Skip to content

Tenet traces don't include memory writes done by the fuzzer #210

@Ninja3047

Description

@Ninja3047

It would be really nice if writes done by the fuzzer using VirtWriteDirty like so

  if (!g_Backend->VirtWriteDirty(NewInputBuffer, MutatedInputBufferPtr,
                                 MutatedInputBufferSize)) {
    fmt::print("Failed to insert the testcase\n");
    std::abort();
  }

could be added to the tenet coverage trace. This will make triaging tenet traces easier since you'll be able to see what part of the input buffer caused the crash if it hasn't been accessed since the fuzzer wrote it. This should also handle the case where we call VirtWriteDirty in the SetBreakpoint callback.

as a workaround, i have a janky python script that parses the output tenet files and adds a memory write to approximately the right location containing the buffer from the crash but this isn't ideal.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions