FFS

A file mutator implemented as an in-memory file system.

Mutate on command. Target and ignore regions of the file. Choose new seeds from mutations. Remove uninteresting mutations to keep the directory neat. Do all this using the command line utilities you know and love.

This was an early proof of concept, see full interface below!

Practical

Install

Ubuntu / Debian

Requires Golang.

sudo apt install fuse3 git
git clone [email protected]:tacixat/FuzzyFileSystem
go get bazil.org/fuse
mkdir /mnt/ffs

Docker

Requires Docker.

git clone [email protected]:tacixat/FuzzyFileSystem
cd FuzzyFileSystem
docker build -t ffs/main .
docker run -it --rm --cap-add SYS_ADMIN --device /dev/fuse --name ffs ffs/main

Run

cd FuzzyFileSystem
go run *.go -mp /mnt/ffs

Usage

Usage of ffs:
  ffs -mp /some/mount/point
  -bs uint
        mutate batch size (default 10)
  -mp string
        /mnt/point
  -s int
        rand seed (default 0)

Cleanup

umount /mnt/ffs

Interface

When started your mountpoint will contain a file info. This is to provide information about the invocation of FFS.

/mnt/ffs/
  info

Interfaces take and return JSON.

$ cat /mnt/ffs/info
{"seed":0,"batch_size":10}

Writing a file into /mnt/ffs/ will use that file as a seed. Copying (cp) and redirection (>) both work for adding files.

$ echo "SNAAAAAKES" > /mnt/ffs/snakes

/mnt/ffs/
  info
  snakes/
    0
    mutate
    mask

The file 0 will contain the original contents. Touching mutate will generate a new batchSize set of mutations.

$ touch /mnt/ffs/snakes/mutate
$ for i in $(seq 0 10); do cat /mnt/ffs/snakes/$i; done
SNAAAAAKES
SNAAACAKES
SNAAAAAKDS
SNAAAAAKMS
SNAAAAAKEW
SNAEAAAKES
SN�AAAAKES
SNACAAAKES
SN@AAAAKES
SLAAAAAKES
SNAAAAAKE‼

I like that last one with the weird !! character. Touching that file will set it as the base for future mutations. Additionally, we'll supply a mask to preserve that character and only mutate the others.

$ touch /mnt/ffs/snakes/10
$ echo '{"include":false,"ranges":[{"offset":9, "size":1}]}' > /mnt/ffs/snakes/mask

Include says whether the ranges are inclusive or exclusive. In this case we are saying to exclude starting at offset 9 for 1 byte. The inverse, '{"include":true,"ranges":[{"offset":0, "size":9},{"offset":10,"size":1}]}' would have worked all the same.

$ touch /mnt/ffs/snakes/mutate
$ for i in $(seq 11 20); do cat /mnt/ffs/snakes/$i; done
SNA@AAAKE‼
SNAAQAAKE‼
SNAAAAACE‼
SNEAAAAKE‼
SNAAA@AKE‼
SNAAAAAIE‼
SN�AAAAKE‼
SNA�AAAKE‼
SNAAAAAKM‼
SNAAAAAKE‼→

Oh yea, you can rm test cases that didn't do anything cool.

$ rm /mnt/ffs/snakes/5

Future

• Add types to mask->ranges. This way it could intelligently mutate a format's field.
• Add more mutation strategies, beyond flip a bit.
• Logging for errors. The syscall errors are a little vague.
• Logging for reproducibility. Store all the touchés and masqués.
• De/Serialize. The storage is pretty light, so you should be able to share your sick sets.