This fuzzer is responsible for the correctness of Ballistic's tier 1 compiler. It translates arm instructions via Ballistic and Unicorn Engine's and compare the results.
Usage
The fuzzer currently supports Linux only.
Building Ballistic in debug mode also builds the fuzzer.
Then you can run the fuzzer with the following command assuming you are ./build/debug/
ctest -R fuzzer --verbose
<!-- snip -->
14: [INFO] [main] [generate_seeds.c:133] Wrote 1592 seeds from 3856 instructions to seeds.bin.
14:
14: [INFO] [main] [main.c:21] Running Test...
14: [INFO] [main] [main.c:51] Loaded 1592 seeds from seeds.bin.
14: [INFO] [bal_fuzzer_ipc_spawn] [bal_fuzzer_ipc.c:96] Spawned worker '/home/apollo/Development/Ballistic/build/debug/bin/linux/bal_fuzzer_worker_ballistic' with pid 79140 (in fd 5, out fd 6).
14: [INFO] [bal_fuzzer_ipc_spawn] [bal_fuzzer_ipc.c:96] Spawned worker '/home/apollo/Development/Ballistic/build/debug/bin/linux/bal_fuzzer_worker_unicorn' with pid 79141 (in fd 7, out fd 8).
14: [WARN] [main] [main.c:169] Unicorn worker reported execution error for seed 0x91800000 and returned status code 1, skipping...
14: [WARN] [main] [main.c:169] Unicorn worker reported execution error for seed 0x91800000 and returned status code 1, skipping...
14: [WARN] [main] [main.c:169] Unicorn worker reported execution error for seed 0x91800001 and returned status code 1, skipping...
14: [WARN] [main] [main.c:169] Unicorn worker reported execution error for seed 0x9180000F and returned status code 1, skipping...
14: [WARN] [main] [main.c:169] Unicorn worker reported execution error for seed 0x9180001E and returned status code 1, skipping...
14: [WARN] [main] [main.c:169] Unicorn worker reported execution error for seed 0x9180001F and returned status code 1, skipping...
14: [WARN] [main] [main.c:169] Unicorn worker reported execution error for seed 0x91800000 and returned status code 1, skipping...
14: [WARN] [main] [main.c:169] Unicorn worker reported execution error for seed 0x91800020 and returned status code 1, skipping...
14: [WARN] [main] [main.c:169] Unicorn worker reported execution error for seed 0x918001E0 and returned status code 1, skipping...
14: [WARN] [main] [main.c:169] Unicorn worker reported execution error for seed 0x918003C0 and returned status code 1, skipping...
14: [WARN] [main] [main.c:169] Unicorn worker reported execution error for seed 0x918003E0 and returned status code 1, skipping...
14: [WARN] [main] [main.c:169] Unicorn worker reported execution error for seed 0x91800000 and returned status code 1, skipping...
14: [WARN] [main] [main.c:169] Unicorn worker reported execution error for seed 0x91800000 and returned status code 1, skipping...
14: [WARN] [main] [main.c:169] Unicorn worker reported execution error for seed 0x919F0000 and returned status code 1, skipping...
14: [WARN] [main] [main.c:169] Unicorn worker reported execution error for seed 0x91BF0000 and returned status code 1, skipping...
14: [INFO] [main] [main.c:251] Fuzz complete: 1592 seeds | 182 passed | 0 failed | 1410 seeds skipped | 0 errors.
The unicorn warnings mean that unicorn does not support that specific instruction and can be safely ignored.
All that matters is 0 failed, which proves that Ballistic translates all of its supported instructions correctly.
The fuzzer must report 0 failed AT ALL TIMES.
1410 seeds skipped means that Ballistic doesn't support that specific instruction and skipped it.
Debugging Specific Instructions
If Ballistic is translating an instruction incorrectly, you can pass the instruction directly to the ballistic worker
to debug the engine's state via the following command, assuming you are in ./build/debug/linux/bin.
./bal_fuzzer_worker_ballistic <hex instruction>