corpus

Documentation

Index

• type CallCov
• type Corpus
  • func NewCorpus(ctx context.Context) *Corpus
  • func NewFocusedCorpus(ctx context.Context, updates chan<- NewItemEvent, areas []FocusArea) *Corpus
  • func NewMonitoredCorpus(ctx context.Context, updates chan<- NewItemEvent) *Corpus
  • func (corpus *Corpus) CallCover() map[string]*CallCov
  • func (corpus *Corpus) ChooseProgram(r *rand.Rand) *prog.Prog
  • func (corpus *Corpus) Item(sig string) *Item
  • func (corpus *Corpus) Items() []*Item
  • func (corpus *Corpus) Minimize(cover bool)
  • func (corpus *Corpus) Programs() []*prog.Prog
  • func (corpus *Corpus) Save(inp NewInput)
  • func (corpus *Corpus) Signal() signal.Signal
• type FocusArea
• type Item
  • func (item Item) StringCall() string
• type ItemUpdate
• type NewInput
• type NewItemEvent
• type ProgramsList

Types

type CallCov

type CallCov struct {
	Count int
	Cover cover.Cover
}

type Corpus

type Corpus struct {
	*ProgramsList
	StatProgs  *stat.Val
	StatSignal *stat.Val
	StatCover  *stat.Val
	// contains filtered or unexported fields
}

Corpus object represents a set of syzkaller-found programs that cover the kernel up to the currently reached frontiers.

func NewCorpus

func NewCorpus(ctx context.Context) *Corpus

func NewFocusedCorpus

func NewFocusedCorpus(ctx context.Context, updates chan<- NewItemEvent, areas []FocusArea) *Corpus

func NewMonitoredCorpus

func NewMonitoredCorpus(ctx context.Context, updates chan<- NewItemEvent) *Corpus

func (*Corpus) CallCover

func (corpus *Corpus) CallCover() map[string]*CallCov

func (*Corpus) ChooseProgram

func (corpus *Corpus) ChooseProgram(r *rand.Rand) *prog.Prog

func (*Corpus) Item

func (corpus *Corpus) Item(sig string) *Item

func (*Corpus) Items

func (corpus *Corpus) Items() []*Item

func (*Corpus) Minimize

func (corpus *Corpus) Minimize(cover bool)

func (*Corpus) Programs

func (corpus *Corpus) Programs() []*prog.Prog

func (*Corpus) Save

func (corpus *Corpus) Save(inp NewInput)

func (*Corpus) Signal

func (corpus *Corpus) Signal() signal.Signal

type FocusArea

type FocusArea struct {
	Name     string // can be empty
	CoverPCs map[uint64]struct{}
	Weight   float64
}

type Item

type Item struct {
	Sig     string
	Call    int
	Prog    *prog.Prog
	HasAny  bool // whether the prog contains squashed arguments
	Signal  signal.Signal
	Cover   []uint64
	Updates []ItemUpdate
	// contains filtered or unexported fields
}

Item objects are to be treated as immutable, otherwise it's just too hard to synchonize accesses to them across the whole project. When Corpus updates one of its items, it saves a copy of it.

func (Item) StringCall

func (item Item) StringCall() string

type ItemUpdate

type ItemUpdate struct {
	Call     int
	RawCover []uint64
}

It may happen that a single program is relevant because of several sysalls. In that case, there will be several ItemUpdate entities.

type NewInput

type NewInput struct {
	Prog     *prog.Prog
	Call     int
	Signal   signal.Signal
	Cover    []uint64
	RawCover []uint64
}

type NewItemEvent

type NewItemEvent struct {
	Sig      string
	Exists   bool
	ProgData []byte
	NewCover []uint64
}

type ProgramsList

type ProgramsList struct {
	// contains filtered or unexported fields
}