MagneFlame
MagneFlame: Multi Supervisor Fuzzing Framework
MagneFlame is a fast and extensible fuzzing framework.
Current version is only available for Windows. When you compile MagneFlame on Linux, it does not work properly.
Install
Add the following lines to your Cargo.toml:
[dependencies]
magne-flame = { git = "https://github.com/ffri/magne-flame" }
Example
use magne_flame::prelude::*;
struct RandomPrintableMutator;
impl Mutator for RandomPrintableMutator {
fn mutate(&mut self, seed: &mut Vec<u8>) -> FuzzerResult<()> {
for _ in 0..util::gen_random(0, seed.len()) {
Printable::mutate(seed, util::gen_random(0, seed.len()), util::gen_random(0, Printable::v_len())).unwrap();
}
Ok(())
}
}
fn main(){
let exec_cmd = "examples\\target_programs\\bin\\crash_test_filename.exe @@".to_string();
let in_dir = "in".to_string();
let out_dir = "out".to_string();
let timeout = 10000;
let thread_num = 4;
FileSeed::set_out_dir(format!("{}\\queue", out_dir)); // Output corpus directory.
let mut scheduler: SimpleScheduler<_, FileArgvSupervisor<_, FileSeed>, _> = SimpleScheduler::new(
SimpleMutationStrategy::new(RandomPrintableMutator),
false, // Do not store any new fuzz inputs.
); // Create a Scheduler.
scheduler.add_raw_fuzzes(&util::read_directory(&in_dir).expect("Failed to read the directory.").iter().map(|file_path| {
util::read_file(&file_path.display().to_string()).unwrap()
}).collect::<Vec<Vec<u8>>>());
let ctx = SimpleFuzzerContext::new(out_dir.clone()); // Create a FuzzerContext.
ctx.start_reporter(); // Start a reporter.
MTSupervisorController::setup_and_run(
move || {
FileArgvSupervisor::new(
exec_cmd.clone(),
format!("{}/.cur_input", out_dir),
"".to_string(),
true,
timeout,
)
},
scheduler,
ctx.clone(),
thread_num,
);
}Output:
+----------------+
| 1 sec |
| 181 exec |
| 181.00 exec/sec|
| 0 crashes |
| 0 hangs |
+----------------+
+----------------+
| 2 sec |
| 363 exec |
| 181.50 exec/sec|
| 0 crashes |
| 0 hangs |
+----------------+
+----------------+
| 3 sec |
| 527 exec |
| 175.67 exec/sec|
| 0 crashes |
| 0 hangs |
+----------------+
+----------------+
| 4 sec |
| 701 exec |
| 175.25 exec/sec|
| 0 crashes |
| 0 hangs |
+----------------+
+----------------+
| 5 sec |
| 883 exec |
| 176.60 exec/sec|
| 0 crashes |
| 0 hangs |
+----------------+
For more information, see Get Started