WIP: Experimental valuegeneration techniques #384

anishnaik · 2024-06-26T12:08:08Z

No description provided.

Since this struct is used in multiple files, to avoid dependency cycles, it is moved to utils.

This tracer is used to get emitted event values and return values of calls and add them to corpus for each sequence.

Since values inside contracts are added to base value set automatically, it was confusing to see values to be emitted and captured in the value set already.

…dd them to valueSet This change will make sure to extract captured event values and their types and store them in a data structure. This also makes sure that baseValueSet is cloned at the beginning of each call sequence execution and event values are added to cloned value set. Later, the modified value set is used by fuzzer workers while executing call sequences.

…ality

Since we are using a different structure to store event values and types, we don't need emittedValues and functionReturnValues as members of ValueGenerationTracer structure.

TransactionOutputValues structure is used to store event and return values together so that both kinds of values can be provided to results.AdditionalResults[valueGenerationTracerResultsKey].

getCallFrameReturnValue is called from this function as this function itself gets called in CaptureExit and CaptureEnd, allowing us to grab return value of every call frame including the top call frame.

We provide the values to MessageResults so that they can be later on added to the ValueSet of the current call sequence in fuzzer worker.

…nt sequence value set This function will check the type of the collected data and add them accordingly to the value set of the currently executed sequence.

Cleaner code is achieved by migrating the part that is responsible for adding collected data to value set into a separate function.

CLAassistant · 2024-06-26T12:08:14Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
2 out of 3 committers have signed the CLA.

✅ s4nsec
✅ anishnaik
❌ Sanan Hasanov

Sanan Hasanov seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

fuzzing/config/config.go

fuzzing/config/config_defaults.go

fuzzing/config/config.go

fuzzing/fuzzer_worker.go

fuzzing/testdata/contracts/assertions/assert_immediate.sol

fuzzing/valuegenerationtracer/valuegeneration_tracer.go

…nerationEnabled

As we don't need to differentiate between an emitted value and a return value, and also saving the type of emitted values are not necessary, we can simply use a slice of any elements to store interesting elements found during EVM execution.

utils/call_frame.go

fuzzing/testdata/contracts/assertions/assert_immediate.sol

fuzzing/valuegenerationtracer/valuegeneration_tracer.go

fuzzing/fuzzer_worker.go

fuzzing/valuegenerationtracer/valuegeneration_tracer.go

Considering clean desing, the function responsible for adding transaction output values to value set is moved to value_set.go and turned into a method called Add.

…rved

This contract will emit event/return values of various types to test value generation tracer's ability to collect them.

The function duplicates a call sequence element at index N and places it at index N+1 if N is not equal to one less the length of the sequence. Otherwise, the duplicate is placed at index N-1.

…ue set

…426) * initial commit * fix: weight methods correctly to avoid skipping some * fix commenting * add debugging scripts * zero clue if i optimized anything at all... * upload artifact on every PR * fix: log number of workers shrinking (#8) * fix: log number of workers shrinking * report total # failed sequences/ total sequences tested * pushing json coverage report --------- Co-authored-by: alpharush <[email protected]>

Sanan Hasanov and others added 24 commits June 18, 2024 09:53

Move CallFrame to utils

b83bc3f

Since this struct is used in multiple files, to avoid dependency cycles, it is moved to utils.

Add ValueGenerationTracer

d26cd47

This tracer is used to get emitted event values and return values of calls and add them to corpus for each sequence.

Import CallFrame from utils for execution_tracer

0024d74

Initialize ValueGenerationTracer in fuzzer_worker.go

385b6fb

Add a unit test for ValueGenerationTracer

af12408

Enable ValueGenerationTracer in configs

faf0952

Enable ValueGenerationTracer in medusa.json

937a7ad

Modify existing contract to fit our test case

39f7d8e

Add necessary functions to get event values

20ef5ce

Add captureEnteredCallFrame in CaptureEnter

63cf261

grab events

c60029f

make generating events a ValueGenerationTrace capability

1695d01

Change emitted event values to check for changes in valueSet

cdab504

Since values inside contracts are added to base value set automatically, it was confusing to see values to be emitted and captured in the value set already.

Remove SetValueSet function

9118e21

Modify assert_immediate.sol to check return value collection function…

6c6bdd2

…ality

Modify fuzzer configs to make debugging easier

aeabcdd

Remove deprecated storage alternatives for event values

f23d608

Since we are using a different structure to store event values and types, we don't need emittedValues and functionReturnValues as members of ValueGenerationTracer structure.

Provide a new structure to store both event and return values

7f56635

TransactionOutputValues structure is used to store event and return values together so that both kinds of values can be provided to results.AdditionalResults[valueGenerationTracerResultsKey].

Get return value of the current call frame

0b2f9e6

Call getCallFrameReturnValue from captureExitedCallFrame

7d1febf

getCallFrameReturnValue is called from this function as this function itself gets called in CaptureExit and CaptureEnd, allowing us to grab return value of every call frame including the top call frame.

Provide collected event and return values to MessageResults

fc21f10

We provide the values to MessageResults so that they can be later on added to the ValueSet of the current call sequence in fuzzer worker.

Write colleced transaction output values(return, event data) to curre…

492e4c4

…nt sequence value set This function will check the type of the collected data and add them accordingly to the value set of the currently executed sequence.

Use AddTransactionOutputValuesToValueSet in fuzzer worker

0cf6a86

Cleaner code is achieved by migrating the part that is responsible for adding collected data to value set into a separate function.

anishnaik commented Jun 26, 2024

View reviewed changes

fuzzing/config/config.go Outdated Show resolved Hide resolved

anishnaik commented Jun 26, 2024

View reviewed changes

s4nsec added 3 commits June 27, 2024 12:47

Rename ValueGenerationTracingEnabled parameter to ExperimentalValueGe…

395667e

…nerationEnabled

Modify the logic to preserve base value set

01c1de3

Set TransactionOutputValues to []any

ba1c045

As we don't need to differentiate between an emitted value and a return value, and also saving the type of emitted values are not necessary, we can simply use a slice of any elements to store interesting elements found during EVM execution.

s4nsec added 2 commits July 1, 2024 11:37

Grab only if ReturnError is nil

cb7d04f

Don't expect values when it is contract creation

b1c3d0f

anishnaik commented Jul 16, 2024

View reviewed changes

utils/call_frame.go Outdated Show resolved Hide resolved

anishnaik commented Jul 16, 2024

View reviewed changes

fuzzing/valuegenerationtracer/valuegeneration_tracer.go Outdated Show resolved Hide resolved

s4nsec added 15 commits July 17, 2024 15:25

Move ExperimentalValueGenerationEnabled to TestingConfig

93799c0

Remove type TransactionOutputValues

ab6d871

Add comment descriptions to ValueGenerationTracer members

f2019f5

Remove stale comments and print statements

072c8cb

Prevent return values from being reset

d8cce90

Make adding transaction output values value_set.go's responsibility

5e10173

Considering clean desing, the function responsible for adding transaction output values to value set is moved to value_set.go and turned into a method called Add.

Use Add instead of deprecated AddTransactionOutputValuesToValueSet

b496c43

Use fw.fuzzer.config.Fuzzing.Testing.ExperimentalValueGenerationEnabled

f9dd9a0

Check whether all values are added and if the base value set is prese…

00e8edb

…rved

Reset assert_immediate.sol to default

826aa8f

Add a contract to test event and return value collection

288337e

This contract will emit event/return values of various types to test value generation tracer's ability to collect them.

Add to value set inside the unit test

30f9419

Merge remote-tracking branch 'origin/master' into valuegeneration-tracer

a68363c

Adapt value generation tracer to interface changes

0e1763f

Add new mutation strategy - callSeqGenFuncDuplicateAtRandom

8ac6695

The function duplicates a call sequence element at index N and places it at index N+1 if N is not equal to one less the length of the sequence. Otherwise, the duplicate is placed at index N-1.

s4nsec force-pushed the valuegeneration-tracer branch from 8ac6695 to 0e1763f Compare July 30, 2024 15:30

anishnaik added 2 commits July 30, 2024 18:07

code cleanup

2851e96

fix test contract

14f677b

s4nsec approved these changes Jul 31, 2024

View reviewed changes

anishnaik and others added 5 commits July 31, 2024 10:38

wipe value set before test

64e3ca2

Add expected values to test whether those values are added to the val…

e94a668

…ue set

Merge branch 'master' into valuegeneration-tracer

42ab8d3

Add latest medusa config

5e2c637

bsamuels453 self-assigned this Oct 25, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WIP: Experimental valuegeneration techniques #384

WIP: Experimental valuegeneration techniques #384

anishnaik commented Jun 26, 2024

CLAassistant commented Jun 26, 2024 •

edited

Loading

WIP: Experimental valuegeneration techniques #384

Are you sure you want to change the base?

WIP: Experimental valuegeneration techniques #384

Conversation

anishnaik commented Jun 26, 2024

CLAassistant commented Jun 26, 2024 • edited Loading

CLAassistant commented Jun 26, 2024 •

edited

Loading