using fuzz introspector with other fuzzers (AFL-Like) about fuzz-introspector HOT 3 OPEN

In essence Fuzz Introspector is independent of libFuzzer as such -- it relies on identifying the entrypoint LLVMFuzzerTestOneInput and then also the ability to read coverage data from llvm-cov.

Could you give some specifics about your usecase and in particular (1) your harness and (2) hw you collect code coverage? Then I might be able to come up with something that generates the introspector report.

from fuzz-introspector.

I appreciate your response so much.

Obviously, there are some harnesses that are libfuzzer-compatible for OSS-fuzz, but my challenge is in this specific case. Like this, I want to fuzz PHP without any specific harness:

 afl-fuzz -i serialized_data -o basic_fuzz -m none -- ./sapi/cli/php -r 'unserialize(file_get_contents("php://stdin"));'

This link could be a good starting point to learn how to merge and generate reports. Do I have the right direction?

https://github.com/google/oss-fuzz/blob/2de46953155fb8be2fa672c0428325f49370cb5e/infra/base-images/base-runner/coverage#L521-L554

The questions are, how do I compile the fuzzer? Is it necessary to have LLVMFuzzerTestOneInput function?

Thank you in advance for your response.

from fuzz-introspector.

The questions are, how do I compile the fuzzer? Is it necessary to have LLVMFuzzerTestOneInput function?

For now yes, however, it may be possible to simply switch this as the only entrypoint to something more flexible. I'm happy to support the process if you're interested in implementing this.

The key would be to make it possible to compile the php binary using LLVM LTO and then enable the LLVM frontend from here https://github.com/ossf/fuzz-introspector/tree/main/frontends/llvm to run on the linked module. This frontend essentially outputs a call tree for the "fuzzer" which I assume in this case would be from the main function in sapi/cli/php?

from fuzz-introspector.