All the extractors have a common API - creating a data source, extraction of all the tracks, etc. These common APIs have been abstracted in a base class called ExtractorFuzzerBase to ensure code is reused between fuzzer plugins.
Additionally, ExtractorFuzzerBase also has support for memory based buffer BufferSource since the fuzzing engine feeds data using memory buffers and usage of standard data source objects like FileSource, HTTPSource, etc. is not feasible.
The fuzzer plugin for MP4 extractor uses the ExtractorFuzzerBase class and implements only the createExtractor to create the MP4 extractor class.
Dict file (dictionary file) is created for MP4 to ensure that the required MP4 atoms are present in every input file that goes to the fuzzer. This ensures that larger code gets covered as a range of MP4 atoms will be present in the input data.
This describes steps to build mp4_extractor_fuzzer binary.
Build the fuzzer
$ mm -j$(nproc) mp4_extractor_fuzzer
Create a directory CORPUS_DIR and copy some MP4 files to that folder Push this directory to device.
To run on device
$ adb sync data $ adb shell /data/fuzz/arm64/mp4_extractor_fuzzer/mp4_extractor_fuzzer CORPUS_DIR
The fuzzer plugin for WAV extractor uses the ExtractorFuzzerBase class and implements only the createExtractor to create the WAV extractor class.
This describes steps to build wav_extractor_fuzzer binary.
Build the fuzzer
$ mm -j$(nproc) wav_extractor_fuzzer
Create a directory CORPUS_DIR and copy some wav files to that folder Push this directory to device.
To run on device
$ adb sync data $ adb shell /data/fuzz/arm64/wav_extractor_fuzzer/wav_extractor_fuzzer CORPUS_DIR
The fuzzer plugin for AMR extractor uses the ExtractorFuzzerBase class and implements only the createExtractor to create the AMR extractor class.
Dict file (dictionary file) is created for AMR to ensure that the required start bytes are present in every input file that goes to the fuzzer. This ensures that larger code gets covered.
This describes steps to build amr_extractor_fuzzer binary.
Build the fuzzer
$ mm -j$(nproc) amr_extractor_fuzzer
Create a directory CORPUS_DIR and copy some AMR files to that folder Push this directory to device.
To run on device
$ adb sync data $ adb shell /data/fuzz/arm64/amr_extractor_fuzzer/amr_extractor_fuzzer CORPUS_DIR
The fuzzer plugin for MKV extractor uses the ExtractorFuzzerBase class and implements only the createExtractor to create the MKV extractor class.
Dict file (dictionary file) is created for MKV to ensure that the required element ID's are present in every input file that goes to the fuzzer. This ensures that larger code gets covered.
This describes steps to build mkv_extractor_fuzzer binary.
Build the fuzzer
$ mm -j$(nproc) mkv_extractor_fuzzer
Create a directory CORPUS_DIR and copy some mkv files to that folder. Push this directory to device.
To run on device
$ adb sync data $ adb shell /data/fuzz/arm64/mkv_extractor_fuzzer/mkv_extractor_fuzzer CORPUS_DIR
The fuzzer plugin for OGG extractor uses the ExtractorFuzzerBase class and implements only the createExtractor to create the OGG extractor object.
Dict file (dictionary file) is created for OGG to ensure that the required start bytes are present in every input file that goes to the fuzzer. This ensures that larger code gets covered.
This describes steps to build ogg_extractor_fuzzer binary.
Build the fuzzer
$ mm -j$(nproc) ogg_extractor_fuzzer
Create a directory CORPUS_DIR and copy some ogg files to that folder. Push this directory to device.
To run on device
$ adb sync data $ adb shell /data/fuzz/arm64/ogg_extractor_fuzzer/ogg_extractor_fuzzer CORPUS_DIR
The fuzzer plugins for MPEG2-PS and MPEG2-TS extractor use the ExtractorFuzzerBase class and implement only the createExtractor to create the MPEG2-PS or MPEG2-TS extractor object respectively.
Dict files (dictionary files) are created for MPEG2-PS and MPEG2-TS to ensure that the required start bytes are present in every input file that goes to the fuzzer. This ensures that larger code gets covered.
Two fuzzer binaries - mpeg2ps_extractor_fuzzer and mpeg2ts_extractor_fuzzer are generated based on the presence of a flag - MPEG2PS
This describes steps to build mpeg2ps_extractor_fuzzer and mpeg2ts_extractor_fuzzer binary.
Build the fuzzer
$ mm -j$(nproc) mpeg2ps_extractor_fuzzer $ mm -j$(nproc) mpeg2ts_extractor_fuzzer
Create a directory CORPUS_DIR and copy some mpeg2 files to that folder Push this directory to device.
To run on device
$ adb sync data $ adb shell /data/fuzz/arm64/mpeg2ps_extractor_fuzzer/mpeg2ps_extractor_fuzzer CORPUS_DIR $ adb shell /data/fuzz/arm64/mpeg2ts_extractor_fuzzer/mpeg2ts_extractor_fuzzer CORPUS_DIR
The fuzzer plugin for MP3 extractor uses the ExtractorFuzzerBase class and implements only the createExtractor to create the MP3 extractor class.
This describes steps to build mp3_extractor_fuzzer binary.
Build the fuzzer
$ mm -j$(nproc) mp3_extractor_fuzzer
Create a directory CORPUS_DIR and copy some mp3 files to that folder Push this directory to device.
To run on device
$ adb sync data $ adb shell /data/fuzz/arm64/mp3_extractor_fuzzer/mp3_extractor_fuzzer CORPUS_DIR
The fuzzer plugin for AAC extractor uses the ExtractorFuzzerBase class and implements only the createExtractor to create the AAC extractor class.
This describes steps to build aac_extractor_fuzzer binary.
Build the fuzzer
$ mm -j$(nproc) aac_extractor_fuzzer
Create a directory CORPUS_DIR and copy some aac files to that folder Push this directory to device.
To run on device
$ adb sync data $ adb shell /data/fuzz/arm64/aac_extractor_fuzzer/aac_extractor_fuzzer CORPUS_DIR
The fuzzer plugin for FLAC extractor uses the ExtractorFuzzerBase class and implements only the createExtractor to create the FLAC extractor object.
Dict file (dictionary file) is created for FLAC to ensure that the required start bytes are present in every input file that goes to the fuzzer. This ensures that larger code gets covered.
This describes steps to build flac_extractor_fuzzer binary.
Build the fuzzer
$ mm -j$(nproc) flac_extractor_fuzzer
Create a directory CORPUS_DIR and copy some flac files to that folder Push this directory to device.
To run on device
$ adb sync data $ adb shell /data/fuzz/arm64/flac_extractor_fuzzer/flac_extractor_fuzzer CORPUS_DIR
The fuzzer plugin for MIDI extractor uses the ExtractorFuzzerBase class and implements only the createExtractor to create the MIDI extractor class.
Dict file (dictionary file) is created for MIDI to ensure that the required MIDI headers are present in every input file that goes to the fuzzer. This ensures that larger code gets covered as a range of MIDI headers will be present in the input data.
This describes steps to build midi_extractor_fuzzer binary.
Build the fuzzer
$ mm -j$(nproc) midi_extractor_fuzzer
Create a directory CORPUS_DIR and copy some MIDI files to that folder Push this directory to device.
To run on device
$ adb sync data $ adb shell /data/fuzz/arm64/midi_extractor_fuzzer/midi_extractor_fuzzer CORPUS_DIR