barrytomasini

Using LLVM's libfuzzer with Swift

Background

Of the many tools available for fuzzing, I've found that LLVM's libfuzzer is the easiest to use for Swift on macOS. Other tools seem to have a list of requirements taht are difficult to meet. libfuzzer on the other hand is built into LLVM and is available on macOS in the custom Swift toolchains: https://www.swift.org/download/

In this document I'll describe how to use libfuzzer with Swift and Swift Packages.

I used this setup to fuzz an SVG Renderer package that I am building. I was able to find and fix a number of bugs in my SVG parsing code using libfuzzer in basically no time at all.

This document is intended to document certain inner workings of the CPU.

There have been efforts by emu-russia and gekkio to have the CPU decapped, and so we have the decode ROM accessible to us. This means, that we know exactly what each opcode does (besides some nuanced behavior related to HALT, STOP, and some state management related to interrupts and power saving which are hard to untangle).

	import SwiftUI

	extension View {
	@MainActor
	func pdf(size: ProposedViewSize) -> Data {
	let renderer = ImageRenderer(content: self)
	renderer.proposedSize = size
	var pdfData = NSMutableData()
	renderer.render { size, render in
	var mediaBox = CGRect(origin: .zero, size: size)

	#!/bin/sh

	# usage:
	# ql /tmp/file.jpg
	# cat /tmp/file.jpg \| ql
	# cal -h \| ql

	if [ -z "$*" ]; then
	cat > /tmp/ql.stdin
	mime_type=$(file --brief --mime-type /tmp/ql.stdin)

	// ==UserScript==
	// @name Prevent link mangling on Google
	// @namespace LordBusiness.LMG
	// @match https://www.google.com/search
	// @grant none
	// @version 1.1
	// @author radiantly
	// @description Prevent google from mangling the link when copying or clicking the link on Firefox
	// ==/UserScript==

	@import Darwin;
	@import Foundation;
	@import IOKit;

	// clang -fmodules -o i2cwrite i2cwrite.m && ./i2cwrite

	typedef CFTypeRef IOAVServiceRef;
	extern IOAVServiceRef IOAVServiceCreate(CFAllocatorRef allocator);
	extern IOReturn IOAVServiceCopyEDID(IOAVServiceRef service, CFDataRef* x2);
	// outputBufferSize must be less than (1 << 12) (4096 bytes)

	@import Darwin;
	@import Foundation;
	@import IOKit;

	// clang -fmodules -o brt brt.m && ./brt

	// credit to @zhuowei for discovering the following APIs
	typedef CFTypeRef IOAVServiceRef;
	extern IOAVServiceRef IOAVServiceCreate(CFAllocatorRef allocator);
	extern IOReturn IOAVServiceCopyEDID(IOAVServiceRef service, CFDataRef* x2);

	Permission is hereby granted, free of charge, to any person obtaining a copy
	of this software and associated documentation files (the "Software"), to deal
	in the Software without restriction, including without limitation the rights
	to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	copies of the Software, and to permit persons to whom the Software is
	furnished to do so, subject to the following conditions:

	The above copyright notice and this permission notice shall be included in
	all copies or substantial portions of the Software.

	// Run any SwiftUI view as a Mac app.

	import Cocoa
	import SwiftUI

	NSApplication.shared.run {
	VStack {
	Text("Hello, World")
	.padding()
	.background(Capsule().fill(Color.blue))

	@propertyWrapper
	struct DidSet<Instance, Value> {
	var wrappedValue: Value

	private var function: (Instance) -> (Value) -> Void

	init(wrappedValue: Value, _ function: @escaping (Instance) -> (Value) -> Void) {
	self.wrappedValue = wrappedValue
	self.function = function
	}

barrytomasini

Using LLVM's libfuzzer with Swift

Background

Table of contents