The fuzzer plugin for libmediametricsservice is designed based on the understanding of the service and tries to achieve the following:
The configuration parameters are not hardcoded, but instead selected based on incoming data. This ensures more code paths are reached by the fuzzer.
Media Metrics Service contains the following modules:
Item)TimeMachineStorage)TransactionLog)AnalyticsAction)AudioAnalytics)TimedAction)| Module | Valid Input Values | Configured Value |
|---|---|---|
Item | Key: std::string. Values: INT32_MIN to INT32_MAX, INT64_MIN to INT64_MAX, std::string, double, pair<INT32_MIN to INT32_MAX, INT32_MIN to INT32_MAX> | Value obtained from FuzzedDataProvider |
TimeMachineStorage | Key: std::string. Values: INT32_MIN to INT32_MAX, INT64_MIN to INT64_MAX, std::string, double, pair<INT32_MIN to INT32_MAX, INT32_MIN to INT32_MAX> | Value obtained from FuzzedDataProvider |
TranscationLog | mediametrics::Item | mediametrics::Item created by obtaining values from FuzzedDataProvider |
AnalyticsAction | URL: std::string ending with .event, Value: std::string, action: A function | URL and Values obtained from FuzzedDataProvider, a placeholder function was passed as action |
AudioAnalytics | mediametrics::Item | mediametrics::Item created by obtaining values from FuzzedDataProvider |
TimedAction | time: std::chrono::seconds, function: std::function | std::chrono::seconds : value obtained from FuzzedDataProvider, std::function: a placeholder function was used. |
This also ensures that the plugin is always deterministic for any given input.
This describes steps to build mediametrics_service_fuzzer binary.
Build the fuzzer
$ mm -j$(nproc) mediametrics_service_fuzzer
Create a directory CORPUS_DIR and copy some files to that folder Push this directory to device.
To run on device
$ adb sync data $ adb shell /data/fuzz/arm64/mediametrics_service_fuzzer/mediametrics_service_fuzzer CORPUS_DIR