Skip to content

Latest commit

 

History

History
34 lines (23 loc) · 3.56 KB

feedback.md

File metadata and controls

34 lines (23 loc) · 3.56 KB

Feedback

The Feedback is an entity that classifies the outcome of an execution of the program under test as interesting or not. Typically, if an execution is interesting, the corresponding input used to feed the target program is added to a corpus.

Most of the time, the notion of Feedback is deeply linked to the Observer, but they are different concepts.

The Feedback, in most of the cases, processes the information reported by one or more observers to decide if the execution is interesting. The concept of "interestingness" is abstract, but typically it is related to a novelty search (i.e. interesting inputs are those that reach a previously unseen edge in the control flow graph).

As an example, given an Observer that reports all the sizes of memory allocations, a maximization Feedback can be used to maximize these sizes to sport pathological inputs in terms of memory consumption.

In terms of code, the library offers the Feedback trait. It is used to implement functors that, given the state of the observers from the last execution, tells if the execution was interesting. So to speak, it reduces the observations to a boolean result of is_interesting - or not. For this, a Feedback can store anything it wants to persist in the fuzzers's state. This might be, for instance, the cumulative map of all edges seen so far, in the case of a feedback based on edge coverage. This can be achieved by adding Metadata in init_state and accessing it later in is_interesting. Feedback can also add custom metadata to a newly created Testcase using append_metadata.

Multiple Feedbacks can be combined into a boolean expression, considering for instance an execution as interesting if it triggers new code paths or execute in less time compared to the average execution time using feedback_or.

On top, logic operators like feedback_or and feedback_and have a _fast variant (e.g. feedback_or_fast) where the second feedback will not be evaluated, if the value of the first feedback operand already answers the interestingness question so as to save precious performance.

Using feedback_and_fast in combination with ConstFeedback, certain feedbacks can be disabled dynamically.

Objectives

While feedbacks are commonly used to decide if an Input should be kept for future mutations, they serve a double-purpose, as so-called Objective Feedbacks. In this case, the interestingness of a feedback indicates if an Objective has been hit. Commonly, these objectives would be a crash or a timeout, but they can also be used to detect if specific parts of the program have been reached, for sanitization, or a differential fuzzing success. Objectives use the same trait as a normal Feedback and the implementations can be used interchangeably.

The only difference is that interesting Objectives won't be mutated further, and are counted as Solutions, a successful fuzzing campaign.