docs/ipc_fuzzer.md

# Introduction

A chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives under `src/tools/ipc_fuzzer/` and is running on ClusterFuzz. A previous version of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new version is doing smarter mutations and generational fuzzing. To do so, each `ParamTraits<Type>` needs a corresponding `FuzzTraits<Type>`. Feel free to contribute.


---

# Working with the fuzzer

## Build instructions
  * add `enable_ipc_fuzzer=1` to `GYP_DEFINES`
  * build `ipc_fuzzer_all` target
  * component builds are currently broken, sorry
  * Debug builds are broken; only Release mode works.

## Replaying ipcdumps
  * `tools/ipc_fuzzer/scripts/play_testcase.py path/to/testcase.ipcdump`
  * more help: `tools/ipc_fuzzer/scripts/play_testcase.py -h`

## Listing messages in ipcdump
  * `out/`_Build_`/ipc_message_util --dump path/to/testcase.ipcdump`

## Updating fuzzers in ClusterFuzz
  * `tools/ipc_fuzzer/scripts/cf_package_builder.py`
  * upload `ipc_fuzzer_mut.zip` and `ipc_fuzzer_gen.zip` under build directory to ClusterFuzz

## Contributing FuzzTraits
  * add them to tools/ipc\_fuzzer/fuzzer/fuzzer.cc
  * thanks!


---

# Components

## ipcdump logger
  * add `enable_ipc_fuzzer=1` to `GYP_DEFINES`
  * build `chrome` and `ipc_message_dump` targets
  * run chrome with `--no-sandbox --ipc-dump-directory=/path/to/ipcdump/directory`
  * ipcdumps will be created in this directory for each renderer using the format _pid_.ipcdump

## ipcdump replay
Lives under `ipc_fuzzer/replay`. The renderer is replaced with `ipc_fuzzer_replay` using `--renderer-cmd-prefix`. This is done automatically with the `ipc_fuzzer/play_testcase.py` convenience script.

## ipcdump mutator / generator
Lives under `ipc_fuzzer/fuzzer`. This is the code that runs on ClusterFuzz. It uses `FuzzTraits<Type>` to mutate ipcdumps or generate them out of thin air.


---

# Problems, questions, suggestions
Send them to mbarbella@chromium.org.