forked from Hearmen/ASTFuzz
-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathmutator.js
98 lines (87 loc) · 3.11 KB
/
mutator.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
function Mutate(){
var raw=rf.readFileSync("page.js","utf-8");
var ast = esprima.parse(raw);
var scopeManager = escope.analyze(ast,{ecmaVersion:7,directive:true});
var pathManager = espath.analyze(ast,scopeManager,{ecmaVersion:7});
var mutateSize = 0;
rf.writeFileSync('page.json',dump(ast));
estraverse.replace(ast, {
enter: function(node, parent) {
},
leave: function(node, parent) {
if(/BinaryExpression/.test(node.type) && node.left.value == 0x10ad){
mutateSize = 20;
}
}
});
// deadloop eliminate
estraverse.replace(ast, {
enter: function(node, parent) {
},
leave: function(node, parent) {
if(/ForStatement/.test(node.type) || /WhileStatement/.test(node.type) || /DoWhileStatement/.test(node.type)){
var loop = node;
var _node = {"type":"BlockStatement", "body":[]};
var guard_p = {
"type": "VariableDeclaration",
"declarations": [
{
"type": "VariableDeclarator",
"id": {
"type": "Identifier",
"name": "interestContol"
},
"init": {
"type": "Literal",
"value": 0,
"raw": "0"
}
}
],
"kind": "var"
}
var guard_n = {
"type": "IfStatement",
"test": {
"type": "BinaryExpression",
"operator": "<",
"left": {
"type": "UpdateExpression",
"operator": "++",
"argument": {
"type": "Identifier",
"name": "interestContol"
},
"prefix": false
},
"right": {
"type": "Literal",
"value": 10000,
"raw": "1000"
}
},
"consequent": {
"type": "BreakStatement",
"label": null
},
"alternate": null
}
let _body = loop.body;
if(/BlockStatement/.test(_body.type)){
}else{
let body = {"type":"BlockStatement", "body":[]};;
body.body.push(_body);
loop.body = body;
}
loop.body.body.push(guard_n);
_node.body.push(guard_p);
_node.body.push(loop);
return _node;
}
}
});
rf.writeFileSync('page.json',dump(ast));
var page = escodegen.generate(ast);
// console.log(page);
rf.writeFileSync('r.js',page);
}