danielebert / emulatedfirmwarefuzzing Goto Github PK

all 3 unit test parts
check what would be best to fuzz. what can be fuzzed

API helper functions

Line coverage is always displayed at 100% because I do not include lines that are not triggered.

and check that we call ->reset = 1 in invalid_write_address_found

avr->trace_data->stack_frame seems to be off by 3 bytes? thats why i have alternative for stack buffer sani

In server.py
When + C on ./server.py process

crash handler.h -- // ids

uninitialized memory -> also printable, i.e. addr2line
> i can send stacktrace via built in array thingy

• avg exec per sec of last 10 sec
• total runtime (seconds or minutes)

cycle timer takes into account sleeps -- so i think cycle is more accurate than counting slept time. maybe some users explicitly want delay time?

TODO: from symbol to addr get the __bss_end symbol and setup shadow map from 0..__bss_end

also make it work with what i write in paper

and in

in bash config same alias as in zsh

https://github.com/SlashDevin/NeoGPS/blob/master/examples/NMEAtest/NMEAtest.ino

has a gps.decode()

when we return we set avr->stack_return_address = -1; -- use avr->trace_data->stack_frame for that, its what we want

Do I check for these issues?:

/// A read or write memory request overflowed the address size
AddressIntegerOverflow,

• new type
• function call

SIGFPE
SIGXFSZ

i can write that i have this list from libfuzzer src: https://github.com/AFLplusplus/AFLplusplus/blob/stable/custom_mutators/libfuzzer/FuzzerDriver.cpp#L990