arion::ArionAfl Class Reference

This class is used to managed a UnicornAFL fuzzing session from an Arion instance. More...

#include <arion_afl.hpp>

Public Member Functions
	ArionAfl (std::weak_ptr< Arion > arion)
void	fuzz (ARION_AFL_INPUT_CALLBACK input_callback, ARION_AFL_CRASH_CALLBACK crash_callback, std::vector< ADDR > exits, ARION_MEM_STRATEGY mem_strategy=ARION_MEM_STRATEGY::RECORD_EDITS, std::vector< int > signals={SIGSEGV, SIGABRT}, bool always_validate=false, uint32_t persistent_iters=1000, void *user_data=nullptr)

Static Private Member Functions
static bool	uc_input_callback (uc_engine *uc, char *input, size_t input_sz, uint32_t persistent_round, void *user_data)
static bool	uc_crash_callback (uc_engine *uc, uc_err res, char *input, int input_len, int persistent_round, void *user_data)

Private Attributes
std::weak_ptr< Arion >	arion
	The Arion instance associated with this fuzzing session.

Detailed Description

This class is used to managed a UnicornAFL fuzzing session from an Arion instance.

Constructor & Destructor Documentation

ArionAfl()

arion::ArionAfl::ArionAfl ( std::weak_ptr< Arion >  arion )

inline

Builder for ArionAfl instances.

Parameters

[in]

Arion

The Arion instance associated with this fuzzing session.

Member Function Documentation

fuzz()

void arion::ArionAfl::fuzz	(	ARION_AFL_INPUT_CALLBACK	input_callback,
		ARION_AFL_CRASH_CALLBACK	crash_callback,
		std::vector< ADDR >	exits,
		ARION_MEM_STRATEGY	mem_strategy = ARION_MEM_STRATEGY::RECORD_EDITS,
		std::vector< int >	signals = {SIGSEGV, SIGABRT},
		bool	always_validate = false,
		uint32_t	persistent_iters = 1000,
		void *	user_data = nullptr
	)

Starts a fuzzing session.

Parameters

[in]	input_callback	The callback that gets triggered at each input generation by AFL.
[in]	crash_callback	The callback that gets triggered at each target crash detected by AFL.
[in]	exits	A list of code addresses, which, when reached, stop the current execution.
[in]	mem_strategy	The memory restoring strategy.
[in]	signals	The list of signals which ArionAfl must consider crashes.
[in]	always_validate	If true, the crash_callback will be called after every execution.
[in]	persistent_iters	The number of executions before forking, and then restoring the context perfectly (but an expensive operation).
[in]	user_data	Optional user-defined data passed to the hook.

uc_crash_callback()

static bool arion::ArionAfl::uc_crash_callback ( uc_engine *  uc, uc_err  res, char *  input, int  input_len, int  persistent_round, void *  user_data  )

staticprivate

A callback that gets triggered at each target crash detected by AFL.

Parameters

[in]	uc	The Unicorn engine associated with the Arion instance.
[in]	res	Error code returned from Unicorn engine.
[in]	input	The buffer containing the input generated by AFL.
[in]	input_sz	The size of the buffer containing the input generated by AFL.
[in]	persistent_round	The number of remaining rounds before a fork occurs to restore a perfect state.
[in]	user_data	The ARION_AFL_PARAM structure for the fuzzing session.

Returns

True if the crash is handled.

uc_input_callback()

static bool arion::ArionAfl::uc_input_callback ( uc_engine *  uc, char *  input, size_t  input_sz, uint32_t  persistent_round, void *  user_data  )

staticprivate

A callback that gets triggered at each input generation by AFL.

Parameters

[in]	uc	The Unicorn engine associated with the Arion instance.
[in]	input	The buffer containing the input generated by AFL.
[in]	input_sz	The size of the buffer containing the input generated by AFL.
[in]	persistent_round	The number of remaining rounds before a fork occurs to restore a perfect state.
[in]	user_data	The ARION_AFL_PARAM structure for the fuzzing session.

Returns

True if the input is accepted.

Member Data Documentation

arion

std::weak_ptr<Arion> arion::ArionAfl::arion

private

The Arion instance associated with this fuzzing session.

---

The documentation for this class was generated from the following file:

• /home/runner/work/Arion/Arion/include/arion/components/arion_afl.hpp