docs/beta/notebooks/PICS/GreyboxGrammarFuzzer-synopsis-3.svg

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
 "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<!-- Generated by graphviz version 2.49.3 (20211023.0002)
 -->
<!-- Pages: 1 -->
<svg width="639pt" height="464pt"
 viewBox="0.00 0.00 638.50 464.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(4 460)">
<g id="a_graph0"><a xlink:title="GreyboxGrammarFuzzer class hierarchy">
<polygon fill="white" stroke="transparent" points="-4,4 -4,-460 634.5,-460 634.5,4 -4,4"/>
</a>
</g>
<!-- GreyboxGrammarFuzzer -->
<g id="node1" class="node">
<title>GreyboxGrammarFuzzer</title>
<g id="a_node1"><a xlink:href="#" xlink:title="class GreyboxGrammarFuzzer:&#10;Greybox fuzzer using grammars.">
<polygon fill="none" stroke="black" points="5,-11.5 5,-64.5 172,-64.5 172,-11.5 5,-11.5"/>
<text text-anchor="start" x="13" y="-50.3" font-family="Patua One, Helvetica, sans-serif" font-weight="bold" font-size="14.00" fill="#b03a2e">GreyboxGrammarFuzzer</text>
<polyline fill="none" stroke="black" points="5,-41.5 172,-41.5 "/>
<g id="a_node1_0"><a xlink:href="#" xlink:title="GreyboxGrammarFuzzer">
<g id="a_node1_1"><a xlink:href="#" xlink:title="__init__(self, seeds: List[str], byte_mutator: GreyboxFuzzer.Mutator, tree_mutator: FragmentMutator, schedule: GreyboxFuzzer.PowerSchedule) &#45;&gt; None:&#10;Constructor.&#10;`seeds` &#45; set of inputs to mutate.&#10;`byte_mutator` &#45; a byte&#45;level mutator.&#10;`tree_mutator` = a tree&#45;level mutator.&#10;`schedule` &#45; a power schedule.">
<text text-anchor="start" x="34.5" y="-30.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-weight="bold" font-style="italic" font-size="10.00">__init__()</text>
</a>
</g>
<g id="a_node1_2"><a xlink:href="#" xlink:title="create_candidate(self) &#45;&gt; str:&#10;Returns an input generated by structural mutation&#10;of a seed in the population">
<text text-anchor="start" x="34.5" y="-19.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-style="italic" font-size="10.00">create_candidate()</text>
</a>
</g>
</a>
</g>
</a>
</g>
</g>
<!-- GreyboxFuzzer -->
<g id="node2" class="node">
<title>GreyboxFuzzer</title>
<g id="a_node2"><a xlink:href="GreyboxFuzzer.ipynb" xlink:title="class GreyboxFuzzer:&#10;Coverage&#45;guided mutational fuzzing.">
<polygon fill="none" stroke="black" points="34,-162 34,-204 143,-204 143,-162 34,-162"/>
<text text-anchor="start" x="42" y="-189.8" font-family="Patua One, Helvetica, sans-serif" font-weight="bold" font-size="14.00" fill="#b03a2e">GreyboxFuzzer</text>
<polyline fill="none" stroke="black" points="34,-181 143,-181 "/>
<g id="a_node2_3"><a xlink:href="#" xlink:title="GreyboxFuzzer">
<g id="a_node2_4"><a xlink:href="GreyboxFuzzer.ipynb" xlink:title="run(self, runner: MutationFuzzer.FunctionCoverageRunner) &#45;&gt; Tuple[Any, str]:&#10;Run function(inp) while tracking coverage.&#10;If we reach new coverage,&#10;add inp to population and its coverage to population_coverage">
<text text-anchor="start" x="73.5" y="-169.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-weight="bold" font-style="italic" font-size="10.00">run()</text>
</a>
</g>
</a>
</g>
</a>
</g>
</g>
<!-- GreyboxGrammarFuzzer&#45;&gt;GreyboxFuzzer -->
<g id="edge1" class="edge">
<title>GreyboxGrammarFuzzer&#45;&gt;GreyboxFuzzer</title>
<path fill="none" stroke="black" d="M88.5,-64.57C88.5,-89 88.5,-125.83 88.5,-151.72"/>
<polygon fill="none" stroke="black" points="85,-151.74 88.5,-161.74 92,-151.74 85,-151.74"/>
</g>
<!-- AdvancedMutationFuzzer -->
<g id="node3" class="node">
<title>AdvancedMutationFuzzer</title>
<g id="a_node3"><a xlink:href="GreyboxFuzzer.ipynb" xlink:title="class AdvancedMutationFuzzer:&#10;Base class for mutation&#45;based fuzzing.">
<polygon fill="none" stroke="black" points="0,-290.5 0,-343.5 177,-343.5 177,-290.5 0,-290.5"/>
<text text-anchor="start" x="8" y="-329.3" font-family="Patua One, Helvetica, sans-serif" font-weight="bold" font-size="14.00" fill="#b03a2e">AdvancedMutationFuzzer</text>
<polyline fill="none" stroke="black" points="0,-320.5 177,-320.5 "/>
<g id="a_node3_5"><a xlink:href="#" xlink:title="AdvancedMutationFuzzer">
<g id="a_node3_6"><a xlink:href="GreyboxFuzzer.ipynb" xlink:title="__init__(self, seeds: List[str], mutator: GreyboxFuzzer.Mutator, schedule: GreyboxFuzzer.PowerSchedule) &#45;&gt; None:&#10;Constructor.&#10;`seeds` &#45; a list of (input) strings to mutate.&#10;`mutator` &#45; the mutator to apply.&#10;`schedule` &#45; the power schedule to apply.">
<text text-anchor="start" x="58.5" y="-309.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-weight="bold" font-style="italic" font-size="10.00">__init__()</text>
</a>
</g>
<g id="a_node3_7"><a xlink:href="GreyboxFuzzer.ipynb" xlink:title="fuzz(self) &#45;&gt; str:&#10;Returns first each seed once and then generates new inputs">
<text text-anchor="start" x="58.5" y="-298.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-weight="bold" font-style="italic" font-size="10.00">fuzz()</text>
</a>
</g>
</a>
</g>
</a>
</g>
</g>
<!-- GreyboxFuzzer&#45;&gt;AdvancedMutationFuzzer -->
<g id="edge2" class="edge">
<title>GreyboxFuzzer&#45;&gt;AdvancedMutationFuzzer</title>
<path fill="none" stroke="black" d="M88.5,-204.05C88.5,-224.24 88.5,-255.83 88.5,-280.31"/>
<polygon fill="none" stroke="black" points="85,-280.31 88.5,-290.31 92,-280.31 85,-280.31"/>
</g>
<!-- Fuzzer -->
<g id="node4" class="node">
<title>Fuzzer</title>
<g id="a_node4"><a xlink:href="Fuzzer.ipynb" xlink:title="class Fuzzer:&#10;Base class for fuzzers.">
<polygon fill="none" stroke="black" points="50,-380.5 50,-455.5 127,-455.5 127,-380.5 50,-380.5"/>
<text text-anchor="start" x="67.5" y="-441.3" font-family="Patua One, Helvetica, sans-serif" font-weight="bold" font-size="14.00" fill="#b03a2e">Fuzzer</text>
<polyline fill="none" stroke="black" points="50,-432.5 127,-432.5 "/>
<g id="a_node4_8"><a xlink:href="#" xlink:title="Fuzzer">
<g id="a_node4_9"><a xlink:href="Fuzzer.ipynb" xlink:title="__init__(self) &#45;&gt; None:&#10;Constructor">
<text text-anchor="start" x="58.5" y="-421.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-weight="bold" font-style="italic" font-size="10.00">__init__()</text>
</a>
</g>
<g id="a_node4_10"><a xlink:href="Fuzzer.ipynb" xlink:title="fuzz(self) &#45;&gt; str:&#10;Return fuzz input">
<text text-anchor="start" x="58.5" y="-410.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-weight="bold" font-style="italic" font-size="10.00">fuzz()</text>
</a>
</g>
<g id="a_node4_11"><a xlink:href="Fuzzer.ipynb" xlink:title="run(self, runner: Fuzzer.Runner = &lt;Fuzzer.Runner object at 0x110c09dc0&gt;) &#45;&gt; Tuple[subprocess.CompletedProcess, str]:&#10;Run `runner` with fuzz input">
<text text-anchor="start" x="58.5" y="-399.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-weight="bold" font-style="italic" font-size="10.00">run()</text>
</a>
</g>
<g id="a_node4_12"><a xlink:href="Fuzzer.ipynb" xlink:title="runs(self, runner: Fuzzer.Runner = &lt;Fuzzer.PrintRunner object at 0x110c09f10&gt;, trials: int = 10) &#45;&gt; List[Tuple[subprocess.CompletedProcess, str]]:&#10;Run `runner` with fuzz input, `trials` times">
<text text-anchor="start" x="58.5" y="-388.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-weight="bold" font-size="10.00">runs()</text>
</a>
</g>
</a>
</g>
</a>
</g>
</g>
<!-- AdvancedMutationFuzzer&#45;&gt;Fuzzer -->
<g id="edge3" class="edge">
<title>AdvancedMutationFuzzer&#45;&gt;Fuzzer</title>
<path fill="none" stroke="black" d="M88.5,-343.75C88.5,-351.83 88.5,-361.01 88.5,-370.07"/>
<polygon fill="none" stroke="black" points="85,-370.19 88.5,-380.19 92,-370.19 85,-370.19"/>
</g>
<!-- AFLSmartSchedule -->
<g id="node5" class="node">
<title>AFLSmartSchedule</title>
<g id="a_node5"><a xlink:href="#" xlink:title="class AFLSmartSchedule:&#10;Define how fuzzing time should be distributed across the population.">
<polygon fill="none" stroke="black" points="190,-0.5 190,-75.5 327,-75.5 327,-0.5 190,-0.5"/>
<text text-anchor="start" x="200" y="-61.3" font-family="Patua One, Helvetica, sans-serif" font-weight="bold" font-size="14.00" fill="#b03a2e">AFLSmartSchedule</text>
<polyline fill="none" stroke="black" points="190,-52.5 327,-52.5 "/>
<g id="a_node5_13"><a xlink:href="#" xlink:title="AFLSmartSchedule">
<g id="a_node5_14"><a xlink:href="#" xlink:title="__init__(self, parser: Parser.EarleyParser, exponent: float = 1.0):&#10;Constructor">
<text text-anchor="start" x="198.5" y="-41.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-weight="bold" font-style="italic" font-size="10.00">__init__()</text>
</a>
</g>
<g id="a_node5_15"><a xlink:href="#" xlink:title="assignEnergy(self, population: Sequence[GreyboxFuzzer.Seed]):&#10;Assign exponential energy proportional to degree of validity">
<text text-anchor="start" x="198.5" y="-30.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-style="italic" font-size="10.00">assignEnergy()</text>
</a>
</g>
<g id="a_node5_16"><a xlink:href="#" xlink:title="degree_of_validity(self, seed: GreyboxFuzzer.Seed) &#45;&gt; float:&#10;Returns the proportion of a seed that is parsable">
<text text-anchor="start" x="198.5" y="-18.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-size="10.00">degree_of_validity()</text>
</a>
</g>
<g id="a_node5_17"><a xlink:href="#" xlink:title="parsable(self, seed: GreyboxFuzzer.Seed) &#45;&gt; str:&#10;Returns the substring that is parsable">
<text text-anchor="start" x="198.5" y="-7.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-size="10.00">parsable()</text>
</a>
</g>
</a>
</g>
</a>
</g>
</g>
<!-- PowerSchedule -->
<g id="node6" class="node">
<title>PowerSchedule</title>
<g id="a_node6"><a xlink:href="GreyboxFuzzer.ipynb" xlink:title="class PowerSchedule:&#10;Define how fuzzing time should be distributed across the population.">
<polygon fill="none" stroke="black" points="203,-162 203,-204 314,-204 314,-162 203,-162"/>
<text text-anchor="start" x="211" y="-189.8" font-family="Patua One, Helvetica, sans-serif" font-weight="bold" font-size="14.00" fill="#b03a2e">PowerSchedule</text>
<polyline fill="none" stroke="black" points="203,-181 314,-181 "/>
<g id="a_node6_18"><a xlink:href="#" xlink:title="PowerSchedule">
<g id="a_node6_19"><a xlink:href="GreyboxFuzzer.ipynb" xlink:title="__init__(self) &#45;&gt; None:&#10;Constructor">
<text text-anchor="start" x="228.5" y="-169.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-weight="bold" font-style="italic" font-size="10.00">__init__()</text>
</a>
</g>
</a>
</g>
</a>
</g>
</g>
<!-- AFLSmartSchedule&#45;&gt;PowerSchedule -->
<g id="edge4" class="edge">
<title>AFLSmartSchedule&#45;&gt;PowerSchedule</title>
<path fill="none" stroke="black" d="M258.5,-75.83C258.5,-99.29 258.5,-129.34 258.5,-151.47"/>
<polygon fill="none" stroke="black" points="255,-151.64 258.5,-161.64 262,-151.64 255,-151.64"/>
</g>
<!-- RegionMutator -->
<g id="node7" class="node">
<title>RegionMutator</title>
<g id="a_node7"><a xlink:href="#" xlink:title="class RegionMutator:&#10;Mutate inputs with input fragments from a pool">
<polygon fill="none" stroke="black" points="345,-6 345,-70 494,-70 494,-6 345,-6"/>
<text text-anchor="start" x="372" y="-55.8" font-family="Patua One, Helvetica, sans-serif" font-weight="bold" font-size="14.00" fill="#b03a2e">RegionMutator</text>
<polyline fill="none" stroke="black" points="345,-47 494,-47 "/>
<g id="a_node7_20"><a xlink:href="#" xlink:title="RegionMutator">
<g id="a_node7_21"><a xlink:href="#" xlink:title="add_to_fragment_pool(self, seed: SeedWithRegions) &#45;&gt; None:&#10;Mark fragments and regions in a seed file">
<text text-anchor="start" x="353.5" y="-35.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-style="italic" font-size="10.00">add_to_fragment_pool()</text>
</a>
</g>
<g id="a_node7_22"><a xlink:href="#" xlink:title="delete_fragment(self, seed: SeedWithRegions) &#45;&gt; SeedWithRegions:&#10;Deletes a random region">
<text text-anchor="start" x="353.5" y="-24.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-style="italic" font-size="10.00">delete_fragment()</text>
</a>
</g>
<g id="a_node7_23"><a xlink:href="#" xlink:title="swap_fragment(self, seed: SeedWithRegions) &#45;&gt; SeedWithRegions:&#10;Chooses a random region and swaps it with a fragment&#10;that starts with the same symbol">
<text text-anchor="start" x="353.5" y="-13.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-style="italic" font-size="10.00">swap_fragment()</text>
</a>
</g>
</a>
</g>
</a>
</g>
</g>
<!-- FragmentMutator -->
<g id="node8" class="node">
<title>FragmentMutator</title>
<g id="a_node8"><a xlink:href="#" xlink:title="class FragmentMutator:&#10;Mutate inputs with input fragments from a pool">
<polygon fill="none" stroke="black" points="345,-112.5 345,-253.5 494,-253.5 494,-112.5 345,-112.5"/>
<text text-anchor="start" x="363.5" y="-239.3" font-family="Patua One, Helvetica, sans-serif" font-weight="bold" font-size="14.00" fill="#b03a2e">FragmentMutator</text>
<polyline fill="none" stroke="black" points="345,-230.5 494,-230.5 "/>
<g id="a_node8_24"><a xlink:href="#" xlink:title="FragmentMutator">
<g id="a_node8_25"><a xlink:href="#" xlink:title="__init__(self, parser):&#10;Initialize mutators">
<text text-anchor="start" x="353.5" y="-219.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-weight="bold" font-style="italic" font-size="10.00">__init__()</text>
</a>
</g>
<g id="a_node8_26"><a xlink:href="#" xlink:title="add_to_fragment_pool(self, seed: SeedWithStructure) &#45;&gt; None:&#10;Adds all fragments of a seed to the fragment pool">
<text text-anchor="start" x="353.5" y="-208.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-weight="bold" font-style="italic" font-size="10.00">add_to_fragment_pool()</text>
</a>
</g>
<g id="a_node8_27"><a xlink:href="#" xlink:title="add_fragment(self, fragment: DerivationTree) &#45;&gt; None:&#10;Recursively adds fragments to the fragment pool">
<text text-anchor="start" x="353.5" y="-196.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-size="10.00">add_fragment()</text>
</a>
</g>
<g id="a_node8_28"><a xlink:href="#" xlink:title="count_nodes(self, fragment: DerivationTree) &#45;&gt; int:&#10;Returns the number of nodes in the fragment">
<text text-anchor="start" x="353.5" y="-185.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-size="10.00">count_nodes()</text>
</a>
</g>
<g id="a_node8_29"><a xlink:href="#" xlink:title="delete_fragment(self, seed: SeedWithStructure) &#45;&gt; SeedWithStructure:&#10;Delete a random fragment">
<text text-anchor="start" x="353.5" y="-175.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-style="italic" font-size="10.00">delete_fragment()</text>
</a>
</g>
<g id="a_node8_30"><a xlink:href="#" xlink:title="is_excluded(self, symbol: str) &#45;&gt; bool:&#10;Returns true if a fragment starting with a specific&#10;symbol and all its decendents can be excluded">
<text text-anchor="start" x="353.5" y="-163.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-size="10.00">is_excluded()</text>
</a>
</g>
<g id="a_node8_31"><a xlink:href="#" xlink:title="mutate(self, seed: SeedWithStructure) &#45;&gt; SeedWithStructure:&#10;Implement structure&#45;aware mutation. Memoize seeds.">
<text text-anchor="start" x="353.5" y="-153.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-style="italic" font-size="10.00">mutate()</text>
</a>
</g>
<g id="a_node8_32"><a xlink:href="#" xlink:title="recursive_delete(self, fragment: DerivationTree) &#45;&gt; DerivationTree:&#10;Recursively finds the fragment to delete">
<text text-anchor="start" x="353.5" y="-141.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-size="10.00">recursive_delete()</text>
</a>
</g>
<g id="a_node8_33"><a xlink:href="#" xlink:title="recursive_swap(self, fragment: DerivationTree) &#45;&gt; DerivationTree:&#10;Recursively finds the fragment to swap.">
<text text-anchor="start" x="353.5" y="-130.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-size="10.00">recursive_swap()</text>
</a>
</g>
<g id="a_node8_34"><a xlink:href="#" xlink:title="swap_fragment(self, seed: SeedWithStructure) &#45;&gt; SeedWithStructure:&#10;Substitutes a random fragment with another with the same symbol">
<text text-anchor="start" x="353.5" y="-120.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-style="italic" font-size="10.00">swap_fragment()</text>
</a>
</g>
</a>
</g>
</a>
</g>
</g>
<!-- RegionMutator&#45;&gt;FragmentMutator -->
<g id="edge5" class="edge">
<title>RegionMutator&#45;&gt;FragmentMutator</title>
<path fill="none" stroke="black" d="M419.5,-70.03C419.5,-79.69 419.5,-90.81 419.5,-102.22"/>
<polygon fill="none" stroke="black" points="416,-102.29 419.5,-112.29 423,-102.29 416,-102.29"/>
</g>
<!-- Mutator -->
<g id="node9" class="node">
<title>Mutator</title>
<g id="a_node9"><a xlink:href="GreyboxFuzzer.ipynb" xlink:title="class Mutator:&#10;Mutate strings">
<polygon fill="none" stroke="black" points="381,-296 381,-338 458,-338 458,-296 381,-296"/>
<text text-anchor="start" x="393.5" y="-323.8" font-family="Patua One, Helvetica, sans-serif" font-weight="bold" font-size="14.00" fill="#b03a2e">Mutator</text>
<polyline fill="none" stroke="black" points="381,-315 458,-315 "/>
<g id="a_node9_35"><a xlink:href="#" xlink:title="Mutator">
<g id="a_node9_36"><a xlink:href="GreyboxFuzzer.ipynb" xlink:title="__init__(self) &#45;&gt; None:&#10;Constructor">
<text text-anchor="start" x="389.5" y="-303.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-weight="bold" font-style="italic" font-size="10.00">__init__()</text>
</a>
</g>
</a>
</g>
</a>
</g>
</g>
<!-- FragmentMutator&#45;&gt;Mutator -->
<g id="edge6" class="edge">
<title>FragmentMutator&#45;&gt;Mutator</title>
<path fill="none" stroke="black" d="M419.5,-253.87C419.5,-265.1 419.5,-276.18 419.5,-285.81"/>
<polygon fill="none" stroke="black" points="416,-285.99 419.5,-295.99 423,-285.99 416,-285.99"/>
</g>
<!-- Legend -->
<g id="node10" class="node">
<title>Legend</title>
<text text-anchor="start" x="512.5" y="-55.5" font-family="Patua One, Helvetica, sans-serif" font-weight="bold" font-size="10.00" fill="#b03a2e">Legend</text>
<text text-anchor="start" x="512.5" y="-45.5" font-family="Patua One, Helvetica, sans-serif" font-size="10.00">• </text>
<text text-anchor="start" x="518.5" y="-45.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-weight="bold" font-size="8.00">public_method()</text>
<text text-anchor="start" x="512.5" y="-35.5" font-family="Patua One, Helvetica, sans-serif" font-size="10.00">• </text>
<text text-anchor="start" x="518.5" y="-35.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-size="8.00">private_method()</text>
<text text-anchor="start" x="512.5" y="-25.5" font-family="Patua One, Helvetica, sans-serif" font-size="10.00">• </text>
<text text-anchor="start" x="518.5" y="-25.5" font-family="'Fira Mono', 'Source Code Pro', 'Courier', monospace" font-style="italic" font-size="8.00">overloaded_method()</text>
<text text-anchor="start" x="512.5" y="-16.3" font-family="Helvetica,sans-Serif" font-size="9.00">Hover over names to see doc</text>
</g>
</g>
</svg>