ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-18 12:48:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fuzzbench integration

Browse Source
This commit is contained in:
van Hauser
2020-08-10 11:23:33 +02:00
parent 87da1e7af6
commit 3aa7d8081d
2 changed files with 30 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
examples/aflpp_driver/aflpp_driver.c
View File

@ -106,6 +106,10 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
#error "Support for your platform has not been implemented" #error "Support for your platform has not been implemented"
#endif #endif
int __afl_sharedmem_fuzzing = 0;
extern unsigned char *__afl_area_ptr;
// extern struct cmp_map *__afl_cmp_map;
// libFuzzer interface is thin, so we don't include any libFuzzer headers. // libFuzzer interface is thin, so we don't include any libFuzzer headers.
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size); int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
__attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv); __attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
@ -118,8 +122,6 @@ int __afl_persistent_loop(unsigned int);
static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##"; static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
void __afl_manual_init(); void __afl_manual_init();
extern unsigned int *__afl_area_ptr;
// Use this optionally defined function to output sanitizer messages even if // Use this optionally defined function to output sanitizer messages even if
// user asks to close stderr. // user asks to close stderr.
__attribute__((weak)) void __sanitizer_set_report_fd(void *); __attribute__((weak)) void __sanitizer_set_report_fd(void *);
@ -247,14 +249,24 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
__attribute__((constructor(1))) void __afl_protect(void) { __attribute__((constructor(1))) void __afl_protect(void) {
setenv("__AFL_DEFER_FORKSRV", "1", 1); setenv("__AFL_DEFER_FORKSRV", "1", 1);
__afl_area_ptr = (unsigned char *)mmap(
(void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
if ((uint64_t)__afl_area_ptr == -1)
__afl_area_ptr = (unsigned char *)mmap((void *)0x10000, MAX_DUMMY_SIZE,
PROT_READ | PROT_WRITE,
MAP_SHARED | MAP_ANONYMOUS, -1, 0);
if ((uint64_t)__afl_area_ptr == -1)
__afl_area_ptr =
(unsigned char *)mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
MAP_SHARED | MAP_ANONYMOUS, -1, 0);
// __afl_cmp_map = (struct cmp_map *)__afl_area_ptr;
} }
int main(int argc, char **argv) { int main(int argc, char **argv) {
unsigned char buf[1024000]; fprintf(stderr, "dummy map is at %p\n", __afl_area_ptr);
printf("__afl_area_ptr is at %p\n", __afl_area_ptr);
printf( printf(
"======================= INFO =========================\n" "======================= INFO =========================\n"
@ -282,6 +294,7 @@ int main(int argc, char **argv) {
// Do any other expensive one-time initialization here. // Do any other expensive one-time initialization here.
uint8_t dummy_input[64] = {0}; uint8_t dummy_input[64] = {0};
uint8_t buf[1024000];
memcpy(dummy_input, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT)); memcpy(dummy_input, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
memcpy(dummy_input + 32, (void *)AFL_DEFER_FORKSVR, memcpy(dummy_input + 32, (void *)AFL_DEFER_FORKSVR,
sizeof(AFL_DEFER_FORKSVR)); sizeof(AFL_DEFER_FORKSVR));
@ -292,6 +305,9 @@ int main(int argc, char **argv) {
printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N); printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
else if (argc > 1) { else if (argc > 1) {
__afl_sharedmem_fuzzing = 0;
munmap(__afl_area_ptr, MAX_DUMMY_SIZE); // we need to free 0x10000
__afl_area_ptr = NULL;
__afl_manual_init(); __afl_manual_init();
return ExecuteFilesOnyByOne(argc, argv); return ExecuteFilesOnyByOne(argc, argv);
@ -299,9 +315,12 @@ int main(int argc, char **argv) {
assert(N > 0); assert(N > 0);
// if (!getenv("AFL_DRIVER_DONT_DEFER")) if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
__afl_manual_init(); munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
fprintf(stderr, "__afl_area_ptr is now at %p\n", __afl_area_ptr); __afl_area_ptr = NULL;
__afl_manual_init();
}
fprintf(stderr, "dummy map is now at %p\n", __afl_area_ptr);
// Call LLVMFuzzerTestOneInput here so that coverage caused by initialization // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
// on the first execution of LLVMFuzzerTestOneInput is ignored. // on the first execution of LLVMFuzzerTestOneInput is ignored.
@ -310,11 +329,11 @@ int main(int argc, char **argv) {
int num_runs = 0; int num_runs = 0;
while (__afl_persistent_loop(N)) { while (__afl_persistent_loop(N)) {
ssize_t n = read(0, buf, sizeof(buf)); ssize_t r = read(0, buf, sizeof(buf));
if (n > 0) { if (r > 0) {
LLVMFuzzerTestOneInput(buf, n); LLVMFuzzerTestOneInput(buf, r);
} }

1
llvm_mode/afl-llvm-rt.o.c
View File

@ -838,7 +838,6 @@ void __afl_manual_init(void) {
fprintf(stderr, fprintf(stderr,
"DEBUG: disabled instrumenation because of " "DEBUG: disabled instrumenation because of "
"AFL_DISABLE_LLVM_INSTRUMENTATION\n"); "AFL_DISABLE_LLVM_INSTRUMENTATION\n");
__afl_area_ptr = __afl_area_initial;
} }