ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-14 02:58:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactored cmplog

Browse Source
This commit is contained in:
Dominik Maier
2020-04-11 01:09:07 +02:00
parent 39e8b91806
commit 29ee3a1ffc
15 changed files with 130 additions and 559 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
include/afl-fuzz.h
View File

@ -439,7 +439,6 @@ typedef struct afl_state {
no_arith, /* Skip most arithmetic ops */
shuffle_queue, /* Shuffle input queue? */
bitmap_changed, /* Time to update bitmap? */
qemu_mode, /* Running in QEMU mode? */
unicorn_mode, /* Running in Unicorn mode? */
use_wine, /* Use WINE with QEMU mode */
skip_requested, /* Skip request, via SIGUSR1 */
@ -560,7 +559,7 @@ typedef struct afl_state {
/* CmpLog */
char *cmplog_binary;
s32 cmplog_child_pid, cmplog_fsrv_pid;
afl_forkserver_t cmplog_fsrv; /* cmplog has its own little forkserver */
/* Custom mutators */
struct custom_mutator *mutator;
@ -878,7 +877,7 @@ void show_init_stats(afl_state_t *);
/* Run */
u8 run_target(afl_state_t *, u32);
u8 run_target(afl_state_t *, afl_forkserver_t *fsrv, u32);
void write_to_testcase(afl_state_t *, void *, u32);
u8 calibrate_case(afl_state_t *, struct queue_entry *, u8 *, u32, u8);
void sync_fuzzers(afl_state_t *);
@ -922,7 +921,6 @@ void save_cmdline(afl_state_t *, u32, char **);
/* CmpLog */
void init_cmplog_forkserver(afl_state_t *afl);
u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len);
/* RedQueen */

6
include/cmplog.h
View File

@ -29,6 +29,7 @@
#define _AFL_CMPLOG_H
#include "config.h"
#include "forkserver.h"
#define CMP_MAP_W 65536
#define CMP_MAP_H 256
@ -74,5 +75,10 @@ struct cmp_map {
};
/* Execs the child */
void cmplog_exec_child(afl_forkserver_t *fsrv, char **argv);
#endif

10
include/forkserver.h
View File

@ -66,15 +66,23 @@ typedef struct afl_forkserver {
u32 prev_timed_out; /* if prev forkserver run timed out */
u8 qemu_mode; /* if running in qemu mode or not */
char *cmplog_binary; /* the name of the cmplog binary */
/* Function to kick off the forkserver child */
void (*init_child_func)(struct afl_forkserver *fsrv, char **argv);
u8 *function_opt; /* for autodictionary: afl ptr */
void (*function_ptr)(void *afl_tmp, u8 *mem, u32 len);
} afl_forkserver_t;
void afl_fsrv_init(afl_forkserver_t *fsrv);
void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
volatile u8 *stop_soon_p);
volatile u8 *stop_soon_p, u8 debug_child_output);
void afl_fsrv_deinit(afl_forkserver_t *fsrv);
void afl_fsrv_killall();

10
src/afl-analyze.c
View File

@ -36,6 +36,7 @@
#include "hash.h"
#include "sharedmem.h"
#include "common.h"
#include "forkserver.h"
#include <stdio.h>
#include <unistd.h>
@ -57,7 +58,7 @@
static s32 child_pid; /* PID of the tested program */
u8 *trace_bits; /* SHM with instrumentation bitmap */
static u8 *trace_bits; /* SHM with instrumentation bitmap */
static u8 *in_file, /* Analyzer input test case */
*prog_in; /* Targeted program input file */
@ -74,16 +75,15 @@ static u64 mem_limit = MEM_LIMIT; /* Memory limit (MB) */
static s32 dev_null_fd = -1; /* FD to /dev/null */
u8 edges_only, /* Ignore hit counts? */
static u8 edges_only, /* Ignore hit counts? */
use_hex_offsets, /* Show hex offsets? */
use_stdin = 1; /* Use stdin for program input? */
static volatile u8 stop_soon, /* Ctrl-C pressed? */
child_timed_out; /* Child timed out? */
static u8 qemu_mode;
static u8 *target_path;
static u8 qemu_mode;
/* Constants used for describing byte behavior. */
@ -639,7 +639,7 @@ static void handle_stop_sig(int sig) {
/* Do basic preparations - persistent fds, filenames, etc. */
static void set_up_environment(void) {
static void set_up_environment() {
u8 *x;

4
src/afl-common.c
View File

@ -235,7 +235,7 @@ char **get_qemu_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
"Oops, unable to find the 'afl-qemu-trace' binary. The binary must be "
"built\n"
" separately by following the instructions in "
"afl->qemu_mode/README.md. "
"qemu_mode/README.md. "
"If you\n"
" already have the binary installed, you may need to specify "
"AFL_PATH in the\n"
@ -332,7 +332,7 @@ char **get_wine_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
"Oops, unable to find the '%s' binary. The binary must be "
"built\n"
" separately by following the instructions in "
"afl->qemu_mode/README.md. "
"qemu_mode/README.md. "
"If you\n"
" already have the binary installed, you may need to specify "
"AFL_PATH in the\n"

32
src/afl-forkserver.c
View File

@ -51,6 +51,12 @@
list_t fsrv_list = {.element_prealloc_count = 0};
static void fsrv_exec_child(afl_forkserver_t *fsrv, char **argv) {
execv(fsrv->target_path, argv);
}
/* Initializes the struct */
void afl_fsrv_init(afl_forkserver_t *fsrv) {
@ -73,6 +79,8 @@ void afl_fsrv_init(afl_forkserver_t *fsrv) {
fsrv->use_fauxsrv = 0;
fsrv->prev_timed_out = 0;
fsrv->init_child_func = fsrv_exec_child;
list_append(&fsrv_list, fsrv);
}
@ -163,7 +171,7 @@ static void afl_fauxsrv_execv(afl_forkserver_t *fsrv, char **argv) {
through a pipe. The other part of this logic is in afl-as.h / llvm_mode */
void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
volatile u8 *stop_soon_p) {
volatile u8 *stop_soon_p, u8 debug_child_output) {
int st_pipe[2], ctl_pipe[2];
int status;
@ -171,6 +179,16 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
if (!be_quiet) ACTF("Spinning up the fork server...");
if (fsrv->use_fauxsrv) {
/* TODO: Come up with sone nice way to initalize this all */
if (fsrv->init_child_func != fsrv_exec_child)
FATAL("Different forkserver not compatible with fauxserver");
fsrv->init_child_func = afl_fauxsrv_execv;
}
if (pipe(st_pipe) || pipe(ctl_pipe)) PFATAL("pipe() failed");
fsrv->child_timed_out = 0;
@ -221,7 +239,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
setsid();
if (!get_afl_env("AFL_DEBUG_CHILD_OUTPUT")) {
if (!(debug_child_output)) {
dup2(fsrv->dev_null_fd, 1);
dup2(fsrv->dev_null_fd, 2);
@ -283,15 +301,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
"msan_track_origins=0",
0);
if (fsrv->use_fauxsrv) {
afl_fauxsrv_execv(fsrv, argv);
} else {
execv(fsrv->target_path, argv);
}
fsrv->init_child_func(fsrv, argv);
/* Use a distinctive bitmap signature to tell the parent about execv()
falling through. */

2
src/afl-fuzz-bitmap.c
View File

@ -645,7 +645,7 @@ u8 save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
u8 new_fault;
write_to_testcase(afl, mem, len);
new_fault = run_target(afl, afl->hang_tmout);
new_fault = run_target(afl, &afl->fsrv, afl->hang_tmout);
/* A corner case that one user reported bumping into: increasing the
timeout actually uncovers a crash. Make sure we don't discard it if

475
src/afl-fuzz-cmplog.c
View File

@ -29,480 +29,21 @@
#include "afl-fuzz.h"
#include "cmplog.h"
void init_cmplog_forkserver(afl_state_t *afl) {
typedef struct cmplog_data {
} cmplog_data_t;
int st_pipe[2], ctl_pipe[2];
int status;
s32 rlen;
ACTF("Spinning up the cmplog fork server...");
if (pipe(st_pipe) || pipe(ctl_pipe)) PFATAL("pipe() failed");
afl->fsrv.child_timed_out = 0;
afl->cmplog_fsrv_pid = fork();
if (afl->cmplog_fsrv_pid < 0) PFATAL("fork() failed");
if (!afl->cmplog_fsrv_pid) {
/* CHILD PROCESS */
struct rlimit r;
/* Umpf. On OpenBSD, the default fd limit for root users is set to
soft 128. Let's try to fix that... */
if (!getrlimit(RLIMIT_NOFILE, &r) && r.rlim_cur < FORKSRV_FD + 2) {
r.rlim_cur = FORKSRV_FD + 2;
setrlimit(RLIMIT_NOFILE, &r); /* Ignore errors */
}
if (afl->fsrv.mem_limit) {
r.rlim_max = r.rlim_cur = ((rlim_t)afl->fsrv.mem_limit) << 20;
#ifdef RLIMIT_AS
setrlimit(RLIMIT_AS, &r); /* Ignore errors */
#else
/* This takes care of OpenBSD, which doesn't have RLIMIT_AS, but
according to reliable sources, RLIMIT_DATA covers anonymous
maps - so we should be getting good protection against OOM bugs. */
setrlimit(RLIMIT_DATA, &r); /* Ignore errors */
#endif /* ^RLIMIT_AS */
}
/* Dumping cores is slow and can lead to anomalies if SIGKILL is delivered
before the dump is complete. */
// r.rlim_max = r.rlim_cur = 0;
// setrlimit(RLIMIT_CORE, &r); /* Ignore errors */
/* Isolate the process and configure standard descriptors. If
afl->fsrv.out_file is specified, stdin is /dev/null; otherwise,
afl->fsrv.out_fd is cloned instead. */
setsid();
if (!(afl->afl_env.afl_debug_child_output)) {
dup2(afl->fsrv.dev_null_fd, 1);
dup2(afl->fsrv.dev_null_fd, 2);
}
if (!afl->fsrv.use_stdin) {
dup2(afl->fsrv.dev_null_fd, 0);
} else {
dup2(afl->fsrv.out_fd, 0);
close(afl->fsrv.out_fd);
}
/* Set up control and status pipes, close the unneeded original fds. */
if (dup2(ctl_pipe[0], FORKSRV_FD) < 0) PFATAL("dup2() failed");
if (dup2(st_pipe[1], FORKSRV_FD + 1) < 0) PFATAL("dup2() failed");
close(ctl_pipe[0]);
close(ctl_pipe[1]);
close(st_pipe[0]);
close(st_pipe[1]);
close(afl->fsrv.out_dir_fd);
close(afl->fsrv.dev_null_fd);
#ifndef HAVE_ARC4RANDOM
close(afl->fsrv.dev_urandom_fd);
#endif
if (afl->fsrv.plot_file != NULL) fclose(afl->fsrv.plot_file);
/* This should improve performance a bit, since it stops the linker from
doing extra work post-fork(). */
if (!getenv("LD_BIND_LAZY")) setenv("LD_BIND_NOW", "1", 0);
/* Set sane defaults for ASAN if nothing else specified. */
setenv("ASAN_OPTIONS",
"abort_on_error=1:"
"detect_leaks=0:"
"malloc_context_size=0:"
"symbolize=0:"
"allocator_may_return_null=1",
0);
/* MSAN is tricky, because it doesn't support abort_on_error=1 at this
point. So, we do this in a very hacky way. */
setenv("MSAN_OPTIONS",
"exit_code=" STRINGIFY(MSAN_ERROR) ":"
"symbolize=0:"
"abort_on_error=1:"
"malloc_context_size=0:"
"allocator_may_return_null=1:"
"msan_track_origins=0",
0);
void cmplog_exec_child(afl_forkserver_t *fsrv, char **argv) {
setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1);
if (!afl->qemu_mode && afl->argv[0] != afl->cmplog_binary) {
if (!fsrv->qemu_mode && argv[0] != fsrv->cmplog_binary) {
ck_free(afl->argv[0]);
afl->argv[0] = afl->cmplog_binary;
ck_free(argv[0]);
argv[0] = fsrv->cmplog_binary;
}
execv(afl->argv[0], afl->argv);
/* Use a distinctive bitmap signature to tell the parent about execv()
falling through. */
*(u32 *)afl->fsrv.trace_bits = EXEC_FAIL_SIG;
exit(0);
}
/* PARENT PROCESS */
/* Close the unneeded endpoints. */
close(ctl_pipe[0]);
close(st_pipe[1]);
afl->cmplog_fsrv_ctl_fd = ctl_pipe[1];
afl->cmplog_fsrv_st_fd = st_pipe[0];
/* Wait for the fork server to come up, but don't wait too long. */
rlen = 0;
if (afl->fsrv.exec_tmout) {
rlen = 4;
u32 timeout_ms = afl->fsrv.exec_tmout * FORK_WAIT_MULT;
/* Reuse readfds as exceptfds to see when the child closed the pipe */
u32 exec_ms = read_timed(afl->cmplog_fsrv_st_fd, &status, rlen, timeout_ms,
&afl->stop_soon);
if (!exec_ms) {
PFATAL("Error in timed read");
} else if (exec_ms > timeout_ms) {
afl->fsrv.child_timed_out = 1;
kill(afl->cmplog_fsrv_pid, SIGKILL);
rlen = read(afl->cmplog_fsrv_st_fd, &status, 4);
}
} else {
rlen = read(afl->cmplog_fsrv_st_fd, &status, 4);
}
/* If we have a four-byte "hello" message from the server, we're all set.
Otherwise, try to figure out what went wrong. */
if (afl->fsrv.child_timed_out)
FATAL(
"Timeout while initializing cmplog fork server (adjusting -t may "
"help)");
if (rlen == 4) {
OKF("All right - fork server is up.");
return;
}
if (waitpid(afl->cmplog_fsrv_pid, &status, 0) <= 0)
PFATAL("waitpid() failed");
if (WIFSIGNALED(status)) {
if (afl->fsrv.mem_limit && afl->fsrv.mem_limit < 500 &&
afl->fsrv.uses_asan) {
SAYF("\n" cLRD "[-] " cRST
"Whoops, the target binary crashed suddenly, "
"before receiving any input\n"
" from the fuzzer! Since it seems to be built with ASAN and you "
"have a\n"
" restrictive memory limit configured, this is expected; please "
"read\n"
" %s/notes_for_asan.md for help.\n",
doc_path);
} else if (!afl->fsrv.mem_limit) {
SAYF("\n" cLRD "[-] " cRST
"Whoops, the target binary crashed suddenly, "
"before receiving any input\n"
" from the fuzzer! There are several probable explanations:\n\n"
" - The binary is just buggy and explodes entirely on its own. "
"If so, you\n"
" need to fix the underlying problem or find a better "
"replacement.\n\n"
MSG_FORK_ON_APPLE
" - Less likely, there is a horrible bug in the fuzzer. If other "
"options\n"
" fail, poke <afl-users@googlegroups.com> for troubleshooting "
"tips.\n");
} else {
u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
SAYF("\n" cLRD "[-] " cRST
"Whoops, the target binary crashed suddenly, "
"before receiving any input\n"
" from the fuzzer! There are several probable explanations:\n\n"
" - The current memory limit (%s) is too restrictive, causing "
"the\n"
" target to hit an OOM condition in the dynamic linker. Try "
"bumping up\n"
" the limit with the -m setting in the command line. A simple "
"way confirm\n"
" this diagnosis would be:\n\n"
MSG_ULIMIT_USAGE
" /path/to/fuzzed_app )\n\n"
" Tip: you can use http://jwilk.net/software/recidivm to "
"quickly\n"
" estimate the required amount of virtual memory for the "
"binary.\n\n"
" - The binary is just buggy and explodes entirely on its own. "
"If so, you\n"
" need to fix the underlying problem or find a better "
"replacement.\n\n"
MSG_FORK_ON_APPLE
" - Less likely, there is a horrible bug in the fuzzer. If other "
"options\n"
" fail, poke <afl-users@googlegroups.com> for troubleshooting "
"tips.\n",
stringify_mem_size(val_buf, sizeof(val_buf),
afl->fsrv.mem_limit << 20),
afl->fsrv.mem_limit - 1);
}
FATAL("Cmplog fork server crashed with signal %d", WTERMSIG(status));
}
if (*(u32 *)afl->fsrv.trace_bits == EXEC_FAIL_SIG)
FATAL("Unable to execute target application ('%s')", afl->argv[0]);
if (afl->fsrv.mem_limit && afl->fsrv.mem_limit < 500 && afl->fsrv.uses_asan) {
SAYF("\n" cLRD "[-] " cRST
"Hmm, looks like the target binary terminated "
"before we could complete a\n"
" handshake with the injected code. Since it seems to be built "
"with ASAN and\n"
" you have a restrictive memory limit configured, this is "
"expected; please\n"
" read %s/notes_for_asan.md for help.\n",
doc_path);
} else if (!afl->fsrv.mem_limit) {
SAYF("\n" cLRD "[-] " cRST
"Hmm, looks like the target binary terminated "
"before we could complete a\n"
" handshake with the injected code. Perhaps there is a horrible "
"bug in the\n"
" fuzzer. Poke <afl-users@googlegroups.com> for troubleshooting "
"tips.\n");
} else {
u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
SAYF(
"\n" cLRD "[-] " cRST
"Hmm, looks like the target binary terminated "
"before we could complete a\n"
" handshake with the injected code. There are %s probable "
"explanations:\n\n"
"%s"
" - The current memory limit (%s) is too restrictive, causing an "
"OOM\n"
" fault in the dynamic linker. This can be fixed with the -m "
"option. A\n"
" simple way to confirm the diagnosis may be:\n\n"
MSG_ULIMIT_USAGE
" /path/to/fuzzed_app )\n\n"
" Tip: you can use http://jwilk.net/software/recidivm to quickly\n"
" estimate the required amount of virtual memory for the "
"binary.\n\n"
" - Less likely, there is a horrible bug in the fuzzer. If other "
"options\n"
" fail, poke <afl-users@googlegroups.com> for troubleshooting "
"tips.\n",
getenv(DEFER_ENV_VAR) ? "three" : "two",
getenv(DEFER_ENV_VAR)
? " - You are using deferred forkserver, but __AFL_INIT() is "
"never\n"
" reached before the program terminates.\n\n"
: "",
stringify_mem_size(val_buf, sizeof(val_buf), afl->fsrv.mem_limit << 20),
afl->fsrv.mem_limit - 1);
}
FATAL("Cmplog fork server handshake failed");
}
u8 run_cmplog_target(afl_state_t *afl, u32 timeout) {
int status = 0;
u32 exec_ms;
u32 tb4;
s32 res;
afl->fsrv.child_timed_out = 0;
/* After this memset, afl->fsrv.trace_bits[] are effectively volatile, so we
must prevent any earlier operations from venturing into that
territory. */
memset(afl->fsrv.trace_bits, 0, afl->fsrv.map_size);
MEM_BARRIER();
/* Since we always have a forkserver (or a fauxserver) running, we can simply
tell them to have at it and read back the pid from it.*/
if ((res = write(afl->cmplog_fsrv_ctl_fd, &afl->cmplog_prev_timed_out, 4)) !=
4) {
if (afl->stop_soon) return 0;
RPFATAL(res,
"Unable to request new process from cmplog fork server (OOM?)");
}
if ((res = read(afl->cmplog_fsrv_st_fd, &afl->cmplog_child_pid, 4)) != 4) {
if (afl->stop_soon) return 0;
RPFATAL(res,
"Unable to request new process from cmplog fork server (OOM?)");
}
if (afl->cmplog_child_pid <= 0)
FATAL("Cmplog fork server is misbehaving (OOM?)");
/* Configure timeout, as requested by user, then wait for child to terminate.
*/
exec_ms =
read_timed(afl->cmplog_fsrv_st_fd, &status, 4, timeout, &afl->stop_soon);
if (exec_ms > timeout) {
/* If there was no response from forkserver after timeout seconds,
we kill the child. The forkserver should inform us afterwards */
kill(afl->cmplog_child_pid, SIGKILL);
afl->fsrv.child_timed_out = 1;
/* After killing the child, the forkserver should tell us */
if (!read(afl->cmplog_fsrv_st_fd, &status, 4)) exec_ms = 0;
}
if (!exec_ms) { // Something went wrong.
if (afl->stop_soon) return 0;
SAYF("\n" cLRD "[-] " cRST
"Unable to communicate with fork server. Some possible reasons:\n\n"
" - You've run out of memory. Use -m to increase the the memory "
"limit\n"
" to something higher than %lld.\n"
" - The binary or one of the libraries it uses manages to create\n"
" threads before the forkserver initializes.\n"
" - The binary, at least in some circumstances, exits in a way "
"that\n"
" also kills the parent process - raise() could be the "
"culprit.\n\n"
"If all else fails you can disable the fork server via "
"AFL_NO_FORKSRV=1.\n",
afl->fsrv.mem_limit);
RPFATAL(res, "Unable to communicate with fork server");
}
if (!WIFSTOPPED(status)) afl->cmplog_child_pid = 0;
if (afl->slowest_exec_ms < exec_ms) afl->slowest_exec_ms = exec_ms;
++afl->total_execs;
/* Any subsequent operations on afl->fsrv.trace_bits must not be moved by the
compiler below this point. Past this location, afl->fsrv.trace_bits[]
behave very normally and do not have to be treated as volatile. */
MEM_BARRIER();
tb4 = *(u32 *)afl->fsrv.trace_bits;
#ifdef WORD_SIZE_64
classify_counts(afl, (u64 *)afl->fsrv.trace_bits);
#else
classify_counts(afl, (u32 *)afl->fsrv.trace_bits);
#endif /* ^WORD_SIZE_64 */
afl->cmplog_prev_timed_out = afl->fsrv.child_timed_out;
/* Report outcome to caller. */
if (WIFSIGNALED(status) && !afl->stop_soon) {
afl->kill_signal = WTERMSIG(status);
if (afl->fsrv.child_timed_out && afl->kill_signal == SIGKILL)
return FAULT_TMOUT;
return FAULT_CRASH;
}
/* A somewhat nasty hack for MSAN, which doesn't support abort_on_error and
must use a special exit code. */
if (afl->fsrv.uses_asan && WEXITSTATUS(status) == MSAN_ERROR) {
afl->kill_signal = 0;
return FAULT_CRASH;
}
if ((afl->dumb_mode == 1 || afl->no_forkserver) && tb4 == EXEC_FAIL_SIG)
return FAULT_ERROR;
return FAULT_NONE;
execv(argv[0], argv);
}
@ -524,7 +65,7 @@ u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
write_to_testcase(afl, out_buf, len);
fault = run_cmplog_target(afl, afl->fsrv.exec_tmout);
fault = run_target(afl, &afl->cmplog_fsrv, afl->fsrv.exec_tmout);
if (afl->stop_soon) return 1;

6
src/afl-fuzz-init.c
View File

@ -1853,8 +1853,6 @@ static void handle_stop_sig(int sig) {
if (el->fsrv.child_pid > 0) kill(el->fsrv.child_pid, SIGKILL);
if (el->fsrv.fsrv_pid > 0) kill(el->fsrv.fsrv_pid, SIGKILL);
if (el->cmplog_child_pid > 0) kill(el->cmplog_child_pid, SIGKILL);
if (el->cmplog_fsrv_pid > 0) kill(el->cmplog_fsrv_pid, SIGKILL);
});
@ -1988,7 +1986,7 @@ void check_binary(afl_state_t *afl, u8 *fname) {
#endif /* ^!__APPLE__ */
if (!afl->qemu_mode && !afl->unicorn_mode && !afl->dumb_mode &&
if (!afl->fsrv.qemu_mode && !afl->unicorn_mode && !afl->dumb_mode &&
!memmem(f_data, f_len, SHM_ENV_VAR, strlen(SHM_ENV_VAR) + 1)) {
SAYF("\n" cLRD "[-] " cRST
@ -2015,7 +2013,7 @@ void check_binary(afl_state_t *afl, u8 *fname) {
}
if ((afl->qemu_mode) &&
if ((afl->fsrv.qemu_mode) &&
memmem(f_data, f_len, SHM_ENV_VAR, strlen(SHM_ENV_VAR) + 1)) {
SAYF("\n" cLRD "[-] " cRST

2
src/afl-fuzz-mutators.c
View File

@ -239,7 +239,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
write_to_testcase(afl, retbuf, retlen);
fault = run_target(afl, afl->fsrv.exec_tmout);
fault = run_target(afl, &afl->fsrv, afl->fsrv.exec_tmout);
++afl->trim_execs;
if (afl->stop_soon || fault == FAULT_ERROR) { goto abort_trimming; }

67
src/afl-fuzz-run.c
View File

@ -27,10 +27,12 @@
#include <sys/time.h>
#include <signal.h>
/* Execute target application, monitoring for timeouts. Return status
information. The called program will update afl->fsrv.trace_bits. */
#include "cmplog.h"
u8 run_target(afl_state_t *afl, u32 timeout) {
/* Execute target application, monitoring for timeouts. Return status
information. The called program will update afl->fsrv->trace_bits. */
u8 run_target(afl_state_t *afl, afl_forkserver_t *fsrv, u32 timeout) {
s32 res;
u32 exec_ms;
@ -38,46 +40,46 @@ u8 run_target(afl_state_t *afl, u32 timeout) {
int status = 0;
u32 tb4;
afl->fsrv.child_timed_out = 0;
fsrv->child_timed_out = 0;
/* After this memset, afl->fsrv.trace_bits[] are effectively volatile, so we
/* After this memset, fsrv->trace_bits[] are effectively volatile, so we
must prevent any earlier operations from venturing into that
territory. */
memset(afl->fsrv.trace_bits, 0, afl->fsrv.map_size);
memset(fsrv->trace_bits, 0, fsrv->map_size);
MEM_BARRIER();
/* we have the fork server (or faux server) up and running, so simply
tell it to have at it, and then read back PID. */
if ((res = write(afl->fsrv.fsrv_ctl_fd, &afl->fsrv.prev_timed_out, 4)) != 4) {
if ((res = write(fsrv->fsrv_ctl_fd, &fsrv->prev_timed_out, 4)) != 4) {
if (afl->stop_soon) return 0;
RPFATAL(res, "Unable to request new process from fork server (OOM?)");
}
if ((res = read(afl->fsrv.fsrv_st_fd, &afl->fsrv.child_pid, 4)) != 4) {
if ((res = read(fsrv->fsrv_st_fd, &fsrv->child_pid, 4)) != 4) {
if (afl->stop_soon) return 0;
RPFATAL(res, "Unable to request new process from fork server (OOM?)");
}
if (afl->fsrv.child_pid <= 0) FATAL("Fork server is misbehaving (OOM?)");
if (fsrv->child_pid <= 0) FATAL("Fork server is misbehaving (OOM?)");
exec_ms =
read_timed(afl->fsrv.fsrv_st_fd, &status, 4, timeout, &afl->stop_soon);
read_timed(fsrv->fsrv_st_fd, &status, 4, timeout, &afl->stop_soon);
if (exec_ms > timeout) {
/* If there was no response from forkserver after timeout seconds,
we kill the child. The forkserver should inform us afterwards */
kill(afl->fsrv.child_pid, SIGKILL);
afl->fsrv.child_timed_out = 1;
if (read(afl->fsrv.fsrv_st_fd, &status, 4) < 4) exec_ms = 0;
kill(fsrv->child_pid, SIGKILL);
fsrv->child_timed_out = 1;
if (read(fsrv->fsrv_st_fd, &status, 4) < 4) exec_ms = 0;
}
@ -104,30 +106,30 @@ u8 run_target(afl_state_t *afl, u32 timeout) {
"\n\n"
"If all else fails you can disable the fork server via "
"AFL_NO_FORKSRV=1.\n",
afl->fsrv.mem_limit);
fsrv->mem_limit);
RPFATAL(res, "Unable to communicate with fork server");
}
if (!WIFSTOPPED(status)) afl->fsrv.child_pid = 0;
if (!WIFSTOPPED(status)) fsrv->child_pid = 0;
++afl->total_execs;
/* Any subsequent operations on afl->fsrv.trace_bits must not be moved by the
compiler below this point. Past this location, afl->fsrv.trace_bits[]
/* Any subsequent operations on fsrv->trace_bits must not be moved by the
compiler below this point. Past this location, fsrv->trace_bits[]
behave very normally and do not have to be treated as volatile. */
MEM_BARRIER();
tb4 = *(u32 *)afl->fsrv.trace_bits;
tb4 = *(u32 *)fsrv->trace_bits;
#ifdef WORD_SIZE_64
classify_counts(afl, (u64 *)afl->fsrv.trace_bits);
classify_counts(afl, (u64 *)fsrv->trace_bits);
#else
classify_counts(afl, (u32 *)afl->fsrv.trace_bits);
classify_counts(afl, (u32 *)fsrv->trace_bits);
#endif /* ^WORD_SIZE_64 */
afl->fsrv.prev_timed_out = afl->fsrv.child_timed_out;
fsrv->prev_timed_out = fsrv->child_timed_out;
/* Report outcome to caller. */
@ -135,7 +137,7 @@ u8 run_target(afl_state_t *afl, u32 timeout) {
afl->kill_signal = WTERMSIG(status);
if (afl->fsrv.child_timed_out && afl->kill_signal == SIGKILL)
if (fsrv->child_timed_out && afl->kill_signal == SIGKILL)
return FAULT_TMOUT;
return FAULT_CRASH;
@ -145,7 +147,7 @@ u8 run_target(afl_state_t *afl, u32 timeout) {
/* A somewhat nasty hack for MSAN, which doesn't support abort_on_error and
must use a special exit code. */
if (afl->fsrv.uses_asan && WEXITSTATUS(status) == MSAN_ERROR) {
if (fsrv->uses_asan && WEXITSTATUS(status) == MSAN_ERROR) {
afl->kill_signal = 0;
return FAULT_CRASH;
@ -309,11 +311,12 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
/* Make sure the forkserver is up before we do anything, and let's not
count its spin-up time toward binary calibration. */
if (!afl->fsrv.fsrv_pid)
afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon);
if (afl->dumb_mode != 1 && !afl->no_forkserver && !afl->cmplog_fsrv_pid &&
afl->shm.cmplog_mode)
init_cmplog_forkserver(afl);
if (!afl->fsrv.fsrv_pid) {
if (afl->shm.cmplog_mode && afl->fsrv.init_child_func != cmplog_exec_child) {
FATAL("BUG in afl-fuzz detected. Cmplog mode not set correctly.");
}
afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child_output);
}
if (q->exec_cksum)
memcpy(afl->first_trace, afl->fsrv.trace_bits, afl->fsrv.map_size);
@ -329,7 +332,7 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
write_to_testcase(afl, use_mem, q->len);
fault = run_target(afl, use_tmout);
fault = run_target(afl, &afl->fsrv, use_tmout);
/* afl->stop_soon is set by the handler for Ctrl+C. When it's pressed,
we want to bail out quickly. */
@ -546,7 +549,7 @@ void sync_fuzzers(afl_state_t *afl) {
write_to_testcase(afl, mem, st.st_size);
fault = run_target(afl, afl->fsrv.exec_tmout);
fault = run_target(afl, &afl->fsrv, afl->fsrv.exec_tmout);
if (afl->stop_soon) goto close_sync;
@ -633,7 +636,7 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
write_with_gap(afl, in_buf, q->len, remove_pos, trim_avail);
fault = run_target(afl, afl->fsrv.exec_tmout);
fault = run_target(afl, &afl->fsrv, afl->fsrv.exec_tmout);
++afl->trim_execs;
if (afl->stop_soon || fault == FAULT_ERROR) goto abort_trimming;
@ -740,7 +743,7 @@ u8 common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
write_to_testcase(afl, out_buf, len);
fault = run_target(afl, afl->fsrv.exec_tmout);
fault = run_target(afl, &afl->fsrv, afl->fsrv.exec_tmout);
if (afl->stop_soon) return 1;

6
src/afl-fuzz-stats.c
View File

@ -124,12 +124,12 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
(unsigned long int)(rus.ru_maxrss >> 10),
#endif
t_bytes, afl->var_byte_count, afl->use_banner,
afl->unicorn_mode ? "unicorn" : "", afl->qemu_mode ? "qemu " : "",
afl->unicorn_mode ? "unicorn" : "", afl->fsrv.qemu_mode ? "qemu " : "",
afl->dumb_mode ? " dumb " : "", afl->no_forkserver ? "no_fsrv " : "",
afl->crash_mode ? "crash " : "",
afl->persistent_mode ? "persistent " : "",
afl->deferred_mode ? "deferred " : "",
(afl->unicorn_mode || afl->qemu_mode || afl->dumb_mode ||
(afl->unicorn_mode || afl->fsrv.qemu_mode || afl->dumb_mode ||
afl->no_forkserver || afl->crash_mode || afl->persistent_mode ||
afl->deferred_mode)
? ""
@ -820,7 +820,7 @@ void show_init_stats(afl_state_t *afl) {
SAYF("\n");
if (avg_us > ((afl->qemu_mode || afl->unicorn_mode) ? 50000 : 10000))
if (avg_us > ((afl->fsrv.qemu_mode || afl->unicorn_mode) ? 50000 : 10000))
WARNF(cLRD "The target binary is pretty slow! See %s/perf_tips.md.",
doc_path);

29
src/afl-fuzz.c
View File

@ -24,6 +24,7 @@
*/
#include "afl-fuzz.h"
#include "cmplog.h"
static u8 *get_libradamsa_path(u8 *own_loc) {
@ -213,6 +214,8 @@ static void usage(afl_state_t *afl, u8 *argv0, int more_help) {
static int stricmp(char const *a, char const *b) {
if (!a || !b) FATAL("Null reference");
for (;; ++a, ++b) {
int d;
@ -498,8 +501,8 @@ int main(int argc, char **argv_orig, char **envp) {
case 'Q': /* QEMU mode */
if (afl->qemu_mode) FATAL("Multiple -Q options not supported");
afl->qemu_mode = 1;
if (afl->fsrv.qemu_mode) FATAL("Multiple -Q options not supported");
afl->fsrv.qemu_mode = 1;
if (!mem_limit_given) afl->fsrv.mem_limit = MEM_LIMIT_QEMU;
@ -524,7 +527,7 @@ int main(int argc, char **argv_orig, char **envp) {
case 'W': /* Wine+QEMU mode */
if (afl->use_wine) FATAL("Multiple -W options not supported");
afl->qemu_mode = 1;
afl->fsrv.qemu_mode = 1;
afl->use_wine = 1;
if (!mem_limit_given) afl->fsrv.mem_limit = 0;
@ -748,7 +751,7 @@ int main(int argc, char **argv_orig, char **envp) {
if (afl->dumb_mode) {
if (afl->crash_mode) FATAL("-C and -n are mutually exclusive");
if (afl->qemu_mode) FATAL("-Q and -n are mutually exclusive");
if (afl->fsrv.qemu_mode) FATAL("-Q and -n are mutually exclusive");
if (afl->unicorn_mode) FATAL("-U and -n are mutually exclusive");
}
@ -816,7 +819,7 @@ int main(int argc, char **argv_orig, char **envp) {
if (afl->afl_env.afl_preload) {
if (afl->qemu_mode) {
if (afl->fsrv.qemu_mode) {
u8 *qemu_preload = getenv("QEMU_SET_ENV");
u8 *afl_preload = getenv("AFL_PRELOAD");
@ -991,7 +994,7 @@ int main(int argc, char **argv_orig, char **envp) {
if (afl->unicorn_mode)
FATAL("CmpLog and Unicorn mode are not compatible at the moment, sorry");
if (!afl->qemu_mode) check_binary(afl, afl->cmplog_binary);
if (!afl->fsrv.qemu_mode) check_binary(afl, afl->cmplog_binary);
}
@ -999,7 +1002,7 @@ int main(int argc, char **argv_orig, char **envp) {
afl->start_time = get_cur_time();
if (afl->qemu_mode) {
if (afl->fsrv.qemu_mode) {
if (afl->use_wine)
use_argv = get_wine_argv(argv[0], &afl->fsrv.target_path, argc - optind,
@ -1015,6 +1018,16 @@ int main(int argc, char **argv_orig, char **envp) {
}
afl->argv = use_argv;
if (afl->cmplog_binary) {
SAYF("Spawning cmplog forkserver");
memcpy(&afl->cmplog_fsrv, &afl->fsrv, sizeof(afl->fsrv));
afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
afl_fsrv_start(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child_output);
}
perform_dry_run(afl);
cull_queue(afl);
@ -1152,8 +1165,6 @@ int main(int argc, char **argv_orig, char **envp) {
if (afl->fsrv.child_pid > 0) kill(afl->fsrv.child_pid, SIGKILL);
if (afl->fsrv.fsrv_pid > 0) kill(afl->fsrv.fsrv_pid, SIGKILL);
if (afl->cmplog_child_pid > 0) kill(afl->cmplog_child_pid, SIGKILL);
if (afl->cmplog_fsrv_pid > 0) kill(afl->cmplog_fsrv_pid, SIGKILL);
/* Now that we've killed the forkserver, we wait for it to be able to get
* rusage stats. */
if (waitpid(afl->fsrv.fsrv_pid, NULL, 0) <= 0) { WARNF("error waitpid\n"); }

18
src/afl-showmap.c
View File

@ -81,8 +81,6 @@ u8 quiet_mode, /* Hide non-essential messages? */
static volatile u8 stop_soon, /* Ctrl-C pressed? */
child_crashed; /* Child crashed? */
static u8 qemu_mode;
/* Classify tuple counts. Instead of mapping to individual bits, as in
afl-fuzz.c, we map to more user-friendly numbers between 1 and 8. */
@ -482,7 +480,7 @@ static void handle_stop_sig(int sig) {
/* Do basic preparations - persistent fds, filenames, etc. */
static void set_up_environment(void) {
static void set_up_environment(afl_forkserver_t *fsrv) {
setenv("ASAN_OPTIONS",
"abort_on_error=1:"
@ -499,7 +497,7 @@ static void set_up_environment(void) {
if (get_afl_env("AFL_PRELOAD")) {
if (qemu_mode) {
if (fsrv->qemu_mode) {
u8 *qemu_preload = getenv("QEMU_SET_ENV");
u8 *afl_preload = getenv("AFL_PRELOAD");
@ -798,10 +796,10 @@ int main(int argc, char **argv_orig, char **envp) {
case 'Q':
if (qemu_mode) FATAL("Multiple -Q options not supported");
if (fsrv->qemu_mode) FATAL("Multiple -Q options not supported");
if (!mem_limit_given) fsrv->mem_limit = MEM_LIMIT_QEMU;
qemu_mode = 1;
fsrv->qemu_mode = 1;
break;
case 'U':
@ -815,7 +813,7 @@ int main(int argc, char **argv_orig, char **envp) {
case 'W': /* Wine+QEMU mode */
if (use_wine) FATAL("Multiple -W options not supported");
qemu_mode = 1;
fsrv->qemu_mode = 1;
use_wine = 1;
if (!mem_limit_given) fsrv->mem_limit = 0;
@ -860,7 +858,7 @@ int main(int argc, char **argv_orig, char **envp) {
fsrv->trace_bits = afl_shm_init(&shm, MAP_SIZE, 0);
setup_signal_handlers();
set_up_environment();
set_up_environment(fsrv);
find_binary(fsrv, argv[optind]);
@ -885,7 +883,7 @@ int main(int argc, char **argv_orig, char **envp) {
for (i = optind; i < argc; i++)
if (strcmp(argv[i], "@@") == 0) arg_offset = i;
if (qemu_mode) {
if (fsrv->qemu_mode) {
if (use_wine)
use_argv = get_wine_argv(argv[0], &fsrv->target_path, argc - optind,
@ -951,7 +949,7 @@ int main(int argc, char **argv_orig, char **envp) {
}
afl_fsrv_start(fsrv, use_argv, &stop_soon);
afl_fsrv_start(fsrv, use_argv, &stop_soon, get_afl_env("AFL_DEBUG_CHILD_OUTPUT")? 1 :0);
while (done == 0 && (dir_ent = readdir(dir_in))) {

14
src/afl-tmin.c
View File

@ -80,8 +80,6 @@ u8 crash_mode, /* Crash-centric mode? */
static volatile u8 stop_soon; /* Ctrl-C pressed? */
static u8 qemu_mode;
/*
* forkserver section
*/
@ -746,7 +744,7 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
if (get_afl_env("AFL_PRELOAD")) {
if (qemu_mode) {
if (fsrv->qemu_mode) {
u8 *qemu_preload = getenv("QEMU_SET_ENV");
u8 *afl_preload = getenv("AFL_PRELOAD");
@ -1029,10 +1027,10 @@ int main(int argc, char **argv_orig, char **envp) {
case 'Q':
if (qemu_mode) FATAL("Multiple -Q options not supported");
if (fsrv->qemu_mode) FATAL("Multiple -Q options not supported");
if (!mem_limit_given) fsrv->mem_limit = MEM_LIMIT_QEMU;
qemu_mode = 1;
fsrv->qemu_mode = 1;
break;
case 'U':
@ -1046,7 +1044,7 @@ int main(int argc, char **argv_orig, char **envp) {
case 'W': /* Wine+QEMU mode */
if (use_wine) FATAL("Multiple -W options not supported");
qemu_mode = 1;
fsrv->qemu_mode = 1;
use_wine = 1;
if (!mem_limit_given) fsrv->mem_limit = 0;
@ -1107,7 +1105,7 @@ int main(int argc, char **argv_orig, char **envp) {
find_binary(fsrv, argv[optind]);
detect_file_args(argv + optind, fsrv->out_file, &fsrv->use_stdin);
if (qemu_mode) {
if (fsrv->qemu_mode) {
if (use_wine)
use_argv = get_wine_argv(argv[0], &fsrv->target_path, argc - optind,
@ -1133,7 +1131,7 @@ int main(int argc, char **argv_orig, char **envp) {
read_initial_file();
afl_fsrv_start(fsrv, use_argv, &stop_soon);
afl_fsrv_start(fsrv, use_argv, &stop_soon, get_afl_env("AFL_DEBUG_CHILD_OUTPUT")? 1 :0);
ACTF("Performing dry run (mem limit = %llu MB, timeout = %u ms%s)...",
fsrv->mem_limit, fsrv->exec_tmout, edges_only ? ", edges only" : "");