libfuzzer-python-bridge

A Python3 bridge for implementing custom libFuzzer mutators

Important: This is proof-of-concept and work in progress. Expect the Python API to change.

Why?

Many people are interested in fuzzing, but lack the knowledge (and/or insanity) to implement complex fuzzing mutators in C/C++. Things like protocol buffers can make this a lot easier but cannot be applied in all cases.

A generic Python bridge allows you to implement whatever logic you have in mind without touching the C/C++ parts further (assuming you already have a libFuzzer target).

Note: You still need a libFuzzer target in C/C++, this implementation is just extending libFuzzer with custom mutators written in Python.

Building and Running the Examples

To build the examples:

clang -o example_compressed_python -g example_compressed_python.cpp -fsanitize=fuzzer -lz -DCUSTOM_MUTATOR -I/usr/include/python3.6m -lpython3.6m
clang -o example_compressed_native -g example_compressed_native.cpp -fsanitize=fuzzer -lz -DCUSTOM_MUTATOR

Python Build flags can be found using

python3-config --cflags --ldflags

and the flags above should work for Ubuntu LTS (18.04).

You can build with -DBENCHMARK to leave out the crashing code in order to compare performance of the two implementations.

To run the python example, use

PYTHONPATH=. LIBFUZZER_PYTHON_MODULE=pymodules.example_compressed ./example_compressed_python

Using with your own targets

All you need to do on the C/C++ side is

#include "python_bridge.cpp"

in the target file where you have LLVMFuzzerTestOneInput (or any other compilation unit that is linked to the target) and then build with the Python include and linker flags added to your build configuration.

Then write a Python module that does what you would like the fuzzer to do, you might want to use the example_compressed module found in the pymodules/ folder as a basis. Then just run your fuzzing as shown in the examples above.

TODO

• Implement LLVMFuzzerCustomCrossOver in C++ and Python example
• For some reason, the Python code is faster in benchmarks than the C++ code. There must be a bug somewhere, please find it!