Skip specific mutation value in s_bytes primitive

[milanraf]

Hello to the Community

I am trying to figure out how to add a custom option in s_bytes primitive.
Since I am fuzzing against a device by reading and writing registers in its memory, I would like to skip a specific register address which would change the device IP and make it unreachable, blocking the fuzzing process.
One s_block of the payload has one entry like this:
s_bytes(value=bytes([0x00, 0x00]), size=2, max_len=2, name="reg_addr")
The idea is to add an extra parameter like:
s_bytes(value=b"", size=None, padding=b"\x00", fuzzable=True, max_len=None, name=None, forbidden_val=b""):
I would like to ask the Community where to look for in the code in order to try to implement this.
I have already found a candidate function:
def get_mutations(self):
in fuzzable.py
but it is not really clear how this recursive algorithm works.

Thanks for hints

Best

Raffaello

[cq674350529]

Hi, if you want to add extra parameters for s_bytes(), maybe you can refer to the implementation of s_bytes(). Based on what you described, you can try to add custom changes to the following methods.

The mutations() will call self._iterate_fuzz_cases() to get the mutated data.

boofuzz/boofuzz/primitives/bytes.py

Lines 146 to 151 in 6340630

	def mutations(self, default_value):
	for fuzz_value in self._iterate_fuzz_cases(default_value):
	if callable(fuzz_value):
	yield compose(self._adjust_mutation_for_size, fuzz_value)
	else:
	yield self._adjust_mutation_for_size(fuzz_value=fuzz_value)

boofuzz/boofuzz/primitives/bytes.py

Lines 164 to 179 in 6340630

	def _iterate_fuzz_cases(self, default_value):
	for fuzz_value in self._fuzz_library:
	yield fuzz_value
	for fuzz_value in self._mutators_of_default_value:
	yield fuzz_value
	for fuzz_value in self._magic_debug_values:
	yield fuzz_value
	for i in range(0, len(default_value)):
	for fuzz_bytes in self._fuzz_strings_1byte:
	def f(value):
	if i < len(value):
	return value[:i] + fuzz_bytes + value[i + 1 :]
	else:
	return value

[milanraf]

Thank you for the hint!
It's been a pretty trivial modification:

    def mutations(self, default_value):
        for fuzz_value in self._iterate_fuzz_cases(default_value):
            if fuzz_value != self.forbidden_value:
                if callable(fuzz_value):
                    yield compose(self._adjust_mutation_for_size, fuzz_value)
                else:
                    yield self._adjust_mutation_for_size(fuzz_value=fuzz_value)

[jtpereyda]

Love it! It could be made into a generic parameter, with some tweaking of base classes, but mostly I'm glad to hear it was easy enough to hack together. Happy fuzzing!