pyjfuzz/core/pjf_mutators.py
def random_action(self, b):
        """
        Perform the actual fuzzing using random strategies
        """
        action = random.choice([1, 2, 3, 4, 5, 6, 7, 8, 9, 10])
        if len(b) >= 3:
            pos = random.randint(0, len(b)-2)
            if action == 1:
                rbyte = random.randrange(256)
                rn = random.randrange(len(b))
                b[rn] = "%c" % rbyte
            elif action == 2:
                howmany = random.randint(1, 100)
                curpos = pos
                for _ in range(0, howmany):
                    b.insert(curpos, b[pos])
                    pos += 1
            elif action == 3:
                n = random.choice([1, 2, 4])
                for _ in range(0, n):
                    if len(b) > pos+1:
                        tmp = b[pos]
                        b[pos] = b[pos+1]
                        b[pos+1] = tmp
                        pos += 1
                    else:
                        pos -= 2
                        tmp = b[pos]
                        b[pos] = b[pos+1]
                        b[pos+1] = tmp
                        pos += 1
            elif action in [4, 5]:
                op = {
                    4: lambda x, y: ord(x) << y,
                    5: lambda x, y: ord(x) >> y,
                }
                n = random.choice([1, 2, 4])
                if len(b) < pos+n:
                    pos = len(b) - (pos+n)
                if n == 1:
                    f = "<B"
                    s = op[action](b[pos], n) % 0xff
                elif n == 2:
                    f = "<H"
                    s = op[action](b[pos], n) % 0xffff
                elif n == 4:
                    f = "<I"
                    s = op[action](b[pos], n) % 0xffffff
                val = struct.pack(f, s)
                for v in val:
                    if isinstance(v, int):
                        v = chr(v)
                    b[pos] = v
                    pos += 1
            elif action == 6:
                b.insert(random.randint(0, len(b)-1), random.choice(["\"", "[", "]", "+", "-", "}", "{"]))
            elif action == 7:
                del b[random.randint(0, len(b)-1)]
            elif action in [8, 9]:
                block = random.choice([
                    (r"\"", r"\""),
                    (r"\[", r"\]"),
                    (r"\{", r"\}")
                ])
                b_str = self.safe_join(b)
                block_re = re.compile(str(".+({0}[^{2}{3}]+{1}).+").format(block[0], block[1], block[0], block[1]))
                if block_re.search(b_str):
                    r = random.choice(block_re.findall(b_str))
                    random_re = re.compile("({0})".format(re.escape(r)))
                    if random_re.search(b_str):
                        if action == 8:
                            newarr = list(random_re.sub("", b_str))
                            b[:] = newarr
                        else:
                            newarr = list(random_re.sub("\\1" * random.randint(1, 10), b_str, 1))
                            b[:] = newarr
            elif action == 10:
                b_str = self.safe_join(b)
                limit_choice = random.choice([
                    0x7FFFFFFF,
                    -0x80000000,
                    0xff,
                    -0xff,
                ])
                block_re = re.compile("(\-?[0-9]+)")
                if block_re.search(b_str):
                    block = random.choice([m for m in block_re.finditer(b_str)])
                    new = b_str[0:block.start()] + str(int(block.group())*limit_choice) + b_str[block.start() +
                                                                                                len(block.group()):]
                    b[:] = list(new)
def random_action(self, b):
        """
        Perform the actual fuzzing using random strategies
        """
        action = random.choice([1, 2, 3, 4, 5, 6, 7, 8, 9, 10])
        if len(b) >= 3:
            pos = random.randint(0, len(b)-2)
            if action == 1:
                rbyte = random.randrange(256)
                rn = random.randrange(len(b))
                b[rn] = "%c" % rbyte
            elif action == 2:
                howmany = random.randint(1, 100)
                curpos = pos
                for _ in range(0, howmany):
                    b.insert(curpos, b[pos])
                    pos += 1
            elif action == 3:
                n = random.choice([1, 2, 4])
                for _ in range(0, n):
                    if len(b) > pos+1:
                        tmp = b[pos]
                        b[pos] = b[pos+1]
                        b[pos+1] = tmp
                        pos += 1
                    else:
                        pos -= 2
                        tmp = b[pos]
                        b[pos] = b[pos+1]
                        b[pos+1] = tmp
                        pos += 1
            elif action in [4, 5]:
                op = {
                    4: lambda x, y: ord(x) << y,
                    5: lambda x, y: ord(x) >> y,
                }
                n = random.choice([1, 2, 4])
                if len(b) < pos+n:
                    pos = len(b) - (pos+n)
                if n == 1:
                    f = "<B"
                    s = op[action](b[pos], n) % 0xff
                elif n == 2:
                    f = "<H"
                    s = op[action](b[pos], n) % 0xffff
                elif n == 4:
                    f = "<I"
                    s = op[action](b[pos], n) % 0xffffff
                val = struct.pack(f, s)
                for v in val:
                    if isinstance(v, int):
                        v = chr(v)
                    b[pos] = v
                    pos += 1
            elif action == 6:
                b.insert(random.randint(0, len(b)-1), random.choice(["\"", "[", "]", "+", "-", "}", "{"]))
            elif action == 7:
                del b[random.randint(0, len(b)-1)]
            elif action in [8, 9]:
                block = random.choice([
                    (r"\"", r"\""),
                    (r"\[", r"\]"),
                    (r"\{", r"\}")
                ])
                b_str = self.safe_join(b)
                block_re = re.compile(str(".+({0}[^{2}{3}]+{1}).+").format(block[0], block[1], block[0], block[1]))
                if block_re.search(b_str):
                    r = random.choice(block_re.findall(b_str))
                    random_re = re.compile("({0})".format(re.escape(r)))
                    if random_re.search(b_str):
                        if action == 8:
                            newarr = list(random_re.sub("", b_str))
                            b[:] = newarr
                        else:
                            newarr = list(random_re.sub("\\1" * random.randint(1, 10), b_str, 1))
                            b[:] = newarr
            elif action == 10:
                b_str = self.safe_join(b)
                limit_choice = random.choice([
                    0x7FFFFFFF,
                    -0x80000000,
                    0xff,
                    -0xff,
                ])
                block_re = re.compile("(\-?[0-9]+)")
                if block_re.search(b_str):
                    block = random.choice([m for m in block_re.finditer(b_str)])
                    new = b_str[0:block.start()] + str(int(block.group())*limit_choice) + b_str[block.start() +
                                                                                                len(block.group()):]
                    b[:] = list(new)
def random_action ( self , b ) : action = random . choice ( [ 1 , 2 , 3 , 4 , 5 , 6 , 7 , 8 , 9 , 10 ] ) if len ( b ) >= 3 : pos = random . randint ( 0 , len ( b ) - 2 ) if action == 1 : rbyte = random . randrange ( 256 ) rn = random . randrange ( len ( b ) ) b [ rn ] = "%c" % rbyte elif action == 2 : howmany = random . randint ( 1 , 100 ) curpos = pos for _ in range ( 0 , howmany ) : b . insert ( curpos , b [ pos ] ) pos += 1 elif action == 3 : n = random . choice ( [ 1 , 2 , 4 ] ) for _ in range ( 0 , n ) : if len ( b ) > pos + 1 : tmp = b [ pos ] b [ pos ] = b [ pos + 1 ] b [ pos + 1 ] = tmp pos += 1 else : pos -= 2 tmp = b [ pos ] b [ pos ] = b [ pos + 1 ] b [ pos + 1 ] = tmp pos += 1 elif action in [ 4 , 5 ] : op = { 4 : lambda x , y : ord ( x ) << y , 5 : lambda x , y : ord ( x ) >> y , } n = random . choice ( [ 1 , 2 , 4 ] ) if len ( b ) < pos + n : pos = len ( b ) - ( pos + n ) if n == 1 : f = "<B" s = op [ action ] ( b [ pos ] , n ) % 0xff elif n == 2 : f = "<H" s = op [ action ] ( b [ pos ] , n ) % 0xffff elif n == 4 : f = "<I" s = op [ action ] ( b [ pos ] , n ) % 0xffffff val = struct . pack ( f , s ) for v in val : if isinstance ( v , int ) : v = chr ( v ) b [ pos ] = v pos += 1 elif action == 6 : b . insert ( random . randint ( 0 , len ( b ) - 1 ) , random . choice ( [ "\"" , "[" , "]" , "+" , "-" , "}" , "{" ] ) ) elif action == 7 : del b [ random . randint ( 0 , len ( b ) - 1 ) ] elif action in [ 8 , 9 ] : block = random . choice ( [ ( r"\"" , r"\"" ) , ( r"\[" , r"\]" ) , ( r"\{" , r"\}" ) ] ) b_str = self . safe_join ( b ) block_re = re . compile ( str ( ".+({0}[^{2}{3}]+{1}).+" ) . format ( block [ 0 ] , block [ 1 ] , block [ 0 ] , block [ 1 ] ) ) if block_re . search ( b_str ) : r = random . choice ( block_re . findall ( b_str ) ) random_re = re . compile ( "({0})" . format ( re . escape ( r ) ) ) if random_re . search ( b_str ) : if action == 8 : newarr = list ( random_re . sub ( "" , b_str ) ) b [ : ] = newarr else : newarr = list ( random_re . sub ( "\\1" * random . randint ( 1 , 10 ) , b_str , 1 ) ) b [ : ] = newarr elif action == 10 : b_str = self . safe_join ( b ) limit_choice = random . choice ( [ 0x7FFFFFFF , - 0x80000000 , 0xff , - 0xff , ] ) block_re = re . compile ( "(\-?[0-9]+)" ) if block_re . search ( b_str ) : block = random . choice ( [ m for m in block_re . finditer ( b_str ) ] ) new = b_str [ 0 : block . start ( ) ] + str ( int ( block . group ( ) ) * limit_choice ) + b_str [ block . start ( ) + len ( block . group ( ) ) : ] b [ : ] = list ( new )
Perform the actual fuzzing using random strategies
Perform the actual fuzzing using random strategies