[Feature] The ability to register custom mutators from one proto message to another. about libprotobuf-mutator HOT 4 CLOSED

Can you please add more details to example?

I see proto type A, which is series of actions. libprotobuf-mutator mutates it. Fuzz target apply it to particular code. If anything was interesting, it's stores proto of type A into the corpus.

So where do we have another message type?

from libprotobuf-mutator.

The simplest case I am dealing with would be four protos:
Message A has a repeated field of Message B which has a oneof representing the type of actions (Message C and Message D).

Message C represents a logic action where as Message D represents a raw action.

The utility of Message C comes from implicit parameter values like HMACs, and valid values for version numbers and length fields.

Message D represents a raw action which could be valid but statistically will not be because of fields that are hard to brute force like HMACs, etc.

I want to define a mutator that transforms one type of message in a oneof field to another type of message---specifically the logical action to the equivalent raw action. This is not the same as just changing the one of field as the underlying data to represent both protos would be different.

from libprotobuf-mutator.

I think you can just mutate whatever make sense to mutate as any type of proto using mutator. Than you just create/convert real input in the beginning of the your fuzz target input handler.

from libprotobuf-mutator.

I implemented a proof of concept of what I am talking about and have uploaded a pull request and CCed you on the PoC, so we can discuss with more context of what I am trying to accomplish.

from libprotobuf-mutator.