README.md
1# Fuzzers for libbtcore
2
3## Plugin Design Considerations
4The fuzzer plugins for `libbtcore` are designed based on the understanding of the
5source code and tries to achieve the following:
6
7##### Maximize code coverage
8The configuration parameters are not hard-coded, but instead selected based on
9incoming data. This ensures more code paths are reached by the fuzzers.
10
11Fuzzers assigns values to the following parameters to pass on to libbtcore:
121. Bluetooth Device Type (parameter name: `deviceType`)
132. Bluetooth Adapter Visibility Mode (parameter name: `mode`)
143. Bluetooth Address (parameter name: `btAddress`)
154. Bluetooth Device Class parameter (parameter name: `deviceClassT`)
16
17| Parameter| Valid Values| Configured Value|
18|------------- |-------------| ----- |
19| `deviceType` | 0.`BT_DEVICE_DEVTYPE_BREDR` 1.`BT_DEVICE_DEVTYPE_BLE` 2.`BT_DEVICE_DEVTYPE_DUAL` | Value obtained from FuzzedDataProvider |
20| `mode` | 0.`BT_SCAN_MODE_NONE` 1.`BT_SCAN_MODE_CONNECTABLE` 2.`BT_SCAN_MODE_CONNECTABLE_DISCOVERABLE` | Value obtained from FuzzedDataProvider |
21| `btAddress` | Values inside array ranges from `0x0` to `0xFF` | Value obtained from FuzzedDataProvider |
22| `deviceClassT` | Values inside array ranges from `0x0` to `0xFF` | Value obtained from FuzzedDataProvider |
23This also ensures that the plugins are always deterministic for any given input.
24
25##### Maximize utilization of input data
26The plugins feed the entire input data to the module.
27This ensures that the plugins tolerates any kind of input (empty, huge,
28malformed, etc) and doesn't `exit()` on any input and thereby increasing the
29chance of identifying vulnerabilities.
30
31## Build
32
33This describes steps to build btcore_device_class_fuzzer, btcore_property_fuzzer and btcore_module_fuzzer binaries.
34
35### Android
36
37#### Steps to build
38Build the fuzzer
39```
40 $ mm -j$(nproc) btcore_device_class_fuzzer
41 $ mm -j$(nproc) btcore_property_fuzzer
42 $ mm -j$(nproc) btcore_module_fuzzer
43```
44### Steps to run
45
46To run on device
47```
48 $ adb sync data
49 $ adb shell /data/fuzz/arm64/btcore_device_class_fuzzer/btcore_device_class_fuzzer
50 $ adb shell /data/fuzz/arm64/btcore_property_fuzzer/btcore_property_fuzzer
51 $ adb shell /data/fuzz/arm64/btcore_module_fuzzer/btcore_module_fuzzer
52```
53
54## References:
55 * http://llvm.org/docs/LibFuzzer.html
56 * https://github.com/google/oss-fuzz
57