Add Support for fuzzing by attaching to running processes on Windows.

README.md

@@ -127,6 +127,8 @@ The following command line arguments are supported:
 
 `-dict <path>` - Provides a dictionary to be used during mutation. The dictionary should be a text file with every entry on a separate line. `\xXX` escape sequences can be used.
 
+`-process-name <name of running process> - Enables fuzzing for processes that are already running in the operating system such as Windows services. The fuzzer will attach to the specified running process and get coverage from there. Then, the script specified after `--` will be opened in a new thread and will send the current testcase to running process. Note: this mode only allows for one thread and file delivery through the script. 
+
 For TinyInst instrumentation command line arguments, refer to [TinyInst readme](https://github.com/googleprojectzero/TinyInst).
 
 Example (macOS):

fuzzer.cpp

@@ -113,6 +113,13 @@ void Fuzzer::ParseOptions(int argc, char **argv) {
   incremental_coverage = GetBinaryOption("-incremental_coverage", argc, argv, true);
 
   add_all_inputs = GetBinaryOption("-add_all_inputs", argc, argv, false);
+
+  process_name = GetOption("-process_name", argc, argv);
+
+  if (process_name != NULL) {
+    //set threads to one as multiple threads attaching to one process does not work well
+    num_threads = 1;
+  }
 }
 
 void Fuzzer::SetupDirectories() {
@@ -245,8 +252,8 @@ RunResult Fuzzer::RunSampleAndGetCoverage(ThreadContext *tc, Sample *sample, Cov
       FATAL("Repeatedly failed to deliver sample");
     }
   }
-
   RunResult result = tc->instrumentation->Run(tc->target_argc, tc->target_argv, init_timeout, timeout);
+
   tc->instrumentation->GetCoverage(*coverage, true);
 
   // save crashes and hangs immediately when they are detected
@@ -325,8 +332,9 @@ RunResult Fuzzer::TryReproduceCrash(ThreadContext* tc, Sample* sample, uint32_t
         FATAL("Repeatedly failed to deliver sample");
       }
     }
-
+    
     result = tc->instrumentation->RunWithCrashAnalysis(tc->target_argc, tc->target_argv, init_timeout, timeout);
+
     tc->instrumentation->ClearCoverage();
 
     if (result == CRASH) return result;

fuzzer.h

@@ -196,6 +196,8 @@ class Fuzzer {
   uint64_t num_samples_discarded;
   uint64_t num_threads;
   uint64_t total_execs;
+
+  char * process_name;
 
   void SaveState(ThreadContext *tc);
   void RestoreState(ThreadContext *tc);

instrumentation.h

@@ -31,7 +31,7 @@ class Instrumentation {
   virtual RunResult RunWithCrashAnalysis(int argc, char** argv, uint32_t init_timeout, uint32_t timeout) {
     return Run(argc, argv, init_timeout, timeout);
   }
-
+  
   virtual void CleanTarget() = 0;
 
   virtual bool HasNewCoverage() = 0;

tinyinstinstrumentation.cpp

@@ -22,13 +22,19 @@ limitations under the License.
 
 #include <sstream>
 
-
 void TinyInstInstrumentation::Init(int argc, char **argv) {
   instrumentation = new LiteCov();
   instrumentation->Init(argc, argv);
 
   persist = GetBinaryOption("-persist", argc, argv, false);
   num_iterations = GetIntOption("-iterations", argc, argv, 1);
+  process_name = GetOption("-process_name", argc, argv);
+  script = ArgvToCmd(argc, argv);
+
+  attach_mode = false;
+  if(process_name != NULL) {
+    attach_mode = true;
+  }
 }
 
 RunResult TinyInstInstrumentation::Run(int argc, char **argv, uint32_t init_timeout, uint32_t timeout) {
@@ -68,7 +74,17 @@ RunResult TinyInstInstrumentation::Run(int argc, char **argv, uint32_t init_time
       WARN("Target function not reached, retrying with a clean process\n");
       instrumentation->Kill();
       cur_iteration = 0;
-      status = instrumentation->Run(argc, argv, init_timeout);
+      if (attach_mode) {
+        Sleep(init_timeout);
+        processID = FindProcessId(process_name);
+        if (script != NULL) {
+          HANDLE thread_handle = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)system, script, 0, NULL);
+          CloseHandle(thread_handle);
+        }
+        status = instrumentation->Attach(processID, timeout1);
+      } else {
+        status = instrumentation->Run(argc, argv, init_timeout);
+      }
     }
 
     if (status != DEBUGGER_TARGET_START) {

tinyinstinstrumentation.h

@@ -32,7 +32,7 @@ class TinyInstInstrumentation : public Instrumentation {
 
   RunResult Run(int argc, char** argv, uint32_t init_timeout, uint32_t timeout) override;
   RunResult RunWithCrashAnalysis(int argc, char** argv, uint32_t init_timeout, uint32_t timeout) override;
-
+  
   void CleanTarget() override;
 
   bool HasNewCoverage() override;
@@ -47,6 +47,10 @@ class TinyInstInstrumentation : public Instrumentation {
 protected:
   LiteCov * instrumentation;
   bool persist;
+  boolean attach_mode;
+  int processID;
+  char * process_name;
+  char * script;
   int num_iterations;
   int cur_iteration;
 };