pyjfuzz/core/pjf_mutators.py
def random_action(self, b):
        """
        Perform the actual fuzzing using random strategies
        """
        action = random.choice([1, 2, 3, 4, 5, 6, 7, 8, 9, 10])
        if len(b) >= 3:
            pos = random.randint(0, len(b)-2)
            if action == 1:
                rbyte = random.randrange(256)
                rn = random.randrange(len(b))
                b[rn] = "%c" % rbyte
            elif action == 2:
                howmany = random.randint(1, 100)
                curpos = pos
                for _ in range(0, howmany):
                    b.insert(curpos, b[pos])
                    pos += 1
            elif action == 3:
                n = random.choice([1, 2, 4])
                for _ in range(0, n):
                    if len(b) > pos+1:
                        tmp = b[pos]
                        b[pos] = b[pos+1]
                        b[pos+1] = tmp
                        pos += 1
                    else:
                        pos -= 2
                        tmp = b[pos]
                        b[pos] = b[pos+1]
                        b[pos+1] = tmp
                        pos += 1
            elif action in [4, 5]:
                op = {
                    4: lambda x, y: ord(x) << y,
                    5: lambda x, y: ord(x) >> y,
                }
                n = random.choice([1, 2, 4])
                if len(b) < pos+n:
                    pos = len(b) - (pos+n)
                if n == 1:
                    f = "<B"
                    s = op[action](b[pos], n) % 0xff
                elif n == 2:
                    f = "<H"
                    s = op[action](b[pos], n) % 0xffff
                elif n == 4:
                    f = "<I"
                    s = op[action](b[pos], n) % 0xffffff
                val = struct.pack(f, s)
                for v in val:
                    if isinstance(v, int):
                        v = chr(v)
                    b[pos] = v
                    pos += 1
            elif action == 6:
                b.insert(random.randint(0, len(b)-1), random.choice(["\"", "[", "]", "+", "-", "}", "{"]))
            elif action == 7:
                del b[random.randint(0, len(b)-1)]
            elif action in [8, 9]:
                block = random.choice([
                    (r"\"", r"\""),
                    (r"\[", r"\]"),
                    (r"\{", r"\}")
                ])
                b_str = self.safe_join(b)
                block_re = re.compile(str(".+({0}[^{2}{3}]+{1}).+").format(block[0], block[1], block[0], block[1]))
                if block_re.search(b_str):
                    r = random.choice(block_re.findall(b_str))
                    random_re = re.compile("({0})".format(re.escape(r)))
                    if random_re.search(b_str):
                        if action == 8:
                            newarr = list(random_re.sub("", b_str))
                            b[:] = newarr
                        else:
                            newarr = list(random_re.sub("\\1" * random.randint(1, 10), b_str, 1))
                            b[:] = newarr
            elif action == 10:
                b_str = self.safe_join(b)
                limit_choice = random.choice([
                    0x7FFFFFFF,
                    -0x80000000,
                    0xff,
                    -0xff,
                ])
                block_re = re.compile("(\-?[0-9]+)")
                if block_re.search(b_str):
                    block = random.choice([m for m in block_re.finditer(b_str)])
                    new = b_str[0:block.start()] + str(int(block.group())*limit_choice) + b_str[block.start() +
                                                                                                len(block.group()):]
                    b[:] = list(new)
def random_action(self, b):
        """
        Perform the actual fuzzing using random strategies
        """
        action = random.choice([1, 2, 3, 4, 5, 6, 7, 8, 9, 10])
        if len(b) >= 3:
            pos = random.randint(0, len(b)-2)
            if action == 1:
                rbyte = random.randrange(256)
                rn = random.randrange(len(b))
                b[rn] = "%c" % rbyte
            elif action == 2:
                howmany = random.randint(1, 100)
                curpos = pos
                for _ in range(0, howmany):
                    b.insert(curpos, b[pos])
                    pos += 1
            elif action == 3:
                n = random.choice([1, 2, 4])
                for _ in range(0, n):
                    if len(b) > pos+1:
                        tmp = b[pos]
                        b[pos] = b[pos+1]
                        b[pos+1] = tmp
                        pos += 1
                    else:
                        pos -= 2
                        tmp = b[pos]
                        b[pos] = b[pos+1]
                        b[pos+1] = tmp
                        pos += 1
            elif action in [4, 5]:
                op = {
                    4: lambda x, y: ord(x) << y,
                    5: lambda x, y: ord(x) >> y,
                }
                n = random.choice([1, 2, 4])
                if len(b) < pos+n:
                    pos = len(b) - (pos+n)
                if n == 1:
                    f = "<B"
                    s = op[action](b[pos], n) % 0xff
                elif n == 2:
                    f = "<H"
                    s = op[action](b[pos], n) % 0xffff
                elif n == 4:
                    f = "<I"
                    s = op[action](b[pos], n) % 0xffffff
                val = struct.pack(f, s)
                for v in val:
                    if isinstance(v, int):
                        v = chr(v)
                    b[pos] = v
                    pos += 1
            elif action == 6:
                b.insert(random.randint(0, len(b)-1), random.choice(["\"", "[", "]", "+", "-", "}", "{"]))
            elif action == 7:
                del b[random.randint(0, len(b)-1)]
            elif action in [8, 9]:
                block = random.choice([
                    (r"\"", r"\""),
                    (r"\[", r"\]"),
                    (r"\{", r"\}")
                ])
                b_str = self.safe_join(b)
                block_re = re.compile(str(".+({0}[^{2}{3}]+{1}).+").format(block[0], block[1], block[0], block[1]))
                if block_re.search(b_str):
                    r = random.choice(block_re.findall(b_str))
                    random_re = re.compile("({0})".format(re.escape(r)))
                    if random_re.search(b_str):
                        if action == 8:
                            newarr = list(random_re.sub("", b_str))
                            b[:] = newarr
                        else:
                            newarr = list(random_re.sub("\\1" * random.randint(1, 10), b_str, 1))
                            b[:] = newarr
            elif action == 10:
                b_str = self.safe_join(b)
                limit_choice = random.choice([
                    0x7FFFFFFF,
                    -0x80000000,
                    0xff,
                    -0xff,
                ])
                block_re = re.compile("(\-?[0-9]+)")
                if block_re.search(b_str):
                    block = random.choice([m for m in block_re.finditer(b_str)])
                    new = b_str[0:block.start()] + str(int(block.group())*limit_choice) + b_str[block.start() +
                                                                                                len(block.group()):]
                    b[:] = list(new)
Perform the actual fuzzing using random strategies