程序代写 #include “Instrument.h”

std::map to_campaign =
{{“MutationA”, MutationA}, {“MutationB”, MutationB}, {“MutationC”, MutationC}};

bool toCampaign(std::string Str, Campaign& FuzzCampaign) {
auto I = to_campaign.find(Str);
if (I == to_campaign.end()) {
fprintf(stderr, “\”%s\” not a valid fuzz campaign, choice options are: “, Str.c_str());
for (auto &I2 : to_campaign) {
fprintf(stderr, “%s “, I2.first.c_str());
fprintf(stderr, “\n”);
return false;
FuzzCampaign = I->second;
return true;

* Implement your mutation algorithms.

std::string mutateA(std::string Origin) {
// Replace bytes with random values
int lower = 33; // !
int upper = 126; // ~

char root[Origin.size() + 1];
strcpy(root, Origin.c_str());

for (int i = 0; root[i] != 0; i++){
char newChar = (rand() % (upper – lower + 1)) + lower;
root[i] = newChar;

return root;

std::string mutateB(std::string Origin) {
// Swap adjacent bytes
int lenght = Origin.size() + 1;
char temp;
char root[lenght];
strcpy(root, Origin.c_str());

for (int i = 0; root[i] != 0; i+=2){
temp = root[i];
root[i] = root[i + 1];
root[i + 1] = temp;

return root;

std::string mutateC(std::string Origin) {
// Insert a random byte
int lenght = Origin.size() + 1;
int lower = 33; // !
int upper = 126; // ~

char root[lenght];
strcpy(root, Origin.c_str());

root[0] = (rand() % (upper – lower + 1)) + lower;

return root;

std::string mutate(std::string Origin, Campaign& FuzzCampaign) {
std::string Mutant;
switch (FuzzCampaign) {
case MutationA:
return mutateA(Origin);
case MutationB:
return mutateB(Origin);
case MutationC:
return mutateC(Origin);
#include
#include
#include
#include
#include
#include

#include “Mutate.h”
#include “Utils.h”

#include

std::string CampaignToStr(Campaign &FuzzCamp) {
switch (FuzzCamp) {
case MutationA:
return “MutationA”;
case MutationB:
return “MutationB”;
case MutationC:
return “MutationC”;

* Implement your feedback-directed seed update algorithm.
std::pair selectSeedAndCampaign() {

std::string Seed = SeedInputs[MutationA].back();
Campaign FuzzCamp = MutationA;

return std::make_pair(Seed,FuzzCamp);

* Implement your feedback-directed seed update algorithm.
void updateSeedInputs(std::string &Target, std::string &Mutated, Campaign &FuzzCamp, bool Success) {

int Freq = 1000;
int Count = 0;

bool test(std::string &Target, std::string &Input, Campaign &FuzzCamp, std::string &OutDir) {
// Clean up old coverage file before running
std::string CoveragePath = Target + “.cov”;
std::remove(CoveragePath.c_str());

int ReturnCode = runTarget(Target, Input);
switch (ReturnCode) {
if (Count % Freq == 0)
storePassingInput(Input, CampaignToStr(FuzzCamp), OutDir);
return true;
fprintf(stderr, “%d crashes found\n”, failureCount);
storeCrashingInput(Input, CampaignToStr(FuzzCamp), OutDir);
return false;
fprintf(stderr, “%s not found\n”, Target.c_str());

// ./fuzzer [exe file] [seed input dir] [output dir]
int main(int argc, char **argv) {
if (argc < 4) { printf("usage %s [exe file] [seed input dir] [output dir]\n", argv[0]); srand(time(NULL)); struct stat Buffer; if (stat(argv[1], &Buffer)) { fprintf(stderr, "%s not found\n", argv[1]); if (stat(argv[2], &Buffer)) { fprintf(stderr, "%s not found\n", argv[2]); if (stat(argv[3], &Buffer)) { fprintf(stderr, "%s not found\n", argv[3]); if (argc >= 5) {
Freq = strtol(argv[5], NULL, 10);

std::string Target(argv[1]);
std::string SeedInputDir(argv[2]);
std::string OutDir(argv[3]);

initialize(OutDir);

if (readSeedInputs(SeedInputDir)) {
fprintf(stderr, “Cannot read seed input directory\n”);

while (true) {
// NOTE: You should feel free to manipulate this run loop
std::pair SC = selectSeedAndCampaign();
auto Mutant = mutate(SC.first, SC.second);
auto Success = test(Target, Mutant, SC.second, OutDir);
updateSeedInputs(Target, Mutant, SC.second, Success);

#include “Mutate.h”

#include
#include