I've been trying to learn the fuzzing library LibAFL for a while now, but I never seem to be able to fully grasp the essential parts. I've read tutorials, followed along tutorials, read the whole LibAFL book (that's still under construction), and have read a few of the examples in the repo. You could say I'm still in tutorial hell, honestly.
I'm trying to write a simple fuzzer for a malware code sample (MooBot) and I've been trying to figure out two things: how to find the input that has the maximum run time for a function, and how to not run malware directly on my computer. One of them should be more important than the other, but given my lack of expertise in LibAFL right now, I'm focused on the former. For my example, I noticed that there's a custom trim function in MooBot that helps sanitize input:
void trim(char *str)
{
int i, begin = 0, end = strlen(str) - 1;
while (isspace(str[begin]))
begin++;
while ((end >= begin) && isspace(str[end]))
end--;
for (i = begin; i <= end; i++)
str[i - begin] = str[i];
str[i - begin] = '\0';
}
This is what I test in my harness. I know I could probably logic my way into finding the input that has the max run time, but I'm using this as an exercise for LibAFL and using the rust FFI. The problem is how to deal with feedbacks and observers. I currently have this with no observers:
let mut feedback = CrashFeedback::new();
let mut objective = CrashFeedback::new();
Which simply reports an input if it crashes the program. It works for inital fuzzing, but now that I'm trying to find an input that maximizes run time this won't work. I tried to figure if there was a maximization feedback that would work with the time observer, but the only feedback that maximizes anything is the MaxMapFeedback which doesn't seem compatible with the time observer.
What I'm envisioning is something like this:
let mut observer = TimeObserver::new();
let mut feedback = MaximizeFeedback::new(&observer);
I think the solution has something to do with MapFeedbacks, but I'm not exactly sure how they work.
Wait that's how it's spelled?