-
Notifications
You must be signed in to change notification settings - Fork 1.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
prog: smarter mutations #534
Comments
Hi, dvyukov. |
I don't see how this is a problem. Why do you think it could be a problem? |
Sorry, I just remember the path calculation method in afl and you are absolute right . |
I see what you mean. But it's not that simple. |
from @lcytxw
|
I see that this is same as the implementation method of dynamic prios now. Right? |
Yes, dynamic prios are similar. |
A bit on resource-centeric generation/mutation from a mailing list:
|
An idea on how to quickly get an estimate for mutation parameters (priorities). Instead of doing some incremental changes to the parameters and monitoring the difference in coverage size (or number of crashes) after fuzzing for a certain period of time, we can compute those parameters based on the corpus that we already have on syzbot. The idea is to split the corpus into two parts in some way, and try to figure out what are the most optimal values for mutation parameters to generate the first part of the corpus from the other one via mutations as efficient as possible. For example to calculate arguments mutation priorities we can do the following. Split all programs in the corpus into syscalls, group all syscalls into buckets based on syscall type (name), and then calculate the shortest sequence of mutations for each pair of syscalls in each group. Then take some kind of average (proportionally to the number of pairs in each bucket?) of the mutation types that we had to do, and use the result values as mutation priorities. |
Hi, May I ask how to reproduce the 30% increase after introducing the dynamic priority? |
Brain dump of ideas for improving mutation efficiency:
The text was updated successfully, but these errors were encountered: