如何完成一个 fuzzer

class Mutator:
    def __init__(self, core):  # 它接受一个参数 core 作为核心样本集  
        # core set of samples  
        self.core = core  # 核心样本集，存储一组样本。  
        # Data format = > (array of bytearrays, coverage)
        self.trace = set()  # Currently observed blocks  
        # 当前观察到的块集合，使用set数据结构存储。  
        self.corpus = []  # Corpus of executed samples  
        # 执行过的样本集，使用列表[]存储。  
        self.pool = []  # Mutation pool  
        # 变异池，使用列表[]存储。  
        self.samples = []  # Mutated samples  
        # 变异后的样本集，使用列表[]存储。  

    def __iter__(self):
        # Initiate mutation round  
        self._fit_pool()
        self._mutate_pool()
        return self

    def __next__(self):
        if not self.samples:
            self._fit_pool()
            self._mutate_pool()

        global stop_flag
        if stop_flag:
            raise StopIteration
        else:
            return self.samples.pop()

def _fit_pool(self):
    # fit function for our genetic algorithm  
    # Always copy initial corpus  
    print("### Fitting round\t\t")  
    for sample in self.core:
        self.pool.append((sample, []))
    # 遍历核心样本集 self.core，将每个样本和一个空列表作为元组 (sample, []) 添加到变异池 self.pool 中  
    print("Pool size: {:d} [core samples promoted]".format(len(self.pool)))

    # Select elements that uncovered new block  
    for sample, trace in self.corpus:
        # 执行过的样本集self.corpus中的每个样本和对应的观察到的块集合  
        if trace - self.trace:
            self.pool.append((sample, trace))
    # 如果该样本观察到的块集合与当前观察到的块集合self.trace有不同  
    # 则将该样本和块集合添加到变异池self.pool中  

    print("Pool size: {:d} [new traces promoted]".format(len(self.pool)))

    # Backfill to 100  
    if self.corpus and len(self.pool) < 100:
        # 如果执行过的样本集self.corpus非空，并且变异池self.pool的大小小于100，那么会进行补充  
        self.corpus.sort(reverse=True, key=lambda x: len(x[1]))
        # 首先对执行过的样本集进行降序排序，按照观察到的块集合的长度进行比较  
        for _ in range(min(100 - len(self.pool), len(self.corpus))):
            # Exponential Distribution
            v = random.random() * random.random() * len(self.corpus)
            # 通过这种方式，随机选择一些样本并将其添加到变异池中，这里留个印象，这就是遗传算法的变异策略  

            self.pool.append(self.corpus[int(v)])
            self.corpus.pop(int(v))
            # 添加后，从执行过的样本集中移除这些样本  
        print("Pool size: {:d} [backfill from corpus]".format(len(self.pool)))
    print("### End of round\t\t")

    # Update trace info  
    for _, t in self.corpus:
        self.trace |= t

    # Drop rest of the corpus  
    self.corpus = []

def _mutate_pool(self):
    # Create samples by mutating pool  
    while self.pool:  # 池子里有东西就弹出  
        sample, _ = self.pool.pop()
        for _ in range(10):  ## 把弹出的 sample 执行变异，当成 samples 填入  
            self.samples.append(Mutator.mutate_sample(sample))


def update_corpus(self, data, trace=None):
    self.corpus.append((data, trace))  ## 更新语料库，真正的 fuzz 程序会调用该方法并更新 corpus  

@staticmethod
def mutate_sample(sample):
    _sample = sample[:]  # Copy sample

    methods = [  ##这些方法都是之后要使用的具体变异函数  
        Mutator.bit_flip,
        Mutator.byte_flip,
        Mutator.magic_number,
        Mutator.add_block,
        Mutator.remove_block,
    ]

    f = random.choice(methods)  # 选哪个方法  
    idx = random.choice(range(0, len(_sample)))  # 选索引  
    f(idx, _sample)

    return _sample

SIZE = [4, 8, 16, 32, 64]
FLIP_ARRAY = [1, 2, 4, 8, 16, 32, 64, 128]
MAGIC_VALS = [
    [0xFF],
    [0x7F],
    [0x00],
    [0xFF, 0xFF],  # 0xFFFF  
    [0x00, 0x00],  # 0x0000  
    [0xFF, 0xFF, 0xFF, 0xFF],  # 0xFFFFFFFF  
    [0x00, 0x00, 0x00, 0x00],  # 0x00000000  
    [0x00, 0x00, 0x00, 0x80],  # 0x80000000  
    [0x00, 0x00, 0x00, 0x40],  # 0x40000000  
    [0xFF, 0xFF, 0xFF, 0x7F],  # 0x7FFFFFFF  
]

...

@staticmethod
def bit_flip(index, _sample):  # 选和哪个FLIP_ARRAY进行异或  
    num = random.choice(SIZE)
    for idx in random.choices(range(len(_sample)), k=num):
        _sample[idx] = _sample[idx] ^ random.choice(FLIP_ARRAY)


@staticmethod
def byte_flip(index, _sample):  # 选和那个random.getrandbits(8)进行异或，算是加强版的bit_flip  
    num = random.choice(SIZE)
    for idx in random.choices(range(len(_sample)), k=num):
        _sample[idx] = _sample[idx] ^ random.getrandbits(8)


@staticmethod
def magic_number(index, _sample):
    selected_magic = random.choice(MAGIC_VALS)

    # guard clause, we don't want to go off by one
    if index > (len(_sample) - len(selected_magic)):  # 做个防越界  
        index = len(_sample) - len(selected_magic)

    for c, v in enumerate(selected_magic):
        _sample[index + c] = v


@staticmethod
def add_block(index, _sample):  ## 添加和移除块，四四方方的移除  
    size = random.choice(SIZE)
    _sample[index:index] = bytearray((random.getrandbits(8) for i in range(size)))


@staticmethod
def remove_block(index, _sample):
    size = random.choice(SIZE)

    _sample = _sample[:index] + _sample[index + size :]

def get_base(vmmap):
    for m in vmmap:
        ## 如果有可执行权限，并且后缀是我们这个文件名的，就返回他的起始地址  
        if "x" in m.permissions and m.pathname.endswith(
            os.path.basename(config["target"])
        ):
            return m.start

def get_bpmap(path):
    bpmap = []

    if path and os.path.isfile(path):
        with open(path, "r") as fh:
            for line in fh.readlines():  ## 按 16进制 保存  
                bpmap.extend(list(map(lambda x: int(x.strip(), 16), line.split())))
    else:
        print("No breakpoint map; trace won't be generated")

    return bpmap

def execute_fuzz(dbg, data, bpmap):
    trace = set()
    cmd = [config["target"], config["file"]]
    pid = debugger.child.createChild(cmd, no_stdout=True, env=None)
    proc = dbg.addProcess(pid, True)
    base = get_base(proc.readMappings())  # 得基础地址  

    # Insert breakpoints for tracing
    if bpmap:
        for offset in bpmap:
            proc.createBreakpoint(base + offset)  # 设置断点  

    while True:
        proc.cont()  # 继续跑  
        event = dbg.waitProcessEvent()
        # 等事件
        if event.signum == signal.SIGSEGV:
            crash_ip = (
                proc.getInstrPointer() - base - 1
            )  # getInstrPointer() always returns instruction + 1
            if crash_ip not in crashes:  # 唯一化保存垃圾  
                crashes[crash_ip] = data
            proc.detach()  # 脱调试，直接 break 出去  
            break
        elif event.signum == signal.SIGTRAP:  # 断点  
            ip = proc.getInstrPointer()
            br = proc.findBreakpoint(ip - 1).desinstall()  # 命中就取消  
            proc.setInstrPointer(ip - 1)  # Rewind back to the correct code
            trace.add(ip - base - 1)
        elif event.signum == signal.SIGINT:
            print("Stoping execution")
            proc.detach()
            break
        elif isinstance(event, debugger.ProcessExit):
            proc.detach()
            break
        else:
            print("Something went wrong -> {}".format(event))

    # Program terminated
    return trace

for sample in mutator:
    save_file(sample)
    trace = execute_fuzz(dbg, sample, bp_map)
    mutator.update_corpus(sample, trace)
    counter += 1

    print(
        "#{:3d} Coverage {:.2f}%\r".format(counter, (len(trace) / len(bp_map)) * 100),
        end="",
    )

import idaapi
import idautils

skip_func = [
    "__libc_csu_init",
    "__libc_csu_fini",
    "_fini",
    "__do_global_dtors_aux",
    "_start",
    "_init",
    "sub_1034",
]

min_ea = idaapi.cvar.inf.min_ea
max_ea = idaapi.cvar.inf.max_ea
bv = idaapi.get_bytes(idaapi.get_fileregion_offset(min_ea), max_ea - min_ea)
base = idaapi.get_segm_by_name(".text").start_ea

for func_ea in idautils.Functions(base, idaapi.get_segm_by_name(".text").end_ea):
    func_name = idaapi.get_func_name(func_ea)
    if func_name in skip_func:
        continue
    func = idaapi.get_func(func_ea)
    if func_name is None or func.flags & idaapi.FUNC_LIB:
        continue
    output = ""
    for bb in idaapi.FlowChart(idaapi.get_func(func_ea)):
        output += "0x{:x} ".format(bb.start_ea - base)
    print(output)

if self.corpus and len(self.pool) < 100:
    # 如果执行过的样本集self.corpus非空，并且变异池self.pool的大小小于100，那么会进行补充  
      self.corpus.sort(reverse = True, key = lambda x: len(x[1]))
      #首先对执行过的样本集进行降序排序，按照观察到的块集合的长度进行比较  
      for _ in range(min(100-len(self.pool), len(self.corpus))):
        # Exponential Distribution
        v = random.random() * random.random() * len(self.corpus)
        # 通过该方式，随机选择一些样本并将其添加到变异池中，这里留个印象，这就是遗传算法的变异策略  

        self.pool.append(self.corpus[int(v)])
        self.corpus.pop(int(v))
        # 添加后，从执行过的样本集中移除这些样本  
      print('Pool size: {:d} [backfill from corpus]'.format(len(self.pool)))
    print('### End of round\t\t')

In [84]: import random
    ...: import matplotlib.pyplot as plt
    ...: data = [random.random() * random.random() for _ in range(100000)]
    ...: plt.hist(data, bins=100, density=True)
    ...: plt.xlabel('Value')
    ...: plt.ylabel('Occurrence probability')
    ...: plt.title('Distribution of random.random() * random.random()')
    ...: plt.show()

import random


def roulette_wheel_selection(population, fitness):
    # 计算适应度总和  
    total_fitness = sum(fitness)

    # 计算每个个体的选择概率  
    probabilities = [fit / total_fitness for fit in fitness]

    # 构建累积概率列表  
    cumulative_probabilities = [
        sum(probabilities[: i + 1]) for i in range(len(probabilities))
    ]

    # 选择一个随机数  
    random_num = random.random()

    # 根据随机数选择一个个体  
    for i, prob in enumerate(cumulative_probabilities):
        if random_num <= prob:
            return population[i]

    # 如果未能选择，则返回最后一个个体  
    return population[-1]


# 示例用法  
population = ["A", "B", "C", "D", "E"]
fitness = [100, 1, 1, 1, 1]

selected_individual = roulette_wheel_selection(population, fitness)
print("Selected individual:", selected_individual)