Added HowFuzzilliWorks.md

googleprojectzero · Jun 11, 2021 · 5e21667 · 5e21667
1 parent 7382d5f
commit 5e21667
Show file tree

Hide file tree

Showing 8 changed files with 840 additions and 2 deletions.
diff --git a/Docs/HowFuzzilliWorks.md b/Docs/HowFuzzilliWorks.md
diff --git a/Docs/images/fuzzing_with_fuzzil.png b/Docs/images/fuzzing_with_fuzzil.png
diff --git a/Docs/images/generative_engine.png b/Docs/images/generative_engine.png
diff --git a/Docs/images/hybrid_engine.png b/Docs/images/hybrid_engine.png
diff --git a/Docs/images/mutation_engine.png b/Docs/images/mutation_engine.png
diff --git a/README.md b/README.md
@@ -82,6 +82,8 @@ A number of mutations can then be performed on these programs:
 * [OperationMutator](Sources/Fuzzilli/Mutators/OperationMutator.swift): mutates the parameters of operations, for example replacing an integer constant with a different one.
 * and more...
 
+A much more thorough discussion of how Fuzzilli works can be found [here](Docs/HowFuzzilliWorks.md).
+
 ## Implementation
 
 The fuzzer is implemented in [Swift](https://swift.org/), with some parts (e.g. coverage measurements, socket interactions, etc.) implemented in C.

diff --git a/Sources/Fuzzilli/FuzzIL/TypeSystem.swift b/Sources/Fuzzilli/FuzzIL/TypeSystem.swift
@@ -134,7 +134,7 @@ public struct Type: Hashable {
     public static let regexp    = Type(definiteType: .regexp)
 
     /// Type one can iterate over
-    public static let iterable   = Type(definiteType: .iterable)
+    public static let iterable   = Type(definiteType: .iterable)        // TODO rename to .array?
 
     /// A value for which the type is not known.
     public static let unknown   = Type(definiteType: .unknown)

diff --git a/Sources/FuzzilliCli/main.swift b/Sources/FuzzilliCli/main.swift
@@ -29,7 +29,8 @@ Options:
     --profile=name              : Select one of several preconfigured profiles.
                                   Available profiles: \(profiles.keys).
     --jobs=n                    : Total number of fuzzing jobs. This will start one master thread and n-1 worker threads. Experimental!
-    --engine=name               : The fuzzing engine to use. Available engines: "mutation" (default), "hybrid", "multi"
+    --engine=name               : The fuzzing engine to use. Available engines: "mutation" (default), "hybrid", "multi".
+                                  Only the mutation engine should be regarded stable at this point.
     --logLevel=level            : The log level to use. Valid values: "verbose", info", "warning", "error", "fatal"
                                   (default: "info").
     --numIterations=n           : Run for the specified number of iterations (default: unlimited).