package fuzzilli.protobuf

repeated uint32 inouts = 1
The operation is either encoded as an index, referring to the nth operation (so that shared operations are also only present once in the protobuf), or as one of the many concrete Operation messages.
oneof operation
- uint32 opIdx = 2
- LoadInteger loadInteger = 5
  TODO fixup keys
- LoadBigInt loadBigInt = 76
- LoadFloat loadFloat = 6
- LoadString loadString = 7
- LoadBoolean loadBoolean = 8
- LoadUndefined loadUndefined = 9
- LoadNull loadNull = 10
- LoadThis loadThis = 65
- LoadArguments loadArguments = 66
- LoadRegExp loadRegExp = 77
- CreateObject createObject = 11
- CreateArray createArray = 12
- CreateTemplateString createTemplateString = 102
- CreateObjectWithSpread createObjectWithSpread = 13
- CreateArrayWithSpread createArrayWithSpread = 14
- LoadBuiltin loadBuiltin = 15
- LoadProperty loadProperty = 16
- StoreProperty storeProperty = 17
- StorePropertyWithBinop storePropertyWithBinop = 112
- DeleteProperty deleteProperty = 18
- LoadElement loadElement = 19
- StoreElement storeElement = 20
- StoreElementWithBinop storeElementWithBinop = 113
- DeleteElement deleteElement = 21
- LoadComputedProperty loadComputedProperty = 22
- StoreComputedProperty storeComputedProperty = 23
- StoreComputedPropertyWithBinop storeComputedPropertyWithBinop = 114
- DeleteComputedProperty deleteComputedProperty = 24
- TypeOf typeOf = 25
- InstanceOf instanceOf = 26
- In in = 27
- BeginPlainFunctionDefinition beginPlainFunctionDefinition = 28
- EndPlainFunctionDefinition endPlainFunctionDefinition = 30
- BeginArrowFunctionDefinition beginArrowFunctionDefinition = 67
- EndArrowFunctionDefinition endArrowFunctionDefinition = 68
- BeginGeneratorFunctionDefinition beginGeneratorFunctionDefinition = 69
- EndGeneratorFunctionDefinition endGeneratorFunctionDefinition = 70
- BeginAsyncFunctionDefinition beginAsyncFunctionDefinition = 71
- EndAsyncFunctionDefinition endAsyncFunctionDefinition = 72
- BeginAsyncArrowFunctionDefinition beginAsyncArrowFunctionDefinition = 79
- EndAsyncArrowFunctionDefinition endAsyncArrowFunctionDefinition = 80
- BeginAsyncGeneratorFunctionDefinition beginAsyncGeneratorFunctionDefinition = 85
- EndAsyncGeneratorFunctionDefinition endAsyncGeneratorFunctionDefinition = 86
- Return return = 29
- Yield yield = 73
- YieldEach yieldEach = 74
- Await await = 75
- CallMethod callMethod = 31
- CallComputedMethod callComputedMethod = 34
- CallFunction callFunction = 32
- Construct construct = 33
- UnaryOperation unaryOperation = 35
- BinaryOperation binaryOperation = 36
- ReassignWithBinop reassignWithBinop = 95
- Dup dup = 37
- Reassign reassign = 38
- DestructArray destructArray = 116
- DestructArrayAndReassign destructArrayAndReassign = 117
- DestructObject destructObject = 118
- DestructObjectAndReassign destructObjectAndReassign = 119
- Compare compare = 39
- ConditionalOperation conditionalOperation = 96
- Eval eval = 40
- BeginClassDefinition beginClassDefinition = 87
- BeginMethodDefinition beginMethodDefinition = 88
- EndClassDefinition endClassDefinition = 89
- CallSuperConstructor callSuperConstructor = 90
- CallSuperMethod callSuperMethod = 91
- LoadSuperProperty loadSuperProperty = 92
- StoreSuperProperty storeSuperProperty = 93
- StoreSuperPropertyWithBinop storeSuperPropertyWithBinop = 115
- BeginWith beginWith = 41
- EndWith endWith = 42
- LoadFromScope loadFromScope = 43
- StoreToScope storeToScope = 44
- BeginIf beginIf = 45
- BeginElse beginElse = 46
- EndIf endIf = 47
- BeginSwitch beginSwitch = 97
- BeginSwitchCase beginSwitchCase = 98
- SwitchBreak switchBreak = 104
- EndSwitch endSwitch = 99
- BeginWhile beginWhile = 48
- EndWhile endWhile = 49
- BeginDoWhile beginDoWhile = 50
- EndDoWhile endDoWhile = 51
- BeginFor beginFor = 52
- EndFor endFor = 53
- BeginForIn beginForIn = 54
- EndForIn endForIn = 55
- BeginForOf beginForOf = 56
- BeginForOfWithDestruct beginForOfWithDestruct = 103
- EndForOf endForOf = 57
- LoopBreak loopBreak = 58
- Continue continue = 59
- BeginTry beginTry = 60
- BeginCatch beginCatch = 61
- BeginFinally beginFinally = 94
- EndTryCatch endTryCatch = 62
- ThrowException throwException = 63
- BeginCodeString beginCodeString = 81
- EndCodeString endCodeString = 82
- BeginBlockStatement beginBlockStatement = 83
- EndBlockStatement endBlockStatement = 84
- Nop nop = 64

Used in: Instruction

(message has no fields)

Used in: Instruction

int64 value = 1

Used in: Instruction

bool value = 1

Used in: Instruction

string builtinName = 1

Used in: Instruction

(message has no fields)

Used in: Instruction

int64 index = 1

Used in: Instruction

double value = 1

Used in: Instruction

string id = 1

Used in: Instruction

int64 value = 1

Used in: Instruction

(message has no fields)

Used in: Instruction

string propertyName = 1

Used in: Instruction

string value = 1
uint32 flags = 2

Used in: Instruction

string value = 1

Used in: Instruction

string propertyName = 1

Used in: Instruction

(message has no fields)

Used in: Instruction

(message has no fields)

message LogMessage

sync.proto:25

string origin = 1
UUID of the original instance
uint32 level = 2
string label = 3
string content = 4

Used in: Instruction

(message has no fields)

Used in: Instruction

(message has no fields)

Used in: Parameter

optional Type inputType = 2

Used in: BeginClassDefinition, FunctionSignature

oneof param
- PlainParameter plainParameter = 1
- OptionalParameter optionalParameter = 2
- RestParameter restParameter = 3

Used in: Parameter

optional Type inputType = 1

Encoding for instructions and types must deterministic, i.e. happen in the same order every time. Our operation and type extension caches rely on that.

bytes uuid = 1
repeated Instruction code = 2
repeated TypeInfo types = 3
TypeCollectionStatus typeCollectionStatus = 4
map<sint32, string> comments = 5
optional Program parent = 6

Used in: Instruction

(message has no fields)

Used in: Instruction

BinaryOperator op = 1

Used in: Parameter

optional Type inputType = 2

Used in: Instruction

(message has no fields)

uint64 totalSamples = 1
/ The total number of samples produced.
uint64 validSamples = 2
/ The number of valid samples produced.
uint64 interestingSamples = 3
/ The number of intersting samples produced.
uint64 timedOutSamples = 4
/ The number of timed-out samples produced.
uint64 crashingSamples = 5
/ The number of crashes found.
uint64 totalExecs = 6
/ The total number of program executions.
double avgProgramSize = 7
/ The average size of produced programs over the last 1000 programs.
double execsPerSecond = 8
/ The current executions per second.
double fuzzerOverhead = 9
/ The average (over the last 1000 executions) fraction of the total time that is not spent executing programs in the target engine.
uint64 numWorkers = 10
/ The number of workers connected directly or indirectly to this instance.
double coverage = 11
/ The percentage of edges covered if doing coverage-guided fuzzing.
uint64 interestingSamplesWithTypes = 12
/ Number of interesting samples with runtime types information
uint64 typeCollectionTimeouts = 13
/ Number of timeouts in runtime type collections runs
uint64 typeCollectionFailures = 14
/ Number of failures in runtime type collections runs
uint64 typeCollectionAttempts = 15
/ Number of runtime type collections runs

Used in: Instruction

(message has no fields)

Used in: Instruction

BinaryOperator op = 1

Used in: Instruction

int64 index = 1

Used in: Instruction

int64 index = 1
BinaryOperator op = 2

Used in: Instruction

string propertyName = 1

Used in: Instruction

string propertyName = 1
BinaryOperator op = 2

Used in: Instruction

string propertyName = 1

Used in: Instruction

string propertyName = 1
BinaryOperator op = 2

Used in: Instruction

string id = 1

Used in: Instruction

(message has no fields)

Used in: Instruction

(message has no fields)

Used in: FunctionSignature, OptionalParameter, PlainParameter, RestParameter, TypeInfo

uint32 definiteType = 1
uint32 possibleType = 2
oneof ext
The extension can be encoded as an index, referring to the nth TypeExtension in the whole message. That way, it becomes possible to encode duplicate extensions only once.
- uint32 extensionIdx = 3
- TypeExtension extension = 4

Keep in sync with TypeCollectionStatus.swift

Used in: Program

SUCCESS = 0
ERROR = 1
TIMEOUT = 2
NOTATTEMPTED = 3

Used in: Type

repeated string properties = 1
repeated string methods = 2
string group = 3
optional FunctionSignature signature = 4

We store type information simply as list of these TypeInfo messages instead of having separate lists per variable. This is simpler to en- and decode but is a bit less efficient if many variables change their type frequently.

Used in: Program

uint32 variable = 1
uint32 index = 2
optional Type type = 3
TypeQuality quality = 4

Used in: Instruction

(message has no fields)

Keep in sync with ProgramTypes.swift

Used in: TypeInfo

INFERRED = 0
RUNTIME = 1

Used in: Instruction

UnaryOperator op = 1

Used in: UnaryOperation

PRE_INC = 0
PRE_DEC = 1
POST_INC = 2
POST_DEC = 3
LOGICAL_NOT = 4
BITWISE_NOT = 5
PLUS = 6
MINUS = 7

Used in: Instruction

(message has no fields)

Used in: Instruction

(message has no fields)

package fuzzilli.protobuf

message Await

message BeginArrowFunctionDefinition

optional FunctionSignature signature = 1

bool isStrict = 2

message BeginAsyncArrowFunctionDefinition

optional FunctionSignature signature = 1

bool isStrict = 2

message BeginAsyncFunctionDefinition

optional FunctionSignature signature = 1

bool isStrict = 2

message BeginAsyncGeneratorFunctionDefinition

optional FunctionSignature signature = 1

bool isStrict = 2

message BeginBlockStatement

message BeginCatch

message BeginClassDefinition

bool hasSuperclass = 1

repeated Parameter constructorParameters = 2

repeated string instanceProperties = 3

repeated string instanceMethodNames = 4

repeated FunctionSignature instanceMethodSignatures = 5

message BeginCodeString

message BeginDoWhile

Comparator comparator = 1

message BeginElse

message BeginFinally

message BeginFor

Comparator comparator = 1

BinaryOperator op = 2

message BeginForIn

message BeginForOf

message BeginForOfWithDestruct

repeated int32 indices = 1

bool hasRestElement = 2

message BeginGeneratorFunctionDefinition

optional FunctionSignature signature = 1

bool isStrict = 2

message BeginIf

message BeginMethodDefinition

uint32 numParameters = 1

message BeginPlainFunctionDefinition

optional FunctionSignature signature = 1

bool isStrict = 2

message BeginSwitch

message BeginSwitchCase

bool previousCaseFallsThrough = 1

message BeginTry

message BeginWhile

Comparator comparator = 1

message BeginWith

message BinaryOperation

BinaryOperator op = 1

enum BinaryOperator

ADD = 0

SUB = 1

MUL = 2

DIV = 3

MOD = 4

BIT_AND = 5

BIT_OR = 6

LOGICAL_AND = 7

LOGICAL_OR = 8

XOR = 9

LSHIFT = 10

RSHIFT = 11

EXP = 12

UNRSHIFT = 13

message CallComputedMethod

repeated bool spreads = 1

message CallFunction

repeated bool spreads = 1

message CallMethod

string methodName = 1

repeated bool spreads = 2

message CallSuperConstructor

repeated bool spreads = 1

message CallSuperMethod

string methodName = 1

enum Comparator