mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-14 11:08:06 +00:00
v3.13c release (#951)
* persistent replay env setup * implementation without testing * complete implemenation, still no test * fix * fixes * fixes * documentation for AFL_PERSISTENT_RECORD * afl-cmin: Allow @@ to be part of an arg The previous implementation of "@@ handling" in afl-cmin differed greatly from how it was handled in afl-fuzz and how the documentation presented it. It used to require that the @@ be its own argument separated by whitespace and could not be used in situations like "--file=@@". This change standardizes it to just look for @@ to be *in* an argument in the same manner that afl-cmin.bash does, so that it will have the expected and documented behavior. * triage_crashes.sh: Allow @@ to be part of an arg * triage_crashes.sh: Fix error reporting * afl-showmap: Allow @@ to be part of an arg The previous implementation of "@@ handling" in afl-showmap differed greatly from how it was handled in afl-fuzz and how the documentation presented it. It used to require that the @@ be its own argument separated by whitespace and could not be used in situations like "--file=@@". This change standardizes it to use detect_file_args() like everybody else does, so that it will have the expected and documented behavior. * afl-showmap: Unwind a change to keep it pre-C99 compatible * v3.13a init * ifdef for record * changelog info * AFL_PERSISTENT_RECORD not a default * Add support for FRIDA mode * support libraries for find_afl_binary * remove warnings * update dynamic list * update changelog * try to trigger github actions * try to trigger github actions * android: support host and target 32bit build * remove InsTrim * Fix support for afl-cmin and updated README * integrate frida_mode, code-format * update README * Update custom_mutators.md * fix compilation for llvm 3.8.0 * pass lib -ldl only on Linux platforms * typos * simpler argument processing * -m32 support for docker container * restructure havoc * add introspection * ensure one fuzzer sync per cycle, cycle introspection * remove unneeded var * add parallel builds * add parallel builds * Add network_proxy build targets to gitignore (#852) All other build targets in utils/ are ignored except for these due to the lack of file extension. * Fixes:6d2ac3e314("fix grammar download script") The git submodle entry point is "grammar_mutator" not "grammar-mutator" The build script fails without this * fix #if A == B always evalutes to true * try to avoid CI build failure by updating apt packages * fix k-ctx * Initialalize the autodict-ql Initialalize the autodict-ql add codeql scripts * update the codes, readme - add readme - add required qlpack.yml * update readme update readme * Update readme Update readme * Update readme Update readme * rename python file rename python file * update update * Add shell command Add shell command * update readme update readme * Add support for standalone leak-sanitizer, introducting the environment variable AFL_USE_LSAN. AFL_USE_LSAN introduces the macro __AFL_CHECK_LEAK() which will check for a memory leak when the macro is run. This is especially helpful when using __AFL_LOOP(). If __AFL_LEAK_CHECK() is not used when AFL_USE_LSAN=1 is set, the leak checker will run when the program exits. * Replace __AFL_CHECK_LEAK with __AFL_LEAK_CHECK to be more proper. Fix spelling mistakes. Correctly call LSAN_ERROR not MSAN_ERROR. * Some updates on readme Some updates on readme * Update readme Update readme * Updates update * finalize 1 commit final things * space space * remove things remove things * Add python scripts Add python scripts * Update python scripts Update python scripts * new commit - change strings new commit - change strings * update qlpack name update qlpack name * remove unessential things remove unessential things from scripts * remove dirs remove dirs * Update readme Update readme * Add note Add note * Add ` Add ` * change cur change current dir * Fix typos, Use symbolize=0 for LSAN, Remove syntactic sugar. * Remove check for exit_code on LSAN and replace it with check for symbolize=0. * Move definition of __AFL_LEAK_CHECK inside ifguards, use LSAN_OPTIONS=print_suppressions=0 * revert Heiko's commit * Fix Haiku references, no <sys/syscall.h> and missing defines for USEMMAP * cleanup * Add -lnetwork to dependencies for Haiku * fix conflict * Fix undeclared SYS_write on Haiku * Declare private api __kern_write for Haiku * better MacOs msg * Haiku: create directory for debug_server, if not present * add missing env * better understandable directory creation logic * android: disable sigaction inside debuggerd check https://github.com/google/AFL/blob/master/docs/INSTALL#L173 * fix forkserver timeout error msg * removed -lc++ linking for lto * fix afl_custom_queue_new_entry when syncing * update grammar-mutator, show better fuzzing strategy yields * Update ideas.md Hey, I noticed there was a spelling error in above documentation for GSOC '21. I have corrected it, you can have a look at it if you want. * display dictionary usage in havoc only mode * ui custom mutator only display * add AFL_EXIT_ON_SEED_ISSUES * afl-whatsup -d * fix alive count in afl-whatsup * update havoc * ui update * fix aflpp qemu hook * qemu driver new api * add readme * update readme * allow aflpp_qemu_driver_hook.o to fail * fix writing stat file on exit * remove duplicate plot file write * fix warnings * afl-whatsup -d fix * fix ui * update readme * qemuafl * fix compcovtest * fix compcovtest * fix compcovtest * cmplog -l3: disable trimming, forcing input2stage for all * autoformat with black * fix nits * Changes following code review * fix nits * update docs * review * Add newline Add newline * Update readme fix typo in readme * Add new line Add new line * fixes * fix compcovtest * fix compcovtest * code format for frida mode * reworked formatting in order to avoid gcc 8.3.0 warnings * add idea of thread-safe target feedback * fix-typo: "WIn32" -> "Win32" * fix custom trim for increasing data * drop support for llvm < 6.0 * Create FUNDING.yml * Update FUNDING.yml * disable QEMU static pie * Push to stable (#895) * sync (#886) * Create FUNDING.yml * Update FUNDING.yml * moved custom_mutator examples * unicorn speedtest makefile cleanup * fixed example location * fix qdbi * update util readme * Frida persistent (#880) * Added x64 support for persistent mode (function call only), in-memory teest cases and complog * Review changes, fix NeverZero and code to parse the .text section of the main executable. Excluded ranges TBC * Various minor fixes and finished support for AFL_INST_LIBS * Review changes Co-authored-by: Your Name <you@example.com> * nits * fix frida mode * Integer overflow/underflow fixes in libdislocator (#889) * libdislocator: fixing integer overflow in 'max_mem' variable and setting 'max_mem' type to 'size_t' * libdislocator: fixing potential integer underflow in 'total_mem' variable due to its different values in different threads * Bumped warnings up to the max and fixed remaining issues (#890) Co-authored-by: Your Name <you@example.com> * nits * frida mode - support non-pie * nits * nit * update grammar mutator * Fixes for aarch64, OSX and other minor issues (#891) Co-authored-by: Your Name <you@example.com> * nits * nits * fix PCGUARD, build aflpp_driver with fPIC * Added representative fuzzbench test and test for libxml (#893) * Added representative fuzzbench test and test for libxml * Added support for building FRIDA from source with FRIDA_SOURCE=1 Co-authored-by: Your Name <you@example.com> * nits * update changelog * typos * fixed potential double free in custom trim (#881) * error handling, freeing mem * frida: complog -> cmplog * fix statsd writing * let aflpp_qemu_driver_hook.so build fail gracefully * fix stdin trimming * Support for AFL_ENTRYPOINT (#898) Co-authored-by: Your Name <you@example.com> * remove the input file .cur_input at the end of the fuzzing, if AFL_TMPDIR is used * reverse push (#901) * Create FUNDING.yml * Update FUNDING.yml * disable QEMU static pie Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> * clarify that no modifications are required. * add new test for frida_mode (please review) * typos * fix persistent mode (64-bit) * set ARCH for linux intel 32-bit for frida-gum-devkit * prepare for 32-bit support (later) * not on qemu 3 anymore * unicorn mips fixes * instrumentation further move to C++11 (#900) * unicorn fixes * more unicorn fixes * Fix memory errors when trim causes testcase growth (#881) (#903) * Revert "fixed potential double free in custom trim (#881)" This reverts commite9d2f72382. * Revert "fix custom trim for increasing data" This reverts commit86a8ef168d. * Fix memory errors when trim causes testcase growth Modify trim_case_custom to avoid writing into in_buf because some custom mutators can cause the testcase to grow rather than shrink. Instead of modifying in_buf directly, we write the update out to the disk when trimming is complete, and then the caller is responsible for refreshing the in-memory buffer from the file. This is still a bit sketchy because it does need to modify q->len in order to notify the upper layers that something changed, and it could end up telling upper layer code that the q->len is *bigger* than the buffer (q->testcase_buf) that contains it, which is asking for trouble down the line somewhere... * Fix an unlikely situation Put back some `unlikely()` calls that were in thee9d2f72382commit that was reverted. * typo * Exit on time (#904) * Variable AFL_EXIT_ON_TIME description has been added. Variables AFL_EXIT_ON_TIME and afl_exit_on_time has been added. afl->exit_on_time variable initialization has been added. The asignment of a value to the afl->afl_env.afl_exit_on_time variable from environment variables has been added. Code to exit on timeout if new path not found has been added. * Type of afl_exit_on_time variable has been changed. Variable exit_on_time has been added to the afl_state_t structure. * Command `export AFL_EXIT_WHEN_DONE=1` has been added. * Millisecond to second conversion has been added. Call get_cur_time() has been added. * Revert to using the saved current time value. * Useless check has been removed. * fix new path to custom-mutators * ensure crashes/README.txt exists * fix * Changes to bump FRIDA version and to clone FRIDA repo in to build directory rather than use a submodule as the FRIDA build scripts don't like it (#906) Co-authored-by: Your Name <you@example.com> * Fix numeric overflow in cmplog implementation (#907) Co-authored-by: Your Name <you@example.com> * testcase fixes for unicorn * remove merge conflict artifacts * fix afl-plot * Changes to remove binaries from frida_mode (#913) Co-authored-by: Your Name <you@example.com> * Frida cmplog fail fast (#914) * Changes to remove binaries from frida_mode * Changes to make cmplog fail fast Co-authored-by: Your Name <you@example.com> * afl-plot: relative time * arch linux and mac os support for afl-system-config * typo * code-format * update documentation Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com> Co-authored-by: hexcoder- <heiko@hexco.de> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> * Push to stable (#927) * sync (#886) * Create FUNDING.yml * Update FUNDING.yml * moved custom_mutator examples * unicorn speedtest makefile cleanup * fixed example location * fix qdbi * update util readme * Frida persistent (#880) * Added x64 support for persistent mode (function call only), in-memory teest cases and complog * Review changes, fix NeverZero and code to parse the .text section of the main executable. Excluded ranges TBC * Various minor fixes and finished support for AFL_INST_LIBS * Review changes Co-authored-by: Your Name <you@example.com> * nits * fix frida mode * Integer overflow/underflow fixes in libdislocator (#889) * libdislocator: fixing integer overflow in 'max_mem' variable and setting 'max_mem' type to 'size_t' * libdislocator: fixing potential integer underflow in 'total_mem' variable due to its different values in different threads * Bumped warnings up to the max and fixed remaining issues (#890) Co-authored-by: Your Name <you@example.com> * nits * frida mode - support non-pie * nits * nit * update grammar mutator * Fixes for aarch64, OSX and other minor issues (#891) Co-authored-by: Your Name <you@example.com> * nits * nits * fix PCGUARD, build aflpp_driver with fPIC * Added representative fuzzbench test and test for libxml (#893) * Added representative fuzzbench test and test for libxml * Added support for building FRIDA from source with FRIDA_SOURCE=1 Co-authored-by: Your Name <you@example.com> * nits * update changelog * typos * fixed potential double free in custom trim (#881) * error handling, freeing mem * frida: complog -> cmplog * fix statsd writing * let aflpp_qemu_driver_hook.so build fail gracefully * fix stdin trimming * Support for AFL_ENTRYPOINT (#898) Co-authored-by: Your Name <you@example.com> * remove the input file .cur_input at the end of the fuzzing, if AFL_TMPDIR is used * reverse push (#901) * Create FUNDING.yml * Update FUNDING.yml * disable QEMU static pie Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> * clarify that no modifications are required. * add new test for frida_mode (please review) * typos * fix persistent mode (64-bit) * set ARCH for linux intel 32-bit for frida-gum-devkit * prepare for 32-bit support (later) * not on qemu 3 anymore * unicorn mips fixes * instrumentation further move to C++11 (#900) * unicorn fixes * more unicorn fixes * Fix memory errors when trim causes testcase growth (#881) (#903) * Revert "fixed potential double free in custom trim (#881)" This reverts commite9d2f72382. * Revert "fix custom trim for increasing data" This reverts commit86a8ef168d. * Fix memory errors when trim causes testcase growth Modify trim_case_custom to avoid writing into in_buf because some custom mutators can cause the testcase to grow rather than shrink. Instead of modifying in_buf directly, we write the update out to the disk when trimming is complete, and then the caller is responsible for refreshing the in-memory buffer from the file. This is still a bit sketchy because it does need to modify q->len in order to notify the upper layers that something changed, and it could end up telling upper layer code that the q->len is *bigger* than the buffer (q->testcase_buf) that contains it, which is asking for trouble down the line somewhere... * Fix an unlikely situation Put back some `unlikely()` calls that were in thee9d2f72382commit that was reverted. * typo * Exit on time (#904) * Variable AFL_EXIT_ON_TIME description has been added. Variables AFL_EXIT_ON_TIME and afl_exit_on_time has been added. afl->exit_on_time variable initialization has been added. The asignment of a value to the afl->afl_env.afl_exit_on_time variable from environment variables has been added. Code to exit on timeout if new path not found has been added. * Type of afl_exit_on_time variable has been changed. Variable exit_on_time has been added to the afl_state_t structure. * Command `export AFL_EXIT_WHEN_DONE=1` has been added. * Millisecond to second conversion has been added. Call get_cur_time() has been added. * Revert to using the saved current time value. * Useless check has been removed. * fix new path to custom-mutators * ensure crashes/README.txt exists * fix * Changes to bump FRIDA version and to clone FRIDA repo in to build directory rather than use a submodule as the FRIDA build scripts don't like it (#906) Co-authored-by: Your Name <you@example.com> * Fix numeric overflow in cmplog implementation (#907) Co-authored-by: Your Name <you@example.com> * testcase fixes for unicorn * remove merge conflict artifacts * fix afl-plot * Changes to remove binaries from frida_mode (#913) Co-authored-by: Your Name <you@example.com> * Frida cmplog fail fast (#914) * Changes to remove binaries from frida_mode * Changes to make cmplog fail fast Co-authored-by: Your Name <you@example.com> * afl-plot: relative time * arch linux and mac os support for afl-system-config * typo * code-format * update documentation * github workflow for qemu * OSX-specific improvements (#912) * Fix afl-cc to work correctly by default on OSX using xcode - CLANG_ENV_VAR must be set for afl-as to work - Use clang mode by default if no specific compiler selected * Add OSX-specific documentation for configuring shared memory * Fixes to memory operands for complog (#916) Co-authored-by: Your Name <you@example.com> * fix a few cur_time uses * added bounds check to pivot_inputs (fixes #921) * additional safety checks for restarts * restrict afl-showmap in_file size * fix seed crash disable * add warning for afl-showmap partial read * no core dumps * AFL_PRINT_FILENAMES added * more documentation for AFL_EXIT_ON_TIME * Flushing for AFL_PRINT_FILENAMES * FASAN Support (#918) * FASAN Support * Fix handling of Address Sanitizer DSO * Changes to identification of Address Sanitizer DSO Co-authored-by: Your Name <you@example.com> * Support for x86 (#920) Co-authored-by: Your Name <you@example.com> * Update frida_mode readme (#925) * libqasan: use syscalls for read and write * update readme * Minor integration tweaks (#926) Co-authored-by: Your Name <you@example.com> * merge * fix afl-fuzz.c frida preload * cleaned up AFL_PRINT_FILENAMES env Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com> Co-authored-by: hexcoder- <heiko@hexco.de> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> Co-authored-by: Dustin Spicuzza <dustin@virtualroadside.com> * push to stable (#931) * sync (#886) * Create FUNDING.yml * Update FUNDING.yml * moved custom_mutator examples * unicorn speedtest makefile cleanup * fixed example location * fix qdbi * update util readme * Frida persistent (#880) * Added x64 support for persistent mode (function call only), in-memory teest cases and complog * Review changes, fix NeverZero and code to parse the .text section of the main executable. Excluded ranges TBC * Various minor fixes and finished support for AFL_INST_LIBS * Review changes Co-authored-by: Your Name <you@example.com> * nits * fix frida mode * Integer overflow/underflow fixes in libdislocator (#889) * libdislocator: fixing integer overflow in 'max_mem' variable and setting 'max_mem' type to 'size_t' * libdislocator: fixing potential integer underflow in 'total_mem' variable due to its different values in different threads * Bumped warnings up to the max and fixed remaining issues (#890) Co-authored-by: Your Name <you@example.com> * nits * frida mode - support non-pie * nits * nit * update grammar mutator * Fixes for aarch64, OSX and other minor issues (#891) Co-authored-by: Your Name <you@example.com> * nits * nits * fix PCGUARD, build aflpp_driver with fPIC * Added representative fuzzbench test and test for libxml (#893) * Added representative fuzzbench test and test for libxml * Added support for building FRIDA from source with FRIDA_SOURCE=1 Co-authored-by: Your Name <you@example.com> * nits * update changelog * typos * fixed potential double free in custom trim (#881) * error handling, freeing mem * frida: complog -> cmplog * fix statsd writing * let aflpp_qemu_driver_hook.so build fail gracefully * fix stdin trimming * Support for AFL_ENTRYPOINT (#898) Co-authored-by: Your Name <you@example.com> * remove the input file .cur_input at the end of the fuzzing, if AFL_TMPDIR is used * reverse push (#901) * Create FUNDING.yml * Update FUNDING.yml * disable QEMU static pie Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> * clarify that no modifications are required. * add new test for frida_mode (please review) * typos * fix persistent mode (64-bit) * set ARCH for linux intel 32-bit for frida-gum-devkit * prepare for 32-bit support (later) * not on qemu 3 anymore * unicorn mips fixes * instrumentation further move to C++11 (#900) * unicorn fixes * more unicorn fixes * Fix memory errors when trim causes testcase growth (#881) (#903) * Revert "fixed potential double free in custom trim (#881)" This reverts commite9d2f72382. * Revert "fix custom trim for increasing data" This reverts commit86a8ef168d. * Fix memory errors when trim causes testcase growth Modify trim_case_custom to avoid writing into in_buf because some custom mutators can cause the testcase to grow rather than shrink. Instead of modifying in_buf directly, we write the update out to the disk when trimming is complete, and then the caller is responsible for refreshing the in-memory buffer from the file. This is still a bit sketchy because it does need to modify q->len in order to notify the upper layers that something changed, and it could end up telling upper layer code that the q->len is *bigger* than the buffer (q->testcase_buf) that contains it, which is asking for trouble down the line somewhere... * Fix an unlikely situation Put back some `unlikely()` calls that were in thee9d2f72382commit that was reverted. * typo * Exit on time (#904) * Variable AFL_EXIT_ON_TIME description has been added. Variables AFL_EXIT_ON_TIME and afl_exit_on_time has been added. afl->exit_on_time variable initialization has been added. The asignment of a value to the afl->afl_env.afl_exit_on_time variable from environment variables has been added. Code to exit on timeout if new path not found has been added. * Type of afl_exit_on_time variable has been changed. Variable exit_on_time has been added to the afl_state_t structure. * Command `export AFL_EXIT_WHEN_DONE=1` has been added. * Millisecond to second conversion has been added. Call get_cur_time() has been added. * Revert to using the saved current time value. * Useless check has been removed. * fix new path to custom-mutators * ensure crashes/README.txt exists * fix * Changes to bump FRIDA version and to clone FRIDA repo in to build directory rather than use a submodule as the FRIDA build scripts don't like it (#906) Co-authored-by: Your Name <you@example.com> * Fix numeric overflow in cmplog implementation (#907) Co-authored-by: Your Name <you@example.com> * testcase fixes for unicorn * remove merge conflict artifacts * fix afl-plot * Changes to remove binaries from frida_mode (#913) Co-authored-by: Your Name <you@example.com> * Frida cmplog fail fast (#914) * Changes to remove binaries from frida_mode * Changes to make cmplog fail fast Co-authored-by: Your Name <you@example.com> * afl-plot: relative time * arch linux and mac os support for afl-system-config * typo * code-format * update documentation * github workflow for qemu * OSX-specific improvements (#912) * Fix afl-cc to work correctly by default on OSX using xcode - CLANG_ENV_VAR must be set for afl-as to work - Use clang mode by default if no specific compiler selected * Add OSX-specific documentation for configuring shared memory * Fixes to memory operands for complog (#916) Co-authored-by: Your Name <you@example.com> * fix a few cur_time uses * added bounds check to pivot_inputs (fixes #921) * additional safety checks for restarts * restrict afl-showmap in_file size * fix seed crash disable * add warning for afl-showmap partial read * no core dumps * AFL_PRINT_FILENAMES added * more documentation for AFL_EXIT_ON_TIME * Flushing for AFL_PRINT_FILENAMES * FASAN Support (#918) * FASAN Support * Fix handling of Address Sanitizer DSO * Changes to identification of Address Sanitizer DSO Co-authored-by: Your Name <you@example.com> * Support for x86 (#920) Co-authored-by: Your Name <you@example.com> * Update frida_mode readme (#925) * libqasan: use syscalls for read and write * update readme * Minor integration tweaks (#926) Co-authored-by: Your Name <you@example.com> * merge * fix afl-fuzz.c frida preload * cleaned up AFL_PRINT_FILENAMES env * Changes to have persistent mode exit at the end of the loop (#928) Co-authored-by: Your Name <you@example.com> * fix llvm-dict2file Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com> Co-authored-by: hexcoder- <heiko@hexco.de> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> Co-authored-by: Dustin Spicuzza <dustin@virtualroadside.com> * Final push to stable (#936) * sync (#886) * Create FUNDING.yml * Update FUNDING.yml * moved custom_mutator examples * unicorn speedtest makefile cleanup * fixed example location * fix qdbi * update util readme * Frida persistent (#880) * Added x64 support for persistent mode (function call only), in-memory teest cases and complog * Review changes, fix NeverZero and code to parse the .text section of the main executable. Excluded ranges TBC * Various minor fixes and finished support for AFL_INST_LIBS * Review changes Co-authored-by: Your Name <you@example.com> * nits * fix frida mode * Integer overflow/underflow fixes in libdislocator (#889) * libdislocator: fixing integer overflow in 'max_mem' variable and setting 'max_mem' type to 'size_t' * libdislocator: fixing potential integer underflow in 'total_mem' variable due to its different values in different threads * Bumped warnings up to the max and fixed remaining issues (#890) Co-authored-by: Your Name <you@example.com> * nits * frida mode - support non-pie * nits * nit * update grammar mutator * Fixes for aarch64, OSX and other minor issues (#891) Co-authored-by: Your Name <you@example.com> * nits * nits * fix PCGUARD, build aflpp_driver with fPIC * Added representative fuzzbench test and test for libxml (#893) * Added representative fuzzbench test and test for libxml * Added support for building FRIDA from source with FRIDA_SOURCE=1 Co-authored-by: Your Name <you@example.com> * nits * update changelog * typos * fixed potential double free in custom trim (#881) * error handling, freeing mem * frida: complog -> cmplog * fix statsd writing * let aflpp_qemu_driver_hook.so build fail gracefully * fix stdin trimming * Support for AFL_ENTRYPOINT (#898) Co-authored-by: Your Name <you@example.com> * remove the input file .cur_input at the end of the fuzzing, if AFL_TMPDIR is used * reverse push (#901) * Create FUNDING.yml * Update FUNDING.yml * disable QEMU static pie Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> * clarify that no modifications are required. * add new test for frida_mode (please review) * typos * fix persistent mode (64-bit) * set ARCH for linux intel 32-bit for frida-gum-devkit * prepare for 32-bit support (later) * not on qemu 3 anymore * unicorn mips fixes * instrumentation further move to C++11 (#900) * unicorn fixes * more unicorn fixes * Fix memory errors when trim causes testcase growth (#881) (#903) * Revert "fixed potential double free in custom trim (#881)" This reverts commite9d2f72382. * Revert "fix custom trim for increasing data" This reverts commit86a8ef168d. * Fix memory errors when trim causes testcase growth Modify trim_case_custom to avoid writing into in_buf because some custom mutators can cause the testcase to grow rather than shrink. Instead of modifying in_buf directly, we write the update out to the disk when trimming is complete, and then the caller is responsible for refreshing the in-memory buffer from the file. This is still a bit sketchy because it does need to modify q->len in order to notify the upper layers that something changed, and it could end up telling upper layer code that the q->len is *bigger* than the buffer (q->testcase_buf) that contains it, which is asking for trouble down the line somewhere... * Fix an unlikely situation Put back some `unlikely()` calls that were in thee9d2f72382commit that was reverted. * typo * Exit on time (#904) * Variable AFL_EXIT_ON_TIME description has been added. Variables AFL_EXIT_ON_TIME and afl_exit_on_time has been added. afl->exit_on_time variable initialization has been added. The asignment of a value to the afl->afl_env.afl_exit_on_time variable from environment variables has been added. Code to exit on timeout if new path not found has been added. * Type of afl_exit_on_time variable has been changed. Variable exit_on_time has been added to the afl_state_t structure. * Command `export AFL_EXIT_WHEN_DONE=1` has been added. * Millisecond to second conversion has been added. Call get_cur_time() has been added. * Revert to using the saved current time value. * Useless check has been removed. * fix new path to custom-mutators * ensure crashes/README.txt exists * fix * Changes to bump FRIDA version and to clone FRIDA repo in to build directory rather than use a submodule as the FRIDA build scripts don't like it (#906) Co-authored-by: Your Name <you@example.com> * Fix numeric overflow in cmplog implementation (#907) Co-authored-by: Your Name <you@example.com> * testcase fixes for unicorn * remove merge conflict artifacts * fix afl-plot * Changes to remove binaries from frida_mode (#913) Co-authored-by: Your Name <you@example.com> * Frida cmplog fail fast (#914) * Changes to remove binaries from frida_mode * Changes to make cmplog fail fast Co-authored-by: Your Name <you@example.com> * afl-plot: relative time * arch linux and mac os support for afl-system-config * typo * code-format * update documentation * github workflow for qemu * OSX-specific improvements (#912) * Fix afl-cc to work correctly by default on OSX using xcode - CLANG_ENV_VAR must be set for afl-as to work - Use clang mode by default if no specific compiler selected * Add OSX-specific documentation for configuring shared memory * Fixes to memory operands for complog (#916) Co-authored-by: Your Name <you@example.com> * fix a few cur_time uses * added bounds check to pivot_inputs (fixes #921) * additional safety checks for restarts * restrict afl-showmap in_file size * fix seed crash disable * add warning for afl-showmap partial read * no core dumps * AFL_PRINT_FILENAMES added * more documentation for AFL_EXIT_ON_TIME * Flushing for AFL_PRINT_FILENAMES * FASAN Support (#918) * FASAN Support * Fix handling of Address Sanitizer DSO * Changes to identification of Address Sanitizer DSO Co-authored-by: Your Name <you@example.com> * Support for x86 (#920) Co-authored-by: Your Name <you@example.com> * Update frida_mode readme (#925) * libqasan: use syscalls for read and write * update readme * Minor integration tweaks (#926) Co-authored-by: Your Name <you@example.com> * merge * fix afl-fuzz.c frida preload * cleaned up AFL_PRINT_FILENAMES env * Changes to have persistent mode exit at the end of the loop (#928) Co-authored-by: Your Name <you@example.com> * fix llvm-dict2file * push to stable (#931) (#932) * sync (#886) * Create FUNDING.yml * Update FUNDING.yml * moved custom_mutator examples * unicorn speedtest makefile cleanup * fixed example location * fix qdbi * update util readme * Frida persistent (#880) * Added x64 support for persistent mode (function call only), in-memory teest cases and complog * Review changes, fix NeverZero and code to parse the .text section of the main executable. Excluded ranges TBC * Various minor fixes and finished support for AFL_INST_LIBS * Review changes Co-authored-by: Your Name <you@example.com> * nits * fix frida mode * Integer overflow/underflow fixes in libdislocator (#889) * libdislocator: fixing integer overflow in 'max_mem' variable and setting 'max_mem' type to 'size_t' * libdislocator: fixing potential integer underflow in 'total_mem' variable due to its different values in different threads * Bumped warnings up to the max and fixed remaining issues (#890) Co-authored-by: Your Name <you@example.com> * nits * frida mode - support non-pie * nits * nit * update grammar mutator * Fixes for aarch64, OSX and other minor issues (#891) Co-authored-by: Your Name <you@example.com> * nits * nits * fix PCGUARD, build aflpp_driver with fPIC * Added representative fuzzbench test and test for libxml (#893) * Added representative fuzzbench test and test for libxml * Added support for building FRIDA from source with FRIDA_SOURCE=1 Co-authored-by: Your Name <you@example.com> * nits * update changelog * typos * fixed potential double free in custom trim (#881) * error handling, freeing mem * frida: complog -> cmplog * fix statsd writing * let aflpp_qemu_driver_hook.so build fail gracefully * fix stdin trimming * Support for AFL_ENTRYPOINT (#898) Co-authored-by: Your Name <you@example.com> * remove the input file .cur_input at the end of the fuzzing, if AFL_TMPDIR is used * reverse push (#901) * Create FUNDING.yml * Update FUNDING.yml * disable QEMU static pie Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> * clarify that no modifications are required. * add new test for frida_mode (please review) * typos * fix persistent mode (64-bit) * set ARCH for linux intel 32-bit for frida-gum-devkit * prepare for 32-bit support (later) * not on qemu 3 anymore * unicorn mips fixes * instrumentation further move to C++11 (#900) * unicorn fixes * more unicorn fixes * Fix memory errors when trim causes testcase growth (#881) (#903) * Revert "fixed potential double free in custom trim (#881)" This reverts commite9d2f72382. * Revert "fix custom trim for increasing data" This reverts commit86a8ef168d. * Fix memory errors when trim causes testcase growth Modify trim_case_custom to avoid writing into in_buf because some custom mutators can cause the testcase to grow rather than shrink. Instead of modifying in_buf directly, we write the update out to the disk when trimming is complete, and then the caller is responsible for refreshing the in-memory buffer from the file. This is still a bit sketchy because it does need to modify q->len in order to notify the upper layers that something changed, and it could end up telling upper layer code that the q->len is *bigger* than the buffer (q->testcase_buf) that contains it, which is asking for trouble down the line somewhere... * Fix an unlikely situation Put back some `unlikely()` calls that were in thee9d2f72382commit that was reverted. * typo * Exit on time (#904) * Variable AFL_EXIT_ON_TIME description has been added. Variables AFL_EXIT_ON_TIME and afl_exit_on_time has been added. afl->exit_on_time variable initialization has been added. The asignment of a value to the afl->afl_env.afl_exit_on_time variable from environment variables has been added. Code to exit on timeout if new path not found has been added. * Type of afl_exit_on_time variable has been changed. Variable exit_on_time has been added to the afl_state_t structure. * Command `export AFL_EXIT_WHEN_DONE=1` has been added. * Millisecond to second conversion has been added. Call get_cur_time() has been added. * Revert to using the saved current time value. * Useless check has been removed. * fix new path to custom-mutators * ensure crashes/README.txt exists * fix * Changes to bump FRIDA version and to clone FRIDA repo in to build directory rather than use a submodule as the FRIDA build scripts don't like it (#906) Co-authored-by: Your Name <you@example.com> * Fix numeric overflow in cmplog implementation (#907) Co-authored-by: Your Name <you@example.com> * testcase fixes for unicorn * remove merge conflict artifacts * fix afl-plot * Changes to remove binaries from frida_mode (#913) Co-authored-by: Your Name <you@example.com> * Frida cmplog fail fast (#914) * Changes to remove binaries from frida_mode * Changes to make cmplog fail fast Co-authored-by: Your Name <you@example.com> * afl-plot: relative time * arch linux and mac os support for afl-system-config * typo * code-format * update documentation * github workflow for qemu * OSX-specific improvements (#912) * Fix afl-cc to work correctly by default on OSX using xcode - CLANG_ENV_VAR must be set for afl-as to work - Use clang mode by default if no specific compiler selected * Add OSX-specific documentation for configuring shared memory * Fixes to memory operands for complog (#916) Co-authored-by: Your Name <you@example.com> * fix a few cur_time uses * added bounds check to pivot_inputs (fixes #921) * additional safety checks for restarts * restrict afl-showmap in_file size * fix seed crash disable * add warning for afl-showmap partial read * no core dumps * AFL_PRINT_FILENAMES added * more documentation for AFL_EXIT_ON_TIME * Flushing for AFL_PRINT_FILENAMES * FASAN Support (#918) * FASAN Support * Fix handling of Address Sanitizer DSO * Changes to identification of Address Sanitizer DSO Co-authored-by: Your Name <you@example.com> * Support for x86 (#920) Co-authored-by: Your Name <you@example.com> * Update frida_mode readme (#925) * libqasan: use syscalls for read and write * update readme * Minor integration tweaks (#926) Co-authored-by: Your Name <you@example.com> * merge * fix afl-fuzz.c frida preload * cleaned up AFL_PRINT_FILENAMES env * Changes to have persistent mode exit at the end of the loop (#928) Co-authored-by: Your Name <you@example.com> * fix llvm-dict2file Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com> Co-authored-by: hexcoder- <heiko@hexco.de> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> Co-authored-by: Dustin Spicuzza <dustin@virtualroadside.com> Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com> Co-authored-by: hexcoder- <heiko@hexco.de> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> Co-authored-by: Dustin Spicuzza <dustin@virtualroadside.com> * improve error msg * Added documentation for wine LoadLibrary workaround (#933) * Fix cmake target compilation command example (#934) - Fix typo DCMAKE_C_COMPILERC -> DCMAKE_C_COMPILER. - Add `cd build` after `mkdir build`. * showmap passes queue items in alphabetical order * added tmp files to gitignore * lenient dict parsing, no map size enum for binary fuzzing * added info about showmap queue directions * update binary-only doc * turn off map size detection if skip_bin_check is set * Typo * update docs * update afl-system-config * Set kill signal before using it in afl-showmap (#935) * fix afl-cc help output * add libafl to binary-only doc Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com> Co-authored-by: hexcoder- <heiko@hexco.de> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> Co-authored-by: Dustin Spicuzza <dustin@virtualroadside.com> Co-authored-by: 0x4d5a-ctf <51098072+0x4d5a-ctf@users.noreply.github.com> Co-authored-by: Tommy Chiang <oToToT@users.noreply.github.com> Co-authored-by: buherator <buherator@silentsignal.hu> * final push to stable (really?) (#939) * sync (#886) * Create FUNDING.yml * Update FUNDING.yml * moved custom_mutator examples * unicorn speedtest makefile cleanup * fixed example location * fix qdbi * update util readme * Frida persistent (#880) * Added x64 support for persistent mode (function call only), in-memory teest cases and complog * Review changes, fix NeverZero and code to parse the .text section of the main executable. Excluded ranges TBC * Various minor fixes and finished support for AFL_INST_LIBS * Review changes Co-authored-by: Your Name <you@example.com> * nits * fix frida mode * Integer overflow/underflow fixes in libdislocator (#889) * libdislocator: fixing integer overflow in 'max_mem' variable and setting 'max_mem' type to 'size_t' * libdislocator: fixing potential integer underflow in 'total_mem' variable due to its different values in different threads * Bumped warnings up to the max and fixed remaining issues (#890) Co-authored-by: Your Name <you@example.com> * nits * frida mode - support non-pie * nits * nit * update grammar mutator * Fixes for aarch64, OSX and other minor issues (#891) Co-authored-by: Your Name <you@example.com> * nits * nits * fix PCGUARD, build aflpp_driver with fPIC * Added representative fuzzbench test and test for libxml (#893) * Added representative fuzzbench test and test for libxml * Added support for building FRIDA from source with FRIDA_SOURCE=1 Co-authored-by: Your Name <you@example.com> * nits * update changelog * typos * fixed potential double free in custom trim (#881) * error handling, freeing mem * frida: complog -> cmplog * fix statsd writing * let aflpp_qemu_driver_hook.so build fail gracefully * fix stdin trimming * Support for AFL_ENTRYPOINT (#898) Co-authored-by: Your Name <you@example.com> * remove the input file .cur_input at the end of the fuzzing, if AFL_TMPDIR is used * reverse push (#901) * Create FUNDING.yml * Update FUNDING.yml * disable QEMU static pie Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> * clarify that no modifications are required. * add new test for frida_mode (please review) * typos * fix persistent mode (64-bit) * set ARCH for linux intel 32-bit for frida-gum-devkit * prepare for 32-bit support (later) * not on qemu 3 anymore * unicorn mips fixes * instrumentation further move to C++11 (#900) * unicorn fixes * more unicorn fixes * Fix memory errors when trim causes testcase growth (#881) (#903) * Revert "fixed potential double free in custom trim (#881)" This reverts commite9d2f72382. * Revert "fix custom trim for increasing data" This reverts commit86a8ef168d. * Fix memory errors when trim causes testcase growth Modify trim_case_custom to avoid writing into in_buf because some custom mutators can cause the testcase to grow rather than shrink. Instead of modifying in_buf directly, we write the update out to the disk when trimming is complete, and then the caller is responsible for refreshing the in-memory buffer from the file. This is still a bit sketchy because it does need to modify q->len in order to notify the upper layers that something changed, and it could end up telling upper layer code that the q->len is *bigger* than the buffer (q->testcase_buf) that contains it, which is asking for trouble down the line somewhere... * Fix an unlikely situation Put back some `unlikely()` calls that were in thee9d2f72382commit that was reverted. * typo * Exit on time (#904) * Variable AFL_EXIT_ON_TIME description has been added. Variables AFL_EXIT_ON_TIME and afl_exit_on_time has been added. afl->exit_on_time variable initialization has been added. The asignment of a value to the afl->afl_env.afl_exit_on_time variable from environment variables has been added. Code to exit on timeout if new path not found has been added. * Type of afl_exit_on_time variable has been changed. Variable exit_on_time has been added to the afl_state_t structure. * Command `export AFL_EXIT_WHEN_DONE=1` has been added. * Millisecond to second conversion has been added. Call get_cur_time() has been added. * Revert to using the saved current time value. * Useless check has been removed. * fix new path to custom-mutators * ensure crashes/README.txt exists * fix * Changes to bump FRIDA version and to clone FRIDA repo in to build directory rather than use a submodule as the FRIDA build scripts don't like it (#906) Co-authored-by: Your Name <you@example.com> * Fix numeric overflow in cmplog implementation (#907) Co-authored-by: Your Name <you@example.com> * testcase fixes for unicorn * remove merge conflict artifacts * fix afl-plot * Changes to remove binaries from frida_mode (#913) Co-authored-by: Your Name <you@example.com> * Frida cmplog fail fast (#914) * Changes to remove binaries from frida_mode * Changes to make cmplog fail fast Co-authored-by: Your Name <you@example.com> * afl-plot: relative time * arch linux and mac os support for afl-system-config * typo * code-format * update documentation * github workflow for qemu * OSX-specific improvements (#912) * Fix afl-cc to work correctly by default on OSX using xcode - CLANG_ENV_VAR must be set for afl-as to work - Use clang mode by default if no specific compiler selected * Add OSX-specific documentation for configuring shared memory * Fixes to memory operands for complog (#916) Co-authored-by: Your Name <you@example.com> * fix a few cur_time uses * added bounds check to pivot_inputs (fixes #921) * additional safety checks for restarts * restrict afl-showmap in_file size * fix seed crash disable * add warning for afl-showmap partial read * no core dumps * AFL_PRINT_FILENAMES added * more documentation for AFL_EXIT_ON_TIME * Flushing for AFL_PRINT_FILENAMES * FASAN Support (#918) * FASAN Support * Fix handling of Address Sanitizer DSO * Changes to identification of Address Sanitizer DSO Co-authored-by: Your Name <you@example.com> * Support for x86 (#920) Co-authored-by: Your Name <you@example.com> * Update frida_mode readme (#925) * libqasan: use syscalls for read and write * update readme * Minor integration tweaks (#926) Co-authored-by: Your Name <you@example.com> * merge * fix afl-fuzz.c frida preload * cleaned up AFL_PRINT_FILENAMES env * Changes to have persistent mode exit at the end of the loop (#928) Co-authored-by: Your Name <you@example.com> * fix llvm-dict2file * push to stable (#931) (#932) * sync (#886) * Create FUNDING.yml * Update FUNDING.yml * moved custom_mutator examples * unicorn speedtest makefile cleanup * fixed example location * fix qdbi * update util readme * Frida persistent (#880) * Added x64 support for persistent mode (function call only), in-memory teest cases and complog * Review changes, fix NeverZero and code to parse the .text section of the main executable. Excluded ranges TBC * Various minor fixes and finished support for AFL_INST_LIBS * Review changes Co-authored-by: Your Name <you@example.com> * nits * fix frida mode * Integer overflow/underflow fixes in libdislocator (#889) * libdislocator: fixing integer overflow in 'max_mem' variable and setting 'max_mem' type to 'size_t' * libdislocator: fixing potential integer underflow in 'total_mem' variable due to its different values in different threads * Bumped warnings up to the max and fixed remaining issues (#890) Co-authored-by: Your Name <you@example.com> * nits * frida mode - support non-pie * nits * nit * update grammar mutator * Fixes for aarch64, OSX and other minor issues (#891) Co-authored-by: Your Name <you@example.com> * nits * nits * fix PCGUARD, build aflpp_driver with fPIC * Added representative fuzzbench test and test for libxml (#893) * Added representative fuzzbench test and test for libxml * Added support for building FRIDA from source with FRIDA_SOURCE=1 Co-authored-by: Your Name <you@example.com> * nits * update changelog * typos * fixed potential double free in custom trim (#881) * error handling, freeing mem * frida: complog -> cmplog * fix statsd writing * let aflpp_qemu_driver_hook.so build fail gracefully * fix stdin trimming * Support for AFL_ENTRYPOINT (#898) Co-authored-by: Your Name <you@example.com> * remove the input file .cur_input at the end of the fuzzing, if AFL_TMPDIR is used * reverse push (#901) * Create FUNDING.yml * Update FUNDING.yml * disable QEMU static pie Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> * clarify that no modifications are required. * add new test for frida_mode (please review) * typos * fix persistent mode (64-bit) * set ARCH for linux intel 32-bit for frida-gum-devkit * prepare for 32-bit support (later) * not on qemu 3 anymore * unicorn mips fixes * instrumentation further move to C++11 (#900) * unicorn fixes * more unicorn fixes * Fix memory errors when trim causes testcase growth (#881) (#903) * Revert "fixed potential double free in custom trim (#881)" This reverts commite9d2f72382. * Revert "fix custom trim for increasing data" This reverts commit86a8ef168d. * Fix memory errors when trim causes testcase growth Modify trim_case_custom to avoid writing into in_buf because some custom mutators can cause the testcase to grow rather than shrink. Instead of modifying in_buf directly, we write the update out to the disk when trimming is complete, and then the caller is responsible for refreshing the in-memory buffer from the file. This is still a bit sketchy because it does need to modify q->len in order to notify the upper layers that something changed, and it could end up telling upper layer code that the q->len is *bigger* than the buffer (q->testcase_buf) that contains it, which is asking for trouble down the line somewhere... * Fix an unlikely situation Put back some `unlikely()` calls that were in thee9d2f72382commit that was reverted. * typo * Exit on time (#904) * Variable AFL_EXIT_ON_TIME description has been added. Variables AFL_EXIT_ON_TIME and afl_exit_on_time has been added. afl->exit_on_time variable initialization has been added. The asignment of a value to the afl->afl_env.afl_exit_on_time variable from environment variables has been added. Code to exit on timeout if new path not found has been added. * Type of afl_exit_on_time variable has been changed. Variable exit_on_time has been added to the afl_state_t structure. * Command `export AFL_EXIT_WHEN_DONE=1` has been added. * Millisecond to second conversion has been added. Call get_cur_time() has been added. * Revert to using the saved current time value. * Useless check has been removed. * fix new path to custom-mutators * ensure crashes/README.txt exists * fix * Changes to bump FRIDA version and to clone FRIDA repo in to build directory rather than use a submodule as the FRIDA build scripts don't like it (#906) Co-authored-by: Your Name <you@example.com> * Fix numeric overflow in cmplog implementation (#907) Co-authored-by: Your Name <you@example.com> * testcase fixes for unicorn * remove merge conflict artifacts * fix afl-plot * Changes to remove binaries from frida_mode (#913) Co-authored-by: Your Name <you@example.com> * Frida cmplog fail fast (#914) * Changes to remove binaries from frida_mode * Changes to make cmplog fail fast Co-authored-by: Your Name <you@example.com> * afl-plot: relative time * arch linux and mac os support for afl-system-config * typo * code-format * update documentation * github workflow for qemu * OSX-specific improvements (#912) * Fix afl-cc to work correctly by default on OSX using xcode - CLANG_ENV_VAR must be set for afl-as to work - Use clang mode by default if no specific compiler selected * Add OSX-specific documentation for configuring shared memory * Fixes to memory operands for complog (#916) Co-authored-by: Your Name <you@example.com> * fix a few cur_time uses * added bounds check to pivot_inputs (fixes #921) * additional safety checks for restarts * restrict afl-showmap in_file size * fix seed crash disable * add warning for afl-showmap partial read * no core dumps * AFL_PRINT_FILENAMES added * more documentation for AFL_EXIT_ON_TIME * Flushing for AFL_PRINT_FILENAMES * FASAN Support (#918) * FASAN Support * Fix handling of Address Sanitizer DSO * Changes to identification of Address Sanitizer DSO Co-authored-by: Your Name <you@example.com> * Support for x86 (#920) Co-authored-by: Your Name <you@example.com> * Update frida_mode readme (#925) * libqasan: use syscalls for read and write * update readme * Minor integration tweaks (#926) Co-authored-by: Your Name <you@example.com> * merge * fix afl-fuzz.c frida preload * cleaned up AFL_PRINT_FILENAMES env * Changes to have persistent mode exit at the end of the loop (#928) Co-authored-by: Your Name <you@example.com> * fix llvm-dict2file Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com> Co-authored-by: hexcoder- <heiko@hexco.de> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> Co-authored-by: Dustin Spicuzza <dustin@virtualroadside.com> Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com> Co-authored-by: hexcoder- <heiko@hexco.de> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> Co-authored-by: Dustin Spicuzza <dustin@virtualroadside.com> * improve error msg * Added documentation for wine LoadLibrary workaround (#933) * Fix cmake target compilation command example (#934) - Fix typo DCMAKE_C_COMPILERC -> DCMAKE_C_COMPILER. - Add `cd build` after `mkdir build`. * showmap passes queue items in alphabetical order * added tmp files to gitignore * lenient dict parsing, no map size enum for binary fuzzing * added info about showmap queue directions * update binary-only doc * turn off map size detection if skip_bin_check is set * Typo * update docs * update afl-system-config * Set kill signal before using it in afl-showmap (#935) * fix afl-cc help output * add libafl to binary-only doc * update docs * less executions on variable paths * AFL_SKIP_CRASHES is obsolete since 3.0 * add AFL_TRY_AFFINITY * Typo * Typo * Typo/wording * tweaks * typos * fix afl-whatsup help output * fix afl-plot output * fix for MacOS * fix cmpcov doc for qemu * fix tmpfile removal * update dockerfile * Frida (#940) * Added re2 test * Added libpcap test * Fix validation of setting of ADDR_NO_RANDOMIZE * Added support for printing original and instrumented code Co-authored-by: Your Name <you@example.com> * Support for AFL_FRIDA_PERSISTENT_RET (#941) Co-authored-by: Your Name <you@example.com> * Changes to add missing exclusion of ranges (#943) Co-authored-by: Your Name <you@example.com> * add --afl-noopt to afl-cc * docs: fix link to README in QuickStartGuide (#946) * Support writing Stalker stats (#945) * Support writing Stalker stats * Fixed string handling in print functions Co-authored-by: Your Name <you@example.com> * afl-cmin help fix, aflpp_driver - + @@ support * fix for afl-showmap Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com> Co-authored-by: hexcoder- <heiko@hexco.de> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> Co-authored-by: Dustin Spicuzza <dustin@virtualroadside.com> Co-authored-by: 0x4d5a-ctf <51098072+0x4d5a-ctf@users.noreply.github.com> Co-authored-by: Tommy Chiang <oToToT@users.noreply.github.com> Co-authored-by: buherator <buherator@silentsignal.hu> Co-authored-by: Dag Heyman Kajevic <dag.heyman@gmail.com> * Dev (#949) * use atomic read-modify-write increment for LLVM CLASSIC * Change other LLVM modes to atomic increments * sync (#886) * Create FUNDING.yml * Update FUNDING.yml * moved custom_mutator examples * unicorn speedtest makefile cleanup * fixed example location * fix qdbi * update util readme * work in progress: not working correctly yet * Frida persistent (#880) * Added x64 support for persistent mode (function call only), in-memory teest cases and complog * Review changes, fix NeverZero and code to parse the .text section of the main executable. Excluded ranges TBC * Various minor fixes and finished support for AFL_INST_LIBS * Review changes Co-authored-by: Your Name <you@example.com> * nits * fix frida mode * Integer overflow/underflow fixes in libdislocator (#889) * libdislocator: fixing integer overflow in 'max_mem' variable and setting 'max_mem' type to 'size_t' * libdislocator: fixing potential integer underflow in 'total_mem' variable due to its different values in different threads * Bumped warnings up to the max and fixed remaining issues (#890) Co-authored-by: Your Name <you@example.com> * nits * frida mode - support non-pie * nits * nit * update grammar mutator * Fixes for aarch64, OSX and other minor issues (#891) Co-authored-by: Your Name <you@example.com> * nits * nits * fix PCGUARD, build aflpp_driver with fPIC * Added representative fuzzbench test and test for libxml (#893) * Added representative fuzzbench test and test for libxml * Added support for building FRIDA from source with FRIDA_SOURCE=1 Co-authored-by: Your Name <you@example.com> * nits * update changelog * typos * still not working * fixed potential double free in custom trim (#881) * error handling, freeing mem * frida: complog -> cmplog * fix statsd writing * let aflpp_qemu_driver_hook.so build fail gracefully * fix stdin trimming * Support for AFL_ENTRYPOINT (#898) Co-authored-by: Your Name <you@example.com> * remove the input file .cur_input at the end of the fuzzing, if AFL_TMPDIR is used * reverse push (#901) * Create FUNDING.yml * Update FUNDING.yml * disable QEMU static pie Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> * clarify that no modifications are required. * add new test for frida_mode (please review) * typos * fix persistent mode (64-bit) * set ARCH for linux intel 32-bit for frida-gum-devkit * prepare for 32-bit support (later) * not on qemu 3 anymore * unicorn mips fixes * instrumentation further move to C++11 (#900) * unicorn fixes * first working NeverZero implementation * more unicorn fixes * Fix memory errors when trim causes testcase growth (#881) (#903) * Revert "fixed potential double free in custom trim (#881)" This reverts commite9d2f72382. * Revert "fix custom trim for increasing data" This reverts commit86a8ef168d. * Fix memory errors when trim causes testcase growth Modify trim_case_custom to avoid writing into in_buf because some custom mutators can cause the testcase to grow rather than shrink. Instead of modifying in_buf directly, we write the update out to the disk when trimming is complete, and then the caller is responsible for refreshing the in-memory buffer from the file. This is still a bit sketchy because it does need to modify q->len in order to notify the upper layers that something changed, and it could end up telling upper layer code that the q->len is *bigger* than the buffer (q->testcase_buf) that contains it, which is asking for trouble down the line somewhere... * Fix an unlikely situation Put back some `unlikely()` calls that were in thee9d2f72382commit that was reverted. * add some comments * typo * Exit on time (#904) * Variable AFL_EXIT_ON_TIME description has been added. Variables AFL_EXIT_ON_TIME and afl_exit_on_time has been added. afl->exit_on_time variable initialization has been added. The asignment of a value to the afl->afl_env.afl_exit_on_time variable from environment variables has been added. Code to exit on timeout if new path not found has been added. * Type of afl_exit_on_time variable has been changed. Variable exit_on_time has been added to the afl_state_t structure. * Command `export AFL_EXIT_WHEN_DONE=1` has been added. * Millisecond to second conversion has been added. Call get_cur_time() has been added. * Revert to using the saved current time value. * Useless check has been removed. * fix new path to custom-mutators * ensure crashes/README.txt exists * fix * Changes to bump FRIDA version and to clone FRIDA repo in to build directory rather than use a submodule as the FRIDA build scripts don't like it (#906) Co-authored-by: Your Name <you@example.com> * Fix numeric overflow in cmplog implementation (#907) Co-authored-by: Your Name <you@example.com> * testcase fixes for unicorn * remove merge conflict artifacts * fix afl-plot * Changes to remove binaries from frida_mode (#913) Co-authored-by: Your Name <you@example.com> * Frida cmplog fail fast (#914) * Changes to remove binaries from frida_mode * Changes to make cmplog fail fast Co-authored-by: Your Name <you@example.com> * afl-plot: relative time * arch linux and mac os support for afl-system-config * typo * code-format * update documentation * github workflow for qemu * OSX-specific improvements (#912) * Fix afl-cc to work correctly by default on OSX using xcode - CLANG_ENV_VAR must be set for afl-as to work - Use clang mode by default if no specific compiler selected * Add OSX-specific documentation for configuring shared memory * Fixes to memory operands for complog (#916) Co-authored-by: Your Name <you@example.com> * fix a few cur_time uses * added bounds check to pivot_inputs (fixes #921) * additional safety checks for restarts * restrict afl-showmap in_file size * fix seed crash disable * add warning for afl-showmap partial read * no core dumps * AFL_PRINT_FILENAMES added * more documentation for AFL_EXIT_ON_TIME * Flushing for AFL_PRINT_FILENAMES * FASAN Support (#918) * FASAN Support * Fix handling of Address Sanitizer DSO * Changes to identification of Address Sanitizer DSO Co-authored-by: Your Name <you@example.com> * Support for x86 (#920) Co-authored-by: Your Name <you@example.com> * Update frida_mode readme (#925) * libqasan: use syscalls for read and write * update readme * Minor integration tweaks (#926) Co-authored-by: Your Name <you@example.com> * merge * fix afl-fuzz.c frida preload * cleaned up AFL_PRINT_FILENAMES env * Changes to have persistent mode exit at the end of the loop (#928) Co-authored-by: Your Name <you@example.com> * fix llvm-dict2file * push to stable (#931) (#932) * sync (#886) * Create FUNDING.yml * Update FUNDING.yml * moved custom_mutator examples * unicorn speedtest makefile cleanup * fixed example location * fix qdbi * update util readme * Frida persistent (#880) * Added x64 support for persistent mode (function call only), in-memory teest cases and complog * Review changes, fix NeverZero and code to parse the .text section of the main executable. Excluded ranges TBC * Various minor fixes and finished support for AFL_INST_LIBS * Review changes Co-authored-by: Your Name <you@example.com> * nits * fix frida mode * Integer overflow/underflow fixes in libdislocator (#889) * libdislocator: fixing integer overflow in 'max_mem' variable and setting 'max_mem' type to 'size_t' * libdislocator: fixing potential integer underflow in 'total_mem' variable due to its different values in different threads * Bumped warnings up to the max and fixed remaining issues (#890) Co-authored-by: Your Name <you@example.com> * nits * frida mode - support non-pie * nits * nit * update grammar mutator * Fixes for aarch64, OSX and other minor issues (#891) Co-authored-by: Your Name <you@example.com> * nits * nits * fix PCGUARD, build aflpp_driver with fPIC * Added representative fuzzbench test and test for libxml (#893) * Added representative fuzzbench test and test for libxml * Added support for building FRIDA from source with FRIDA_SOURCE=1 Co-authored-by: Your Name <you@example.com> * nits * update changelog * typos * fixed potential double free in custom trim (#881) * error handling, freeing mem * frida: complog -> cmplog * fix statsd writing * let aflpp_qemu_driver_hook.so build fail gracefully * fix stdin trimming * Support for AFL_ENTRYPOINT (#898) Co-authored-by: Your Name <you@example.com> * remove the input file .cur_input at the end of the fuzzing, if AFL_TMPDIR is used * reverse push (#901) * Create FUNDING.yml * Update FUNDING.yml * disable QEMU static pie Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> * clarify that no modifications are required. * add new test for frida_mode (please review) * typos * fix persistent mode (64-bit) * set ARCH for linux intel 32-bit for frida-gum-devkit * prepare for 32-bit support (later) * not on qemu 3 anymore * unicorn mips fixes * instrumentation further move to C++11 (#900) * unicorn fixes * more unicorn fixes * Fix memory errors when trim causes testcase growth (#881) (#903) * Revert "fixed potential double free in custom trim (#881)" This reverts commite9d2f72382. * Revert "fix custom trim for increasing data" This reverts commit86a8ef168d. * Fix memory errors when trim causes testcase growth Modify trim_case_custom to avoid writing into in_buf because some custom mutators can cause the testcase to grow rather than shrink. Instead of modifying in_buf directly, we write the update out to the disk when trimming is complete, and then the caller is responsible for refreshing the in-memory buffer from the file. This is still a bit sketchy because it does need to modify q->len in order to notify the upper layers that something changed, and it could end up telling upper layer code that the q->len is *bigger* than the buffer (q->testcase_buf) that contains it, which is asking for trouble down the line somewhere... * Fix an unlikely situation Put back some `unlikely()` calls that were in thee9d2f72382commit that was reverted. * typo * Exit on time (#904) * Variable AFL_EXIT_ON_TIME description has been added. Variables AFL_EXIT_ON_TIME and afl_exit_on_time has been added. afl->exit_on_time variable initialization has been added. The asignment of a value to the afl->afl_env.afl_exit_on_time variable from environment variables has been added. Code to exit on timeout if new path not found has been added. * Type of afl_exit_on_time variable has been changed. Variable exit_on_time has been added to the afl_state_t structure. * Command `export AFL_EXIT_WHEN_DONE=1` has been added. * Millisecond to second conversion has been added. Call get_cur_time() has been added. * Revert to using the saved current time value. * Useless check has been removed. * fix new path to custom-mutators * ensure crashes/README.txt exists * fix * Changes to bump FRIDA version and to clone FRIDA repo in to build directory rather than use a submodule as the FRIDA build scripts don't like it (#906) Co-authored-by: Your Name <you@example.com> * Fix numeric overflow in cmplog implementation (#907) Co-authored-by: Your Name <you@example.com> * testcase fixes for unicorn * remove merge conflict artifacts * fix afl-plot * Changes to remove binaries from frida_mode (#913) Co-authored-by: Your Name <you@example.com> * Frida cmplog fail fast (#914) * Changes to remove binaries from frida_mode * Changes to make cmplog fail fast Co-authored-by: Your Name <you@example.com> * afl-plot: relative time * arch linux and mac os support for afl-system-config * typo * code-format * update documentation * github workflow for qemu * OSX-specific improvements (#912) * Fix afl-cc to work correctly by default on OSX using xcode - CLANG_ENV_VAR must be set for afl-as to work - Use clang mode by default if no specific compiler selected * Add OSX-specific documentation for configuring shared memory * Fixes to memory operands for complog (#916) Co-authored-by: Your Name <you@example.com> * fix a few cur_time uses * added bounds check to pivot_inputs (fixes #921) * additional safety checks for restarts * restrict afl-showmap in_file size * fix seed crash disable * add warning for afl-showmap partial read * no core dumps * AFL_PRINT_FILENAMES added * more documentation for AFL_EXIT_ON_TIME * Flushing for AFL_PRINT_FILENAMES * FASAN Support (#918) * FASAN Support * Fix handling of Address Sanitizer DSO * Changes to identification of Address Sanitizer DSO Co-authored-by: Your Name <you@example.com> * Support for x86 (#920) Co-authored-by: Your Name <you@example.com> * Update frida_mode readme (#925) * libqasan: use syscalls for read and write * update readme * Minor integration tweaks (#926) Co-authored-by: Your Name <you@example.com> * merge * fix afl-fuzz.c frida preload * cleaned up AFL_PRINT_FILENAMES env * Changes to have persistent mode exit at the end of the loop (#928) Co-authored-by: Your Name <you@example.com> * fix llvm-dict2file Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com> Co-authored-by: hexcoder- <heiko@hexco.de> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> Co-authored-by: Dustin Spicuzza <dustin@virtualroadside.com> Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com> Co-authored-by: hexcoder- <heiko@hexco.de> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> Co-authored-by: Dustin Spicuzza <dustin@virtualroadside.com> * improve error msg * Added documentation for wine LoadLibrary workaround (#933) * Fix cmake target compilation command example (#934) - Fix typo DCMAKE_C_COMPILERC -> DCMAKE_C_COMPILER. - Add `cd build` after `mkdir build`. * showmap passes queue items in alphabetical order * added tmp files to gitignore * lenient dict parsing, no map size enum for binary fuzzing * added info about showmap queue directions * update binary-only doc * turn off map size detection if skip_bin_check is set * Typo * update docs * update afl-system-config * Set kill signal before using it in afl-showmap (#935) * fix afl-cc help output * add libafl to binary-only doc * update docs * less executions on variable paths * AFL_SKIP_CRASHES is obsolete since 3.0 * add AFL_TRY_AFFINITY * Typo * Typo * Typo/wording * tweaks * typos * fix afl-whatsup help output * fix afl-plot output * fix for MacOS * fix cmpcov doc for qemu * fix tmpfile removal * update dockerfile * Frida (#940) * Added re2 test * Added libpcap test * Fix validation of setting of ADDR_NO_RANDOMIZE * Added support for printing original and instrumented code Co-authored-by: Your Name <you@example.com> * Support for AFL_FRIDA_PERSISTENT_RET (#941) Co-authored-by: Your Name <you@example.com> * Changes to add missing exclusion of ranges (#943) Co-authored-by: Your Name <you@example.com> * add --afl-noopt to afl-cc * docs: fix link to README in QuickStartGuide (#946) * Support writing Stalker stats (#945) * Support writing Stalker stats * Fixed string handling in print functions Co-authored-by: Your Name <you@example.com> * afl-cmin help fix, aflpp_driver - + @@ support * fix for afl-showmap * support new env var AFL_LLVM_THREADSAFE_INST to enable atomic counters. add new test case for that. * add documentation for AFL_LLVM_THREADSAFE_INST * add support for AFL_LLVM_THREADSAFE_INST to other LLVM passes * add missing include for _exit() * threadsafe doc fixes, code format * Wording: "never zero" -> NeverZero * fix afl_custom_post_process with multiple custom mutators * fix docs * debug ck_write * fixed potential diff by 0 * fixes * fix classic threadsafe counters Co-authored-by: van Hauser <vh@thc.org> Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> Co-authored-by: Dustin Spicuzza <dustin@virtualroadside.com> Co-authored-by: 0x4d5a-ctf <51098072+0x4d5a-ctf@users.noreply.github.com> Co-authored-by: Tommy Chiang <oToToT@users.noreply.github.com> Co-authored-by: buherator <buherator@silentsignal.hu> Co-authored-by: Dag Heyman Kajevic <dag.heyman@gmail.com> * v3.13c release (#950) * use atomic read-modify-write increment for LLVM CLASSIC * Change other LLVM modes to atomic increments * sync (#886) * Create FUNDING.yml * Update FUNDING.yml * moved custom_mutator examples * unicorn speedtest makefile cleanup * fixed example location * fix qdbi * update util readme * work in progress: not working correctly yet * Frida persistent (#880) * Added x64 support for persistent mode (function call only), in-memory teest cases and complog * Review changes, fix NeverZero and code to parse the .text section of the main executable. Excluded ranges TBC * Various minor fixes and finished support for AFL_INST_LIBS * Review changes Co-authored-by: Your Name <you@example.com> * nits * fix frida mode * Integer overflow/underflow fixes in libdislocator (#889) * libdislocator: fixing integer overflow in 'max_mem' variable and setting 'max_mem' type to 'size_t' * libdislocator: fixing potential integer underflow in 'total_mem' variable due to its different values in different threads * Bumped warnings up to the max and fixed remaining issues (#890) Co-authored-by: Your Name <you@example.com> * nits * frida mode - support non-pie * nits * nit * update grammar mutator * Fixes for aarch64, OSX and other minor issues (#891) Co-authored-by: Your Name <you@example.com> * nits * nits * fix PCGUARD, build aflpp_driver with fPIC * Added representative fuzzbench test and test for libxml (#893) * Added representative fuzzbench test and test for libxml * Added support for building FRIDA from source with FRIDA_SOURCE=1 Co-authored-by: Your Name <you@example.com> * nits * update changelog * typos * still not working * fixed potential double free in custom trim (#881) * error handling, freeing mem * frida: complog -> cmplog * fix statsd writing * let aflpp_qemu_driver_hook.so build fail gracefully * fix stdin trimming * Support for AFL_ENTRYPOINT (#898) Co-authored-by: Your Name <you@example.com> * remove the input file .cur_input at the end of the fuzzing, if AFL_TMPDIR is used * reverse push (#901) * Create FUNDING.yml * Update FUNDING.yml * disable QEMU static pie Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> * clarify that no modifications are required. * add new test for frida_mode (please review) * typos * fix persistent mode (64-bit) * set ARCH for linux intel 32-bit for frida-gum-devkit * prepare for 32-bit support (later) * not on qemu 3 anymore * unicorn mips fixes * instrumentation further move to C++11 (#900) * unicorn fixes * first working NeverZero implementation * more unicorn fixes * Fix memory errors when trim causes testcase growth (#881) (#903) * Revert "fixed potential double free in custom trim (#881)" This reverts commite9d2f72382. * Revert "fix custom trim for increasing data" This reverts commit86a8ef168d. * Fix memory errors when trim causes testcase growth Modify trim_case_custom to avoid writing into in_buf because some custom mutators can cause the testcase to grow rather than shrink. Instead of modifying in_buf directly, we write the update out to the disk when trimming is complete, and then the caller is responsible for refreshing the in-memory buffer from the file. This is still a bit sketchy because it does need to modify q->len in order to notify the upper layers that something changed, and it could end up telling upper layer code that the q->len is *bigger* than the buffer (q->testcase_buf) that contains it, which is asking for trouble down the line somewhere... * Fix an unlikely situation Put back some `unlikely()` calls that were in thee9d2f72382commit that was reverted. * add some comments * typo * Exit on time (#904) * Variable AFL_EXIT_ON_TIME description has been added. Variables AFL_EXIT_ON_TIME and afl_exit_on_time has been added. afl->exit_on_time variable initialization has been added. The asignment of a value to the afl->afl_env.afl_exit_on_time variable from environment variables has been added. Code to exit on timeout if new path not found has been added. * Type of afl_exit_on_time variable has been changed. Variable exit_on_time has been added to the afl_state_t structure. * Command `export AFL_EXIT_WHEN_DONE=1` has been added. * Millisecond to second conversion has been added. Call get_cur_time() has been added. * Revert to using the saved current time value. * Useless check has been removed. * fix new path to custom-mutators * ensure crashes/README.txt exists * fix * Changes to bump FRIDA version and to clone FRIDA repo in to build directory rather than use a submodule as the FRIDA build scripts don't like it (#906) Co-authored-by: Your Name <you@example.com> * Fix numeric overflow in cmplog implementation (#907) Co-authored-by: Your Name <you@example.com> * testcase fixes for unicorn * remove merge conflict artifacts * fix afl-plot * Changes to remove binaries from frida_mode (#913) Co-authored-by: Your Name <you@example.com> * Frida cmplog fail fast (#914) * Changes to remove binaries from frida_mode * Changes to make cmplog fail fast Co-authored-by: Your Name <you@example.com> * afl-plot: relative time * arch linux and mac os support for afl-system-config * typo * code-format * update documentation * github workflow for qemu * OSX-specific improvements (#912) * Fix afl-cc to work correctly by default on OSX using xcode - CLANG_ENV_VAR must be set for afl-as to work - Use clang mode by default if no specific compiler selected * Add OSX-specific documentation for configuring shared memory * Fixes to memory operands for complog (#916) Co-authored-by: Your Name <you@example.com> * fix a few cur_time uses * added bounds check to pivot_inputs (fixes #921) * additional safety checks for restarts * restrict afl-showmap in_file size * fix seed crash disable * add warning for afl-showmap partial read * no core dumps * AFL_PRINT_FILENAMES added * more documentation for AFL_EXIT_ON_TIME * Flushing for AFL_PRINT_FILENAMES * FASAN Support (#918) * FASAN Support * Fix handling of Address Sanitizer DSO * Changes to identification of Address Sanitizer DSO Co-authored-by: Your Name <you@example.com> * Support for x86 (#920) Co-authored-by: Your Name <you@example.com> * Update frida_mode readme (#925) * libqasan: use syscalls for read and write * update readme * Minor integration tweaks (#926) Co-authored-by: Your Name <you@example.com> * merge * fix afl-fuzz.c frida preload * cleaned up AFL_PRINT_FILENAMES env * Changes to have persistent mode exit at the end of the loop (#928) Co-authored-by: Your Name <you@example.com> * fix llvm-dict2file * push to stable (#931) (#932) * sync (#886) * Create FUNDING.yml * Update FUNDING.yml * moved custom_mutator examples * unicorn speedtest makefile cleanup * fixed example location * fix qdbi * update util readme * Frida persistent (#880) * Added x64 support for persistent mode (function call only), in-memory teest cases and complog * Review changes, fix NeverZero and code to parse the .text section of the main executable. Excluded ranges TBC * Various minor fixes and finished support for AFL_INST_LIBS * Review changes Co-authored-by: Your Name <you@example.com> * nits * fix frida mode * Integer overflow/underflow fixes in libdislocator (#889) * libdislocator: fixing integer overflow in 'max_mem' variable and setting 'max_mem' type to 'size_t' * libdislocator: fixing potential integer underflow in 'total_mem' variable due to its different values in different threads * Bumped warnings up to the max and fixed remaining issues (#890) Co-authored-by: Your Name <you@example.com> * nits * frida mode - support non-pie * nits * nit * update grammar mutator * Fixes for aarch64, OSX and other minor issues (#891) Co-authored-by: Your Name <you@example.com> * nits * nits * fix PCGUARD, build aflpp_driver with fPIC * Added representative fuzzbench test and test for libxml (#893) * Added representative fuzzbench test and test for libxml * Added support for building FRIDA from source with FRIDA_SOURCE=1 Co-authored-by: Your Name <you@example.com> * nits * update changelog * typos * fixed potential double free in custom trim (#881) * error handling, freeing mem * frida: complog -> cmplog * fix statsd writing * let aflpp_qemu_driver_hook.so build fail gracefully * fix stdin trimming * Support for AFL_ENTRYPOINT (#898) Co-authored-by: Your Name <you@example.com> * remove the input file .cur_input at the end of the fuzzing, if AFL_TMPDIR is used * reverse push (#901) * Create FUNDING.yml * Update FUNDING.yml * disable QEMU static pie Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> * clarify that no modifications are required. * add new test for frida_mode (please review) * typos * fix persistent mode (64-bit) * set ARCH for linux intel 32-bit for frida-gum-devkit * prepare for 32-bit support (later) * not on qemu 3 anymore * unicorn mips fixes * instrumentation further move to C++11 (#900) * unicorn fixes * more unicorn fixes * Fix memory errors when trim causes testcase growth (#881) (#903) * Revert "fixed potential double free in custom trim (#881)" This reverts commite9d2f72382. * Revert "fix custom trim for increasing data" This reverts commit86a8ef168d. * Fix memory errors when trim causes testcase growth Modify trim_case_custom to avoid writing into in_buf because some custom mutators can cause the testcase to grow rather than shrink. Instead of modifying in_buf directly, we write the update out to the disk when trimming is complete, and then the caller is responsible for refreshing the in-memory buffer from the file. This is still a bit sketchy because it does need to modify q->len in order to notify the upper layers that something changed, and it could end up telling upper layer code that the q->len is *bigger* than the buffer (q->testcase_buf) that contains it, which is asking for trouble down the line somewhere... * Fix an unlikely situation Put back some `unlikely()` calls that were in thee9d2f72382commit that was reverted. * typo * Exit on time (#904) * Variable AFL_EXIT_ON_TIME description has been added. Variables AFL_EXIT_ON_TIME and afl_exit_on_time has been added. afl->exit_on_time variable initialization has been added. The asignment of a value to the afl->afl_env.afl_exit_on_time variable from environment variables has been added. Code to exit on timeout if new path not found has been added. * Type of afl_exit_on_time variable has been changed. Variable exit_on_time has been added to the afl_state_t structure. * Command `export AFL_EXIT_WHEN_DONE=1` has been added. * Millisecond to second conversion has been added. Call get_cur_time() has been added. * Revert to using the saved current time value. * Useless check has been removed. * fix new path to custom-mutators * ensure crashes/README.txt exists * fix * Changes to bump FRIDA version and to clone FRIDA repo in to build directory rather than use a submodule as the FRIDA build scripts don't like it (#906) Co-authored-by: Your Name <you@example.com> * Fix numeric overflow in cmplog implementation (#907) Co-authored-by: Your Name <you@example.com> * testcase fixes for unicorn * remove merge conflict artifacts * fix afl-plot * Changes to remove binaries from frida_mode (#913) Co-authored-by: Your Name <you@example.com> * Frida cmplog fail fast (#914) * Changes to remove binaries from frida_mode * Changes to make cmplog fail fast Co-authored-by: Your Name <you@example.com> * afl-plot: relative time * arch linux and mac os support for afl-system-config * typo * code-format * update documentation * github workflow for qemu * OSX-specific improvements (#912) * Fix afl-cc to work correctly by default on OSX using xcode - CLANG_ENV_VAR must be set for afl-as to work - Use clang mode by default if no specific compiler selected * Add OSX-specific documentation for configuring shared memory * Fixes to memory operands for complog (#916) Co-authored-by: Your Name <you@example.com> * fix a few cur_time uses * added bounds check to pivot_inputs (fixes #921) * additional safety checks for restarts * restrict afl-showmap in_file size * fix seed crash disable * add warning for afl-showmap partial read * no core dumps * AFL_PRINT_FILENAMES added * more documentation for AFL_EXIT_ON_TIME * Flushing for AFL_PRINT_FILENAMES * FASAN Support (#918) * FASAN Support * Fix handling of Address Sanitizer DSO * Changes to identification of Address Sanitizer DSO Co-authored-by: Your Name <you@example.com> * Support for x86 (#920) Co-authored-by: Your Name <you@example.com> * Update frida_mode readme (#925) * libqasan: use syscalls for read and write * update readme * Minor integration tweaks (#926) Co-authored-by: Your Name <you@example.com> * merge * fix afl-fuzz.c frida preload * cleaned up AFL_PRINT_FILENAMES env * Changes to have persistent mode exit at the end of the loop (#928) Co-authored-by: Your Name <you@example.com> * fix llvm-dict2file Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com> Co-authored-by: hexcoder- <heiko@hexco.de> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> Co-authored-by: Dustin Spicuzza <dustin@virtualroadside.com> Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com> Co-authored-by: hexcoder- <heiko@hexco.de> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> Co-authored-by: Dustin Spicuzza <dustin@virtualroadside.com> * improve error msg * Added documentation for wine LoadLibrary workaround (#933) * Fix cmake target compilation command example (#934) - Fix typo DCMAKE_C_COMPILERC -> DCMAKE_C_COMPILER. - Add `cd build` after `mkdir build`. * showmap passes queue items in alphabetical order * added tmp files to gitignore * lenient dict parsing, no map size enum for binary fuzzing * added info about showmap queue directions * update binary-only doc * turn off map size detection if skip_bin_check is set * Typo * update docs * update afl-system-config * Set kill signal before using it in afl-showmap (#935) * fix afl-cc help output * add libafl to binary-only doc * update docs * less executions on variable paths * AFL_SKIP_CRASHES is obsolete since 3.0 * add AFL_TRY_AFFINITY * Typo * Typo * Typo/wording * tweaks * typos * fix afl-whatsup help output * fix afl-plot output * fix for MacOS * fix cmpcov doc for qemu * fix tmpfile removal * update dockerfile * Frida (#940) * Added re2 test * Added libpcap test * Fix validation of setting of ADDR_NO_RANDOMIZE * Added support for printing original and instrumented code Co-authored-by: Your Name <you@example.com> * Support for AFL_FRIDA_PERSISTENT_RET (#941) Co-authored-by: Your Name <you@example.com> * Changes to add missing exclusion of ranges (#943) Co-authored-by: Your Name <you@example.com> * add --afl-noopt to afl-cc * docs: fix link to README in QuickStartGuide (#946) * Support writing Stalker stats (#945) * Support writing Stalker stats * Fixed string handling in print functions Co-authored-by: Your Name <you@example.com> * afl-cmin help fix, aflpp_driver - + @@ support * fix for afl-showmap * support new env var AFL_LLVM_THREADSAFE_INST to enable atomic counters. add new test case for that. * add documentation for AFL_LLVM_THREADSAFE_INST * add support for AFL_LLVM_THREADSAFE_INST to other LLVM passes * add missing include for _exit() * threadsafe doc fixes, code format * Wording: "never zero" -> NeverZero * fix afl_custom_post_process with multiple custom mutators * fix docs * debug ck_write * fixed potential diff by 0 * fixes * fix classic threadsafe counters * v3.13c release Co-authored-by: hexcoder- <heiko@hexco.de> Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> Co-authored-by: Dustin Spicuzza <dustin@virtualroadside.com> Co-authored-by: 0x4d5a-ctf <51098072+0x4d5a-ctf@users.noreply.github.com> Co-authored-by: Tommy Chiang <oToToT@users.noreply.github.com> Co-authored-by: buherator <buherator@silentsignal.hu> Co-authored-by: Dag Heyman Kajevic <dag.heyman@gmail.com> Co-authored-by: realmadsci <71108352+realmadsci@users.noreply.github.com> Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com> Co-authored-by: Your Name <you@example.com> Co-authored-by: Jiangen Jiao <joeyjiaojg@qq.com> Co-authored-by: Yong-Hao Zou <yonghaoz1994@gmail.com> Co-authored-by: hexcoder- <heiko@hexco.de> Co-authored-by: R. Elliott Childre <elliottchildre329@gmail.com> Co-authored-by: microsvuln <55649192+Microsvuln@users.noreply.github.com> Co-authored-by: Joshua Rogers <jrogers@opera.com> Co-authored-by: begasus <begasus@gmail.com> Co-authored-by: Ujjwal Kirti <64329707+ujjwalkirti@users.noreply.github.com> Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com> Co-authored-by: Dominik Maier <domenukk@gmail.com> Co-authored-by: veritas501 <hxzene@gmail.com> Co-authored-by: WorksButNotTested <62701594+WorksButNotTested@users.noreply.github.com> Co-authored-by: Dmitry Zheregelya <zheregelya.d@gmail.com> Co-authored-by: David CARLIER <devnexen@gmail.com> Co-authored-by: Roman M. Iudichev <SecNotice@ya.ru> Co-authored-by: Dustin Spicuzza <dustin@virtualroadside.com> Co-authored-by: 0x4d5a-ctf <51098072+0x4d5a-ctf@users.noreply.github.com> Co-authored-by: Tommy Chiang <oToToT@users.noreply.github.com> Co-authored-by: buherator <buherator@silentsignal.hu> Co-authored-by: Dag Heyman Kajevic <dag.heyman@gmail.com>
This commit is contained in:
van Hauser
GitHub
@ -83,6 +83,7 @@ static volatile u8 stop_soon, /* Ctrl-C pressed? */
|
||||
child_timed_out; /* Child timed out? */
|
||||
|
||||
static u8 *target_path;
|
||||
static u8 frida_mode;
|
||||
static u8 qemu_mode;
|
||||
static u32 map_size = MAP_SIZE;
|
||||
|
||||
@ -717,9 +718,11 @@ static void handle_stop_sig(int sig) {
|
||||
|
||||
/* Do basic preparations - persistent fds, filenames, etc. */
|
||||
|
||||
static void set_up_environment(void) {
|
||||
static void set_up_environment(char **argv) {
|
||||
|
||||
u8 *x;
|
||||
u8 * x;
|
||||
char *afl_preload;
|
||||
char *frida_afl_preload = NULL;
|
||||
|
||||
dev_null_fd = open("/dev/null", O_RDWR);
|
||||
if (dev_null_fd < 0) { PFATAL("Unable to open /dev/null"); }
|
||||
@ -781,6 +784,18 @@ static void set_up_environment(void) {
|
||||
|
||||
}
|
||||
|
||||
x = get_afl_env("LSAN_OPTIONS");
|
||||
|
||||
if (x) {
|
||||
|
||||
if (!strstr(x, "symbolize=0")) {
|
||||
|
||||
FATAL("Custom LSAN_OPTIONS set without symbolize=0 - please fix!");
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
setenv("ASAN_OPTIONS",
|
||||
"abort_on_error=1:"
|
||||
"detect_leaks=0:"
|
||||
@ -818,12 +833,38 @@ static void set_up_environment(void) {
|
||||
"handle_sigfpe=0:"
|
||||
"handle_sigill=0", 0);
|
||||
|
||||
setenv("LSAN_OPTIONS",
|
||||
"exitcode=" STRINGIFY(LSAN_ERROR) ":"
|
||||
"fast_unwind_on_malloc=0:"
|
||||
"symbolize=0:"
|
||||
"print_suppressions=0",
|
||||
0);
|
||||
|
||||
if (get_afl_env("AFL_PRELOAD")) {
|
||||
|
||||
if (qemu_mode) {
|
||||
|
||||
/* afl-qemu-trace takes care of converting AFL_PRELOAD. */
|
||||
|
||||
} else if (frida_mode) {
|
||||
|
||||
afl_preload = getenv("AFL_PRELOAD");
|
||||
u8 *frida_binary = find_afl_binary(argv[0], "afl-frida-trace.so");
|
||||
if (afl_preload) {
|
||||
|
||||
frida_afl_preload = alloc_printf("%s:%s", afl_preload, frida_binary);
|
||||
|
||||
} else {
|
||||
|
||||
frida_afl_preload = alloc_printf("%s", frida_binary);
|
||||
|
||||
}
|
||||
|
||||
ck_free(frida_binary);
|
||||
|
||||
setenv("LD_PRELOAD", frida_afl_preload, 1);
|
||||
setenv("DYLD_INSERT_LIBRARIES", frida_afl_preload, 1);
|
||||
|
||||
} else {
|
||||
|
||||
setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
|
||||
@ -831,8 +872,17 @@ static void set_up_environment(void) {
|
||||
|
||||
}
|
||||
|
||||
} else if (frida_mode) {
|
||||
|
||||
u8 *frida_binary = find_afl_binary(argv[0], "afl-frida-trace.so");
|
||||
setenv("LD_PRELOAD", frida_binary, 1);
|
||||
setenv("DYLD_INSERT_LIBRARIES", frida_binary, 1);
|
||||
ck_free(frida_binary);
|
||||
|
||||
}
|
||||
|
||||
if (frida_afl_preload) { ck_free(frida_afl_preload); }
|
||||
|
||||
}
|
||||
|
||||
/* Setup signal handlers, duh. */
|
||||
@ -872,6 +922,7 @@ static void usage(u8 *argv0) {
|
||||
" -f file - input file read by the tested program (stdin)\n"
|
||||
" -t msec - timeout for each run (%u ms)\n"
|
||||
" -m megs - memory limit for child process (%u MB)\n"
|
||||
" -O - use binary-only instrumentation (FRIDA mode)\n"
|
||||
" -Q - use binary-only instrumentation (QEMU mode)\n"
|
||||
" -U - use unicorn-based instrumentation (Unicorn mode)\n"
|
||||
" -W - use qemu-based instrumentation with Wine (Wine "
|
||||
@ -914,7 +965,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
SAYF(cCYA "afl-analyze" VERSION cRST " by Michal Zalewski\n");
|
||||
|
||||
while ((opt = getopt(argc, argv, "+i:f:m:t:eQUWh")) > 0) {
|
||||
while ((opt = getopt(argc, argv, "+i:f:m:t:eOQUWh")) > 0) {
|
||||
|
||||
switch (opt) {
|
||||
|
||||
@ -1008,6 +1059,14 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
break;
|
||||
|
||||
case 'O': /* FRIDA mode */
|
||||
|
||||
if (frida_mode) { FATAL("Multiple -O options not supported"); }
|
||||
|
||||
frida_mode = 1;
|
||||
|
||||
break;
|
||||
|
||||
case 'Q':
|
||||
|
||||
if (qemu_mode) { FATAL("Multiple -Q options not supported"); }
|
||||
@ -1062,7 +1121,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
atexit(at_exit_handler);
|
||||
setup_signal_handlers();
|
||||
|
||||
set_up_environment();
|
||||
set_up_environment(argv);
|
||||
|
||||
target_path = find_binary(argv[optind]);
|
||||
detect_file_args(argv + optind, prog_in, &use_stdin);
|
||||
|
||||
@ -517,11 +517,12 @@ static void add_instrumentation(void) {
|
||||
} else {
|
||||
|
||||
char modeline[100];
|
||||
snprintf(modeline, sizeof(modeline), "%s%s%s%s",
|
||||
snprintf(modeline, sizeof(modeline), "%s%s%s%s%s",
|
||||
getenv("AFL_HARDEN") ? "hardened" : "non-hardened",
|
||||
getenv("AFL_USE_ASAN") ? ", ASAN" : "",
|
||||
getenv("AFL_USE_MSAN") ? ", MSAN" : "",
|
||||
getenv("AFL_USE_UBSAN") ? ", UBSAN" : "");
|
||||
getenv("AFL_USE_UBSAN") ? ", UBSAN" : "",
|
||||
getenv("AFL_USE_LSAN") ? ", LSAN" : "");
|
||||
|
||||
OKF("Instrumented %u locations (%s-bit, %s mode, ratio %u%%).", ins_lines,
|
||||
use_64bit ? "64" : "32", modeline, inst_ratio);
|
||||
@ -585,7 +586,7 @@ int main(int argc, char **argv) {
|
||||
"AFL_QUIET: suppress verbose output\n"
|
||||
"AFL_KEEP_ASSEMBLY: leave instrumented assembly files\n"
|
||||
"AFL_AS_FORCE_INSTRUMENT: force instrumentation for asm sources\n"
|
||||
"AFL_HARDEN, AFL_USE_ASAN, AFL_USE_MSAN, AFL_USE_UBSAN:\n"
|
||||
"AFL_HARDEN, AFL_USE_ASAN, AFL_USE_MSAN, AFL_USE_UBSAN, AFL_USE_LSAN:\n"
|
||||
" used in the instrumentation summary message\n",
|
||||
argv[0]);
|
||||
|
||||
|
||||
122
src/afl-cc.c
122
src/afl-cc.c
@ -66,7 +66,6 @@ enum {
|
||||
INSTRUMENT_CLASSIC = 1,
|
||||
INSTRUMENT_AFL = 1,
|
||||
INSTRUMENT_PCGUARD = 2,
|
||||
INSTRUMENT_INSTRIM = 3,
|
||||
INSTRUMENT_CFG = 3,
|
||||
INSTRUMENT_LTO = 4,
|
||||
INSTRUMENT_LLVMNATIVE = 5,
|
||||
@ -431,9 +430,6 @@ static void edit_params(u32 argc, char **argv, char **envp) {
|
||||
|
||||
cc_params[cc_par_cnt++] = "-Wno-unused-command-line-argument";
|
||||
|
||||
if (lto_mode && plusplus_mode)
|
||||
cc_params[cc_par_cnt++] = "-lc++"; // needed by fuzzbench, early
|
||||
|
||||
if (lto_mode && have_instr_env) {
|
||||
|
||||
cc_params[cc_par_cnt++] = "-Xclang";
|
||||
@ -564,12 +560,14 @@ static void edit_params(u32 argc, char **argv, char **envp) {
|
||||
if (lto_mode && !have_c) {
|
||||
|
||||
u8 *ld_path = strdup(AFL_REAL_LD);
|
||||
if (!*ld_path) ld_path = "ld.lld";
|
||||
if (!ld_path || !*ld_path) { ld_path = strdup("ld.lld"); }
|
||||
if (!ld_path) { PFATAL("Could not allocate mem for ld_path"); }
|
||||
#if defined(AFL_CLANG_LDPATH) && LLVM_MAJOR >= 12
|
||||
cc_params[cc_par_cnt++] = alloc_printf("--ld-path=%s", ld_path);
|
||||
#else
|
||||
cc_params[cc_par_cnt++] = alloc_printf("-fuse-ld=%s", ld_path);
|
||||
#endif
|
||||
free(ld_path);
|
||||
|
||||
cc_params[cc_par_cnt++] = "-Wl,--allow-multiple-definition";
|
||||
|
||||
@ -588,9 +586,9 @@ static void edit_params(u32 argc, char **argv, char **envp) {
|
||||
if (instrument_mode == INSTRUMENT_PCGUARD) {
|
||||
|
||||
#if LLVM_MAJOR > 10 || (LLVM_MAJOR == 10 && LLVM_MINOR > 0)
|
||||
#ifdef __ANDROID__
|
||||
#if defined __ANDROID__ || ANDROID
|
||||
cc_params[cc_par_cnt++] = "-fsanitize-coverage=trace-pc-guard";
|
||||
instrument_mode != INSTRUMENT_LLVMNATIVE;
|
||||
instrument_mode = INSTRUMENT_LLVMNATIVE;
|
||||
#else
|
||||
if (have_instr_list) {
|
||||
|
||||
@ -639,12 +637,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
|
||||
cc_params[cc_par_cnt++] = "-Xclang";
|
||||
cc_params[cc_par_cnt++] = "-load";
|
||||
cc_params[cc_par_cnt++] = "-Xclang";
|
||||
if (instrument_mode == INSTRUMENT_CFG)
|
||||
cc_params[cc_par_cnt++] =
|
||||
alloc_printf("%s/libLLVMInsTrim.so", obj_path);
|
||||
else
|
||||
cc_params[cc_par_cnt++] =
|
||||
alloc_printf("%s/afl-llvm-pass.so", obj_path);
|
||||
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-pass.so", obj_path);
|
||||
|
||||
}
|
||||
|
||||
@ -825,6 +818,14 @@ static void edit_params(u32 argc, char **argv, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
if (getenv("AFL_USE_LSAN")) {
|
||||
|
||||
cc_params[cc_par_cnt++] = "-fsanitize=leak";
|
||||
cc_params[cc_par_cnt++] = "-includesanitizer/lsan_interface.h";
|
||||
cc_params[cc_par_cnt++] = "-D__AFL_LEAK_CHECK()=__lsan_do_leak_check()";
|
||||
|
||||
}
|
||||
|
||||
if (getenv("AFL_USE_CFISAN")) {
|
||||
|
||||
if (!lto_mode) {
|
||||
@ -1223,6 +1224,14 @@ int main(int argc, char **argv, char **envp) {
|
||||
|
||||
if (strncmp(argv[i], "--afl", 5) == 0) {
|
||||
|
||||
if (!strcmp(argv[i], "--afl_noopt") || !strcmp(argv[i], "--afl-noopt")) {
|
||||
|
||||
passthrough = 1;
|
||||
argv[i] = "-g"; // we have to overwrite it, -g is always good
|
||||
continue;
|
||||
|
||||
}
|
||||
|
||||
if (compiler_mode)
|
||||
WARNF(
|
||||
"--afl-... compiler mode supersedes the AFL_CC_COMPILER and "
|
||||
@ -1252,8 +1261,9 @@ int main(int argc, char **argv, char **envp) {
|
||||
|
||||
strcasecmp(ptr, "CFG") == 0) {
|
||||
|
||||
compiler_mode = LLVM;
|
||||
instrument_mode = INSTRUMENT_CFG;
|
||||
FATAL(
|
||||
"InsTrim instrumentation was removed. Use a modern LLVM and "
|
||||
"PCGUARD (default in afl-cc).\n");
|
||||
|
||||
} else if (strcasecmp(ptr, "AFL") == 0 ||
|
||||
|
||||
@ -1319,10 +1329,9 @@ int main(int argc, char **argv, char **envp) {
|
||||
if (getenv("AFL_LLVM_INSTRIM") || getenv("INSTRIM") ||
|
||||
getenv("INSTRIM_LIB")) {
|
||||
|
||||
if (instrument_mode == 0)
|
||||
instrument_mode = INSTRUMENT_CFG;
|
||||
else if (instrument_mode != INSTRUMENT_CFG)
|
||||
FATAL("you cannot set AFL_LLVM_INSTRUMENT and AFL_LLVM_INSTRIM together");
|
||||
FATAL(
|
||||
"InsTrim instrumentation was removed. Use a modern LLVM and PCGUARD "
|
||||
"(default in afl-cc).\n");
|
||||
|
||||
}
|
||||
|
||||
@ -1409,17 +1418,9 @@ int main(int argc, char **argv, char **envp) {
|
||||
if (strncasecmp(ptr2, "cfg", strlen("cfg")) == 0 ||
|
||||
strncasecmp(ptr2, "instrim", strlen("instrim")) == 0) {
|
||||
|
||||
if (instrument_mode == INSTRUMENT_LTO) {
|
||||
|
||||
instrument_mode = INSTRUMENT_CFG;
|
||||
lto_mode = 1;
|
||||
|
||||
} else if (!instrument_mode || instrument_mode == INSTRUMENT_CFG)
|
||||
|
||||
instrument_mode = INSTRUMENT_CFG;
|
||||
else
|
||||
FATAL("main instrumentation mode already set with %s",
|
||||
instrument_mode_string[instrument_mode]);
|
||||
FATAL(
|
||||
"InsTrim instrumentation was removed. Use a modern LLVM and "
|
||||
"PCGUARD (default in afl-cc).\n");
|
||||
|
||||
}
|
||||
|
||||
@ -1428,7 +1429,7 @@ int main(int argc, char **argv, char **envp) {
|
||||
lto_mode = 1;
|
||||
if (!instrument_mode || instrument_mode == INSTRUMENT_LTO)
|
||||
instrument_mode = INSTRUMENT_LTO;
|
||||
else if (instrument_mode != INSTRUMENT_CFG)
|
||||
else
|
||||
FATAL("main instrumentation mode already set with %s",
|
||||
instrument_mode_string[instrument_mode]);
|
||||
|
||||
@ -1456,9 +1457,11 @@ int main(int argc, char **argv, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
if (strncasecmp(ptr2, "ctx-", strlen("ctx-")) == 0) {
|
||||
if (strncasecmp(ptr2, "ctx-", strlen("ctx-")) == 0 ||
|
||||
strncasecmp(ptr2, "kctx-", strlen("c-ctx-")) == 0 ||
|
||||
strncasecmp(ptr2, "k-ctx-", strlen("k-ctx-")) == 0) {
|
||||
|
||||
u8 *ptr3 = ptr2 + strlen("ctx-");
|
||||
u8 *ptr3 = ptr2;
|
||||
while (*ptr3 && (*ptr3 < '0' || *ptr3 > '9'))
|
||||
ptr3++;
|
||||
|
||||
@ -1494,7 +1497,7 @@ int main(int argc, char **argv, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
if (strncasecmp(ptr2, "ctx", strlen("ctx")) == 0) {
|
||||
if (strcasecmp(ptr2, "ctx") == 0) {
|
||||
|
||||
instrument_opt_mode |= INSTRUMENT_OPT_CTX;
|
||||
setenv("AFL_LLVM_CTX", "1", 1);
|
||||
@ -1579,7 +1582,12 @@ int main(int argc, char **argv, char **envp) {
|
||||
else if (have_gcc_plugin)
|
||||
compiler_mode = GCC_PLUGIN;
|
||||
else if (have_gcc)
|
||||
#ifdef __APPLE__
|
||||
// on OSX clang masquerades as GCC
|
||||
compiler_mode = CLANG;
|
||||
#else
|
||||
compiler_mode = GCC;
|
||||
#endif
|
||||
else if (have_lto)
|
||||
compiler_mode = LTO;
|
||||
else
|
||||
@ -1601,7 +1609,12 @@ int main(int argc, char **argv, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
if (compiler_mode == CLANG) { instrument_mode = INSTRUMENT_CLANG; }
|
||||
if (compiler_mode == CLANG) {
|
||||
|
||||
instrument_mode = INSTRUMENT_CLANG;
|
||||
setenv(CLANG_ENV_VAR, "1", 1); // used by afl-as
|
||||
|
||||
}
|
||||
|
||||
if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) {
|
||||
|
||||
@ -1635,18 +1648,13 @@ int main(int argc, char **argv, char **envp) {
|
||||
" yes\n"
|
||||
" [LLVM] llvm: %s%s\n"
|
||||
" PCGUARD %s yes yes module yes yes "
|
||||
"extern\n"
|
||||
"yes\n"
|
||||
" CLASSIC %s no yes module yes yes "
|
||||
"yes\n"
|
||||
" - NORMAL\n"
|
||||
" - CALLER\n"
|
||||
" - CTX\n"
|
||||
" - NGRAM-{2-16}\n"
|
||||
" INSTRIM no yes module yes yes "
|
||||
" yes\n"
|
||||
" - NORMAL\n"
|
||||
" - CALLER\n"
|
||||
" - NGRAM-{2-16}\n"
|
||||
" [GCC_PLUGIN] gcc plugin: %s%s\n"
|
||||
" CLASSIC DEFAULT no yes no no no "
|
||||
"yes\n"
|
||||
@ -1697,9 +1705,7 @@ int main(int argc, char **argv, char **envp) {
|
||||
" CTX: CLASSIC + full callee context "
|
||||
"(instrumentation/README.ctx.md)\n"
|
||||
" NGRAM-x: CLASSIC + previous path "
|
||||
"((instrumentation/README.ngram.md)\n"
|
||||
" INSTRIM: Dominator tree (for LLVM <= 6.0) "
|
||||
"(instrumentation/README.instrim.md)\n\n");
|
||||
"((instrumentation/README.ngram.md)\n\n");
|
||||
|
||||
#undef NATIVE_MSG
|
||||
|
||||
@ -1749,7 +1755,8 @@ int main(int argc, char **argv, char **envp) {
|
||||
" AFL_USE_ASAN: activate address sanitizer\n"
|
||||
" AFL_USE_CFISAN: activate control flow sanitizer\n"
|
||||
" AFL_USE_MSAN: activate memory sanitizer\n"
|
||||
" AFL_USE_UBSAN: activate undefined behaviour sanitizer\n");
|
||||
" AFL_USE_UBSAN: activate undefined behaviour sanitizer\n"
|
||||
" AFL_USE_LSAN: activate leak-checker sanitizer\n");
|
||||
|
||||
if (have_gcc_plugin)
|
||||
SAYF(
|
||||
@ -1770,6 +1777,8 @@ int main(int argc, char **argv, char **envp) {
|
||||
SAYF(
|
||||
"\nLLVM/LTO/afl-clang-fast/afl-clang-lto specific environment "
|
||||
"variables:\n"
|
||||
" AFL_LLVM_THREADSAFE_INST: instrument with thread safe counters, "
|
||||
"disables neverzero\n"
|
||||
|
||||
COUNTER_BEHAVIOUR
|
||||
|
||||
@ -1791,19 +1800,16 @@ int main(int argc, char **argv, char **envp) {
|
||||
" AFL_LLVM_CMPLOG: log operands of comparisons (RedQueen "
|
||||
"mutator)\n"
|
||||
" AFL_LLVM_INSTRUMENT: set instrumentation mode:\n"
|
||||
" CLASSIC, INSTRIM, PCGUARD, LTO, GCC, CLANG, CALLER, CTX, "
|
||||
"NGRAM-2 ..-16\n"
|
||||
" CLASSIC, PCGUARD, LTO, GCC, CLANG, CALLER, CTX, NGRAM-2 "
|
||||
"..-16\n"
|
||||
" You can also use the old environment variables instead:\n"
|
||||
" AFL_LLVM_USE_TRACE_PC: use LLVM trace-pc-guard instrumentation\n"
|
||||
" AFL_LLVM_INSTRIM: use light weight instrumentation InsTrim\n"
|
||||
" AFL_LLVM_INSTRIM_LOOPHEAD: optimize loop tracing for speed "
|
||||
"(option to INSTRIM)\n"
|
||||
" AFL_LLVM_CALLER: use single context sensitive coverage (for "
|
||||
"CLASSIC)\n"
|
||||
" AFL_LLVM_CTX: use full context sensitive coverage (for "
|
||||
"CLASSIC)\n"
|
||||
" AFL_LLVM_NGRAM_SIZE: use ngram prev_loc count coverage (for "
|
||||
"CLASSIC & INSTRIM)\n");
|
||||
"CLASSIC)\n");
|
||||
|
||||
#ifdef AFL_CLANG_FLTO
|
||||
if (have_lto)
|
||||
@ -1825,6 +1831,12 @@ int main(int argc, char **argv, char **envp) {
|
||||
"If anything fails - be sure to read README.lto.md!\n");
|
||||
#endif
|
||||
|
||||
SAYF(
|
||||
"\nYou can supply --afl-noopt to not instrument, like AFL_NOOPT. "
|
||||
"(this is helpful\n"
|
||||
"in some build systems if you do not want to instrument "
|
||||
"everything.\n");
|
||||
|
||||
}
|
||||
|
||||
SAYF(
|
||||
@ -1951,11 +1963,7 @@ int main(int argc, char **argv, char **envp) {
|
||||
"(requires LLVM 11 or higher)");
|
||||
#endif
|
||||
|
||||
if (instrument_opt_mode && instrument_mode == INSTRUMENT_CFG &&
|
||||
instrument_opt_mode & INSTRUMENT_OPT_CTX)
|
||||
FATAL("CFG instrumentation mode supports NGRAM and CALLER, but not CTX.");
|
||||
else if (instrument_opt_mode && instrument_mode != INSTRUMENT_CLASSIC)
|
||||
// we will drop CFG/INSTRIM in the future so do not advertise
|
||||
if (instrument_opt_mode && instrument_mode != INSTRUMENT_CLASSIC)
|
||||
FATAL(
|
||||
"CALLER, CTX and NGRAM instrumentation options can only be used with "
|
||||
"the LLVM CLASSIC instrumentation mode.");
|
||||
@ -2023,7 +2031,7 @@ int main(int argc, char **argv, char **envp) {
|
||||
if (!be_quiet && cmplog_mode)
|
||||
printf("CmpLog mode by <andreafioraldi@gmail.com>\n");
|
||||
|
||||
#ifndef __ANDROID__
|
||||
#if !defined(__ANDROID__) && !defined(ANDROID)
|
||||
ptr = find_object("afl-compiler-rt.o", argv[0]);
|
||||
|
||||
if (!ptr) {
|
||||
|
||||
@ -70,31 +70,26 @@ void detect_file_args(char **argv, u8 *prog_in, bool *use_stdin) {
|
||||
|
||||
*use_stdin = false;
|
||||
|
||||
if (prog_in[0] != 0) { // not afl-showmap special case
|
||||
/* Be sure that we're always using fully-qualified paths. */
|
||||
|
||||
u8 *n_arg;
|
||||
*aa_loc = 0;
|
||||
|
||||
/* Be sure that we're always using fully-qualified paths. */
|
||||
/* Construct a replacement argv value. */
|
||||
u8 *n_arg;
|
||||
|
||||
*aa_loc = 0;
|
||||
if (prog_in[0] == '/') {
|
||||
|
||||
/* Construct a replacement argv value. */
|
||||
n_arg = alloc_printf("%s%s%s", argv[i], prog_in, aa_loc + 2);
|
||||
|
||||
if (prog_in[0] == '/') {
|
||||
} else {
|
||||
|
||||
n_arg = alloc_printf("%s%s%s", argv[i], prog_in, aa_loc + 2);
|
||||
|
||||
} else {
|
||||
|
||||
n_arg = alloc_printf("%s%s/%s%s", argv[i], cwd, prog_in, aa_loc + 2);
|
||||
|
||||
}
|
||||
|
||||
ck_free(argv[i]);
|
||||
argv[i] = n_arg;
|
||||
n_arg = alloc_printf("%s%s/%s%s", argv[i], cwd, prog_in, aa_loc + 2);
|
||||
|
||||
}
|
||||
|
||||
ck_free(argv[i]);
|
||||
argv[i] = n_arg;
|
||||
|
||||
}
|
||||
|
||||
i++;
|
||||
@ -287,12 +282,19 @@ u8 *find_binary(u8 *fname) {
|
||||
|
||||
u8 *find_afl_binary(u8 *own_loc, u8 *fname) {
|
||||
|
||||
u8 *afl_path = NULL, *target_path, *own_copy;
|
||||
u8 *afl_path = NULL, *target_path, *own_copy, *tmp;
|
||||
int perm = X_OK;
|
||||
|
||||
if ((tmp = strrchr(fname, '.'))) {
|
||||
|
||||
if (!strcasecmp(tmp, ".so") || !strcasecmp(tmp, ".dylib")) { perm = R_OK; }
|
||||
|
||||
}
|
||||
|
||||
if ((afl_path = getenv("AFL_PATH"))) {
|
||||
|
||||
target_path = alloc_printf("%s/%s", afl_path, fname);
|
||||
if (!access(target_path, X_OK)) {
|
||||
if (!access(target_path, perm)) {
|
||||
|
||||
return target_path;
|
||||
|
||||
@ -316,7 +318,7 @@ u8 *find_afl_binary(u8 *own_loc, u8 *fname) {
|
||||
target_path = alloc_printf("%s/%s", own_copy, fname);
|
||||
ck_free(own_copy);
|
||||
|
||||
if (!access(target_path, X_OK)) {
|
||||
if (!access(target_path, perm)) {
|
||||
|
||||
return target_path;
|
||||
|
||||
@ -334,8 +336,17 @@ u8 *find_afl_binary(u8 *own_loc, u8 *fname) {
|
||||
|
||||
}
|
||||
|
||||
target_path = alloc_printf("%s/%s", BIN_PATH, fname);
|
||||
if (!access(target_path, X_OK)) {
|
||||
if (perm == X_OK) {
|
||||
|
||||
target_path = alloc_printf("%s/%s", BIN_PATH, fname);
|
||||
|
||||
} else {
|
||||
|
||||
target_path = alloc_printf("%s/%s", AFL_PATH, fname);
|
||||
|
||||
}
|
||||
|
||||
if (!access(target_path, perm)) {
|
||||
|
||||
return target_path;
|
||||
|
||||
@ -345,7 +356,15 @@ u8 *find_afl_binary(u8 *own_loc, u8 *fname) {
|
||||
|
||||
}
|
||||
|
||||
return find_binary(fname);
|
||||
if (perm == X_OK) {
|
||||
|
||||
return find_binary(fname);
|
||||
|
||||
} else {
|
||||
|
||||
FATAL("Library '%s' not found", fname);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@ -460,9 +479,17 @@ void print_suggested_envs(char *mispelled_env) {
|
||||
|
||||
size_t end = start + strcspn(afl_env + start, "_") + 1;
|
||||
memcpy(reduced, afl_env, start);
|
||||
if (end < afl_env_len)
|
||||
if (end < afl_env_len) {
|
||||
|
||||
memcpy(reduced + start, afl_env + end, afl_env_len - end);
|
||||
reduced[afl_env_len - end + start] = 0;
|
||||
|
||||
}
|
||||
|
||||
if (afl_env_len + start >= end) {
|
||||
|
||||
reduced[afl_env_len - end + start] = 0;
|
||||
|
||||
}
|
||||
|
||||
int distance = string_distance_levenshtein(reduced, env_name);
|
||||
if (distance < ENV_SIMILARITY_TRESHOLD && seen[j] == 0) {
|
||||
@ -1091,6 +1118,10 @@ u32 get_map_size(void) {
|
||||
|
||||
if (map_size % 64) { map_size = (((map_size >> 6) + 1) << 6); }
|
||||
|
||||
} else if (getenv("AFL_SKIP_BIN_CHECK")) {
|
||||
|
||||
map_size = MAP_SIZE;
|
||||
|
||||
}
|
||||
|
||||
return map_size;
|
||||
|
||||
@ -42,6 +42,7 @@
|
||||
#include <errno.h>
|
||||
#include <signal.h>
|
||||
#include <fcntl.h>
|
||||
#include <limits.h>
|
||||
#include <sys/time.h>
|
||||
#include <sys/wait.h>
|
||||
#include <sys/resource.h>
|
||||
@ -126,7 +127,7 @@ void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from) {
|
||||
fsrv_to->last_run_timed_out = 0;
|
||||
|
||||
fsrv_to->init_child_func = from->init_child_func;
|
||||
// Note: do not copy ->add_extra_func
|
||||
// Note: do not copy ->add_extra_func or ->persistent_record*
|
||||
|
||||
list_append(&fsrv_list, fsrv_to);
|
||||
|
||||
@ -364,6 +365,24 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
|
||||
|
||||
if (!be_quiet) { ACTF("Spinning up the fork server..."); }
|
||||
|
||||
#ifdef AFL_PERSISTENT_RECORD
|
||||
if (unlikely(fsrv->persistent_record)) {
|
||||
|
||||
fsrv->persistent_record_data =
|
||||
(u8 **)ck_alloc(fsrv->persistent_record * sizeof(u8 *));
|
||||
fsrv->persistent_record_len =
|
||||
(u32 *)ck_alloc(fsrv->persistent_record * sizeof(u32));
|
||||
|
||||
if (!fsrv->persistent_record_data || !fsrv->persistent_record_len) {
|
||||
|
||||
FATAL("Unable to allocate memory for persistent replay.");
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
if (fsrv->use_fauxsrv) {
|
||||
|
||||
/* TODO: Come up with some nice way to initialize this all */
|
||||
@ -397,7 +416,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
|
||||
|
||||
struct rlimit r;
|
||||
|
||||
if (!fsrv->cmplog_binary && fsrv->qemu_mode == false) {
|
||||
if (!fsrv->cmplog_binary && fsrv->qemu_mode == false &&
|
||||
fsrv->frida_mode == false) {
|
||||
|
||||
unsetenv(CMPLOG_SHM_ENV_VAR); // we do not want that in non-cmplog fsrv
|
||||
|
||||
@ -431,8 +451,12 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
|
||||
/* Dumping cores is slow and can lead to anomalies if SIGKILL is delivered
|
||||
before the dump is complete. */
|
||||
|
||||
// r.rlim_max = r.rlim_cur = 0;
|
||||
// setrlimit(RLIMIT_CORE, &r); /* Ignore errors */
|
||||
if (!fsrv->debug) {
|
||||
|
||||
r.rlim_max = r.rlim_cur = 0;
|
||||
setrlimit(RLIMIT_CORE, &r); /* Ignore errors */
|
||||
|
||||
}
|
||||
|
||||
/* Isolate the process and configure standard descriptors. If out_file is
|
||||
specified, stdin is /dev/null; otherwise, out_fd is cloned instead. */
|
||||
@ -483,7 +507,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
|
||||
|
||||
if (!getenv("LD_BIND_LAZY")) { setenv("LD_BIND_NOW", "1", 1); }
|
||||
|
||||
/* Set sane defaults for ASAN if nothing else specified. */
|
||||
/* Set sane defaults for ASAN if nothing else is specified. */
|
||||
|
||||
if (!getenv("ASAN_OPTIONS"))
|
||||
setenv("ASAN_OPTIONS",
|
||||
@ -500,7 +524,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
|
||||
"handle_sigill=0",
|
||||
1);
|
||||
|
||||
/* Set sane defaults for UBSAN if nothing else specified. */
|
||||
/* Set sane defaults for UBSAN if nothing else is specified. */
|
||||
|
||||
if (!getenv("UBSAN_OPTIONS"))
|
||||
setenv("UBSAN_OPTIONS",
|
||||
@ -538,6 +562,16 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
|
||||
"handle_sigill=0",
|
||||
1);
|
||||
|
||||
/* LSAN, too, does not support abort_on_error=1. */
|
||||
|
||||
if (!getenv("LSAN_OPTIONS"))
|
||||
setenv("LSAN_OPTIONS",
|
||||
"exitcode=" STRINGIFY(LSAN_ERROR) ":"
|
||||
"fast_unwind_on_malloc=0:"
|
||||
"symbolize=0:"
|
||||
"print_suppressions=0",
|
||||
1);
|
||||
|
||||
fsrv->init_child_func(fsrv, argv);
|
||||
|
||||
/* Use a distinctive bitmap signature to tell the parent about execv()
|
||||
@ -792,7 +826,9 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
|
||||
|
||||
if (fsrv->last_run_timed_out) {
|
||||
|
||||
FATAL("Timeout while initializing fork server (adjusting -t may help)");
|
||||
FATAL(
|
||||
"Timeout while initializing fork server (setting "
|
||||
"AFL_FORKSRV_INIT_TMOUT may help)");
|
||||
|
||||
}
|
||||
|
||||
@ -1032,7 +1068,33 @@ u32 afl_fsrv_get_mapsize(afl_forkserver_t *fsrv, char **argv,
|
||||
|
||||
void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
|
||||
|
||||
if (likely(fsrv->use_shmem_fuzz && fsrv->shmem_fuzz)) {
|
||||
#ifdef AFL_PERSISTENT_RECORD
|
||||
if (unlikely(fsrv->persistent_record)) {
|
||||
|
||||
fsrv->persistent_record_len[fsrv->persistent_record_idx] = len;
|
||||
fsrv->persistent_record_data[fsrv->persistent_record_idx] = afl_realloc(
|
||||
(void **)&fsrv->persistent_record_data[fsrv->persistent_record_idx],
|
||||
len);
|
||||
|
||||
if (unlikely(!fsrv->persistent_record_data[fsrv->persistent_record_idx])) {
|
||||
|
||||
FATAL("allocating replay memory failed.");
|
||||
|
||||
}
|
||||
|
||||
memcpy(fsrv->persistent_record_data[fsrv->persistent_record_idx], buf, len);
|
||||
|
||||
if (unlikely(++fsrv->persistent_record_idx >= fsrv->persistent_record)) {
|
||||
|
||||
fsrv->persistent_record_idx = 0;
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
if (likely(fsrv->use_shmem_fuzz)) {
|
||||
|
||||
if (unlikely(len > MAX_FILE)) len = MAX_FILE;
|
||||
|
||||
@ -1146,6 +1208,26 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
|
||||
|
||||
}
|
||||
|
||||
#ifdef AFL_PERSISTENT_RECORD
|
||||
// end of persistent loop?
|
||||
if (unlikely(fsrv->persistent_record &&
|
||||
fsrv->persistent_record_pid != fsrv->child_pid)) {
|
||||
|
||||
fsrv->persistent_record_pid = fsrv->child_pid;
|
||||
u32 idx, val;
|
||||
if (unlikely(!fsrv->persistent_record_idx))
|
||||
idx = fsrv->persistent_record - 1;
|
||||
else
|
||||
idx = fsrv->persistent_record_idx - 1;
|
||||
val = fsrv->persistent_record_len[idx];
|
||||
memset((void *)fsrv->persistent_record_len, 0,
|
||||
fsrv->persistent_record * sizeof(u32));
|
||||
fsrv->persistent_record_len[idx] = val;
|
||||
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
if (fsrv->child_pid <= 0) {
|
||||
|
||||
if (*stop_soon_p) { return 0; }
|
||||
@ -1238,12 +1320,47 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
|
||||
if (unlikely(
|
||||
/* A normal crash/abort */
|
||||
(WIFSIGNALED(fsrv->child_status)) ||
|
||||
/* special handling for msan */
|
||||
(fsrv->uses_asan && WEXITSTATUS(fsrv->child_status) == MSAN_ERROR) ||
|
||||
/* special handling for msan and lsan */
|
||||
(fsrv->uses_asan &&
|
||||
(WEXITSTATUS(fsrv->child_status) == MSAN_ERROR ||
|
||||
WEXITSTATUS(fsrv->child_status) == LSAN_ERROR)) ||
|
||||
/* the custom crash_exitcode was returned by the target */
|
||||
(fsrv->uses_crash_exitcode &&
|
||||
WEXITSTATUS(fsrv->child_status) == fsrv->crash_exitcode))) {
|
||||
|
||||
#ifdef AFL_PERSISTENT_RECORD
|
||||
if (unlikely(fsrv->persistent_record)) {
|
||||
|
||||
char fn[PATH_MAX];
|
||||
u32 i, writecnt = 0;
|
||||
for (i = 0; i < fsrv->persistent_record; ++i) {
|
||||
|
||||
u32 entry = (i + fsrv->persistent_record_idx) % fsrv->persistent_record;
|
||||
u8 *data = fsrv->persistent_record_data[entry];
|
||||
u32 len = fsrv->persistent_record_len[entry];
|
||||
if (likely(len && data)) {
|
||||
|
||||
snprintf(fn, sizeof(fn), "%s/RECORD:%06u,cnt:%06u",
|
||||
fsrv->persistent_record_dir, fsrv->persistent_record_cnt,
|
||||
writecnt++);
|
||||
int fd = open(fn, O_CREAT | O_TRUNC | O_WRONLY, 0644);
|
||||
if (fd >= 0) {
|
||||
|
||||
ck_write(fd, data, len, fn);
|
||||
close(fd);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
++fsrv->persistent_record_cnt;
|
||||
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
/* For a proper crash, set last_kill_signal to WTERMSIG, else set it to 0 */
|
||||
fsrv->last_kill_signal =
|
||||
WIFSIGNALED(fsrv->child_status) ? WTERMSIG(fsrv->child_status) : 0;
|
||||
|
||||
@ -397,7 +397,7 @@ u8 *describe_op(afl_state_t *afl, u8 new_bits, size_t max_description_len) {
|
||||
|
||||
/* Write a message accompanying the crash directory :-) */
|
||||
|
||||
static void write_crash_readme(afl_state_t *afl) {
|
||||
void write_crash_readme(afl_state_t *afl) {
|
||||
|
||||
u8 fn[PATH_MAX];
|
||||
s32 fd;
|
||||
|
||||
@ -35,7 +35,7 @@ void cmplog_exec_child(afl_forkserver_t *fsrv, char **argv) {
|
||||
|
||||
if (fsrv->qemu_mode) { setenv("AFL_DISABLE_LLVM_INSTRUMENTATION", "1", 0); }
|
||||
|
||||
if (!fsrv->qemu_mode && argv[0] != fsrv->cmplog_binary) {
|
||||
if (!fsrv->qemu_mode && !fsrv->frida_mode && argv[0] != fsrv->cmplog_binary) {
|
||||
|
||||
argv[0] = fsrv->cmplog_binary;
|
||||
|
||||
|
||||
@ -130,6 +130,20 @@ void load_extras_file(afl_state_t *afl, u8 *fname, u32 *min_len, u32 *max_len,
|
||||
|
||||
}
|
||||
|
||||
/* Skip [number] */
|
||||
|
||||
if (*lptr == '[') {
|
||||
|
||||
do {
|
||||
|
||||
++lptr;
|
||||
|
||||
} while (*lptr >= '0' && *lptr <= '9');
|
||||
|
||||
if (*lptr == ']') { ++lptr; }
|
||||
|
||||
}
|
||||
|
||||
/* Skip whitespace and = signs. */
|
||||
|
||||
while (isspace(*lptr) || *lptr == '=') {
|
||||
|
||||
@ -113,7 +113,7 @@ void bind_to_free_cpu(afl_state_t *afl) {
|
||||
u8 lockfile[PATH_MAX] = "";
|
||||
s32 i;
|
||||
|
||||
if (afl->afl_env.afl_no_affinity) {
|
||||
if (afl->afl_env.afl_no_affinity && !afl->afl_env.afl_try_affinity) {
|
||||
|
||||
if (afl->cpu_to_bind != -1) {
|
||||
|
||||
@ -130,10 +130,21 @@ void bind_to_free_cpu(afl_state_t *afl) {
|
||||
|
||||
if (!bind_cpu(afl, afl->cpu_to_bind)) {
|
||||
|
||||
FATAL(
|
||||
"Could not bind to requested CPU %d! Make sure you passed a valid "
|
||||
"-b.",
|
||||
afl->cpu_to_bind);
|
||||
if (afl->afl_env.afl_try_affinity) {
|
||||
|
||||
WARNF(
|
||||
"Could not bind to requested CPU %d! Make sure you passed a valid "
|
||||
"-b.",
|
||||
afl->cpu_to_bind);
|
||||
|
||||
} else {
|
||||
|
||||
FATAL(
|
||||
"Could not bind to requested CPU %d! Make sure you passed a valid "
|
||||
"-b.",
|
||||
afl->cpu_to_bind);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@ -420,11 +431,14 @@ void bind_to_free_cpu(afl_state_t *afl) {
|
||||
"Uh-oh, looks like all %d CPU cores on your system are allocated to\n"
|
||||
" other instances of afl-fuzz (or similar CPU-locked tasks). "
|
||||
"Starting\n"
|
||||
" another fuzzer on this machine is probably a bad plan, but if "
|
||||
"you are\n"
|
||||
" absolutely sure, you can set AFL_NO_AFFINITY and try again.\n",
|
||||
afl->cpu_core_count);
|
||||
FATAL("No more free CPU cores");
|
||||
" another fuzzer on this machine is probably a bad plan.\n"
|
||||
"%s",
|
||||
afl->cpu_core_count,
|
||||
afl->afl_env.afl_try_affinity ? ""
|
||||
: " If you are sure, you can set "
|
||||
"AFL_NO_AFFINITY and try again.\n");
|
||||
|
||||
if (!afl->afl_env.afl_try_affinity) { FATAL("No more free CPU cores"); }
|
||||
|
||||
}
|
||||
|
||||
@ -823,7 +837,6 @@ void perform_dry_run(afl_state_t *afl) {
|
||||
|
||||
struct queue_entry *q;
|
||||
u32 cal_failures = 0, idx;
|
||||
u8 * skip_crashes = afl->afl_env.afl_skip_crashes;
|
||||
u8 * use_mem;
|
||||
|
||||
for (idx = 0; idx < afl->queued_paths; idx++) {
|
||||
@ -881,7 +894,7 @@ void perform_dry_run(afl_state_t *afl) {
|
||||
|
||||
case FSRV_RUN_TMOUT:
|
||||
|
||||
if (afl->timeout_given) {
|
||||
if (afl->timeout_given && !afl->afl_env.afl_exit_on_seed_issues) {
|
||||
|
||||
/* if we have a timeout but a timeout value was given then always
|
||||
skip. The '+' meaning has been changed! */
|
||||
@ -923,27 +936,6 @@ void perform_dry_run(afl_state_t *afl) {
|
||||
|
||||
if (afl->crash_mode) { break; }
|
||||
|
||||
if (skip_crashes) {
|
||||
|
||||
if (afl->fsrv.uses_crash_exitcode) {
|
||||
|
||||
WARNF(
|
||||
"Test case results in a crash or AFL_CRASH_EXITCODE %d "
|
||||
"(skipping)",
|
||||
(int)(s8)afl->fsrv.crash_exitcode);
|
||||
|
||||
} else {
|
||||
|
||||
WARNF("Test case results in a crash (skipping)");
|
||||
|
||||
}
|
||||
|
||||
q->cal_failed = CAL_CHANCES;
|
||||
++cal_failures;
|
||||
break;
|
||||
|
||||
}
|
||||
|
||||
if (afl->fsrv.mem_limit) {
|
||||
|
||||
u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
|
||||
@ -1036,20 +1028,24 @@ void perform_dry_run(afl_state_t *afl) {
|
||||
|
||||
}
|
||||
|
||||
if (afl->afl_env.afl_exit_on_seed_issues) {
|
||||
|
||||
FATAL("As AFL_EXIT_ON_SEED_ISSUES is set, afl-fuzz exits.");
|
||||
|
||||
}
|
||||
|
||||
/* Remove from fuzzing queue but keep for splicing */
|
||||
|
||||
struct queue_entry *p = afl->queue;
|
||||
if (!q->was_fuzzed) {
|
||||
|
||||
if (!p->was_fuzzed) {
|
||||
|
||||
p->was_fuzzed = 1;
|
||||
q->was_fuzzed = 1;
|
||||
--afl->pending_not_fuzzed;
|
||||
--afl->active_paths;
|
||||
|
||||
}
|
||||
|
||||
p->disabled = 1;
|
||||
p->perf_score = 0;
|
||||
q->disabled = 1;
|
||||
q->perf_score = 0;
|
||||
|
||||
u32 i = 0;
|
||||
while (unlikely(i < afl->queued_paths && afl->queue_buf[i] &&
|
||||
@ -1113,14 +1109,12 @@ void perform_dry_run(afl_state_t *afl) {
|
||||
|
||||
if (cal_failures == afl->queued_paths) {
|
||||
|
||||
FATAL("All test cases time out%s, giving up!",
|
||||
skip_crashes ? " or crash" : "");
|
||||
FATAL("All test cases time out or crash, giving up!");
|
||||
|
||||
}
|
||||
|
||||
WARNF("Skipped %u test cases (%0.02f%%) due to timeouts%s.", cal_failures,
|
||||
((double)cal_failures) * 100 / afl->queued_paths,
|
||||
skip_crashes ? " or crashes" : "");
|
||||
WARNF("Skipped %u test cases (%0.02f%%) due to timeouts or crashes.",
|
||||
cal_failures, ((double)cal_failures) * 100 / afl->queued_paths);
|
||||
|
||||
if (cal_failures * 5 > afl->queued_paths) {
|
||||
|
||||
@ -1288,9 +1282,13 @@ void pivot_inputs(afl_state_t *afl) {
|
||||
|
||||
if (src_str && sscanf(src_str + 1, "%06u", &src_id) == 1) {
|
||||
|
||||
struct queue_entry *s = afl->queue_buf[src_id];
|
||||
if (src_id < afl->queued_paths) {
|
||||
|
||||
if (s) { q->depth = s->depth + 1; }
|
||||
struct queue_entry *s = afl->queue_buf[src_id];
|
||||
|
||||
if (s) { q->depth = s->depth + 1; }
|
||||
|
||||
}
|
||||
|
||||
if (afl->max_depth < q->depth) { afl->max_depth = q->depth; }
|
||||
|
||||
@ -2025,7 +2023,7 @@ void setup_dirs_fds(afl_state_t *afl) {
|
||||
|
||||
fprintf(
|
||||
afl->fsrv.plot_file,
|
||||
"# unix_time, cycles_done, cur_path, paths_total, "
|
||||
"# relative_time, cycles_done, cur_path, paths_total, "
|
||||
"pending_total, pending_favs, map_size, unique_crashes, "
|
||||
"unique_hangs, max_depth, execs_per_sec, total_execs, edges_found\n");
|
||||
|
||||
@ -2490,6 +2488,18 @@ void check_asan_opts(afl_state_t *afl) {
|
||||
|
||||
}
|
||||
|
||||
x = get_afl_env("LSAN_OPTIONS");
|
||||
|
||||
if (x) {
|
||||
|
||||
if (!strstr(x, "symbolize=0")) {
|
||||
|
||||
FATAL("Custom LSAN_OPTIONS set without symbolize=0 - please fix!");
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
/* Handle stop signal (Ctrl-C, etc). */
|
||||
@ -2692,7 +2702,7 @@ void check_binary(afl_state_t *afl, u8 *fname) {
|
||||
|
||||
#endif /* ^!__APPLE__ */
|
||||
|
||||
if (!afl->fsrv.qemu_mode && !afl->unicorn_mode &&
|
||||
if (!afl->fsrv.qemu_mode && !afl->fsrv.frida_mode && !afl->unicorn_mode &&
|
||||
!afl->non_instrumented_mode &&
|
||||
!memmem(f_data, f_len, SHM_ENV_VAR, strlen(SHM_ENV_VAR) + 1)) {
|
||||
|
||||
@ -2708,11 +2718,15 @@ void check_binary(afl_state_t *afl, u8 *fname) {
|
||||
" When source code is not available, you may be able to leverage "
|
||||
"QEMU\n"
|
||||
" mode support. Consult the README.md for tips on how to enable "
|
||||
"this.\n"
|
||||
"this.\n\n"
|
||||
|
||||
" If your target is an instrumented binary (e.g. with zafl, "
|
||||
"retrowrite,\n"
|
||||
" etc.) then set 'AFL_SKIP_BIN_CHECK=1'\n\n"
|
||||
|
||||
" (It is also possible to use afl-fuzz as a traditional, "
|
||||
"non-instrumented fuzzer.\n"
|
||||
" For that, you can use the -n option - but expect much worse "
|
||||
"non-instrumented\n"
|
||||
" fuzzer. For that use the -n option - but expect much worse "
|
||||
"results.)\n",
|
||||
doc_path);
|
||||
|
||||
@ -2720,7 +2734,7 @@ void check_binary(afl_state_t *afl, u8 *fname) {
|
||||
|
||||
}
|
||||
|
||||
if ((afl->fsrv.qemu_mode) &&
|
||||
if ((afl->fsrv.qemu_mode || afl->fsrv.frida_mode) &&
|
||||
memmem(f_data, f_len, SHM_ENV_VAR, strlen(SHM_ENV_VAR) + 1)) {
|
||||
|
||||
SAYF("\n" cLRD "[-] " cRST
|
||||
@ -2735,7 +2749,8 @@ void check_binary(afl_state_t *afl, u8 *fname) {
|
||||
}
|
||||
|
||||
if (memmem(f_data, f_len, "__asan_init", 11) ||
|
||||
memmem(f_data, f_len, "__msan_init", 11)) {
|
||||
memmem(f_data, f_len, "__msan_init", 11) ||
|
||||
memmem(f_data, f_len, "__lsan_init", 11)) {
|
||||
|
||||
afl->fsrv.uses_asan = 1;
|
||||
|
||||
@ -2755,9 +2770,18 @@ void check_binary(afl_state_t *afl, u8 *fname) {
|
||||
|
||||
WARNF("AFL_PERSISTENT is no longer supported and may misbehave!");
|
||||
|
||||
} else if (getenv("AFL_FRIDA_PERSISTENT_ADDR")) {
|
||||
|
||||
OKF("FRIDA Persistent mode configuration options detected.");
|
||||
setenv(PERSIST_ENV_VAR, "1", 1);
|
||||
afl->persistent_mode = 1;
|
||||
|
||||
afl->shmem_testcase_mode = 1;
|
||||
|
||||
}
|
||||
|
||||
if (memmem(f_data, f_len, DEFER_SIG, strlen(DEFER_SIG) + 1)) {
|
||||
if (afl->fsrv.frida_mode ||
|
||||
memmem(f_data, f_len, DEFER_SIG, strlen(DEFER_SIG) + 1)) {
|
||||
|
||||
OKF(cPIN "Deferred forkserver binary detected.");
|
||||
setenv(DEFER_ENV_VAR, "1", 1);
|
||||
|
||||
@ -308,9 +308,11 @@ struct custom_mutator *load_custom_mutator(afl_state_t *afl, const char *fn) {
|
||||
u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
|
||||
struct custom_mutator *mutator) {
|
||||
|
||||
u8 needs_write = 0, fault = 0;
|
||||
u8 fault = 0;
|
||||
u32 trim_exec = 0;
|
||||
u32 orig_len = q->len;
|
||||
u32 out_len = 0;
|
||||
u8 *out_buf = NULL;
|
||||
|
||||
u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
|
||||
|
||||
@ -397,27 +399,33 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
|
||||
|
||||
if (likely(retlen && cksum == q->exec_cksum)) {
|
||||
|
||||
q->len = retlen;
|
||||
memcpy(in_buf, retbuf, retlen);
|
||||
|
||||
/* Let's save a clean trace, which will be needed by
|
||||
update_bitmap_score once we're done with the trimming stuff. */
|
||||
update_bitmap_score once we're done with the trimming stuff.
|
||||
Use out_buf NULL check to make this only happen once per trim. */
|
||||
|
||||
if (!needs_write) {
|
||||
if (!out_buf) {
|
||||
|
||||
needs_write = 1;
|
||||
memcpy(afl->clean_trace_custom, afl->fsrv.trace_bits,
|
||||
afl->fsrv.map_size);
|
||||
|
||||
}
|
||||
|
||||
if (afl_realloc((void **)&out_buf, retlen) == NULL) {
|
||||
|
||||
FATAL("can not allocate memory for trim");
|
||||
|
||||
}
|
||||
|
||||
out_len = retlen;
|
||||
memcpy(out_buf, retbuf, retlen);
|
||||
|
||||
/* Tell the custom mutator that the trimming was successful */
|
||||
afl->stage_cur = mutator->afl_custom_post_trim(mutator->data, 1);
|
||||
|
||||
if (afl->not_on_tty && afl->debug) {
|
||||
|
||||
SAYF("[Custom Trimming] SUCCESS: %u/%u iterations (now at %u bytes)",
|
||||
afl->stage_cur, afl->stage_max, q->len);
|
||||
afl->stage_cur, afl->stage_max, out_len);
|
||||
|
||||
}
|
||||
|
||||
@ -450,16 +458,10 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
|
||||
|
||||
}
|
||||
|
||||
if (afl->not_on_tty && afl->debug) {
|
||||
|
||||
SAYF("[Custom Trimming] DONE: %u bytes -> %u bytes", orig_len, q->len);
|
||||
|
||||
}
|
||||
|
||||
/* If we have made changes to in_buf, we also need to update the on-disk
|
||||
/* If we have made changes, we also need to update the on-disk
|
||||
version of the test case. */
|
||||
|
||||
if (needs_write) {
|
||||
if (out_buf) {
|
||||
|
||||
s32 fd;
|
||||
|
||||
@ -469,16 +471,28 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
|
||||
|
||||
if (fd < 0) { PFATAL("Unable to create '%s'", q->fname); }
|
||||
|
||||
ck_write(fd, in_buf, q->len, q->fname);
|
||||
ck_write(fd, out_buf, out_len, q->fname);
|
||||
close(fd);
|
||||
|
||||
/* Update the queue's knowledge of length as soon as we write the file.
|
||||
We do this here so that exit/error cases that *don't* update the file
|
||||
also don't update q->len. */
|
||||
q->len = out_len;
|
||||
|
||||
memcpy(afl->fsrv.trace_bits, afl->clean_trace_custom, afl->fsrv.map_size);
|
||||
update_bitmap_score(afl, q);
|
||||
|
||||
}
|
||||
|
||||
if (afl->not_on_tty && afl->debug) {
|
||||
|
||||
SAYF("[Custom Trimming] DONE: %u bytes -> %u bytes", orig_len, q->len);
|
||||
|
||||
}
|
||||
|
||||
abort_trimming:
|
||||
|
||||
if (out_buf) afl_free(out_buf);
|
||||
afl->bytes_trim_out += q->len;
|
||||
return fault;
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -212,7 +212,7 @@ static py_mutator_t *init_py_module(afl_state_t *afl, u8 *module_name) {
|
||||
PyObject_GetAttrString(py_module, "introspection");
|
||||
py_functions[PY_FUNC_DEINIT] = PyObject_GetAttrString(py_module, "deinit");
|
||||
if (!py_functions[PY_FUNC_DEINIT])
|
||||
FATAL("deinit function not found in python module");
|
||||
WARNF("deinit function not found in python module");
|
||||
|
||||
for (py_idx = 0; py_idx < PY_FUNC_COUNT; ++py_idx) {
|
||||
|
||||
|
||||
@ -478,7 +478,11 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
|
||||
u8 *fname_orig = NULL;
|
||||
|
||||
/* At the initialization stage, queue_cur is NULL */
|
||||
if (afl->queue_cur) fname_orig = afl->queue_cur->fname;
|
||||
if (afl->queue_cur && !afl->syncing_party) {
|
||||
|
||||
fname_orig = afl->queue_cur->fname;
|
||||
|
||||
}
|
||||
|
||||
el->afl_custom_queue_new_entry(el->data, fname, fname_orig);
|
||||
|
||||
|
||||
@ -437,8 +437,8 @@ static u8 colorization(afl_state_t *afl, u8 *buf, u32 len,
|
||||
|
||||
if (taint) {
|
||||
|
||||
if (afl->colorize_success &&
|
||||
(len / positions == 1 && positions > CMPLOG_POSITIONS_MAX &&
|
||||
if (afl->colorize_success && afl->cmplog_lvl < 3 &&
|
||||
(positions > CMPLOG_POSITIONS_MAX && len / positions == 1 &&
|
||||
afl->active_paths / afl->colorize_success > CMPLOG_CORPUS_PERCENT)) {
|
||||
|
||||
#ifdef _DEBUG
|
||||
@ -1749,6 +1749,12 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
|
||||
|
||||
#endif
|
||||
|
||||
#ifdef _DEBUG
|
||||
if (o->v0 != orig_o->v0 || o->v1 != orig_o->v1)
|
||||
fprintf(stderr, "key=%u idx=%u o0=%llu v0=%llu o1=%llu v1=%llu\n", key,
|
||||
idx, orig_o->v0, o->v0, orig_o->v1, o->v1);
|
||||
#endif
|
||||
|
||||
// even for u128 and _ExtInt we do cmp_extend_encoding() because
|
||||
// if we got here their own special trials failed and it might just be
|
||||
// a cast from e.g. u64 to u128 from the input data.
|
||||
@ -2365,6 +2371,24 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
|
||||
|
||||
status = 0;
|
||||
|
||||
#ifdef _DEBUG
|
||||
int w;
|
||||
fprintf(stderr, "key=%u idx=%u len=%u o0=", key, idx,
|
||||
SHAPE_BYTES(h->shape));
|
||||
for (w = 0; w < SHAPE_BYTES(h->shape); ++w)
|
||||
fprintf(stderr, "%02x", orig_o->v0[w]);
|
||||
fprintf(stderr, " v0=");
|
||||
for (w = 0; w < SHAPE_BYTES(h->shape); ++w)
|
||||
fprintf(stderr, "%02x", o->v0[w]);
|
||||
fprintf(stderr, " o1=");
|
||||
for (w = 0; w < SHAPE_BYTES(h->shape); ++w)
|
||||
fprintf(stderr, "%02x", orig_o->v1[w]);
|
||||
fprintf(stderr, " v1=");
|
||||
for (w = 0; w < SHAPE_BYTES(h->shape); ++w)
|
||||
fprintf(stderr, "%02x", o->v1[w]);
|
||||
fprintf(stderr, "\n");
|
||||
#endif
|
||||
|
||||
if (unlikely(rtn_extend_encoding(
|
||||
afl, o->v0, o->v1, orig_o->v0, orig_o->v1, SHAPE_BYTES(h->shape),
|
||||
idx, taint_len, orig_buf, buf, cbuf, len, lvl, &status))) {
|
||||
|
||||
@ -107,27 +107,21 @@ write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
|
||||
new_size =
|
||||
el->afl_custom_post_process(el->data, new_mem, new_size, &new_buf);
|
||||
|
||||
}
|
||||
if (unlikely(!new_buf && new_size <= 0)) {
|
||||
|
||||
new_mem = new_buf;
|
||||
FATAL("Custom_post_process failed (ret: %lu)",
|
||||
(long unsigned)new_size);
|
||||
|
||||
}
|
||||
|
||||
new_mem = new_buf;
|
||||
|
||||
}
|
||||
|
||||
});
|
||||
|
||||
if (unlikely(!new_buf && (new_size <= 0))) {
|
||||
|
||||
FATAL("Custom_post_process failed (ret: %lu)", (long unsigned)new_size);
|
||||
|
||||
} else if (likely(new_buf)) {
|
||||
|
||||
/* everything as planned. use the new data. */
|
||||
afl_fsrv_write_to_testcase(&afl->fsrv, new_buf, new_size);
|
||||
|
||||
} else {
|
||||
|
||||
/* custom mutators do not has a custom_post_process function */
|
||||
afl_fsrv_write_to_testcase(&afl->fsrv, mem, len);
|
||||
|
||||
}
|
||||
/* everything as planned. use the potentially new data. */
|
||||
afl_fsrv_write_to_testcase(&afl->fsrv, new_mem, new_size);
|
||||
|
||||
} else {
|
||||
|
||||
@ -188,22 +182,22 @@ static void write_with_gap(afl_state_t *afl, u8 *mem, u32 len, u32 skip_at,
|
||||
new_size =
|
||||
el->afl_custom_post_process(el->data, new_mem, new_size, &new_buf);
|
||||
|
||||
if (unlikely(!new_buf || (new_size <= 0))) {
|
||||
if (unlikely(!new_buf || new_size <= 0)) {
|
||||
|
||||
FATAL("Custom_post_process failed (ret: %lu)",
|
||||
(long unsigned)new_size);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
new_mem = new_buf;
|
||||
|
||||
new_mem = new_buf;
|
||||
}
|
||||
|
||||
});
|
||||
|
||||
}
|
||||
|
||||
if (afl->fsrv.shmem_fuzz) {
|
||||
if (likely(afl->fsrv.use_shmem_fuzz)) {
|
||||
|
||||
if (!post_process_skipped) {
|
||||
|
||||
@ -211,9 +205,7 @@ static void write_with_gap(afl_state_t *afl, u8 *mem, u32 len, u32 skip_at,
|
||||
|
||||
memcpy(afl->fsrv.shmem_fuzz, new_mem, new_size);
|
||||
|
||||
}
|
||||
|
||||
else {
|
||||
} else {
|
||||
|
||||
memcpy(afl->fsrv.shmem_fuzz, mem, skip_at);
|
||||
|
||||
@ -244,7 +236,7 @@ static void write_with_gap(afl_state_t *afl, u8 *mem, u32 len, u32 skip_at,
|
||||
|
||||
return;
|
||||
|
||||
} else if (afl->fsrv.out_file) {
|
||||
} else if (unlikely(!afl->fsrv.use_stdin)) {
|
||||
|
||||
if (unlikely(afl->no_unlink)) {
|
||||
|
||||
@ -279,7 +271,7 @@ static void write_with_gap(afl_state_t *afl, u8 *mem, u32 len, u32 skip_at,
|
||||
|
||||
}
|
||||
|
||||
if (!afl->fsrv.out_file) {
|
||||
if (afl->fsrv.use_stdin) {
|
||||
|
||||
if (ftruncate(fd, new_size)) { PFATAL("ftruncate() failed"); }
|
||||
lseek(fd, 0, SEEK_SET);
|
||||
@ -412,7 +404,7 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
|
||||
}
|
||||
|
||||
var_detected = 1;
|
||||
afl->stage_max = CAL_CYCLES_LONG;
|
||||
afl->stage_max = afl->fast_cal ? CAL_CYCLES : CAL_CYCLES_LONG;
|
||||
|
||||
} else {
|
||||
|
||||
@ -712,6 +704,7 @@ void sync_fuzzers(afl_state_t *afl) {
|
||||
if (afl->foreign_sync_cnt) read_foreign_testcases(afl, 0);
|
||||
|
||||
afl->last_sync_time = get_cur_time();
|
||||
afl->last_sync_cycle = afl->queue_cycle;
|
||||
|
||||
}
|
||||
|
||||
|
||||
@ -99,10 +99,11 @@ void afl_state_init(afl_state_t *afl, uint32_t map_size) {
|
||||
afl->cal_cycles = CAL_CYCLES;
|
||||
afl->cal_cycles_long = CAL_CYCLES_LONG;
|
||||
afl->hang_tmout = EXEC_TIMEOUT;
|
||||
afl->exit_on_time = 0;
|
||||
afl->stats_update_freq = 1;
|
||||
afl->stats_avg_exec = 0;
|
||||
afl->skip_deterministic = 1;
|
||||
afl->cmplog_lvl = 1;
|
||||
afl->cmplog_lvl = 2;
|
||||
#ifndef NO_SPLICING
|
||||
afl->use_splicing = 1;
|
||||
#endif
|
||||
@ -187,6 +188,13 @@ void read_afl_environment(afl_state_t *afl, char **envp) {
|
||||
afl->afl_env.afl_exit_when_done =
|
||||
get_afl_env(afl_environment_variables[i]) ? 1 : 0;
|
||||
|
||||
} else if (!strncmp(env, "AFL_EXIT_ON_TIME",
|
||||
|
||||
afl_environment_variable_len)) {
|
||||
|
||||
afl->afl_env.afl_exit_on_time =
|
||||
(u8 *)get_afl_env(afl_environment_variables[i]);
|
||||
|
||||
} else if (!strncmp(env, "AFL_NO_AFFINITY",
|
||||
|
||||
afl_environment_variable_len)) {
|
||||
@ -194,12 +202,18 @@ void read_afl_environment(afl_state_t *afl, char **envp) {
|
||||
afl->afl_env.afl_no_affinity =
|
||||
get_afl_env(afl_environment_variables[i]) ? 1 : 0;
|
||||
|
||||
} else if (!strncmp(env, "AFL_TRY_AFFINITY",
|
||||
|
||||
afl_environment_variable_len)) {
|
||||
|
||||
afl->afl_env.afl_try_affinity =
|
||||
get_afl_env(afl_environment_variables[i]) ? 1 : 0;
|
||||
|
||||
} else if (!strncmp(env, "AFL_SKIP_CRASHES",
|
||||
|
||||
afl_environment_variable_len)) {
|
||||
|
||||
afl->afl_env.afl_skip_crashes =
|
||||
(u8 *)get_afl_env(afl_environment_variables[i]);
|
||||
// we should mark this obsolete in a few versions
|
||||
|
||||
} else if (!strncmp(env, "AFL_HANG_TMOUT",
|
||||
|
||||
@ -292,6 +306,13 @@ void read_afl_environment(afl_state_t *afl, char **envp) {
|
||||
afl->afl_env.afl_autoresume =
|
||||
get_afl_env(afl_environment_variables[i]) ? 1 : 0;
|
||||
|
||||
} else if (!strncmp(env, "AFL_PERSISTENT_RECORD",
|
||||
|
||||
afl_environment_variable_len)) {
|
||||
|
||||
afl->afl_env.afl_persistent_record =
|
||||
get_afl_env(afl_environment_variables[i]);
|
||||
|
||||
} else if (!strncmp(env, "AFL_CYCLE_SCHEDULES",
|
||||
|
||||
afl_environment_variable_len)) {
|
||||
@ -299,6 +320,13 @@ void read_afl_environment(afl_state_t *afl, char **envp) {
|
||||
afl->cycle_schedules = afl->afl_env.afl_cycle_schedules =
|
||||
get_afl_env(afl_environment_variables[i]) ? 1 : 0;
|
||||
|
||||
} else if (!strncmp(env, "AFL_EXIT_ON_SEED_ISSUES",
|
||||
|
||||
afl_environment_variable_len)) {
|
||||
|
||||
afl->afl_env.afl_exit_on_seed_issues =
|
||||
get_afl_env(afl_environment_variables[i]) ? 1 : 0;
|
||||
|
||||
} else if (!strncmp(env, "AFL_EXPAND_HAVOC_NOW",
|
||||
|
||||
afl_environment_variable_len)) {
|
||||
|
||||
@ -179,6 +179,8 @@ void load_stats_file(afl_state_t *afl) {
|
||||
|
||||
}
|
||||
|
||||
if (afl->unique_crashes) { write_crash_readme(afl); }
|
||||
|
||||
return;
|
||||
|
||||
}
|
||||
@ -355,18 +357,19 @@ void write_stats_file(afl_state_t *afl, u32 t_bytes, double bitmap_cvg,
|
||||
void maybe_update_plot_file(afl_state_t *afl, u32 t_bytes, double bitmap_cvg,
|
||||
double eps) {
|
||||
|
||||
if (unlikely(afl->stop_soon) ||
|
||||
unlikely(afl->plot_prev_qp == afl->queued_paths &&
|
||||
afl->plot_prev_pf == afl->pending_favored &&
|
||||
afl->plot_prev_pnf == afl->pending_not_fuzzed &&
|
||||
afl->plot_prev_ce == afl->current_entry &&
|
||||
afl->plot_prev_qc == afl->queue_cycle &&
|
||||
afl->plot_prev_uc == afl->unique_crashes &&
|
||||
afl->plot_prev_uh == afl->unique_hangs &&
|
||||
afl->plot_prev_md == afl->max_depth &&
|
||||
afl->plot_prev_ed == afl->fsrv.total_execs) ||
|
||||
unlikely(!afl->queue_cycle) ||
|
||||
unlikely(get_cur_time() - afl->start_time <= 60)) {
|
||||
if (unlikely(!afl->force_ui_update &&
|
||||
(afl->stop_soon ||
|
||||
(afl->plot_prev_qp == afl->queued_paths &&
|
||||
afl->plot_prev_pf == afl->pending_favored &&
|
||||
afl->plot_prev_pnf == afl->pending_not_fuzzed &&
|
||||
afl->plot_prev_ce == afl->current_entry &&
|
||||
afl->plot_prev_qc == afl->queue_cycle &&
|
||||
afl->plot_prev_uc == afl->unique_crashes &&
|
||||
afl->plot_prev_uh == afl->unique_hangs &&
|
||||
afl->plot_prev_md == afl->max_depth &&
|
||||
afl->plot_prev_ed == afl->fsrv.total_execs) ||
|
||||
!afl->queue_cycle ||
|
||||
get_cur_time() - afl->start_time <= 60000))) {
|
||||
|
||||
return;
|
||||
|
||||
@ -384,14 +387,14 @@ void maybe_update_plot_file(afl_state_t *afl, u32 t_bytes, double bitmap_cvg,
|
||||
|
||||
/* Fields in the file:
|
||||
|
||||
unix_time, afl->cycles_done, cur_path, paths_total, paths_not_fuzzed,
|
||||
relative_time, afl->cycles_done, cur_path, paths_total, paths_not_fuzzed,
|
||||
favored_not_fuzzed, unique_crashes, unique_hangs, max_depth,
|
||||
execs_per_sec, edges_found */
|
||||
|
||||
fprintf(afl->fsrv.plot_file,
|
||||
"%llu, %llu, %u, %u, %u, %u, %0.02f%%, %llu, %llu, %u, %0.02f, %llu, "
|
||||
"%u\n",
|
||||
(afl->prev_run_time + get_cur_time() - afl->start_time),
|
||||
((afl->prev_run_time + get_cur_time() - afl->start_time) / 1000),
|
||||
afl->queue_cycle - 1, afl->current_entry, afl->queued_paths,
|
||||
afl->pending_not_fuzzed, afl->pending_favored, bitmap_cvg,
|
||||
afl->unique_crashes, afl->unique_hangs, afl->max_depth, eps,
|
||||
@ -531,7 +534,8 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
/* Roughly every minute, update fuzzer stats and save auto tokens. */
|
||||
|
||||
if (cur_ms - afl->stats_last_stats_ms > STATS_UPDATE_SEC * 1000) {
|
||||
if (unlikely(afl->force_ui_update ||
|
||||
cur_ms - afl->stats_last_stats_ms > STATS_UPDATE_SEC * 1000)) {
|
||||
|
||||
afl->stats_last_stats_ms = cur_ms;
|
||||
write_stats_file(afl, t_bytes, t_byte_ratio, stab_ratio,
|
||||
@ -543,7 +547,8 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
if (unlikely(afl->afl_env.afl_statsd)) {
|
||||
|
||||
if (cur_ms - afl->statsd_last_send_ms > STATSD_UPDATE_SEC * 1000) {
|
||||
if (unlikely(afl->force_ui_update || cur_ms - afl->statsd_last_send_ms >
|
||||
STATSD_UPDATE_SEC * 1000)) {
|
||||
|
||||
/* reset counter, even if send failed. */
|
||||
afl->statsd_last_send_ms = cur_ms;
|
||||
@ -555,7 +560,8 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
/* Every now and then, write plot data. */
|
||||
|
||||
if (cur_ms - afl->stats_last_plot_ms > PLOT_UPDATE_SEC * 1000) {
|
||||
if (unlikely(afl->force_ui_update ||
|
||||
cur_ms - afl->stats_last_plot_ms > PLOT_UPDATE_SEC * 1000)) {
|
||||
|
||||
afl->stats_last_plot_ms = cur_ms;
|
||||
maybe_update_plot_file(afl, t_bytes, t_byte_ratio, afl->stats_avg_exec);
|
||||
@ -564,14 +570,24 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
/* Honor AFL_EXIT_WHEN_DONE and AFL_BENCH_UNTIL_CRASH. */
|
||||
|
||||
if (!afl->non_instrumented_mode && afl->cycles_wo_finds > 100 &&
|
||||
!afl->pending_not_fuzzed && afl->afl_env.afl_exit_when_done) {
|
||||
if (unlikely(!afl->non_instrumented_mode && afl->cycles_wo_finds > 100 &&
|
||||
!afl->pending_not_fuzzed && afl->afl_env.afl_exit_when_done)) {
|
||||
|
||||
afl->stop_soon = 2;
|
||||
|
||||
}
|
||||
|
||||
if (afl->total_crashes && afl->afl_env.afl_bench_until_crash) {
|
||||
/* AFL_EXIT_ON_TIME. */
|
||||
|
||||
if (unlikely(afl->last_path_time && !afl->non_instrumented_mode &&
|
||||
afl->afl_env.afl_exit_on_time &&
|
||||
(cur_ms - afl->last_path_time) > afl->exit_on_time)) {
|
||||
|
||||
afl->stop_soon = 2;
|
||||
|
||||
}
|
||||
|
||||
if (unlikely(afl->total_crashes && afl->afl_env.afl_bench_until_crash)) {
|
||||
|
||||
afl->stop_soon = 2;
|
||||
|
||||
@ -583,7 +599,7 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
/* If we haven't started doing things, bail out. */
|
||||
|
||||
if (!afl->queue_cur) { return; }
|
||||
if (unlikely(!afl->queue_cur)) { return; }
|
||||
|
||||
/* Compute some mildly useful bitmap stats. */
|
||||
|
||||
@ -602,7 +618,7 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
SAYF(TERM_HOME);
|
||||
|
||||
if (afl->term_too_small) {
|
||||
if (unlikely(afl->term_too_small)) {
|
||||
|
||||
SAYF(cBRI
|
||||
"Your terminal is too small to display the UI.\n"
|
||||
@ -861,9 +877,13 @@ void show_stats(afl_state_t *afl) {
|
||||
" fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA
|
||||
" path geometry " bSTG bH5 bH2 bVL "\n");
|
||||
|
||||
if (afl->skip_deterministic) {
|
||||
if (unlikely(afl->custom_only)) {
|
||||
|
||||
strcpy(tmp, "n/a, n/a, n/a");
|
||||
strcpy(tmp, "disabled (custom-mutator-only mode)");
|
||||
|
||||
} else if (likely(afl->skip_deterministic)) {
|
||||
|
||||
strcpy(tmp, "disabled (default, enable with -D)");
|
||||
|
||||
} else {
|
||||
|
||||
@ -881,7 +901,7 @@ void show_stats(afl_state_t *afl) {
|
||||
" levels : " cRST "%-10s" bSTG bV "\n",
|
||||
tmp, u_stringify_int(IB(0), afl->max_depth));
|
||||
|
||||
if (!afl->skip_deterministic) {
|
||||
if (unlikely(!afl->skip_deterministic)) {
|
||||
|
||||
sprintf(tmp, "%s/%s, %s/%s, %s/%s",
|
||||
u_stringify_int(IB(0), afl->stage_finds[STAGE_FLIP8]),
|
||||
@ -897,7 +917,7 @@ void show_stats(afl_state_t *afl) {
|
||||
" pending : " cRST "%-10s" bSTG bV "\n",
|
||||
tmp, u_stringify_int(IB(0), afl->pending_not_fuzzed));
|
||||
|
||||
if (!afl->skip_deterministic) {
|
||||
if (unlikely(!afl->skip_deterministic)) {
|
||||
|
||||
sprintf(tmp, "%s/%s, %s/%s, %s/%s",
|
||||
u_stringify_int(IB(0), afl->stage_finds[STAGE_ARITH8]),
|
||||
@ -913,7 +933,7 @@ void show_stats(afl_state_t *afl) {
|
||||
" pend fav : " cRST "%-10s" bSTG bV "\n",
|
||||
tmp, u_stringify_int(IB(0), afl->pending_favored));
|
||||
|
||||
if (!afl->skip_deterministic) {
|
||||
if (unlikely(!afl->skip_deterministic)) {
|
||||
|
||||
sprintf(tmp, "%s/%s, %s/%s, %s/%s",
|
||||
u_stringify_int(IB(0), afl->stage_finds[STAGE_INTEREST8]),
|
||||
@ -929,7 +949,7 @@ void show_stats(afl_state_t *afl) {
|
||||
" own finds : " cRST "%-10s" bSTG bV "\n",
|
||||
tmp, u_stringify_int(IB(0), afl->queued_discovered));
|
||||
|
||||
if (!afl->skip_deterministic) {
|
||||
if (unlikely(!afl->skip_deterministic)) {
|
||||
|
||||
sprintf(tmp, "%s/%s, %s/%s, %s/%s",
|
||||
u_stringify_int(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]),
|
||||
@ -939,6 +959,14 @@ void show_stats(afl_state_t *afl) {
|
||||
u_stringify_int(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]),
|
||||
u_stringify_int(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO]));
|
||||
|
||||
} else if (unlikely(!afl->extras_cnt || afl->custom_only)) {
|
||||
|
||||
strcpy(tmp, "n/a");
|
||||
|
||||
} else {
|
||||
|
||||
strcpy(tmp, "havoc mode");
|
||||
|
||||
}
|
||||
|
||||
SAYF(bV bSTOP " dictionary : " cRST "%-36s " bSTG bV bSTOP
|
||||
@ -974,35 +1002,57 @@ void show_stats(afl_state_t *afl) {
|
||||
: cRST),
|
||||
tmp);
|
||||
|
||||
if (afl->shm.cmplog_mode) {
|
||||
if (unlikely(afl->afl_env.afl_python_module)) {
|
||||
|
||||
sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s",
|
||||
sprintf(tmp, "%s/%s,",
|
||||
u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
|
||||
u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
|
||||
u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
|
||||
u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]),
|
||||
u_stringify_int(IB(4), afl->stage_finds[STAGE_COLORIZATION]),
|
||||
u_stringify_int(IB(5), afl->stage_cycles[STAGE_COLORIZATION]),
|
||||
u_stringify_int(IB(6), afl->stage_finds[STAGE_ITS]),
|
||||
u_stringify_int(IB(7), afl->stage_cycles[STAGE_ITS]));
|
||||
|
||||
SAYF(bV bSTOP " custom/rq : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
|
||||
tmp);
|
||||
u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]));
|
||||
|
||||
} else {
|
||||
|
||||
sprintf(tmp, "%s/%s, %s/%s",
|
||||
u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
|
||||
u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
|
||||
u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
|
||||
u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
|
||||
|
||||
SAYF(bV bSTOP " py/custom : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
|
||||
tmp);
|
||||
strcpy(tmp, "unused,");
|
||||
|
||||
}
|
||||
|
||||
if (!afl->bytes_trim_out) {
|
||||
if (unlikely(afl->afl_env.afl_custom_mutator_library)) {
|
||||
|
||||
strcat(tmp, " ");
|
||||
strcat(tmp, u_stringify_int(IB(2), afl->stage_finds[STAGE_PYTHON]));
|
||||
strcat(tmp, "/");
|
||||
strcat(tmp, u_stringify_int(IB(3), afl->stage_cycles[STAGE_PYTHON]));
|
||||
strcat(tmp, ",");
|
||||
|
||||
} else {
|
||||
|
||||
strcat(tmp, " unused,");
|
||||
|
||||
}
|
||||
|
||||
if (unlikely(afl->shm.cmplog_mode)) {
|
||||
|
||||
strcat(tmp, " ");
|
||||
strcat(tmp, u_stringify_int(IB(4), afl->stage_finds[STAGE_COLORIZATION]));
|
||||
strcat(tmp, "/");
|
||||
strcat(tmp, u_stringify_int(IB(5), afl->stage_cycles[STAGE_COLORIZATION]));
|
||||
strcat(tmp, ", ");
|
||||
strcat(tmp, u_stringify_int(IB(6), afl->stage_finds[STAGE_ITS]));
|
||||
strcat(tmp, "/");
|
||||
strcat(tmp, u_stringify_int(IB(7), afl->stage_cycles[STAGE_ITS]));
|
||||
|
||||
} else {
|
||||
|
||||
strcat(tmp, " unused, unused");
|
||||
|
||||
}
|
||||
|
||||
SAYF(bV bSTOP "py/custom/rq : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
|
||||
tmp);
|
||||
|
||||
if (likely(afl->disable_trim)) {
|
||||
|
||||
sprintf(tmp, "disabled, ");
|
||||
|
||||
} else if (unlikely(!afl->bytes_trim_out)) {
|
||||
|
||||
sprintf(tmp, "n/a, ");
|
||||
|
||||
@ -1015,12 +1065,13 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
}
|
||||
|
||||
if (!afl->blocks_eff_total) {
|
||||
if (likely(afl->skip_deterministic)) {
|
||||
|
||||
u8 tmp2[128];
|
||||
strcat(tmp, "disabled");
|
||||
|
||||
sprintf(tmp2, "n/a");
|
||||
strcat(tmp, tmp2);
|
||||
} else if (unlikely(!afl->blocks_eff_total)) {
|
||||
|
||||
strcat(tmp, "n/a");
|
||||
|
||||
} else {
|
||||
|
||||
@ -1044,7 +1095,7 @@ void show_stats(afl_state_t *afl) {
|
||||
//
|
||||
//} else {
|
||||
|
||||
SAYF(bV bSTOP " trim : " cRST "%-36s " bSTG bV RESET_G1, tmp);
|
||||
SAYF(bV bSTOP " trim/eff : " cRST "%-36s " bSTG bV RESET_G1, tmp);
|
||||
|
||||
//}
|
||||
|
||||
|
||||
285
src/afl-fuzz.c
285
src/afl-fuzz.c
@ -35,6 +35,10 @@
|
||||
#include <sys/shm.h>
|
||||
#endif
|
||||
|
||||
#ifdef __APPLE__
|
||||
#include <sys/qos.h>
|
||||
#endif
|
||||
|
||||
#ifdef PROFILING
|
||||
extern u64 time_spent_working;
|
||||
#endif
|
||||
@ -109,6 +113,7 @@ static void usage(u8 *argv0, int more_help) {
|
||||
"maximum.\n"
|
||||
" -m megs - memory limit for child process (%u MB, 0 = no limit "
|
||||
"[default])\n"
|
||||
" -O - use binary-only instrumentation (FRIDA mode)\n"
|
||||
" -Q - use binary-only instrumentation (QEMU mode)\n"
|
||||
" -U - use unicorn-based instrumentation (Unicorn mode)\n"
|
||||
" -W - use qemu-based instrumentation with Wine (Wine "
|
||||
@ -126,7 +131,7 @@ static void usage(u8 *argv0, int more_help) {
|
||||
"it.\n"
|
||||
" if using QEMU, just use -c 0.\n"
|
||||
" -l cmplog_opts - CmpLog configuration values (e.g. \"2AT\"):\n"
|
||||
" 1=small files (default), 2=larger files, 3=all "
|
||||
" 1=small files, 2=larger files (default), 3=all "
|
||||
"files,\n"
|
||||
" A=arithmetic solving, T=transformational solving.\n\n"
|
||||
"Fuzzing behavior settings:\n"
|
||||
@ -175,6 +180,14 @@ static void usage(u8 *argv0, int more_help) {
|
||||
#define DYN_COLOR
|
||||
#endif
|
||||
|
||||
#ifdef AFL_PERSISTENT_RECORD
|
||||
#define PERSISTENT_MSG \
|
||||
"AFL_PERSISTENT_RECORD: record the last X inputs to every crash in " \
|
||||
"out/crashes\n"
|
||||
#else
|
||||
#define PERSISTENT_MSG
|
||||
#endif
|
||||
|
||||
SAYF(
|
||||
"Environment variables used:\n"
|
||||
"LD_BIND_LAZY: do not set LD_BIND_NOW env var for target\n"
|
||||
@ -195,6 +208,7 @@ static void usage(u8 *argv0, int more_help) {
|
||||
"AFL_DISABLE_TRIM: disable the trimming of test cases\n"
|
||||
"AFL_DUMB_FORKSRV: use fork server without feedback from target\n"
|
||||
"AFL_EXIT_WHEN_DONE: exit when all inputs are run and no new finds are found\n"
|
||||
"AFL_EXIT_ON_TIME: exit when no new paths are found within the specified time period\n"
|
||||
"AFL_EXPAND_HAVOC_NOW: immediately enable expand havoc mode (default: after 60 minutes and a cycle without finds)\n"
|
||||
"AFL_FAST_CAL: limit the calibration stage to three cycles for speedup\n"
|
||||
"AFL_FORCE_UI: force showing the status screen (for virtual consoles)\n"
|
||||
@ -210,6 +224,7 @@ static void usage(u8 *argv0, int more_help) {
|
||||
" then they are randomly selected instead all of them being\n"
|
||||
" used. Defaults to 200.\n"
|
||||
"AFL_NO_AFFINITY: do not check for an unused cpu core to use for fuzzing\n"
|
||||
"AFL_TRY_AFFINITY: try to bind to an unused core, but don't fail if unsuccessful\n"
|
||||
"AFL_NO_ARITH: skip arithmetic mutations in deterministic stage\n"
|
||||
"AFL_NO_AUTODICT: do not load an offered auto dictionary compiled into a target\n"
|
||||
"AFL_NO_CPU_RED: avoid red color for showing very high cpu usage\n"
|
||||
@ -222,12 +237,15 @@ static void usage(u8 *argv0, int more_help) {
|
||||
"AFL_PATH: path to AFL support binaries\n"
|
||||
"AFL_PYTHON_MODULE: mutate and trim inputs with the specified Python module\n"
|
||||
"AFL_QUIET: suppress forkserver status messages\n"
|
||||
|
||||
PERSISTENT_MSG
|
||||
|
||||
"AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
|
||||
"AFL_TARGET_ENV: pass extra environment variables to target\n"
|
||||
"AFL_SHUFFLE_QUEUE: reorder the input queue randomly on startup\n"
|
||||
"AFL_SKIP_BIN_CHECK: skip the check, if the target is an executable\n"
|
||||
"AFL_SKIP_BIN_CHECK: skip afl compatibility checks, also disables auto map size\n"
|
||||
"AFL_SKIP_CPUFREQ: do not warn about variable cpu clocking\n"
|
||||
"AFL_SKIP_CRASHES: during initial dry run do not terminate for crashing inputs\n"
|
||||
//"AFL_SKIP_CRASHES: during initial dry run do not terminate for crashing inputs\n"
|
||||
"AFL_STATSD: enables StatsD metrics collection\n"
|
||||
"AFL_STATSD_HOST: change default statsd host (default 127.0.0.1)\n"
|
||||
"AFL_STATSD_PORT: change default statsd port (default: 8125)\n"
|
||||
@ -253,7 +271,13 @@ static void usage(u8 *argv0, int more_help) {
|
||||
SAYF("Compiled with %s module support, see docs/custom_mutator.md\n",
|
||||
(char *)PYTHON_VERSION);
|
||||
#else
|
||||
SAYF("Compiled without python module support\n");
|
||||
SAYF("Compiled without python module support.\n");
|
||||
#endif
|
||||
|
||||
#ifdef AFL_PERSISTENT_RECORD
|
||||
SAYF("Compiled with AFL_PERSISTENT_RECORD support.\n");
|
||||
#else
|
||||
SAYF("Compiled without AFL_PERSISTENT_RECORD support.\n");
|
||||
#endif
|
||||
|
||||
#ifdef USEMMAP
|
||||
@ -263,27 +287,27 @@ static void usage(u8 *argv0, int more_help) {
|
||||
#endif
|
||||
|
||||
#ifdef ASAN_BUILD
|
||||
SAYF("Compiled with ASAN_BUILD\n\n");
|
||||
SAYF("Compiled with ASAN_BUILD.\n");
|
||||
#endif
|
||||
|
||||
#ifdef NO_SPLICING
|
||||
SAYF("Compiled with NO_SPLICING\n\n");
|
||||
SAYF("Compiled with NO_SPLICING.\n");
|
||||
#endif
|
||||
|
||||
#ifdef PROFILING
|
||||
SAYF("Compiled with PROFILING\n\n");
|
||||
SAYF("Compiled with PROFILING.\n");
|
||||
#endif
|
||||
|
||||
#ifdef INTROSPECTION
|
||||
SAYF("Compiled with INTROSPECTION\n\n");
|
||||
SAYF("Compiled with INTROSPECTION.\n");
|
||||
#endif
|
||||
|
||||
#ifdef _DEBUG
|
||||
SAYF("Compiled with _DEBUG\n\n");
|
||||
SAYF("Compiled with _DEBUG.\n");
|
||||
#endif
|
||||
|
||||
#ifdef _AFL_DOCUMENT_MUTATIONS
|
||||
SAYF("Compiled with _AFL_DOCUMENT_MUTATIONS\n\n");
|
||||
SAYF("Compiled with _AFL_DOCUMENT_MUTATIONS.\n");
|
||||
#endif
|
||||
|
||||
SAYF("For additional help please consult %s/README.md :)\n\n", doc_path);
|
||||
@ -309,17 +333,63 @@ static int stricmp(char const *a, char const *b) {
|
||||
|
||||
}
|
||||
|
||||
static void fasan_check_afl_preload(char *afl_preload) {
|
||||
|
||||
char first_preload[PATH_MAX + 1] = {0};
|
||||
char * separator = strchr(afl_preload, ':');
|
||||
size_t first_preload_len = PATH_MAX;
|
||||
char * basename;
|
||||
char clang_runtime_prefix[] = "libclang_rt.asan-";
|
||||
|
||||
if (separator != NULL && (separator - afl_preload) < PATH_MAX) {
|
||||
|
||||
first_preload_len = separator - afl_preload;
|
||||
|
||||
}
|
||||
|
||||
strncpy(first_preload, afl_preload, first_preload_len);
|
||||
|
||||
basename = strrchr(first_preload, '/');
|
||||
if (basename == NULL) {
|
||||
|
||||
basename = first_preload;
|
||||
|
||||
} else {
|
||||
|
||||
basename = basename + 1;
|
||||
|
||||
}
|
||||
|
||||
if (strncmp(basename, clang_runtime_prefix,
|
||||
sizeof(clang_runtime_prefix) - 1) != 0) {
|
||||
|
||||
FATAL("Address Sanitizer DSO must be the first DSO in AFL_PRELOAD");
|
||||
|
||||
}
|
||||
|
||||
if (access(first_preload, R_OK) != 0) {
|
||||
|
||||
FATAL("Address Sanitizer DSO not found");
|
||||
|
||||
}
|
||||
|
||||
OKF("Found ASAN DSO: %s", first_preload);
|
||||
|
||||
}
|
||||
|
||||
/* Main entry point */
|
||||
|
||||
int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
s32 opt, i, auto_sync = 0 /*, user_set_cache = 0*/;
|
||||
s32 opt, auto_sync = 0 /*, user_set_cache = 0*/;
|
||||
u64 prev_queued = 0;
|
||||
u32 sync_interval_cnt = 0, seek_to = 0, show_help = 0,
|
||||
map_size = get_map_size();
|
||||
u8 *extras_dir[4];
|
||||
u8 mem_limit_given = 0, exit_1 = 0, debug = 0,
|
||||
extras_dir_cnt = 0 /*, have_p = 0*/;
|
||||
char * afl_preload;
|
||||
char * frida_afl_preload = NULL;
|
||||
char **use_argv;
|
||||
|
||||
struct timeval tv;
|
||||
@ -363,7 +433,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
while ((opt = getopt(
|
||||
argc, argv,
|
||||
"+b:B:c:CdDe:E:hi:I:f:F:l:L:m:M:nNo:p:RQs:S:t:T:UV:Wx:Z")) > 0) {
|
||||
"+b:B:c:CdDe:E:hi:I:f:F:l:L:m:M:nNOo:p:RQs:S:t:T:UV:Wx:Z")) > 0) {
|
||||
|
||||
switch (opt) {
|
||||
|
||||
@ -755,6 +825,19 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
afl->use_banner = optarg;
|
||||
break;
|
||||
|
||||
case 'O': /* FRIDA mode */
|
||||
|
||||
if (afl->fsrv.frida_mode) {
|
||||
|
||||
FATAL("Multiple -O options not supported");
|
||||
|
||||
}
|
||||
|
||||
afl->fsrv.frida_mode = 1;
|
||||
if (get_afl_env("AFL_USE_FASAN")) { afl->fsrv.frida_asan = 1; }
|
||||
|
||||
break;
|
||||
|
||||
case 'Q': /* QEMU mode */
|
||||
|
||||
if (afl->fsrv.qemu_mode) { FATAL("Multiple -Q options not supported"); }
|
||||
@ -831,6 +914,14 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
break;
|
||||
case '3':
|
||||
afl->cmplog_lvl = 3;
|
||||
|
||||
if (!afl->disable_trim) {
|
||||
|
||||
ACTF("Deactivating trimming due CMPLOG level 3");
|
||||
afl->disable_trim = 1;
|
||||
|
||||
}
|
||||
|
||||
break;
|
||||
case 'a':
|
||||
case 'A':
|
||||
@ -1023,6 +1114,30 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
if (unlikely(afl->afl_env.afl_persistent_record)) {
|
||||
|
||||
#ifdef AFL_PERSISTENT_RECORD
|
||||
|
||||
afl->fsrv.persistent_record = atoi(afl->afl_env.afl_persistent_record);
|
||||
|
||||
if (afl->fsrv.persistent_record < 2) {
|
||||
|
||||
FATAL(
|
||||
"AFL_PERSISTENT_RECORD value must be be at least 2, recommended is "
|
||||
"100 or 1000.");
|
||||
|
||||
}
|
||||
|
||||
#else
|
||||
|
||||
FATAL(
|
||||
"afl-fuzz was not compiled with AFL_PERSISTENT_RECORD enabled in "
|
||||
"config.h!");
|
||||
|
||||
#endif
|
||||
|
||||
}
|
||||
|
||||
if (afl->fsrv.mem_limit && afl->shm.cmplog_mode) afl->fsrv.mem_limit += 260;
|
||||
|
||||
OKF("afl++ is maintained by Marc \"van Hauser\" Heuse, Heiko \"hexcoder\" "
|
||||
@ -1085,6 +1200,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
if (afl->non_instrumented_mode) {
|
||||
|
||||
if (afl->crash_mode) { FATAL("-C and -n are mutually exclusive"); }
|
||||
if (afl->fsrv.frida_mode) { FATAL("-O and -n are mutually exclusive"); }
|
||||
if (afl->fsrv.qemu_mode) { FATAL("-Q and -n are mutually exclusive"); }
|
||||
if (afl->unicorn_mode) { FATAL("-U and -n are mutually exclusive"); }
|
||||
|
||||
@ -1181,6 +1297,13 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
if (afl->afl_env.afl_exit_on_time) {
|
||||
|
||||
u64 exit_on_time = atoi(afl->afl_env.afl_exit_on_time);
|
||||
afl->exit_on_time = (u64)exit_on_time * 1000;
|
||||
|
||||
}
|
||||
|
||||
if (afl->afl_env.afl_max_det_extras) {
|
||||
|
||||
s32 max_det_extras = atoi(afl->afl_env.afl_max_det_extras);
|
||||
@ -1289,6 +1412,34 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
/* afl-qemu-trace takes care of converting AFL_PRELOAD. */
|
||||
|
||||
} else if (afl->fsrv.frida_mode) {
|
||||
|
||||
afl_preload = getenv("AFL_PRELOAD");
|
||||
u8 *frida_binary = find_afl_binary(argv[0], "afl-frida-trace.so");
|
||||
OKF("Injecting %s ...", frida_binary);
|
||||
if (afl_preload) {
|
||||
|
||||
if (afl->fsrv.frida_asan) {
|
||||
|
||||
OKF("Using Frida Address Sanitizer Mode");
|
||||
|
||||
fasan_check_afl_preload(afl_preload);
|
||||
|
||||
setenv("ASAN_OPTIONS", "detect_leaks=false", 1);
|
||||
|
||||
}
|
||||
|
||||
u8 *frida_binary = find_afl_binary(argv[0], "afl-frida-trace.so");
|
||||
OKF("Injecting %s ...", frida_binary);
|
||||
frida_afl_preload = alloc_printf("%s:%s", afl_preload, frida_binary);
|
||||
|
||||
ck_free(frida_binary);
|
||||
|
||||
setenv("LD_PRELOAD", frida_afl_preload, 1);
|
||||
setenv("DYLD_INSERT_LIBRARIES", frida_afl_preload, 1);
|
||||
|
||||
}
|
||||
|
||||
} else {
|
||||
|
||||
setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
|
||||
@ -1296,6 +1447,25 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
} else if (afl->fsrv.frida_mode) {
|
||||
|
||||
if (afl->fsrv.frida_asan) {
|
||||
|
||||
OKF("Using Frida Address Sanitizer Mode");
|
||||
FATAL(
|
||||
"Address Sanitizer DSO must be loaded using AFL_PRELOAD in Frida "
|
||||
"Address Sanitizer Mode");
|
||||
|
||||
} else {
|
||||
|
||||
u8 *frida_binary = find_afl_binary(argv[0], "afl-frida-trace.so");
|
||||
OKF("Injecting %s ...", frida_binary);
|
||||
setenv("LD_PRELOAD", frida_binary, 1);
|
||||
setenv("DYLD_INSERT_LIBRARIES", frida_binary, 1);
|
||||
ck_free(frida_binary);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
if (getenv("AFL_LD_PRELOAD")) {
|
||||
@ -1479,7 +1649,8 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
if (!afl->fsrv.qemu_mode && !afl->non_instrumented_mode) {
|
||||
if (!afl->fsrv.qemu_mode && !afl->fsrv.frida_mode &&
|
||||
!afl->non_instrumented_mode) {
|
||||
|
||||
check_binary(afl, afl->cmplog_binary);
|
||||
|
||||
@ -1489,6 +1660,23 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
check_binary(afl, argv[optind]);
|
||||
|
||||
#ifdef AFL_PERSISTENT_RECORD
|
||||
if (unlikely(afl->fsrv.persistent_record)) {
|
||||
|
||||
if (!getenv(PERSIST_ENV_VAR)) {
|
||||
|
||||
FATAL(
|
||||
"Target binary is not compiled in persistent mode, "
|
||||
"AFL_PERSISTENT_RECORD makes no sense.");
|
||||
|
||||
}
|
||||
|
||||
afl->fsrv.persistent_record_dir = alloc_printf("%s/crashes", afl->out_dir);
|
||||
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
if (afl->shmem_testcase_mode) { setup_testcase_shmem(afl); }
|
||||
|
||||
afl->start_time = get_cur_time();
|
||||
@ -1513,7 +1701,8 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
if (afl->non_instrumented_mode || afl->fsrv.qemu_mode || afl->unicorn_mode) {
|
||||
if (afl->non_instrumented_mode || afl->fsrv.qemu_mode ||
|
||||
afl->fsrv.frida_mode || afl->unicorn_mode) {
|
||||
|
||||
map_size = afl->fsrv.map_size = MAP_SIZE;
|
||||
afl->virgin_bits = ck_realloc(afl->virgin_bits, map_size);
|
||||
@ -1533,10 +1722,10 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode);
|
||||
|
||||
if (!afl->non_instrumented_mode && !afl->fsrv.qemu_mode &&
|
||||
!afl->unicorn_mode) {
|
||||
!afl->unicorn_mode && !afl->fsrv.frida_mode &&
|
||||
!afl->afl_env.afl_skip_bin_check) {
|
||||
|
||||
if (map_size <= DEFAULT_SHMEM_SIZE && !afl->non_instrumented_mode &&
|
||||
!afl->fsrv.qemu_mode && !afl->unicorn_mode) {
|
||||
if (map_size <= DEFAULT_SHMEM_SIZE) {
|
||||
|
||||
afl->fsrv.map_size = DEFAULT_SHMEM_SIZE; // dummy temporary value
|
||||
char vbuf[16];
|
||||
@ -1587,13 +1776,15 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
// TODO: this is semi-nice
|
||||
afl->cmplog_fsrv.trace_bits = afl->fsrv.trace_bits;
|
||||
afl->cmplog_fsrv.qemu_mode = afl->fsrv.qemu_mode;
|
||||
afl->cmplog_fsrv.frida_mode = afl->fsrv.frida_mode;
|
||||
afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary;
|
||||
afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
|
||||
|
||||
if ((map_size <= DEFAULT_SHMEM_SIZE ||
|
||||
afl->cmplog_fsrv.map_size < map_size) &&
|
||||
!afl->non_instrumented_mode && !afl->fsrv.qemu_mode &&
|
||||
!afl->unicorn_mode) {
|
||||
!afl->fsrv.frida_mode && !afl->unicorn_mode &&
|
||||
!afl->afl_env.afl_skip_bin_check) {
|
||||
|
||||
afl->cmplog_fsrv.map_size = MAX(map_size, (u32)DEFAULT_SHMEM_SIZE);
|
||||
char vbuf[16];
|
||||
@ -1649,7 +1840,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
if (extras_dir_cnt) {
|
||||
|
||||
for (i = 0; i < extras_dir_cnt; i++) {
|
||||
for (u8 i = 0; i < extras_dir_cnt; i++) {
|
||||
|
||||
load_extras(afl, extras_dir[i]);
|
||||
|
||||
@ -1773,6 +1964,14 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
runs_in_current_cycle > afl->queued_paths) ||
|
||||
(afl->old_seed_selection && !afl->queue_cur))) {
|
||||
|
||||
if (unlikely((afl->last_sync_cycle < afl->queue_cycle ||
|
||||
(!afl->queue_cycle && afl->afl_env.afl_import_first)) &&
|
||||
afl->sync_id)) {
|
||||
|
||||
sync_fuzzers(afl);
|
||||
|
||||
}
|
||||
|
||||
++afl->queue_cycle;
|
||||
runs_in_current_cycle = (u32)-1;
|
||||
afl->cur_skipped_paths = 0;
|
||||
@ -1793,6 +1992,13 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
if (unlikely(seek_to)) {
|
||||
|
||||
if (unlikely(seek_to >= afl->queued_paths)) {
|
||||
|
||||
// This should never happen.
|
||||
FATAL("BUG: seek_to location out of bounds!\n");
|
||||
|
||||
}
|
||||
|
||||
afl->current_entry = seek_to;
|
||||
afl->queue_cur = afl->queue_buf[seek_to];
|
||||
seek_to = 0;
|
||||
@ -1811,8 +2017,10 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
/* If we had a full queue cycle with no new finds, try
|
||||
recombination strategies next. */
|
||||
|
||||
if (unlikely(afl->queued_paths == prev_queued &&
|
||||
(get_cur_time() - afl->start_time) >= 3600)) {
|
||||
if (unlikely(afl->queued_paths == prev_queued
|
||||
/* FIXME TODO BUG: && (get_cur_time() - afl->start_time) >=
|
||||
3600 */
|
||||
)) {
|
||||
|
||||
if (afl->use_splicing) {
|
||||
|
||||
@ -1858,13 +2066,10 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
break;
|
||||
case 4:
|
||||
afl->expand_havoc = 5;
|
||||
if (afl->cmplog_lvl && afl->cmplog_lvl < 3) afl->cmplog_lvl = 3;
|
||||
// if (afl->cmplog_lvl && afl->cmplog_lvl < 3) afl->cmplog_lvl =
|
||||
// 3;
|
||||
break;
|
||||
case 5:
|
||||
// if not in sync mode, enable deterministic mode?
|
||||
// if (!afl->sync_id) afl->skip_deterministic = 0;
|
||||
afl->expand_havoc = 6;
|
||||
case 6:
|
||||
// nothing else currently
|
||||
break;
|
||||
|
||||
@ -1886,6 +2091,13 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
#ifdef INTROSPECTION
|
||||
fprintf(afl->introspection_file,
|
||||
"CYCLE cycle=%llu cycle_wo_finds=%llu expand_havoc=%u queue=%u\n",
|
||||
afl->queue_cycle, afl->cycles_wo_finds, afl->expand_havoc,
|
||||
afl->queued_paths);
|
||||
#endif
|
||||
|
||||
if (afl->cycle_schedules) {
|
||||
|
||||
/* we cannot mix non-AFLfast schedules with others */
|
||||
@ -1923,7 +2135,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
}
|
||||
|
||||
// we must recalculate the scores of all queue entries
|
||||
for (i = 0; i < (s32)afl->queued_paths; i++) {
|
||||
for (u32 i = 0; i < afl->queued_paths; i++) {
|
||||
|
||||
if (likely(!afl->queue_buf[i]->disabled)) {
|
||||
|
||||
@ -1937,13 +2149,6 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
prev_queued = afl->queued_paths;
|
||||
|
||||
if (afl->sync_id && afl->queue_cycle == 1 &&
|
||||
afl->afl_env.afl_import_first) {
|
||||
|
||||
sync_fuzzers(afl);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
++runs_in_current_cycle;
|
||||
@ -2023,12 +2228,10 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
}
|
||||
|
||||
write_bitmap(afl);
|
||||
maybe_update_plot_file(afl, 0, 0, 0);
|
||||
save_auto(afl);
|
||||
|
||||
stop_fuzzing:
|
||||
|
||||
write_stats_file(afl, 0, 0, 0, 0);
|
||||
afl->force_ui_update = 1; // ensure the screen is reprinted
|
||||
show_stats(afl); // print the screen one last time
|
||||
|
||||
@ -2074,6 +2277,8 @@ stop_fuzzing:
|
||||
|
||||
}
|
||||
|
||||
if (frida_afl_preload) { ck_free(frida_afl_preload); }
|
||||
|
||||
fclose(afl->fsrv.plot_file);
|
||||
destroy_queue(afl);
|
||||
destroy_extras(afl);
|
||||
@ -2091,6 +2296,14 @@ stop_fuzzing:
|
||||
}
|
||||
|
||||
afl_fsrv_deinit(&afl->fsrv);
|
||||
|
||||
/* remove tmpfile */
|
||||
if (afl->tmp_dir != NULL && !afl->in_place_resume && afl->fsrv.out_file) {
|
||||
|
||||
(void)unlink(afl->fsrv.out_file);
|
||||
|
||||
}
|
||||
|
||||
if (afl->orig_cmdline) { ck_free(afl->orig_cmdline); }
|
||||
ck_free(afl->fsrv.target_path);
|
||||
ck_free(afl->fsrv.out_file);
|
||||
|
||||
@ -73,8 +73,8 @@ static u32 ld_param_cnt = 1; /* Number of params to 'ld' */
|
||||
so we exploit this property to keep the code "simple". */
|
||||
static void edit_params(int argc, char **argv) {
|
||||
|
||||
u32 i, instrim = 0, gold_pos = 0, gold_present = 0, rt_present = 0,
|
||||
rt_lto_present = 0, inst_present = 0;
|
||||
u32 i, gold_pos = 0, gold_present = 0, rt_present = 0, rt_lto_present = 0,
|
||||
inst_present = 0;
|
||||
char *ptr;
|
||||
|
||||
ld_params = ck_alloc(4096 * sizeof(u8 *));
|
||||
@ -186,17 +186,18 @@ static void edit_params(int argc, char **argv) {
|
||||
|
||||
}
|
||||
|
||||
if (getenv("AFL_LLVM_INSTRIM"))
|
||||
instrim = 1;
|
||||
else if ((ptr = getenv("AFL_LLVM_INSTRUMENT")) &&
|
||||
(strcasestr(ptr, "CFG") == 0 || strcasestr(ptr, "INSTRIM") == 0))
|
||||
instrim = 1;
|
||||
if (getenv("AFL_LLVM_INSTRIM") ||
|
||||
((ptr = getenv("AFL_LLVM_INSTRUMENT")) &&
|
||||
(strcasestr(ptr, "CFG") == 0 || strcasestr(ptr, "INSTRIM") == 0)))
|
||||
FATAL(
|
||||
"InsTrim was removed because it is not effective. Use a modern LLVM "
|
||||
"and PCGUARD (which is the default in afl-cc).\n");
|
||||
|
||||
if (debug)
|
||||
DEBUGF(
|
||||
"passthrough=%s instrim=%u, gold_pos=%u, gold_present=%s "
|
||||
"passthrough=%s, gold_pos=%u, gold_present=%s "
|
||||
"inst_present=%s rt_present=%s rt_lto_present=%s\n",
|
||||
passthrough ? "true" : "false", instrim, gold_pos,
|
||||
passthrough ? "true" : "false", gold_pos,
|
||||
gold_present ? "true" : "false", inst_present ? "true" : "false",
|
||||
rt_present ? "true" : "false", rt_lto_present ? "true" : "false");
|
||||
|
||||
@ -230,12 +231,8 @@ static void edit_params(int argc, char **argv) {
|
||||
|
||||
if (!inst_present) {
|
||||
|
||||
if (instrim)
|
||||
ld_params[ld_param_cnt++] =
|
||||
alloc_printf("-mllvm=-load=%s/afl-llvm-lto-instrim.so", afl_path);
|
||||
else
|
||||
ld_params[ld_param_cnt++] = alloc_printf(
|
||||
"-mllvm=-load=%s/afl-llvm-lto-instrumentation.so", afl_path);
|
||||
ld_params[ld_param_cnt++] = alloc_printf(
|
||||
"-mllvm=-load=%s/afl-llvm-lto-instrumentation.so", afl_path);
|
||||
|
||||
}
|
||||
|
||||
@ -301,13 +298,12 @@ int main(int argc, char **argv) {
|
||||
|
||||
SAYF(
|
||||
"\n"
|
||||
"This is a helper application for afl-clang-lto. It is a wrapper "
|
||||
"around GNU "
|
||||
"llvm's 'lld',\n"
|
||||
"executed by the toolchain whenever using "
|
||||
"afl-clang-lto/afl-clang-lto++.\n"
|
||||
"This is a helper application for afl-clang-lto.\n"
|
||||
"It is a wrapper around llvm's 'lld' in case afl-clang-lto cannot be "
|
||||
"used.\n"
|
||||
"Note that the target still has to be compiled with -flto=full!\n"
|
||||
"You probably don't want to run this program directly but rather pass "
|
||||
"it as LD parameter to configure scripts\n\n"
|
||||
"it as LD\nparameter to e.g. configure scripts.\n\n"
|
||||
|
||||
"Environment variables:\n"
|
||||
" AFL_LD_PASSTHROUGH do not link+optimize == no instrumentation\n"
|
||||
|
||||
@ -52,6 +52,7 @@
|
||||
#include <fcntl.h>
|
||||
#include <limits.h>
|
||||
|
||||
#include <dirent.h>
|
||||
#include <sys/wait.h>
|
||||
#include <sys/time.h>
|
||||
#ifndef USEMMAP
|
||||
@ -72,22 +73,22 @@ static u8 *in_data, /* Input data */
|
||||
static u64 total; /* tuple content information */
|
||||
static u32 tcnt, highest; /* tuple content information */
|
||||
|
||||
static u32 in_len, /* Input data length */
|
||||
arg_offset; /* Total number of execs */
|
||||
static u32 in_len; /* Input data length */
|
||||
|
||||
static u32 map_size = MAP_SIZE;
|
||||
|
||||
static u8 quiet_mode, /* Hide non-essential messages? */
|
||||
static bool quiet_mode, /* Hide non-essential messages? */
|
||||
edges_only, /* Ignore hit counts? */
|
||||
raw_instr_output, /* Do not apply AFL filters */
|
||||
cmin_mode, /* Generate output in afl-cmin mode? */
|
||||
binary_mode, /* Write output as a binary map */
|
||||
keep_cores, /* Allow coredumps? */
|
||||
remove_shm = 1, /* remove shmem? */
|
||||
remove_shm = true, /* remove shmem? */
|
||||
collect_coverage, /* collect coverage */
|
||||
have_coverage, /* have coverage? */
|
||||
no_classify, /* do not classify counts */
|
||||
debug; /* debug mode */
|
||||
debug, /* debug mode */
|
||||
print_filenames; /* print the current filename */
|
||||
|
||||
static volatile u8 stop_soon, /* Ctrl-C pressed? */
|
||||
child_crashed; /* Child crashed? */
|
||||
@ -234,6 +235,9 @@ static u32 write_results_to_file(afl_forkserver_t *fsrv, u8 *outfile) {
|
||||
if (cmin_mode &&
|
||||
(fsrv->last_run_timed_out || (!caa && child_crashed != cco))) {
|
||||
|
||||
// create empty file to prevent error messages in afl-cmin
|
||||
fd = open(outfile, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
|
||||
close(fd);
|
||||
return ret;
|
||||
|
||||
}
|
||||
@ -321,11 +325,11 @@ static void showmap_run_target_forkserver(afl_forkserver_t *fsrv, u8 *mem,
|
||||
if (fsrv->trace_bits[0] == 1) {
|
||||
|
||||
fsrv->trace_bits[0] = 0;
|
||||
have_coverage = 1;
|
||||
have_coverage = true;
|
||||
|
||||
} else {
|
||||
|
||||
have_coverage = 0;
|
||||
have_coverage = false;
|
||||
|
||||
}
|
||||
|
||||
@ -336,11 +340,11 @@ static void showmap_run_target_forkserver(afl_forkserver_t *fsrv, u8 *mem,
|
||||
if (!fsrv->last_run_timed_out && !stop_soon &&
|
||||
WIFSIGNALED(fsrv->child_status)) {
|
||||
|
||||
child_crashed = 1;
|
||||
child_crashed = true;
|
||||
|
||||
} else {
|
||||
|
||||
child_crashed = 0;
|
||||
child_crashed = false;
|
||||
|
||||
}
|
||||
|
||||
@ -376,6 +380,13 @@ static void showmap_run_target_forkserver(afl_forkserver_t *fsrv, u8 *mem,
|
||||
|
||||
static u32 read_file(u8 *in_file) {
|
||||
|
||||
if (print_filenames) {
|
||||
|
||||
SAYF("Processing %s\n", in_file);
|
||||
fflush(stdout);
|
||||
|
||||
}
|
||||
|
||||
struct stat st;
|
||||
s32 fd = open(in_file, O_RDONLY);
|
||||
|
||||
@ -387,7 +398,18 @@ static u32 read_file(u8 *in_file) {
|
||||
|
||||
}
|
||||
|
||||
in_len = st.st_size;
|
||||
if (st.st_size > MAX_FILE) {
|
||||
|
||||
WARNF("Input file '%s' is too large, only reading %u bytes.", in_file,
|
||||
MAX_FILE);
|
||||
in_len = MAX_FILE;
|
||||
|
||||
} else {
|
||||
|
||||
in_len = st.st_size;
|
||||
|
||||
}
|
||||
|
||||
in_data = ck_alloc_nozero(in_len);
|
||||
|
||||
ck_read(fd, in_data, in_len, in_file);
|
||||
@ -505,11 +527,11 @@ static void showmap_run_target(afl_forkserver_t *fsrv, char **argv) {
|
||||
if (fsrv->trace_bits[0] == 1) {
|
||||
|
||||
fsrv->trace_bits[0] = 0;
|
||||
have_coverage = 1;
|
||||
have_coverage = true;
|
||||
|
||||
} else {
|
||||
|
||||
have_coverage = 0;
|
||||
have_coverage = false;
|
||||
|
||||
}
|
||||
|
||||
@ -519,7 +541,7 @@ static void showmap_run_target(afl_forkserver_t *fsrv, char **argv) {
|
||||
|
||||
if (!fsrv->last_run_timed_out && !stop_soon && WIFSIGNALED(status)) {
|
||||
|
||||
child_crashed = 1;
|
||||
child_crashed = true;
|
||||
|
||||
}
|
||||
|
||||
@ -549,15 +571,17 @@ static void showmap_run_target(afl_forkserver_t *fsrv, char **argv) {
|
||||
static void handle_stop_sig(int sig) {
|
||||
|
||||
(void)sig;
|
||||
stop_soon = 1;
|
||||
stop_soon = true;
|
||||
afl_fsrv_killall();
|
||||
|
||||
}
|
||||
|
||||
/* Do basic preparations - persistent fds, filenames, etc. */
|
||||
|
||||
static void set_up_environment(afl_forkserver_t *fsrv) {
|
||||
static void set_up_environment(afl_forkserver_t *fsrv, char **argv) {
|
||||
|
||||
char *afl_preload;
|
||||
char *frida_afl_preload = NULL;
|
||||
setenv("ASAN_OPTIONS",
|
||||
"abort_on_error=1:"
|
||||
"detect_leaks=0:"
|
||||
@ -571,6 +595,13 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
|
||||
"handle_sigill=0",
|
||||
0);
|
||||
|
||||
setenv("LSAN_OPTIONS",
|
||||
"exitcode=" STRINGIFY(LSAN_ERROR) ":"
|
||||
"fast_unwind_on_malloc=0:"
|
||||
"symbolize=0:"
|
||||
"print_suppressions=0",
|
||||
0);
|
||||
|
||||
setenv("UBSAN_OPTIONS",
|
||||
"halt_on_error=1:"
|
||||
"abort_on_error=1:"
|
||||
@ -601,6 +632,25 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
|
||||
|
||||
/* afl-qemu-trace takes care of converting AFL_PRELOAD. */
|
||||
|
||||
} else if (fsrv->frida_mode) {
|
||||
|
||||
afl_preload = getenv("AFL_PRELOAD");
|
||||
u8 *frida_binary = find_afl_binary(argv[0], "afl-frida-trace.so");
|
||||
if (afl_preload) {
|
||||
|
||||
frida_afl_preload = alloc_printf("%s:%s", afl_preload, frida_binary);
|
||||
|
||||
} else {
|
||||
|
||||
frida_afl_preload = alloc_printf("%s", frida_binary);
|
||||
|
||||
}
|
||||
|
||||
ck_free(frida_binary);
|
||||
|
||||
setenv("LD_PRELOAD", frida_afl_preload, 1);
|
||||
setenv("DYLD_INSERT_LIBRARIES", frida_afl_preload, 1);
|
||||
|
||||
} else {
|
||||
|
||||
setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
|
||||
@ -608,8 +658,17 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
|
||||
|
||||
}
|
||||
|
||||
} else if (fsrv->frida_mode) {
|
||||
|
||||
u8 *frida_binary = find_afl_binary(argv[0], "afl-frida-trace.so");
|
||||
setenv("LD_PRELOAD", frida_binary, 1);
|
||||
setenv("DYLD_INSERT_LIBRARIES", frida_binary, 1);
|
||||
ck_free(frida_binary);
|
||||
|
||||
}
|
||||
|
||||
if (frida_afl_preload) { ck_free(frida_afl_preload); }
|
||||
|
||||
}
|
||||
|
||||
/* Setup signal handlers, duh. */
|
||||
@ -656,6 +715,7 @@ static void usage(u8 *argv0) {
|
||||
"Execution control settings:\n"
|
||||
" -t msec - timeout for each run (none)\n"
|
||||
" -m megs - memory limit for child process (%u MB)\n"
|
||||
" -O - use binary-only instrumentation (FRIDA mode)\n"
|
||||
" -Q - use binary-only instrumentation (QEMU mode)\n"
|
||||
" -U - use Unicorn-based instrumentation (Unicorn mode)\n"
|
||||
" -W - use qemu-based instrumentation with Wine (Wine mode)\n"
|
||||
@ -694,6 +754,8 @@ static void usage(u8 *argv0) {
|
||||
"AFL_MAP_SIZE: the shared memory size for that target. must be >= the "
|
||||
"size the target was compiled for\n"
|
||||
"AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
|
||||
"AFL_PRINT_FILENAMES: If set, the filename currently processed will be "
|
||||
"printed to stdout\n"
|
||||
"AFL_QUIET: do not print extra informational output\n",
|
||||
argv0, MEM_LIMIT, doc_path);
|
||||
|
||||
@ -707,14 +769,17 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
// TODO: u64 mem_limit = MEM_LIMIT; /* Memory limit (MB) */
|
||||
|
||||
s32 opt, i;
|
||||
u8 mem_limit_given = 0, timeout_given = 0, unicorn_mode = 0, use_wine = 0;
|
||||
s32 opt, i;
|
||||
bool mem_limit_given = false, timeout_given = false, unicorn_mode = false,
|
||||
use_wine = false;
|
||||
char **use_argv;
|
||||
|
||||
char **argv = argv_cpy_dup(argc, argv_orig);
|
||||
|
||||
afl_forkserver_t fsrv_var = {0};
|
||||
if (getenv("AFL_DEBUG")) { debug = 1; }
|
||||
if (getenv("AFL_DEBUG")) { debug = true; }
|
||||
if (get_afl_env("AFL_PRINT_FILENAMES")) { print_filenames = true; }
|
||||
|
||||
fsrv = &fsrv_var;
|
||||
afl_fsrv_init(fsrv);
|
||||
map_size = get_map_size();
|
||||
@ -722,19 +787,19 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH;
|
||||
|
||||
if (getenv("AFL_QUIET") != NULL) { be_quiet = 1; }
|
||||
if (getenv("AFL_QUIET") != NULL) { be_quiet = true; }
|
||||
|
||||
while ((opt = getopt(argc, argv, "+i:o:f:m:t:A:eqCZQUWbcrsh")) > 0) {
|
||||
while ((opt = getopt(argc, argv, "+i:o:f:m:t:A:eqCZOQUWbcrsh")) > 0) {
|
||||
|
||||
switch (opt) {
|
||||
|
||||
case 's':
|
||||
no_classify = 1;
|
||||
no_classify = true;
|
||||
break;
|
||||
|
||||
case 'C':
|
||||
collect_coverage = 1;
|
||||
quiet_mode = 1;
|
||||
collect_coverage = true;
|
||||
quiet_mode = true;
|
||||
break;
|
||||
|
||||
case 'i':
|
||||
@ -753,7 +818,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
u8 suffix = 'M';
|
||||
|
||||
if (mem_limit_given) { FATAL("Multiple -m options not supported"); }
|
||||
mem_limit_given = 1;
|
||||
mem_limit_given = true;
|
||||
|
||||
if (!optarg) { FATAL("Wrong usage of -m"); }
|
||||
|
||||
@ -814,7 +879,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
case 't':
|
||||
|
||||
if (timeout_given) { FATAL("Multiple -t options not supported"); }
|
||||
timeout_given = 1;
|
||||
timeout_given = true;
|
||||
|
||||
if (!optarg) { FATAL("Wrong usage of -t"); }
|
||||
|
||||
@ -836,12 +901,12 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
if (edges_only) { FATAL("Multiple -e options not supported"); }
|
||||
if (raw_instr_output) { FATAL("-e and -r are mutually exclusive"); }
|
||||
edges_only = 1;
|
||||
edges_only = true;
|
||||
break;
|
||||
|
||||
case 'q':
|
||||
|
||||
quiet_mode = 1;
|
||||
quiet_mode = true;
|
||||
break;
|
||||
|
||||
case 'Z':
|
||||
@ -849,8 +914,8 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
/* This is an undocumented option to write data in the syntax expected
|
||||
by afl-cmin. Nobody else should have any use for this. */
|
||||
|
||||
cmin_mode = 1;
|
||||
quiet_mode = 1;
|
||||
cmin_mode = true;
|
||||
quiet_mode = true;
|
||||
break;
|
||||
|
||||
case 'A':
|
||||
@ -858,25 +923,33 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
at_file = optarg;
|
||||
break;
|
||||
|
||||
case 'O': /* FRIDA mode */
|
||||
|
||||
if (fsrv->frida_mode) { FATAL("Multiple -O options not supported"); }
|
||||
|
||||
fsrv->frida_mode = true;
|
||||
|
||||
break;
|
||||
|
||||
case 'Q':
|
||||
|
||||
if (fsrv->qemu_mode) { FATAL("Multiple -Q options not supported"); }
|
||||
|
||||
fsrv->qemu_mode = 1;
|
||||
fsrv->qemu_mode = true;
|
||||
break;
|
||||
|
||||
case 'U':
|
||||
|
||||
if (unicorn_mode) { FATAL("Multiple -U options not supported"); }
|
||||
|
||||
unicorn_mode = 1;
|
||||
unicorn_mode = true;
|
||||
break;
|
||||
|
||||
case 'W': /* Wine+QEMU mode */
|
||||
|
||||
if (use_wine) { FATAL("Multiple -W options not supported"); }
|
||||
fsrv->qemu_mode = 1;
|
||||
use_wine = 1;
|
||||
fsrv->qemu_mode = true;
|
||||
use_wine = true;
|
||||
|
||||
break;
|
||||
|
||||
@ -885,20 +958,20 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
/* Secret undocumented mode. Writes output in raw binary format
|
||||
similar to that dumped by afl-fuzz in <out_dir/queue/fuzz_bitmap. */
|
||||
|
||||
binary_mode = 1;
|
||||
binary_mode = true;
|
||||
break;
|
||||
|
||||
case 'c':
|
||||
|
||||
if (keep_cores) { FATAL("Multiple -c options not supported"); }
|
||||
keep_cores = 1;
|
||||
keep_cores = true;
|
||||
break;
|
||||
|
||||
case 'r':
|
||||
|
||||
if (raw_instr_output) { FATAL("Multiple -r options not supported"); }
|
||||
if (edges_only) { FATAL("-e and -r are mutually exclusive"); }
|
||||
raw_instr_output = 1;
|
||||
raw_instr_output = true;
|
||||
break;
|
||||
|
||||
case 'h':
|
||||
@ -944,7 +1017,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
shm.cmplog_mode = 0;
|
||||
setup_signal_handlers();
|
||||
|
||||
set_up_environment(fsrv);
|
||||
set_up_environment(fsrv, argv);
|
||||
|
||||
fsrv->target_path = find_binary(argv[optind]);
|
||||
fsrv->trace_bits = afl_shm_init(&shm, map_size, 0);
|
||||
@ -958,10 +1031,27 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
if (in_dir) {
|
||||
|
||||
detect_file_args(argv + optind, "", &fsrv->use_stdin);
|
||||
/* If we don't have a file name chosen yet, use a safe default. */
|
||||
u8 *use_dir = ".";
|
||||
|
||||
if (access(use_dir, R_OK | W_OK | X_OK)) {
|
||||
|
||||
use_dir = get_afl_env("TMPDIR");
|
||||
if (!use_dir) { use_dir = "/tmp"; }
|
||||
|
||||
}
|
||||
|
||||
stdin_file = at_file ? strdup(at_file)
|
||||
: (char *)alloc_printf("%s/.afl-showmap-temp-%u",
|
||||
use_dir, (u32)getpid());
|
||||
unlink(stdin_file);
|
||||
|
||||
// If @@ are in the target args, replace them and also set use_stdin=false.
|
||||
detect_file_args(argv + optind, stdin_file, &fsrv->use_stdin);
|
||||
|
||||
} else {
|
||||
|
||||
// If @@ are in the target args, replace them and also set use_stdin=false.
|
||||
detect_file_args(argv + optind, at_file, &fsrv->use_stdin);
|
||||
|
||||
}
|
||||
@ -986,20 +1076,12 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
i = 0;
|
||||
while (use_argv[i] != NULL && !arg_offset) {
|
||||
|
||||
if (strcmp(use_argv[i], "@@") == 0) { arg_offset = i; }
|
||||
i++;
|
||||
|
||||
}
|
||||
|
||||
shm_fuzz = ck_alloc(sizeof(sharedmem_t));
|
||||
|
||||
/* initialize cmplog_mode */
|
||||
shm_fuzz->cmplog_mode = 0;
|
||||
u8 *map = afl_shm_init(shm_fuzz, MAX_FILE + sizeof(u32), 1);
|
||||
shm_fuzz->shmemfuzz_mode = 1;
|
||||
shm_fuzz->shmemfuzz_mode = true;
|
||||
if (!map) { FATAL("BUG: Zero return from afl_shm_init."); }
|
||||
#ifdef USEMMAP
|
||||
setenv(SHM_FUZZ_ENV_VAR, shm_fuzz->g_shm_file_path, 1);
|
||||
@ -1008,7 +1090,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
setenv(SHM_FUZZ_ENV_VAR, shm_str, 1);
|
||||
ck_free(shm_str);
|
||||
#endif
|
||||
fsrv->support_shmem_fuzz = 1;
|
||||
fsrv->support_shmem_fuzz = true;
|
||||
fsrv->shmem_fuzz_len = (u32 *)map;
|
||||
fsrv->shmem_fuzz = map + sizeof(u32);
|
||||
|
||||
@ -1025,6 +1107,9 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
: 0);
|
||||
be_quiet = save_be_quiet;
|
||||
|
||||
fsrv->kill_signal =
|
||||
parse_afl_kill_signal_env(getenv("AFL_KILL_SIGNAL"), SIGKILL);
|
||||
|
||||
if (new_map_size) {
|
||||
|
||||
// only reinitialize when it makes sense
|
||||
@ -1051,8 +1136,9 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
if (in_dir) {
|
||||
|
||||
DIR * dir_in, *dir_out = NULL;
|
||||
struct dirent *dir_ent;
|
||||
DIR * dir_in, *dir_out = NULL;
|
||||
struct dirent **file_list;
|
||||
|
||||
// int done = 0;
|
||||
u8 infile[PATH_MAX], outfile[PATH_MAX];
|
||||
u8 wait_for_gdb = 0;
|
||||
@ -1060,7 +1146,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
struct stat statbuf;
|
||||
#endif
|
||||
|
||||
if (getenv("AFL_DEBUG_GDB")) wait_for_gdb = 1;
|
||||
if (getenv("AFL_DEBUG_GDB")) wait_for_gdb = true;
|
||||
|
||||
fsrv->dev_null_fd = open("/dev/null", O_RDWR);
|
||||
if (fsrv->dev_null_fd < 0) { PFATAL("Unable to open /dev/null"); }
|
||||
@ -1077,12 +1163,6 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
ck_free(dn);
|
||||
if (!be_quiet) ACTF("Reading from directory '%s'...", in_dir);
|
||||
|
||||
if (!(dir_in = opendir(in_dir))) {
|
||||
|
||||
PFATAL("cannot open directory %s", in_dir);
|
||||
|
||||
}
|
||||
|
||||
if (!collect_coverage) {
|
||||
|
||||
if (!(dir_out = opendir(out_file))) {
|
||||
@ -1099,36 +1179,17 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
if ((coverage_map = (u8 *)malloc(map_size)) == NULL)
|
||||
FATAL("coult not grab memory");
|
||||
edges_only = 0;
|
||||
raw_instr_output = 1;
|
||||
edges_only = false;
|
||||
raw_instr_output = true;
|
||||
|
||||
}
|
||||
|
||||
u8 *use_dir = ".";
|
||||
|
||||
if (access(use_dir, R_OK | W_OK | X_OK)) {
|
||||
|
||||
use_dir = get_afl_env("TMPDIR");
|
||||
if (!use_dir) { use_dir = "/tmp"; }
|
||||
|
||||
}
|
||||
|
||||
stdin_file = at_file ? strdup(at_file)
|
||||
: (char *)alloc_printf("%s/.afl-showmap-temp-%u",
|
||||
use_dir, (u32)getpid());
|
||||
unlink(stdin_file);
|
||||
atexit(at_exit_handler);
|
||||
fsrv->out_file = stdin_file;
|
||||
fsrv->out_fd =
|
||||
open(stdin_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
|
||||
if (fsrv->out_fd < 0) { PFATAL("Unable to create '%s'", out_file); }
|
||||
|
||||
if (arg_offset && use_argv[arg_offset] != stdin_file) {
|
||||
|
||||
use_argv[arg_offset] = strdup(stdin_file);
|
||||
|
||||
}
|
||||
|
||||
if (get_afl_env("AFL_DEBUG")) {
|
||||
|
||||
int j = optind;
|
||||
@ -1156,9 +1217,6 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
fsrv->kill_signal =
|
||||
parse_afl_kill_signal_env(getenv("AFL_KILL_SIGNAL"), SIGKILL);
|
||||
|
||||
if (getenv("AFL_CRASH_EXITCODE")) {
|
||||
|
||||
long exitcode = strtol(getenv("AFL_CRASH_EXITCODE"), NULL, 10);
|
||||
@ -1187,7 +1245,16 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
if (fsrv->support_shmem_fuzz && !fsrv->use_shmem_fuzz)
|
||||
shm_fuzz = deinit_shmem(fsrv, shm_fuzz);
|
||||
|
||||
while ((dir_ent = readdir(dir_in))) {
|
||||
int file_count = scandir(in_dir, &file_list, NULL, alphasort);
|
||||
if (file_count < 0) {
|
||||
|
||||
PFATAL("Failed to read from input dir at %s\n", in_dir);
|
||||
|
||||
}
|
||||
|
||||
for (int i = 0; i < file_count; i++) {
|
||||
|
||||
struct dirent *dir_ent = file_list[i];
|
||||
|
||||
if (dir_ent->d_name[0] == '.') {
|
||||
|
||||
@ -1234,9 +1301,11 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
free(file_list);
|
||||
file_list = NULL;
|
||||
|
||||
if (!quiet_mode) { OKF("Processed %llu input files.", fsrv->total_execs); }
|
||||
|
||||
closedir(dir_in);
|
||||
if (dir_out) { closedir(dir_out); }
|
||||
|
||||
if (collect_coverage) {
|
||||
|
||||
@ -640,9 +640,11 @@ static void handle_stop_sig(int sig) {
|
||||
|
||||
/* Do basic preparations - persistent fds, filenames, etc. */
|
||||
|
||||
static void set_up_environment(afl_forkserver_t *fsrv) {
|
||||
static void set_up_environment(afl_forkserver_t *fsrv, char **argv) {
|
||||
|
||||
u8 *x;
|
||||
u8 * x;
|
||||
char *afl_preload;
|
||||
char *frida_afl_preload = NULL;
|
||||
|
||||
fsrv->dev_null_fd = open("/dev/null", O_RDWR);
|
||||
if (fsrv->dev_null_fd < 0) { PFATAL("Unable to open /dev/null"); }
|
||||
@ -712,6 +714,18 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
|
||||
|
||||
}
|
||||
|
||||
x = get_afl_env("LSAN_OPTIONS");
|
||||
|
||||
if (x) {
|
||||
|
||||
if (!strstr(x, "symbolize=0")) {
|
||||
|
||||
FATAL("Custom LSAN_OPTIONS set without symbolize=0 - please fix!");
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
setenv("ASAN_OPTIONS",
|
||||
"abort_on_error=1:"
|
||||
"detect_leaks=0:"
|
||||
@ -749,12 +763,38 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
|
||||
"handle_sigfpe=0:"
|
||||
"handle_sigill=0", 0);
|
||||
|
||||
setenv("LSAN_OPTIONS",
|
||||
"exitcode=" STRINGIFY(LSAN_ERROR) ":"
|
||||
"fast_unwind_on_malloc=0:"
|
||||
"symbolize=0:"
|
||||
"print_suppressions=0",
|
||||
0);
|
||||
|
||||
if (get_afl_env("AFL_PRELOAD")) {
|
||||
|
||||
if (fsrv->qemu_mode) {
|
||||
|
||||
/* afl-qemu-trace takes care of converting AFL_PRELOAD. */
|
||||
|
||||
} else if (fsrv->frida_mode) {
|
||||
|
||||
afl_preload = getenv("AFL_PRELOAD");
|
||||
u8 *frida_binary = find_afl_binary(argv[0], "afl-frida-trace.so");
|
||||
if (afl_preload) {
|
||||
|
||||
frida_afl_preload = alloc_printf("%s:%s", afl_preload, frida_binary);
|
||||
|
||||
} else {
|
||||
|
||||
frida_afl_preload = alloc_printf("%s", frida_binary);
|
||||
|
||||
}
|
||||
|
||||
ck_free(frida_binary);
|
||||
|
||||
setenv("LD_PRELOAD", frida_afl_preload, 1);
|
||||
setenv("DYLD_INSERT_LIBRARIES", frida_afl_preload, 1);
|
||||
|
||||
} else {
|
||||
|
||||
setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
|
||||
@ -762,8 +802,17 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
|
||||
|
||||
}
|
||||
|
||||
} else if (fsrv->frida_mode) {
|
||||
|
||||
u8 *frida_binary = find_afl_binary(argv[0], "afl-frida-trace.so");
|
||||
setenv("LD_PRELOAD", frida_binary, 1);
|
||||
setenv("DYLD_INSERT_LIBRARIES", frida_binary, 1);
|
||||
ck_free(frida_binary);
|
||||
|
||||
}
|
||||
|
||||
if (frida_afl_preload) { ck_free(frida_afl_preload); }
|
||||
|
||||
}
|
||||
|
||||
/* Setup signal handlers, duh. */
|
||||
@ -804,6 +853,7 @@ static void usage(u8 *argv0) {
|
||||
" -f file - input file read by the tested program (stdin)\n"
|
||||
" -t msec - timeout for each run (%u ms)\n"
|
||||
" -m megs - memory limit for child process (%u MB)\n"
|
||||
" -O - use binary-only instrumentation (FRIDA mode)\n"
|
||||
" -Q - use binary-only instrumentation (QEMU mode)\n"
|
||||
" -U - use unicorn-based instrumentation (Unicorn mode)\n"
|
||||
" -W - use qemu-based instrumentation with Wine (Wine "
|
||||
@ -859,7 +909,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
SAYF(cCYA "afl-tmin" VERSION cRST " by Michal Zalewski\n");
|
||||
|
||||
while ((opt = getopt(argc, argv, "+i:o:f:m:t:B:xeQUWHh")) > 0) {
|
||||
while ((opt = getopt(argc, argv, "+i:o:f:m:t:B:xeOQUWHh")) > 0) {
|
||||
|
||||
switch (opt) {
|
||||
|
||||
@ -971,6 +1021,14 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
|
||||
break;
|
||||
|
||||
case 'O': /* FRIDA mode */
|
||||
|
||||
if (fsrv->frida_mode) { FATAL("Multiple -O options not supported"); }
|
||||
|
||||
fsrv->frida_mode = 1;
|
||||
|
||||
break;
|
||||
|
||||
case 'Q':
|
||||
|
||||
if (fsrv->qemu_mode) { FATAL("Multiple -Q options not supported"); }
|
||||
@ -1054,7 +1112,7 @@ int main(int argc, char **argv_orig, char **envp) {
|
||||
atexit(at_exit_handler);
|
||||
setup_signal_handlers();
|
||||
|
||||
set_up_environment(fsrv);
|
||||
set_up_environment(fsrv, argv);
|
||||
|
||||
fsrv->target_path = find_binary(argv[optind]);
|
||||
fsrv->trace_bits = afl_shm_init(&shm, map_size, 0);
|
||||
|
||||
Reference in New Issue
Block a user