mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-11 01:31:37 +00:00
van Hauser
GitHub
commit
22e2362f0f
@ -1,4 +1,6 @@
|
||||
# How to submit a Pull Request to AFL++
|
||||
# Contributing to AFL++
|
||||
|
||||
## How to submit a pull request
|
||||
|
||||
All contributions (pull requests) must be made against our `dev` branch.
|
||||
|
||||
@ -20,4 +22,38 @@ and use AFL's macros wherever possible (e.g., WARNF, FATAL, MAP_SIZE, ...).
|
||||
|
||||
Remember that AFL++ has to build and run on many platforms, so generalize your
|
||||
Makefiles/GNUmakefile (or your patches to our pre-existing Makefiles) to be as
|
||||
generic as possible.
|
||||
generic as possible.
|
||||
|
||||
## How to contribute to the docs
|
||||
|
||||
We welcome contributions to our docs.
|
||||
|
||||
Before creating a new file, please check if your content matches an existing
|
||||
file in one the following folders:
|
||||
|
||||
* [docs/](docs/) (this is where you can find most of our docs content)
|
||||
* [frida_mode/](frida_mode/)
|
||||
* [instrumentation/](instrumentation/)
|
||||
* [qemu_mode/](qemu_mode/)
|
||||
* [unicorn_mode/](unicorn_mode/)
|
||||
|
||||
When working on the docs, please keep the following guidelines in mind:
|
||||
|
||||
* Edit or create Markdown files and use Markdown markup.
|
||||
* Do: fuzzing_gui_program.md
|
||||
* Don't: fuzzing_gui_program.txt
|
||||
* Use underscore in file names.
|
||||
* Do: fuzzing_network_service.md
|
||||
* Don't: fuzzing-network-service.md
|
||||
* Use a maximum of 80 characters per line to make reading in a console easier.
|
||||
* Make all pull requests against `dev`, see
|
||||
[#how-to-submit-a-pull-request-to-afl](#how-to-submit-a-pull-request-to-afl).
|
||||
|
||||
And finally, here are some best practices for writing docs content:
|
||||
|
||||
* Use clear and simple language.
|
||||
* Structure your content with headings and paragraphs.
|
||||
* Use bulleted lists to present similar content in a way that makes it easy to
|
||||
scan.
|
||||
* Use numbered lists for procedures or prioritizing.
|
||||
* Link to related content, for example, prerequisites or in-depth discussions.
|
||||
@ -390,11 +390,11 @@ instrumentation/afl-llvm-common.o: instrumentation/afl-llvm-common.cc instrument
|
||||
ifeq "$(LLVM_MIN_4_0_1)" "0"
|
||||
$(info [!] N-gram branch coverage instrumentation is not available for llvm version $(LLVMVER))
|
||||
endif
|
||||
$(CXX) $(CLANG_CPPFL) -DLLVMInsTrim_EXPORTS -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
|
||||
$(CXX) $(CLANG_CPPFL) -Wdeprecated -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
|
||||
|
||||
./SanitizerCoveragePCGUARD.so: instrumentation/SanitizerCoveragePCGUARD.so.cc instrumentation/afl-llvm-common.o | test_deps
|
||||
ifeq "$(LLVM_10_OK)" "1"
|
||||
-$(CXX) $(CLANG_CPPFL) -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
|
||||
-$(CXX) $(CLANG_CPPFL) -Wdeprecated -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
|
||||
endif
|
||||
|
||||
./afl-llvm-lto-instrumentlist.so: instrumentation/afl-llvm-lto-instrumentlist.so.cc instrumentation/afl-llvm-common.o
|
||||
|
||||
6
afl-plot
6
afl-plot
@ -140,9 +140,9 @@ set output '$outputdir/high_freq.png'
|
||||
|
||||
$GNUPLOT_SETUP
|
||||
|
||||
plot '$inputdir/plot_data' using 1:4 with filledcurve x1 title 'total paths' linecolor rgb '#000000' fillstyle transparent solid 0.2 noborder, \\
|
||||
'' using 1:3 with filledcurve x1 title 'current path' linecolor rgb '#f0f0f0' fillstyle transparent solid 0.5 noborder, \\
|
||||
'' using 1:5 with lines title 'pending paths' linecolor rgb '#0090ff' linewidth 3, \\
|
||||
plot '$inputdir/plot_data' using 1:4 with filledcurve x1 title 'corpus count' linecolor rgb '#000000' fillstyle transparent solid 0.2 noborder, \\
|
||||
'' using 1:3 with filledcurve x1 title 'current fuzz item' linecolor rgb '#f0f0f0' fillstyle transparent solid 0.5 noborder, \\
|
||||
'' using 1:5 with lines title 'pending items' linecolor rgb '#0090ff' linewidth 3, \\
|
||||
'' using 1:6 with lines title 'pending favs' linecolor rgb '#c00080' linewidth 3, \\
|
||||
'' using 1:2 with lines title 'cycles done' linecolor rgb '#c000f0' linewidth 3
|
||||
"
|
||||
|
||||
@ -211,7 +211,7 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
|
||||
} else if (data->mut_idx == 2) { // Perform splice mutation
|
||||
|
||||
// we cannot use the supplied splice data so choose a new random file
|
||||
u32 tid = rand_below(global_afl, data->afl->queued_paths);
|
||||
u32 tid = rand_below(global_afl, data->afl->queued_items);
|
||||
struct queue_entry *q = data->afl->queue_buf[tid];
|
||||
|
||||
// Read the input representation for the splice candidate
|
||||
|
||||
@ -4473,6 +4473,10 @@ static word prim_sys(word op, word a, word b, word c) {
|
||||
FD_CLOEXEC,
|
||||
F_DUPFD,
|
||||
F_DUPFD_CLOEXEC,
|
||||
#if defined(F_DUP2FD)
|
||||
F_DUP2FD,
|
||||
F_DUP2FD_CLOEXEC,
|
||||
#endif
|
||||
F_GETFD,
|
||||
F_SETFD,
|
||||
F_GETFL,
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
# AFL++ dictionaries
|
||||
|
||||
(See [../README.md](../README.md) for the general instruction manual.)
|
||||
For the general instruction manual, see [docs/README.md](../docs/README.md).
|
||||
|
||||
This subdirectory contains a set of dictionaries that can be used in conjunction
|
||||
with the -x option to allow the fuzzer to effortlessly explore the grammar of
|
||||
|
||||
@ -10,6 +10,10 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
|
||||
|
||||
### Version ++3.15a (dev)
|
||||
- documentation restructuring, made possible by Google Season of Docs
|
||||
- we renamed several UI and fuzzer_stat entries to be more precise,
|
||||
e.g. "unique crashes" -> "saved crashes", "total paths" ->
|
||||
"corpus count", "current path" -> "current item".
|
||||
This might need changing custom scripting!
|
||||
- new binary-only fuzzing mode: coresight_mode for aarch64 CPUs :)
|
||||
thanks to RICSecLab submitting!
|
||||
- if instrumented libaries are dlopen()'ed after the forkserver you
|
||||
@ -30,6 +34,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
|
||||
- better banner
|
||||
- more effective cmplog mode
|
||||
- more often update the UI when in input2stage mode
|
||||
- qemu_mode/unicorn_mode: fixed OOB write when using libcompcov,
|
||||
thanks to kotee4ko for reporting!
|
||||
- frida_mode:
|
||||
- better performance, bug fixes
|
||||
- David Carlier added Android support :)
|
||||
@ -47,7 +53,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
|
||||
- fix for shared linking on MacOS
|
||||
- fixed a potential crash in targets for LAF string handling
|
||||
- added AFL_USE_TSAN thread sanitizer support
|
||||
- llvm and LTO mode modified to work with new llvm 14-dev (again)
|
||||
- llvm and LTO mode modified to work with new llvm 14-dev (again. again.)
|
||||
- fix for AFL_REAL_LD
|
||||
- added the very good grammar mutator "GramaTron" to the
|
||||
custom_mutators
|
||||
@ -1566,7 +1572,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
|
||||
- Fixed a bug with installed copies of AFL trying to use QEMU mode. Spotted
|
||||
by G.M. Lime.
|
||||
|
||||
- Added last path / crash / hang times to fuzzer_stats, suggested by
|
||||
- Added last find / crash / hang times to fuzzer_stats, suggested by
|
||||
Richard Hipp.
|
||||
|
||||
- Fixed a typo, thanks to Jakub Wilk.
|
||||
|
||||
26
docs/FAQ.md
26
docs/FAQ.md
@ -33,6 +33,19 @@ If you find an interesting or important question missing, submit it via
|
||||
Report](https://www.fuzzbench.com/reports/2020-08-03/index.html).
|
||||
</p></details>
|
||||
|
||||
<details>
|
||||
<summary id="is-afl-a-whitebox-graybox-or-blackbox-fuzzer">Is AFL++ a whitebox, graybox, or blackbox fuzzer?</summary><p>
|
||||
|
||||
The definition of the terms whitebox, graybox, and blackbox fuzzing varies
|
||||
from one source to another. For example, "graybox fuzzing" could mean
|
||||
binary-only or source code fuzzing, or something completely different.
|
||||
Therefore, we try to avoid them.
|
||||
|
||||
[The Fuzzing Book](https://www.fuzzingbook.org/html/GreyboxFuzzer.html#AFL:-An-Effective-Greybox-Fuzzer)
|
||||
describes the original AFL to be a graybox fuzzer. In that sense, AFL++ is
|
||||
also a graybox fuzzer.
|
||||
</p></details>
|
||||
|
||||
<details>
|
||||
<summary id="where-can-i-find-tutorials">Where can I find tutorials?</summary><p>
|
||||
|
||||
@ -126,6 +139,15 @@ If you find an interesting or important question missing, submit it via
|
||||
|
||||
## Performance
|
||||
|
||||
<details>
|
||||
<summary id="what-makes-a-good-performance">What makes a good performance?</summary><p>
|
||||
|
||||
Good performance generally means "making the fuzzing results better". This can
|
||||
be influenced by various factors, for example, speed (finding lots of paths
|
||||
quickly) or thoroughness (working with decreased speed, but finding better
|
||||
mutations).
|
||||
</p></details>
|
||||
|
||||
<details>
|
||||
<summary id="how-can-i-improve-the-fuzzing-speed">How can I improve the fuzzing speed?</summary><p>
|
||||
|
||||
@ -146,8 +168,8 @@ If you find an interesting or important question missing, submit it via
|
||||
the edge coverage result will be different across runs. Those edges that
|
||||
change are then flagged "unstable".
|
||||
|
||||
The more "unstable" edges, the more difficult for AFL++ to identify valid new
|
||||
paths.
|
||||
The more "unstable" edges there are, the harder it is for AFL++ to identify
|
||||
valid new paths.
|
||||
|
||||
A value above 90% is usually fine and a value above 80% is also still ok, and
|
||||
even a value above 20% can still result in successful finds of bugs. However,
|
||||
|
||||
65
docs/README.md
Normal file
65
docs/README.md
Normal file
@ -0,0 +1,65 @@
|
||||
# AFL++ documentation
|
||||
|
||||
This is the overview of the AFL++ docs content.
|
||||
|
||||
For general information on AFL++, see the
|
||||
[README.md of the repository](../README.md).
|
||||
|
||||
Also take a look at our [FAQ.md](FAQ.md) and
|
||||
[best_practices.md](best_practices.md).
|
||||
|
||||
## Fuzzing targets with the source code available
|
||||
|
||||
You can find a quickstart for fuzzing targets with the source code available in
|
||||
the [README.md of the repository](../README.md#quick-start-fuzzing-with-afl).
|
||||
|
||||
For in-depth information on the steps of the fuzzing process, see
|
||||
[fuzzing_in_depth.md](fuzzing_in_depth.md) or click on the following
|
||||
image and select a step.
|
||||
|
||||
|
||||
|
||||
For further information on instrumentation, see the
|
||||
[READMEs in the instrumentation/ folder](../instrumentation/).
|
||||
|
||||
### Instrumenting the target
|
||||
|
||||
For more information, click on the following image and select a step.
|
||||
|
||||
|
||||
|
||||
### Preparing the fuzzing campaign
|
||||
|
||||
For more information, click on the following image and select a step.
|
||||
|
||||
|
||||
|
||||
### Fuzzing the target
|
||||
|
||||
For more information, click on the following image and select a step.
|
||||
|
||||
|
||||
|
||||
### Managing the fuzzing campaign
|
||||
|
||||
For more information, click on the following image and select a step.
|
||||
|
||||
|
||||
|
||||
## Fuzzing other targets
|
||||
|
||||
To learn about fuzzing other targets, see:
|
||||
|
||||
* Binary-only: [fuzzing_binary-only_targets.md](fuzzing_binary-only_targets.md)
|
||||
* GUI programs:
|
||||
[best_practices.md#fuzzing-a-gui-program](best_practices.md#fuzzing-a-gui-program)
|
||||
* Libraries: [frida_mode/README.md](../frida_mode/README.md)
|
||||
* Network services:
|
||||
[best_practices.md#fuzzing-a-network-service](best_practices.md#fuzzing-a-network-service)
|
||||
* Non-linux: [unicorn_mode/README.md](../unicorn_mode/README.md)
|
||||
|
||||
## Additional information
|
||||
|
||||
* Tools that help fuzzing with AFL++:
|
||||
[third_party_tools.md](third_party_tools.md)
|
||||
* Tutorials: [tutorials.md](tutorials.md)
|
||||
@ -40,7 +40,7 @@ superior to blind fuzzing or coverage-only tools.
|
||||
This section provides an overview of the status screen - plus tips for
|
||||
troubleshooting any warnings and red text shown in the UI.
|
||||
|
||||
For the general instruction manual, see [README.md](../README.md).
|
||||
For the general instruction manual, see [README.md](README.md).
|
||||
|
||||
### A note about colors
|
||||
|
||||
@ -85,7 +85,7 @@ for parallel fuzzing. Second to last is the power schedule mode being run
|
||||
```
|
||||
+----------------------------------------------------+
|
||||
| run time : 0 days, 8 hrs, 32 min, 43 sec |
|
||||
| last new path : 0 days, 0 hrs, 6 min, 40 sec |
|
||||
| last new find : 0 days, 0 hrs, 6 min, 40 sec |
|
||||
| last uniq crash : none seen yet |
|
||||
| last uniq hang : 0 days, 1 hrs, 24 min, 32 sec |
|
||||
+----------------------------------------------------+
|
||||
@ -485,20 +485,20 @@ directory. This includes:
|
||||
- `cycles_wo_finds` - number of cycles without any new paths found
|
||||
- `execs_done` - number of execve() calls attempted
|
||||
- `execs_per_sec` - overall number of execs per second
|
||||
- `paths_total` - total number of entries in the queue
|
||||
- `paths_favored` - number of queue entries that are favored
|
||||
- `paths_found` - number of entries discovered through local fuzzing
|
||||
- `paths_imported` - number of entries imported from other instances
|
||||
- `corpus_count` - total number of entries in the queue
|
||||
- `corpus_favored` - number of queue entries that are favored
|
||||
- `corpus_found` - number of entries discovered through local fuzzing
|
||||
- `corpus_imported` - number of entries imported from other instances
|
||||
- `max_depth` - number of levels in the generated data set
|
||||
- `cur_path` - currently processed entry number
|
||||
- `cur_item` - currently processed entry number
|
||||
- `pending_favs` - number of favored entries still waiting to be fuzzed
|
||||
- `pending_total` - number of all entries waiting to be fuzzed
|
||||
- `variable_paths` - number of test cases showing variable behavior
|
||||
- `corpus_variable` - number of test cases showing variable behavior
|
||||
- `stability` - percentage of bitmap bytes that behave consistently
|
||||
- `bitmap_cvg` - percentage of edge coverage found in the map so far
|
||||
- `unique_crashes` - number of unique crashes recorded
|
||||
- `unique_hangs` - number of unique hangs encountered
|
||||
- `last_path` - seconds since the last path was found
|
||||
- `saved_crashes` - number of unique crashes recorded
|
||||
- `saved_hangs` - number of unique hangs encountered
|
||||
- `last_find` - seconds since the last find was found
|
||||
- `last_crash` - seconds since the last crash was found
|
||||
- `last_hang` - seconds since the last hang was found
|
||||
- `execs_since_crash` - execs since the last crash was found
|
||||
@ -531,9 +531,9 @@ last crash > X, etc.).
|
||||
|
||||
The selected metrics are a subset of all the metrics found in the status and in
|
||||
the plot file. The list is the following: `cycle_done`, `cycles_wo_finds`,
|
||||
`execs_done`,`execs_per_sec`, `paths_total`, `paths_favored`, `paths_found`,
|
||||
`paths_imported`, `max_depth`, `cur_path`, `pending_favs`, `pending_total`,
|
||||
`variable_paths`, `unique_crashes`, `unique_hangs`, `total_crashes`,
|
||||
`execs_done`,`execs_per_sec`, `corpus_count`, `corpus_favored`, `corpus_found`,
|
||||
`corpus_imported`, `max_depth`, `cur_item`, `pending_favs`, `pending_total`,
|
||||
`corpus_variable`, `saved_crashes`, `saved_hangs`, `total_crashes`,
|
||||
`slowest_exec_ms`, `edges_found`, `var_byte_count`, `havoc_expansion`. Their
|
||||
definitions can be found in the addendum above.
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ Fuzzing source code is a three-step process:
|
||||
2. Prepare the fuzzing by selecting and optimizing the input corpus for the
|
||||
target.
|
||||
3. Perform the fuzzing of the target by randomly mutating input and assessing if
|
||||
a generated input was processed in a new path in the target binary.
|
||||
that input was processed on a new path in the target binary.
|
||||
|
||||
## 0. Common sense risks
|
||||
|
||||
@ -95,38 +95,43 @@ Clickable README links for the chosen compiler:
|
||||
* GCC/CLANG modes (afl-gcc/afl-clang) have no README as they have no own
|
||||
features
|
||||
|
||||
You can select the mode for the afl-cc compiler by:
|
||||
1. use a symlink to afl-cc: afl-gcc, afl-g++, afl-clang, afl-clang++,
|
||||
afl-clang-fast, afl-clang-fast++, afl-clang-lto, afl-clang-lto++,
|
||||
afl-gcc-fast, afl-g++-fast (recommended!)
|
||||
2. using the environment variable AFL_CC_COMPILER with MODE
|
||||
3. passing --afl-MODE command line options to the compiler via
|
||||
CFLAGS/CXXFLAGS/CPPFLAGS
|
||||
You can select the mode for the afl-cc compiler by one of the following methods:
|
||||
|
||||
MODE can be one of: LTO (afl-clang-lto*), LLVM (afl-clang-fast*), GCC_PLUGIN
|
||||
(afl-g*-fast) or GCC (afl-gcc/afl-g++) or CLANG(afl-clang/afl-clang++).
|
||||
* Using a symlink to afl-cc: afl-gcc, afl-g++, afl-clang, afl-clang++,
|
||||
afl-clang-fast, afl-clang-fast++, afl-clang-lto, afl-clang-lto++,
|
||||
afl-gcc-fast, afl-g++-fast (recommended!).
|
||||
* Using the environment variable `AFL_CC_COMPILER` with `MODE`.
|
||||
* Passing --afl-MODE command line options to the compiler via
|
||||
`CFLAGS`/`CXXFLAGS`/`CPPFLAGS`.
|
||||
|
||||
`MODE` can be one of the following:
|
||||
|
||||
* LTO (afl-clang-lto*)
|
||||
* LLVM (afl-clang-fast*)
|
||||
* GCC_PLUGIN (afl-g*-fast) or GCC (afl-gcc/afl-g++)
|
||||
* CLANG(afl-clang/afl-clang++)
|
||||
|
||||
Because no AFL++ specific command-line options are accepted (beside the
|
||||
--afl-MODE command), the compile-time tools make fairly broad use of environment
|
||||
variables, which can be listed with `afl-cc -hh` or by reading
|
||||
variables, which can be listed with `afl-cc -hh` or looked up in
|
||||
[env_variables.md](env_variables.md).
|
||||
|
||||
### b) Selecting instrumentation options
|
||||
|
||||
The following options are available when you instrument with LTO mode
|
||||
(afl-clang-fast/afl-clang-lto):
|
||||
If you instrument with LTO mode (afl-clang-fast/afl-clang-lto), the following
|
||||
options are available:
|
||||
|
||||
* Splitting integer, string, float and switch comparisons so AFL++ can easier
|
||||
* Splitting integer, string, float, and switch comparisons so AFL++ can easier
|
||||
solve these. This is an important option if you do not have a very good and
|
||||
large input corpus. This technique is called laf-intel or COMPCOV. To use this
|
||||
set the following environment variable before compiling the target: `export
|
||||
AFL_LLVM_LAF_ALL=1` You can read more about this in
|
||||
large input corpus. This technique is called laf-intel or COMPCOV. To use
|
||||
this, set the following environment variable before compiling the target:
|
||||
`export AFL_LLVM_LAF_ALL=1`. You can read more about this in
|
||||
[instrumentation/README.laf-intel.md](../instrumentation/README.laf-intel.md).
|
||||
* A different technique (and usually a better one than laf-intel) is to
|
||||
instrument the target so that any compare values in the target are sent to
|
||||
AFL++ which then tries to put these values into the fuzzing data at different
|
||||
locations. This technique is very fast and good - if the target does not
|
||||
transform input data before comparison. Therefore this technique is called
|
||||
transform input data before comparison. Therefore, this technique is called
|
||||
`input to state` or `redqueen`. If you want to use this technique, then you
|
||||
have to compile the target twice, once specifically with/for this mode by
|
||||
setting `AFL_LLVM_CMPLOG=1`, and pass this binary to afl-fuzz via the `-c`
|
||||
@ -135,24 +140,25 @@ The following options are available when you instrument with LTO mode
|
||||
about this in
|
||||
[instrumentation/README.cmplog.md](../instrumentation/README.cmplog.md).
|
||||
|
||||
If you use LTO, LLVM or GCC_PLUGIN mode
|
||||
(afl-clang-fast/afl-clang-lto/afl-gcc-fast) you have the option to selectively
|
||||
If you use LTO, LLVM, or GCC_PLUGIN mode
|
||||
(afl-clang-fast/afl-clang-lto/afl-gcc-fast), you have the option to selectively
|
||||
only instrument parts of the target that you are interested in:
|
||||
|
||||
* To instrument only those parts of the target that you are interested in create
|
||||
a file with all the filenames of the source code that should be instrumented.
|
||||
For afl-clang-lto and afl-gcc-fast - or afl-clang-fast if a mode other than
|
||||
DEFAULT/PCGUARD is used or you have llvm > 10.0.0 - just put one filename or
|
||||
function per line (no directory information necessary for filenames9, and
|
||||
either set `export AFL_LLVM_ALLOWLIST=allowlist.txt` **or** `export
|
||||
AFL_LLVM_DENYLIST=denylist.txt` - depending on if you want per default to
|
||||
instrument unless noted (DENYLIST) or not perform instrumentation unless
|
||||
* To instrument only those parts of the target that you are interested in,
|
||||
create a file with all the filenames of the source code that should be
|
||||
instrumented. For afl-clang-lto and afl-gcc-fast - or afl-clang-fast if a mode
|
||||
other than DEFAULT/PCGUARD is used or you have llvm > 10.0.0 - just put one
|
||||
filename or function per line (no directory information necessary for
|
||||
filenames), and either set `export AFL_LLVM_ALLOWLIST=allowlist.txt` **or**
|
||||
`export AFL_LLVM_DENYLIST=denylist.txt` - depending on if you want per default
|
||||
to instrument unless noted (DENYLIST) or not perform instrumentation unless
|
||||
requested (ALLOWLIST). **NOTE:** During optimization functions might be
|
||||
inlined and then would not match! See
|
||||
[instrumentation/README.instrument_list.md](../instrumentation/README.instrument_list.md)
|
||||
[instrumentation/README.instrument_list.md](../instrumentation/README.instrument_list.md).
|
||||
|
||||
There are many more options and modes available, however, these are most of the
|
||||
time less effective. See:
|
||||
|
||||
* [instrumentation/README.llvm.md#6) AFL++ Context Sensitive Branch Coverage](../instrumentation/README.llvm.md#6-afl-context-sensitive-branch-coverage)
|
||||
* [instrumentation/README.llvm.md#7) AFL++ N-Gram Branch Coverage](../instrumentation/README.llvm.md#7-afl-n-gram-branch-coverage)
|
||||
|
||||
@ -166,12 +172,13 @@ It is possible to use sanitizers when instrumenting targets for fuzzing, which
|
||||
allows you to find bugs that would not necessarily result in a crash.
|
||||
|
||||
Note that sanitizers have a huge impact on CPU (= less executions per second)
|
||||
and RAM usage. Also you should only run one afl-fuzz instance per sanitizer
|
||||
and RAM usage. Also, you should only run one afl-fuzz instance per sanitizer
|
||||
type. This is enough because a use-after-free bug will be picked up, e.g., by
|
||||
ASAN (address sanitizer) anyway when syncing to other fuzzing instances, so not
|
||||
all fuzzing instances need to be instrumented with ASAN.
|
||||
|
||||
The following sanitizers have built-in support in AFL++:
|
||||
|
||||
* ASAN = Address SANitizer, finds memory corruption vulnerabilities like
|
||||
use-after-free, NULL pointer dereference, buffer overruns, etc. Enabled with
|
||||
`export AFL_USE_ASAN=1` before compiling.
|
||||
@ -184,7 +191,7 @@ The following sanitizers have built-in support in AFL++:
|
||||
with `export AFL_USE_UBSAN=1` before compiling.
|
||||
* CFISAN = Control Flow Integrity SANitizer, finds instances where the control
|
||||
flow is found to be illegal. Originally this was rather to prevent return
|
||||
oriented programming exploit chains from functioning, in fuzzing this is
|
||||
oriented programming exploit chains from functioning. In fuzzing, this is
|
||||
mostly reduced to detecting type confusion vulnerabilities - which is,
|
||||
however, one of the most important and dangerous C++ memory corruption
|
||||
classes! Enabled with `export AFL_USE_CFISAN=1` before compiling.
|
||||
@ -227,20 +234,20 @@ All AFL++ compilers will set this preprocessor definition automatically.
|
||||
|
||||
### e) Instrumenting the target
|
||||
|
||||
In this step the target source code is compiled so that it can be fuzzed.
|
||||
In this step, the target source code is compiled so that it can be fuzzed.
|
||||
|
||||
Basically you have to tell the target build system that the selected AFL++
|
||||
Basically, you have to tell the target build system that the selected AFL++
|
||||
compiler is used. Also - if possible - you should always configure the build
|
||||
system such that the target is compiled statically and not dynamically. How to
|
||||
do this is described below.
|
||||
system in such way that the target is compiled statically and not dynamically.
|
||||
How to do this is described below.
|
||||
|
||||
The #1 rule when instrumenting a target is: avoid instrumenting shared libraries
|
||||
at all cost. You would need to set LD_LIBRARY_PATH to point to these, you could
|
||||
accidentally type "make install" and install them system wide - so don't. Really
|
||||
don't. **Always compile libraries you want to have instrumented as static and
|
||||
link these to the target program!**
|
||||
at all cost. You would need to set `LD_LIBRARY_PATH` to point to these, you
|
||||
could accidentally type "make install" and install them system wide - so don't.
|
||||
Really don't. **Always compile libraries you want to have instrumented as static
|
||||
and link these to the target program!**
|
||||
|
||||
Then build the target. (Usually with `make`)
|
||||
Then build the target. (Usually with `make`.)
|
||||
|
||||
**NOTES**
|
||||
|
||||
@ -258,41 +265,49 @@ Then build the target. (Usually with `make`)
|
||||
|
||||
#### configure
|
||||
|
||||
For `configure` build systems this is usually done by:
|
||||
For `configure` build systems, this is usually done by:
|
||||
|
||||
`CC=afl-clang-fast CXX=afl-clang-fast++ ./configure --disable-shared`
|
||||
```
|
||||
CC=afl-clang-fast CXX=afl-clang-fast++ ./configure --disable-shared
|
||||
```
|
||||
|
||||
Note that if you are using the (better) afl-clang-lto compiler, you also have to
|
||||
set `AR` to llvm-ar[-VERSION] and `RANLIB` to llvm-ranlib[-VERSION] - as is
|
||||
described in [instrumentation/README.lto.md](../instrumentation/README.lto.md).
|
||||
|
||||
#### CMake
|
||||
|
||||
For CMake build systems, this is usually done by:
|
||||
|
||||
```
|
||||
mkdir build; cd build; cmake -DCMAKE_C_COMPILER=afl-cc -DCMAKE_CXX_COMPILER=afl-c++ ..
|
||||
```
|
||||
|
||||
Note that if you are using the (better) afl-clang-lto compiler you also have to
|
||||
set AR to llvm-ar[-VERSION] and RANLIB to llvm-ranlib[-VERSION] - as is
|
||||
described in [instrumentation/README.lto.md](../instrumentation/README.lto.md).
|
||||
|
||||
#### cmake
|
||||
#### Meson Build System
|
||||
|
||||
For `cmake` build systems this is usually done by:
|
||||
For the Meson Build System, you have to set the AFL++ compiler with the very
|
||||
first command!
|
||||
|
||||
`mkdir build; cd build; cmake -DCMAKE_C_COMPILER=afl-cc -DCMAKE_CXX_COMPILER=afl-c++ ..`
|
||||
```
|
||||
CC=afl-cc CXX=afl-c++ meson
|
||||
```
|
||||
|
||||
Note that if you are using the (better) afl-clang-lto compiler you also have to
|
||||
set AR to llvm-ar[-VERSION] and RANLIB to llvm-ranlib[-VERSION] - as is
|
||||
described in [instrumentation/README.lto.md](../instrumentation/README.lto.md).
|
||||
#### Other build systems or if configure/cmake didn't work
|
||||
|
||||
#### meson
|
||||
|
||||
For meson you have to set the AFL++ compiler with the very first command!
|
||||
`CC=afl-cc CXX=afl-c++ meson`
|
||||
|
||||
#### other build systems or if configure/cmake didn't work
|
||||
|
||||
Sometimes cmake and configure do not pick up the AFL++ compiler, or the
|
||||
ranlib/ar that is needed - because this was just not foreseen by the developer
|
||||
of the target. Or they have non-standard options. Figure out if there is a
|
||||
non-standard way to set this, otherwise set up the build normally and edit the
|
||||
generated build environment afterwards manually to point it to the right
|
||||
compiler (and/or ranlib and ar).
|
||||
Sometimes `cmake` and `configure` do not pick up the AFL++ compiler or the
|
||||
`RANLIB`/`AR` that is needed - because this was just not foreseen by the
|
||||
developer of the target. Or they have non-standard options. Figure out if there
|
||||
is a non-standard way to set this, otherwise set up the build normally and edit
|
||||
the generated build environment afterwards manually to point it to the right
|
||||
compiler (and/or `RANLIB` and `AR`).
|
||||
|
||||
### f) Better instrumentation
|
||||
|
||||
If you just fuzz a target program as-is you are wasting a great opportunity for
|
||||
If you just fuzz a target program as-is, you are wasting a great opportunity for
|
||||
much more fuzzing speed.
|
||||
|
||||
This variant requires the usage of afl-clang-lto, afl-clang-fast or
|
||||
@ -304,7 +319,7 @@ that you want to fuzz, plus a few specific AFL++ functions around it. See
|
||||
[instrumentation/README.persistent_mode.md](../instrumentation/README.persistent_mode.md)
|
||||
for details.
|
||||
|
||||
Basically if you do not fuzz a target in persistent mode, then you are just
|
||||
Basically, if you do not fuzz a target in persistent mode, then you are just
|
||||
doing it for a hobby and not professionally :-).
|
||||
|
||||
### g) libfuzzer fuzzer harnesses with LLVMFuzzerTestOneInput()
|
||||
@ -354,20 +369,24 @@ You can find many good examples of starting files in the
|
||||
### b) Making the input corpus unique
|
||||
|
||||
Use the AFL++ tool `afl-cmin` to remove inputs from the corpus that do not
|
||||
produce a new path in the target.
|
||||
produce a new path/coverage in the target:
|
||||
|
||||
Put all files from step a) into one directory, e.g., INPUTS.
|
||||
1. Put all files from [step a](#a-collecting-inputs) into one directory, e.g., INPUTS.
|
||||
2. Run afl-cmin:
|
||||
* If the target program is to be called by fuzzing as `bin/target -d
|
||||
INPUTFILE`, set the INPUTFILE argument that the target program would read
|
||||
from as `@@`:
|
||||
|
||||
If the target program is to be called by fuzzing as `bin/target -d INPUTFILE`
|
||||
the run afl-cmin like this:
|
||||
```
|
||||
afl-cmin -i INPUTS -o INPUTS_UNIQUE -- bin/target -d @@
|
||||
```
|
||||
|
||||
`afl-cmin -i INPUTS -o INPUTS_UNIQUE -- bin/target -d @@`
|
||||
* If the target reads from stdin instead, just omit the `@@` as this is the
|
||||
default:
|
||||
|
||||
Note that the INPUTFILE argument that the target program would read from has to
|
||||
be set as `@@`.
|
||||
|
||||
If the target reads from stdin instead, just omit the `@@` as this is the
|
||||
default.
|
||||
```
|
||||
afl-cmin -i INPUTS -o INPUTS_UNIQUE -- bin/target -d
|
||||
```
|
||||
|
||||
This step is highly recommended!
|
||||
|
||||
@ -385,14 +404,16 @@ for i in *; do
|
||||
done
|
||||
```
|
||||
|
||||
This step can also be parallelized, e.g., with `parallel`. Note that this step
|
||||
is rather optional though.
|
||||
This step can also be parallelized, e.g., with `parallel`.
|
||||
|
||||
Note that this step is rather optional though.
|
||||
|
||||
### Done!
|
||||
|
||||
The INPUTS_UNIQUE/ directory from step b) - or even better the directory input/
|
||||
if you minimized the corpus in step c) - is the resulting input corpus directory
|
||||
to be used in fuzzing! :-)
|
||||
The INPUTS_UNIQUE/ directory from [step b](#b-making-the-input-corpus-unique) -
|
||||
or even better the directory input/ if you minimized the corpus in
|
||||
[step c](#c-minimizing-all-corpus-files) - is the resulting input corpus
|
||||
directory to be used in fuzzing! :-)
|
||||
|
||||
## 3. Fuzzing the target
|
||||
|
||||
@ -405,28 +426,31 @@ seriously :-)
|
||||
|
||||
### a) Running afl-fuzz
|
||||
|
||||
Before you do even a test run of afl-fuzz execute `sudo afl-system-config` (on
|
||||
the host if you execute afl-fuzz in a docker container). This reconfigures the
|
||||
Before you do even a test run of afl-fuzz, execute `sudo afl-system-config` (on
|
||||
the host if you execute afl-fuzz in a Docker container). This reconfigures the
|
||||
system for optimal speed - which afl-fuzz checks and bails otherwise. Set
|
||||
`export AFL_SKIP_CPUFREQ=1` for afl-fuzz to skip this check if you cannot run
|
||||
afl-system-config with root privileges on the host for whatever reason.
|
||||
|
||||
Note there is also `sudo afl-persistent-config` which sets additional permanent
|
||||
boot options for a much better fuzzing performance.
|
||||
Note:
|
||||
|
||||
Note that both scripts improve your fuzzing performance but also decrease your
|
||||
system protection against attacks! So set strong firewall rules and only expose
|
||||
SSH as a network service if you use these (which is highly recommended).
|
||||
* There is also `sudo afl-persistent-config` which sets additional permanent
|
||||
boot options for a much better fuzzing performance.
|
||||
* Both scripts improve your fuzzing performance but also decrease your system
|
||||
protection against attacks! So set strong firewall rules and only expose SSH
|
||||
as a network service if you use these (which is highly recommended).
|
||||
|
||||
If you have an input corpus from step 2, then specify this directory with the
|
||||
`-i` option. Otherwise, create a new directory and create a file with any
|
||||
content as test data in there.
|
||||
If you have an input corpus from [step 2](#2-preparing-the-fuzzing-campaign),
|
||||
then specify this directory with the `-i` option. Otherwise, create a new
|
||||
directory and create a file with any content as test data in there.
|
||||
|
||||
If you do not want anything special, the defaults are already usually best,
|
||||
hence all you need is to specify the seed input directory with the result of
|
||||
step [2a) Collect inputs](#a-collect-inputs):
|
||||
step [2a) Collecting inputs](#a-collecting-inputs):
|
||||
|
||||
`afl-fuzz -i input -o output -- bin/target -d @@`
|
||||
```
|
||||
afl-fuzz -i input -o output -- bin/target -d @@
|
||||
```
|
||||
|
||||
Note that the directory specified with `-o` will be created if it does not
|
||||
exist.
|
||||
@ -444,7 +468,9 @@ If you need to stop and re-start the fuzzing, use the same command line options
|
||||
(or even change them by selecting a different power schedule or another mutation
|
||||
mode!) and switch the input directory with a dash (`-`):
|
||||
|
||||
`afl-fuzz -i - -o output -- bin/target -d @@`
|
||||
```
|
||||
afl-fuzz -i - -o output -- bin/target -d @@
|
||||
```
|
||||
|
||||
Adding a dictionary is helpful. See the directory
|
||||
[dictionaries/](../dictionaries/) if something is already included for your data
|
||||
@ -461,7 +487,7 @@ specific locations for the input file (`-f`), performing deterministic fuzzing
|
||||
We highly recommend that you set a memory limit for running the target with `-m`
|
||||
which defines the maximum memory in MB. This prevents a potential out-of-memory
|
||||
problem for your system plus helps you detect missing `malloc()` failure
|
||||
handling in the target. Play around with various -m values until you find one
|
||||
handling in the target. Play around with various `-m` values until you find one
|
||||
that safely works for all your input seeds (if you have good ones and then
|
||||
double or quadruple that.
|
||||
|
||||
@ -469,8 +495,8 @@ By default, afl-fuzz never stops fuzzing. To terminate AFL++, press Control-C or
|
||||
send a signal SIGINT. You can limit the number of executions or approximate
|
||||
runtime in seconds with options also.
|
||||
|
||||
When you start afl-fuzz you will see a user interface that shows what the status
|
||||
is:
|
||||
When you start afl-fuzz, you will see a user interface that shows what the
|
||||
status is:
|
||||
|
||||
|
||||
|
||||
@ -570,7 +596,7 @@ its name is unique, hence the recommendation for `-M main-$HOSTNAME`.
|
||||
|
||||
Now there are three strategies on how you can sync between the servers:
|
||||
* never: sounds weird, but this makes every server an island and has the chance
|
||||
the each follow different paths into the target. You can make this even more
|
||||
that each follow different paths into the target. You can make this even more
|
||||
interesting by even giving different seeds to each server.
|
||||
* regularly (~4h): this ensures that all fuzzing campaigns on the servers "see"
|
||||
the same thing. It is like fuzzing on a huge server.
|
||||
@ -596,7 +622,8 @@ done
|
||||
```
|
||||
|
||||
You can run this manually, per cron job - as you need it. There is a more
|
||||
complex and configurable script in `utils/distributed_fuzzing`.
|
||||
complex and configurable script in
|
||||
[utils/distributed_fuzzing](../utils/distributed_fuzzing).
|
||||
|
||||
### e) The status of the fuzz campaign
|
||||
|
||||
@ -612,7 +639,7 @@ If you have multiple servers, then use the command after a sync or you have to
|
||||
execute this script per server.
|
||||
|
||||
Another tool to inspect the current state and history of a specific instance is
|
||||
afl-plot, which generates an index.html file and a graphs that show how the
|
||||
afl-plot, which generates an index.html file and graphs that show how the
|
||||
fuzzing instance is performing. The syntax is `afl-plot instance_dir web_dir`,
|
||||
e.g., `afl-plot out/default /srv/www/htdocs/plot`.
|
||||
|
||||
@ -623,7 +650,7 @@ To stop an afl-fuzz run, press Control-C.
|
||||
To restart an afl-fuzz run, just reuse the same command line but replace the `-i
|
||||
directory` with `-i -` or set `AFL_AUTORESUME=1`.
|
||||
|
||||
If you want to add new seeds to a fuzzing campaign you can run a temporary
|
||||
If you want to add new seeds to a fuzzing campaign, you can run a temporary
|
||||
fuzzing instance, e.g., when your main fuzzer is using `-o out` and the new
|
||||
seeds are in `newseeds/` directory:
|
||||
|
||||
@ -633,7 +660,7 @@ AFL_BENCH_JUST_ONE=1 AFL_FAST_CAL=1 afl-fuzz -i newseeds -o out -S newseeds -- .
|
||||
|
||||
### g) Checking the coverage of the fuzzing
|
||||
|
||||
The `paths found` value is a bad indicator for checking how good the coverage
|
||||
The `corpus count` value is a bad indicator for checking how good the coverage
|
||||
is.
|
||||
|
||||
A better indicator - if you use default llvm instrumentation with at least
|
||||
@ -686,21 +713,21 @@ or honggfuzz.
|
||||
### i) Improve the speed!
|
||||
|
||||
* Use [persistent mode](../instrumentation/README.persistent_mode.md) (x2-x20
|
||||
speed increase)
|
||||
speed increase).
|
||||
* If you do not use shmem persistent mode, use `AFL_TMPDIR` to point the input
|
||||
file on a tempfs location, see [env_variables.md](env_variables.md)
|
||||
file on a tempfs location, see [env_variables.md](env_variables.md).
|
||||
* Linux: Improve kernel performance: modify `/etc/default/grub`, set
|
||||
`GRUB_CMDLINE_LINUX_DEFAULT="ibpb=off ibrs=off kpti=off l1tf=off mds=off
|
||||
mitigations=off no_stf_barrier noibpb noibrs nopcid nopti
|
||||
nospec_store_bypass_disable nospectre_v1 nospectre_v2 pcid=off pti=off
|
||||
spec_store_bypass_disable=off spectre_v2=off stf_barrier=off"`; then
|
||||
`update-grub` and `reboot` (warning: makes the system more insecure) - you can
|
||||
also just run `sudo afl-persistent-config`
|
||||
also just run `sudo afl-persistent-config`.
|
||||
* Linux: Running on an `ext2` filesystem with `noatime` mount option will be a
|
||||
bit faster than on any other journaling filesystem
|
||||
* Use your cores! [3c) Using multiple cores](#c-using-multiple-cores)
|
||||
bit faster than on any other journaling filesystem.
|
||||
* Use your cores! See [3c) Using multiple cores](#c-using-multiple-cores).
|
||||
* Run `sudo afl-system-config` before starting the first afl-fuzz instance after
|
||||
a reboot
|
||||
a reboot.
|
||||
|
||||
### j) Going beyond crashes
|
||||
|
||||
@ -774,7 +801,7 @@ making it easier to diagnose faults.
|
||||
Having said that, it's important to acknowledge that some fuzzing crashes can be
|
||||
difficult to quickly evaluate for exploitability without a lot of debugging and
|
||||
code analysis work. To assist with this task, afl-fuzz supports a very unique
|
||||
"crash exploration" mode enabled with the -C flag.
|
||||
"crash exploration" mode enabled with the `-C` flag.
|
||||
|
||||
In this mode, the fuzzer takes one or more crashing test cases as the input and
|
||||
uses its feedback-driven fuzzing strategies to very quickly enumerate all code
|
||||
@ -800,19 +827,19 @@ mode, it will happily accept instrumented and non-instrumented binaries. In the
|
||||
non-crashing mode, the minimizer relies on standard AFL++ instrumentation to
|
||||
make the file simpler without altering the execution path.
|
||||
|
||||
The minimizer accepts the -m, -t, -f and @@ syntax in a manner compatible with
|
||||
afl-fuzz.
|
||||
The minimizer accepts the `-m`, `-t`, `-f`, and `@@` syntax in a manner
|
||||
compatible with afl-fuzz.
|
||||
|
||||
Another tool in AFL++ is the afl-analyze tool. It takes an input file, attempts
|
||||
to sequentially flip bytes, and observes the behavior of the tested program. It
|
||||
then color-codes the input based on which sections appear to be critical, and
|
||||
to sequentially flip bytes and observes the behavior of the tested program. It
|
||||
then color-codes the input based on which sections appear to be critical and
|
||||
which are not; while not bulletproof, it can often offer quick insights into
|
||||
complex file formats.
|
||||
|
||||
## 5. CI fuzzing
|
||||
|
||||
Some notes on CI fuzzing - this fuzzing is different to normal fuzzing campaigns
|
||||
as these are much shorter runnings.
|
||||
Some notes on continuous integration (CI) fuzzing - this fuzzing is different to
|
||||
normal fuzzing campaigns as these are much shorter runnings.
|
||||
|
||||
1. Always:
|
||||
* LTO has a much longer compile time which is diametrical to short fuzzing -
|
||||
@ -820,10 +847,10 @@ as these are much shorter runnings.
|
||||
* If you compile with CMPLOG, then you can save fuzzing time and reuse that
|
||||
compiled target for both the `-c` option and the main fuzz target. This
|
||||
will impact the speed by ~15% though.
|
||||
* `AFL_FAST_CAL` - Enable fast calibration, this halves the time the
|
||||
* `AFL_FAST_CAL` - enables fast calibration, this halves the time the
|
||||
saturated corpus needs to be loaded.
|
||||
* `AFL_CMPLOG_ONLY_NEW` - only perform cmplog on new found paths, not the
|
||||
initial corpus as this very likely has been done for them already.
|
||||
* `AFL_CMPLOG_ONLY_NEW` - only perform cmplog on new finds, not the initial
|
||||
corpus as this very likely has been done for them already.
|
||||
* Keep the generated corpus, use afl-cmin and reuse it every time!
|
||||
|
||||
2. Additionally randomize the AFL++ compilation options, e.g.:
|
||||
|
||||
4
docs/resources/0_fuzzing_process_overview.drawio.svg
Normal file
4
docs/resources/0_fuzzing_process_overview.drawio.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 32 KiB |
4
docs/resources/1_instrument_target.drawio.svg
Normal file
4
docs/resources/1_instrument_target.drawio.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 14 KiB |
4
docs/resources/2_prepare_campaign.drawio.svg
Normal file
4
docs/resources/2_prepare_campaign.drawio.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 10 KiB |
4
docs/resources/3_fuzz_target.drawio.svg
Normal file
4
docs/resources/3_fuzz_target.drawio.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 11 KiB |
4
docs/resources/4_manage_campaign.drawio.svg
Normal file
4
docs/resources/4_manage_campaign.drawio.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 13 KiB |
@ -926,7 +926,7 @@
|
||||
"steppedLine": false,
|
||||
"targets": [
|
||||
{
|
||||
"expr": "fuzzing{type=\"cur_path\"}",
|
||||
"expr": "fuzzing{type=\"cur_item\"}",
|
||||
"interval": "",
|
||||
"legendFormat": "",
|
||||
"refId": "A"
|
||||
@ -936,7 +936,7 @@
|
||||
"timeFrom": null,
|
||||
"timeRegions": [],
|
||||
"timeShift": null,
|
||||
"title": "Curent path",
|
||||
"title": "Current fuzz item",
|
||||
"tooltip": {
|
||||
"shared": true,
|
||||
"sort": 0,
|
||||
@ -1116,7 +1116,7 @@
|
||||
"steppedLine": false,
|
||||
"targets": [
|
||||
{
|
||||
"expr": "fuzzing{type=\"paths_favored\"}",
|
||||
"expr": "fuzzing{type=\"corpus_favored\"}",
|
||||
"interval": "",
|
||||
"legendFormat": "",
|
||||
"refId": "A"
|
||||
@ -1135,7 +1135,7 @@
|
||||
}
|
||||
],
|
||||
"timeShift": null,
|
||||
"title": "Path Favored",
|
||||
"title": "Corpus Favored",
|
||||
"tooltip": {
|
||||
"shared": true,
|
||||
"sort": 0,
|
||||
@ -1428,7 +1428,7 @@
|
||||
"steppedLine": false,
|
||||
"targets": [
|
||||
{
|
||||
"expr": "fuzzing{type=\"paths_imported\"}",
|
||||
"expr": "fuzzing{type=\"corpus_imported\"}",
|
||||
"interval": "",
|
||||
"legendFormat": "",
|
||||
"refId": "A"
|
||||
@ -1447,7 +1447,7 @@
|
||||
}
|
||||
],
|
||||
"timeShift": null,
|
||||
"title": "Path Imported",
|
||||
"title": "Corpus Imported",
|
||||
"tooltip": {
|
||||
"shared": true,
|
||||
"sort": 0,
|
||||
|
||||
@ -26,7 +26,7 @@ StatsD allows you to receive and aggregate metrics from a wide range of
|
||||
applications and retransmit them to a backend of your choice.
|
||||
|
||||
From AFL++, StatsD can receive the following metrics:
|
||||
- cur_path
|
||||
- cur_item
|
||||
- cycle_done
|
||||
- cycles_wo_finds
|
||||
- edges_found
|
||||
@ -34,18 +34,18 @@ From AFL++, StatsD can receive the following metrics:
|
||||
- execs_per_sec
|
||||
- havoc_expansion
|
||||
- max_depth
|
||||
- paths_favored
|
||||
- paths_found
|
||||
- paths_imported
|
||||
- paths_total
|
||||
- corpus_favored
|
||||
- corpus_found
|
||||
- corpus_imported
|
||||
- corpus_count
|
||||
- pending_favs
|
||||
- pending_total
|
||||
- slowest_exec_ms
|
||||
- total_crashes
|
||||
- unique_crashes
|
||||
- unique_hangs
|
||||
- saved_crashes
|
||||
- saved_hangs
|
||||
- var_byte_count
|
||||
- variable_paths
|
||||
- corpus_variable
|
||||
|
||||
Depending on your StatsD server, you will be able to monitor, trigger alerts, or
|
||||
perform actions based on these metrics (for example: alert on slow exec/s for a
|
||||
|
||||
@ -45,7 +45,83 @@ static gboolean instrument_coverage_in_range(gssize offset) {
|
||||
|
||||
}
|
||||
|
||||
#pragma pack(push, 1)
|
||||
#ifdef __APPLE__
|
||||
#pragma pack(push, 1)
|
||||
|
||||
typedef struct {
|
||||
|
||||
// cur_location = (block_address >> 4) ^ (block_address << 8);
|
||||
// shared_mem[cur_location ^ prev_location]++;
|
||||
// prev_location = cur_location >> 1;
|
||||
|
||||
// mov QWORD PTR [rsp-0x80],rax
|
||||
// lahf
|
||||
// mov QWORD PTR [rsp-0x88],rax
|
||||
// mov QWORD PTR [rsp-0x90],rbx
|
||||
// mov eax,DWORD PTR [rip+0x333d5a] # 0x7ffff6ff2740
|
||||
// mov DWORD PTR [rip+0x333d3c],0x9fbb # 0x7ffff6ff2740
|
||||
// lea rax,[rip + 0x103f77]
|
||||
// mov bl,BYTE PTR [rax]
|
||||
// add bl,0x1
|
||||
// adc bl,0x0
|
||||
// mov BYTE PTR [rax],bl
|
||||
// mov rbx,QWORD PTR [rsp-0x90]
|
||||
// mov rax,QWORD PTR [rsp-0x88]
|
||||
// sahf
|
||||
// mov rax,QWORD PTR [rsp-0x80]
|
||||
|
||||
uint8_t mov_rax_rsp_88[8];
|
||||
uint8_t lahf;
|
||||
uint8_t mov_rax_rsp_90[8];
|
||||
uint8_t mov_rbx_rsp_98[8];
|
||||
|
||||
uint8_t mov_eax_prev_loc[6];
|
||||
uint8_t mov_prev_loc_curr_loc_shr1[10];
|
||||
|
||||
uint8_t leax_eax_curr_loc[7];
|
||||
|
||||
uint8_t mov_rbx_ptr_rax[2];
|
||||
uint8_t add_bl_1[3];
|
||||
uint8_t adc_bl_0[3];
|
||||
uint8_t mov_ptr_rax_rbx[2];
|
||||
|
||||
uint8_t mov_rsp_98_rbx[8];
|
||||
uint8_t mov_rsp_90_rax[8];
|
||||
uint8_t sahf;
|
||||
uint8_t mov_rsp_88_rax[8];
|
||||
|
||||
} afl_log_code_asm_t;
|
||||
|
||||
#pragma pack(pop)
|
||||
|
||||
static const afl_log_code_asm_t template =
|
||||
{
|
||||
|
||||
.mov_rax_rsp_88 = {0x48, 0x89, 0x84, 0x24, 0x78, 0xFF, 0xFF, 0xFF},
|
||||
.lahf = 0x9f,
|
||||
.mov_rax_rsp_90 = {0x48, 0x89, 0x84, 0x24, 0x70, 0xFF, 0xFF, 0xFF},
|
||||
.mov_rbx_rsp_98 = {0x48, 0x89, 0x9C, 0x24, 0x68, 0xFF, 0xFF, 0xFF},
|
||||
|
||||
.mov_eax_prev_loc = {0x8b, 0x05},
|
||||
.mov_prev_loc_curr_loc_shr1 = {0xc7, 0x05},
|
||||
|
||||
.leax_eax_curr_loc = {0x48, 0x8d, 0x05},
|
||||
.mov_rbx_ptr_rax = {0x8a, 0x18},
|
||||
.add_bl_1 = {0x80, 0xc3, 0x01},
|
||||
.adc_bl_0 = {0x80, 0xd3, 0x00},
|
||||
.mov_ptr_rax_rbx = {0x88, 0x18},
|
||||
|
||||
.mov_rsp_98_rbx = {0x48, 0x8B, 0x9C, 0x24, 0x68, 0xFF, 0xFF, 0xFF},
|
||||
.mov_rsp_90_rax = {0x48, 0x8B, 0x84, 0x24, 0x70, 0xFF, 0xFF, 0xFF},
|
||||
.sahf = 0x9e,
|
||||
.mov_rsp_88_rax = {0x48, 0x8B, 0x84, 0x24, 0x78, 0xFF, 0xFF, 0xFF},
|
||||
|
||||
}
|
||||
|
||||
;
|
||||
|
||||
#else
|
||||
#pragma pack(push, 1)
|
||||
typedef struct {
|
||||
|
||||
// cur_location = (block_address >> 4) ^ (block_address << 8);
|
||||
@ -90,14 +166,7 @@ typedef struct {
|
||||
|
||||
} afl_log_code_asm_t;
|
||||
|
||||
#pragma pack(pop)
|
||||
|
||||
typedef union {
|
||||
|
||||
afl_log_code_asm_t code;
|
||||
uint8_t bytes[0];
|
||||
|
||||
} afl_log_code;
|
||||
#pragma pack(pop)
|
||||
|
||||
static const afl_log_code_asm_t template =
|
||||
{
|
||||
@ -124,6 +193,22 @@ static const afl_log_code_asm_t template =
|
||||
}
|
||||
|
||||
;
|
||||
#endif
|
||||
|
||||
typedef union {
|
||||
|
||||
afl_log_code_asm_t code;
|
||||
uint8_t bytes[0];
|
||||
|
||||
} afl_log_code;
|
||||
|
||||
#ifdef __APPLE__
|
||||
|
||||
void instrument_coverage_optimize_init(void) {
|
||||
|
||||
}
|
||||
|
||||
#else
|
||||
|
||||
static gboolean instrument_coverage_find_low(const GumRangeDetails *details,
|
||||
gpointer user_data) {
|
||||
@ -181,10 +266,10 @@ static void instrument_coverage_optimize_map_mmap(char * shm_file_path,
|
||||
|
||||
__afl_area_ptr = NULL;
|
||||
|
||||
#if !defined(__ANDROID__)
|
||||
#if !defined(__ANDROID__)
|
||||
shm_fd = shm_open(shm_file_path, O_RDWR, DEFAULT_PERMISSION);
|
||||
if (shm_fd == -1) { FATAL("shm_open() failed\n"); }
|
||||
#else
|
||||
#else
|
||||
shm_fd = open("/dev/ashmem", O_RDWR);
|
||||
if (shm_fd == -1) { FATAL("open() failed\n"); }
|
||||
if (ioctl(shm_fd, ASHMEM_SET_NAME, shm_file_path) == -1) {
|
||||
@ -199,7 +284,7 @@ static void instrument_coverage_optimize_map_mmap(char * shm_file_path,
|
||||
|
||||
}
|
||||
|
||||
#endif
|
||||
#endif
|
||||
|
||||
__afl_area_ptr = mmap(address, __afl_map_size, PROT_READ | PROT_WRITE,
|
||||
MAP_FIXED_NOREPLACE | MAP_SHARED, shm_fd, 0);
|
||||
@ -231,51 +316,6 @@ static void instrument_coverage_optimize_map_shm(guint64 shm_env_val,
|
||||
|
||||
}
|
||||
|
||||
static void instrument_coverage_switch(GumStalkerObserver *self,
|
||||
gpointer start_address,
|
||||
const cs_insn * from_insn,
|
||||
gpointer * target) {
|
||||
|
||||
UNUSED_PARAMETER(self);
|
||||
UNUSED_PARAMETER(start_address);
|
||||
|
||||
cs_x86 * x86;
|
||||
cs_x86_op *op;
|
||||
if (from_insn == NULL) { return; }
|
||||
|
||||
x86 = &from_insn->detail->x86;
|
||||
op = x86->operands;
|
||||
|
||||
if (!g_hash_table_contains(coverage_blocks, GSIZE_TO_POINTER(*target))) {
|
||||
|
||||
return;
|
||||
|
||||
}
|
||||
|
||||
switch (from_insn->id) {
|
||||
|
||||
case X86_INS_CALL:
|
||||
case X86_INS_JMP:
|
||||
if (x86->op_count != 1) {
|
||||
|
||||
FATAL("Unexpected operand count: %d", x86->op_count);
|
||||
|
||||
}
|
||||
|
||||
if (op[0].type != X86_OP_IMM) { return; }
|
||||
|
||||
break;
|
||||
case X86_INS_RET:
|
||||
break;
|
||||
default:
|
||||
return;
|
||||
|
||||
}
|
||||
|
||||
*target = (guint8 *)*target + sizeof(afl_log_code);
|
||||
|
||||
}
|
||||
|
||||
void instrument_coverage_optimize_init(void) {
|
||||
|
||||
gpointer low_address = NULL;
|
||||
@ -322,6 +362,53 @@ void instrument_coverage_optimize_init(void) {
|
||||
FOKF("__afl_area_ptr: %p", __afl_area_ptr);
|
||||
FOKF("instrument_previous_pc: %p", &instrument_previous_pc);
|
||||
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
static void instrument_coverage_switch(GumStalkerObserver *self,
|
||||
gpointer start_address,
|
||||
const cs_insn * from_insn,
|
||||
gpointer * target) {
|
||||
|
||||
UNUSED_PARAMETER(self);
|
||||
UNUSED_PARAMETER(start_address);
|
||||
|
||||
cs_x86 * x86;
|
||||
cs_x86_op *op;
|
||||
if (from_insn == NULL) { return; }
|
||||
|
||||
x86 = &from_insn->detail->x86;
|
||||
op = x86->operands;
|
||||
|
||||
if (!g_hash_table_contains(coverage_blocks, GSIZE_TO_POINTER(*target))) {
|
||||
|
||||
return;
|
||||
|
||||
}
|
||||
|
||||
switch (from_insn->id) {
|
||||
|
||||
case X86_INS_CALL:
|
||||
case X86_INS_JMP:
|
||||
if (x86->op_count != 1) {
|
||||
|
||||
FATAL("Unexpected operand count: %d", x86->op_count);
|
||||
|
||||
}
|
||||
|
||||
if (op[0].type != X86_OP_IMM) { return; }
|
||||
|
||||
break;
|
||||
case X86_INS_RET:
|
||||
break;
|
||||
default:
|
||||
return;
|
||||
|
||||
}
|
||||
|
||||
*target = (guint8 *)*target + sizeof(afl_log_code);
|
||||
|
||||
}
|
||||
|
||||
static void instrument_coverage_suppress_init(void) {
|
||||
@ -405,12 +492,35 @@ void instrument_coverage_optimize(const cs_insn * instr,
|
||||
|
||||
*((gint *)&code.bytes[prev_loc_value_offset2]) = (gint)prev_loc_value2;
|
||||
|
||||
#ifdef __APPLE__
|
||||
|
||||
gssize xor_curr_loc_offset = offsetof(afl_log_code, code.leax_eax_curr_loc) +
|
||||
sizeof(code.code.leax_eax_curr_loc) -
|
||||
sizeof(guint32);
|
||||
|
||||
gssize xor_curr_loc_value =
|
||||
((GPOINTER_TO_SIZE(__afl_area_ptr) | area_offset) -
|
||||
(code_addr + offsetof(afl_log_code, code.mov_eax_prev_loc) +
|
||||
sizeof(code.code.mov_eax_prev_loc)));
|
||||
|
||||
if (!instrument_coverage_in_range(xor_curr_loc_value)) {
|
||||
|
||||
FATAL("Patch out of range (xor_curr_loc_value): 0x%016lX",
|
||||
xor_curr_loc_value);
|
||||
|
||||
}
|
||||
|
||||
*((guint32 *)&code.bytes[xor_curr_loc_offset]) = xor_curr_loc_value;
|
||||
|
||||
#else
|
||||
|
||||
gssize xor_curr_loc_offset = offsetof(afl_log_code, code.xor_eax_curr_loc) +
|
||||
sizeof(code.code.xor_eax_curr_loc) -
|
||||
sizeof(guint32);
|
||||
|
||||
*((guint32 *)&code.bytes[xor_curr_loc_offset]) =
|
||||
(guint32)(GPOINTER_TO_SIZE(__afl_area_ptr) | area_offset);
|
||||
#endif
|
||||
|
||||
gum_x86_writer_put_bytes(cw, code.bytes, sizeof(afl_log_code));
|
||||
|
||||
|
||||
172
frida_mode/test/libxml/GNUmakefile
Normal file
172
frida_mode/test/libxml/GNUmakefile
Normal file
@ -0,0 +1,172 @@
|
||||
PWD:=$(shell pwd)/
|
||||
ROOT:=$(PWD)../../../
|
||||
BUILD_DIR:=$(PWD)build/
|
||||
|
||||
AFLPP_FRIDA_DRIVER_HOOK_OBJ=$(ROOT)frida_mode/build/frida_hook.so
|
||||
AFLPP_QEMU_DRIVER_HOOK_OBJ=$(ROOT)frida_mode/build/qemu_hook.so
|
||||
|
||||
LIBXML_GIT_REPO:=https://gitlab.gnome.org/GNOME/libxml2.git
|
||||
LIBXML_DIR:=$(BUILD_DIR)libxml/
|
||||
LIBXML_BIN:=$(LIBXML_DIR).libs/libxml2.a
|
||||
|
||||
TARGET_URL:=https://raw.githubusercontent.com/google/fuzzbench/master/benchmarks/libxml2-v2.9.2/target.cc
|
||||
TARGET_SRC:=$(BUILD_DIR)target.cc
|
||||
TARGET_OBJ:=$(BUILD_DIR)target.o
|
||||
|
||||
HARNESS_URL:="https://raw.githubusercontent.com/llvm/llvm-project/main/compiler-rt/lib/fuzzer/standalone/StandaloneFuzzTargetMain.c"
|
||||
HARNESS_SRC:=$(BUILD_DIR)StandaloneFuzzTargetMain.c
|
||||
HARNESS_OBJ:=$(BUILD_DIR)StandaloneFuzzTargetMain.o
|
||||
|
||||
TEST_BIN:=$(BUILD_DIR)test
|
||||
|
||||
ifeq "$(shell uname)" "Darwin"
|
||||
TEST_BIN_LDFLAGS:=-undefined dynamic_lookup -Wl,-no_pie
|
||||
endif
|
||||
|
||||
TEST_DATA_DIR:=$(BUILD_DIR)in/
|
||||
TEST_DATA_FILE:=$(TEST_DATA_DIR)default_seed
|
||||
DUMMY_DATA_FILE:=$(BUILD_DIR)dummy.dat
|
||||
|
||||
FRIDA_OUT:=$(BUILD_DIR)frida-out
|
||||
QEMU_OUT:=$(BUILD_DIR)qemu-out
|
||||
|
||||
ifndef ARCH
|
||||
|
||||
ARCH=$(shell uname -m)
|
||||
ifeq "$(ARCH)" "aarch64"
|
||||
ARCH:=arm64
|
||||
endif
|
||||
|
||||
ifeq "$(ARCH)" "i686"
|
||||
ARCH:=x86
|
||||
endif
|
||||
endif
|
||||
|
||||
GET_SYMBOL_ADDR:=$(ROOT)frida_mode/util/get_symbol_addr.sh
|
||||
|
||||
AFL_QEMU_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x4000000000)
|
||||
|
||||
ifeq "$(ARCH)" "aarch64"
|
||||
AFL_FRIDA_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x0000aaaaaaaaa000)
|
||||
endif
|
||||
|
||||
ifeq "$(ARCH)" "x86_64"
|
||||
AFL_FRIDA_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x0000555555554000)
|
||||
endif
|
||||
|
||||
ifeq "$(ARCH)" "x86"
|
||||
AFL_FRIDA_PERSISTENT_ADDR=$(shell $(GET_SYMBOL_ADDR) $(TEST_BIN) LLVMFuzzerTestOneInput 0x56555000)
|
||||
endif
|
||||
|
||||
.PHONY: all clean frida hook
|
||||
|
||||
all: $(TEST_BIN)
|
||||
make -C $(ROOT)frida_mode/
|
||||
|
||||
32:
|
||||
CXXFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
|
||||
|
||||
$(BUILD_DIR):
|
||||
mkdir -p $@
|
||||
|
||||
########## LIBXML #######
|
||||
|
||||
$(LIBXML_DIR): | $(BUILD_DIR)
|
||||
git clone --depth 1 $(LIBXML_GIT_REPO) $@
|
||||
|
||||
$(LIBXML_BIN): | $(LIBXML_DIR)
|
||||
cd $(LIBXML_DIR) && git fetch --tags
|
||||
cd $(LIBXML_DIR) && git checkout -f v2.9.2
|
||||
cd $(LIBXML_DIR) && ./autogen.sh
|
||||
cd $(LIBXML_DIR) && CCLD="$CXX $CXXFLAGS" ./configure --without-python --with-threads=no \
|
||||
--with-zlib=no --with-lzma=no
|
||||
cd $(LIBXML_DIR) && make
|
||||
|
||||
libxml: $(LIBXML_BIN)
|
||||
|
||||
########## TARGET #######
|
||||
|
||||
$(TARGET_SRC):
|
||||
wget -O $@ $(TARGET_URL)
|
||||
|
||||
$(TARGET_OBJ): $(TARGET_SRC) $(LIBXML_BIN)
|
||||
$(CXX) \
|
||||
$(CXXFLAGS) \
|
||||
-std=c++11 \
|
||||
-I $(LIBXML_DIR)include \
|
||||
-c $< \
|
||||
-o $@
|
||||
|
||||
target: $(TARGET_OBJ)
|
||||
|
||||
|
||||
######### HARNESS ########
|
||||
$(HARNESS_SRC): | $(BUILD_DIR)
|
||||
wget -O $@ $(HARNESS_URL)
|
||||
|
||||
$(HARNESS_OBJ): $(HARNESS_SRC)
|
||||
$(CC) $(CXXFLAGS) $(LDFLAGS) -o $@ -c $<
|
||||
|
||||
harness: $(HARNESS_OBJ)
|
||||
|
||||
######### TEST ########
|
||||
|
||||
$(TEST_BIN): $(HARNESS_OBJ) $(TARGET_OBJ) $(LIBXML_BIN)
|
||||
$(CXX) \
|
||||
$(CFLAGS) \
|
||||
-o $@ \
|
||||
$(HARNESS_OBJ) \
|
||||
$(TARGET_OBJ) \
|
||||
$(LIBXML_BIN) \
|
||||
$(LDFLAGS) \
|
||||
$(TEST_BIN_LDFLAGS) \
|
||||
|
||||
test: $(TEST_BIN)
|
||||
|
||||
########## DUMMY #######
|
||||
|
||||
$(DUMMY_DATA_FILE): | $(BUILD_DIR)
|
||||
dd if=/dev/zero bs=1048576 count=1 of=$@
|
||||
|
||||
###### TEST DATA #######
|
||||
|
||||
$(TEST_DATA_DIR): | $(BUILD_DIR)
|
||||
mkdir -p $@
|
||||
|
||||
$(TEST_DATA_FILE): | $(TEST_DATA_DIR)
|
||||
dd if=/dev/zero bs=1048576 count=1 of=$@
|
||||
|
||||
###### #######
|
||||
|
||||
clean:
|
||||
rm -rf $(BUILD_DIR)
|
||||
|
||||
frida: $(TEST_BIN) $(AFLPP_FRIDA_DRIVER_HOOK_OBJ) $(TEST_DATA_FILE) $(DUMMY_DATA_FILE)
|
||||
AFL_FRIDA_PERSISTENT_CNT=1000000 \
|
||||
AFL_FRIDA_PERSISTENT_HOOK=$(AFLPP_FRIDA_DRIVER_HOOK_OBJ) \
|
||||
AFL_FRIDA_PERSISTENT_ADDR=$(AFL_FRIDA_PERSISTENT_ADDR) \
|
||||
AFL_ENTRYPOINT=$(AFL_FRIDA_PERSISTENT_ADDR) \
|
||||
$(ROOT)afl-fuzz \
|
||||
-i $(TEST_DATA_DIR) \
|
||||
-o $(FRIDA_OUT) \
|
||||
-m none \
|
||||
-d \
|
||||
-O \
|
||||
-V 30 \
|
||||
-- \
|
||||
$(TEST_BIN) $(DUMMY_DATA_FILE)
|
||||
|
||||
qemu: $(TEST_BIN) $(AFLPP_QEMU_DRIVER_HOOK_OBJ) $(TEST_DATA_FILE) $(DUMMY_DATA_FILE)
|
||||
AFL_QEMU_PERSISTENT_CNT=1000000 \
|
||||
AFL_QEMU_PERSISTENT_HOOK=$(AFLPP_QEMU_DRIVER_HOOK_OBJ) \
|
||||
AFL_QEMU_PERSISTENT_ADDR=$(AFL_QEMU_PERSISTENT_ADDR) \
|
||||
AFL_ENTRYPOINT=$(AFL_QEMU_PERSISTENT_ADDR) \
|
||||
$(ROOT)afl-fuzz \
|
||||
-i $(TEST_DATA_DIR) \
|
||||
-o $(QEMU_OUT) \
|
||||
-m none \
|
||||
-d \
|
||||
-Q \
|
||||
-V 30 \
|
||||
-- \
|
||||
$(TEST_BIN) $(DUMMY_DATA_FILE)
|
||||
13
frida_mode/test/libxml/Makefile
Normal file
13
frida_mode/test/libxml/Makefile
Normal file
@ -0,0 +1,13 @@
|
||||
all:
|
||||
@echo trying to use GNU make...
|
||||
@gmake all || echo please install GNUmake
|
||||
|
||||
32:
|
||||
@echo trying to use GNU make...
|
||||
@gmake 32 || echo please install GNUmake
|
||||
|
||||
clean:
|
||||
@gmake clean
|
||||
|
||||
frida:
|
||||
@gmake frida
|
||||
36
frida_mode/test/libxml/get_symbol_addr.py
Executable file
36
frida_mode/test/libxml/get_symbol_addr.py
Executable file
@ -0,0 +1,36 @@
|
||||
#!/usr/bin/python3
|
||||
import argparse
|
||||
from elftools.elf.elffile import ELFFile
|
||||
|
||||
def process_file(file, symbol, base):
|
||||
with open(file, 'rb') as f:
|
||||
elf = ELFFile(f)
|
||||
symtab = elf.get_section_by_name('.symtab')
|
||||
mains = symtab.get_symbol_by_name(symbol)
|
||||
if len(mains) != 1:
|
||||
print ("Failed to find main")
|
||||
return 1
|
||||
|
||||
main_addr = mains[0]['st_value']
|
||||
main = base + main_addr
|
||||
print ("0x%016x" % main)
|
||||
return 0
|
||||
|
||||
def hex_value(x):
|
||||
return int(x, 16)
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description='Process some integers.')
|
||||
parser.add_argument('-f', '--file', dest='file', type=str,
|
||||
help='elf file name', required=True)
|
||||
parser.add_argument('-s', '--symbol', dest='symbol', type=str,
|
||||
help='symbol name', required=True)
|
||||
parser.add_argument('-b', '--base', dest='base', type=hex_value,
|
||||
help='elf base address', required=True)
|
||||
|
||||
args = parser.parse_args()
|
||||
return process_file (args.file, args.symbol, args.base)
|
||||
|
||||
if __name__ == "__main__":
|
||||
ret = main()
|
||||
exit(ret)
|
||||
@ -527,7 +527,7 @@ typedef struct afl_state {
|
||||
|
||||
double *alias_probability; /* alias weighted probabilities */
|
||||
u32 * alias_table; /* alias weighted random lookup table */
|
||||
u32 active_paths; /* enabled entries in the queue */
|
||||
u32 active_items; /* enabled entries in the queue */
|
||||
|
||||
u8 *var_bytes; /* Bytes that appear to be variable */
|
||||
|
||||
@ -537,7 +537,7 @@ typedef struct afl_state {
|
||||
volatile u8 stop_soon, /* Ctrl-C pressed? */
|
||||
clear_screen; /* Window resized? */
|
||||
|
||||
u32 queued_paths, /* Total number of queued testcases */
|
||||
u32 queued_items, /* Total number of queued testcases */
|
||||
queued_variable, /* Testcases with variable behavior */
|
||||
queued_at_start, /* Total number of initial inputs */
|
||||
queued_discovered, /* Items discovered during this run */
|
||||
@ -546,7 +546,7 @@ typedef struct afl_state {
|
||||
queued_with_cov, /* Paths with new coverage bytes */
|
||||
pending_not_fuzzed, /* Queued but not done yet */
|
||||
pending_favored, /* Pending favored paths */
|
||||
cur_skipped_paths, /* Abandoned inputs in cur cycle */
|
||||
cur_skipped_items, /* Abandoned inputs in cur cycle */
|
||||
cur_depth, /* Current path depth */
|
||||
max_depth, /* Max path depth */
|
||||
useless_at_start, /* Number of useless starting paths */
|
||||
@ -556,10 +556,10 @@ typedef struct afl_state {
|
||||
max_det_extras; /* deterministic extra count (dicts)*/
|
||||
|
||||
u64 total_crashes, /* Total number of crashes */
|
||||
unique_crashes, /* Crashes with unique signatures */
|
||||
saved_crashes, /* Crashes with unique signatures */
|
||||
total_tmouts, /* Total number of timeouts */
|
||||
unique_tmouts, /* Timeouts with unique signatures */
|
||||
unique_hangs, /* Hangs with unique signatures */
|
||||
saved_tmouts, /* Timeouts with unique signatures */
|
||||
saved_hangs, /* Hangs with unique signatures */
|
||||
last_crash_execs, /* Exec counter at last crash */
|
||||
queue_cycle, /* Queue round counter */
|
||||
cycles_wo_finds, /* Cycles without any new paths */
|
||||
@ -571,7 +571,7 @@ typedef struct afl_state {
|
||||
start_time, /* Unix start time (ms) */
|
||||
last_sync_time, /* Time of last sync */
|
||||
last_sync_cycle, /* Cycle no. of the last sync */
|
||||
last_path_time, /* Time for most recent path (ms) */
|
||||
last_find_time, /* Time for most recent path (ms) */
|
||||
last_crash_time, /* Time for most recent crash (ms) */
|
||||
last_hang_time, /* Time for most recent hang (ms) */
|
||||
exit_on_time; /* Delay to exit if no new paths */
|
||||
|
||||
@ -1010,7 +1010,7 @@ XXH128_hashFromCanonical(const XXH128_canonical_t *src);
|
||||
* These declarations should only be used with static linking.
|
||||
* Never use them in association with dynamic linking!
|
||||
*****************************************************************************
|
||||
*/
|
||||
*/
|
||||
|
||||
/*
|
||||
* These definitions are only present to allow static allocation
|
||||
@ -1435,9 +1435,9 @@ XXH_PUBLIC_API XXH128_hash_t XXH128(const void *data, size_t len,
|
||||
#define XXH_OLD_NAMES
|
||||
#undef XXH_OLD_NAMES /* don't actually use, it is ugly. */
|
||||
#endif /* XXH_DOXYGEN */
|
||||
/*!
|
||||
* @}
|
||||
*/
|
||||
/*!
|
||||
* @}
|
||||
*/
|
||||
|
||||
#ifndef XXH_FORCE_MEMORY_ACCESS /* can be defined externally, on command \
|
||||
line for example */
|
||||
@ -1601,6 +1601,7 @@ static void *XXH_memcpy(void *dest, const void *src, size_t size) {
|
||||
static_assert((c), m); \
|
||||
\
|
||||
} while (0)
|
||||
|
||||
#elif defined(__cplusplus) && (__cplusplus >= 201103L) /* C++11 */
|
||||
#define XXH_STATIC_ASSERT_WITH_MESSAGE(c, m) \
|
||||
do { \
|
||||
@ -1608,6 +1609,7 @@ static void *XXH_memcpy(void *dest, const void *src, size_t size) {
|
||||
static_assert((c), m); \
|
||||
\
|
||||
} while (0)
|
||||
|
||||
#else
|
||||
#define XXH_STATIC_ASSERT_WITH_MESSAGE(c, m) \
|
||||
do { \
|
||||
@ -1619,6 +1621,7 @@ static void *XXH_memcpy(void *dest, const void *src, size_t size) {
|
||||
}; \
|
||||
\
|
||||
} while (0)
|
||||
|
||||
#endif
|
||||
#define XXH_STATIC_ASSERT(c) XXH_STATIC_ASSERT_WITH_MESSAGE((c), #c)
|
||||
#endif
|
||||
@ -1830,7 +1833,7 @@ static int XXH_isLittleEndian(void) {
|
||||
return one.c[0];
|
||||
|
||||
}
|
||||
\
|
||||
|
||||
#define XXH_CPU_LITTLE_ENDIAN XXH_isLittleEndian()
|
||||
#endif
|
||||
#endif
|
||||
@ -2079,23 +2082,6 @@ static xxh_u32 XXH32_avalanche(xxh_u32 h32) {
|
||||
|
||||
#define XXH_get32bits(p) XXH_readLE32_align(p, align)
|
||||
|
||||
/*!
|
||||
* @internal
|
||||
* @brief Processes the last 0-15 bytes of @p ptr.
|
||||
*
|
||||
* There may be up to 15 bytes remaining to consume from the input.
|
||||
* This final stage will digest them to ensure that all input bytes are present
|
||||
* in the final mix.
|
||||
*
|
||||
* @param h32 The hash to finalize.
|
||||
* @param ptr The pointer to the remaining input.
|
||||
* @param len The remaining length, modulo 16.
|
||||
* @param align Whether @p ptr is aligned.
|
||||
* @return The finalized hash.
|
||||
*/
|
||||
static xxh_u32 XXH32_finalize(xxh_u32 h32, const xxh_u8 *ptr, size_t len,
|
||||
XXH_alignment align) {
|
||||
\
|
||||
#define XXH_PROCESS1 \
|
||||
do { \
|
||||
\
|
||||
@ -2113,6 +2099,23 @@ static xxh_u32 XXH32_finalize(xxh_u32 h32, const xxh_u8 *ptr, size_t len,
|
||||
\
|
||||
} while (0)
|
||||
|
||||
/*!
|
||||
* @internal
|
||||
* @brief Processes the last 0-15 bytes of @p ptr.
|
||||
*
|
||||
* There may be up to 15 bytes remaining to consume from the input.
|
||||
* This final stage will digest them to ensure that all input bytes are present
|
||||
* in the final mix.
|
||||
*
|
||||
* @param h32 The hash to finalize.
|
||||
* @param ptr The pointer to the remaining input.
|
||||
* @param len The remaining length, modulo 16.
|
||||
* @param align Whether @p ptr is aligned.
|
||||
* @return The finalized hash.
|
||||
*/
|
||||
static xxh_u32 XXH32_finalize(xxh_u32 h32, const xxh_u8 *ptr, size_t len,
|
||||
XXH_alignment align) {
|
||||
|
||||
/* Compact rerolled version */
|
||||
if (XXH_REROLL) {
|
||||
|
||||
@ -3385,6 +3388,7 @@ enum XXH_VECTOR_TYPE /* fake enum */ {
|
||||
(outHi) = vget_high_u32(vreinterpretq_u32_u64(in)); \
|
||||
\
|
||||
} while (0)
|
||||
|
||||
#else
|
||||
#define XXH_SPLIT_IN_PLACE(in, outLo, outHi) \
|
||||
do { \
|
||||
@ -3393,6 +3397,7 @@ enum XXH_VECTOR_TYPE /* fake enum */ {
|
||||
(outHi) = vshrn_n_u64((in), 32); \
|
||||
\
|
||||
} while (0)
|
||||
|
||||
#endif
|
||||
#endif /* XXH_VECTOR == XXH_NEON */
|
||||
|
||||
|
||||
@ -11,12 +11,11 @@ see
|
||||
## Build
|
||||
|
||||
To use CmpLog, you have to build two versions of the instrumented target
|
||||
program.
|
||||
program:
|
||||
|
||||
The first version is built using the regular AFL++ instrumentation.
|
||||
|
||||
The second one, the CmpLog binary, is built with setting AFL_LLVM_CMPLOG during
|
||||
the compilation.
|
||||
* The first version is built using the regular AFL++ instrumentation.
|
||||
* The second one, the CmpLog binary, is built with setting `AFL_LLVM_CMPLOG`
|
||||
during the compilation.
|
||||
|
||||
For example:
|
||||
|
||||
|
||||
@ -1,7 +1,8 @@
|
||||
# GCC-based instrumentation for afl-fuzz
|
||||
|
||||
For the general instruction manual, see [../README.md](../README.md). For the
|
||||
LLVM-based instrumentation, see [README.llvm.md](README.llvm.md).
|
||||
For the general instruction manual, see [docs/README.md](../docs/README.md).
|
||||
|
||||
For the LLVM-based instrumentation, see [README.llvm.md](README.llvm.md).
|
||||
|
||||
This document describes how to build and use `afl-gcc-fast` and `afl-g++-fast`,
|
||||
which instrument the target with the help of gcc plugins.
|
||||
|
||||
@ -39,13 +39,11 @@ AFL_LLVM_LAF_SPLIT_COMPARES_BITW=<bit_width>`, where bit_width may be 64, 32, or
|
||||
16. For example, a bit_width of 16 would split larger comparisons down to 16 bit
|
||||
comparisons.
|
||||
|
||||
A new experimental feature is splitting floating point comparisons into a series
|
||||
A new unique feature is splitting floating point comparisons into a series
|
||||
of sign, exponent and mantissa comparisons followed by splitting each of them
|
||||
into 8 bit comparisons when necessary. It is activated with the
|
||||
`AFL_LLVM_LAF_SPLIT_FLOATS` setting. Note that full IEEE 754 functionality is
|
||||
not preserved, that is values of nan and infinity will probably behave
|
||||
differently.
|
||||
`AFL_LLVM_LAF_SPLIT_FLOATS` setting.
|
||||
|
||||
Note that setting this automatically activates `AFL_LLVM_LAF_SPLIT_COMPARES`.
|
||||
|
||||
You can also set `AFL_LLVM_LAF_ALL` and have all of the above enabled. :-)
|
||||
You can also set `AFL_LLVM_LAF_ALL` and have all of the above enabled. :-)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
# Fast LLVM-based instrumentation for afl-fuzz
|
||||
|
||||
For the general instruction manual, see [../README.md](../README.md).
|
||||
For the general instruction manual, see [docs/README.md](../docs/README.md).
|
||||
|
||||
For the GCC-based instrumentation, see
|
||||
[README.gcc_plugin.md](README.gcc_plugin.md).
|
||||
|
||||
@ -1123,7 +1123,7 @@ bool ModuleSanitizerCoverage::instrumentModule(
|
||||
M, PointerType::get(Int8Tyi, 0), false,
|
||||
GlobalValue::ExternalLinkage, 0, "__afl_dictionary");
|
||||
|
||||
Value *AFLDictOff = IRB.CreateGEP(AFLInternalDictionary, Zero);
|
||||
Value *AFLDictOff = IRB.CreateGEP(Int8Ty, AFLInternalDictionary, Zero);
|
||||
Value *AFLDictPtr =
|
||||
IRB.CreatePointerCast(AFLDictOff, PointerType::get(Int8Tyi, 0));
|
||||
StoreInst *StoreDict = IRB.CreateStore(AFLDictPtr, AFLDictionary);
|
||||
@ -1388,7 +1388,8 @@ void ModuleSanitizerCoverage::instrumentFunction(
|
||||
local_selects++;
|
||||
uint32_t vector_cur = 0;
|
||||
/* Load SHM pointer */
|
||||
LoadInst *MapPtr = IRB.CreateLoad(AFLMapPtr);
|
||||
LoadInst *MapPtr =
|
||||
IRB.CreateLoad(PointerType::get(Int8Ty, 0), AFLMapPtr);
|
||||
ModuleSanitizerCoverage::SetNoSanitizeMetadata(MapPtr);
|
||||
|
||||
while (1) {
|
||||
@ -1399,12 +1400,12 @@ void ModuleSanitizerCoverage::instrumentFunction(
|
||||
/* Load counter for CurLoc */
|
||||
if (!vector_cnt) {
|
||||
|
||||
MapPtrIdx = IRB.CreateGEP(MapPtr, result);
|
||||
MapPtrIdx = IRB.CreateGEP(Int8Ty, MapPtr, result);
|
||||
|
||||
} else {
|
||||
|
||||
auto element = IRB.CreateExtractElement(result, vector_cur++);
|
||||
MapPtrIdx = IRB.CreateGEP(MapPtr, element);
|
||||
MapPtrIdx = IRB.CreateGEP(Int8Ty, MapPtr, element);
|
||||
|
||||
}
|
||||
|
||||
@ -1418,7 +1419,7 @@ void ModuleSanitizerCoverage::instrumentFunction(
|
||||
|
||||
} else {
|
||||
|
||||
LoadInst *Counter = IRB.CreateLoad(MapPtrIdx);
|
||||
LoadInst *Counter = IRB.CreateLoad(IRB.getInt8Ty(), MapPtrIdx);
|
||||
ModuleSanitizerCoverage::SetNoSanitizeMetadata(Counter);
|
||||
|
||||
/* Update bitmap */
|
||||
@ -1672,13 +1673,13 @@ void ModuleSanitizerCoverage::InjectCoverageAtBlock(Function &F, BasicBlock &BB,
|
||||
|
||||
if (map_addr) {
|
||||
|
||||
MapPtrIdx = IRB.CreateGEP(MapPtrFixed, CurLoc);
|
||||
MapPtrIdx = IRB.CreateGEP(Int8Ty, MapPtrFixed, CurLoc);
|
||||
|
||||
} else {
|
||||
|
||||
LoadInst *MapPtr = IRB.CreateLoad(AFLMapPtr);
|
||||
LoadInst *MapPtr = IRB.CreateLoad(PointerType::get(Int8Ty, 0), AFLMapPtr);
|
||||
ModuleSanitizerCoverage::SetNoSanitizeMetadata(MapPtr);
|
||||
MapPtrIdx = IRB.CreateGEP(MapPtr, CurLoc);
|
||||
MapPtrIdx = IRB.CreateGEP(Int8Ty, MapPtr, CurLoc);
|
||||
|
||||
}
|
||||
|
||||
@ -1693,7 +1694,7 @@ void ModuleSanitizerCoverage::InjectCoverageAtBlock(Function &F, BasicBlock &BB,
|
||||
|
||||
} else {
|
||||
|
||||
LoadInst *Counter = IRB.CreateLoad(MapPtrIdx);
|
||||
LoadInst *Counter = IRB.CreateLoad(IRB.getInt8Ty(), MapPtrIdx);
|
||||
ModuleSanitizerCoverage::SetNoSanitizeMetadata(Counter);
|
||||
|
||||
Value *Incr = IRB.CreateAdd(Counter, One);
|
||||
|
||||
@ -937,7 +937,7 @@ bool ModuleSanitizerCoverage::InjectCoverage(Function & F,
|
||||
ConstantInt::get(IntptrTy, (++special + AllBlocks.size()) * 4)),
|
||||
Int32PtrTy);
|
||||
|
||||
LoadInst *Idx = IRB.CreateLoad(GuardPtr);
|
||||
LoadInst *Idx = IRB.CreateLoad(IRB.getInt32Ty(), GuardPtr);
|
||||
ModuleSanitizerCoverage::SetNoSanitizeMetadata(Idx);
|
||||
|
||||
callInst->setOperand(1, Idx);
|
||||
@ -1059,7 +1059,8 @@ bool ModuleSanitizerCoverage::InjectCoverage(Function & F,
|
||||
|
||||
/* Load SHM pointer */
|
||||
|
||||
LoadInst *MapPtr = IRB.CreateLoad(AFLMapPtr);
|
||||
LoadInst *MapPtr =
|
||||
IRB.CreateLoad(PointerType::get(Int8Ty, 0), AFLMapPtr);
|
||||
ModuleSanitizerCoverage::SetNoSanitizeMetadata(MapPtr);
|
||||
|
||||
/*
|
||||
@ -1078,17 +1079,17 @@ bool ModuleSanitizerCoverage::InjectCoverage(Function & F,
|
||||
/* Load counter for CurLoc */
|
||||
if (!vector_cnt) {
|
||||
|
||||
CurLoc = IRB.CreateLoad(result);
|
||||
CurLoc = IRB.CreateLoad(IRB.getInt32Ty(), result);
|
||||
ModuleSanitizerCoverage::SetNoSanitizeMetadata(CurLoc);
|
||||
MapPtrIdx = IRB.CreateGEP(MapPtr, CurLoc);
|
||||
MapPtrIdx = IRB.CreateGEP(Int8Ty, MapPtr, CurLoc);
|
||||
|
||||
} else {
|
||||
|
||||
auto element = IRB.CreateExtractElement(result, vector_cur++);
|
||||
auto elementptr = IRB.CreateIntToPtr(element, Int32PtrTy);
|
||||
auto elementld = IRB.CreateLoad(elementptr);
|
||||
auto elementld = IRB.CreateLoad(IRB.getInt32Ty(), elementptr);
|
||||
ModuleSanitizerCoverage::SetNoSanitizeMetadata(elementld);
|
||||
MapPtrIdx = IRB.CreateGEP(MapPtr, elementld);
|
||||
MapPtrIdx = IRB.CreateGEP(Int8Ty, MapPtr, elementld);
|
||||
|
||||
}
|
||||
|
||||
@ -1102,7 +1103,7 @@ bool ModuleSanitizerCoverage::InjectCoverage(Function & F,
|
||||
|
||||
} else {
|
||||
|
||||
LoadInst *Counter = IRB.CreateLoad(MapPtrIdx);
|
||||
LoadInst *Counter = IRB.CreateLoad(IRB.getInt8Ty(), MapPtrIdx);
|
||||
ModuleSanitizerCoverage::SetNoSanitizeMetadata(Counter);
|
||||
|
||||
/* Update bitmap */
|
||||
@ -1347,17 +1348,17 @@ void ModuleSanitizerCoverage::InjectCoverageAtBlock(Function &F, BasicBlock &BB,
|
||||
ConstantInt::get(IntptrTy, Idx * 4)),
|
||||
Int32PtrTy);
|
||||
|
||||
LoadInst *CurLoc = IRB.CreateLoad(GuardPtr);
|
||||
LoadInst *CurLoc = IRB.CreateLoad(IRB.getInt32Ty(), GuardPtr);
|
||||
ModuleSanitizerCoverage::SetNoSanitizeMetadata(CurLoc);
|
||||
|
||||
/* Load SHM pointer */
|
||||
|
||||
LoadInst *MapPtr = IRB.CreateLoad(AFLMapPtr);
|
||||
LoadInst *MapPtr = IRB.CreateLoad(PointerType::get(Int8Ty, 0), AFLMapPtr);
|
||||
ModuleSanitizerCoverage::SetNoSanitizeMetadata(MapPtr);
|
||||
|
||||
/* Load counter for CurLoc */
|
||||
|
||||
Value *MapPtrIdx = IRB.CreateGEP(MapPtr, CurLoc);
|
||||
Value *MapPtrIdx = IRB.CreateGEP(Int8Ty, MapPtr, CurLoc);
|
||||
|
||||
if (use_threadsafe_counters) {
|
||||
|
||||
@ -1369,7 +1370,7 @@ void ModuleSanitizerCoverage::InjectCoverageAtBlock(Function &F, BasicBlock &BB,
|
||||
|
||||
} else {
|
||||
|
||||
LoadInst *Counter = IRB.CreateLoad(MapPtrIdx);
|
||||
LoadInst *Counter = IRB.CreateLoad(IRB.getInt8Ty(), MapPtrIdx);
|
||||
ModuleSanitizerCoverage::SetNoSanitizeMetadata(Counter);
|
||||
|
||||
/* Update bitmap */
|
||||
|
||||
@ -454,7 +454,11 @@ bool AFLCoverage::runOnModule(Module &M) {
|
||||
#ifdef AFL_HAVE_VECTOR_INTRINSICS
|
||||
if (ctx_k) {
|
||||
|
||||
PrevCaller = IRB.CreateLoad(AFLPrevCaller);
|
||||
PrevCaller = IRB.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
IRB.getInt32Ty(),
|
||||
#endif
|
||||
AFLPrevCaller);
|
||||
PrevCaller->setMetadata(M.getMDKindID("nosanitize"),
|
||||
MDNode::get(C, None));
|
||||
PrevCtx =
|
||||
@ -467,7 +471,11 @@ bool AFLCoverage::runOnModule(Module &M) {
|
||||
|
||||
// load the context ID of the previous function and write to to a
|
||||
// local variable on the stack
|
||||
LoadInst *PrevCtxLoad = IRB.CreateLoad(AFLContext);
|
||||
LoadInst *PrevCtxLoad = IRB.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
IRB.getInt32Ty(),
|
||||
#endif
|
||||
AFLContext);
|
||||
PrevCtxLoad->setMetadata(M.getMDKindID("nosanitize"),
|
||||
MDNode::get(C, None));
|
||||
PrevCtx = PrevCtxLoad;
|
||||
@ -620,7 +628,11 @@ bool AFLCoverage::runOnModule(Module &M) {
|
||||
|
||||
/* Load prev_loc */
|
||||
|
||||
LoadInst *PrevLoc = IRB.CreateLoad(AFLPrevLoc);
|
||||
LoadInst *PrevLoc = IRB.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
IRB.getInt32Ty(),
|
||||
#endif
|
||||
AFLPrevLoc);
|
||||
PrevLoc->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
|
||||
Value *PrevLocTrans;
|
||||
|
||||
@ -644,20 +656,28 @@ bool AFLCoverage::runOnModule(Module &M) {
|
||||
|
||||
/* Load SHM pointer */
|
||||
|
||||
LoadInst *MapPtr = IRB.CreateLoad(AFLMapPtr);
|
||||
LoadInst *MapPtr = IRB.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
PointerType::get(Int8Ty, 0),
|
||||
#endif
|
||||
AFLMapPtr);
|
||||
MapPtr->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
|
||||
|
||||
Value *MapPtrIdx;
|
||||
#ifdef AFL_HAVE_VECTOR_INTRINSICS
|
||||
if (ngram_size)
|
||||
MapPtrIdx = IRB.CreateGEP(
|
||||
MapPtr,
|
||||
Int8Ty, MapPtr,
|
||||
IRB.CreateZExt(
|
||||
IRB.CreateXor(PrevLocTrans, IRB.CreateZExt(CurLoc, Int32Ty)),
|
||||
Int32Ty));
|
||||
else
|
||||
#endif
|
||||
MapPtrIdx = IRB.CreateGEP(MapPtr, IRB.CreateXor(PrevLocTrans, CurLoc));
|
||||
MapPtrIdx = IRB.CreateGEP(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
Int8Ty,
|
||||
#endif
|
||||
MapPtr, IRB.CreateXor(PrevLocTrans, CurLoc));
|
||||
|
||||
/* Update bitmap */
|
||||
|
||||
@ -676,7 +696,11 @@ bool AFLCoverage::runOnModule(Module &M) {
|
||||
|
||||
} else {
|
||||
|
||||
LoadInst *Counter = IRB.CreateLoad(MapPtrIdx);
|
||||
LoadInst *Counter = IRB.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
IRB.getInt8Ty(),
|
||||
#endif
|
||||
MapPtrIdx);
|
||||
Counter->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
|
||||
|
||||
Value *Incr = IRB.CreateAdd(Counter, One);
|
||||
@ -813,7 +837,11 @@ bool AFLCoverage::runOnModule(Module &M) {
|
||||
IRBuilder<> IRB(&(*it0));
|
||||
|
||||
// load the old counter value atomically
|
||||
LoadInst *Counter = IRB.CreateLoad(MapPtrIdx);
|
||||
LoadInst *Counter = IRB.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
IRB.getInt8Ty(),
|
||||
#endif
|
||||
MapPtrIdx);
|
||||
Counter->setAlignment(llvm::Align());
|
||||
Counter->setAtomic(llvm::AtomicOrdering::Monotonic);
|
||||
Counter->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
|
||||
|
||||
@ -264,7 +264,11 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
|
||||
|
||||
IRBuilder<> IRB2(selectcmpInst->getParent());
|
||||
IRB2.SetInsertPoint(selectcmpInst);
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(AFLCmplogPtr);
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
PointerType::get(Int8Ty, 0),
|
||||
#endif
|
||||
AFLCmplogPtr);
|
||||
CmpPtr->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
|
||||
auto is_not_null = IRB2.CreateICmpNE(CmpPtr, Null);
|
||||
auto ThenTerm =
|
||||
|
||||
@ -448,7 +448,11 @@ bool CmpLogRoutines::hookRtns(Module &M) {
|
||||
IRBuilder<> IRB2(callInst->getParent());
|
||||
IRB2.SetInsertPoint(callInst);
|
||||
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(AFLCmplogPtr);
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
PointerType::get(Int8Ty, 0),
|
||||
#endif
|
||||
AFLCmplogPtr);
|
||||
CmpPtr->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
|
||||
auto is_not_null = IRB2.CreateICmpNE(CmpPtr, Null);
|
||||
auto ThenTerm = SplitBlockAndInsertIfThen(is_not_null, callInst, false);
|
||||
@ -475,7 +479,11 @@ bool CmpLogRoutines::hookRtns(Module &M) {
|
||||
IRBuilder<> IRB2(callInst->getParent());
|
||||
IRB2.SetInsertPoint(callInst);
|
||||
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(AFLCmplogPtr);
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
PointerType::get(Int8Ty, 0),
|
||||
#endif
|
||||
AFLCmplogPtr);
|
||||
CmpPtr->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
|
||||
auto is_not_null = IRB2.CreateICmpNE(CmpPtr, Null);
|
||||
auto ThenTerm = SplitBlockAndInsertIfThen(is_not_null, callInst, false);
|
||||
@ -506,7 +514,11 @@ bool CmpLogRoutines::hookRtns(Module &M) {
|
||||
IRBuilder<> IRB2(callInst->getParent());
|
||||
IRB2.SetInsertPoint(callInst);
|
||||
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(AFLCmplogPtr);
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
PointerType::get(Int8Ty, 0),
|
||||
#endif
|
||||
AFLCmplogPtr);
|
||||
CmpPtr->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
|
||||
auto is_not_null = IRB2.CreateICmpNE(CmpPtr, Null);
|
||||
auto ThenTerm = SplitBlockAndInsertIfThen(is_not_null, callInst, false);
|
||||
@ -533,7 +545,11 @@ bool CmpLogRoutines::hookRtns(Module &M) {
|
||||
IRBuilder<> IRB2(callInst->getParent());
|
||||
IRB2.SetInsertPoint(callInst);
|
||||
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(AFLCmplogPtr);
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
PointerType::get(Int8Ty, 0),
|
||||
#endif
|
||||
AFLCmplogPtr);
|
||||
CmpPtr->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
|
||||
auto is_not_null = IRB2.CreateICmpNE(CmpPtr, Null);
|
||||
auto ThenTerm = SplitBlockAndInsertIfThen(is_not_null, callInst, false);
|
||||
@ -564,7 +580,11 @@ bool CmpLogRoutines::hookRtns(Module &M) {
|
||||
IRBuilder<> IRB2(callInst->getParent());
|
||||
IRB2.SetInsertPoint(callInst);
|
||||
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(AFLCmplogPtr);
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
PointerType::get(Int8Ty, 0),
|
||||
#endif
|
||||
AFLCmplogPtr);
|
||||
CmpPtr->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
|
||||
auto is_not_null = IRB2.CreateICmpNE(CmpPtr, Null);
|
||||
auto ThenTerm = SplitBlockAndInsertIfThen(is_not_null, callInst, false);
|
||||
@ -590,7 +610,11 @@ bool CmpLogRoutines::hookRtns(Module &M) {
|
||||
IRBuilder<> IRB2(callInst->getParent());
|
||||
IRB2.SetInsertPoint(callInst);
|
||||
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(AFLCmplogPtr);
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
PointerType::get(Int8Ty, 0),
|
||||
#endif
|
||||
AFLCmplogPtr);
|
||||
CmpPtr->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
|
||||
auto is_not_null = IRB2.CreateICmpNE(CmpPtr, Null);
|
||||
auto ThenTerm = SplitBlockAndInsertIfThen(is_not_null, callInst, false);
|
||||
@ -616,7 +640,11 @@ bool CmpLogRoutines::hookRtns(Module &M) {
|
||||
IRBuilder<> IRB2(callInst->getParent());
|
||||
IRB2.SetInsertPoint(callInst);
|
||||
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(AFLCmplogPtr);
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
PointerType::get(Int8Ty, 0),
|
||||
#endif
|
||||
AFLCmplogPtr);
|
||||
CmpPtr->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
|
||||
auto is_not_null = IRB2.CreateICmpNE(CmpPtr, Null);
|
||||
auto ThenTerm = SplitBlockAndInsertIfThen(is_not_null, callInst, false);
|
||||
@ -642,7 +670,11 @@ bool CmpLogRoutines::hookRtns(Module &M) {
|
||||
IRBuilder<> IRB2(callInst->getParent());
|
||||
IRB2.SetInsertPoint(callInst);
|
||||
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(AFLCmplogPtr);
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
PointerType::get(Int8Ty, 0),
|
||||
#endif
|
||||
AFLCmplogPtr);
|
||||
CmpPtr->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
|
||||
auto is_not_null = IRB2.CreateICmpNE(CmpPtr, Null);
|
||||
auto ThenTerm = SplitBlockAndInsertIfThen(is_not_null, callInst, false);
|
||||
|
||||
@ -246,7 +246,11 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
|
||||
IRBuilder<> IRB2(SI->getParent());
|
||||
IRB2.SetInsertPoint(SI);
|
||||
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(AFLCmplogPtr);
|
||||
LoadInst *CmpPtr = IRB2.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
PointerType::get(Int8Ty, 0),
|
||||
#endif
|
||||
AFLCmplogPtr);
|
||||
CmpPtr->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
|
||||
auto is_not_null = IRB2.CreateICmpNE(CmpPtr, Null);
|
||||
auto ThenTerm = SplitBlockAndInsertIfThen(is_not_null, SI, false);
|
||||
|
||||
@ -529,8 +529,16 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp,
|
||||
IRBuilder<> cur_cmp_IRB(&*(cur_cmp_bb->getFirstInsertionPt()));
|
||||
|
||||
Value *v = ConstantInt::get(Int64Ty, i);
|
||||
Value *ele = cur_cmp_IRB.CreateInBoundsGEP(VarStr, v, "empty");
|
||||
Value *load = cur_cmp_IRB.CreateLoad(ele);
|
||||
Value *ele = cur_cmp_IRB.CreateInBoundsGEP(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
Int8Ty,
|
||||
#endif
|
||||
VarStr, v, "empty");
|
||||
Value *load = cur_cmp_IRB.CreateLoad(
|
||||
#if LLVM_VERSION_MAJOR >= 14
|
||||
Int8Ty,
|
||||
#endif
|
||||
ele);
|
||||
|
||||
if (isCaseInsensitive) {
|
||||
|
||||
|
||||
@ -882,6 +882,7 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
|
||||
// BUG FIXME TODO: u64 does not work for > 64 bit ... e.g. 80 and 128 bit
|
||||
if (sizeInBits > 64) { continue; }
|
||||
|
||||
IntegerType * intType = IntegerType::get(C, op_size);
|
||||
const unsigned int precision = sizeInBits == 32 ? 24
|
||||
: sizeInBits == 64 ? 53
|
||||
: sizeInBits == 128 ? 113
|
||||
@ -913,14 +914,106 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
|
||||
BasicBlock *end_bb = bb->splitBasicBlock(BasicBlock::iterator(FcmpInst));
|
||||
|
||||
/* create the integers from floats directly */
|
||||
Instruction *b_op0, *b_op1;
|
||||
b_op0 = CastInst::Create(Instruction::BitCast, op0,
|
||||
IntegerType::get(C, op_size));
|
||||
bb->getInstList().insert(BasicBlock::iterator(bb->getTerminator()), b_op0);
|
||||
Instruction *bpre_op0, *bpre_op1;
|
||||
bpre_op0 = CastInst::Create(Instruction::BitCast, op0,
|
||||
IntegerType::get(C, op_size));
|
||||
bb->getInstList().insert(BasicBlock::iterator(bb->getTerminator()),
|
||||
bpre_op0);
|
||||
|
||||
b_op1 = CastInst::Create(Instruction::BitCast, op1,
|
||||
IntegerType::get(C, op_size));
|
||||
bb->getInstList().insert(BasicBlock::iterator(bb->getTerminator()), b_op1);
|
||||
bpre_op1 = CastInst::Create(Instruction::BitCast, op1,
|
||||
IntegerType::get(C, op_size));
|
||||
bb->getInstList().insert(BasicBlock::iterator(bb->getTerminator()),
|
||||
bpre_op1);
|
||||
|
||||
/* Check if any operand is NaN.
|
||||
* If so, all comparisons except unequal (which yields true) yield false */
|
||||
|
||||
/* build mask for NaN */
|
||||
const unsigned long long NaN_lowend = mask_exponent << precision;
|
||||
// errs() << "Fractions: IntFractionTy size " <<
|
||||
// IntFractionTy->getPrimitiveSizeInBits() << ", op_size " << op_size <<
|
||||
// ", mask_fraction 0x";
|
||||
// errs().write_hex(mask_fraction);
|
||||
// errs() << ", precision " << precision <<
|
||||
// ", NaN_lowend 0x";
|
||||
// errs().write_hex(NaN_lowend); errs() << "\n";
|
||||
|
||||
/* Check op0 for NaN */
|
||||
/* Shift left 1 Bit, ignore sign bit */
|
||||
Instruction *nan_op0, *nan_op1;
|
||||
nan_op0 = BinaryOperator::Create(Instruction::Shl, bpre_op0,
|
||||
ConstantInt::get(bpre_op0->getType(), 1));
|
||||
bb->getInstList().insert(BasicBlock::iterator(bb->getTerminator()),
|
||||
nan_op0);
|
||||
|
||||
/* compare to NaN interval */
|
||||
Instruction *is_op0_nan =
|
||||
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_UGT, nan_op0,
|
||||
ConstantInt::get(intType, NaN_lowend));
|
||||
bb->getInstList().insert(BasicBlock::iterator(bb->getTerminator()),
|
||||
is_op0_nan);
|
||||
|
||||
/* Check op1 for NaN */
|
||||
/* Shift right 1 Bit, ignore sign bit */
|
||||
nan_op1 = BinaryOperator::Create(Instruction::Shl, bpre_op1,
|
||||
ConstantInt::get(bpre_op1->getType(), 1));
|
||||
bb->getInstList().insert(BasicBlock::iterator(bb->getTerminator()),
|
||||
nan_op1);
|
||||
|
||||
/* compare to NaN interval */
|
||||
Instruction *is_op1_nan =
|
||||
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_UGT, nan_op1,
|
||||
ConstantInt::get(intType, NaN_lowend));
|
||||
bb->getInstList().insert(BasicBlock::iterator(bb->getTerminator()),
|
||||
is_op1_nan);
|
||||
|
||||
/* combine checks */
|
||||
Instruction *is_nan =
|
||||
BinaryOperator::Create(Instruction::Or, is_op0_nan, is_op1_nan);
|
||||
bb->getInstList().insert(BasicBlock::iterator(bb->getTerminator()), is_nan);
|
||||
|
||||
/* the result of the comparison, when at least one op is NaN
|
||||
is true only for the "NOT EQUAL" predicates. */
|
||||
bool NaNcmp_result = FcmpInst->getPredicate() == CmpInst::FCMP_ONE ||
|
||||
FcmpInst->getPredicate() == CmpInst::FCMP_UNE;
|
||||
|
||||
BasicBlock *nonan_bb =
|
||||
BasicBlock::Create(C, "noNaN", end_bb->getParent(), end_bb);
|
||||
|
||||
BranchInst::Create(end_bb, nonan_bb);
|
||||
|
||||
auto term = bb->getTerminator();
|
||||
/* if no operand is NaN goto nonan_bb else to handleNaN_bb */
|
||||
BranchInst::Create(end_bb, nonan_bb, is_nan, bb);
|
||||
term->eraseFromParent();
|
||||
|
||||
/*** now working in nonan_bb ***/
|
||||
|
||||
/* Treat -0.0 as equal to +0.0, that is for -0.0 make it +0.0 */
|
||||
Instruction * b_op0, *b_op1;
|
||||
Instruction * isMzero_op0, *isMzero_op1;
|
||||
const unsigned long long MinusZero = 1UL << (sizeInBits - 1U);
|
||||
const unsigned long long PlusZero = 0;
|
||||
|
||||
isMzero_op0 = CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, bpre_op0,
|
||||
ConstantInt::get(intType, MinusZero));
|
||||
nonan_bb->getInstList().insert(
|
||||
BasicBlock::iterator(nonan_bb->getTerminator()), isMzero_op0);
|
||||
|
||||
isMzero_op1 = CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, bpre_op1,
|
||||
ConstantInt::get(intType, MinusZero));
|
||||
nonan_bb->getInstList().insert(
|
||||
BasicBlock::iterator(nonan_bb->getTerminator()), isMzero_op1);
|
||||
|
||||
b_op0 = SelectInst::Create(isMzero_op0, ConstantInt::get(intType, PlusZero),
|
||||
bpre_op0);
|
||||
nonan_bb->getInstList().insert(
|
||||
BasicBlock::iterator(nonan_bb->getTerminator()), b_op0);
|
||||
|
||||
b_op1 = SelectInst::Create(isMzero_op1, ConstantInt::get(intType, PlusZero),
|
||||
bpre_op1);
|
||||
nonan_bb->getInstList().insert(
|
||||
BasicBlock::iterator(nonan_bb->getTerminator()), b_op1);
|
||||
|
||||
/* isolate signs of value of floating point type */
|
||||
|
||||
@ -931,22 +1024,26 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
|
||||
s_s0 =
|
||||
BinaryOperator::Create(Instruction::LShr, b_op0,
|
||||
ConstantInt::get(b_op0->getType(), op_size - 1));
|
||||
bb->getInstList().insert(BasicBlock::iterator(bb->getTerminator()), s_s0);
|
||||
nonan_bb->getInstList().insert(
|
||||
BasicBlock::iterator(nonan_bb->getTerminator()), s_s0);
|
||||
t_s0 = new TruncInst(s_s0, Int1Ty);
|
||||
bb->getInstList().insert(BasicBlock::iterator(bb->getTerminator()), t_s0);
|
||||
nonan_bb->getInstList().insert(
|
||||
BasicBlock::iterator(nonan_bb->getTerminator()), t_s0);
|
||||
|
||||
s_s1 =
|
||||
BinaryOperator::Create(Instruction::LShr, b_op1,
|
||||
ConstantInt::get(b_op1->getType(), op_size - 1));
|
||||
bb->getInstList().insert(BasicBlock::iterator(bb->getTerminator()), s_s1);
|
||||
nonan_bb->getInstList().insert(
|
||||
BasicBlock::iterator(nonan_bb->getTerminator()), s_s1);
|
||||
t_s1 = new TruncInst(s_s1, Int1Ty);
|
||||
bb->getInstList().insert(BasicBlock::iterator(bb->getTerminator()), t_s1);
|
||||
nonan_bb->getInstList().insert(
|
||||
BasicBlock::iterator(nonan_bb->getTerminator()), t_s1);
|
||||
|
||||
/* compare of the sign bits */
|
||||
icmp_sign_bit =
|
||||
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, t_s0, t_s1);
|
||||
bb->getInstList().insert(BasicBlock::iterator(bb->getTerminator()),
|
||||
icmp_sign_bit);
|
||||
nonan_bb->getInstList().insert(
|
||||
BasicBlock::iterator(nonan_bb->getTerminator()), icmp_sign_bit);
|
||||
|
||||
/* create a new basic block which is executed if the signedness bits are
|
||||
* equal */
|
||||
@ -962,9 +1059,9 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
|
||||
|
||||
BranchInst::Create(end_bb, middle_bb);
|
||||
|
||||
auto term = bb->getTerminator();
|
||||
term = nonan_bb->getTerminator();
|
||||
/* if the signs are different goto end_bb else to signequal_bb */
|
||||
BranchInst::Create(signequal_bb, end_bb, icmp_sign_bit, bb);
|
||||
BranchInst::Create(signequal_bb, end_bb, icmp_sign_bit, nonan_bb);
|
||||
term->eraseFromParent();
|
||||
|
||||
/* insert code for equal signs */
|
||||
@ -1261,7 +1358,7 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
|
||||
|
||||
}
|
||||
|
||||
PHINode *PN = PHINode::Create(Int1Ty, 3, "");
|
||||
PHINode *PN = PHINode::Create(Int1Ty, 4, "");
|
||||
|
||||
switch (FcmpInst->getPredicate()) {
|
||||
|
||||
@ -1269,37 +1366,45 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
|
||||
case CmpInst::FCMP_OEQ:
|
||||
/* unequal signs cannot be equal values */
|
||||
/* goto false branch */
|
||||
PN->addIncoming(ConstantInt::get(Int1Ty, 0), bb);
|
||||
PN->addIncoming(ConstantInt::get(Int1Ty, 0), nonan_bb);
|
||||
/* unequal exponents cannot be equal values, too */
|
||||
PN->addIncoming(ConstantInt::get(Int1Ty, 0), signequal_bb);
|
||||
/* fractions comparison */
|
||||
PN->addIncoming(icmp_fraction_result, middle2_bb);
|
||||
/* NaNs */
|
||||
PN->addIncoming(ConstantInt::get(Int1Ty, NaNcmp_result), bb);
|
||||
break;
|
||||
case CmpInst::FCMP_ONE:
|
||||
case CmpInst::FCMP_UNE:
|
||||
/* unequal signs are unequal values */
|
||||
/* goto true branch */
|
||||
PN->addIncoming(ConstantInt::get(Int1Ty, 1), bb);
|
||||
PN->addIncoming(ConstantInt::get(Int1Ty, 1), nonan_bb);
|
||||
/* unequal exponents are unequal values, too */
|
||||
PN->addIncoming(icmp_exponent_result, signequal_bb);
|
||||
/* fractions comparison */
|
||||
PN->addIncoming(icmp_fraction_result, middle2_bb);
|
||||
/* NaNs */
|
||||
PN->addIncoming(ConstantInt::get(Int1Ty, NaNcmp_result), bb);
|
||||
break;
|
||||
case CmpInst::FCMP_OGT:
|
||||
case CmpInst::FCMP_UGT:
|
||||
/* if op1 is negative goto true branch,
|
||||
else go on comparing */
|
||||
PN->addIncoming(t_s1, bb);
|
||||
PN->addIncoming(t_s1, nonan_bb);
|
||||
PN->addIncoming(icmp_exponent_result, signequal2_bb);
|
||||
PN->addIncoming(PN2, middle2_bb);
|
||||
/* NaNs */
|
||||
PN->addIncoming(ConstantInt::get(Int1Ty, NaNcmp_result), bb);
|
||||
break;
|
||||
case CmpInst::FCMP_OLT:
|
||||
case CmpInst::FCMP_ULT:
|
||||
/* if op0 is negative goto true branch,
|
||||
else go on comparing */
|
||||
PN->addIncoming(t_s0, bb);
|
||||
PN->addIncoming(t_s0, nonan_bb);
|
||||
PN->addIncoming(icmp_exponent_result, signequal2_bb);
|
||||
PN->addIncoming(PN2, middle2_bb);
|
||||
/* NaNs */
|
||||
PN->addIncoming(ConstantInt::get(Int1Ty, NaNcmp_result), bb);
|
||||
break;
|
||||
default:
|
||||
continue;
|
||||
@ -1341,18 +1446,15 @@ bool SplitComparesTransform::runOnModule(Module &M) {
|
||||
|
||||
if (enableFPSplit) {
|
||||
|
||||
simplifyFPCompares(M);
|
||||
count = splitFPCompares(M);
|
||||
|
||||
/*
|
||||
if (!be_quiet) {
|
||||
if (!be_quiet && !debug) {
|
||||
|
||||
errs() << "Split-floatingpoint-compare-pass: " << count
|
||||
<< " FP comparisons split\n";
|
||||
errs() << "Split-floatingpoint-compare-pass: " << count
|
||||
<< " FP comparisons splitted\n";
|
||||
|
||||
}
|
||||
|
||||
*/
|
||||
simplifyFPCompares(M);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
@ -1 +1 @@
|
||||
002e473939
|
||||
ce65a7349e
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
# High-performance binary-only instrumentation for afl-fuzz
|
||||
|
||||
For the general instruction manual, see [README.md](../README.md).
|
||||
For the general instruction manual, see [docs/README.md](../docs/README.md).
|
||||
|
||||
## 1) Introduction
|
||||
|
||||
|
||||
@ -1 +1 @@
|
||||
Subproject commit 002e473939a350854d56f67ce7b2e2d9706b8bca
|
||||
Subproject commit ce65a7349e7156e052b37a660422cad8346764d0
|
||||
@ -395,7 +395,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
|
||||
snprintf(llvm_fullpath, sizeof(llvm_fullpath), "%s/clang",
|
||||
LLVM_BINDIR);
|
||||
else
|
||||
snprintf(llvm_fullpath, sizeof(llvm_fullpath), CLANGPP_BIN);
|
||||
snprintf(llvm_fullpath, sizeof(llvm_fullpath), CLANG_BIN);
|
||||
alt_cc = llvm_fullpath;
|
||||
|
||||
}
|
||||
|
||||
@ -491,13 +491,13 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
|
||||
#ifndef SIMPLE_FILES
|
||||
|
||||
queue_fn = alloc_printf(
|
||||
"%s/queue/id:%06u,%s", afl->out_dir, afl->queued_paths,
|
||||
"%s/queue/id:%06u,%s", afl->out_dir, afl->queued_items,
|
||||
describe_op(afl, new_bits, NAME_MAX - strlen("id:000000,")));
|
||||
|
||||
#else
|
||||
|
||||
queue_fn =
|
||||
alloc_printf("%s/queue/id_%06u", afl->out_dir, afl->queued_paths);
|
||||
alloc_printf("%s/queue/id_%06u", afl->out_dir, afl->queued_items);
|
||||
|
||||
#endif /* ^!SIMPLE_FILES */
|
||||
fd = open(queue_fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
|
||||
@ -586,7 +586,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
|
||||
|
||||
++afl->total_tmouts;
|
||||
|
||||
if (afl->unique_hangs >= KEEP_UNIQUE_HANG) { return keeping; }
|
||||
if (afl->saved_hangs >= KEEP_UNIQUE_HANG) { return keeping; }
|
||||
|
||||
if (likely(!afl->non_instrumented_mode)) {
|
||||
|
||||
@ -603,7 +603,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
|
||||
|
||||
}
|
||||
|
||||
++afl->unique_tmouts;
|
||||
++afl->saved_tmouts;
|
||||
#ifdef INTROSPECTION
|
||||
if (afl->custom_mutators_count && afl->current_custom_fuzz) {
|
||||
|
||||
@ -661,17 +661,17 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
|
||||
#ifndef SIMPLE_FILES
|
||||
|
||||
snprintf(fn, PATH_MAX, "%s/hangs/id:%06llu,%s", afl->out_dir,
|
||||
afl->unique_hangs,
|
||||
afl->saved_hangs,
|
||||
describe_op(afl, 0, NAME_MAX - strlen("id:000000,")));
|
||||
|
||||
#else
|
||||
|
||||
snprintf(fn, PATH_MAX, "%s/hangs/id_%06llu", afl->out_dir,
|
||||
afl->unique_hangs);
|
||||
afl->saved_hangs);
|
||||
|
||||
#endif /* ^!SIMPLE_FILES */
|
||||
|
||||
++afl->unique_hangs;
|
||||
++afl->saved_hangs;
|
||||
|
||||
afl->last_hang_time = get_cur_time();
|
||||
|
||||
@ -687,7 +687,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
|
||||
|
||||
++afl->total_crashes;
|
||||
|
||||
if (afl->unique_crashes >= KEEP_UNIQUE_CRASH) { return keeping; }
|
||||
if (afl->saved_crashes >= KEEP_UNIQUE_CRASH) { return keeping; }
|
||||
|
||||
if (likely(!afl->non_instrumented_mode)) {
|
||||
|
||||
@ -699,22 +699,22 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
|
||||
|
||||
}
|
||||
|
||||
if (unlikely(!afl->unique_crashes)) { write_crash_readme(afl); }
|
||||
if (unlikely(!afl->saved_crashes)) { write_crash_readme(afl); }
|
||||
|
||||
#ifndef SIMPLE_FILES
|
||||
|
||||
snprintf(fn, PATH_MAX, "%s/crashes/id:%06llu,sig:%02u,%s", afl->out_dir,
|
||||
afl->unique_crashes, afl->fsrv.last_kill_signal,
|
||||
afl->saved_crashes, afl->fsrv.last_kill_signal,
|
||||
describe_op(afl, 0, NAME_MAX - strlen("id:000000,sig:00,")));
|
||||
|
||||
#else
|
||||
|
||||
snprintf(fn, PATH_MAX, "%s/crashes/id_%06llu_%02u", afl->out_dir,
|
||||
afl->unique_crashes, afl->last_kill_signal);
|
||||
afl->saved_crashes, afl->last_kill_signal);
|
||||
|
||||
#endif /* ^!SIMPLE_FILES */
|
||||
|
||||
++afl->unique_crashes;
|
||||
++afl->saved_crashes;
|
||||
#ifdef INTROSPECTION
|
||||
if (afl->custom_mutators_count && afl->current_custom_fuzz) {
|
||||
|
||||
|
||||
@ -59,7 +59,7 @@ u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
|
||||
|
||||
if (afl->subseq_tmouts++ > TMOUT_LIMIT) {
|
||||
|
||||
++afl->cur_skipped_paths;
|
||||
++afl->cur_skipped_items;
|
||||
return 1;
|
||||
|
||||
}
|
||||
@ -76,7 +76,7 @@ u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
|
||||
if (afl->skip_requested) {
|
||||
|
||||
afl->skip_requested = 0;
|
||||
++afl->cur_skipped_paths;
|
||||
++afl->cur_skipped_items;
|
||||
return 1;
|
||||
|
||||
}
|
||||
|
||||
@ -638,8 +638,8 @@ void read_foreign_testcases(afl_state_t *afl, int first) {
|
||||
|
||||
if (first) {
|
||||
|
||||
afl->last_path_time = 0;
|
||||
afl->queued_at_start = afl->queued_paths;
|
||||
afl->last_find_time = 0;
|
||||
afl->queued_at_start = afl->queued_items;
|
||||
|
||||
}
|
||||
|
||||
@ -812,7 +812,7 @@ void read_testcases(afl_state_t *afl, u8 *directory) {
|
||||
|
||||
free(nl); /* not tracked */
|
||||
|
||||
if (!afl->queued_paths && directory == NULL) {
|
||||
if (!afl->queued_items && directory == NULL) {
|
||||
|
||||
SAYF("\n" cLRD "[-] " cRST
|
||||
"Looks like there are no valid test cases in the input directory! The "
|
||||
@ -841,8 +841,8 @@ void read_testcases(afl_state_t *afl, u8 *directory) {
|
||||
|
||||
}
|
||||
|
||||
afl->last_path_time = 0;
|
||||
afl->queued_at_start = afl->queued_paths;
|
||||
afl->last_find_time = 0;
|
||||
afl->queued_at_start = afl->queued_items;
|
||||
|
||||
}
|
||||
|
||||
@ -855,7 +855,7 @@ void perform_dry_run(afl_state_t *afl) {
|
||||
u32 cal_failures = 0, idx;
|
||||
u8 * use_mem;
|
||||
|
||||
for (idx = 0; idx < afl->queued_paths; idx++) {
|
||||
for (idx = 0; idx < afl->queued_items; idx++) {
|
||||
|
||||
q = afl->queue_buf[idx];
|
||||
if (unlikely(!q || q->disabled)) { continue; }
|
||||
@ -920,7 +920,7 @@ void perform_dry_run(afl_state_t *afl) {
|
||||
|
||||
q->was_fuzzed = 1;
|
||||
--afl->pending_not_fuzzed;
|
||||
--afl->active_paths;
|
||||
--afl->active_items;
|
||||
|
||||
}
|
||||
|
||||
@ -1051,7 +1051,7 @@ void perform_dry_run(afl_state_t *afl) {
|
||||
|
||||
q->was_fuzzed = 1;
|
||||
--afl->pending_not_fuzzed;
|
||||
--afl->active_paths;
|
||||
--afl->active_items;
|
||||
|
||||
}
|
||||
|
||||
@ -1059,14 +1059,14 @@ void perform_dry_run(afl_state_t *afl) {
|
||||
q->perf_score = 0;
|
||||
|
||||
u32 i = 0;
|
||||
while (unlikely(i < afl->queued_paths && afl->queue_buf[i] &&
|
||||
while (unlikely(i < afl->queued_items && afl->queue_buf[i] &&
|
||||
afl->queue_buf[i]->disabled)) {
|
||||
|
||||
++i;
|
||||
|
||||
}
|
||||
|
||||
if (i < afl->queued_paths && afl->queue_buf[i]) {
|
||||
if (i < afl->queued_items && afl->queue_buf[i]) {
|
||||
|
||||
afl->queue = afl->queue_buf[i];
|
||||
|
||||
@ -1077,7 +1077,7 @@ void perform_dry_run(afl_state_t *afl) {
|
||||
}
|
||||
|
||||
afl->max_depth = 0;
|
||||
for (i = 0; i < afl->queued_paths && likely(afl->queue_buf[i]); i++) {
|
||||
for (i = 0; i < afl->queued_items && likely(afl->queue_buf[i]); i++) {
|
||||
|
||||
if (!afl->queue_buf[i]->disabled &&
|
||||
afl->queue_buf[i]->depth > afl->max_depth)
|
||||
@ -1118,16 +1118,16 @@ void perform_dry_run(afl_state_t *afl) {
|
||||
|
||||
if (cal_failures) {
|
||||
|
||||
if (cal_failures == afl->queued_paths) {
|
||||
if (cal_failures == afl->queued_items) {
|
||||
|
||||
FATAL("All test cases time out or crash, giving up!");
|
||||
|
||||
}
|
||||
|
||||
WARNF("Skipped %u test cases (%0.02f%%) due to timeouts or crashes.",
|
||||
cal_failures, ((double)cal_failures) * 100 / afl->queued_paths);
|
||||
cal_failures, ((double)cal_failures) * 100 / afl->queued_items);
|
||||
|
||||
if (cal_failures * 5 > afl->queued_paths) {
|
||||
if (cal_failures * 5 > afl->queued_items) {
|
||||
|
||||
WARNF(cLRD "High percentage of rejected test cases, check settings!");
|
||||
|
||||
@ -1139,14 +1139,14 @@ void perform_dry_run(afl_state_t *afl) {
|
||||
|
||||
u32 duplicates = 0, i;
|
||||
|
||||
for (idx = 0; idx < afl->queued_paths; idx++) {
|
||||
for (idx = 0; idx < afl->queued_items; idx++) {
|
||||
|
||||
q = afl->queue_buf[idx];
|
||||
if (!q || q->disabled || q->cal_failed || !q->exec_cksum) { continue; }
|
||||
|
||||
u32 done = 0;
|
||||
for (i = idx + 1;
|
||||
i < afl->queued_paths && !done && likely(afl->queue_buf[i]); i++) {
|
||||
i < afl->queued_items && !done && likely(afl->queue_buf[i]); i++) {
|
||||
|
||||
struct queue_entry *p = afl->queue_buf[i];
|
||||
if (p->disabled || p->cal_failed || !p->exec_cksum) { continue; }
|
||||
@ -1162,7 +1162,7 @@ void perform_dry_run(afl_state_t *afl) {
|
||||
|
||||
p->was_fuzzed = 1;
|
||||
--afl->pending_not_fuzzed;
|
||||
--afl->active_paths;
|
||||
--afl->active_items;
|
||||
|
||||
}
|
||||
|
||||
@ -1175,7 +1175,7 @@ void perform_dry_run(afl_state_t *afl) {
|
||||
|
||||
q->was_fuzzed = 1;
|
||||
--afl->pending_not_fuzzed;
|
||||
--afl->active_paths;
|
||||
--afl->active_items;
|
||||
|
||||
}
|
||||
|
||||
@ -1196,7 +1196,7 @@ void perform_dry_run(afl_state_t *afl) {
|
||||
|
||||
afl->max_depth = 0;
|
||||
|
||||
for (idx = 0; idx < afl->queued_paths; idx++) {
|
||||
for (idx = 0; idx < afl->queued_items; idx++) {
|
||||
|
||||
if (afl->queue_buf[idx] && !afl->queue_buf[idx]->disabled &&
|
||||
afl->queue_buf[idx]->depth > afl->max_depth)
|
||||
@ -1254,7 +1254,7 @@ void pivot_inputs(afl_state_t *afl) {
|
||||
|
||||
ACTF("Creating hard links for all input files...");
|
||||
|
||||
for (i = 0; i < afl->queued_paths && likely(afl->queue_buf[i]); i++) {
|
||||
for (i = 0; i < afl->queued_items && likely(afl->queue_buf[i]); i++) {
|
||||
|
||||
q = afl->queue_buf[i];
|
||||
|
||||
@ -1293,7 +1293,7 @@ void pivot_inputs(afl_state_t *afl) {
|
||||
|
||||
if (src_str && sscanf(src_str + 1, "%06u", &src_id) == 1) {
|
||||
|
||||
if (src_id < afl->queued_paths) {
|
||||
if (src_id < afl->queued_items) {
|
||||
|
||||
struct queue_entry *s = afl->queue_buf[src_id];
|
||||
|
||||
@ -1391,11 +1391,11 @@ u32 find_start_position(afl_state_t *afl) {
|
||||
(void)i; /* Ignore errors */
|
||||
close(fd);
|
||||
|
||||
off = strstr(tmp, "cur_path : ");
|
||||
off = strstr(tmp, "cur_item : ");
|
||||
if (!off) { return 0; }
|
||||
|
||||
ret = atoi(off + 20);
|
||||
if (ret >= afl->queued_paths) { ret = 0; }
|
||||
if (ret >= afl->queued_items) { ret = 0; }
|
||||
return ret;
|
||||
|
||||
}
|
||||
@ -2040,9 +2040,9 @@ void setup_dirs_fds(afl_state_t *afl) {
|
||||
|
||||
fprintf(
|
||||
afl->fsrv.plot_file,
|
||||
"# relative_time, cycles_done, cur_path, paths_total, "
|
||||
"pending_total, pending_favs, map_size, unique_crashes, "
|
||||
"unique_hangs, max_depth, execs_per_sec, total_execs, edges_found\n");
|
||||
"# relative_time, cycles_done, cur_item, corpus_count, "
|
||||
"pending_total, pending_favs, map_size, saved_crashes, "
|
||||
"saved_hangs, max_depth, execs_per_sec, total_execs, edges_found\n");
|
||||
|
||||
} else {
|
||||
|
||||
|
||||
@ -423,7 +423,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
|
||||
|
||||
} else if (!afl->non_instrumented_mode && !afl->queue_cur->favored &&
|
||||
|
||||
afl->queued_paths > 10) {
|
||||
afl->queued_items > 10) {
|
||||
|
||||
/* Otherwise, still possibly skip non-favored cases, albeit less often.
|
||||
The odds of skipping stuff are higher for already-fuzzed inputs and
|
||||
@ -447,9 +447,9 @@ u8 fuzz_one_original(afl_state_t *afl) {
|
||||
if (unlikely(afl->not_on_tty)) {
|
||||
|
||||
ACTF(
|
||||
"Fuzzing test case #%u (%u total, %llu uniq crashes found, "
|
||||
"Fuzzing test case #%u (%u total, %llu crashes saved, "
|
||||
"perf_score=%0.0f, exec_us=%llu, hits=%u, map=%u, ascii=%u)...",
|
||||
afl->current_entry, afl->queued_paths, afl->unique_crashes,
|
||||
afl->current_entry, afl->queued_items, afl->saved_crashes,
|
||||
afl->queue_cur->perf_score, afl->queue_cur->exec_us,
|
||||
likely(afl->n_fuzz) ? afl->n_fuzz[afl->queue_cur->n_fuzz_entry] : 0,
|
||||
afl->queue_cur->bitmap_size, afl->queue_cur->is_ascii);
|
||||
@ -492,7 +492,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
|
||||
|
||||
if (unlikely(afl->stop_soon) || res != afl->crash_mode) {
|
||||
|
||||
++afl->cur_skipped_paths;
|
||||
++afl->cur_skipped_items;
|
||||
goto abandon_entry;
|
||||
|
||||
}
|
||||
@ -519,7 +519,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
|
||||
|
||||
if (unlikely(afl->stop_soon)) {
|
||||
|
||||
++afl->cur_skipped_paths;
|
||||
++afl->cur_skipped_items;
|
||||
goto abandon_entry;
|
||||
|
||||
}
|
||||
@ -547,7 +547,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
|
||||
afl->queue_cur->perf_score = orig_perf = perf_score =
|
||||
calculate_score(afl, afl->queue_cur);
|
||||
|
||||
if (unlikely(perf_score <= 0 && afl->active_paths > 1)) {
|
||||
if (unlikely(perf_score <= 0 && afl->active_items > 1)) {
|
||||
|
||||
goto abandon_entry;
|
||||
|
||||
@ -566,8 +566,8 @@ u8 fuzz_one_original(afl_state_t *afl) {
|
||||
if (afl->cmplog_lvl == 3 ||
|
||||
(afl->cmplog_lvl == 2 && afl->queue_cur->tc_ref) ||
|
||||
afl->queue_cur->favored ||
|
||||
!(afl->fsrv.total_execs % afl->queued_paths) ||
|
||||
get_cur_time() - afl->last_path_time > 300000) { // 300 seconds
|
||||
!(afl->fsrv.total_execs % afl->queued_items) ||
|
||||
get_cur_time() - afl->last_find_time > 300000) { // 300 seconds
|
||||
|
||||
if (input_to_state_stage(afl, in_buf, out_buf, len)) {
|
||||
|
||||
@ -630,7 +630,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
|
||||
|
||||
afl->stage_val_type = STAGE_VAL_NONE;
|
||||
|
||||
orig_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
orig_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
prev_cksum = afl->queue_cur->exec_cksum;
|
||||
|
||||
@ -734,7 +734,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_FLIP1] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_FLIP1] += afl->stage_max;
|
||||
@ -766,7 +766,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_FLIP2] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_FLIP2] += afl->stage_max;
|
||||
@ -802,7 +802,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_FLIP4] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_FLIP4] += afl->stage_max;
|
||||
@ -909,7 +909,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
|
||||
|
||||
afl->blocks_eff_total += EFF_ALEN(len);
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_FLIP8] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_FLIP8] += afl->stage_max;
|
||||
@ -952,7 +952,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_FLIP16] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_FLIP16] += afl->stage_max;
|
||||
@ -995,7 +995,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_FLIP32] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_FLIP32] += afl->stage_max;
|
||||
@ -1087,7 +1087,7 @@ skip_bitflip:
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_ARITH8] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_ARITH8] += afl->stage_max;
|
||||
@ -1217,7 +1217,7 @@ skip_bitflip:
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_ARITH16] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_ARITH16] += afl->stage_max;
|
||||
@ -1346,7 +1346,7 @@ skip_bitflip:
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_ARITH32] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_ARITH32] += afl->stage_max;
|
||||
@ -1412,7 +1412,7 @@ skip_arith:
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_INTEREST8] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_INTEREST8] += afl->stage_max;
|
||||
@ -1500,7 +1500,7 @@ skip_arith:
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_INTEREST16] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_INTEREST16] += afl->stage_max;
|
||||
@ -1589,7 +1589,7 @@ skip_arith:
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_INTEREST32] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_INTEREST32] += afl->stage_max;
|
||||
@ -1662,7 +1662,7 @@ skip_interest:
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_EXTRAS_UO] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_EXTRAS_UO] += afl->stage_max;
|
||||
@ -1718,7 +1718,7 @@ skip_interest:
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_EXTRAS_UI] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_EXTRAS_UI] += afl->stage_max;
|
||||
@ -1776,7 +1776,7 @@ skip_user_extras:
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_EXTRAS_AO] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_EXTRAS_AO] += afl->stage_max;
|
||||
@ -1806,7 +1806,7 @@ custom_mutator_stage:
|
||||
|
||||
const u32 max_seed_size = MAX_FILE, saved_max = afl->stage_max;
|
||||
|
||||
orig_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
orig_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
#ifdef INTROSPECTION
|
||||
afl->mutation[0] = 0;
|
||||
@ -1850,7 +1850,7 @@ custom_mutator_stage:
|
||||
|
||||
do {
|
||||
|
||||
tid = rand_below(afl, afl->queued_paths);
|
||||
tid = rand_below(afl, afl->queued_items);
|
||||
|
||||
} while (unlikely(tid == afl->current_entry ||
|
||||
|
||||
@ -1890,7 +1890,7 @@ custom_mutator_stage:
|
||||
/* If we're finding new stuff, let's run for a bit longer, limits
|
||||
permitting. */
|
||||
|
||||
if (afl->queued_paths != havoc_queued) {
|
||||
if (afl->queued_items != havoc_queued) {
|
||||
|
||||
if (perf_score <= afl->havoc_max_mult * 100) {
|
||||
|
||||
@ -1899,7 +1899,7 @@ custom_mutator_stage:
|
||||
|
||||
}
|
||||
|
||||
havoc_queued = afl->queued_paths;
|
||||
havoc_queued = afl->queued_items;
|
||||
|
||||
}
|
||||
|
||||
@ -1926,7 +1926,7 @@ custom_mutator_stage:
|
||||
|
||||
if (!has_custom_fuzz) goto havoc_stage;
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_CUSTOM_MUTATOR] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_CUSTOM_MUTATOR] += afl->stage_max;
|
||||
@ -1972,9 +1972,9 @@ havoc_stage:
|
||||
|
||||
temp_len = len;
|
||||
|
||||
orig_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
orig_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
havoc_queued = afl->queued_paths;
|
||||
havoc_queued = afl->queued_items;
|
||||
|
||||
if (afl->custom_mutators_count) {
|
||||
|
||||
@ -2023,7 +2023,7 @@ havoc_stage:
|
||||
|
||||
}
|
||||
|
||||
if (unlikely(get_cur_time() - afl->last_path_time > 5000 /* 5 seconds */ &&
|
||||
if (unlikely(get_cur_time() - afl->last_find_time > 5000 /* 5 seconds */ &&
|
||||
afl->ready_for_splicing_count > 1)) {
|
||||
|
||||
/* add expensive havoc cases here if there is no findings in the last 5s */
|
||||
@ -2669,7 +2669,7 @@ havoc_stage:
|
||||
u32 tid;
|
||||
do {
|
||||
|
||||
tid = rand_below(afl, afl->queued_paths);
|
||||
tid = rand_below(afl, afl->queued_items);
|
||||
|
||||
} while (tid == afl->current_entry || afl->queue_buf[tid]->len < 4);
|
||||
|
||||
@ -2757,7 +2757,7 @@ havoc_stage:
|
||||
/* If we're finding new stuff, let's run for a bit longer, limits
|
||||
permitting. */
|
||||
|
||||
if (afl->queued_paths != havoc_queued) {
|
||||
if (afl->queued_items != havoc_queued) {
|
||||
|
||||
if (perf_score <= afl->havoc_max_mult * 100) {
|
||||
|
||||
@ -2766,13 +2766,13 @@ havoc_stage:
|
||||
|
||||
}
|
||||
|
||||
havoc_queued = afl->queued_paths;
|
||||
havoc_queued = afl->queued_items;
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
if (!splice_cycle) {
|
||||
|
||||
@ -2821,7 +2821,7 @@ retry_splicing:
|
||||
|
||||
do {
|
||||
|
||||
tid = rand_below(afl, afl->queued_paths);
|
||||
tid = rand_below(afl, afl->queued_items);
|
||||
|
||||
} while (tid == afl->current_entry || afl->queue_buf[tid]->len < 4);
|
||||
|
||||
@ -2945,7 +2945,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
|
||||
|
||||
} else if (!afl->non_instrumented_mode && !afl->queue_cur->favored &&
|
||||
|
||||
afl->queued_paths > 10) {
|
||||
afl->queued_items > 10) {
|
||||
|
||||
/* Otherwise, still possibly skip non-favored cases, albeit less often.
|
||||
The odds of skipping stuff are higher for already-fuzzed inputs and
|
||||
@ -2968,8 +2968,8 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
|
||||
|
||||
if (afl->not_on_tty) {
|
||||
|
||||
ACTF("Fuzzing test case #%u (%u total, %llu uniq crashes found)...",
|
||||
afl->current_entry, afl->queued_paths, afl->unique_crashes);
|
||||
ACTF("Fuzzing test case #%u (%u total, %llu crashes saved)...",
|
||||
afl->current_entry, afl->queued_items, afl->saved_crashes);
|
||||
fflush(stdout);
|
||||
|
||||
}
|
||||
@ -3010,7 +3010,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
|
||||
|
||||
if (afl->stop_soon || res != afl->crash_mode) {
|
||||
|
||||
++afl->cur_skipped_paths;
|
||||
++afl->cur_skipped_items;
|
||||
goto abandon_entry;
|
||||
|
||||
}
|
||||
@ -3037,7 +3037,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
|
||||
|
||||
if (unlikely(afl->stop_soon)) {
|
||||
|
||||
++afl->cur_skipped_paths;
|
||||
++afl->cur_skipped_items;
|
||||
goto abandon_entry;
|
||||
|
||||
}
|
||||
@ -3064,7 +3064,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
|
||||
else
|
||||
orig_perf = perf_score = calculate_score(afl, afl->queue_cur);
|
||||
|
||||
if (unlikely(perf_score <= 0 && afl->active_paths > 1)) {
|
||||
if (unlikely(perf_score <= 0 && afl->active_items > 1)) {
|
||||
|
||||
goto abandon_entry;
|
||||
|
||||
@ -3082,8 +3082,8 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
|
||||
|
||||
if (afl->cmplog_lvl == 3 ||
|
||||
(afl->cmplog_lvl == 2 && afl->queue_cur->tc_ref) ||
|
||||
!(afl->fsrv.total_execs % afl->queued_paths) ||
|
||||
get_cur_time() - afl->last_path_time > 300000) { // 300 seconds
|
||||
!(afl->fsrv.total_execs % afl->queued_items) ||
|
||||
get_cur_time() - afl->last_find_time > 300000) { // 300 seconds
|
||||
|
||||
if (input_to_state_stage(afl, in_buf, out_buf, len)) {
|
||||
|
||||
@ -3101,10 +3101,10 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
|
||||
|
||||
cur_ms_lv = get_cur_time();
|
||||
if (!(afl->key_puppet == 0 &&
|
||||
((cur_ms_lv - afl->last_path_time < (u32)afl->limit_time_puppet) ||
|
||||
((cur_ms_lv - afl->last_find_time < (u32)afl->limit_time_puppet) ||
|
||||
(afl->last_crash_time != 0 &&
|
||||
cur_ms_lv - afl->last_crash_time < (u32)afl->limit_time_puppet) ||
|
||||
afl->last_path_time == 0))) {
|
||||
afl->last_find_time == 0))) {
|
||||
|
||||
afl->key_puppet = 1;
|
||||
goto pacemaker_fuzzing;
|
||||
@ -3156,7 +3156,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
|
||||
|
||||
afl->stage_val_type = STAGE_VAL_NONE;
|
||||
|
||||
orig_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
orig_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
prev_cksum = afl->queue_cur->exec_cksum;
|
||||
|
||||
@ -3259,7 +3259,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
|
||||
|
||||
} /* for afl->stage_cur */
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_FLIP1] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_FLIP1] += afl->stage_max;
|
||||
@ -3290,7 +3290,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
|
||||
|
||||
} /* for afl->stage_cur */
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_FLIP2] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_FLIP2] += afl->stage_max;
|
||||
@ -3325,7 +3325,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
|
||||
|
||||
} /* for afl->stage_cur */
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_FLIP4] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_FLIP4] += afl->stage_max;
|
||||
@ -3431,7 +3431,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
|
||||
|
||||
afl->blocks_eff_total += EFF_ALEN(len);
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_FLIP8] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_FLIP8] += afl->stage_max;
|
||||
@ -3473,7 +3473,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
|
||||
|
||||
} /* for i = 0; i < len */
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_FLIP16] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_FLIP16] += afl->stage_max;
|
||||
@ -3515,7 +3515,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
|
||||
|
||||
} /* for i = 0; i < len - 3 */
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_FLIP32] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_FLIP32] += afl->stage_max;
|
||||
@ -3605,7 +3605,7 @@ skip_bitflip:
|
||||
|
||||
} /* for i = 0; i < len */
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_ARITH8] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_ARITH8] += afl->stage_max;
|
||||
@ -3731,7 +3731,7 @@ skip_bitflip:
|
||||
|
||||
} /* for i = 0; i < len - 1 */
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_ARITH16] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_ARITH16] += afl->stage_max;
|
||||
@ -3856,7 +3856,7 @@ skip_bitflip:
|
||||
|
||||
} /* for i = 0; i < len - 3 */
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_ARITH32] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_ARITH32] += afl->stage_max;
|
||||
@ -3921,7 +3921,7 @@ skip_arith:
|
||||
|
||||
} /* for i = 0; i < len */
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_INTEREST8] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_INTEREST8] += afl->stage_max;
|
||||
@ -4007,7 +4007,7 @@ skip_arith:
|
||||
|
||||
} /* for i = 0; i < len - 1 */
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_INTEREST16] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_INTEREST16] += afl->stage_max;
|
||||
@ -4094,7 +4094,7 @@ skip_arith:
|
||||
|
||||
} /* for i = 0; i < len - 3 */
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_INTEREST32] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_INTEREST32] += afl->stage_max;
|
||||
@ -4167,7 +4167,7 @@ skip_interest:
|
||||
|
||||
} /* for i = 0; i < len */
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_EXTRAS_UO] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_EXTRAS_UO] += afl->stage_max;
|
||||
@ -4223,7 +4223,7 @@ skip_interest:
|
||||
|
||||
} /* for i = 0; i <= len */
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_EXTRAS_UI] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_EXTRAS_UI] += afl->stage_max;
|
||||
@ -4282,7 +4282,7 @@ skip_user_extras:
|
||||
|
||||
} /* for i = 0; i < len */
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_finds[STAGE_EXTRAS_AO] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_EXTRAS_AO] += afl->stage_max;
|
||||
@ -4335,7 +4335,7 @@ pacemaker_fuzzing:
|
||||
|
||||
if (unlikely(afl->orig_hit_cnt_puppet == 0)) {
|
||||
|
||||
afl->orig_hit_cnt_puppet = afl->queued_paths + afl->unique_crashes;
|
||||
afl->orig_hit_cnt_puppet = afl->queued_items + afl->saved_crashes;
|
||||
afl->last_limit_time_start = get_cur_time();
|
||||
afl->SPLICE_CYCLES_puppet =
|
||||
(rand_below(
|
||||
@ -4380,9 +4380,9 @@ pacemaker_fuzzing:
|
||||
|
||||
temp_len = len;
|
||||
|
||||
orig_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
orig_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
havoc_queued = afl->queued_paths;
|
||||
havoc_queued = afl->queued_items;
|
||||
|
||||
u32 r_max;
|
||||
|
||||
@ -4948,7 +4948,7 @@ pacemaker_fuzzing:
|
||||
u32 tid;
|
||||
do {
|
||||
|
||||
tid = rand_below(afl, afl->queued_paths);
|
||||
tid = rand_below(afl, afl->queued_items);
|
||||
|
||||
} while (tid == afl->current_entry ||
|
||||
|
||||
@ -5029,7 +5029,7 @@ pacemaker_fuzzing:
|
||||
|
||||
++*MOpt_globals.pTime;
|
||||
|
||||
u64 temp_total_found = afl->queued_paths + afl->unique_crashes;
|
||||
u64 temp_total_found = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
if (common_fuzz_stuff(afl, out_buf, temp_len)) {
|
||||
|
||||
@ -5048,7 +5048,7 @@ pacemaker_fuzzing:
|
||||
/* If we're finding new stuff, let's run for a bit longer, limits
|
||||
permitting. */
|
||||
|
||||
if (afl->queued_paths != havoc_queued) {
|
||||
if (afl->queued_items != havoc_queued) {
|
||||
|
||||
if (perf_score <= afl->havoc_max_mult * 100) {
|
||||
|
||||
@ -5057,15 +5057,15 @@ pacemaker_fuzzing:
|
||||
|
||||
}
|
||||
|
||||
havoc_queued = afl->queued_paths;
|
||||
havoc_queued = afl->queued_items;
|
||||
|
||||
}
|
||||
|
||||
if (unlikely(afl->queued_paths + afl->unique_crashes >
|
||||
if (unlikely(afl->queued_items + afl->saved_crashes >
|
||||
temp_total_found)) {
|
||||
|
||||
u64 temp_temp_puppet =
|
||||
afl->queued_paths + afl->unique_crashes - temp_total_found;
|
||||
afl->queued_items + afl->saved_crashes - temp_total_found;
|
||||
afl->total_puppet_find = afl->total_puppet_find + temp_temp_puppet;
|
||||
|
||||
if (MOpt_globals.is_pilot_mode) {
|
||||
@ -5099,7 +5099,7 @@ pacemaker_fuzzing:
|
||||
|
||||
++afl->stage_cur) { */
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
if (MOpt_globals.is_pilot_mode) {
|
||||
|
||||
@ -5149,7 +5149,7 @@ pacemaker_fuzzing:
|
||||
|
||||
do {
|
||||
|
||||
tid = rand_below(afl, afl->queued_paths);
|
||||
tid = rand_below(afl, afl->queued_items);
|
||||
|
||||
} while (tid == afl->current_entry || afl->queue_buf[tid]->len < 4);
|
||||
|
||||
@ -5235,8 +5235,8 @@ pacemaker_fuzzing:
|
||||
if (afl->key_puppet == 1) {
|
||||
|
||||
if (unlikely(
|
||||
afl->queued_paths + afl->unique_crashes >
|
||||
((afl->queued_paths + afl->unique_crashes) * limit_time_bound +
|
||||
afl->queued_items + afl->saved_crashes >
|
||||
((afl->queued_items + afl->saved_crashes) * limit_time_bound +
|
||||
afl->orig_hit_cnt_puppet))) {
|
||||
|
||||
afl->key_puppet = 0;
|
||||
@ -5251,7 +5251,7 @@ pacemaker_fuzzing:
|
||||
|
||||
afl->total_pacemaker_time += *MOpt_globals.pTime;
|
||||
*MOpt_globals.pTime = 0;
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
if (MOpt_globals.is_pilot_mode) {
|
||||
|
||||
|
||||
@ -31,7 +31,7 @@
|
||||
|
||||
inline u32 select_next_queue_entry(afl_state_t *afl) {
|
||||
|
||||
u32 s = rand_below(afl, afl->queued_paths);
|
||||
u32 s = rand_below(afl, afl->queued_items);
|
||||
double p = rand_next_percent(afl);
|
||||
/*
|
||||
fprintf(stderr, "select: p=%f s=%u ... p < prob[s]=%f ? s=%u : alias[%u]=%u"
|
||||
@ -69,7 +69,7 @@ double compute_weight(afl_state_t *afl, struct queue_entry *q,
|
||||
|
||||
void create_alias_table(afl_state_t *afl) {
|
||||
|
||||
u32 n = afl->queued_paths, i = 0, a, g;
|
||||
u32 n = afl->queued_items, i = 0, a, g;
|
||||
double sum = 0;
|
||||
|
||||
afl->alias_table =
|
||||
@ -547,19 +547,19 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
|
||||
|
||||
if (likely(q->len > 4)) afl->ready_for_splicing_count++;
|
||||
|
||||
++afl->queued_paths;
|
||||
++afl->active_paths;
|
||||
++afl->queued_items;
|
||||
++afl->active_items;
|
||||
++afl->pending_not_fuzzed;
|
||||
|
||||
afl->cycles_wo_finds = 0;
|
||||
|
||||
struct queue_entry **queue_buf = afl_realloc(
|
||||
AFL_BUF_PARAM(queue), afl->queued_paths * sizeof(struct queue_entry *));
|
||||
AFL_BUF_PARAM(queue), afl->queued_items * sizeof(struct queue_entry *));
|
||||
if (unlikely(!queue_buf)) { PFATAL("alloc"); }
|
||||
queue_buf[afl->queued_paths - 1] = q;
|
||||
q->id = afl->queued_paths - 1;
|
||||
queue_buf[afl->queued_items - 1] = q;
|
||||
q->id = afl->queued_items - 1;
|
||||
|
||||
afl->last_path_time = get_cur_time();
|
||||
afl->last_find_time = get_cur_time();
|
||||
|
||||
if (afl->custom_mutators_count) {
|
||||
|
||||
@ -583,7 +583,7 @@ void destroy_queue(afl_state_t *afl) {
|
||||
|
||||
u32 i;
|
||||
|
||||
for (i = 0; i < afl->queued_paths; i++) {
|
||||
for (i = 0; i < afl->queued_items; i++) {
|
||||
|
||||
struct queue_entry *q;
|
||||
|
||||
@ -737,7 +737,7 @@ void cull_queue(afl_state_t *afl) {
|
||||
afl->queued_favored = 0;
|
||||
afl->pending_favored = 0;
|
||||
|
||||
for (i = 0; i < afl->queued_paths; i++) {
|
||||
for (i = 0; i < afl->queued_items; i++) {
|
||||
|
||||
afl->queue_buf[i]->favored = 0;
|
||||
|
||||
@ -782,7 +782,7 @@ void cull_queue(afl_state_t *afl) {
|
||||
|
||||
}
|
||||
|
||||
for (i = 0; i < afl->queued_paths; i++) {
|
||||
for (i = 0; i < afl->queued_items; i++) {
|
||||
|
||||
if (likely(!afl->queue_buf[i]->disabled)) {
|
||||
|
||||
@ -915,7 +915,7 @@ u32 calculate_score(afl_state_t *afl, struct queue_entry *q) {
|
||||
|
||||
}
|
||||
|
||||
u32 n_paths;
|
||||
u32 n_items;
|
||||
double factor = 1.0;
|
||||
long double fuzz_mu;
|
||||
|
||||
@ -933,26 +933,26 @@ u32 calculate_score(afl_state_t *afl, struct queue_entry *q) {
|
||||
|
||||
case COE:
|
||||
fuzz_mu = 0.0;
|
||||
n_paths = 0;
|
||||
n_items = 0;
|
||||
|
||||
// Don't modify perf_score for unfuzzed seeds
|
||||
if (q->fuzz_level == 0) break;
|
||||
|
||||
u32 i;
|
||||
for (i = 0; i < afl->queued_paths; i++) {
|
||||
for (i = 0; i < afl->queued_items; i++) {
|
||||
|
||||
if (likely(!afl->queue_buf[i]->disabled)) {
|
||||
|
||||
fuzz_mu += log2(afl->n_fuzz[afl->queue_buf[i]->n_fuzz_entry]);
|
||||
n_paths++;
|
||||
n_items++;
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
if (unlikely(!n_paths)) { FATAL("Queue state corrupt"); }
|
||||
if (unlikely(!n_items)) { FATAL("Queue state corrupt"); }
|
||||
|
||||
fuzz_mu = fuzz_mu / n_paths;
|
||||
fuzz_mu = fuzz_mu / n_items;
|
||||
|
||||
if (log2(afl->n_fuzz[q->n_fuzz_entry]) > fuzz_mu) {
|
||||
|
||||
@ -1018,7 +1018,7 @@ u32 calculate_score(afl_state_t *afl, struct queue_entry *q) {
|
||||
-- rare. the simpler algo however is good when rare is not.
|
||||
// the newer the entry, the higher the pref_score
|
||||
perf_score *= (1 + (double)((double)q->depth /
|
||||
(double)afl->queued_paths));
|
||||
(double)afl->queued_items));
|
||||
// with special focus on the last 8 entries
|
||||
if (afl->max_depth - q->depth < 8) perf_score *= (1 + ((8 -
|
||||
(afl->max_depth - q->depth)) / 5));
|
||||
|
||||
@ -276,7 +276,7 @@ static u8 colorization(afl_state_t *afl, u8 *buf, u32 len,
|
||||
#endif
|
||||
|
||||
u64 orig_hit_cnt, new_hit_cnt, exec_cksum;
|
||||
orig_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
orig_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_name = "colorization";
|
||||
afl->stage_short = "colorization";
|
||||
@ -424,7 +424,7 @@ static u8 colorization(afl_state_t *afl, u8 *buf, u32 len,
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
#if defined(_DEBUG) || defined(CMPLOG_INTROSPECTION)
|
||||
FILE *f = stderr;
|
||||
@ -461,7 +461,7 @@ static u8 colorization(afl_state_t *afl, u8 *buf, u32 len,
|
||||
|
||||
if (afl->colorize_success && afl->cmplog_lvl < 3 &&
|
||||
(positions > CMPLOG_POSITIONS_MAX && len / positions == 1 &&
|
||||
afl->active_paths / afl->colorize_success > CMPLOG_CORPUS_PERCENT)) {
|
||||
afl->active_items / afl->colorize_success > CMPLOG_CORPUS_PERCENT)) {
|
||||
|
||||
#ifdef _DEBUG
|
||||
fprintf(stderr, "Colorization unsatisfactory\n");
|
||||
@ -517,7 +517,7 @@ static u8 its_fuzz(afl_state_t *afl, u8 *buf, u32 len, u8 *status) {
|
||||
|
||||
u64 orig_hit_cnt, new_hit_cnt;
|
||||
|
||||
orig_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
orig_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
#ifdef _DEBUG
|
||||
dump("DATA", buf, len);
|
||||
@ -525,7 +525,7 @@ static u8 its_fuzz(afl_state_t *afl, u8 *buf, u32 len, u8 *status) {
|
||||
|
||||
if (unlikely(common_fuzz_stuff(afl, buf, len))) { return 1; }
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
if (unlikely(new_hit_cnt != orig_hit_cnt)) {
|
||||
|
||||
@ -2720,7 +2720,7 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
|
||||
|
||||
u64 orig_hit_cnt, new_hit_cnt;
|
||||
u64 orig_execs = afl->fsrv.total_execs;
|
||||
orig_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
orig_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
|
||||
afl->stage_name = "input-to-state";
|
||||
afl->stage_short = "its";
|
||||
@ -2845,7 +2845,7 @@ exit_its:
|
||||
}
|
||||
|
||||
#ifdef CMPLOG_COMBINE
|
||||
if (afl->queued_paths + afl->unique_crashes > orig_hit_cnt + 1) {
|
||||
if (afl->queued_items + afl->saved_crashes > orig_hit_cnt + 1) {
|
||||
|
||||
// copy the current virgin bits so we can recover the information
|
||||
u8 *virgin_save = afl_realloc((void **)&afl->eff_buf, afl->shm.map_size);
|
||||
@ -2897,7 +2897,7 @@ exit_its:
|
||||
|
||||
#endif
|
||||
|
||||
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
|
||||
new_hit_cnt = afl->queued_items + afl->saved_crashes;
|
||||
afl->stage_finds[STAGE_ITS] += new_hit_cnt - orig_hit_cnt;
|
||||
afl->stage_cycles[STAGE_ITS] += afl->fsrv.total_execs - orig_execs;
|
||||
|
||||
|
||||
@ -953,7 +953,7 @@ common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
|
||||
|
||||
if (afl->subseq_tmouts++ > TMOUT_LIMIT) {
|
||||
|
||||
++afl->cur_skipped_paths;
|
||||
++afl->cur_skipped_items;
|
||||
return 1;
|
||||
|
||||
}
|
||||
@ -970,7 +970,7 @@ common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
|
||||
if (afl->skip_requested) {
|
||||
|
||||
afl->skip_requested = 0;
|
||||
++afl->cur_skipped_paths;
|
||||
++afl->cur_skipped_items;
|
||||
return 1;
|
||||
|
||||
}
|
||||
|
||||
@ -147,10 +147,10 @@ void load_stats_file(afl_state_t *afl) {
|
||||
afl->fsrv.total_execs = strtoull(lptr, &nptr, 10);
|
||||
break;
|
||||
case 10:
|
||||
if (!strcmp(keystring, "paths_total ")) {
|
||||
if (!strcmp(keystring, "corpus_count ")) {
|
||||
|
||||
u32 paths_total = strtoul(lptr, &nptr, 10);
|
||||
if (paths_total != afl->queued_paths) {
|
||||
u32 corpus_count = strtoul(lptr, &nptr, 10);
|
||||
if (corpus_count != afl->queued_items) {
|
||||
|
||||
WARNF(
|
||||
"queue/ has been modified -- things might not work, you're "
|
||||
@ -162,11 +162,11 @@ void load_stats_file(afl_state_t *afl) {
|
||||
|
||||
break;
|
||||
case 12:
|
||||
if (!strcmp(keystring, "paths_found "))
|
||||
if (!strcmp(keystring, "corpus_found "))
|
||||
afl->queued_discovered = strtoul(lptr, &nptr, 10);
|
||||
break;
|
||||
case 13:
|
||||
if (!strcmp(keystring, "paths_imported "))
|
||||
if (!strcmp(keystring, "corpus_imported "))
|
||||
afl->queued_imported = strtoul(lptr, &nptr, 10);
|
||||
break;
|
||||
case 14:
|
||||
@ -174,12 +174,12 @@ void load_stats_file(afl_state_t *afl) {
|
||||
afl->max_depth = strtoul(lptr, &nptr, 10);
|
||||
break;
|
||||
case 21:
|
||||
if (!strcmp(keystring, "unique_crashes "))
|
||||
afl->unique_crashes = strtoull(lptr, &nptr, 10);
|
||||
if (!strcmp(keystring, "saved_crashes "))
|
||||
afl->saved_crashes = strtoull(lptr, &nptr, 10);
|
||||
break;
|
||||
case 22:
|
||||
if (!strcmp(keystring, "unique_hangs "))
|
||||
afl->unique_hangs = strtoull(lptr, &nptr, 10);
|
||||
if (!strcmp(keystring, "saved_hangs "))
|
||||
afl->saved_hangs = strtoull(lptr, &nptr, 10);
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
@ -190,7 +190,7 @@ void load_stats_file(afl_state_t *afl) {
|
||||
|
||||
}
|
||||
|
||||
if (afl->unique_crashes) { write_crash_readme(afl); }
|
||||
if (afl->saved_crashes) { write_crash_readme(afl); }
|
||||
|
||||
return;
|
||||
|
||||
@ -243,96 +243,95 @@ void write_stats_file(afl_state_t *afl, u32 t_bytes, double bitmap_cvg,
|
||||
if (getrusage(RUSAGE_CHILDREN, &rus)) { rus.ru_maxrss = 0; }
|
||||
#endif
|
||||
|
||||
fprintf(f,
|
||||
"start_time : %llu\n"
|
||||
"last_update : %llu\n"
|
||||
"run_time : %llu\n"
|
||||
"fuzzer_pid : %u\n"
|
||||
"cycles_done : %llu\n"
|
||||
"cycles_wo_finds : %llu\n"
|
||||
"execs_done : %llu\n"
|
||||
"execs_per_sec : %0.02f\n"
|
||||
"execs_ps_last_min : %0.02f\n"
|
||||
"paths_total : %u\n"
|
||||
"paths_favored : %u\n"
|
||||
"paths_found : %u\n"
|
||||
"paths_imported : %u\n"
|
||||
"max_depth : %u\n"
|
||||
"cur_path : %u\n" /* Must match find_start_position() */
|
||||
"pending_favs : %u\n"
|
||||
"pending_total : %u\n"
|
||||
"variable_paths : %u\n"
|
||||
"stability : %0.02f%%\n"
|
||||
"bitmap_cvg : %0.02f%%\n"
|
||||
"unique_crashes : %llu\n"
|
||||
"unique_hangs : %llu\n"
|
||||
"last_path : %llu\n"
|
||||
"last_crash : %llu\n"
|
||||
"last_hang : %llu\n"
|
||||
"execs_since_crash : %llu\n"
|
||||
"exec_timeout : %u\n"
|
||||
"slowest_exec_ms : %u\n"
|
||||
"peak_rss_mb : %lu\n"
|
||||
"cpu_affinity : %d\n"
|
||||
"edges_found : %u\n"
|
||||
"total_edges : %u\n"
|
||||
"var_byte_count : %u\n"
|
||||
"havoc_expansion : %u\n"
|
||||
"auto_dict_entries : %u\n"
|
||||
"testcache_size : %llu\n"
|
||||
"testcache_count : %u\n"
|
||||
"testcache_evict : %u\n"
|
||||
"afl_banner : %s\n"
|
||||
"afl_version : " VERSION
|
||||
"\n"
|
||||
"target_mode : %s%s%s%s%s%s%s%s%s%s\n"
|
||||
"command_line : %s\n",
|
||||
(afl->start_time - afl->prev_run_time) / 1000, cur_time / 1000,
|
||||
(afl->prev_run_time + cur_time - afl->start_time) / 1000,
|
||||
(u32)getpid(), afl->queue_cycle ? (afl->queue_cycle - 1) : 0,
|
||||
afl->cycles_wo_finds, afl->fsrv.total_execs,
|
||||
afl->fsrv.total_execs /
|
||||
((double)(afl->prev_run_time + get_cur_time() - afl->start_time) /
|
||||
1000),
|
||||
afl->last_avg_execs_saved, afl->queued_paths, afl->queued_favored,
|
||||
afl->queued_discovered, afl->queued_imported, afl->max_depth,
|
||||
afl->current_entry, afl->pending_favored, afl->pending_not_fuzzed,
|
||||
afl->queued_variable, stability, bitmap_cvg, afl->unique_crashes,
|
||||
afl->unique_hangs, afl->last_path_time / 1000,
|
||||
afl->last_crash_time / 1000, afl->last_hang_time / 1000,
|
||||
afl->fsrv.total_execs - afl->last_crash_execs, afl->fsrv.exec_tmout,
|
||||
afl->slowest_exec_ms,
|
||||
fprintf(
|
||||
f,
|
||||
"start_time : %llu\n"
|
||||
"last_update : %llu\n"
|
||||
"run_time : %llu\n"
|
||||
"fuzzer_pid : %u\n"
|
||||
"cycles_done : %llu\n"
|
||||
"cycles_wo_finds : %llu\n"
|
||||
"execs_done : %llu\n"
|
||||
"execs_per_sec : %0.02f\n"
|
||||
"execs_ps_last_min : %0.02f\n"
|
||||
"corpus_count : %u\n"
|
||||
"corpus_favored : %u\n"
|
||||
"corpus_found : %u\n"
|
||||
"corpus_imported : %u\n"
|
||||
"corpus_variable : %u\n"
|
||||
"max_depth : %u\n"
|
||||
"cur_item : %u\n"
|
||||
"pending_favs : %u\n"
|
||||
"pending_total : %u\n"
|
||||
"stability : %0.02f%%\n"
|
||||
"bitmap_cvg : %0.02f%%\n"
|
||||
"saved_crashes : %llu\n"
|
||||
"saved_hangs : %llu\n"
|
||||
"last_find : %llu\n"
|
||||
"last_crash : %llu\n"
|
||||
"last_hang : %llu\n"
|
||||
"execs_since_crash : %llu\n"
|
||||
"exec_timeout : %u\n"
|
||||
"slowest_exec_ms : %u\n"
|
||||
"peak_rss_mb : %lu\n"
|
||||
"cpu_affinity : %d\n"
|
||||
"edges_found : %u\n"
|
||||
"total_edges : %u\n"
|
||||
"var_byte_count : %u\n"
|
||||
"havoc_expansion : %u\n"
|
||||
"auto_dict_entries : %u\n"
|
||||
"testcache_size : %llu\n"
|
||||
"testcache_count : %u\n"
|
||||
"testcache_evict : %u\n"
|
||||
"afl_banner : %s\n"
|
||||
"afl_version : " VERSION
|
||||
"\n"
|
||||
"target_mode : %s%s%s%s%s%s%s%s%s%s\n"
|
||||
"command_line : %s\n",
|
||||
(afl->start_time - afl->prev_run_time) / 1000, cur_time / 1000,
|
||||
(afl->prev_run_time + cur_time - afl->start_time) / 1000, (u32)getpid(),
|
||||
afl->queue_cycle ? (afl->queue_cycle - 1) : 0, afl->cycles_wo_finds,
|
||||
afl->fsrv.total_execs,
|
||||
afl->fsrv.total_execs /
|
||||
((double)(afl->prev_run_time + get_cur_time() - afl->start_time) /
|
||||
1000),
|
||||
afl->last_avg_execs_saved, afl->queued_items, afl->queued_favored,
|
||||
afl->queued_discovered, afl->queued_imported, afl->queued_variable,
|
||||
afl->max_depth, afl->current_entry, afl->pending_favored,
|
||||
afl->pending_not_fuzzed, stability, bitmap_cvg, afl->saved_crashes,
|
||||
afl->saved_hangs, afl->last_find_time / 1000, afl->last_crash_time / 1000,
|
||||
afl->last_hang_time / 1000, afl->fsrv.total_execs - afl->last_crash_execs,
|
||||
afl->fsrv.exec_tmout, afl->slowest_exec_ms,
|
||||
#ifndef __HAIKU__
|
||||
#ifdef __APPLE__
|
||||
(unsigned long int)(rus.ru_maxrss >> 20),
|
||||
(unsigned long int)(rus.ru_maxrss >> 20),
|
||||
#else
|
||||
(unsigned long int)(rus.ru_maxrss >> 10),
|
||||
(unsigned long int)(rus.ru_maxrss >> 10),
|
||||
#endif
|
||||
#else
|
||||
-1UL,
|
||||
-1UL,
|
||||
#endif
|
||||
#ifdef HAVE_AFFINITY
|
||||
afl->cpu_aff,
|
||||
afl->cpu_aff,
|
||||
#else
|
||||
-1,
|
||||
-1,
|
||||
#endif
|
||||
t_bytes, afl->fsrv.real_map_size, afl->var_byte_count,
|
||||
afl->expand_havoc, afl->a_extras_cnt, afl->q_testcase_cache_size,
|
||||
afl->q_testcase_cache_count, afl->q_testcase_evictions,
|
||||
afl->use_banner, afl->unicorn_mode ? "unicorn" : "",
|
||||
afl->fsrv.qemu_mode ? "qemu " : "",
|
||||
afl->fsrv.cs_mode ? "coresight" : "",
|
||||
afl->non_instrumented_mode ? " non_instrumented " : "",
|
||||
afl->no_forkserver ? "no_fsrv " : "", afl->crash_mode ? "crash " : "",
|
||||
afl->persistent_mode ? "persistent " : "",
|
||||
afl->shmem_testcase_mode ? "shmem_testcase " : "",
|
||||
afl->deferred_mode ? "deferred " : "",
|
||||
(afl->unicorn_mode || afl->fsrv.qemu_mode || afl->fsrv.cs_mode ||
|
||||
afl->non_instrumented_mode || afl->no_forkserver ||
|
||||
afl->crash_mode || afl->persistent_mode || afl->deferred_mode)
|
||||
? ""
|
||||
: "default",
|
||||
afl->orig_cmdline);
|
||||
t_bytes, afl->fsrv.real_map_size, afl->var_byte_count, afl->expand_havoc,
|
||||
afl->a_extras_cnt, afl->q_testcase_cache_size,
|
||||
afl->q_testcase_cache_count, afl->q_testcase_evictions, afl->use_banner,
|
||||
afl->unicorn_mode ? "unicorn" : "", afl->fsrv.qemu_mode ? "qemu " : "",
|
||||
afl->fsrv.cs_mode ? "coresight" : "",
|
||||
afl->non_instrumented_mode ? " non_instrumented " : "",
|
||||
afl->no_forkserver ? "no_fsrv " : "", afl->crash_mode ? "crash " : "",
|
||||
afl->persistent_mode ? "persistent " : "",
|
||||
afl->shmem_testcase_mode ? "shmem_testcase " : "",
|
||||
afl->deferred_mode ? "deferred " : "",
|
||||
(afl->unicorn_mode || afl->fsrv.qemu_mode || afl->fsrv.cs_mode ||
|
||||
afl->non_instrumented_mode || afl->no_forkserver || afl->crash_mode ||
|
||||
afl->persistent_mode || afl->deferred_mode)
|
||||
? ""
|
||||
: "default",
|
||||
afl->orig_cmdline);
|
||||
|
||||
/* ignore errors */
|
||||
|
||||
@ -373,13 +372,13 @@ void maybe_update_plot_file(afl_state_t *afl, u32 t_bytes, double bitmap_cvg,
|
||||
|
||||
if (unlikely(!afl->force_ui_update &&
|
||||
(afl->stop_soon ||
|
||||
(afl->plot_prev_qp == afl->queued_paths &&
|
||||
(afl->plot_prev_qp == afl->queued_items &&
|
||||
afl->plot_prev_pf == afl->pending_favored &&
|
||||
afl->plot_prev_pnf == afl->pending_not_fuzzed &&
|
||||
afl->plot_prev_ce == afl->current_entry &&
|
||||
afl->plot_prev_qc == afl->queue_cycle &&
|
||||
afl->plot_prev_uc == afl->unique_crashes &&
|
||||
afl->plot_prev_uh == afl->unique_hangs &&
|
||||
afl->plot_prev_uc == afl->saved_crashes &&
|
||||
afl->plot_prev_uh == afl->saved_hangs &&
|
||||
afl->plot_prev_md == afl->max_depth &&
|
||||
afl->plot_prev_ed == afl->fsrv.total_execs) ||
|
||||
!afl->queue_cycle ||
|
||||
@ -389,29 +388,29 @@ void maybe_update_plot_file(afl_state_t *afl, u32 t_bytes, double bitmap_cvg,
|
||||
|
||||
}
|
||||
|
||||
afl->plot_prev_qp = afl->queued_paths;
|
||||
afl->plot_prev_qp = afl->queued_items;
|
||||
afl->plot_prev_pf = afl->pending_favored;
|
||||
afl->plot_prev_pnf = afl->pending_not_fuzzed;
|
||||
afl->plot_prev_ce = afl->current_entry;
|
||||
afl->plot_prev_qc = afl->queue_cycle;
|
||||
afl->plot_prev_uc = afl->unique_crashes;
|
||||
afl->plot_prev_uh = afl->unique_hangs;
|
||||
afl->plot_prev_uc = afl->saved_crashes;
|
||||
afl->plot_prev_uh = afl->saved_hangs;
|
||||
afl->plot_prev_md = afl->max_depth;
|
||||
afl->plot_prev_ed = afl->fsrv.total_execs;
|
||||
|
||||
/* Fields in the file:
|
||||
|
||||
relative_time, afl->cycles_done, cur_path, paths_total, paths_not_fuzzed,
|
||||
favored_not_fuzzed, unique_crashes, unique_hangs, max_depth,
|
||||
relative_time, afl->cycles_done, cur_item, corpus_count, corpus_not_fuzzed,
|
||||
favored_not_fuzzed, saved_crashes, saved_hangs, max_depth,
|
||||
execs_per_sec, edges_found */
|
||||
|
||||
fprintf(afl->fsrv.plot_file,
|
||||
"%llu, %llu, %u, %u, %u, %u, %0.02f%%, %llu, %llu, %u, %0.02f, %llu, "
|
||||
"%u\n",
|
||||
((afl->prev_run_time + get_cur_time() - afl->start_time) / 1000),
|
||||
afl->queue_cycle - 1, afl->current_entry, afl->queued_paths,
|
||||
afl->queue_cycle - 1, afl->current_entry, afl->queued_items,
|
||||
afl->pending_not_fuzzed, afl->pending_favored, bitmap_cvg,
|
||||
afl->unique_crashes, afl->unique_hangs, afl->max_depth, eps,
|
||||
afl->saved_crashes, afl->saved_hangs, afl->max_depth, eps,
|
||||
afl->plot_prev_ed, t_bytes); /* ignore errors */
|
||||
|
||||
fflush(afl->fsrv.plot_file);
|
||||
@ -611,9 +610,9 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
/* AFL_EXIT_ON_TIME. */
|
||||
|
||||
if (unlikely(afl->last_path_time && !afl->non_instrumented_mode &&
|
||||
if (unlikely(afl->last_find_time && !afl->non_instrumented_mode &&
|
||||
afl->afl_env.afl_exit_on_time &&
|
||||
(cur_ms - afl->last_path_time) > afl->exit_on_time)) {
|
||||
(cur_ms - afl->last_find_time) > afl->exit_on_time)) {
|
||||
|
||||
afl->stop_soon = 2;
|
||||
|
||||
@ -704,10 +703,10 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
/* Since `total_crashes` does not get reloaded from disk on restart,
|
||||
it indicates if we found crashes this round already -> paint red.
|
||||
If it's 0, but `unique_crashes` is set from a past run, paint in yellow. */
|
||||
char *crash_color = afl->total_crashes ? cLRD
|
||||
: afl->unique_crashes ? cYEL
|
||||
: cRST;
|
||||
If it's 0, but `saved_crashes` is set from a past run, paint in yellow. */
|
||||
char *crash_color = afl->total_crashes ? cLRD
|
||||
: afl->saved_crashes ? cYEL
|
||||
: cRST;
|
||||
|
||||
/* Lord, forgive me this. */
|
||||
|
||||
@ -721,7 +720,7 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
} else {
|
||||
|
||||
u64 min_wo_finds = (cur_ms - afl->last_path_time) / 1000 / 60;
|
||||
u64 min_wo_finds = (cur_ms - afl->last_find_time) / 1000 / 60;
|
||||
|
||||
/* First queue cycle: don't stop now! */
|
||||
if (afl->queue_cycle == 1 || min_wo_finds < 15) {
|
||||
@ -762,48 +761,48 @@ void show_stats(afl_state_t *afl) {
|
||||
except when resuming fuzzing or running in non-instrumented mode. */
|
||||
|
||||
if (!afl->non_instrumented_mode &&
|
||||
(afl->last_path_time || afl->resuming_fuzz || afl->queue_cycle == 1 ||
|
||||
(afl->last_find_time || afl->resuming_fuzz || afl->queue_cycle == 1 ||
|
||||
afl->in_bitmap || afl->crash_mode)) {
|
||||
|
||||
u_stringify_time_diff(time_tmp, cur_ms, afl->last_path_time);
|
||||
SAYF(bV bSTOP " last new path : " cRST "%-33s ", time_tmp);
|
||||
u_stringify_time_diff(time_tmp, cur_ms, afl->last_find_time);
|
||||
SAYF(bV bSTOP " last new find : " cRST "%-33s ", time_tmp);
|
||||
|
||||
} else {
|
||||
|
||||
if (afl->non_instrumented_mode) {
|
||||
|
||||
SAYF(bV bSTOP " last new path : " cPIN "n/a" cRST
|
||||
SAYF(bV bSTOP " last new find : " cPIN "n/a" cRST
|
||||
" (non-instrumented mode) ");
|
||||
|
||||
} else {
|
||||
|
||||
SAYF(bV bSTOP " last new path : " cRST "none yet " cLRD
|
||||
SAYF(bV bSTOP " last new find : " cRST "none yet " cLRD
|
||||
"(odd, check syntax!) ");
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
SAYF(bSTG bV bSTOP " total paths : " cRST "%-5s " bSTG bV "\n",
|
||||
u_stringify_int(IB(0), afl->queued_paths));
|
||||
SAYF(bSTG bV bSTOP " corpus count : " cRST "%-5s " bSTG bV "\n",
|
||||
u_stringify_int(IB(0), afl->queued_items));
|
||||
|
||||
/* Highlight crashes in red if found, denote going over the KEEP_UNIQUE_CRASH
|
||||
limit with a '+' appended to the count. */
|
||||
|
||||
sprintf(tmp, "%s%s", u_stringify_int(IB(0), afl->unique_crashes),
|
||||
(afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : "");
|
||||
sprintf(tmp, "%s%s", u_stringify_int(IB(0), afl->saved_crashes),
|
||||
(afl->saved_crashes >= KEEP_UNIQUE_CRASH) ? "+" : "");
|
||||
|
||||
u_stringify_time_diff(time_tmp, cur_ms, afl->last_crash_time);
|
||||
SAYF(bV bSTOP " last uniq crash : " cRST "%-33s " bSTG bV bSTOP
|
||||
" uniq crashes : %s%-6s" bSTG bV "\n",
|
||||
SAYF(bV bSTOP "last saved crash : " cRST "%-33s " bSTG bV bSTOP
|
||||
"saved crashes : %s%-6s" bSTG bV "\n",
|
||||
time_tmp, crash_color, tmp);
|
||||
|
||||
sprintf(tmp, "%s%s", u_stringify_int(IB(0), afl->unique_hangs),
|
||||
(afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
|
||||
sprintf(tmp, "%s%s", u_stringify_int(IB(0), afl->saved_hangs),
|
||||
(afl->saved_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
|
||||
|
||||
u_stringify_time_diff(time_tmp, cur_ms, afl->last_hang_time);
|
||||
SAYF(bV bSTOP " last uniq hang : " cRST "%-33s " bSTG bV bSTOP
|
||||
" uniq hangs : " cRST "%-6s" bSTG bV "\n",
|
||||
SAYF(bV bSTOP " last saved hang : " cRST "%-33s " bSTG bV bSTOP
|
||||
" saved hangs : " cRST "%-6s" bSTG bV "\n",
|
||||
time_tmp, tmp);
|
||||
|
||||
SAYF(bVR bH bSTOP cCYA
|
||||
@ -816,7 +815,7 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
sprintf(tmp, "%s%s%u (%0.01f%%)", u_stringify_int(IB(0), afl->current_entry),
|
||||
afl->queue_cur->favored ? "." : "*", afl->queue_cur->fuzz_level,
|
||||
((double)afl->current_entry * 100) / afl->queued_paths);
|
||||
((double)afl->current_entry * 100) / afl->queued_items);
|
||||
|
||||
SAYF(bV bSTOP " now processing : " cRST "%-18s " bSTG bV bSTOP, tmp);
|
||||
|
||||
@ -830,10 +829,10 @@ void show_stats(afl_state_t *afl) {
|
||||
: ((t_bytes < 200 && !afl->non_instrumented_mode) ? cPIN : cRST),
|
||||
tmp);
|
||||
|
||||
sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->cur_skipped_paths),
|
||||
((double)afl->cur_skipped_paths * 100) / afl->queued_paths);
|
||||
sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->cur_skipped_items),
|
||||
((double)afl->cur_skipped_items * 100) / afl->queued_items);
|
||||
|
||||
SAYF(bV bSTOP " paths timed out : " cRST "%-18s " bSTG bV, tmp);
|
||||
SAYF(bV bSTOP " runs timed out : " cRST "%-18s " bSTG bV, tmp);
|
||||
|
||||
sprintf(tmp, "%0.02f bits/tuple", t_bytes ? (((double)t_bits) / t_bytes) : 0);
|
||||
|
||||
@ -844,12 +843,12 @@ void show_stats(afl_state_t *afl) {
|
||||
" findings in depth " bSTG bH10 bH5 bH2 bVL "\n");
|
||||
|
||||
sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_favored),
|
||||
((double)afl->queued_favored) * 100 / afl->queued_paths);
|
||||
((double)afl->queued_favored) * 100 / afl->queued_items);
|
||||
|
||||
/* Yeah... it's still going on... halp? */
|
||||
|
||||
SAYF(bV bSTOP " now trying : " cRST "%-22s " bSTG bV bSTOP
|
||||
" favored paths : " cRST "%-20s" bSTG bV "\n",
|
||||
" favored items : " cRST "%-20s" bSTG bV "\n",
|
||||
afl->stage_name, tmp);
|
||||
|
||||
if (!afl->stage_max) {
|
||||
@ -867,13 +866,13 @@ void show_stats(afl_state_t *afl) {
|
||||
SAYF(bV bSTOP " stage execs : " cRST "%-23s" bSTG bV bSTOP, tmp);
|
||||
|
||||
sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_with_cov),
|
||||
((double)afl->queued_with_cov) * 100 / afl->queued_paths);
|
||||
((double)afl->queued_with_cov) * 100 / afl->queued_items);
|
||||
|
||||
SAYF(" new edges on : " cRST "%-20s" bSTG bV "\n", tmp);
|
||||
|
||||
sprintf(tmp, "%s (%s%s unique)", u_stringify_int(IB(0), afl->total_crashes),
|
||||
u_stringify_int(IB(1), afl->unique_crashes),
|
||||
(afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : "");
|
||||
sprintf(tmp, "%s (%s%s saved)", u_stringify_int(IB(0), afl->total_crashes),
|
||||
u_stringify_int(IB(1), afl->saved_crashes),
|
||||
(afl->saved_crashes >= KEEP_UNIQUE_CRASH) ? "+" : "");
|
||||
|
||||
if (afl->crash_mode) {
|
||||
|
||||
@ -905,16 +904,16 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
}
|
||||
|
||||
sprintf(tmp, "%s (%s%s unique)", u_stringify_int(IB(0), afl->total_tmouts),
|
||||
u_stringify_int(IB(1), afl->unique_tmouts),
|
||||
(afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
|
||||
sprintf(tmp, "%s (%s%s saved)", u_stringify_int(IB(0), afl->total_tmouts),
|
||||
u_stringify_int(IB(1), afl->saved_tmouts),
|
||||
(afl->saved_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
|
||||
|
||||
SAYF(bSTG bV bSTOP " total tmouts : " cRST "%-20s" bSTG bV "\n", tmp);
|
||||
|
||||
/* Aaaalmost there... hold on! */
|
||||
|
||||
SAYF(bVR bH cCYA bSTOP " fuzzing strategy yields " bSTG bH10 bH2 bHT bH10 bH2
|
||||
bH bHB bH bSTOP cCYA " path geometry " bSTG bH5 bH2 bVL "\n");
|
||||
bH bHB bH bSTOP cCYA " item geometry " bSTG bH5 bH2 bVL "\n");
|
||||
|
||||
if (unlikely(afl->custom_only)) {
|
||||
|
||||
@ -1222,7 +1221,7 @@ void show_init_stats(afl_state_t *afl) {
|
||||
|
||||
}
|
||||
|
||||
for (i = 0; i < afl->queued_paths; i++) {
|
||||
for (i = 0; i < afl->queued_items; i++) {
|
||||
|
||||
q = afl->queue_buf[i];
|
||||
if (unlikely(q->disabled)) { continue; }
|
||||
@ -1290,13 +1289,13 @@ void show_init_stats(afl_state_t *afl) {
|
||||
|
||||
}
|
||||
|
||||
if (afl->queued_paths > 100) {
|
||||
if (afl->queued_items > 100) {
|
||||
|
||||
WARNF(cLRD
|
||||
"You probably have far too many input files! Consider trimming "
|
||||
"down.");
|
||||
|
||||
} else if (afl->queued_paths > 20) {
|
||||
} else if (afl->queued_items > 20) {
|
||||
|
||||
WARNF("You have lots of input files; try starting small.");
|
||||
|
||||
@ -1311,8 +1310,8 @@ void show_init_stats(afl_state_t *afl) {
|
||||
" Bitmap range : " cRST
|
||||
"%u to %u bits (average: %0.02f bits)\n" cGRA
|
||||
" Exec timing : " cRST "%s to %s us (average: %s us)\n",
|
||||
afl->queued_favored, afl->queued_variable, afl->queued_paths - count,
|
||||
afl->queued_paths, min_bits, max_bits,
|
||||
afl->queued_favored, afl->queued_variable, afl->queued_items - count,
|
||||
afl->queued_items, min_bits, max_bits,
|
||||
((double)afl->total_bitmap_size) /
|
||||
(afl->total_bitmap_entries ? afl->total_bitmap_entries : 1),
|
||||
stringify_int(IB(0), min_us), stringify_int(IB(1), max_us),
|
||||
|
||||
@ -42,46 +42,48 @@
|
||||
|
||||
// For DogstatsD
|
||||
#define STATSD_TAGS_TYPE_SUFFIX 1
|
||||
#define STATSD_TAGS_SUFFIX_METRICS \
|
||||
METRIC_PREFIX \
|
||||
".cycle_done:%llu|g%s\n" METRIC_PREFIX \
|
||||
".cycles_wo_finds:%llu|g%s\n" METRIC_PREFIX \
|
||||
".execs_done:%llu|g%s\n" METRIC_PREFIX \
|
||||
".execs_per_sec:%0.02f|g%s\n" METRIC_PREFIX \
|
||||
".paths_total:%u|g%s\n" METRIC_PREFIX \
|
||||
".paths_favored:%u|g%s\n" METRIC_PREFIX \
|
||||
".paths_found:%u|g%s\n" METRIC_PREFIX \
|
||||
".paths_imported:%u|g%s\n" METRIC_PREFIX ".max_depth:%u|g%s\n" METRIC_PREFIX \
|
||||
".cur_path:%u|g%s\n" METRIC_PREFIX ".pending_favs:%u|g%s\n" METRIC_PREFIX \
|
||||
".pending_total:%u|g%s\n" METRIC_PREFIX \
|
||||
".variable_paths:%u|g%s\n" METRIC_PREFIX \
|
||||
".unique_crashes:%llu|g%s\n" METRIC_PREFIX \
|
||||
".unique_hangs:%llu|g%s\n" METRIC_PREFIX \
|
||||
".total_crashes:%llu|g%s\n" METRIC_PREFIX \
|
||||
".slowest_exec_ms:%u|g%s\n" METRIC_PREFIX \
|
||||
".edges_found:%u|g%s\n" METRIC_PREFIX \
|
||||
#define STATSD_TAGS_SUFFIX_METRICS \
|
||||
METRIC_PREFIX \
|
||||
".cycle_done:%llu|g%s\n" METRIC_PREFIX \
|
||||
".cycles_wo_finds:%llu|g%s\n" METRIC_PREFIX \
|
||||
".execs_done:%llu|g%s\n" METRIC_PREFIX \
|
||||
".execs_per_sec:%0.02f|g%s\n" METRIC_PREFIX \
|
||||
".corpus_count:%u|g%s\n" METRIC_PREFIX \
|
||||
".corpus_favored:%u|g%s\n" METRIC_PREFIX \
|
||||
".corpus_found:%u|g%s\n" METRIC_PREFIX \
|
||||
".corpus_imported:%u|g%s\n" METRIC_PREFIX \
|
||||
".max_depth:%u|g%s\n" METRIC_PREFIX ".cur_item:%u|g%s\n" METRIC_PREFIX \
|
||||
".pending_favs:%u|g%s\n" METRIC_PREFIX \
|
||||
".pending_total:%u|g%s\n" METRIC_PREFIX \
|
||||
".corpus_variable:%u|g%s\n" METRIC_PREFIX \
|
||||
".saved_crashes:%llu|g%s\n" METRIC_PREFIX \
|
||||
".saved_hangs:%llu|g%s\n" METRIC_PREFIX \
|
||||
".total_crashes:%llu|g%s\n" METRIC_PREFIX \
|
||||
".slowest_exec_ms:%u|g%s\n" METRIC_PREFIX \
|
||||
".edges_found:%u|g%s\n" METRIC_PREFIX \
|
||||
".var_byte_count:%u|g%s\n" METRIC_PREFIX ".havoc_expansion:%u|g%s\n"
|
||||
|
||||
// For Librato, InfluxDB, SignalFX
|
||||
#define STATSD_TAGS_TYPE_MID 2
|
||||
#define STATSD_TAGS_MID_METRICS \
|
||||
METRIC_PREFIX \
|
||||
".cycle_done%s:%llu|g\n" METRIC_PREFIX \
|
||||
".cycles_wo_finds%s:%llu|g\n" METRIC_PREFIX \
|
||||
".execs_done%s:%llu|g\n" METRIC_PREFIX \
|
||||
".execs_per_sec%s:%0.02f|g\n" METRIC_PREFIX \
|
||||
".paths_total%s:%u|g\n" METRIC_PREFIX \
|
||||
".paths_favored%s:%u|g\n" METRIC_PREFIX \
|
||||
".paths_found%s:%u|g\n" METRIC_PREFIX \
|
||||
".paths_imported%s:%u|g\n" METRIC_PREFIX ".max_depth%s:%u|g\n" METRIC_PREFIX \
|
||||
".cur_path%s:%u|g\n" METRIC_PREFIX ".pending_favs%s:%u|g\n" METRIC_PREFIX \
|
||||
".pending_total%s:%u|g\n" METRIC_PREFIX \
|
||||
".variable_paths%s:%u|g\n" METRIC_PREFIX \
|
||||
".unique_crashes%s:%llu|g\n" METRIC_PREFIX \
|
||||
".unique_hangs%s:%llu|g\n" METRIC_PREFIX \
|
||||
".total_crashes%s:%llu|g\n" METRIC_PREFIX \
|
||||
".slowest_exec_ms%s:%u|g\n" METRIC_PREFIX \
|
||||
".edges_found%s:%u|g\n" METRIC_PREFIX \
|
||||
#define STATSD_TAGS_MID_METRICS \
|
||||
METRIC_PREFIX \
|
||||
".cycle_done%s:%llu|g\n" METRIC_PREFIX \
|
||||
".cycles_wo_finds%s:%llu|g\n" METRIC_PREFIX \
|
||||
".execs_done%s:%llu|g\n" METRIC_PREFIX \
|
||||
".execs_per_sec%s:%0.02f|g\n" METRIC_PREFIX \
|
||||
".corpus_count%s:%u|g\n" METRIC_PREFIX \
|
||||
".corpus_favored%s:%u|g\n" METRIC_PREFIX \
|
||||
".corpus_found%s:%u|g\n" METRIC_PREFIX \
|
||||
".corpus_imported%s:%u|g\n" METRIC_PREFIX \
|
||||
".max_depth%s:%u|g\n" METRIC_PREFIX ".cur_item%s:%u|g\n" METRIC_PREFIX \
|
||||
".pending_favs%s:%u|g\n" METRIC_PREFIX \
|
||||
".pending_total%s:%u|g\n" METRIC_PREFIX \
|
||||
".corpus_variable%s:%u|g\n" METRIC_PREFIX \
|
||||
".saved_crashes%s:%llu|g\n" METRIC_PREFIX \
|
||||
".saved_hangs%s:%llu|g\n" METRIC_PREFIX \
|
||||
".total_crashes%s:%llu|g\n" METRIC_PREFIX \
|
||||
".slowest_exec_ms%s:%u|g\n" METRIC_PREFIX \
|
||||
".edges_found%s:%u|g\n" METRIC_PREFIX \
|
||||
".var_byte_count%s:%u|g\n" METRIC_PREFIX ".havoc_expansion%s:%u|g\n"
|
||||
|
||||
void statsd_setup_format(afl_state_t *afl) {
|
||||
@ -238,11 +240,11 @@ int statsd_format_metric(afl_state_t *afl, char *buff, size_t bufflen) {
|
||||
afl->fsrv.total_execs /
|
||||
((double)(get_cur_time() + afl->prev_run_time - afl->start_time) /
|
||||
1000),
|
||||
tags, afl->queued_paths, tags, afl->queued_favored, tags,
|
||||
tags, afl->queued_items, tags, afl->queued_favored, tags,
|
||||
afl->queued_discovered, tags, afl->queued_imported, tags,
|
||||
afl->max_depth, tags, afl->current_entry, tags, afl->pending_favored,
|
||||
tags, afl->pending_not_fuzzed, tags, afl->queued_variable, tags,
|
||||
afl->unique_crashes, tags, afl->unique_hangs, tags, afl->total_crashes,
|
||||
afl->saved_crashes, tags, afl->saved_hangs, tags, afl->total_crashes,
|
||||
tags, afl->slowest_exec_ms, tags,
|
||||
count_non_255_bytes(afl, afl->virgin_bits), tags, afl->var_byte_count,
|
||||
tags, afl->expand_havoc, tags);
|
||||
@ -256,11 +258,11 @@ int statsd_format_metric(afl_state_t *afl, char *buff, size_t bufflen) {
|
||||
afl->fsrv.total_execs /
|
||||
((double)(get_cur_time() + afl->prev_run_time - afl->start_time) /
|
||||
1000),
|
||||
tags, afl->queued_paths, tags, afl->queued_favored, tags,
|
||||
tags, afl->queued_items, tags, afl->queued_favored, tags,
|
||||
afl->queued_discovered, tags, afl->queued_imported, tags,
|
||||
afl->max_depth, tags, afl->current_entry, tags, afl->pending_favored,
|
||||
tags, afl->pending_not_fuzzed, tags, afl->queued_variable, tags,
|
||||
afl->unique_crashes, tags, afl->unique_hangs, tags, afl->total_crashes,
|
||||
afl->saved_crashes, tags, afl->saved_hangs, tags, afl->total_crashes,
|
||||
tags, afl->slowest_exec_ms, tags,
|
||||
count_non_255_bytes(afl, afl->virgin_bits), tags, afl->var_byte_count,
|
||||
tags, afl->expand_havoc);
|
||||
|
||||
@ -129,7 +129,7 @@ static void usage(u8 *argv0, int more_help) {
|
||||
" -D - enable deterministic fuzzing (once per queue entry)\n"
|
||||
" -L minutes - use MOpt(imize) mode and set the time limit for "
|
||||
"entering the\n"
|
||||
" pacemaker mode (minutes of no new paths). 0 = "
|
||||
" pacemaker mode (minutes of no new finds). 0 = "
|
||||
"immediately,\n"
|
||||
" -1 = immediately and together with normal mutation.\n"
|
||||
" See docs/README.MOpt.md\n"
|
||||
@ -214,7 +214,7 @@ static void usage(u8 *argv0, int more_help) {
|
||||
"AFL_DISABLE_TRIM: disable the trimming of test cases\n"
|
||||
"AFL_DUMB_FORKSRV: use fork server without feedback from target\n"
|
||||
"AFL_EXIT_WHEN_DONE: exit when all inputs are run and no new finds are found\n"
|
||||
"AFL_EXIT_ON_TIME: exit when no new paths are found within the specified time period\n"
|
||||
"AFL_EXIT_ON_TIME: exit when no new coverage finds are made within the specified time period\n"
|
||||
"AFL_EXPAND_HAVOC_NOW: immediately enable expand havoc mode (default: after 60 minutes and a cycle without finds)\n"
|
||||
"AFL_FAST_CAL: limit the calibration stage to three cycles for speedup\n"
|
||||
"AFL_FORCE_UI: force showing the status screen (for virtual consoles)\n"
|
||||
@ -1607,7 +1607,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
read_testcases(afl, NULL);
|
||||
// read_foreign_testcases(afl, 1); for the moment dont do this
|
||||
OKF("Loaded a total of %u seeds.", afl->queued_paths);
|
||||
OKF("Loaded a total of %u seeds.", afl->queued_items);
|
||||
|
||||
pivot_inputs(afl);
|
||||
|
||||
@ -1929,7 +1929,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
// ensure we have at least one seed that is not disabled.
|
||||
u32 entry, valid_seeds = 0;
|
||||
for (entry = 0; entry < afl->queued_paths; ++entry)
|
||||
for (entry = 0; entry < afl->queued_items; ++entry)
|
||||
if (!afl->queue_buf[entry]->disabled) { ++valid_seeds; }
|
||||
|
||||
if (!afl->pending_not_fuzzed || !valid_seeds) {
|
||||
@ -1951,7 +1951,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
u64 max_ms = 0;
|
||||
|
||||
for (entry = 0; entry < afl->queued_paths; ++entry)
|
||||
for (entry = 0; entry < afl->queued_items; ++entry)
|
||||
if (!afl->queue_buf[entry]->disabled)
|
||||
if (afl->queue_buf[entry]->exec_us > max_ms)
|
||||
max_ms = afl->queue_buf[entry]->exec_us;
|
||||
@ -1993,7 +1993,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
afl->start_time = get_cur_time();
|
||||
|
||||
u32 runs_in_current_cycle = (u32)-1;
|
||||
u32 prev_queued_paths = 0;
|
||||
u32 prev_queued_items = 0;
|
||||
u8 skipped_fuzz;
|
||||
|
||||
#ifdef INTROSPECTION
|
||||
@ -2014,7 +2014,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
cull_queue(afl);
|
||||
|
||||
if (unlikely((!afl->old_seed_selection &&
|
||||
runs_in_current_cycle > afl->queued_paths) ||
|
||||
runs_in_current_cycle > afl->queued_items) ||
|
||||
(afl->old_seed_selection && !afl->queue_cur))) {
|
||||
|
||||
if (unlikely((afl->last_sync_cycle < afl->queue_cycle ||
|
||||
@ -2027,25 +2027,25 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
++afl->queue_cycle;
|
||||
runs_in_current_cycle = (u32)-1;
|
||||
afl->cur_skipped_paths = 0;
|
||||
afl->cur_skipped_items = 0;
|
||||
|
||||
if (unlikely(afl->old_seed_selection)) {
|
||||
|
||||
afl->current_entry = 0;
|
||||
while (unlikely(afl->current_entry < afl->queued_paths &&
|
||||
while (unlikely(afl->current_entry < afl->queued_items &&
|
||||
afl->queue_buf[afl->current_entry]->disabled)) {
|
||||
|
||||
++afl->current_entry;
|
||||
|
||||
}
|
||||
|
||||
if (afl->current_entry >= afl->queued_paths) { afl->current_entry = 0; }
|
||||
if (afl->current_entry >= afl->queued_items) { afl->current_entry = 0; }
|
||||
|
||||
afl->queue_cur = afl->queue_buf[afl->current_entry];
|
||||
|
||||
if (unlikely(seek_to)) {
|
||||
|
||||
if (unlikely(seek_to >= afl->queued_paths)) {
|
||||
if (unlikely(seek_to >= afl->queued_items)) {
|
||||
|
||||
// This should never happen.
|
||||
FATAL("BUG: seek_to location out of bounds!\n");
|
||||
@ -2070,7 +2070,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
/* If we had a full queue cycle with no new finds, try
|
||||
recombination strategies next. */
|
||||
|
||||
if (unlikely(afl->queued_paths == prev_queued
|
||||
if (unlikely(afl->queued_items == prev_queued
|
||||
/* FIXME TODO BUG: && (get_cur_time() - afl->start_time) >=
|
||||
3600 */
|
||||
)) {
|
||||
@ -2148,7 +2148,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
fprintf(afl->introspection_file,
|
||||
"CYCLE cycle=%llu cycle_wo_finds=%llu expand_havoc=%u queue=%u\n",
|
||||
afl->queue_cycle, afl->cycles_wo_finds, afl->expand_havoc,
|
||||
afl->queued_paths);
|
||||
afl->queued_items);
|
||||
#endif
|
||||
|
||||
if (afl->cycle_schedules) {
|
||||
@ -2188,7 +2188,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
}
|
||||
|
||||
// we must recalculate the scores of all queue entries
|
||||
for (u32 i = 0; i < afl->queued_paths; i++) {
|
||||
for (u32 i = 0; i < afl->queued_items; i++) {
|
||||
|
||||
if (likely(!afl->queue_buf[i]->disabled)) {
|
||||
|
||||
@ -2200,7 +2200,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
prev_queued = afl->queued_paths;
|
||||
prev_queued = afl->queued_items;
|
||||
|
||||
}
|
||||
|
||||
@ -2210,11 +2210,11 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
if (likely(!afl->old_seed_selection)) {
|
||||
|
||||
if (unlikely(prev_queued_paths < afl->queued_paths ||
|
||||
if (unlikely(prev_queued_items < afl->queued_items ||
|
||||
afl->reinit_table)) {
|
||||
|
||||
// we have new queue entries since the last run, recreate alias table
|
||||
prev_queued_paths = afl->queued_paths;
|
||||
prev_queued_items = afl->queued_items;
|
||||
create_alias_table(afl);
|
||||
|
||||
}
|
||||
@ -2230,10 +2230,10 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
if (unlikely(afl->old_seed_selection)) {
|
||||
|
||||
while (++afl->current_entry < afl->queued_paths &&
|
||||
while (++afl->current_entry < afl->queued_items &&
|
||||
afl->queue_buf[afl->current_entry]->disabled)
|
||||
;
|
||||
if (unlikely(afl->current_entry >= afl->queued_paths ||
|
||||
if (unlikely(afl->current_entry >= afl->queued_items ||
|
||||
afl->queue_buf[afl->current_entry] == NULL ||
|
||||
afl->queue_buf[afl->current_entry]->disabled))
|
||||
afl->queue_cur = NULL;
|
||||
@ -2321,11 +2321,11 @@ stop_fuzzing:
|
||||
u8 time_tmp[64];
|
||||
u_stringify_time_diff(time_tmp, get_cur_time(), afl->start_time);
|
||||
ACTF(
|
||||
"Statistics: %u new paths found, %.02f%% coverage achieved, %llu "
|
||||
"crashes found, %llu timeouts found, total runtime %s",
|
||||
"Statistics: %u new corpus items found, %.02f%% coverage achieved, "
|
||||
"%llu crashes saved, %llu timeouts saved, total runtime %s",
|
||||
afl->queued_discovered,
|
||||
((double)t_bytes * 100) / afl->fsrv.real_map_size, afl->unique_crashes,
|
||||
afl->unique_hangs, time_tmp);
|
||||
((double)t_bytes * 100) / afl->fsrv.real_map_size, afl->saved_crashes,
|
||||
afl->saved_hangs, time_tmp);
|
||||
|
||||
}
|
||||
|
||||
|
||||
@ -242,8 +242,11 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
|
||||
#else
|
||||
u8 *shm_str;
|
||||
|
||||
// for qemu+unicorn we have to increase by 8 to account for potential
|
||||
// compcov map overwrite
|
||||
shm->shm_id =
|
||||
shmget(IPC_PRIVATE, map_size, IPC_CREAT | IPC_EXCL | DEFAULT_PERMISSION);
|
||||
shmget(IPC_PRIVATE, map_size == MAP_SIZE ? map_size + 8 : map_size,
|
||||
IPC_CREAT | IPC_EXCL | DEFAULT_PERMISSION);
|
||||
if (shm->shm_id < 0) {
|
||||
|
||||
PFATAL("shmget() failed, try running afl-system-config");
|
||||
|
||||
@ -7,6 +7,7 @@
|
||||
#include <unistd.h>
|
||||
|
||||
int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t i) {
|
||||
|
||||
if (i < 24) return 0;
|
||||
if (buf[0] != 'A') return 0;
|
||||
if (buf[1] != 'B') return 0;
|
||||
@ -16,17 +17,25 @@ int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t i) {
|
||||
if (strncmp(buf + 12, "IJKL", 4) == 0 && strcmp(buf + 16, "DEADBEEF") == 0)
|
||||
abort();
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
#ifdef __AFL_COMPILER
|
||||
int main(int argc, char *argv[]) {
|
||||
unsigned char buf[1024];
|
||||
ssize_t i;
|
||||
while(__AFL_LOOP(1000)) {
|
||||
i = read(0, (char*)buf, sizeof(buf) - 1);
|
||||
|
||||
unsigned char buf[1024];
|
||||
ssize_t i;
|
||||
while (__AFL_LOOP(1000)) {
|
||||
|
||||
i = read(0, (char *)buf, sizeof(buf) - 1);
|
||||
if (i > 0) buf[i] = 0;
|
||||
LLVMFuzzerTestOneInput(buf, i);
|
||||
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
|
||||
39
test/test-fpExtra.sh
Executable file
39
test/test-fpExtra.sh
Executable file
@ -0,0 +1,39 @@
|
||||
#!/bin/sh
|
||||
|
||||
. ./test-pre.sh
|
||||
|
||||
test -e ../afl-clang-fast -a -e ../split-switches-pass.so && {
|
||||
$ECHO "$GREY[*] llvm_mode laf-intel/compcov testing splitting floating point types with Nan, infinity, minusZero"
|
||||
for testcase in ./test-fp_minusZerocases.c ./test-fp_Infcases.c ./test-fp_NaNcases.c; do
|
||||
#for testcase in ./test-fp_cases.c ./test-fp_Infcases.c ./test-fp_NaNcases.c ./test-fp_minusZerocases.c ; do
|
||||
for I in float double "long double"; do
|
||||
#for I in double; do
|
||||
for BITS in 64 32 16 8; do
|
||||
#for BITS in 64; do
|
||||
bin="$testcase-split-$I-$BITS.compcov"
|
||||
#AFL_DONT_OPTIMIZE=1 AFL_LLVM_INSTRUMENT=AFL AFL_DEBUG=1 AFL_LLVM_LAF_SPLIT_COMPARES_BITW=$BITS AFL_LLVM_LAF_SPLIT_COMPARES=1 AFL_LLVM_LAF_SPLIT_FLOATS=1 ../afl-clang-fast -DFLOAT_TYPE="$I" -S "$testcase"
|
||||
#AFL_DONT_OPTIMIZE=1 AFL_LLVM_INSTRUMENT=AFL AFL_DEBUG=1 AFL_LLVM_LAF_SPLIT_COMPARES_BITW=$BITS AFL_LLVM_LAF_SPLIT_COMPARES=1 AFL_LLVM_LAF_SPLIT_FLOATS=1 ../afl-clang-fast -DFLOAT_TYPE="$I" -S -emit-llvm "$testcase"
|
||||
AFL_DONT_OPTIMIZE=1 AFL_LLVM_INSTRUMENT=AFL AFL_DEBUG=1 AFL_LLVM_LAF_SPLIT_COMPARES_BITW=$BITS AFL_LLVM_LAF_SPLIT_COMPARES=1 AFL_LLVM_LAF_SPLIT_FLOATS=1 ../afl-clang-fast -DFLOAT_TYPE="$I" -o "$bin" "$testcase" > test.out 2>&1;
|
||||
if ! test -e "$bin"; then
|
||||
cat test.out
|
||||
$ECHO "$RED[!] llvm_mode laf-intel/compcov float splitting failed! ($testcase with type $I split to $BITS)!";
|
||||
CODE=1
|
||||
break
|
||||
fi
|
||||
if ! "$bin"; then
|
||||
$ECHO "$RED[!] llvm_mode laf-intel/compcov float splitting resulted in miscompilation (type $I split to $BITS)!";
|
||||
CODE=1
|
||||
break
|
||||
fi
|
||||
rm -f "$bin" test.out || true
|
||||
done
|
||||
done
|
||||
done
|
||||
rm -f test-fp_cases*.compcov test.out
|
||||
|
||||
} || {
|
||||
$ECHO "$YELLOW[-] llvm_mode not compiled, cannot test"
|
||||
INCOMPLETE=1
|
||||
}
|
||||
|
||||
. ./test-post.sh
|
||||
124
test/test-fp_Infcases.c
Normal file
124
test/test-fp_Infcases.c
Normal file
@ -0,0 +1,124 @@
|
||||
/* test cases for floating point comparison transformations
|
||||
* compile with -DFLOAT_TYPE=float
|
||||
* or -DFLOAT_TYPE=double
|
||||
* or -DFLOAT_TYPE="long double"
|
||||
*/
|
||||
|
||||
#include <assert.h>
|
||||
#define _GNU_SOURCE
|
||||
#include <math.h> /* for NaNs and infinity values */
|
||||
|
||||
int main() {
|
||||
|
||||
volatile FLOAT_TYPE a, b;
|
||||
|
||||
#ifdef INFINITY
|
||||
FLOAT_TYPE inf = (FLOAT_TYPE)INFINITY;
|
||||
#else
|
||||
FLOAT_TYPE inf = 1.0 / 0.0; /* produces infinity */
|
||||
#endif
|
||||
FLOAT_TYPE negZero = 1.0 / -inf;
|
||||
FLOAT_TYPE posZero = 0.0;
|
||||
|
||||
/* plus infinity */
|
||||
a = (1.0 / 0.0); /* positive infinity */
|
||||
b = (1.0 / 0.0); /* positive infinity */
|
||||
assert(!(a < b));
|
||||
assert((a <= b));
|
||||
assert(!(a > b));
|
||||
assert((a >= b));
|
||||
assert(!(a != b));
|
||||
assert((a == b));
|
||||
|
||||
b = -(1.0 / 0.0); /* negative infinity */
|
||||
assert(!(a < b));
|
||||
assert(!(a <= b));
|
||||
assert((a > b));
|
||||
assert((a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
b = 1.0 / -(1.0 / 0.0); /* negative 0 */
|
||||
assert(!(a < b));
|
||||
assert(!(a <= b));
|
||||
assert((a > b));
|
||||
assert((a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
b = 0.0; /* positive 0 */
|
||||
assert(!(a < b));
|
||||
assert(!(a <= b));
|
||||
assert((a > b));
|
||||
assert((a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
b = -42.0;
|
||||
assert(!(a < b));
|
||||
assert(!(a <= b));
|
||||
assert((a > b));
|
||||
assert((a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
b = 42.0;
|
||||
assert(!(a < b));
|
||||
assert(!(a <= b));
|
||||
assert((a > b));
|
||||
assert((a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
/* negative infinity */
|
||||
a = -(1.0 / 0.0);
|
||||
b = (1.0 / 0.0); /* positive infinity */
|
||||
assert((a < b));
|
||||
assert((a <= b));
|
||||
assert(!(a > b));
|
||||
assert(!(a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
b = -(1.0 / 0.0); /* negative infinity */
|
||||
assert(!(a < b));
|
||||
assert((a <= b));
|
||||
assert(!(a > b));
|
||||
assert((a >= b));
|
||||
assert(!(a != b));
|
||||
assert((a == b));
|
||||
|
||||
b = 1.0 / -(1.0 / 0.0); /* negative 0 */
|
||||
assert((a < b));
|
||||
assert((a <= b));
|
||||
assert(!(a > b));
|
||||
assert(!(a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
b = 0.0; /* positive 0 */
|
||||
assert((a < b));
|
||||
assert((a <= b));
|
||||
assert(!(a > b));
|
||||
assert(!(a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
b = -42.0;
|
||||
assert((a < b));
|
||||
assert((a <= b));
|
||||
assert(!(a > b));
|
||||
assert(!(a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
b = 42.0;
|
||||
assert((a < b));
|
||||
assert((a <= b));
|
||||
assert(!(a > b));
|
||||
assert(!(a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
}
|
||||
|
||||
86
test/test-fp_NaNcases.c
Normal file
86
test/test-fp_NaNcases.c
Normal file
@ -0,0 +1,86 @@
|
||||
/* test cases for floating point comparison transformations
|
||||
* compile with -DFLOAT_TYPE=float
|
||||
* or -DFLOAT_TYPE=double
|
||||
* or -DFLOAT_TYPE="long double"
|
||||
*/
|
||||
|
||||
#include <assert.h>
|
||||
#define _GNU_SOURCE
|
||||
#include <math.h> /* for NaNs and infinity values */
|
||||
|
||||
int main() {
|
||||
|
||||
volatile FLOAT_TYPE a, b;
|
||||
|
||||
/* NaN */
|
||||
#ifdef NAN
|
||||
a = (FLOAT_TYPE)NAN; /* produces NaN */
|
||||
#else
|
||||
a = 0.0 / 0.0; /* produces NaN */
|
||||
#endif
|
||||
#ifdef INFINITY
|
||||
FLOAT_TYPE inf = (FLOAT_TYPE)INFINITY;
|
||||
#else
|
||||
FLOAT_TYPE inf = 1.0 / 0.0; /* produces infinity */
|
||||
#endif
|
||||
FLOAT_TYPE negZero = 1.0 / -inf;
|
||||
FLOAT_TYPE posZero = 0.0;
|
||||
b = a;
|
||||
|
||||
assert(!(a < b));
|
||||
assert(!(a <= b));
|
||||
assert(!(a > b));
|
||||
assert(!(a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
b = 0.0;
|
||||
assert(!(a < b));
|
||||
assert(!(a <= b));
|
||||
assert(!(a > b));
|
||||
assert(!(a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
b = 1.0 / -(1.0 / 0.0); /* negative 0 */
|
||||
assert(!(a < b));
|
||||
assert(!(a <= b));
|
||||
assert(!(a > b));
|
||||
assert(!(a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
b = 42.0;
|
||||
assert(!(a < b));
|
||||
assert(!(a <= b));
|
||||
assert(!(a > b));
|
||||
assert(!(a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
b = -42.0;
|
||||
assert(!(a < b));
|
||||
assert(!(a <= b));
|
||||
assert(!(a > b));
|
||||
assert(!(a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
b = (1.0 / 0.0); /* positive infinity */
|
||||
assert(!(a < b));
|
||||
assert(!(a <= b));
|
||||
assert(!(a > b));
|
||||
assert(!(a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
b = -(1.0 / 0.0); /* negative infinity */
|
||||
assert(!(a < b));
|
||||
assert(!(a <= b));
|
||||
assert(!(a > b));
|
||||
assert(!(a >= b));
|
||||
assert((a != b));
|
||||
assert(!(a == b));
|
||||
|
||||
}
|
||||
|
||||
35
test/test-fp_minusZerocases.c
Normal file
35
test/test-fp_minusZerocases.c
Normal file
@ -0,0 +1,35 @@
|
||||
/* test cases for floating point comparison transformations
|
||||
* compile with -DFLOAT_TYPE=float
|
||||
* or -DFLOAT_TYPE=double
|
||||
* or -DFLOAT_TYPE="long double"
|
||||
*/
|
||||
|
||||
#include <assert.h>
|
||||
#define _GNU_SOURCE
|
||||
#include <math.h> /* for NaNs and infinity values */
|
||||
|
||||
int main() {
|
||||
|
||||
volatile FLOAT_TYPE a, b;
|
||||
|
||||
/* negative zero */
|
||||
a = 1.0 / -(1.0 / 0.0); /* negative 0 */
|
||||
b = 0.0; /* positive 0 */
|
||||
assert(!(a < b));
|
||||
assert((a <= b));
|
||||
assert(!(a > b));
|
||||
assert((a >= b));
|
||||
assert(!(a != b));
|
||||
assert((a == b));
|
||||
|
||||
a = 1.0 / -(1.0 / 0.0); /* negative 0 */
|
||||
b = 1.0 / -(1.0 / 0.0); /* negative 0 */
|
||||
assert(!(a < b));
|
||||
assert((a <= b));
|
||||
assert(!(a > b));
|
||||
assert((a >= b));
|
||||
assert(!(a != b));
|
||||
assert((a == b));
|
||||
|
||||
}
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
. ./test-pre.sh
|
||||
|
||||
$ECHO "$BLUE[*] Testing: LTO llvm_mode"
|
||||
test -e ../afl-clang-lto -a -e ../afl-llvm-lto-instrumentation.so && {
|
||||
test -e ../afl-clang-lto -a -e ../SanitizerCoverageLTO.so && {
|
||||
# on FreeBSD need to set AFL_CC
|
||||
test `uname -s` = 'FreeBSD' && {
|
||||
if type clang >/dev/null; then
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
# AFL++ starting test cases
|
||||
|
||||
(See [../README.md](../README.md) for the general instruction manual.)
|
||||
For the general instruction manual, see [docs/README.md](../docs/README.md).
|
||||
|
||||
The archives/, images/, multimedia/, and others/ subdirectories contain small,
|
||||
standalone files that can be used to seed afl-fuzz when testing parsers for a
|
||||
|
||||
@ -1 +1 @@
|
||||
Subproject commit d4915053d477dd827b3fe4b494173d3fbf9f456e
|
||||
Subproject commit 9df92d6868e8b219886e4b7458e5e134c48ff2c9
|
||||
@ -1,6 +1,6 @@
|
||||
# libdislocator, an abusive allocator
|
||||
|
||||
(See ../../README.md for the general instruction manual.)
|
||||
For the general instruction manual, see [docs/README.md](../../docs/README.md).
|
||||
|
||||
This is a companion library that can be used as a drop-in replacement for the
|
||||
libc allocator in the fuzzed binaries. It improves the odds of bumping into
|
||||
|
||||
@ -5,7 +5,7 @@
|
||||
The afl-clang-fast AFL_LLVM_DICT2FILE feature is much better, afl-clang-lto
|
||||
has that feature automatically integrated.
|
||||
|
||||
(See ../../README.md for the general instruction manual.)
|
||||
For the general instruction manual, see [docs/README.md](../../docs/README.md).
|
||||
|
||||
This companion library allows you to instrument `strcmp()`, `memcmp()`,
|
||||
and related functions to automatically extract syntax tokens passed to any of
|
||||
|
||||
@ -171,7 +171,7 @@ static void __tokencap_load_mappings(void) {
|
||||
int mib[] = {CTL_VM, VM_PROC, VM_PROC_MAP, __tokencap_pid,
|
||||
sizeof(struct kinfo_vmentry)};
|
||||
#endif
|
||||
char *buf, *low, *high;
|
||||
char * buf, *low, *high;
|
||||
size_t miblen = sizeof(mib) / sizeof(mib[0]);
|
||||
size_t len;
|
||||
|
||||
@ -345,11 +345,7 @@ static void __tokencap_dump(const u8 *ptr, size_t len, u8 is_text) {
|
||||
wrt_ok &= (pos == write(__tokencap_out_file, buf, pos));
|
||||
wrt_ok &= (2 == write(__tokencap_out_file, "\"\n", 2));
|
||||
|
||||
if (!wrt_ok) {
|
||||
|
||||
DEBUGF("%s", "writing to the token file failed\n");
|
||||
|
||||
}
|
||||
if (!wrt_ok) { DEBUGF("%s", "writing to the token file failed\n"); }
|
||||
|
||||
}
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user