mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-18 20:48:07 +00:00
add symqemu custom mutator
This commit is contained in:
vanhauser-thc
446
custom_mutators/symqemu/symqemu.c
Normal file
446
custom_mutators/symqemu/symqemu.c
Normal file
@ -0,0 +1,446 @@
|
||||
#define _GNU_SOURCE
|
||||
#include <stdio.h>
|
||||
#include <stdint.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include <fcntl.h>
|
||||
#include <ctype.h>
|
||||
#include "config.h"
|
||||
#include "debug.h"
|
||||
#include "afl-fuzz.h"
|
||||
#include "common.h"
|
||||
|
||||
afl_state_t *afl_struct;
|
||||
static u32 debug = 0;
|
||||
|
||||
#define DBG(x...) \
|
||||
if (debug) { fprintf(stderr, x); }
|
||||
|
||||
typedef struct my_mutator {
|
||||
|
||||
afl_state_t *afl;
|
||||
u8 *mutator_buf;
|
||||
u8 *out_dir;
|
||||
u8 *queue_dir;
|
||||
u8 *target;
|
||||
u8 *symqemu;
|
||||
u8 *input_file;
|
||||
u32 counter;
|
||||
u32 seed;
|
||||
u32 argc;
|
||||
u8 **argv;
|
||||
|
||||
} my_mutator_t;
|
||||
|
||||
my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
|
||||
|
||||
if (getenv("AFL_DEBUG")) debug = 1;
|
||||
|
||||
my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
|
||||
if (!data) {
|
||||
|
||||
perror("afl_custom_init alloc");
|
||||
return NULL;
|
||||
|
||||
}
|
||||
|
||||
char *path = getenv("PATH");
|
||||
char *exec_name = "symqemu-x86_64";
|
||||
char *token = strtok(path, ":");
|
||||
char exec_path[4096];
|
||||
|
||||
while (token != NULL && data->symqemu == NULL) {
|
||||
|
||||
snprintf(exec_path, sizeof(exec_path), "%s/%s", token, exec_name);
|
||||
if (access(exec_path, X_OK) == 0) {
|
||||
|
||||
data->symqemu = (u8 *)strdup(exec_path);
|
||||
break;
|
||||
|
||||
}
|
||||
|
||||
token = strtok(NULL, ":");
|
||||
|
||||
}
|
||||
|
||||
if (!data->symqemu) FATAL("symqemu binary %s not found", exec_name);
|
||||
DBG("Found %s\n", data->symqemu);
|
||||
|
||||
if (getenv("AFL_CUSTOM_MUTATOR_ONLY"))
|
||||
FATAL("the symqemu module cannot be used with AFL_CUSTOM_MUTATOR_ONLY.");
|
||||
|
||||
if ((data->mutator_buf = malloc(MAX_FILE)) == NULL) {
|
||||
|
||||
free(data);
|
||||
perror("mutator_buf alloc");
|
||||
return NULL;
|
||||
|
||||
}
|
||||
|
||||
data->target = getenv("AFL_CUSTOM_INFO_PROGRAM");
|
||||
|
||||
u8 *path_tmp = getenv("AFL_CUSTOM_INFO_OUT");
|
||||
u32 len = strlen(path_tmp) + 32;
|
||||
u8 *symqemu_path = malloc(len);
|
||||
data->out_dir = malloc(len);
|
||||
data->queue_dir = malloc(len);
|
||||
snprintf(symqemu_path, len, "%s/../symqemu", path_tmp);
|
||||
snprintf(data->out_dir, len, "%s/../symqemu/out", path_tmp);
|
||||
snprintf(data->queue_dir, len, "%s/../symqemu/queue", path_tmp);
|
||||
|
||||
mkdir(symqemu_path, 0755);
|
||||
mkdir(data->out_dir, 0755);
|
||||
mkdir(data->queue_dir, 0755);
|
||||
|
||||
setenv("SYMCC_OUTPUT_DIR", data->out_dir, 1);
|
||||
|
||||
data->input_file = getenv("AFL_CUSTOM_INFO_PROGRAM_INPUT");
|
||||
|
||||
u8 *tmp = NULL;
|
||||
if ((tmp = getenv("AFL_CUSTOM_INFO_PROGRAM_ARGV")) && *tmp) {
|
||||
|
||||
int argc = 0, index = 2;
|
||||
for (u32 i = 0; i < strlen(tmp); ++i)
|
||||
if (isspace(tmp[i])) ++argc;
|
||||
|
||||
data->argv = (u8 **)malloc((argc + 4) * sizeof(u8 **));
|
||||
u8 *p = strdup(tmp);
|
||||
|
||||
do {
|
||||
|
||||
data->argv[index] = p;
|
||||
while (*p && !isspace(*p))
|
||||
++p;
|
||||
if (*p) {
|
||||
|
||||
*p++ = 0;
|
||||
while (isspace(*p))
|
||||
++p;
|
||||
|
||||
}
|
||||
|
||||
if (strcmp(data->argv[index], "@@") == 0) {
|
||||
|
||||
if (!data->input_file) {
|
||||
|
||||
u32 ilen = strlen(symqemu_path) + 32;
|
||||
data->input_file = malloc(ilen);
|
||||
snprintf(data->input_file, ilen, "%s/.input", symqemu_path);
|
||||
|
||||
}
|
||||
|
||||
data->argv[index] = data->input_file;
|
||||
|
||||
}
|
||||
|
||||
DBG("%d: %s\n", index, data->argv[index]);
|
||||
index++;
|
||||
|
||||
} while (*p);
|
||||
|
||||
data->argv[index] = NULL;
|
||||
data->argc = index;
|
||||
|
||||
} else {
|
||||
|
||||
data->argv = (u8 **)malloc(8 * sizeof(u8 **));
|
||||
data->argc = 2;
|
||||
data->argv[2] = NULL;
|
||||
|
||||
}
|
||||
|
||||
data->argv[0] = data->symqemu;
|
||||
data->argv[1] = data->target;
|
||||
|
||||
DBG("out_dir=%s, queue_dir=%s, target=%s, input_file=%s, argc=%u\n",
|
||||
data->out_dir, data->queue_dir, data->target,
|
||||
data->input_file ? (char *)data->input_file : (char *)"<stdin>",
|
||||
data->argc);
|
||||
|
||||
if (data->input_file) { setenv("SYMCC_INPUT_FILE", data->input_file, 1); }
|
||||
|
||||
data->afl = afl;
|
||||
data->seed = seed;
|
||||
afl_struct = afl;
|
||||
|
||||
if (debug) {
|
||||
|
||||
fprintf(stderr, "[");
|
||||
for (u32 i = 0; i <= data->argc; ++i)
|
||||
fprintf(stderr, " \"%s\"",
|
||||
data->argv[i] ? (char *)data->argv[i] : "<NULL>");
|
||||
fprintf(stderr, " ]\n");
|
||||
|
||||
}
|
||||
|
||||
OKF("Custom mutator symqemu loaded - note that the initial startup of "
|
||||
"afl-fuzz will be delayed the more starting seeds are present. This is "
|
||||
"fine, do not worry!");
|
||||
|
||||
return data;
|
||||
|
||||
}
|
||||
|
||||
/* When a new queue entry is added we run this input with the symqemu
|
||||
instrumented binary */
|
||||
uint8_t afl_custom_queue_new_entry(my_mutator_t *data,
|
||||
const uint8_t *filename_new_queue,
|
||||
const uint8_t *filename_orig_queue) {
|
||||
|
||||
int pipefd[2];
|
||||
struct stat st;
|
||||
if (data->afl->afl_env.afl_no_ui)
|
||||
ACTF("Sending to symqemu: %s", filename_new_queue);
|
||||
u8 *fn = alloc_printf("%s", filename_new_queue);
|
||||
if (!(stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size)) {
|
||||
|
||||
ck_free(fn);
|
||||
PFATAL("Couldn't find enqueued file: %s", fn);
|
||||
|
||||
}
|
||||
|
||||
if (afl_struct->fsrv.use_stdin) {
|
||||
|
||||
if (pipe(pipefd) == -1) {
|
||||
|
||||
ck_free(fn);
|
||||
PFATAL(
|
||||
"Couldn't create a pipe for interacting with symqemu child process");
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
int fd = open(fn, O_RDONLY);
|
||||
if (fd < 0) return 0;
|
||||
ssize_t r = read(fd, data->mutator_buf, MAX_FILE);
|
||||
DBG("fn=%s, fd=%d, size=%ld\n", fn, fd, r);
|
||||
ck_free(fn);
|
||||
close(fd);
|
||||
|
||||
if (data->input_file) {
|
||||
|
||||
fd = open(data->input_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
|
||||
ssize_t s = write(fd, data->mutator_buf, r);
|
||||
close(fd);
|
||||
DBG("wrote %zd/%zd to %s\n", s, r, data->input_file);
|
||||
|
||||
}
|
||||
|
||||
int pid = fork();
|
||||
|
||||
if (pid == -1) return 0;
|
||||
|
||||
if (pid) {
|
||||
|
||||
if (!data->input_file || afl_struct->fsrv.use_stdin) {
|
||||
|
||||
close(pipefd[0]);
|
||||
|
||||
if (fd >= 0) {
|
||||
|
||||
if (r <= 0) {
|
||||
|
||||
close(pipefd[1]);
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
if (r > fcntl(pipefd[1], F_GETPIPE_SZ))
|
||||
fcntl(pipefd[1], F_SETPIPE_SZ, MAX_FILE);
|
||||
ck_write(pipefd[1], data->mutator_buf, r, filename_new_queue);
|
||||
|
||||
} else {
|
||||
|
||||
ck_free(fn);
|
||||
close(pipefd[1]);
|
||||
PFATAL(
|
||||
"Something happened to the enqueued file before sending its "
|
||||
"contents to symqemu binary");
|
||||
|
||||
}
|
||||
|
||||
close(pipefd[1]);
|
||||
|
||||
}
|
||||
|
||||
pid = waitpid(pid, NULL, 0);
|
||||
DBG("symqemu finished executing!\n");
|
||||
|
||||
// At this point we need to transfer files to output dir, since their names
|
||||
// collide and symqemu will just overwrite them
|
||||
|
||||
struct dirent **nl;
|
||||
int32_t items = scandir(data->out_dir, &nl, NULL, NULL);
|
||||
u8 *origin_name = basename(filename_new_queue);
|
||||
u8 source_name[4096], destination_name[4096];
|
||||
int32_t i;
|
||||
|
||||
if (items > 0) {
|
||||
|
||||
for (i = 0; i < (u32)items; ++i) {
|
||||
|
||||
// symqemu output files start with a digit
|
||||
if (!isdigit(nl[i]->d_name[0])) continue;
|
||||
|
||||
struct stat st;
|
||||
snprintf(source_name, sizeof(source_name), "%s/%s", data->out_dir,
|
||||
nl[i]->d_name);
|
||||
DBG("file=%s\n", source_name);
|
||||
|
||||
if (stat(source_name, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
|
||||
|
||||
snprintf(destination_name, sizeof(destination_name), "%s/id:%06u,%s",
|
||||
data->queue_dir, data->counter++, nl[i]->d_name);
|
||||
DBG("src=%s dst=%s\n", source_name, destination_name);
|
||||
rename(source_name, destination_name);
|
||||
|
||||
}
|
||||
|
||||
free(nl[i]);
|
||||
|
||||
}
|
||||
|
||||
free(nl);
|
||||
|
||||
}
|
||||
|
||||
DBG("Done!\n");
|
||||
|
||||
} else /* (pid == 0) */ { // child
|
||||
|
||||
if (afl_struct->fsrv.use_stdin) {
|
||||
|
||||
close(pipefd[1]);
|
||||
dup2(pipefd[0], 0);
|
||||
|
||||
}
|
||||
|
||||
DBG("exec=%s\n", data->target);
|
||||
if (!debug) {
|
||||
|
||||
close(1);
|
||||
close(2);
|
||||
dup2(afl_struct->fsrv.dev_null_fd, 1);
|
||||
dup2(afl_struct->fsrv.dev_null_fd, 2);
|
||||
|
||||
}
|
||||
|
||||
execvp((char *)data->argv[0], (char **)data->argv);
|
||||
fprintf(stderr, "Executing: [");
|
||||
for (u32 i = 0; i <= data->argc; ++i)
|
||||
fprintf(stderr, " \"%s\"",
|
||||
data->argv[i] ? (char *)data->argv[i] : "<NULL>");
|
||||
fprintf(stderr, " ]\n");
|
||||
FATAL("Failed to execute %s %s\n", data->argv[0], data->argv[1]);
|
||||
exit(-1);
|
||||
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
/*
|
||||
uint32_t afl_custom_fuzz_count(my_mutator_t *data, const u8 *buf,
|
||||
size_t buf_size) {
|
||||
|
||||
uint32_t count = 0, i;
|
||||
struct dirent **nl;
|
||||
int32_t items = scandir(data->out_dir, &nl, NULL, NULL);
|
||||
|
||||
if (items > 0) {
|
||||
|
||||
for (i = 0; i < (u32)items; ++i) {
|
||||
|
||||
struct stat st;
|
||||
u8 * fn = alloc_printf("%s/%s", data->out_dir, nl[i]->d_name);
|
||||
DBG("test=%s\n", fn);
|
||||
if (stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
|
||||
|
||||
DBG("found=%s\n", fn);
|
||||
count++;
|
||||
|
||||
}
|
||||
|
||||
ck_free(fn);
|
||||
free(nl[i]);
|
||||
|
||||
}
|
||||
|
||||
free(nl);
|
||||
|
||||
}
|
||||
|
||||
DBG("dir=%s, count=%u\n", data->out_dir, count);
|
||||
return count;
|
||||
|
||||
}
|
||||
|
||||
*/
|
||||
|
||||
// here we actually just read the files generated from symqemu
|
||||
/*
|
||||
size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
|
||||
u8 **out_buf, uint8_t *add_buf, size_t add_buf_size,
|
||||
size_t max_size) {
|
||||
|
||||
struct dirent **nl;
|
||||
int32_t i, done = 0, items = scandir(data->out_dir, &nl, NULL, NULL);
|
||||
ssize_t size = 0;
|
||||
|
||||
if (items <= 0) return 0;
|
||||
|
||||
for (i = 0; i < (u32)items; ++i) {
|
||||
|
||||
struct stat st;
|
||||
u8 * fn = alloc_printf("%s/%s", data->out_dir, nl[i]->d_name);
|
||||
|
||||
if (done == 0) {
|
||||
|
||||
if (stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
|
||||
|
||||
int fd = open(fn, O_RDONLY);
|
||||
|
||||
if (fd >= 0) {
|
||||
|
||||
size = read(fd, data->mutator_buf, max_size);
|
||||
*out_buf = data->mutator_buf;
|
||||
|
||||
close(fd);
|
||||
done = 1;
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
unlink(fn);
|
||||
|
||||
}
|
||||
|
||||
ck_free(fn);
|
||||
free(nl[i]);
|
||||
|
||||
}
|
||||
|
||||
free(nl);
|
||||
DBG("FUZZ size=%lu\n", size);
|
||||
return (uint32_t)size;
|
||||
|
||||
}
|
||||
|
||||
*/
|
||||
|
||||
/**
|
||||
* Deinitialize everything
|
||||
*
|
||||
* @param data The data ptr from afl_custom_init
|
||||
*/
|
||||
void afl_custom_deinit(my_mutator_t *data) {
|
||||
|
||||
free(data->mutator_buf);
|
||||
free(data);
|
||||
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user