ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-08 16:21:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'dev' of github.com:vanhauser-thc/AFLplusplus into dev

Browse Source
This commit is contained in:
Andrea Fioraldi 2020-03-23 20:19:20 +01:00
commit 36213dba7d
8 changed files with 602 additions and 340 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
examples/custom_mutators/custom_mutator_helpers.h
View File

@ -5,7 +5,9 @@
#include "types.h" #include "types.h"
#include <stdlib.h> #include <stdlib.h>
#define LIMIT_RAND(limit) (rand() % (limit)) #define RAND_BELOW(limit) (rand() % (limit))
typedef struct{} afl_t;
static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) { static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
@ -13,13 +15,13 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
static s16 interesting_16[] = {INTERESTING_8, INTERESTING_16}; static s16 interesting_16[] = {INTERESTING_8, INTERESTING_16};
static s32 interesting_32[] = {INTERESTING_8, INTERESTING_16, INTERESTING_32}; static s32 interesting_32[] = {INTERESTING_8, INTERESTING_16, INTERESTING_32};
switch (LIMIT_RAND(12)) { switch (RAND_BELOW(12)) {
case 0: { case 0: {
/* Flip a single bit somewhere. Spooky! */ /* Flip a single bit somewhere. Spooky! */
s32 bit_idx = ((LIMIT_RAND(end - begin) + begin) << 3) + LIMIT_RAND(8); s32 bit_idx = ((RAND_BELOW(end - begin) + begin) << 3) + RAND_BELOW(8);
out_buf[bit_idx >> 3] ^= 128 >> (bit_idx & 7); out_buf[bit_idx >> 3] ^= 128 >> (bit_idx & 7);
@ -31,8 +33,8 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
/* Set byte to interesting value. */ /* Set byte to interesting value. */
u8 val = interesting_8[LIMIT_RAND(sizeof(interesting_8))]; u8 val = interesting_8[RAND_BELOW(sizeof(interesting_8))];
out_buf[(LIMIT_RAND(end - begin) + begin)] = val; out_buf[(RAND_BELOW(end - begin) + begin)] = val;
break; break;
@ -44,19 +46,19 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
if (end - begin < 2) break; if (end - begin < 2) break;
s32 byte_idx = (LIMIT_RAND(end - begin) + begin); s32 byte_idx = (RAND_BELOW(end - begin) + begin);
if (byte_idx >= end - 1) break; if (byte_idx >= end - 1) break;
switch (LIMIT_RAND(2)) { switch (RAND_BELOW(2)) {
case 0: case 0:
*(u16 *)(out_buf + byte_idx) = *(u16 *)(out_buf + byte_idx) =
interesting_16[LIMIT_RAND(sizeof(interesting_16) >> 1)]; interesting_16[RAND_BELOW(sizeof(interesting_16) >> 1)];
break; break;
case 1: case 1:
*(u16 *)(out_buf + byte_idx) = *(u16 *)(out_buf + byte_idx) =
SWAP16(interesting_16[LIMIT_RAND(sizeof(interesting_16) >> 1)]); SWAP16(interesting_16[RAND_BELOW(sizeof(interesting_16) >> 1)]);
break; break;
} }
@ -71,19 +73,19 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
if (end - begin < 4) break; if (end - begin < 4) break;
s32 byte_idx = (LIMIT_RAND(end - begin) + begin); s32 byte_idx = (RAND_BELOW(end - begin) + begin);
if (byte_idx >= end - 3) break; if (byte_idx >= end - 3) break;
switch (LIMIT_RAND(2)) { switch (RAND_BELOW(2)) {
case 0: case 0:
*(u32 *)(out_buf + byte_idx) = *(u32 *)(out_buf + byte_idx) =
interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)]; interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)];
break; break;
case 1: case 1:
*(u32 *)(out_buf + byte_idx) = *(u32 *)(out_buf + byte_idx) =
SWAP32(interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)]); SWAP32(interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)]);
break; break;
} }
@ -98,19 +100,19 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
if (end - begin < 8) break; if (end - begin < 8) break;
s32 byte_idx = (LIMIT_RAND(end - begin) + begin); s32 byte_idx = (RAND_BELOW(end - begin) + begin);
if (byte_idx >= end - 7) break; if (byte_idx >= end - 7) break;
switch (LIMIT_RAND(2)) { switch (RAND_BELOW(2)) {
case 0: case 0:
*(u64 *)(out_buf + byte_idx) = *(u64 *)(out_buf + byte_idx) =
(s64)interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)]; (s64)interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)];
break; break;
case 1: case 1:
*(u64 *)(out_buf + byte_idx) = *(u64 *)(out_buf + byte_idx) =
SWAP64((s64)interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)]); SWAP64((s64)interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)]);
break; break;
} }
@ -123,7 +125,7 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
/* Randomly subtract from byte. */ /* Randomly subtract from byte. */
out_buf[(LIMIT_RAND(end - begin) + begin)] -= 1 + LIMIT_RAND(ARITH_MAX); out_buf[(RAND_BELOW(end - begin) + begin)] -= 1 + RAND_BELOW(ARITH_MAX);
break; break;
@ -133,7 +135,7 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
/* Randomly add to byte. */ /* Randomly add to byte. */
out_buf[(LIMIT_RAND(end - begin) + begin)] += 1 + LIMIT_RAND(ARITH_MAX); out_buf[(RAND_BELOW(end - begin) + begin)] += 1 + RAND_BELOW(ARITH_MAX);
break; break;
@ -145,17 +147,17 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
if (end - begin < 2) break; if (end - begin < 2) break;
s32 byte_idx = (LIMIT_RAND(end - begin) + begin); s32 byte_idx = (RAND_BELOW(end - begin) + begin);
if (byte_idx >= end - 1) break; if (byte_idx >= end - 1) break;
if (LIMIT_RAND(2)) { if (RAND_BELOW(2)) {
*(u16 *)(out_buf + byte_idx) -= 1 + LIMIT_RAND(ARITH_MAX); *(u16 *)(out_buf + byte_idx) -= 1 + RAND_BELOW(ARITH_MAX);
} else { } else {
u16 num = 1 + LIMIT_RAND(ARITH_MAX); u16 num = 1 + RAND_BELOW(ARITH_MAX);
*(u16 *)(out_buf + byte_idx) = *(u16 *)(out_buf + byte_idx) =
SWAP16(SWAP16(*(u16 *)(out_buf + byte_idx)) - num); SWAP16(SWAP16(*(u16 *)(out_buf + byte_idx)) - num);
@ -172,17 +174,17 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
if (end - begin < 2) break; if (end - begin < 2) break;
s32 byte_idx = (LIMIT_RAND(end - begin) + begin); s32 byte_idx = (RAND_BELOW(end - begin) + begin);
if (byte_idx >= end - 1) break; if (byte_idx >= end - 1) break;
if (LIMIT_RAND(2)) { if (RAND_BELOW(2)) {
*(u16 *)(out_buf + byte_idx) += 1 + LIMIT_RAND(ARITH_MAX); *(u16 *)(out_buf + byte_idx) += 1 + RAND_BELOW(ARITH_MAX);
} else { } else {
u16 num = 1 + LIMIT_RAND(ARITH_MAX); u16 num = 1 + RAND_BELOW(ARITH_MAX);
*(u16 *)(out_buf + byte_idx) = *(u16 *)(out_buf + byte_idx) =
SWAP16(SWAP16(*(u16 *)(out_buf + byte_idx)) + num); SWAP16(SWAP16(*(u16 *)(out_buf + byte_idx)) + num);
@ -199,17 +201,17 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
if (end - begin < 4) break; if (end - begin < 4) break;
s32 byte_idx = (LIMIT_RAND(end - begin) + begin); s32 byte_idx = (RAND_BELOW(end - begin) + begin);
if (byte_idx >= end - 3) break; if (byte_idx >= end - 3) break;
if (LIMIT_RAND(2)) { if (RAND_BELOW(2)) {
*(u32 *)(out_buf + byte_idx) -= 1 + LIMIT_RAND(ARITH_MAX); *(u32 *)(out_buf + byte_idx) -= 1 + RAND_BELOW(ARITH_MAX);
} else { } else {
u32 num = 1 + LIMIT_RAND(ARITH_MAX); u32 num = 1 + RAND_BELOW(ARITH_MAX);
*(u32 *)(out_buf + byte_idx) = *(u32 *)(out_buf + byte_idx) =
SWAP32(SWAP32(*(u32 *)(out_buf + byte_idx)) - num); SWAP32(SWAP32(*(u32 *)(out_buf + byte_idx)) - num);
@ -226,17 +228,17 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
if (end - begin < 4) break; if (end - begin < 4) break;
s32 byte_idx = (LIMIT_RAND(end - begin) + begin); s32 byte_idx = (RAND_BELOW(end - begin) + begin);
if (byte_idx >= end - 3) break; if (byte_idx >= end - 3) break;
if (LIMIT_RAND(2)) { if (RAND_BELOW(2)) {
*(u32 *)(out_buf + byte_idx) += 1 + LIMIT_RAND(ARITH_MAX); *(u32 *)(out_buf + byte_idx) += 1 + RAND_BELOW(ARITH_MAX);
} else { } else {
u32 num = 1 + LIMIT_RAND(ARITH_MAX); u32 num = 1 + RAND_BELOW(ARITH_MAX);
*(u32 *)(out_buf + byte_idx) = *(u32 *)(out_buf + byte_idx) =
SWAP32(SWAP32(*(u32 *)(out_buf + byte_idx)) + num); SWAP32(SWAP32(*(u32 *)(out_buf + byte_idx)) + num);
@ -253,7 +255,7 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
why not. We use XOR with 1-255 to eliminate the why not. We use XOR with 1-255 to eliminate the
possibility of a no-op. */ possibility of a no-op. */
out_buf[(LIMIT_RAND(end - begin) + begin)] ^= 1 + LIMIT_RAND(255); out_buf[(RAND_BELOW(end - begin) + begin)] ^= 1 + RAND_BELOW(255);
break; break;

76
examples/custom_mutators/example.c
View File

@ -3,6 +3,7 @@
Written by Khaled Yakdan <yakdan@code-intelligence.de> Written by Khaled Yakdan <yakdan@code-intelligence.de>
Andrea Fioraldi <andreafioraldi@gmail.com> Andrea Fioraldi <andreafioraldi@gmail.com>
Shengtuo Hu <h1994st@gmail.com> Shengtuo Hu <h1994st@gmail.com>
Dominik Maier <mail@dmnk.co>
*/ */
// You need to use -I /path/to/AFLplusplus/include // You need to use -I /path/to/AFLplusplus/include
@ -12,6 +13,8 @@
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#define DATA_SIZE (100)
static const char *commands[] = { static const char *commands[] = {
"GET", "GET",
@ -20,12 +23,36 @@ static const char *commands[] = {
}; };
static size_t data_size = 100;
void afl_custom_init(unsigned int seed) { typedef struct my_mutator {
afl_t *afl;
// any additional data here!
} my_mutator_t;
/**
* Initialize this custom mutator
*
* @param[in] afl a pointer to the internal state object. Can be ignored for now.
* @param[in] seed A seed for this mutator - the same seed should always mutate in the same way.
* @return Pointer to the data object this custom mutator instance should use.
* There may be multiple instances of this mutator in one afl-fuzz run!
* Returns NULL on error.
*/
my_mutator_t *afl_custom_init(afl_t *afl, unsigned int seed) {
srand(seed); // needed also by surgical_havoc_mutate() srand(seed); // needed also by surgical_havoc_mutate()
my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
if (!data) {
perror("afl_custom_init alloc");
return NULL;
}
data->afl = afl;
return data;
} }
/** /**
@ -33,6 +60,7 @@ void afl_custom_init(unsigned int seed) {
* *
* (Optional for now. Required in the future) * (Optional for now. Required in the future)
* *
* @param[in] data pointer returned in afl_custom_init for this fuzz case
* @param[in] buf Pointer to input data to be mutated * @param[in] buf Pointer to input data to be mutated
* @param[in] buf_size Size of input data * @param[in] buf_size Size of input data
* @param[in] add_buf Buffer containing the additional test case * @param[in] add_buf Buffer containing the additional test case
@ -41,13 +69,14 @@ void afl_custom_init(unsigned int seed) {
* produce data larger than max_size. * produce data larger than max_size.
* @return Size of the mutated output. * @return Size of the mutated output.
*/ */
size_t afl_custom_fuzz(uint8_t **buf, size_t buf_size, uint8_t *add_buf, size_t afl_custom_fuzz(my_mutator_t *data, uint8_t **buf, size_t buf_size,
uint8_t *add_buf,
size_t add_buf_size, // add_buf can be NULL size_t add_buf_size, // add_buf can be NULL
size_t max_size) { size_t max_size) {
// Make sure that the packet size does not exceed the maximum size expected by // Make sure that the packet size does not exceed the maximum size expected by
// the fuzzer // the fuzzer
size_t mutated_size = data_size <= max_size ? data_size : max_size; size_t mutated_size = DATA_SIZE <= max_size ? DATA_SIZE : max_size;
if (mutated_size > buf_size) *buf = realloc(*buf, mutated_size); if (mutated_size > buf_size) *buf = realloc(*buf, mutated_size);
@ -59,10 +88,10 @@ size_t afl_custom_fuzz(uint8_t **buf, size_t buf_size, uint8_t *add_buf,
// Mutate the payload of the packet // Mutate the payload of the packet
int i; int i;
for (i = 0; i < 8; ++i) { for (i = 0; i < 8; ++i) {
// Randomly perform one of the (no len modification) havoc mutations // Randomly perform one of the (no len modification) havoc mutations
surgical_havoc_mutate(mutated_out, 3, mutated_size); surgical_havoc_mutate(mutated_out, 3, mutated_size);
} }
return mutated_size; return mutated_size;
@ -76,6 +105,7 @@ size_t afl_custom_fuzz(uint8_t **buf, size_t buf_size, uint8_t *add_buf,
* (Optional) If this functionality is not needed, simply don't define this * (Optional) If this functionality is not needed, simply don't define this
* function. * function.
* *
* @param[in] data pointer returned in afl_custom_init for this fuzz case
* @param[in] buf Buffer containing the test case to be executed * @param[in] buf Buffer containing the test case to be executed
* @param[in] buf_size Size of the test case * @param[in] buf_size Size of the test case
* @param[out] out_buf Pointer to the buffer containing the test case after * @param[out] out_buf Pointer to the buffer containing the test case after
@ -83,7 +113,7 @@ size_t afl_custom_fuzz(uint8_t **buf, size_t buf_size, uint8_t *add_buf,
* will release the memory after saving the test case. * will release the memory after saving the test case.
* @return Size of the output buffer after processing * @return Size of the output buffer after processing
*/ */
size_t afl_custom_pre_save(uint8_t *buf, size_t buf_size, uint8_t **out_buf) { size_t afl_custom_pre_save(my_mutator_t *data, uint8_t *buf, size_t buf_size, uint8_t **out_buf) {
size_t out_buf_size; size_t out_buf_size;
@ -118,11 +148,12 @@ static int cur_step;
* *
* (Optional) * (Optional)
* *
* @param data pointer returned in afl_custom_init for this fuzz case
* @param buf Buffer containing the test case * @param buf Buffer containing the test case
* @param buf_size Size of the test case * @param buf_size Size of the test case
* @return The amount of possible iteration steps to trim the input * @return The amount of possible iteration steps to trim the input
*/ */
int afl_custom_init_trim(uint8_t *buf, size_t buf_size) { int afl_custom_init_trim(my_mutator_t *data, uint8_t *buf, size_t buf_size) {
// We simply trim once // We simply trim once
trimmming_steps = 1; trimmming_steps = 1;
@ -146,12 +177,13 @@ int afl_custom_init_trim(uint8_t *buf, size_t buf_size) {
* *
* (Optional) * (Optional)
* *
* @param[in] data pointer returned in afl_custom_init for this fuzz case
* @param[out] out_buf Pointer to the buffer containing the trimmed test case. * @param[out] out_buf Pointer to the buffer containing the trimmed test case.
* External library should allocate memory for out_buf. AFL++ will release * External library should allocate memory for out_buf. AFL++ will release
* the memory after saving the test case. * the memory after saving the test case.
* @param[out] out_buf_size Pointer to the size of the trimmed test case * @param[out] out_buf_size Pointer to the size of the trimmed test case
*/ */
void afl_custom_trim(uint8_t **out_buf, size_t *out_buf_size) { void afl_custom_trim(my_mutator_t *data, uint8_t **out_buf, size_t *out_buf_size) {
*out_buf_size = trim_buf_size - 1; *out_buf_size = trim_buf_size - 1;
@ -169,11 +201,12 @@ void afl_custom_trim(uint8_t **out_buf, size_t *out_buf_size) {
* *
* (Optional) * (Optional)
* *
* @param[in] data pointer returned in afl_custom_init for this fuzz case
* @param success Indicates if the last trim operation was successful. * @param success Indicates if the last trim operation was successful.
* @return The next trim iteration index (from 0 to the maximum amount of * @return The next trim iteration index (from 0 to the maximum amount of
* steps returned in init_trim) * steps returned in init_trim)
*/ */
int afl_custom_post_trim(int success) { int afl_custom_post_trim(my_mutator_t *data, int success) {
if (success) { if (success) {
@ -192,6 +225,7 @@ int afl_custom_post_trim(int success) {
* *
* (Optional) * (Optional)
* *
* @param[in] data pointer returned in afl_custom_init for this fuzz case
* @param[inout] buf Pointer to the input data to be mutated and the mutated * @param[inout] buf Pointer to the input data to be mutated and the mutated
* output * output
* @param[in] buf_size Size of input data * @param[in] buf_size Size of input data
@ -199,7 +233,7 @@ int afl_custom_post_trim(int success) {
* not produce data larger than max_size. * not produce data larger than max_size.
* @return Size of the mutated output. * @return Size of the mutated output.
*/ */
size_t afl_custom_havoc_mutation(uint8_t **buf, size_t buf_size, size_t afl_custom_havoc_mutation(my_mutator_t *data, uint8_t **buf, size_t buf_size,
size_t max_size) { size_t max_size) {
if (buf_size == 0) { if (buf_size == 0) {
@ -223,9 +257,10 @@ size_t afl_custom_havoc_mutation(uint8_t **buf, size_t buf_size,
* *
* (Optional) * (Optional)
* *
* @param[in] data pointer returned in afl_custom_init for this fuzz case
* @return The probability (0-100). * @return The probability (0-100).
*/ */
uint8_t afl_custom_havoc_mutation_probability(void) { uint8_t afl_custom_havoc_mutation_probability(my_mutator_t *data) {
return 5; // 5 % return 5; // 5 %
@ -236,11 +271,12 @@ uint8_t afl_custom_havoc_mutation_probability(void) {
* *
* (Optional) * (Optional)
* *
* @param[in] data pointer returned in afl_custom_init for this fuzz case
* @param filename File name of the test case in the queue entry * @param filename File name of the test case in the queue entry
* @return Return True(1) if the fuzzer will fuzz the queue entry, and * @return Return True(1) if the fuzzer will fuzz the queue entry, and
* False(0) otherwise. * False(0) otherwise.
*/ */
uint8_t afl_custom_queue_get(const uint8_t *filename) { uint8_t afl_custom_queue_get(my_mutator_t *data, const uint8_t *filename) {
return 1; return 1;
@ -252,13 +288,25 @@ uint8_t afl_custom_queue_get(const uint8_t *filename) {
* *
* (Optional) * (Optional)
* *
* @param data pointer returned in afl_custom_init for this fuzz case
* @param filename_new_queue File name of the new queue entry * @param filename_new_queue File name of the new queue entry
* @param filename_orig_queue File name of the original queue entry * @param filename_orig_queue File name of the original queue entry
*/ */
void afl_custom_queue_new_entry(const uint8_t *filename_new_queue, void afl_custom_queue_new_entry(my_mutator_t *data, const uint8_t *filename_new_queue,
const uint8_t *filename_orig_queue) { const uint8_t *filename_orig_queue) {
/* Additional analysis on the original or new test case */ /* Additional analysis on the original or new test case */
} }
/**
* Deinitialize everything
*
* @param data The data ptr from afl_custom_init
*/
void afl_custom_deinit(my_mutator_t *data) {
free(data);
}

82
include/afl-fuzz.h
View File

@ -281,10 +281,20 @@ enum {
/* 07 */ PY_FUNC_HAVOC_MUTATION_PROBABILITY, /* 07 */ PY_FUNC_HAVOC_MUTATION_PROBABILITY,
/* 08 */ PY_FUNC_QUEUE_GET, /* 08 */ PY_FUNC_QUEUE_GET,
/* 09 */ PY_FUNC_QUEUE_NEW_ENTRY, /* 09 */ PY_FUNC_QUEUE_NEW_ENTRY,
/* 10 */ PY_FUNC_DEINIT,
PY_FUNC_COUNT PY_FUNC_COUNT
}; };
typedef struct py_mutator {
PyObject *py_module;
PyObject *py_functions[PY_FUNC_COUNT];
void *afl_state;
void *py_data;
} py_mutator_t;
#endif #endif
typedef struct MOpt_globals { typedef struct MOpt_globals {
@ -540,6 +550,9 @@ typedef struct afl_state {
/* Custom mutators */ /* Custom mutators */
struct custom_mutator *mutator; struct custom_mutator *mutator;
#ifdef USE_PYTHON
struct custom_mutator *py_mutator;
#endif
/* cmplog forkserver ids */ /* cmplog forkserver ids */
s32 cmplog_fsrv_ctl_fd, cmplog_fsrv_st_fd; s32 cmplog_fsrv_ctl_fd, cmplog_fsrv_st_fd;
@ -548,12 +561,6 @@ typedef struct afl_state {
u8 describe_op_buf_256[256]; /* describe_op will use this to return a string u8 describe_op_buf_256[256]; /* describe_op will use this to return a string
up to 256 */ up to 256 */
#ifdef USE_PYTHON
/* Python Mutators */
PyObject *py_module;
PyObject *py_functions[PY_FUNC_COUNT];
#endif
#ifdef _AFL_DOCUMENT_MUTATIONS #ifdef _AFL_DOCUMENT_MUTATIONS
u8 do_document; u8 do_document;
u32 document_counter; u32 document_counter;
@ -585,22 +592,25 @@ struct custom_mutator {
const char *name; const char *name;
void * dh; void * dh;
void *data; /* custom mutator data ptr */
/* hooks for the custom mutator function */ /* hooks for the custom mutator function */
/** /**
* Initialize the custom mutator. * Initialize the custom mutator.
* *
* (Optional) * @param afl AFL instance.
*
* @param seed Seed used for the mutation. * @param seed Seed used for the mutation.
* @return pointer to internal data or NULL on error
*/ */
void (*afl_custom_init)(afl_state_t *afl, unsigned int seed); void *(*afl_custom_init)(afl_state_t *afl, unsigned int seed);
/** /**
* Perform custom mutations on a given input * Perform custom mutations on a given input
* *
* (Optional for now. Required in the future) * (Optional for now. Required in the future)
* *
* @param data pointer returned in afl_custom_init for this fuzz case
* @param[inout] buf Pointer to the input data to be mutated and the mutated * @param[inout] buf Pointer to the input data to be mutated and the mutated
* output * output
* @param[in] buf_size Size of the input/output data * @param[in] buf_size Size of the input/output data
@ -610,7 +620,7 @@ struct custom_mutator {
* not produce data larger than max_size. * not produce data larger than max_size.
* @return Size of the mutated output. * @return Size of the mutated output.
*/ */
size_t (*afl_custom_fuzz)(afl_state_t *afl, u8 **buf, size_t buf_size, size_t (*afl_custom_fuzz)(void *data, u8 **buf, size_t buf_size,
u8 *add_buf, size_t add_buf_size, size_t max_size); u8 *add_buf, size_t add_buf_size, size_t max_size);
/** /**
@ -620,6 +630,7 @@ struct custom_mutator {
* (Optional) If this functionality is not needed, simply don't define this * (Optional) If this functionality is not needed, simply don't define this
* function. * function.
* *
* @param[in] data pointer returned in afl_custom_init for this fuzz case
* @param[in] buf Buffer containing the test case to be executed * @param[in] buf Buffer containing the test case to be executed
* @param[in] buf_size Size of the test case * @param[in] buf_size Size of the test case
* @param[out] out_buf Pointer to the buffer of storing the test case after * @param[out] out_buf Pointer to the buffer of storing the test case after
@ -627,7 +638,7 @@ struct custom_mutator {
* will release the memory after saving the test case. * will release the memory after saving the test case.
* @return Size of the output buffer after processing * @return Size of the output buffer after processing
*/ */
size_t (*afl_custom_pre_save)(afl_state_t *afl, u8 *buf, size_t buf_size, size_t (*afl_custom_pre_save)(void *data, u8 *buf, size_t buf_size,
u8 **out_buf); u8 **out_buf);
/** /**
@ -646,11 +657,12 @@ struct custom_mutator {
* *
* (Optional) * (Optional)
* *
* @param data pointer returned in afl_custom_init for this fuzz case
* @param buf Buffer containing the test case * @param buf Buffer containing the test case
* @param buf_size Size of the test case * @param buf_size Size of the test case
* @return The amount of possible iteration steps to trim the input * @return The amount of possible iteration steps to trim the input
*/ */
u32 (*afl_custom_init_trim)(afl_state_t *afl, u8 *buf, size_t buf_size); u32 (*afl_custom_init_trim)(void *data, u8 *buf, size_t buf_size);
/** /**
* This method is called for each trimming operation. It doesn't have any * This method is called for each trimming operation. It doesn't have any
@ -663,12 +675,13 @@ struct custom_mutator {
* *
* (Optional) * (Optional)
* *
* @param data pointer returned in afl_custom_init for this fuzz case
* @param[out] out_buf Pointer to the buffer containing the trimmed test case. * @param[out] out_buf Pointer to the buffer containing the trimmed test case.
* External library should allocate memory for out_buf. AFL++ will release * External library should allocate memory for out_buf. AFL++ will release
* the memory after saving the test case. * the memory after saving the test case.
* @param[out] out_buf_size Pointer to the size of the trimmed test case * @param[out] out_buf_size Pointer to the size of the trimmed test case
*/ */
void (*afl_custom_trim)(afl_state_t *afl, u8 **out_buf, size_t *out_buf_size); void (*afl_custom_trim)(void *data, u8 **out_buf, size_t *out_buf_size);
/** /**
* This method is called after each trim operation to inform you if your * This method is called after each trim operation to inform you if your
@ -677,11 +690,12 @@ struct custom_mutator {
* *
* (Optional) * (Optional)
* *
* @param data pointer returned in afl_custom_init for this fuzz case
* @param success Indicates if the last trim operation was successful. * @param success Indicates if the last trim operation was successful.
* @return The next trim iteration index (from 0 to the maximum amount of * @return The next trim iteration index (from 0 to the maximum amount of
* steps returned in init_trim) * steps returned in init_trim)
*/ */
u32 (*afl_custom_post_trim)(afl_state_t *afl, u8 success); u32 (*afl_custom_post_trim)(void *data, u8 success);
/** /**
* Perform a single custom mutation on a given input. * Perform a single custom mutation on a given input.
@ -689,6 +703,7 @@ struct custom_mutator {
* *
* (Optional) * (Optional)
* *
* @param data pointer returned in afl_custom_init for this fuzz case
* @param[inout] buf Pointer to the input data to be mutated and the mutated * @param[inout] buf Pointer to the input data to be mutated and the mutated
* output * output
* @param[in] buf_size Size of input data * @param[in] buf_size Size of input data
@ -696,7 +711,7 @@ struct custom_mutator {
* not produce data larger than max_size. * not produce data larger than max_size.
* @return Size of the mutated output. * @return Size of the mutated output.
*/ */
size_t (*afl_custom_havoc_mutation)(afl_state_t *afl, u8 **buf, size_t (*afl_custom_havoc_mutation)(void *data, u8 **buf,
size_t buf_size, size_t max_size); size_t buf_size, size_t max_size);
/** /**
@ -705,20 +720,22 @@ struct custom_mutator {
* *
* (Optional) * (Optional)
* *
* @param data pointer returned in afl_custom_init for this fuzz case
* @return The probability (0-100). * @return The probability (0-100).
*/ */
u8 (*afl_custom_havoc_mutation_probability)(afl_state_t *afl); u8 (*afl_custom_havoc_mutation_probability)(void *data);
/** /**
* Determine whether the fuzzer should fuzz the current queue entry or not. * Determine whether the fuzzer should fuzz the current queue entry or not.
* *
* (Optional) * (Optional)
* *
* @param data pointer returned in afl_custom_init for this fuzz case
* @param filename File name of the test case in the queue entry * @param filename File name of the test case in the queue entry
* @return Return True(1) if the fuzzer will fuzz the queue entry, and * @return Return True(1) if the fuzzer will fuzz the queue entry, and
* False(0) otherwise. * False(0) otherwise.
*/ */
u8 (*afl_custom_queue_get)(afl_state_t *afl, const u8 *filename); u8 (*afl_custom_queue_get)(void *data, const u8 *filename);
/** /**
* Allow for additional analysis (e.g. calling a different tool that does a * Allow for additional analysis (e.g. calling a different tool that does a
@ -726,13 +743,20 @@ struct custom_mutator {
* *
* (Optional) * (Optional)
* *
* @param data pointer returned in afl_custom_init for this fuzz case
* @param filename_new_queue File name of the new queue entry * @param filename_new_queue File name of the new queue entry
* @param filename_orig_queue File name of the original queue entry. This * @param filename_orig_queue File name of the original queue entry. This
* argument can be NULL while initializing the fuzzer * argument can be NULL while initializing the fuzzer
*/ */
void (*afl_custom_queue_new_entry)(afl_state_t *afl, void (*afl_custom_queue_new_entry)(void *data,
const u8 * filename_new_queue, const u8 * filename_new_queue,
const u8 * filename_orig_queue); const u8 * filename_orig_queue);
/**
* Deinitialize the custom mutator.
*
* @param data pointer returned in afl_custom_init for this fuzz case
*/
void (*afl_custom_deinit)(void *data);
}; };
@ -750,19 +774,17 @@ u8 trim_case_custom(afl_state_t *, struct queue_entry *q, u8 *in_buf);
/* Python */ /* Python */
#ifdef USE_PYTHON #ifdef USE_PYTHON
int init_py_module(afl_state_t *, u8 *); void finalize_py_module(void *);
void finalize_py_module(afl_state_t *);
void init_py(afl_state_t *, unsigned int); size_t pre_save_py(void *, u8 *, size_t, u8 **);
size_t fuzz_py(afl_state_t *, u8 **, size_t, u8 *, size_t, size_t); u32 init_trim_py(void *, u8 *, size_t);
size_t pre_save_py(afl_state_t *, u8 *, size_t, u8 **); u32 post_trim_py(void *, u8);
u32 init_trim_py(afl_state_t *, u8 *, size_t); void trim_py(void *, u8 **, size_t *);
u32 post_trim_py(afl_state_t *, u8); size_t havoc_mutation_py(void *, u8 **, size_t, size_t);
void trim_py(afl_state_t *, u8 **, size_t *); u8 havoc_mutation_probability_py(void *);
size_t havoc_mutation_py(afl_state_t *, u8 **, size_t, size_t); u8 queue_get_py(void *, const u8 *);
u8 havoc_mutation_probability_py(afl_state_t *); void queue_new_entry_py(void *, const u8 *, const u8 *);
u8 queue_get_py(afl_state_t *, const u8 *); void deinit_py(void *);
void queue_new_entry_py(afl_state_t *, const u8 *, const u8 *);
#endif #endif

160
include/common.h
View File

@ -78,7 +78,7 @@ static u64 get_cur_time_us(void) {
Will return buf for convenience. */ Will return buf for convenience. */
static u8 *stringify_int(u8 *buf, size_t len, u64 val) { static u8 *stringify_int(u8 *buf, size_t len, u64 val) {
\
#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \ #define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \
do { \ do { \
\ \
@ -233,5 +233,163 @@ static u8 *stringify_time_diff(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) {
} }
/* Unsafe Describe integer. The buf sizes are not checked.
This is unsafe but fast.
Will return buf for convenience. */
static u8 *u_stringify_int(u8 *buf, u64 val) {
#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \
do { \
\
if (val < (_divisor) * (_limit_mult)) { \
\
sprintf(buf, _fmt, ((_cast)val) / (_divisor)); \
return buf; \
\
} \
\
} while (0)
/* 0-9999 */
CHK_FORMAT(1, 10000, "%llu", u64);
/* 10.0k - 99.9k */
CHK_FORMAT(1000, 99.95, "%0.01fk", double);
/* 100k - 999k */
CHK_FORMAT(1000, 1000, "%lluk", u64);
/* 1.00M - 9.99M */
CHK_FORMAT(1000 * 1000, 9.995, "%0.02fM", double);
/* 10.0M - 99.9M */
CHK_FORMAT(1000 * 1000, 99.95, "%0.01fM", double);
/* 100M - 999M */
CHK_FORMAT(1000 * 1000, 1000, "%lluM", u64);
/* 1.00G - 9.99G */
CHK_FORMAT(1000LL * 1000 * 1000, 9.995, "%0.02fG", double);
/* 10.0G - 99.9G */
CHK_FORMAT(1000LL * 1000 * 1000, 99.95, "%0.01fG", double);
/* 100G - 999G */
CHK_FORMAT(1000LL * 1000 * 1000, 1000, "%lluG", u64);
/* 1.00T - 9.99G */
CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 9.995, "%0.02fT", double);
/* 10.0T - 99.9T */
CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 99.95, "%0.01fT", double);
/* 100T+ */
strcpy(buf, "infty");
return buf;
}
/* Unsafe describe float. Similar as unsafe int. */
static u8 *u_stringify_float(u8 *buf, double val) {
if (val < 99.995) {
sprintf(buf, "%0.02f", val);
} else if (val < 999.95) {
sprintf(buf, "%0.01f", val);
} else {
return u_stringify_int(buf, (u64)val);
}
return buf;
}
/* Unsafe describe integer as memory size. */
static u8 *u_stringify_mem_size(u8 *buf, u64 val) {
/* 0-9999 */
CHK_FORMAT(1, 10000, "%llu B", u64);
/* 10.0k - 99.9k */
CHK_FORMAT(1024, 99.95, "%0.01f kB", double);
/* 100k - 999k */
CHK_FORMAT(1024, 1000, "%llu kB", u64);
/* 1.00M - 9.99M */
CHK_FORMAT(1024 * 1024, 9.995, "%0.02f MB", double);
/* 10.0M - 99.9M */
CHK_FORMAT(1024 * 1024, 99.95, "%0.01f MB", double);
/* 100M - 999M */
CHK_FORMAT(1024 * 1024, 1000, "%llu MB", u64);
/* 1.00G - 9.99G */
CHK_FORMAT(1024LL * 1024 * 1024, 9.995, "%0.02f GB", double);
/* 10.0G - 99.9G */
CHK_FORMAT(1024LL * 1024 * 1024, 99.95, "%0.01f GB", double);
/* 100G - 999G */
CHK_FORMAT(1024LL * 1024 * 1024, 1000, "%llu GB", u64);
/* 1.00T - 9.99G */
CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 9.995, "%0.02f TB", double);
/* 10.0T - 99.9T */
CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 99.95, "%0.01f TB", double);
#undef CHK_FORMAT
/* 100T+ */
strcpy(buf, "infty");
return buf;
}
/* Unsafe describe time delta as string.
Returns a pointer to buf for convenience. */
static u8 *u_stringify_time_diff(u8 *buf, u64 cur_ms, u64 event_ms) {
u64 delta;
s32 t_d, t_h, t_m, t_s;
u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
if (!event_ms) {
sprintf(buf, "none seen yet");
} else {
delta = cur_ms - event_ms;
t_d = delta / 1000 / 60 / 60 / 24;
t_h = (delta / 1000 / 60 / 60) % 24;
t_m = (delta / 1000 / 60) % 60;
t_s = (delta / 1000) % 60;
u_stringify_int(val_buf, t_d);
sprintf(buf, "%s days, %d hrs, %d min, %d sec", val_buf, t_h, t_m, t_s);
}
return buf;
}
#endif #endif

83
src/afl-fuzz-mutators.c
View File

@ -27,7 +27,7 @@
void load_custom_mutator(afl_state_t *, const char *); void load_custom_mutator(afl_state_t *, const char *);
#ifdef USE_PYTHON #ifdef USE_PYTHON
void load_custom_mutator_py(afl_state_t *, const char *); void load_custom_mutator_py(afl_state_t *, char *);
#endif #endif
void setup_custom_mutator(afl_state_t *afl) { void setup_custom_mutator(afl_state_t *afl) {
@ -59,10 +59,7 @@ void setup_custom_mutator(afl_state_t *afl) {
FATAL( FATAL(
"MOpt and Python mutator are mutually exclusive. We accept pull " "MOpt and Python mutator are mutually exclusive. We accept pull "
"requests that integrates MOpt with the optional mutators " "requests that integrates MOpt with the optional mutators "
"(custom/radamsa/redquenn/...)."); "(custom/radamsa/redqueen/...).");
if (init_py_module(afl, module_name))
FATAL("Failed to initialize Python module");
load_custom_mutator_py(afl, module_name); load_custom_mutator_py(afl, module_name);
@ -79,18 +76,13 @@ void destroy_custom_mutator(afl_state_t *afl) {
if (afl->mutator) { if (afl->mutator) {
afl->mutator->afl_custom_deinit(afl->mutator->data);
if (afl->mutator->dh) if (afl->mutator->dh)
dlclose(afl->mutator->dh); dlclose(afl->mutator->dh);
else {
/* Python mutator */
#ifdef USE_PYTHON
finalize_py_module(afl);
#endif
}
ck_free(afl->mutator); ck_free(afl->mutator);
afl->mutator = NULL;
} }
@ -109,10 +101,13 @@ void load_custom_mutator(afl_state_t *afl, const char *fn) {
afl->mutator->dh = dh; afl->mutator->dh = dh;
/* Mutator */ /* Mutator */
/* "afl_custom_init", optional for backward compatibility */ /* "afl_custom_init", required */
afl->mutator->afl_custom_init = dlsym(dh, "afl_custom_init"); afl->mutator->afl_custom_init = dlsym(dh, "afl_custom_init");
if (!afl->mutator->afl_custom_init) if (!afl->mutator->afl_custom_init) FATAL("Symbol 'afl_custom_init' not found.");
WARNF("Symbol 'afl_custom_init' not found.");
/* "afl_custom_deinit", required */
afl->mutator->afl_custom_deinit = dlsym(dh, "afl_custom_deinit");
if (!afl->mutator->afl_custom_deinit) FATAL("Symbol 'afl_custom_deinit' not found.");
/* "afl_custom_fuzz" or "afl_custom_mutator", required */ /* "afl_custom_fuzz" or "afl_custom_mutator", required */
afl->mutator->afl_custom_fuzz = dlsym(dh, "afl_custom_fuzz"); afl->mutator->afl_custom_fuzz = dlsym(dh, "afl_custom_fuzz");
@ -203,7 +198,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
/* Initialize trimming in the custom mutator */ /* Initialize trimming in the custom mutator */
afl->stage_cur = 0; afl->stage_cur = 0;
afl->stage_max = afl->mutator->afl_custom_init_trim(afl, in_buf, q->len); afl->stage_max = afl->mutator->afl_custom_init_trim(afl->mutator->data, in_buf, q->len);
if (afl->not_on_tty && afl->debug) if (afl->not_on_tty && afl->debug)
SAYF("[Custom Trimming] START: Max %d iterations, %u bytes", afl->stage_max, SAYF("[Custom Trimming] START: Max %d iterations, %u bytes", afl->stage_max,
@ -211,8 +206,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
while (afl->stage_cur < afl->stage_max) { while (afl->stage_cur < afl->stage_max) {
snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "ptrim %s", sprintf(afl->stage_name_buf, "ptrim %s", u_stringify_int(val_buf, trim_exec));
stringify_int(val_buf, sizeof(val_buf), trim_exec));
u32 cksum; u32 cksum;
@ -310,54 +304,3 @@ abort_trimming:
return fault; return fault;
} }
#ifdef USE_PYTHON
void load_custom_mutator_py(afl_state_t *afl, const char *module_name) {
PyObject **py_functions = afl->py_functions;
afl->mutator = ck_alloc(sizeof(struct custom_mutator));
afl->mutator->name = module_name;
ACTF("Loading Python mutator library from '%s'...", module_name);
if (py_functions[PY_FUNC_INIT]) afl->mutator->afl_custom_init = init_py;
/* "afl_custom_fuzz" should not be NULL, but the interface of Python mutator
is quite different from the custom mutator. */
afl->mutator->afl_custom_fuzz = fuzz_py;
if (py_functions[PY_FUNC_PRE_SAVE])
afl->mutator->afl_custom_pre_save = pre_save_py;
if (py_functions[PY_FUNC_INIT_TRIM])
afl->mutator->afl_custom_init_trim = init_trim_py;
if (py_functions[PY_FUNC_POST_TRIM])
afl->mutator->afl_custom_post_trim = post_trim_py;
if (py_functions[PY_FUNC_TRIM]) afl->mutator->afl_custom_trim = trim_py;
if (py_functions[PY_FUNC_HAVOC_MUTATION])
afl->mutator->afl_custom_havoc_mutation = havoc_mutation_py;
if (py_functions[PY_FUNC_HAVOC_MUTATION_PROBABILITY])
afl->mutator->afl_custom_havoc_mutation_probability =
havoc_mutation_probability_py;
if (py_functions[PY_FUNC_QUEUE_GET])
afl->mutator->afl_custom_queue_get = queue_get_py;
if (py_functions[PY_FUNC_QUEUE_NEW_ENTRY])
afl->mutator->afl_custom_queue_new_entry = queue_new_entry_py;
OKF("Python mutator '%s' installed successfully.", module_name);
/* Initialize the custom mutator */
if (afl->mutator->afl_custom_init)
afl->mutator->afl_custom_init(afl, rand_below(afl, 0xFFFFFFFF));
}
#endif

258
src/afl-fuzz-python.c
View File

@ -28,9 +28,84 @@
/* Python stuff */ /* Python stuff */
#ifdef USE_PYTHON #ifdef USE_PYTHON
int init_py_module(afl_state_t *afl, u8 *module_name) { static void *unsupported(afl_state_t *afl, unsigned int seed) {
FATAL("Python Mutator cannot be called twice yet");
return NULL;
}
if (!module_name) return 1; size_t fuzz_py(void *py_mutator, u8 **buf, size_t buf_size, u8 *add_buf,
size_t add_buf_size, size_t max_size) {
size_t mutated_size;
PyObject *py_args, *py_value;
py_args = PyTuple_New(3);
/* buf */
py_value = PyByteArray_FromStringAndSize(*buf, buf_size);
if (!py_value) {
Py_DECREF(py_args);
FATAL("Failed to convert arguments");
}
PyTuple_SetItem(py_args, 0, py_value);
/* add_buf */
py_value = PyByteArray_FromStringAndSize(add_buf, add_buf_size);
if (!py_value) {
Py_DECREF(py_args);
FATAL("Failed to convert arguments");
}
PyTuple_SetItem(py_args, 1, py_value);
/* max_size */
#if PY_MAJOR_VERSION >= 3
py_value = PyLong_FromLong(max_size);
#else
py_value = PyInt_FromLong(max_size);
#endif
if (!py_value) {
Py_DECREF(py_args);
FATAL("Failed to convert arguments");
}
PyTuple_SetItem(py_args, 2, py_value);
py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_FUZZ], py_args);
Py_DECREF(py_args);
if (py_value != NULL) {
mutated_size = PyByteArray_Size(py_value);
if (buf_size < mutated_size) *buf = ck_realloc(*buf, mutated_size);
memcpy(*buf, PyByteArray_AsString(py_value), mutated_size);
Py_DECREF(py_value);
return mutated_size;
} else {
PyErr_Print();
FATAL("Call failed");
}
}
static py_mutator_t *init_py_module(afl_state_t *afl, u8 *module_name) {
if (!module_name) return NULL;
py_mutator_t *py = calloc(1, sizeof(py_mutator_t));
if (!py) PFATAL("Could not allocate memory for python mutator!");
Py_Initialize(); Py_Initialize();
@ -40,17 +115,18 @@ int init_py_module(afl_state_t *afl, u8 *module_name) {
PyObject *py_name = PyString_FromString(module_name); PyObject *py_name = PyString_FromString(module_name);
#endif #endif
afl->py_module = PyImport_Import(py_name); py->py_module = PyImport_Import(py_name);
Py_DECREF(py_name); Py_DECREF(py_name);
PyObject * py_module = afl->py_module; PyObject * py_module = py->py_module;
PyObject **py_functions = afl->py_functions; PyObject **py_functions = py->py_functions;
if (afl->py_module != NULL) { if (py_module != NULL) {
u8 py_notrim = 0, py_idx; u8 py_notrim = 0, py_idx;
py_functions[PY_FUNC_INIT] = PyObject_GetAttrString(afl->py_module, "init"); py_functions[PY_FUNC_INIT] = PyObject_GetAttrString(py_module, "init");
py_functions[PY_FUNC_FUZZ] = PyObject_GetAttrString(afl->py_module, "fuzz"); py_functions[PY_FUNC_DEINIT] = PyObject_GetAttrString(py_module, "deinit");
py_functions[PY_FUNC_FUZZ] = PyObject_GetAttrString(py_module, "fuzz");
py_functions[PY_FUNC_PRE_SAVE] = py_functions[PY_FUNC_PRE_SAVE] =
PyObject_GetAttrString(py_module, "pre_save"); PyObject_GetAttrString(py_module, "pre_save");
py_functions[PY_FUNC_INIT_TRIM] = py_functions[PY_FUNC_INIT_TRIM] =
@ -96,7 +172,7 @@ int init_py_module(afl_state_t *afl, u8 *module_name) {
"Cannot find/call function with index %d in external " "Cannot find/call function with index %d in external "
"Python module.\n", "Python module.\n",
py_idx); py_idx);
return 1; return NULL;
} }
@ -119,23 +195,27 @@ int init_py_module(afl_state_t *afl, u8 *module_name) {
PyErr_Print(); PyErr_Print();
fprintf(stderr, "Failed to load \"%s\"\n", module_name); fprintf(stderr, "Failed to load \"%s\"\n", module_name);
return 1; return NULL;
} }
return 0; return py;
} }
void finalize_py_module(afl_state_t *afl) { void finalize_py_module(void *py_mutator) {
if (afl->py_module != NULL) { py_mutator_t *py = (py_mutator_t *)py_mutator;
if (py->py_module != NULL) {
deinit_py(py_mutator);
u32 i; u32 i;
for (i = 0; i < PY_FUNC_COUNT; ++i) for (i = 0; i < PY_FUNC_COUNT; ++i)
Py_XDECREF(afl->py_functions[i]); Py_XDECREF(py->py_functions[i]);
Py_DECREF(afl->py_module); Py_DECREF(py->py_module);
} }
@ -143,7 +223,7 @@ void finalize_py_module(afl_state_t *afl) {
} }
void init_py(afl_state_t *afl, unsigned int seed) { static void init_py(afl_state_t *afl, py_mutator_t *py_mutator, unsigned int seed) {
PyObject *py_args, *py_value; PyObject *py_args, *py_value;
@ -158,14 +238,13 @@ void init_py(afl_state_t *afl, unsigned int seed) {
if (!py_value) { if (!py_value) {
Py_DECREF(py_args); Py_DECREF(py_args);
fprintf(stderr, "Cannot convert argument\n"); FATAL("Cannot convert argument in python init.");
return;
} }
PyTuple_SetItem(py_args, 0, py_value); PyTuple_SetItem(py_args, 0, py_value);
py_value = PyObject_CallObject(afl->py_functions[PY_FUNC_INIT], py_args); py_value = PyObject_CallObject(py_mutator->py_functions[PY_FUNC_INIT], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
@ -173,68 +252,24 @@ void init_py(afl_state_t *afl, unsigned int seed) {
PyErr_Print(); PyErr_Print();
fprintf(stderr, "Call failed\n"); fprintf(stderr, "Call failed\n");
return; FATAL("Custom py mutator INIT failed.");
} }
} }
size_t fuzz_py(afl_state_t *afl, u8 **buf, size_t buf_size, u8 *add_buf, void deinit_py(void *py_mutator) {
size_t add_buf_size, size_t max_size) {
size_t mutated_size;
PyObject *py_args, *py_value; PyObject *py_args, *py_value;
py_args = PyTuple_New(3);
/* buf */
py_value = PyByteArray_FromStringAndSize(*buf, buf_size);
if (!py_value) {
Py_DECREF(py_args);
FATAL("Failed to convert arguments");
}
PyTuple_SetItem(py_args, 0, py_value);
/* add_buf */
py_value = PyByteArray_FromStringAndSize(add_buf, add_buf_size);
if (!py_value) {
Py_DECREF(py_args);
FATAL("Failed to convert arguments");
}
PyTuple_SetItem(py_args, 1, py_value);
/* max_size */
#if PY_MAJOR_VERSION >= 3
py_value = PyLong_FromLong(max_size);
#else
py_value = PyInt_FromLong(max_size);
#endif
if (!py_value) {
Py_DECREF(py_args);
FATAL("Failed to convert arguments");
}
PyTuple_SetItem(py_args, 2, py_value);
py_value = PyObject_CallObject(afl->py_functions[PY_FUNC_FUZZ], py_args);
py_args = PyTuple_New(0);
py_value = PyObject_CallObject(
((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_DEINIT], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
if (py_value != NULL) { if (py_value != NULL) {
mutated_size = PyByteArray_Size(py_value);
if (buf_size < mutated_size) *buf = ck_realloc(*buf, mutated_size);
memcpy(*buf, PyByteArray_AsString(py_value), mutated_size);
Py_DECREF(py_value); Py_DECREF(py_value);
return mutated_size;
} else { } else {
@ -245,7 +280,62 @@ size_t fuzz_py(afl_state_t *afl, u8 **buf, size_t buf_size, u8 *add_buf,
} }
size_t pre_save_py(afl_state_t *afl, u8 *buf, size_t buf_size, u8 **out_buf) { void load_custom_mutator_py(afl_state_t *afl, char *module_name) {
afl->mutator = ck_alloc(sizeof(struct custom_mutator));
afl->mutator->name = module_name;
ACTF("Loading Python mutator library from '%s'...", module_name);
py_mutator_t *py_mutator;
py_mutator = init_py_module(afl, module_name);
if (!py_mutator) {
FATAL("Failed to load python mutator.");
}
PyObject **py_functions = py_mutator->py_functions;
if (py_functions[PY_FUNC_INIT]) afl->mutator->afl_custom_init = unsupported;
if (py_functions[PY_FUNC_DEINIT]) afl->mutator->afl_custom_deinit = deinit_py;
/* "afl_custom_fuzz" should not be NULL, but the interface of Python mutator
is quite different from the custom mutator. */
afl->mutator->afl_custom_fuzz = fuzz_py;
if (py_functions[PY_FUNC_PRE_SAVE])
afl->mutator->afl_custom_pre_save = pre_save_py;
if (py_functions[PY_FUNC_INIT_TRIM])
afl->mutator->afl_custom_init_trim = init_trim_py;
if (py_functions[PY_FUNC_POST_TRIM])
afl->mutator->afl_custom_post_trim = post_trim_py;
if (py_functions[PY_FUNC_TRIM]) afl->mutator->afl_custom_trim = trim_py;
if (py_functions[PY_FUNC_HAVOC_MUTATION])
afl->mutator->afl_custom_havoc_mutation = havoc_mutation_py;
if (py_functions[PY_FUNC_HAVOC_MUTATION_PROBABILITY])
afl->mutator->afl_custom_havoc_mutation_probability =
havoc_mutation_probability_py;
if (py_functions[PY_FUNC_QUEUE_GET])
afl->mutator->afl_custom_queue_get = queue_get_py;
if (py_functions[PY_FUNC_QUEUE_NEW_ENTRY])
afl->mutator->afl_custom_queue_new_entry = queue_new_entry_py;
OKF("Python mutator '%s' installed successfully.", module_name);
/* Initialize the custom mutator */
init_py(afl, py_mutator, rand_below(afl, 0xFFFFFFFF));
}
size_t pre_save_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) {
size_t out_buf_size; size_t out_buf_size;
PyObject *py_args, *py_value; PyObject *py_args, *py_value;
@ -260,7 +350,7 @@ size_t pre_save_py(afl_state_t *afl, u8 *buf, size_t buf_size, u8 **out_buf) {
PyTuple_SetItem(py_args, 0, py_value); PyTuple_SetItem(py_args, 0, py_value);
py_value = PyObject_CallObject(afl->py_functions[PY_FUNC_PRE_SAVE], py_args); py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_PRE_SAVE], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
@ -281,7 +371,7 @@ size_t pre_save_py(afl_state_t *afl, u8 *buf, size_t buf_size, u8 **out_buf) {
} }
u32 init_trim_py(afl_state_t *afl, u8 *buf, size_t buf_size) { u32 init_trim_py(void *py_mutator, u8 *buf, size_t buf_size) {
PyObject *py_args, *py_value; PyObject *py_args, *py_value;
@ -296,7 +386,7 @@ u32 init_trim_py(afl_state_t *afl, u8 *buf, size_t buf_size) {
PyTuple_SetItem(py_args, 0, py_value); PyTuple_SetItem(py_args, 0, py_value);
py_value = PyObject_CallObject(afl->py_functions[PY_FUNC_INIT_TRIM], py_args); py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_INIT_TRIM], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
if (py_value != NULL) { if (py_value != NULL) {
@ -318,7 +408,7 @@ u32 init_trim_py(afl_state_t *afl, u8 *buf, size_t buf_size) {
} }
u32 post_trim_py(afl_state_t *afl, u8 success) { u32 post_trim_py(void *py_mutator, u8 success) {
PyObject *py_args, *py_value; PyObject *py_args, *py_value;
@ -334,7 +424,7 @@ u32 post_trim_py(afl_state_t *afl, u8 success) {
PyTuple_SetItem(py_args, 0, py_value); PyTuple_SetItem(py_args, 0, py_value);
py_value = PyObject_CallObject(afl->py_functions[PY_FUNC_POST_TRIM], py_args); py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_POST_TRIM], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
if (py_value != NULL) { if (py_value != NULL) {
@ -356,12 +446,12 @@ u32 post_trim_py(afl_state_t *afl, u8 success) {
} }
void trim_py(afl_state_t *afl, u8 **out_buf, size_t *out_buf_size) { void trim_py(void *py_mutator, u8 **out_buf, size_t *out_buf_size) {
PyObject *py_args, *py_value; PyObject *py_args, *py_value;
py_args = PyTuple_New(0); py_args = PyTuple_New(0);
py_value = PyObject_CallObject(afl->py_functions[PY_FUNC_TRIM], py_args); py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_TRIM], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
if (py_value != NULL) { if (py_value != NULL) {
@ -380,7 +470,7 @@ void trim_py(afl_state_t *afl, u8 **out_buf, size_t *out_buf_size) {
} }
size_t havoc_mutation_py(afl_state_t *afl, u8 **buf, size_t buf_size, size_t havoc_mutation_py(void *py_mutator, u8 **buf, size_t buf_size,
size_t max_size) { size_t max_size) {
size_t mutated_size; size_t mutated_size;
@ -414,7 +504,7 @@ size_t havoc_mutation_py(afl_state_t *afl, u8 **buf, size_t buf_size,
PyTuple_SetItem(py_args, 1, py_value); PyTuple_SetItem(py_args, 1, py_value);
py_value = py_value =
PyObject_CallObject(afl->py_functions[PY_FUNC_HAVOC_MUTATION], py_args); PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_HAVOC_MUTATION], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
@ -437,13 +527,13 @@ size_t havoc_mutation_py(afl_state_t *afl, u8 **buf, size_t buf_size,
} }
u8 havoc_mutation_probability_py(afl_state_t *afl) { u8 havoc_mutation_probability_py(void *py_mutator) {
PyObject *py_args, *py_value; PyObject *py_args, *py_value;
py_args = PyTuple_New(0); py_args = PyTuple_New(0);
py_value = PyObject_CallObject( py_value = PyObject_CallObject(
afl->py_functions[PY_FUNC_HAVOC_MUTATION_PROBABILITY], py_args); ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_HAVOC_MUTATION_PROBABILITY], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
if (py_value != NULL) { if (py_value != NULL) {
@ -461,7 +551,7 @@ u8 havoc_mutation_probability_py(afl_state_t *afl) {
} }
u8 queue_get_py(afl_state_t *afl, const u8 *filename) { u8 queue_get_py(void *py_mutator, const u8 *filename) {
PyObject *py_args, *py_value; PyObject *py_args, *py_value;
@ -483,7 +573,7 @@ u8 queue_get_py(afl_state_t *afl, const u8 *filename) {
PyTuple_SetItem(py_args, 0, py_value); PyTuple_SetItem(py_args, 0, py_value);
// Call Python function // Call Python function
py_value = PyObject_CallObject(afl->py_functions[PY_FUNC_QUEUE_GET], py_args); py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_QUEUE_GET], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
if (py_value != NULL) { if (py_value != NULL) {
@ -509,7 +599,7 @@ u8 queue_get_py(afl_state_t *afl, const u8 *filename) {
} }
void queue_new_entry_py(afl_state_t *afl, const u8 *filename_new_queue, void queue_new_entry_py(void *py_mutator, const u8 *filename_new_queue,
const u8 *filename_orig_queue) { const u8 *filename_orig_queue) {
PyObject *py_args, *py_value; PyObject *py_args, *py_value;
@ -553,7 +643,7 @@ void queue_new_entry_py(afl_state_t *afl, const u8 *filename_new_queue,
// Call // Call
py_value = py_value =
PyObject_CallObject(afl->py_functions[PY_FUNC_QUEUE_NEW_ENTRY], py_args); PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_QUEUE_NEW_ENTRY], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
if (py_value == NULL) { if (py_value == NULL) {

6
src/afl-fuzz-run.c
View File

@ -626,9 +626,9 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
u32 remove_pos = remove_len; u32 remove_pos = remove_len;
snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "trim %s/%s", sprintf(afl->stage_name_buf, "trim %s/%s",
stringify_int(val_bufs[0], sizeof(val_bufs[0]), remove_len), u_stringify_int(val_bufs[0], remove_len),
stringify_int(val_bufs[1], sizeof(val_bufs[1]), remove_len)); u_stringify_int(val_bufs[1], remove_len));
afl->stage_cur = 0; afl->stage_cur = 0;
afl->stage_max = q->len / remove_len; afl->stage_max = q->len / remove_len;

203
src/afl-fuzz-stats.c
View File

@ -206,7 +206,7 @@ void show_stats(afl_state_t *afl) {
u8 time_tmp[64]; u8 time_tmp[64];
u8 val_buf[8][STRINGIFY_VAL_SIZE_MAX]; u8 val_buf[8][STRINGIFY_VAL_SIZE_MAX];
#define IB(i) val_buf[(i)], sizeof(val_buf[(i)]) #define IB(i) (val_buf[(i)])
cur_ms = get_cur_time(); cur_ms = get_cur_time();
@ -394,10 +394,10 @@ void show_stats(afl_state_t *afl) {
} }
stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, afl->start_time); u_stringify_time_diff(time_tmp, cur_ms, afl->start_time);
SAYF(bV bSTOP " run time : " cRST "%-33s " bSTG bV bSTOP SAYF(bV bSTOP " run time : " cRST "%-33s " bSTG bV bSTOP
" cycles done : %s%-5s " bSTG bV "\n", " cycles done : %s%-5s " bSTG bV "\n",
time_tmp, tmp, stringify_int(IB(0), afl->queue_cycle - 1)); time_tmp, tmp, u_stringify_int(IB(0), afl->queue_cycle - 1));
/* We want to warn people about not seeing new paths after a full cycle, /* We want to warn people about not seeing new paths after a full cycle,
except when resuming fuzzing or running in non-instrumented mode. */ except when resuming fuzzing or running in non-instrumented mode. */
@ -406,7 +406,7 @@ void show_stats(afl_state_t *afl) {
(afl->last_path_time || afl->resuming_fuzz || afl->queue_cycle == 1 || (afl->last_path_time || afl->resuming_fuzz || afl->queue_cycle == 1 ||
afl->in_bitmap || afl->crash_mode)) { afl->in_bitmap || afl->crash_mode)) {
stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, u_stringify_time_diff(time_tmp, cur_ms,
afl->last_path_time); afl->last_path_time);
SAYF(bV bSTOP " last new path : " cRST "%-33s ", time_tmp); SAYF(bV bSTOP " last new path : " cRST "%-33s ", time_tmp);
@ -425,23 +425,23 @@ void show_stats(afl_state_t *afl) {
} }
SAYF(bSTG bV bSTOP " total paths : " cRST "%-5s " bSTG bV "\n", SAYF(bSTG bV bSTOP " total paths : " cRST "%-5s " bSTG bV "\n",
stringify_int(IB(0), afl->queued_paths)); u_stringify_int(IB(0), afl->queued_paths));
/* Highlight crashes in red if found, denote going over the KEEP_UNIQUE_CRASH /* Highlight crashes in red if found, denote going over the KEEP_UNIQUE_CRASH
limit with a '+' appended to the count. */ limit with a '+' appended to the count. */
sprintf(tmp, "%s%s", stringify_int(IB(0), afl->unique_crashes), sprintf(tmp, "%s%s", u_stringify_int(IB(0), afl->unique_crashes),
(afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : ""); (afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : "");
stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, afl->last_crash_time); u_stringify_time_diff(time_tmp, cur_ms, afl->last_crash_time);
SAYF(bV bSTOP " last uniq crash : " cRST "%-33s " bSTG bV bSTOP SAYF(bV bSTOP " last uniq crash : " cRST "%-33s " bSTG bV bSTOP
" uniq crashes : %s%-6s" bSTG bV "\n", " uniq crashes : %s%-6s" bSTG bV "\n",
time_tmp, afl->unique_crashes ? cLRD : cRST, tmp); time_tmp, afl->unique_crashes ? cLRD : cRST, tmp);
sprintf(tmp, "%s%s", stringify_int(IB(0), afl->unique_hangs), sprintf(tmp, "%s%s", u_stringify_int(IB(0), afl->unique_hangs),
(afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : ""); (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, afl->last_hang_time); u_stringify_time_diff(time_tmp, cur_ms, afl->last_hang_time);
SAYF(bV bSTOP " last uniq hang : " cRST "%-33s " bSTG bV bSTOP SAYF(bV bSTOP " last uniq hang : " cRST "%-33s " bSTG bV bSTOP
" uniq hangs : " cRST "%-6s" bSTG bV "\n", " uniq hangs : " cRST "%-6s" bSTG bV "\n",
time_tmp, tmp); time_tmp, tmp);
@ -454,7 +454,7 @@ void show_stats(afl_state_t *afl) {
together, but then cram them into a fixed-width field - so we need to together, but then cram them into a fixed-width field - so we need to
put them in a temporary buffer first. */ put them in a temporary buffer first. */
sprintf(tmp, "%s%s%u (%0.01f%%)", stringify_int(IB(0), afl->current_entry), sprintf(tmp, "%s%s%u (%0.01f%%)", u_stringify_int(IB(0), afl->current_entry),
afl->queue_cur->favored ? "." : "*", afl->queue_cur->fuzz_level, afl->queue_cur->favored ? "." : "*", afl->queue_cur->fuzz_level,
((double)afl->current_entry * 100) / afl->queued_paths); ((double)afl->current_entry * 100) / afl->queued_paths);
@ -468,7 +468,7 @@ void show_stats(afl_state_t *afl) {
: ((t_bytes < 200 && !afl->dumb_mode) ? cPIN : cRST), : ((t_bytes < 200 && !afl->dumb_mode) ? cPIN : cRST),
tmp); tmp);
sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->cur_skipped_paths), sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->cur_skipped_paths),
((double)afl->cur_skipped_paths * 100) / afl->queued_paths); ((double)afl->cur_skipped_paths * 100) / afl->queued_paths);
SAYF(bV bSTOP " paths timed out : " cRST "%-16s " bSTG bV, tmp); SAYF(bV bSTOP " paths timed out : " cRST "%-16s " bSTG bV, tmp);
@ -481,7 +481,7 @@ void show_stats(afl_state_t *afl) {
" stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA
" findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->queued_favored), sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_favored),
((double)afl->queued_favored) * 100 / afl->queued_paths); ((double)afl->queued_favored) * 100 / afl->queued_paths);
/* Yeah... it's still going on... halp? */ /* Yeah... it's still going on... halp? */
@ -492,39 +492,39 @@ void show_stats(afl_state_t *afl) {
if (!afl->stage_max) { if (!afl->stage_max) {
sprintf(tmp, "%s/-", stringify_int(IB(0), afl->stage_cur)); sprintf(tmp, "%s/-", u_stringify_int(IB(0), afl->stage_cur));
} else { } else {
sprintf(tmp, "%s/%s (%0.02f%%)", stringify_int(IB(0), afl->stage_cur), sprintf(tmp, "%s/%s (%0.02f%%)", u_stringify_int(IB(0), afl->stage_cur),
stringify_int(IB(1), afl->stage_max), u_stringify_int(IB(1), afl->stage_max),
((double)afl->stage_cur) * 100 / afl->stage_max); ((double)afl->stage_cur) * 100 / afl->stage_max);
} }
SAYF(bV bSTOP " stage execs : " cRST "%-21s" bSTG bV bSTOP, tmp); SAYF(bV bSTOP " stage execs : " cRST "%-21s" bSTG bV bSTOP, tmp);
sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->queued_with_cov), sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_with_cov),
((double)afl->queued_with_cov) * 100 / afl->queued_paths); ((double)afl->queued_with_cov) * 100 / afl->queued_paths);
SAYF(" new edges on : " cRST "%-22s" bSTG bV "\n", tmp); SAYF(" new edges on : " cRST "%-22s" bSTG bV "\n", tmp);
sprintf(tmp, "%s (%s%s unique)", stringify_int(IB(0), afl->total_crashes), sprintf(tmp, "%s (%s%s unique)", u_stringify_int(IB(0), afl->total_crashes),
stringify_int(IB(1), afl->unique_crashes), u_stringify_int(IB(1), afl->unique_crashes),
(afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : ""); (afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : "");
if (afl->crash_mode) { if (afl->crash_mode) {
SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP
" new crashes : %s%-22s" bSTG bV "\n", " new crashes : %s%-22s" bSTG bV "\n",
stringify_int(IB(0), afl->total_execs), u_stringify_int(IB(0), afl->total_execs),
afl->unique_crashes ? cLRD : cRST, tmp); afl->unique_crashes ? cLRD : cRST, tmp);
} else { } else {
SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP
" total crashes : %s%-22s" bSTG bV "\n", " total crashes : %s%-22s" bSTG bV "\n",
stringify_int(IB(0), afl->total_execs), u_stringify_int(IB(0), afl->total_execs),
afl->unique_crashes ? cLRD : cRST, tmp); afl->unique_crashes ? cLRD : cRST, tmp);
} }
@ -533,23 +533,23 @@ void show_stats(afl_state_t *afl) {
if (afl->stats_avg_exec < 100) { if (afl->stats_avg_exec < 100) {
snprintf(tmp, sizeof(tmp), "%s/sec (%s)", sprintf(tmp, "%s/sec (%s)",
stringify_float(IB(0), afl->stats_avg_exec), u_stringify_float(IB(0), afl->stats_avg_exec),
afl->stats_avg_exec < 20 ? "zzzz..." : "slow!"); afl->stats_avg_exec < 20 ? "zzzz..." : "slow!");
SAYF(bV bSTOP " exec speed : " cLRD "%-20s ", tmp); SAYF(bV bSTOP " exec speed : " cLRD "%-20s ", tmp);
} else { } else {
snprintf(tmp, sizeof(tmp), "%s/sec", sprintf(tmp, "%s/sec",
stringify_float(IB(0), afl->stats_avg_exec)); u_stringify_float(IB(0), afl->stats_avg_exec));
SAYF(bV bSTOP " exec speed : " cRST "%-20s ", tmp); SAYF(bV bSTOP " exec speed : " cRST "%-20s ", tmp);
} }
snprintf(tmp, sizeof(tmp), "%s (%s%s unique)", sprintf(tmp, "%s (%s%s unique)",
stringify_int(IB(0), afl->total_tmouts), u_stringify_int(IB(0), afl->total_tmouts),
stringify_int(IB(1), afl->unique_tmouts), u_stringify_int(IB(1), afl->unique_tmouts),
(afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : ""); (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
SAYF(bSTG bV bSTOP " total tmouts : " cRST "%-22s" bSTG bV "\n", tmp); SAYF(bSTG bV bSTOP " total tmouts : " cRST "%-22s" bSTG bV "\n", tmp);
@ -562,85 +562,84 @@ void show_stats(afl_state_t *afl) {
if (afl->skip_deterministic) { if (afl->skip_deterministic) {
strncpy(tmp, "n/a, n/a, n/a", sizeof(tmp) - 1); strcpy(tmp, "n/a, n/a, n/a");
tmp[sizeof(tmp) - 1] = '\0';
} else { } else {
snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", sprintf(tmp, "%s/%s, %s/%s, %s/%s",
stringify_int(IB(0), afl->stage_finds[STAGE_FLIP1]), u_stringify_int(IB(0), afl->stage_finds[STAGE_FLIP1]),
stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP1]), u_stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP1]),
stringify_int(IB(2), afl->stage_finds[STAGE_FLIP2]), u_stringify_int(IB(2), afl->stage_finds[STAGE_FLIP2]),
stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP2]), u_stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP2]),
stringify_int(IB(3), afl->stage_finds[STAGE_FLIP4]), u_stringify_int(IB(3), afl->stage_finds[STAGE_FLIP4]),
stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP4])); u_stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP4]));
} }
SAYF(bV bSTOP " bit flips : " cRST "%-36s " bSTG bV bSTOP SAYF(bV bSTOP " bit flips : " cRST "%-36s " bSTG bV bSTOP
" levels : " cRST "%-10s" bSTG bV "\n", " levels : " cRST "%-10s" bSTG bV "\n",
tmp, stringify_int(IB(0), afl->max_depth)); tmp, u_stringify_int(IB(0), afl->max_depth));
if (!afl->skip_deterministic)
snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
stringify_int(IB(0), afl->stage_finds[STAGE_FLIP8]),
stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP8]),
stringify_int(IB(2), afl->stage_finds[STAGE_FLIP16]),
stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP16]),
stringify_int(IB(4), afl->stage_finds[STAGE_FLIP32]),
stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP32]));
SAYF(bV bSTOP " byte flips : " cRST "%-36s " bSTG bV bSTOP
" pending : " cRST "%-10s" bSTG bV "\n",
tmp, stringify_int(IB(0), afl->pending_not_fuzzed));
if (!afl->skip_deterministic)
snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
stringify_int(IB(0), afl->stage_finds[STAGE_ARITH8]),
stringify_int(IB(1), afl->stage_cycles[STAGE_ARITH8]),
stringify_int(IB(2), afl->stage_finds[STAGE_ARITH16]),
stringify_int(IB(3), afl->stage_cycles[STAGE_ARITH16]),
stringify_int(IB(4), afl->stage_finds[STAGE_ARITH32]),
stringify_int(IB(5), afl->stage_cycles[STAGE_ARITH32]));
SAYF(bV bSTOP " arithmetics : " cRST "%-36s " bSTG bV bSTOP
" pend fav : " cRST "%-10s" bSTG bV "\n",
tmp, stringify_int(IB(0), afl->pending_favored));
if (!afl->skip_deterministic) if (!afl->skip_deterministic)
sprintf(tmp, "%s/%s, %s/%s, %s/%s", sprintf(tmp, "%s/%s, %s/%s, %s/%s",
stringify_int(IB(0), afl->stage_finds[STAGE_INTEREST8]), u_stringify_int(IB(0), afl->stage_finds[STAGE_FLIP8]),
stringify_int(IB(1), afl->stage_cycles[STAGE_INTEREST8]), u_stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP8]),
stringify_int(IB(2), afl->stage_finds[STAGE_INTEREST16]), u_stringify_int(IB(2), afl->stage_finds[STAGE_FLIP16]),
stringify_int(IB(3), afl->stage_cycles[STAGE_INTEREST16]), u_stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP16]),
stringify_int(IB(4), afl->stage_finds[STAGE_INTEREST32]), u_stringify_int(IB(4), afl->stage_finds[STAGE_FLIP32]),
stringify_int(IB(5), afl->stage_cycles[STAGE_INTEREST32])); u_stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP32]));
SAYF(bV bSTOP " byte flips : " cRST "%-36s " bSTG bV bSTOP
" pending : " cRST "%-10s" bSTG bV "\n",
tmp, u_stringify_int(IB(0), afl->pending_not_fuzzed));
if (!afl->skip_deterministic)
sprintf(tmp, "%s/%s, %s/%s, %s/%s",
u_stringify_int(IB(0), afl->stage_finds[STAGE_ARITH8]),
u_stringify_int(IB(1), afl->stage_cycles[STAGE_ARITH8]),
u_stringify_int(IB(2), afl->stage_finds[STAGE_ARITH16]),
u_stringify_int(IB(3), afl->stage_cycles[STAGE_ARITH16]),
u_stringify_int(IB(4), afl->stage_finds[STAGE_ARITH32]),
u_stringify_int(IB(5), afl->stage_cycles[STAGE_ARITH32]));
SAYF(bV bSTOP " arithmetics : " cRST "%-36s " bSTG bV bSTOP
" pend fav : " cRST "%-10s" bSTG bV "\n",
tmp, u_stringify_int(IB(0), afl->pending_favored));
if (!afl->skip_deterministic)
sprintf(tmp, "%s/%s, %s/%s, %s/%s",
u_stringify_int(IB(0), afl->stage_finds[STAGE_INTEREST8]),
u_stringify_int(IB(1), afl->stage_cycles[STAGE_INTEREST8]),
u_stringify_int(IB(2), afl->stage_finds[STAGE_INTEREST16]),
u_stringify_int(IB(3), afl->stage_cycles[STAGE_INTEREST16]),
u_stringify_int(IB(4), afl->stage_finds[STAGE_INTEREST32]),
u_stringify_int(IB(5), afl->stage_cycles[STAGE_INTEREST32]));
SAYF(bV bSTOP " known ints : " cRST "%-36s " bSTG bV bSTOP SAYF(bV bSTOP " known ints : " cRST "%-36s " bSTG bV bSTOP
" own finds : " cRST "%-10s" bSTG bV "\n", " own finds : " cRST "%-10s" bSTG bV "\n",
tmp, stringify_int(IB(0), afl->queued_discovered)); tmp, u_stringify_int(IB(0), afl->queued_discovered));
if (!afl->skip_deterministic) if (!afl->skip_deterministic)
snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", sprintf(tmp, "%s/%s, %s/%s, %s/%s",
stringify_int(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]), u_stringify_int(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]),
stringify_int(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]), u_stringify_int(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]),
stringify_int(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]), u_stringify_int(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]),
stringify_int(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]), u_stringify_int(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]),
stringify_int(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]), u_stringify_int(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]),
stringify_int(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO])); u_stringify_int(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO]));
SAYF(bV bSTOP " dictionary : " cRST "%-36s " bSTG bV bSTOP SAYF(bV bSTOP " dictionary : " cRST "%-36s " bSTG bV bSTOP
" imported : " cRST "%-10s" bSTG bV "\n", " imported : " cRST "%-10s" bSTG bV "\n",
tmp, tmp,
afl->sync_id ? stringify_int(IB(0), afl->queued_imported) : (u8 *)"n/a"); afl->sync_id ? u_stringify_int(IB(0), afl->queued_imported) : (u8 *)"n/a");
snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", sprintf(tmp, "%s/%s, %s/%s, %s/%s",
stringify_int(IB(0), afl->stage_finds[STAGE_HAVOC]), u_stringify_int(IB(0), afl->stage_finds[STAGE_HAVOC]),
stringify_int(IB(2), afl->stage_cycles[STAGE_HAVOC]), u_stringify_int(IB(2), afl->stage_cycles[STAGE_HAVOC]),
stringify_int(IB(3), afl->stage_finds[STAGE_SPLICE]), u_stringify_int(IB(3), afl->stage_finds[STAGE_SPLICE]),
stringify_int(IB(4), afl->stage_cycles[STAGE_SPLICE]), u_stringify_int(IB(4), afl->stage_cycles[STAGE_SPLICE]),
stringify_int(IB(5), afl->stage_finds[STAGE_RADAMSA]), u_stringify_int(IB(5), afl->stage_finds[STAGE_RADAMSA]),
stringify_int(IB(6), afl->stage_cycles[STAGE_RADAMSA])); u_stringify_int(IB(6), afl->stage_cycles[STAGE_RADAMSA]));
SAYF(bV bSTOP " havoc/rad : " cRST "%-36s " bSTG bV bSTOP, tmp); SAYF(bV bSTOP " havoc/rad : " cRST "%-36s " bSTG bV bSTOP, tmp);
@ -660,26 +659,26 @@ void show_stats(afl_state_t *afl) {
if (afl->shm.cmplog_mode) { if (afl->shm.cmplog_mode) {
snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s, %s/%s", sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s",
stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]), u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]), u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]), u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]),
stringify_int(IB(4), afl->stage_finds[STAGE_COLORIZATION]), u_stringify_int(IB(4), afl->stage_finds[STAGE_COLORIZATION]),
stringify_int(IB(5), afl->stage_cycles[STAGE_COLORIZATION]), u_stringify_int(IB(5), afl->stage_cycles[STAGE_COLORIZATION]),
stringify_int(IB(6), afl->stage_finds[STAGE_ITS]), u_stringify_int(IB(6), afl->stage_finds[STAGE_ITS]),
stringify_int(IB(7), afl->stage_cycles[STAGE_ITS])); u_stringify_int(IB(7), afl->stage_cycles[STAGE_ITS]));
SAYF(bV bSTOP " custom/rq : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n", SAYF(bV bSTOP " custom/rq : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
tmp); tmp);
} else { } else {
snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s", sprintf(tmp, "%s/%s, %s/%s",
stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]), u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]), u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR])); u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
SAYF(bV bSTOP " py/custom : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n", SAYF(bV bSTOP " py/custom : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
tmp); tmp);
@ -695,7 +694,7 @@ void show_stats(afl_state_t *afl) {
sprintf(tmp, "%0.02f%%/%s, ", sprintf(tmp, "%0.02f%%/%s, ",
((double)(afl->bytes_trim_in - afl->bytes_trim_out)) * 100 / ((double)(afl->bytes_trim_in - afl->bytes_trim_out)) * 100 /
afl->bytes_trim_in, afl->bytes_trim_in,
stringify_int(IB(0), afl->trim_execs)); u_stringify_int(IB(0), afl->trim_execs));
} }
@ -721,8 +720,8 @@ void show_stats(afl_state_t *afl) {
if (afl->mutator) { if (afl->mutator) {
sprintf(tmp, "%s/%s", sprintf(tmp, "%s/%s",
stringify_int(IB(0), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), u_stringify_int(IB(0), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
stringify_int(IB(1), afl->stage_cycles[STAGE_CUSTOM_MUTATOR])); u_stringify_int(IB(1), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
SAYF(bV bSTOP " custom mut. : " cRST "%-36s " bSTG bV RESET_G1, tmp); SAYF(bV bSTOP " custom mut. : " cRST "%-36s " bSTG bV RESET_G1, tmp);
} else { } else {