ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-13 02:28:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enhancement on Deterministic stage (#1972)

Browse Source 
* fuzzer: init commit based on aflpp 60dc37a8cf

* fuzzers: adding the skip variables and initialize

* log: profile the det/havoc finding

* log: add profile log output

* fuzzers: sperate log/skipdet module

* fuzzers: add quick eff_map calc

* fuzzers: add skip_eff_map in fuzz_one

* fuzzers: mark whole input space in eff_map

* fuzzers: add undet bit threshold to skip some seeds

* fuzzers: fix one byte overflow

* fuzzers: fix overflow

* fix code format

* add havoc only again

* code format

* remove log to INTROSPECTION, rename skipdet module

* rename skipdet module

* remove log to stats

* clean redundant code

* code format

* remove redundant code format check

* remove redundant doc

* remove redundant objects

* clean files

* change -d to default skipdet

* disable deterministic when using CUSTOM_MUTATOR

* revert fix
This commit is contained in:
Han Zheng
2024-02-01 15:13:21 +01:00
committed by GitHub
parent 37d2039211
commit 06f0982f0f
10 changed files with 682 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
include/afl-fuzz.h
View File

@ -149,6 +149,48 @@ struct tainted {
};
struct inf_profile {
u32 inf_skipped_bytes; /* Inference Stage Profiling */
u64 inf_execs_cost, inf_time_cost;
};
/* ToDo: add cmplog profile as well */
struct havoc_profile {
u32 queued_det_stage, /* Det/Havoc Stage Profiling */
queued_havoc_stage, total_queued_det, edge_det_stage, edge_havoc_stage,
total_det_edge;
u64 det_stage_time, havoc_stage_time, total_det_time;
};
struct skipdet_entry {
u8 continue_inf, done_eff;
u32 undet_bits, quick_eff_bytes;
u8 *skip_eff_map, /* we'v finish the eff_map */
*done_inf_map; /* some bytes are not done yet */
};
struct skipdet_global {
u8 use_skip_havoc;
u32 undet_bits_threshold;
u64 last_cov_undet;
u8 *virgin_det_bits; /* global fuzzed bits */
struct inf_profile *inf_prof;
};
struct queue_entry {
u8 *fname; /* File name for the test case */
@ -203,6 +245,8 @@ struct queue_entry {
struct queue_entry *mother; /* queue entry this based on */
struct skipdet_entry *skipdet_e;
};
struct extra_data {
@ -247,6 +291,8 @@ enum {
/* 19 */ STAGE_CUSTOM_MUTATOR,
/* 20 */ STAGE_COLORIZATION,
/* 21 */ STAGE_ITS,
/* 22 */ STAGE_INF,
/* 23 */ STAGE_QUICK,
STAGE_NUM_MAX
@ -782,6 +828,11 @@ typedef struct afl_state {
* is too large) */
struct queue_entry **q_testcase_cache;
/* Global Profile Data for deterministic/havoc-splice stage */
struct havoc_profile *havoc_prof;
struct skipdet_global *skipdet_g;
#ifdef INTROSPECTION
char mutation[8072];
char m_tmp[4096];
@ -1232,6 +1283,13 @@ AFL_RAND_RETURN rand_next(afl_state_t *afl);
/* probability between 0.0 and 1.0 */
double rand_next_percent(afl_state_t *afl);
/* SkipDet Functions */
u8 skip_deterministic_stage(afl_state_t *, u8 *, u8 *, u32, u64);
u8 is_det_timeout(u64, u8);
void plot_profile_data(afl_state_t *, struct queue_entry *);
/**** Inline routines ****/
/* Generate a random number (from 0 to limit - 1). This may