std::move(entry));
|
||||
return;
|
||||
}
|
||||
|
||||
if (this->top_scorer_.size() < MAX_TOP_SCORER)
|
||||
{
|
||||
this->top_scorer_.emplace_back(std::move(entry));
|
||||
return;
|
||||
}
|
||||
const auto insert_at_random = this->rng.get(10) == 0;
|
||||
const auto index =
|
||||
insert_at_random ? (this->rng.get<size_t>() % this->top_scorer_.size()) : this->lowest_scorer;
|
||||
|
||||
const auto insert_at_random = this->rng.get(10) == 0;
|
||||
const auto index = insert_at_random
|
||||
? (this->rng.get<size_t>() % this->top_scorer_.size())
|
||||
: this->lowest_scorer;
|
||||
this->top_scorer_[index] = std::move(entry);
|
||||
|
||||
this->top_scorer_[index] = std::move(entry);
|
||||
this->lowest_score = this->top_scorer_[0].score;
|
||||
this->lowest_scorer = 0;
|
||||
|
||||
this->lowest_score = this->top_scorer_[0].score;
|
||||
this->lowest_scorer = 0;
|
||||
|
||||
for (size_t i = 1; i < this->top_scorer_.size(); ++i)
|
||||
{
|
||||
if (this->top_scorer_[i].score < this->lowest_score)
|
||||
{
|
||||
this->lowest_score = this->top_scorer_[i].score;
|
||||
this->lowest_scorer = i;
|
||||
}
|
||||
}
|
||||
}
|
||||
for (size_t i = 1; i < this->top_scorer_.size(); ++i)
|
||||
{
|
||||
if (this->top_scorer_[i].score < this->lowest_score)
|
||||
{
|
||||
this->lowest_score = this->top_scorer_[i].score;
|
||||
this->lowest_scorer = i;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -8,37 +8,37 @@
|
||||
|
||||
namespace fuzzer
|
||||
{
|
||||
using input_score = uint64_t;
|
||||
using input_handler = input_score(std::span<const uint8_t>);
|
||||
using input_score = uint64_t;
|
||||
using input_handler = input_score(std::span<const uint8_t>);
|
||||
|
||||
struct input_entry
|
||||
{
|
||||
std::vector<uint8_t> data{};
|
||||
input_score score{};
|
||||
};
|
||||
struct input_entry
|
||||
{
|
||||
std::vector<uint8_t> data{};
|
||||
input_score score{};
|
||||
};
|
||||
|
||||
class input_generator
|
||||
{
|
||||
public:
|
||||
input_generator();
|
||||
class input_generator
|
||||
{
|
||||
public:
|
||||
input_generator();
|
||||
|
||||
void access_input(const std::function<input_handler>& handler);
|
||||
void access_input(const std::function<input_handler>& handler);
|
||||
|
||||
input_entry get_highest_scorer();
|
||||
double get_average_score();
|
||||
input_entry get_highest_scorer();
|
||||
double get_average_score();
|
||||
|
||||
private:
|
||||
std::mutex mutex_{};
|
||||
random_generator rng{};
|
||||
private:
|
||||
std::mutex mutex_{};
|
||||
random_generator rng{};
|
||||
|
||||
std::vector<input_entry> top_scorer_{};
|
||||
input_score lowest_score{0};
|
||||
size_t lowest_scorer{0};
|
||||
std::vector<input_entry> top_scorer_{};
|
||||
input_score lowest_score{0};
|
||||
size_t lowest_scorer{0};
|
||||
|
||||
input_entry highest_scorer_{};
|
||||
input_entry highest_scorer_{};
|
||||
|
||||
std::vector<uint8_t> generate_next_input();
|
||||
std::vector<uint8_t> generate_next_input();
|
||||
|
||||
void store_input_entry(input_entry entry);
|
||||
};
|
||||
void store_input_entry(input_entry entry);
|
||||
};
|
||||
}
|
||||
|
||||
@@ -3,33 +3,33 @@
|
||||
|
||||
namespace fuzzer
|
||||
{
|
||||
random_generator::random_generator()
|
||||
: rng_(std::random_device()())
|
||||
{
|
||||
}
|
||||
random_generator::random_generator()
|
||||
: rng_(std::random_device()())
|
||||
{
|
||||
}
|
||||
|
||||
std::mt19937::result_type random_generator::generate_number()
|
||||
{
|
||||
return this->distribution_(this->rng_);
|
||||
}
|
||||
std::mt19937::result_type random_generator::generate_number()
|
||||
{
|
||||
return this->distribution_(this->rng_);
|
||||
}
|
||||
|
||||
void random_generator::fill(void* data, const size_t size)
|
||||
{
|
||||
this->fill(std::span(static_cast<uint8_t*>(data), size));
|
||||
}
|
||||
void random_generator::fill(void* data, const size_t size)
|
||||
{
|
||||
this->fill(std::span(static_cast<uint8_t*>(data), size));
|
||||
}
|
||||
|
||||
void random_generator::fill(std::span<uint8_t> data)
|
||||
{
|
||||
size_t i = 0;
|
||||
while (i < data.size())
|
||||
{
|
||||
const auto number = this->generate_number();
|
||||
void random_generator::fill(std::span<uint8_t> data)
|
||||
{
|
||||
size_t i = 0;
|
||||
while (i < data.size())
|
||||
{
|
||||
const auto number = this->generate_number();
|
||||
|
||||
const auto remaining_data = data.size() - i;
|
||||
const auto data_to_fill = std::min(remaining_data, sizeof(number));
|
||||
const auto remaining_data = data.size() - i;
|
||||
const auto data_to_fill = std::min(remaining_data, sizeof(number));
|
||||
|
||||
memcpy(data.data() + i, &number, data_to_fill);
|
||||
i += data_to_fill;
|
||||
}
|
||||
}
|
||||
memcpy(data.data() + i, &number, data_to_fill);
|
||||
i += data_to_fill;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -6,65 +6,65 @@
|
||||
|
||||
namespace fuzzer
|
||||
{
|
||||
class random_generator
|
||||
{
|
||||
public:
|
||||
random_generator();
|
||||
class random_generator
|
||||
{
|
||||
public:
|
||||
random_generator();
|
||||
|
||||
void fill(std::span<uint8_t> data);
|
||||
void fill(void* data, size_t size);
|
||||
void fill(std::span<uint8_t> data);
|
||||
void fill(void* data, size_t size);
|
||||
|
||||
template <typename T>
|
||||
requires(std::is_trivially_copyable_v<T>)
|
||||
T get()
|
||||
{
|
||||
T value{};
|
||||
this->fill(&value, sizeof(value));
|
||||
return value;
|
||||
}
|
||||
template <typename T>
|
||||
requires(std::is_trivially_copyable_v<T>)
|
||||
T get()
|
||||
{
|
||||
T value{};
|
||||
this->fill(&value, sizeof(value));
|
||||
return value;
|
||||
}
|
||||
|
||||
template <typename T>
|
||||
T get(const T& max)
|
||||
{
|
||||
return this->get<T>() % max;
|
||||
}
|
||||
template <typename T>
|
||||
T get(const T& max)
|
||||
{
|
||||
return this->get<T>() % max;
|
||||
}
|
||||
|
||||
template <typename T>
|
||||
T get(T min, T max)
|
||||
{
|
||||
if (max < min)
|
||||
{
|
||||
std::swap(max, min);
|
||||
}
|
||||
template <typename T>
|
||||
T get(T min, T max)
|
||||
{
|
||||
if (max < min)
|
||||
{
|
||||
std::swap(max, min);
|
||||
}
|
||||
|
||||
const auto diff = max - min;
|
||||
const auto diff = max - min;
|
||||
|
||||
return (this->get<T>() % diff) + min;
|
||||
}
|
||||
return (this->get<T>() % diff) + min;
|
||||
}
|
||||
|
||||
template <typename T>
|
||||
T get_geometric()
|
||||
{
|
||||
T value{0};
|
||||
template <typename T>
|
||||
T get_geometric()
|
||||
{
|
||||
T value{0};
|
||||
|
||||
while (this->get<bool>())
|
||||
{
|
||||
++value;
|
||||
}
|
||||
while (this->get<bool>())
|
||||
{
|
||||
++value;
|
||||
}
|
||||
|
||||
return value;
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
private:
|
||||
std::mt19937 rng_;
|
||||
std::uniform_int_distribution<std::mt19937::result_type> distribution_{};
|
||||
private:
|
||||
std::mt19937 rng_;
|
||||
std::uniform_int_distribution<std::mt19937::result_type> distribution_{};
|
||||
|
||||
std::mt19937::result_type generate_number();
|
||||
};
|
||||
std::mt19937::result_type generate_number();
|
||||
};
|
||||
|
||||
template <>
|
||||
inline bool random_generator::get<bool>()
|
||||
{
|
||||
return (this->generate_number() & 1) != 0;
|
||||
}
|
||||
template <>
|
||||
inline bool random_generator::get<bool>()
|
||||
{
|
||||
return (this->generate_number() & 1) != 0;
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user