Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add tool to modify fuzzer corpora #54

Open
wants to merge 8 commits into
base: main
Choose a base branch
from
Open

Add tool to modify fuzzer corpora #54

wants to merge 8 commits into from

Conversation

tuturu-tech
Copy link
Collaborator

@tuturu-tech tuturu-tech commented Jun 12, 2024

This PR adds the ability to modify an Echidna or Medusa corpus based on certain conditions, save a corpus into a corpus "history" file, and restore a previously saved corpus.

It includes the following changes:

  • New CLI commands:
    • modify-corpus: Modifies an existing corpus based on the fuzzer configuration or data provided via flags. The available conditions are:
      • --fuzzer-config: Fetches the maximum time delay, maximum block delay, or blacklisted functions defined in the fuzzer configuration file. Calls or call sequences that use a larger time/block delay than defined, or use a blacklisted function, are discarded.
      • --modify-senders LIST: Takes in a list of the format 0xoldAddress=0xnewAddress,..., and replaces the caller for all calls that use the oldAddress with newAddress
      • --filter-functions: Removes calls or call sequences that call functions that no longer exist. Currently supports only one target contract.
      • --mode delete_sequence | delete_calls: Defines how filtering is done, delete_sequence deletes the entire call sequence file if any call within it is invalid per the included rules. delete_calls only deletes the invalid call.
    • snapshot: Saves the provided corpus directory into a history.json file so it can be easily retrieved. E.g., in case we want to rollback the changes we made to the corpus. Available flags: --corpus-dir, --fuzzer
    • restore: Restores a corpus from the history.json file, it will override the directory where it was previously saved. Available flags: --list-history (lists all saved corpora with their hashes), --hash STR (takes in a hash of the corpus we want to restore)
  • New parsers and a new class CorpusModifier were added to support the above features.
  • pyYAML was added as a dependancy so we can process echidna .yaml config files

Before merging this PR further work should be done to:

  • Sanity check modification of Medusa corpora (only tested Echidna so far)
  • Create unit tests for each of the features
    • Unit tests for call deletion
    • Unit tests for sequence deletion
  • Resolve ignored mypy errors
  • Add support for multiple contracts when using --filter-functions Note: This is non-trivial in the case where we have multiple target contracts that might have functions with the same name.
  • Add error handling to file system manipulation
  • Fix bug where corpus directories are not properly saved when using delete_sequences
  • Modify Medusa sequence nonces when using delete_calls and modifying senders

@tuturu-tech tuturu-tech marked this pull request as ready for review June 14, 2024 08:29
@0xalpharush
Copy link
Contributor

Can we add some docs in markdown files (in docs/)? Can be migrated to proper documentation site later

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants