AFLplusplus + libprotobuf-mutator = love
Example/skeleton for using libprotobuf-mutator together with AFL.
gen/out.proto
export AFL_CUSTOM_MUTATOR_ONLY=1
export AFL_CUSTOM_MUTATOR_LIBRARY=./mutator.so
The current implementation turns enum values into bytes. It was an experiment in encoding regexps as protobuffers. Unfortunately, PBs are not powerful enough to do that.
export AFL_CUSTOM_MUTATOR_ONLY=1
export AFL_CUSTOM_MUTATOR_LIBRARY=./mutator.so
afl-fuzz -i /tmp/in -o /tmp/out -Q -- ./dumper @@
In order to dump/verify the content of the protobuffers:
for f in /tmp/out/queue/id*src*; do echo "== $f =="; ./dumper $f; done
./build.sh
make