New-Age JVM Fuzzer

[cretz]

• I've seen javafuzz, jfuzz, and the like
• Take an AFL approach of watching navigated bytecodes (maybe even use a meta-circular JVM instead of OpenJDK)
• Intelligently run many on separate JVM contexts to prevent state sharing

[cretz]

Been thinking about this more. Thinking...

• Use single step in JVMTI via Rust, ref: https://docs.oracle.com/javase/9/docs/specs/jvmti.html#SingleStep
• Not that much of a bug-finding fuzzer, more of a unique-path fuzzer
• Only start when requested. Can be programmatically started or via a build script plugin
• Basic version takes a MethodHandle and an "outputter" that is constantly called with unique parameter combinations, the path they took, and the result they made (including exceptions if necessary). Maybe also conf like parallel execution allowed or not.
• Could add on to that to generate test cases
• The parameters are the things that are fuzzed. This includes parameters necessary to instantiate objects as params or the object the instance method resides in.
• Parameter generator has to build a dag that can tell that some constructors are not circular
• Maybe to make things easy, the Rust stepper just calls right back into Java?
• Oooh, instead of Rust, we could use Kotlin native and be fancy

[cretz]

Some work begun: https://github.com/cretz/javan-warty-pig