https://github.com/risicle/cpytraceafl-regex
A modified version of mrab-regex with added cpytraceafl instrumentation
https://github.com/risicle/cpytraceafl-regex
afl-fuzz coverage cpython python regular-expression tracing
Last synced: about 1 month ago
JSON representation
A modified version of mrab-regex with added cpytraceafl instrumentation
- Host: GitHub
- URL: https://github.com/risicle/cpytraceafl-regex
- Owner: risicle
- Created: 2020-06-02T21:37:56.000Z (about 6 years ago)
- Default Branch: master
- Last Pushed: 2020-06-22T17:33:34.000Z (almost 6 years ago)
- Last Synced: 2025-02-09T05:27:48.964Z (over 1 year ago)
- Topics: afl-fuzz, coverage, cpython, python, regular-expression, tracing
- Language: C
- Size: 48 MB
- Stars: 0
- Watchers: 3
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# cpytraceafl-regex
This is a thinly modified version of Matthew Barnett's
[mrab-regex](https://bitbucket.org/mrabarnett/mrab-regex) regular expression library with
added instrumentation for use when fuzzing python code with
[cpytraceafl](https://github.com/risicle/cpytraceafl).
The intention is for fuzzing harnesses to be able to substitute the builtin `re` module
library with this, highly compatible, module and thereby allow AFL to generate examples
which pass regular expressions used in the target or explore their limits in interesting
ways.
See the original [README.mrab-regex.rst](./README.mrab-regex.rst) for more general
information in this library's extended regex features.
## Recommended usage
Early in the startup of the fuzzing harness, (though after the call to `install_rewriter()`):
```python
import regex
from sys import modules
modules["re"] = regex
```
code later importing/referencing the `re` module should instead be using this instrumented
`regex` code. Note that before evaluating any regexes, `cpytraceafl.tracehook.set_map_start()`
will need to have been initialized with a memory region to write its intrumentation data
into. Otherwise you'll get segfaults.
This works unless the code under test attempts to use the `typing` module, at which point its
trick involving the `Pattern` type will trip up over itself. Some further hackery will need
to be devised to get past this.