FPicker/AFL++ to fuzz network application.

[jdefrancesco]

I'm exploring the use of fpicker for a specific application and wonder if anyone else has tried something similar. Initially, I intended to use an AFL-proxy I developed for fuzzing embedded systems. However, my focus shifted after discovering fpicker. I'm working with a Linux licensing server program that communicates over a network socket. My goal is to fuzz this server binary using AFL++/fpicker specifically targeting the network handling function (like the recv() function from a client) and leveraging FRIDA or another Dynamic Binary Instrumentation (DBI) for coverage analysis. This coverage data would then feedback into AFL++'s loop, updating the coverage map as expected.

My key question is: does fpicker support a mode where I can send test cases to the target through a socket connection, as opposed to using Shared Memory (SHM) or other Inter-Process Communication (IPC) mechanisms? This approach seems theoretically feasible, but I'm curious if there are any known limitations or reasons it might not work. I'm eager to test this out and would appreciate any insights or experiences anyone might have in this area.