1# Fuzzer for android.hardware.automotive.vehicle@2.0-manager-lib
2
3## Plugin Design Considerations
4The fuzzer plugin for android.hardware.automotive.vehicle@2.0-manager-lib is
5designed based on the understanding of the library and tries to achieve the following:
6
7##### Maximize code coverage
8The configuration parameters are not hardcoded, but instead selected based on
9incoming data. This ensures more code paths are reached by the fuzzer.
10
11Vehicle Manager supports the following parameters:
121. Vehicle Property (parameter name: `vehicleProp`)
132. Diagnostic Integer Sensor Index (parameter name: `diagnosticIntIndex`)
143. Diagnostic Float Sensor Index (parameter name: `diagnosticFloatIndex`)
154. Availability Message Type (parameter name: `availabilityMsgType`)
165. Subscription Message Type (parameter name: `subscriptionMsgType`)
17
18| Parameter| Valid Values| Configured Value|
19|------------- |-------------| ----- |
20| `vehicleProp` | 0.`VehicleProperty::INVALID` 1.`VehicleProperty::HVAC_FAN_SPEED` 2.`VehicleProperty::INFO_MAKE` 3.`VehicleProperty::DISPLAY_BRIGHTNESS`  4.`VehicleProperty::INFO_FUEL_CAPACITY` 5.`VehicleProperty::HVAC_SEAT_TEMPERATURE`| Value obtained from FuzzedDataProvider |
21| `diagnosticIntIndex`   | 0.`DiagnosticIntegerSensorIndex::FUEL_SYSTEM_STATUS` 1.`DiagnosticIntegerSensorIndex::MALFUNCTION_INDICATOR_LIGHT_ON` 2.`DiagnosticIntegerSensorIndex::NUM_OXYGEN_SENSORS_PRESENT` 3.`DiagnosticIntegerSensorIndex::FUEL_TYPE`  | Value obtained from FuzzedDataProvider |
22| `diagnosticFloatIndex`   | 0.`DiagnosticFloatSensorIndex::CALCULATED_ENGINE_LOAD` 1.`DiagnosticFloatSensorIndex::SHORT_TERM_FUEL_TRIM_BANK1` 2.`DiagnosticFloatSensorIndex::LONG_TERM_FUEL_TRIM_BANK1` 3.`DiagnosticFloatSensorIndex::THROTTLE_POSITION`  | Value obtained from FuzzedDataProvider |
23| `availabilityMsgType`   | 0.`VmsMessageType::AVAILABILITY_CHANGE` 1.`VmsMessageType::AVAILABILITY_RESPONSE` | Value obtained from FuzzedDataProvider |
24| `subscriptionMsgType`   | 0.`VmsMessageType::SUBSCRIPTIONS_CHANGE` 1.`VmsMessageType::SUBSCRIPTIONS_RESPONSE` | Value obtained from FuzzedDataProvider |
25
26This also ensures that the plugin is always deterministic for any given input.
27
28## Build
29
30This describes steps to build vehicleManager_fuzzer binary.
31
32### Android
33
34#### Steps to build
35Build the fuzzer
36```
37  $ mm -j$(nproc) vehicleManager_fuzzer
38```
39
40#### Steps to run
41Create a directory CORPUS_DIR
42```
43  $ adb shell mkdir /data/local/tmp/CORPUS_DIR
44```
45
46##### Some Additional steps needed to run the vehicleManager_fuzzer successfully on device
47
481. Push the following libraries from /vendor/lib/ and /vendor/lib64/ folders of your workspace to the device's /vendor/lib/ and /vendor/lib64/ :
49```
501.1  android.hardware.automotive.vehicle@2.0.so
511.2  carwatchdog_aidl_interface-V2-ndk_platform.so
52```
532. Now, reboot the device using command
54```
55  $ adb reboot
56```
57
58##### To run the fuzzer on device
59```
60  $ adb sync data
61  $ adb shell LD_LIBRARY_PATH=/vendor/lib64 /data/fuzz/${TARGET_ARCH}/vehicleManager_fuzzer/vendor/vehicleManager_fuzzer /data/local/tmp/CORPUS_DIR
62```
63
64## References:
65 * http://llvm.org/docs/LibFuzzer.html
66 * https://github.com/google/oss-fuzz
67