# IPC Fuzzer A Chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives under `src/tools/ipc_fuzzer/` and is running on ClusterFuzz. A previous version of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new version is doing smarter mutations and generational fuzzing. To do so, each `ParamTraits` needs a corresponding `FuzzTraits`. Feel free to contribute. [TOC] ## Working with the fuzzer ### Build instructions * Run `gn args` and add `enable_ipc_fuzzer = true` to your args.gn. * build `ipc_fuzzer_all` target * component builds are currently broken, sorry * Debug builds are broken; only Release mode works. ### Replaying ipcdumps * `tools/ipc_fuzzer/scripts/play_testcase.py path/to/testcase.ipcdump` * more help: `tools/ipc_fuzzer/scripts/play_testcase.py -h` ### Listing messages in ipcdump * `out//ipc_message_util --dump path/to/testcase.ipcdump` ### Updating fuzzers in ClusterFuzz * `tools/ipc_fuzzer/scripts/cf_package_builder.py` * upload `ipc_fuzzer_mut.zip` and `ipc_fuzzer_gen.zip` under build directory to ClusterFuzz ### Contributing FuzzTraits * add them to `tools/ipc_fuzzer/fuzzer/fuzzer.cc` * thanks! ## Components ### ipcdump logger * add `enable_ipc_fuzzer = true` to `args.gn` * build `chrome` and `ipc_message_dump` targets * run chrome with `--no-sandbox --ipc-dump-directory=/path/to/ipcdump/directory` * ipcdumps will be created in this directory for each renderer using the format `_pid_.ipcdump` ### ipcdump replay Lives under `ipc_fuzzer/replay`. The renderer is replaced with `ipc_fuzzer_replay` using `--renderer-cmd-prefix`. This is done automatically with the `ipc_fuzzer/play_testcase.py` convenience script. ### ipcdump mutator / generator Lives under `ipc_fuzzer/fuzzer`. This is the code that runs on ClusterFuzz. It uses `FuzzTraits` to mutate ipcdumps or generate them out of thin air. ## Problems, questions, suggestions Send them to mbarbella@chromium.org.