KaneAI - World’s First E2E Software Testing Agent.Book a Demo Join TestMu Conference

How to use FuzzerCmd method of instance Package

Best Syzkaller code snippet using instance.FuzzerCmd

instance.go

Source:instance.go

...248	executorBin, err := inst.vm.Copy(inst.cfg.SyzExecutorBin)249	if err != nil {250		return &TestError{Title: fmt.Sprintf("failed to copy test binary to VM: %v", err)}251	}252	cmd := FuzzerCmd(fuzzerBin, executorBin, "test", inst.cfg.TargetOS, inst.cfg.TargetArch, fwdAddr,253		inst.cfg.Sandbox, 0, 0, false, false, true, false)254	outc, errc, err := inst.vm.Run(5*time.Minute, nil, cmd)255	if err != nil {256		return fmt.Errorf("failed to run binary in VM: %v", err)257	}258	rep := inst.vm.MonitorExecution(outc, errc, inst.reporter, true)259	if rep != nil {260		if err := inst.reporter.Symbolize(rep); err != nil {261			// TODO(dvyukov): send such errors to dashboard.262			log.Logf(0, "failed to symbolize report: %v", err)263		}264		return &TestError{265			Title:  rep.Title,266			Report: rep,267		}268	}269	select {270	case err := <-acceptErr:271		return err272	case <-time.After(10 * time.Second):273		return fmt.Errorf("test machine failed to connect to host")274	}275}276func (inst *inst) testRepro() error {277	cfg := inst.cfg278	execprogBin, err := inst.vm.Copy(cfg.SyzExecprogBin)279	if err != nil {280		return &TestError{Title: fmt.Sprintf("failed to copy test binary to VM: %v", err)}281	}282	executorBin, err := inst.vm.Copy(cfg.SyzExecutorBin)283	if err != nil {284		return &TestError{Title: fmt.Sprintf("failed to copy test binary to VM: %v", err)}285	}286	progFile := filepath.Join(cfg.Workdir, "repro.prog")287	if err := osutil.WriteFile(progFile, inst.reproSyz); err != nil {288		return fmt.Errorf("failed to write temp file: %v", err)289	}290	vmProgFile, err := inst.vm.Copy(progFile)291	if err != nil {292		return &TestError{Title: fmt.Sprintf("failed to copy test binary to VM: %v", err)}293	}294	opts, err := csource.DeserializeOptions(inst.reproOpts)295	if err != nil {296		return err297	}298	// Combine repro options and default options in a way that increases chances to reproduce the crash.299	// First, we always enable threaded/collide as it should be [almost] strictly better.300	// Executor does not support empty sandbox, so we use none instead.301	// Finally, always use repeat and multiple procs.302	if opts.Sandbox == "" {303		opts.Sandbox = "none"304	}305	if !opts.Fault {306		opts.FaultCall = -1307	}308	cmdSyz := ExecprogCmd(execprogBin, executorBin, cfg.TargetOS, cfg.TargetArch, opts.Sandbox,309		true, true, true, cfg.Procs, opts.FaultCall, opts.FaultNth, vmProgFile)310	if err := inst.testProgram(cmdSyz, 7*time.Minute); err != nil {311		return err312	}313	if len(inst.reproC) == 0 {314		return nil315	}316	target, err := prog.GetTarget(cfg.TargetOS, cfg.TargetArch)317	if err != nil {318		return err319	}320	bin, err := csource.Build(target, inst.reproC)321	if err != nil {322		return err323	}324	vmBin, err := inst.vm.Copy(bin)325	if err != nil {326		return &TestError{Title: fmt.Sprintf("failed to copy test binary to VM: %v", err)}327	}328	// We should test for longer (e.g. 5 mins), but the problem is that329	// reproducer does not print anything, so after 3 mins we detect "no output".330	return inst.testProgram(vmBin, time.Minute)331}332func (inst *inst) testProgram(command string, testTime time.Duration) error {333	outc, errc, err := inst.vm.Run(testTime, nil, command)334	if err != nil {335		return fmt.Errorf("failed to run binary in VM: %v", err)336	}337	rep := inst.vm.MonitorExecution(outc, errc, inst.reporter, true)338	if rep == nil {339		return nil340	}341	if err := inst.reporter.Symbolize(rep); err != nil {342		log.Logf(0, "failed to symbolize report: %v", err)343	}344	return &CrashError{Report: rep}345}346func FuzzerCmd(fuzzer, executor, name, OS, arch, fwdAddr, sandbox string, procs, verbosity int,347	cover, debug, test, runtest bool) string {348	osArg := ""349	if OS == "akaros" {350		// Only akaros needs OS, because the rest assume host OS.351		// But speciying OS for all OSes breaks patch testing on syzbot352		// because old execprog does not have os flag.353		osArg = " -os=" + OS354	}355	return fmt.Sprintf("%v -executor=%v -name=%v -arch=%v%v -manager=%v -sandbox=%v"+356		" -procs=%v -v=%d -cover=%v -debug=%v -test=%v -runtest=%v",357		fuzzer, executor, name, arch, osArg, fwdAddr, sandbox,358		procs, verbosity, cover, debug, test, runtest)359}360func ExecprogCmd(execprog, executor, OS, arch, sandbox string, repeat, threaded, collide bool,...

instance_test.go

Source:instance_test.go

...7	"runtime"8	"strings"9	"testing"10)11func TestFuzzerCmd(t *testing.T) {12	// IMPORTANT: if this test fails, do not fix it by changing flags here!13	// Test how an old version of syz-fuzzer parses flags genereated by the current FuzzerCmd.14	// This actually happens in syz-ci when we test a patch for an old bug and use an old syz-fuzzer/execprog.15	flags := flag.NewFlagSet("", flag.ContinueOnError)16	flagName := flags.String("name", "", "unique name for manager")17	flagArch := flags.String("arch", "", "target arch")18	flagManager := flags.String("manager", "", "manager rpc address")19	flagProcs := flags.Int("procs", 1, "number of parallel test processes")20	flagLeak := flags.Bool("leak", false, "detect memory leaks")21	flagOutput := flags.String("output", "stdout", "write programs to none/stdout/dmesg/file")22	flagPprof := flags.String("pprof", "", "address to serve pprof profiles")23	flagTest := flags.Bool("test", false, "enable image testing mode") // used by syz-ci24	flagExecutor := flags.String("executor", "./syz-executor", "path to executor binary")25	flagSignal := flags.Bool("cover", false, "collect feedback signals (coverage)")26	flagSandbox := flags.String("sandbox", "none", "sandbox for fuzzing (none/setuid/namespace)")27	flagDebug := flags.Bool("debug", false, "debug output from executor")28	flagV := flags.Int("v", 0, "verbosity")29	cmdLine := FuzzerCmd(os.Args[0], "/myexecutor", "myname", "linux", "386", "localhost:1234",30		"namespace", 3, 5, true, false, true, false)31	args := strings.Split(cmdLine, " ")[1:]32	if err := flags.Parse(args); err != nil {33		t.Fatal(err)34	}35	if *flagName != "myname" {36		t.Errorf("bad name: %q, want: %q", *flagName, "myname")37	}38	if *flagArch != "386" {39		t.Errorf("bad arch: %q, want: %q", *flagArch, "386")40	}41	if *flagManager != "localhost:1234" {42		t.Errorf("bad manager: %q, want: %q", *flagManager, "localhost:1234")43	}44	if *flagProcs != 3 {45		t.Errorf("bad procs: %v, want: %v", *flagProcs, 3)46	}47	if *flagLeak {48		t.Errorf("bad leak: %v, want: %v", *flagLeak, false)49	}50	if *flagOutput != "stdout" {51		t.Errorf("bad output: %q, want: %q", *flagOutput, "stdout")52	}53	if *flagPprof != "" {54		t.Errorf("bad pprof: %q, want: %q", *flagPprof, "")55	}56	if !*flagTest {57		t.Errorf("bad test: %v, want: %v", *flagTest, true)58	}59	if *flagExecutor != "/myexecutor" {60		t.Errorf("bad executor: %q, want: %q", *flagExecutor, "/myexecutor")61	}62	if *flagSandbox != "namespace" {63		t.Errorf("bad sandbox: %q, want: %q", *flagSandbox, "namespace")64	}65	if !*flagSignal {66		t.Errorf("bad signal: %v, want: %v", *flagSignal, true)67	}68	if *flagDebug {69		t.Errorf("bad debug: %v, want: %v", *flagDebug, false)70	}71	if *flagV != 5 {72		t.Errorf("bad verbosity: %v, want: %v", *flagV, 5)73	}74}75func TestExecprogCmd(t *testing.T) {76	// IMPORTANT: if this test fails, do not fix it by changing flags here!77	// See comment in TestFuzzerCmd.78	flags := flag.NewFlagSet("", flag.ContinueOnError)79	flagOS := flags.String("os", runtime.GOOS, "target os")80	flagArch := flags.String("arch", "", "target arch")81	flagRepeat := flags.Int("repeat", 1, "repeat execution that many times (0 for infinite loop)")82	flagProcs := flags.Int("procs", 1, "number of parallel processes to execute programs")83	flagFaultCall := flags.Int("fault_call", -1, "inject fault into this call (0-based)")84	flagFaultNth := flags.Int("fault_nth", 0, "inject fault on n-th operation (0-based)")85	flagExecutor := flags.String("executor", "./syz-executor", "path to executor binary")86	flagThreaded := flags.Bool("threaded", true, "use threaded mode in executor")87	flagCollide := flags.Bool("collide", true, "collide syscalls to provoke data races")88	flagSignal := flags.Bool("cover", false, "collect feedback signals (coverage)")89	flagSandbox := flags.String("sandbox", "none", "sandbox for fuzzing (none/setuid/namespace)")90	cmdLine := ExecprogCmd(os.Args[0], "/myexecutor", "fuchsia", "386", "namespace", true, false, false, 7, 2, 3, "myprog")91	args := strings.Split(cmdLine, " ")[1:]...

FuzzerCmd

Using AI Code Generation

1func FuzzerCmd() {2    instance.FuzzerCmd()3}4func FuzzerCmd() {5    instance.FuzzerCmd()6}7func FuzzerCmd() {8    instance.FuzzerCmd()9}

Automation Testing Tutorials

Learn to execute automation testing from scratch with LambdaTest Learning Hub. Right from setting up the prerequisites to run your first automation test, to following best practices and diving deeper into advanced test scenarios. LambdaTest Learning Hubs compile a list of step-by-step guides to help you be proficient with different test automation frameworks i.e. Selenium, Cypress, TestNG etc.