This commit is contained in:
vanhauser-thc
2023-04-07 09:41:22 +02:00
parent fcb5eda5d0
commit 400c5e92cb
2 changed files with 99 additions and 97 deletions

View File

@ -52,8 +52,8 @@ enum {
/* 14 */ MUT_ARITH32, /* 14 */ MUT_ARITH32,
/* 15 */ MUT_ARITH32BE, /* 15 */ MUT_ARITH32BE,
/* 16 */ MUT_RAND8, /* 16 */ MUT_RAND8,
/* 17 */ MUT_CLONE_OVERWRITE, /* 17 */ MUT_CLONE_COPY,
/* 18 */ MUT_CLONE_INSERT, /* 18 */ MUT_CLONE_FIXED,
/* 19 */ MUT_OVERWRITE_COPY, /* 19 */ MUT_OVERWRITE_COPY,
/* 20 */ MUT_OVERWRITE_FIXED, /* 20 */ MUT_OVERWRITE_FIXED,
/* 21 */ MUT_BYTEADD, /* 21 */ MUT_BYTEADD,
@ -176,29 +176,29 @@ u32 mutation_strategy_exploration_text[MUT_STRATEGY_ARRAY_SIZE] = {
MUT_RAND8, MUT_RAND8,
MUT_RAND8, MUT_RAND8,
MUT_RAND8, MUT_RAND8,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_OVERWRITE_COPY, MUT_OVERWRITE_COPY,
MUT_OVERWRITE_COPY, MUT_OVERWRITE_COPY,
MUT_OVERWRITE_COPY, MUT_OVERWRITE_COPY,
@ -446,28 +446,28 @@ u32 mutation_strategy_exploration_binary[MUT_STRATEGY_ARRAY_SIZE] = {
MUT_RAND8, MUT_RAND8,
MUT_RAND8, MUT_RAND8,
MUT_RAND8, MUT_RAND8,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_OVERWRITE_COPY, MUT_OVERWRITE_COPY,
MUT_OVERWRITE_COPY, MUT_OVERWRITE_COPY,
MUT_OVERWRITE_COPY, MUT_OVERWRITE_COPY,
@ -716,23 +716,23 @@ u32 mutation_strategy_exploitation_text[MUT_STRATEGY_ARRAY_SIZE] = {
MUT_RAND8, MUT_RAND8,
MUT_RAND8, MUT_RAND8,
MUT_RAND8, MUT_RAND8,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_OVERWRITE_COPY, MUT_OVERWRITE_COPY,
MUT_OVERWRITE_COPY, MUT_OVERWRITE_COPY,
MUT_OVERWRITE_COPY, MUT_OVERWRITE_COPY,
@ -979,23 +979,23 @@ u32 mutation_strategy_exploitation_binary[MUT_STRATEGY_ARRAY_SIZE] = {
MUT_RAND8, MUT_RAND8,
MUT_RAND8, MUT_RAND8,
MUT_RAND8, MUT_RAND8,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_OVERWRITE, MUT_CLONE_COPY,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_CLONE_INSERT, MUT_CLONE_FIXED,
MUT_OVERWRITE_COPY, MUT_OVERWRITE_COPY,
MUT_OVERWRITE_COPY, MUT_OVERWRITE_COPY,
MUT_OVERWRITE_COPY, MUT_OVERWRITE_COPY,
@ -1455,7 +1455,7 @@ inline u32 afl_mutate(afl_state_t *afl, u8 *buf, u32 len, u32 steps,
} }
case MUT_CLONE_OVERWRITE: { case MUT_CLONE_COPY: {
if (likely(len + HAVOC_BLK_XL < max_len)) { if (likely(len + HAVOC_BLK_XL < max_len)) {
@ -1494,7 +1494,7 @@ inline u32 afl_mutate(afl_state_t *afl, u8 *buf, u32 len, u32 steps,
} }
case MUT_CLONE_INSERT: { case MUT_CLONE_FIXED: {
if (likely(len + HAVOC_BLK_XL < max_len)) { if (likely(len + HAVOC_BLK_XL < max_len)) {

View File

@ -2481,7 +2481,7 @@ havoc_stage:
} }
case MUT_CLONE_OVERWRITE: { case MUT_CLONE_COPY: {
if (likely(temp_len + HAVOC_BLK_XL < MAX_FILE)) { if (likely(temp_len + HAVOC_BLK_XL < MAX_FILE)) {
@ -2493,7 +2493,7 @@ havoc_stage:
#ifdef INTROSPECTION #ifdef INTROSPECTION
snprintf(afl->m_tmp, sizeof(afl->m_tmp), " CLONE-%s_%u_%u_%u", snprintf(afl->m_tmp, sizeof(afl->m_tmp), " CLONE-%s_%u_%u_%u",
"overwrite", clone_from, clone_to, clone_len); "COPY", clone_from, clone_to, clone_len);
strcat(afl->mutation, afl->m_tmp); strcat(afl->mutation, afl->m_tmp);
#endif #endif
u8 *new_buf = u8 *new_buf =
@ -2530,7 +2530,7 @@ havoc_stage:
} }
case MUT_CLONE_INSERT: { case MUT_CLONE_FIXED: {
if (likely(temp_len + HAVOC_BLK_XL < MAX_FILE)) { if (likely(temp_len + HAVOC_BLK_XL < MAX_FILE)) {
@ -2544,7 +2544,7 @@ havoc_stage:
#ifdef INTROSPECTION #ifdef INTROSPECTION
snprintf(afl->m_tmp, sizeof(afl->m_tmp), " CLONE-%s_%u_%u_%u", snprintf(afl->m_tmp, sizeof(afl->m_tmp), " CLONE-%s_%u_%u_%u",
"insert", strat, clone_to, clone_len); "FIXED", strat, clone_to, clone_len);
strcat(afl->mutation, afl->m_tmp); strcat(afl->mutation, afl->m_tmp);
#endif #endif
u8 *new_buf = u8 *new_buf =
@ -2587,11 +2587,15 @@ havoc_stage:
if (unlikely(temp_len < 2)) { break; } // no retry if (unlikely(temp_len < 2)) { break; } // no retry
u32 copy_len = choose_block_len(afl, temp_len - 1); u32 copy_from, copy_to,
u32 copy_from = rand_below(afl, temp_len - copy_len + 1); copy_len = choose_block_len(afl, temp_len - 1);
u32 copy_to = rand_below(afl, temp_len - copy_len + 1);
if (likely(copy_from != copy_to)) { do {
copy_from = rand_below(afl, temp_len - copy_len + 1);
copy_to = rand_below(afl, temp_len - copy_len + 1);
} while (unlikely(copy_from == copy_to));
#ifdef INTROSPECTION #ifdef INTROSPECTION
snprintf(afl->m_tmp, sizeof(afl->m_tmp), " OVERWRITE-COPY_%u_%u_%u", snprintf(afl->m_tmp, sizeof(afl->m_tmp), " OVERWRITE-COPY_%u_%u_%u",
@ -2600,8 +2604,6 @@ havoc_stage:
#endif #endif
memmove(out_buf + copy_to, out_buf + copy_from, copy_len); memmove(out_buf + copy_to, out_buf + copy_from, copy_len);
}
break; break;
} }