Skip to content

Commit 8551f09

Browse files
authored
typos (please review)
1 parent ba61b39 commit 8551f09

File tree

1 file changed

+22
-22
lines changed

1 file changed

+22
-22
lines changed

docs/src/design/core_concepts.md

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -10,45 +10,45 @@ TODO add links to trait definitions in docs.rs
1010

1111
An Observer, or Observation Channel, is an entity that provides an information observed during the execution of the program under test to the fuzzer.
1212

13-
The information contained in the Observer is not preserved cross executions.
13+
The information contained in the Observer is not preserved across executions.
1414

15-
As an example, the coverage shared map filled during the execution to report the executed edges used by fuzzers such as AFL and HoggFuzz can be considered an Observation Channel.
16-
This information is not preserved accros runs and it is an observation of a dynamic property of the program.
15+
As an example, the coverage shared map filled during the execution to report the executed edges used by fuzzers such as AFL and HonggFuzz can be considered an Observation Channel.
16+
This information is not preserved across runs and it is an observation of a dynamic property of the program.
1717

1818
## Executor
1919

20-
In different fuzzers, the concept of executing the program under test each run is now always the same.
21-
For instance, for in-memory fuzzers like libFuzzer an execution is a call to an harness function, for hypervisor-based fuzzers like [kAFL](https://github.com/IntelLabs/kAFL) instead an entire operating system is started from a snapshot each run.
20+
In different fuzzers, this concept of executing the program under test means each run is now always the same.
21+
For instance, for in-memory fuzzers like libFuzzer an execution is a call to an harness function, for hypervisor-based fuzzers like [kAFL](https://github.com/IntelLabs/kAFL) instead an entire operating system is started from a snapshot for each run.
2222

2323
In our model, an Executor is the entity that defines not only how to execute the target, but all the volatile operations that are related to just a single run of the target.
2424

25-
So the Executor is for instance reponsible to inform the program about the input that the fuzzer wants to use in the run, writing to a memory location for instance or passing it as a parameter to the harness function.
25+
So the Executor is for instance responsible to inform the program about the input that the fuzzer wants to use in the run, writing to a memory location for instance or passing it as a parameter to the harness function.
2626

27-
It also holds a set of Observers, as thay are related to just a single run of the target.
27+
It also holds a set of Observers, as they are related to just a single run of the target.
2828

2929
## Feedback
3030

31-
The Feedback is an entity that classify the outcome of an execution of the program under test as interesting or not.
32-
Tipically, if an exeuction is interesting, the corresponding input used to feed the target program is added to a corpus.
31+
The Feedback is an entity that classifies the outcome of an execution of the program under test as interesting or not.
32+
Typically, if an execution is interesting, the corresponding input used to feed the target program is added to a corpus.
3333

3434
Most of the times, the notion of Feedback is deeply linked to the Observer, but they are different concepts.
3535

36-
The Feedback, in most of the cases, process the information reported by one or more observer to decide if the execution is interesting.
37-
The concept of "interestingness" is abstract, but tipically it is related to a novelty search (i.e. interesting inputs are those that reach a previosly unseen edge in the control flow graph).
36+
The Feedback, in most of the cases, processes the information reported by one or more observers to decide if the execution is interesting.
37+
The concept of "interestingness" is abstract, but typically it is related to a novelty search (i.e. interesting inputs are those that reach a previously unseen edge in the control flow graph).
3838

39-
As an example, given an Observer that reports all the size of memory allocations, a maximization Feedback can be used to maximize these sizes to sport patological inputs in terms of memory consumption.
39+
As an example, given an Observer that reports all the sizes of memory allocations, a maximization Feedback can be used to maximize these sizes to sport pathological inputs in terms of memory consumption.
4040

4141
## Input
4242

43-
Formally, the input of a program is the data taken from external sources and that affect the program behaviour.
43+
Formally, the input of a program is the data taken from external sources that affect the program behaviour.
4444

45-
In our model of an abstarct fuzzer, we define the Input as the internal representation of the program input (or a part of it).
45+
In our model of an abstract fuzzer, we define the Input as the internal representation of the program input (or a part of it).
4646

47-
In the straightforward case, the input of the program is a byte array and in fuzzers such as AFL we store an manipulate exaclty these byte arrays.
47+
In the straightforward case, the input of the program is a byte array and in fuzzers such as AFL we store and manipulate exactly these byte arrays.
4848

49-
But it is not always the case. A program can expect inputs that are not byte arrays (e.g. a sequence of syscalls) and the fuzzer does not represent the Input in the same way that the program consume it.
49+
But it is not always the case. A program can expect inputs that are not byte arrays (e.g. a sequence of syscalls) and the fuzzer does not represent the Input in the same way that the program consumes it.
5050

51-
In case of a grammar fuzzer for instance, the Input is generally an Abstract Syntax Tree because it is a data structure that can be easily manipulated while maintaining the validity, but the program expects a byte array as input so, just before the execution, the tree is serialized to a sequence of bytes.
51+
In case of a grammar fuzzer for instance, the Input is generally an Abstract Syntax Tree because it is a data structure that can be easily manipulated while maintaining the validity, but the program expects a byte array as input, so just before the execution, the tree is serialized to a sequence of bytes.
5252

5353
## Corpus
5454

@@ -60,27 +60,27 @@ Usually, a testcase is added to the Corpus when it is considered as interesting.
6060

6161
## Mutator
6262

63-
The Mutator is an entitiy that takes one or more Inputs and generates a new derived one.
63+
The Mutator is an entity that takes one or more Inputs and generates a new derived one.
6464

6565
Mutators can be composed and they are generally linked to a specific Input type.
6666

67-
There can be, for instance, a Mutator that applies more than a single type of mutation on the input. Consider a generic Mutator for a byte stream, bit flip is just one of the possible mutations but not the single one, there is also, for instance, the random replacement of a byte of the copy of a chunk.
67+
There can be, for instance, a Mutator that applies more than a single type of mutation on the input. Consider a generic Mutator for a byte stream, bit flip is just one of the possible mutations but not the only one, there is also, for instance, the random replacement of a byte of the copy of a chunk.
6868

6969
This Mutator will simple schedule the application of some other Mutators.
7070

7171
## Generator
7272

7373
A Generator is a component designed to generate an Input from scratch.
7474

75-
Tipically, a random generator is used to generate random inputs.
75+
Typically, a random generator is used to generate random inputs.
7676

7777
Generators are traditionally less used in Feedback-driven Fuzzing, but there are exceptions, like Nautilus, that uses a Grammar generator to create the initial corpus and a sub-tree Generator as a mutation of its grammar Mutator.
7878

7979
## Stage
8080

8181
A Stage is an entity that operates on a single Input got from the Corpus.
8282

83-
For instance, a Mutational Stage, given an input of the corpus, applies a Mutator and executes the generated input one or more time. How many times this has to be done can be scheduled, AFL for instance use a performance score of the input to choose how many times the havoc mutator should be invoked. This can depends also on other parameters, for instance, the length of the input if we want to just apply a sequential bitflip, or be a fixed value.
83+
For instance, a Mutational Stage, given an input of the corpus, applies a Mutator and executes the generated input one or more time. How many times this has to be done can be scheduled, AFL for instance uses a performance score of the input to choose how many times the havoc mutator should be invoked. This can depend also on other parameters, for instance, the length of the input if we want to just apply a sequential bitflip, or be a fixed value.
8484

85-
A stage can be also an analysis stage, for instance, the Colorization stage of Redqueen that aims to introduce more entropy in a testcase or the Trimming stage of AFL that aims to reduce the size of a testcase.
85+
A stage can also be an analysis stage, for instance, the Colorization stage of Redqueen that aims to introduce more entropy in a testcase or the Trimming stage of AFL that aims to reduce the size of a testcase.
8686

0 commit comments

Comments
 (0)