parent
4afae10ece
commit
f4b677d52a
@ -1,14 +1,13 @@
|
||||
[package]
|
||||
name = "nestur"
|
||||
name = "nesfuzz"
|
||||
version = "0.1.0"
|
||||
authors = ["Theron <tspiegl@gmail.com>"]
|
||||
authors = ["sarah@openprivacy.ca"]
|
||||
edition = "2018"
|
||||
|
||||
[dependencies]
|
||||
sdl2 = { version = "0.33", features = ["bundled", "static-link"] }
|
||||
minifb = "0.19.3"
|
||||
serde = { version = "1.0.104", features = ["derive"] }
|
||||
serde_json = "1.0"
|
||||
cpuprofiler = "0.0.3"
|
||||
|
||||
[profile.release]
|
||||
debug = true
|
||||
font8x8 = "0.3.1"
|
||||
priority-queue = "1.2.0"
|
||||
hamming = "0.1.3"
|
||||
|
@ -1,65 +1,54 @@
|
||||
# nestur
|
||||
# nesfuzz
|
||||
|
||||
Nestur is an NES emulator. There are plenty of full-featured emulators out there; this is primarily an educational project but it is usable. There may still be many bugs, but I'm probably not aware of them so please submit issues.
|
||||
- no use of `unsafe`
|
||||
- NTSC timing
|
||||
- supports mappers 0-4 which cover ~85% of [games](http://tuxnes.sourceforge.net/nesmapper.txt)
|
||||
nesfuzz is a fuzzer for Nes Games by [@SarahJamieLewis](https://twitter.com/sarahjamielewis)
|
||||
|
||||
<img src="pics/smb.png" width=250> <img src="pics/zelda_dungeon.png" width=250> <img src="pics/kirby.png" width=250> <img src="pics/dk.png" width=250> <img src="pics/smb3.png" width=250> <img src="pics/excitebike.png" width=250>
|
||||
nessfuzz built on top of the [nestur](https://github.com/spieglt/nestur) emulator by [@spieglt](https://github.com/spieglt).
|
||||
|
||||
The code aims to follow the explanations from the [NES dev wiki](https://wiki.nesdev.com/w/index.php/NES_reference_guide) where possible, especially in the PPU, and the comments quote from it often. Thanks to everyone who contributes to that wiki/forum, and to Michael Fogleman's [NES](https://github.com/fogleman/nes) and Scott Ferguson's [Fergulator](https://github.com/scottferg/Fergulator) for getting me unstuck at several points.
|
||||
## Usage & Methodology
|
||||
|
||||
## Controls
|
||||
```
|
||||
Button | Key
|
||||
___________________
|
||||
| A | D |
|
||||
| B | F |
|
||||
| Start | Enter |
|
||||
| Select | R-Shift|
|
||||
| Up | Up |
|
||||
| Down | Down |
|
||||
| Left | Left |
|
||||
| Right | Right |
|
||||
-------------------
|
||||
To begin fuzzing you will need a rom file, and a sample input file. For sample inputs see [TasVids](http://tasvideos.org/).
|
||||
|
||||
F2: reset console
|
||||
F5: save game state
|
||||
F9: load most recent save state
|
||||
```
|
||||
If the game is called `mygame.nes`, the save state files will be called `mygame-#.dat`. To load any previous save state, drag and drop a `.dat` file onto the window.
|
||||
`nessfuzz <rom> <tas file>`
|
||||
`nessfuzz smb.rom happylee-supermariobros,warped.fm2`
|
||||
|
||||
## Use
|
||||
nesfuzz uses the same input to see novel RAM configurations and search the possible input space. It will also
|
||||
tile 28 (by default), windows to allow you to see the fuzzing happen.
|
||||
|
||||
Double-click or run the executable from a terminal by itself to launch with instructions. Then click Ok and drag a (iNES/`.nes`) ROM file onto the window. Or, drag and drop a ROM file onto the executable to run it directly, or use the path to the ROM file as the first argument to the terminal command.
|
||||

|
||||
|
||||
If the game uses battery-backed RAM (if it can save data when the console is turned off), a save file like `rom_filename.sav` will be created in the same folder as the ROM when the program is exited. When Nestur is run again, it will look for a file matching the ROM name, with a `.sav` extension instead of `.nes`.
|
||||
## Parameters
|
||||
|
||||
## Compilation
|
||||
Found at the top of `main.rs` a few parameters control the types and effectiveness of fuzzing.
|
||||
|
||||
1. Install [Rust](https://www.rust-lang.org/tools/install)
|
||||
2. Have a C compiler
|
||||
- Linux: `sudo apt install build-essential`
|
||||
- Mac: [XCode](https://apps.apple.com/us/app/xcode/id497799835)
|
||||
- Windows: install the [Visual Studio Build Tools](https://visualstudio.microsoft.com/thank-you-downloading-visual-studio/?sku=BuildTools&rel=16) (or [Visual Studio](https://docs.microsoft.com/en-us/cpp/build/vscpp-step-0-installation?view=vs-2019) with the "Desktop development with C++" workload).
|
||||
3. Install CMake
|
||||
- Linux: `sudo apt install cmake`
|
||||
- Mac: install [Homebrew](https://brew.sh/) and run `brew install cmake`
|
||||
- [Windows](https://cmake.org/download/)
|
||||
4. `cd nestur/ && cargo build --release` (be sure to build/run with the release flag or it will run very slowly)
|
||||
5. The `nestur` executable or `nestur.exe` will be in `nestur/target/release`.
|
||||
// The number of cpu instances to spawn..
|
||||
const NUM_THREADS: usize = 28;
|
||||
|
||||
// The number of frames to fuzz and process
|
||||
// A small number exploits the current point more at the expense of
|
||||
// large exploration - and vice versa.
|
||||
const FRAMES_TO_CONSIDER: usize = 400;
|
||||
|
||||
// Same input should generate the same output...
|
||||
// (I make no guarantee of that at the moment)
|
||||
const RNG_SEED: u32 = 0x5463753;
|
||||
|
||||
// If set to a low number, this disables start presses after the given frame
|
||||
// Useful for some games where pausing does nothing to advance the game...
|
||||
const DISABLE_START_PRESSES_AFTER: usize = 50;
|
||||
|
||||
// The rate at which seed inputs become corrupted..
|
||||
const MUTATION_RATE: f64 = 0.1;
|
||||
|
||||
// The rate at which seed inputs may become soft resets..
|
||||
const MUTATION_RATE_SOFT_RESET: f64 = 0.000;
|
||||
|
||||
## To do
|
||||
|
||||
- support other controllers?
|
||||
## Known Issues
|
||||
|
||||
- more mappers?
|
||||
The only game that really works as expected is Super Mario Bros. with the `happylee-supermariobros,warped.fm2` input.
|
||||
This is probably because of issues in the underlying emulator / differences in the expected behaviour of the system the
|
||||
tas inputs are produced for v.s. the emulator.
|
||||
|
||||
- better save file organization?
|
||||
|
||||
## Known problem games
|
||||
|
||||
- None currently, please report any issues
|
||||
|
||||
|
||||
Please also check out [Cloaker](https://github.com/spieglt/cloaker) and [Flying Carpet](https://github.com/spieglt/flyingcarpet)!
|
||||
Other games like Legend of Zelda, Megaman, Super Mario Bros. 3, Final Fantasy II etc. will run, but I have had any
|
||||
tas inputs from them quickly become out of sync with the actual gameplay. Further research is needed to as to why
|
||||
that is. Help appreciated.
|
After Width: | Height: | Size: 79 KiB |