samsung / fluff

A tool designed to synthesise semantically correct JavaScript snippets given arbitrary data. Useful for fuzzing.

Fluff

A tool designed to synthesise semantically correct JavaScript snippets given arbitrary data.

Useful for fuzzing.

JS Runtimes supported out-of-the-box

• jerryscript
• njs
• duktape
• v8

Requirements

• docker
• make

Building

• (optional) Check if you have access to docker (run docker info)
• (optional) Specify desired version of JS runtime in Makefile.conf
• Run make (jerryscript | njs | duktape | v8)
• If everything builds correctly the process will result in:
  • build/fluff_* - binary to fuzz
  • build/fluff_*_dry - binary that will convert Fluff bytecode to JS testcase (stdout)
  • build/grammars
    • js_grammar.yaml - es5.1 grammar file
    • js_grammar_es6.yaml - es6 grammar file

Usage

Typical fuzzing setup:

• Create input folder and sample testcase, i.e. mkdir in && echo "420" >> in/testcase
• Start fuzzing using afl-fuzz, for example: afl-fuzz -m none -i in -o out ./fluff_njs @@ js_grammar.yaml
• (optional) you can use build container to run fuzzing, requires some manual work

docker run -it -d -v path/to/fluff/repository/build:/home/build/fluff identifier /bin/bash
docker exec -it container_number bash
# afl-fuzz is preinstalled in /home/build/afl

• Enjoy your cup of tea/coffee and wait for crashes

Description

Detailed information about the design of Fluff can be read in the whitepaper.

Contributing

Patches, additions and other contributions are welcome! If you see a feature which you could implement or a bug which you could fix please send us a message or a pull request. If you have found some interesting bug with this tool, please leave us a message/github issue for the future Hall Of Fame.

Contact

If you want to drop us a message, feel free to send a mail to [email protected] or [email protected].

fluff's Issues

Maximal index that can be accessed is 256.

Since every integer that is treated as a number is an unsigned char, some of the functionality can't be accessed. This includes

• too many builtin functions/variables (which for instance is a case at Spidermonkey).
• inability to access array indices greater than 255.

Proposed solution: include special opcode with one argument (say n), which means that the argument for the next read value will be 256*n + m instead of regular m. For better illustration, look at EXTENDED_ARG opcode from Python 3.6 and above.

Setup CI

We should setup CI for this project, there are multiple available.

I think that a lot of OSS projects use travis-ci as they offer free service.