Adding new mutator i.e radamsa about frida-fuzzer

[andreafioraldi]

i think this a bad idea, radamsa is slow. If you really want it, you should use libradamsa from aflpp and not execute the randamsa binary every time

[andreafioraldi]

You must use the Frida API, Cmodule or load the libradamsa as a shared library and invoke its routines from JS using a NativeFunction.

[andreafioraldi]

Yes you can try to add other mutators. Personally I don't like radamsa as it is too slow and generates the same inputs many times, but if you add other stuffs like protobuf etc I will accept a PR.

[marcinguy]

Maybe you know JS <-> C world better.

Compiled your libradamsa to JS using emscripten

em++       -O3       -Oz       --llvm-lto 1       -s NO_EXIT_RUNTIME=1       -s EXPORTED_FUNCTIONS="['_radamsa']"       libradamsa.bc       -o radamsa.html

Do you happen to know how to call it now from JS?

        var Module = {
          onRuntimeInitialized: function() {
            radamsa = Module.cwrap('radamsa', 'number', ['string', 'number', 'string', 'number', 'number'])
                  ?????
          },
        };

Or you would do it differently, not using emscripten?

[marcinguy]

Would save me hours of finding it out to see a sample.

I saw how you use CModule (couldn't find any references about it while googling)

So I can put radamsa C code in CModule and than use NativeFunction to call it?

Biggest question I have, is how to pass input and output buffer via NativeFunction to radamsa()

Here is function signature:

 n = radamsa((uint8_t *) input, len, (uint8_t *) output, BUFSIZE, seed);

Any tips, points to code samples would be great.

Thank you in advance

[marcinguy]

Managed to add it. Did it like you described.

Performance was affected. Radamsa is 10x slower than havoc and splice in my run.

For Multimedia Format fuzzing i.e HEVC, would you add other mutators than havoc and splice? Or do anything else? Or generally to extend this fuzzer. I can add them in similar approach.

P.S I know this is your PoC fuzzer