ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-17 04:18:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fuzzer wotking with rtn cmplog

Browse Source
This commit is contained in:
Andrea Fioraldi
2020-02-18 17:45:57 +01:00
parent a83691d662
commit 2a549d548a
3 changed files with 69 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
llvm_mode/afl-llvm-cmplog-rt.o.c
View File

@ -323,6 +323,8 @@ void __sanitizer_cov_trace_cmp2(uint16_t Arg1, uint16_t Arg2) {
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
u32 hits = __afl_cmp_map->headers[k].hits;
__afl_cmp_map->headers[k].hits = hits + 1;
// if (!__afl_cmp_map->headers[k].cnt)
@ -345,6 +347,8 @@ void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) {
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
u32 hits = __afl_cmp_map->headers[k].hits;
__afl_cmp_map->headers[k].hits = hits + 1;
@ -364,6 +368,8 @@ void __sanitizer_cov_trace_cmp8(uint64_t Arg1, uint64_t Arg2) {
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
u32 hits = __afl_cmp_map->headers[k].hits;
__afl_cmp_map->headers[k].hits = hits + 1;

29
llvm_mode/cmplog-routines-pass.cc
View File

@ -1,18 +1,19 @@
/*
* Copyright 2016 laf-intel
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
american fuzzy lop++ - LLVM CmpLog instrumentation
--------------------------------------------------
Written by Andrea Fioraldi <andreafioraldi@gmail.com>
Copyright 2015, 2016 Google Inc. All rights reserved.
Copyright 2019-2020 AFLplusplus Project. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0
*/
#include <stdio.h>
#include <stdlib.h>

73
src/afl-fuzz-redqueen.c
View File

@ -207,7 +207,7 @@ checksum_fail:
///// Input to State replacement
u8 its_fuzz(u32 idx, u32 size, u8* buf, u32 len, u8* status) {
u8 its_fuzz(u8* buf, u32 len, u8* status) {
u64 orig_hit_cnt, new_hit_cnt;
@ -217,18 +217,11 @@ u8 its_fuzz(u32 idx, u32 size, u8* buf, u32 len, u8* status) {
new_hit_cnt = queued_paths + unique_crashes;
if (unlikely(new_hit_cnt != orig_hit_cnt)) {
if (unlikely(new_hit_cnt != orig_hit_cnt))
*status = 1;
} else {
if (size >= MIN_AUTO_EXTRA && size <= MAX_AUTO_EXTRA)
maybe_add_auto(&buf[idx], size);
else
*status = 2;
}
return 0;
}
@ -254,7 +247,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
if (its_len >= 8 && *buf_64 == pattern && *o_buf_64 == pattern) {
*buf_64 = repl;
if (unlikely(its_fuzz(idx, 8, buf, len, status))) return 1;
if (unlikely(its_fuzz(buf, len, status))) return 1;
*buf_64 = pattern;
}
@ -272,7 +265,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
if (its_len >= 4 && *buf_32 == (u32)pattern && *o_buf_32 == (u32)pattern) {
*buf_32 = (u32)repl;
if (unlikely(its_fuzz(idx, 4, buf, len, status))) return 1;
if (unlikely(its_fuzz(buf, len, status))) return 1;
*buf_32 = pattern;
}
@ -290,7 +283,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
if (its_len >= 2 && *buf_16 == (u16)pattern && *o_buf_16 == (u16)pattern) {
*buf_16 = (u16)repl;
if (unlikely(its_fuzz(idx, 2, buf, len, status))) return 1;
if (unlikely(its_fuzz(buf, len, status))) return 1;
*buf_16 = (u16)pattern;
}
@ -308,7 +301,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
if (its_len >= 2 && *buf_8 == (u8)pattern && *o_buf_8 == (u8)pattern) {
*buf_8 = (u8)repl;
if (unlikely(its_fuzz(idx, 1, buf, len, status)))
if (unlikely(its_fuzz(buf, len, status)))
return 1;
*buf_16 = (u16)pattern;
@ -423,7 +416,26 @@ u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
u8 rtn_extend_encoding(struct cmp_header* h, u8* pattern, u8* repl, u32 idx,
u8* orig_buf, u8* buf, u32 len, u8* status) {
*status = 2;
u32 i;
u32 its_len = MIN(32, len - idx);
u8 save[32];
memcpy(save, &buf[idx], its_len);
*status = 0;
for (i = 0; i < its_len; ++i) {
if (pattern[idx + i] != orig_buf[idx + i] || *status == 1)
break;
buf[idx +i] = repl[idx + i];
if (unlikely(its_fuzz(buf, len, status))) return 1;
}
memcpy(&buf[idx], save, i);
return 0;
}
@ -444,9 +456,9 @@ u8 rtn_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
struct cmpfn_operands* o = &((struct cmpfn_operands*)cmp_map->log[key])[i];
// opt not in the paper
//for (j = 0; j < i; ++j)
// if (cmp_map->log[key][j].v0 == o->v0 && cmp_map->log[key][i].v1 == o->v1)
// goto cmp_fuzz_next_iter;
for (j = 0; j < i; ++j)
if (!memcmp(&((struct cmpfn_operands*)cmp_map->log[key])[j], o, sizeof(struct cmpfn_operands)))
goto rtn_fuzz_next_iter;
for (idx = 0; idx < len && fails < 8; ++idx) {
@ -476,7 +488,7 @@ u8 rtn_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
}
cmp_fuzz_next_iter:
rtn_fuzz_next_iter:
stage_cur++;
}
@ -491,6 +503,7 @@ u8 rtn_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len,
u32 exec_cksum) {
u8 r = 1;
its_argv = argv;
if (unlikely(colorization(buf, len, exec_cksum))) return 1;
@ -513,10 +526,10 @@ u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len,
for (k = 0; k < CMP_MAP_W; ++k) {
if (!cmp_map->headers[k].hits) continue;
if (cmp_map->headers[k].hits > CMP_MAP_H)
stage_max += CMP_MAP_H;
if (cmp_map->headers[k].type == CMP_TYPE_INS)
stage_max += MIN(cmp_map->headers[k].hits, CMP_MAP_H);
else
stage_max += cmp_map->headers[k].hits;
stage_max += MIN(cmp_map->headers[k].hits, CMP_MAP_RTN_H);
}
@ -524,20 +537,26 @@ u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len,
if (!cmp_map->headers[k].hits) continue;
if (cmp_map->headers[k].type == CMP_TYPE_INS)
cmp_fuzz(k, orig_buf, buf, len);
else
rtn_fuzz(k, orig_buf, buf, len);
if (cmp_map->headers[k].type == CMP_TYPE_INS) {
if (unlikely(cmp_fuzz(k, orig_buf, buf, len)))
goto exit_its;
} else {
if (unlikely(rtn_fuzz(k, orig_buf, buf, len)))
goto exit_its;
}
}
r = 0;
exit_its:
memcpy(orig_buf, buf, len);
new_hit_cnt = queued_paths + unique_crashes;
stage_finds[STAGE_ITS] += new_hit_cnt - orig_hit_cnt;
stage_cycles[STAGE_ITS] += total_execs - orig_execs;
return 0;
return r;
}