def reproduce(self, target_path, input_path, arguments, max_time): # pylint: disable=unused-argument
"""Reproduce a crash given an input.
Example: ./syz-crush -config my.cfg -infinite=false -restart_time=20s
crash-qemu-1-1455745459265726910
Args:
target_path: Path to the target.
input_path: Path to the reproducer input.
arguments: Additional arguments needed for reproduction.
max_time: Maximum allowed time for the reproduction.
Returns:
A ReproduceResult.
"""
binary_dir = self.prepare_binary_path()
syzkaller_runner = runner.get_runner(
os.path.join(binary_dir, constants.SYZ_REPRO))
repro_args = runner.get_config()
repro_args.extend([
'-infinite=false', '-restart_time={}s'.format(REPRO_TIME),
input_path
])
result = syzkaller_runner.repro(max_time, repro_args=repro_args)
return engine.ReproduceResult(result.command, result.return_code,
result.time_executed, result.output)
def prepare(self, corpus_dir, target_path, unused_build_dir): # pylint: disable=unused-argument
"""Prepare for a fuzzing session, by generating options and making
syzkaller binaries executable.
Args:
corpus_dir: The main corpus directory.
target_path: Path to the target.
build_dir: Path to the build directory.
Returns:
A FuzzOptions object."""
self.prepare_binary_path()
config = runner.get_config()
return SyzkallerOptions(corpus_dir,
config,
strategies={},
fuzz_corpus_dirs=None,
extra_env=None)
def reproduce(self, target_path, input_path, arguments, max_time):
"""Reproduce a crash given an input.
Example: ./syz-repro -config my.cfg crash-qemu-1-1455745459265726910
Args:
target_path: Path to the target.
input_path: Path to the reproducer input.
arguments: Additional arguments needed for reproduction.
max_time: Maximum allowed time for the reproduction.
Returns:
A ReproduceResult.
"""
binary_dir = self.prepare_binary_path()
syzkaller_runner = runner.get_runner(
os.path.join(binary_dir, constants.SYZ_REPRO))
repro_args = runner.get_config()
repro_args.extend(input_path)
result = syzkaller_runner.repro(max_time, repro_args=repro_args)
return engine.ReproduceResult(result.command, result.return_code,
result.time_executed, result.output)