[Question] Run-time sync/reseed support?

[rc0r]

Hi,

does honggfuzz come with some kind of sync/reseed feature? Let's say I've got some new samples obtained from an external sources (test case repo, produced by other fuzzer node, ...). Is there a way to get honggfuzz to pick these samples up during run-time, maybe by adding these files to the initial input dir or the working dir? In case that's possible, do we have to follow any file naming conventions?

Thanks
rc0r

[robertswiecki]

It's not implemented, but given that honggfuzz implements initial dry run where samples are tested for new code blocks being hit, only the good samples are retained in the honggfuzz's memory (dynamic corpus)

In other words, if honggfuzz can go through your initial corpus within some limited time-frame (phase: Dry Run (1/2), just restart it with new files added to the directory.

[rc0r]

Thanks! Are the interesting samples added to a fuzzers' dynamic corpus written to disk at some point? So that when aborting a running fuzzer, I'm not losing samples/state only contained in its dynamic in-memory corpus?

[robertswiecki]

It's added back to the input directory (-f). You can change that directory with (--covdir), e.g. to perform corpus minimization, but then you need to either copy this corpus back to the input directory, or change the input directory to this directory.

Generally, the dynamic corpus which is used as input for fuzzing is kept in memory. Though new, interesting samples are written to -f or --covdir

PS. All of that works only with dynamic feedback-driven modes (-z or --linux_perf_* or --sancov). With the static mode, there's no feedback, and files from (-f) are picked up and modified randomly before being fed to the fuzzed command (or to the persistent process)

[rc0r]

Yeah sure, I was asking having feedback-driven modes in mind. Thanks again for the clarifications. Closing.