mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-11 01:31:37 +00:00
added AFL_LLVM_INSTRUMENT, made USE_TRACE_PC obselete and llvm_mode Makefile fix, fixed for FUSELD (for LTO)
This commit is contained in:
van Hauser
parent
5ad50adaa8
commit
452acf3a75
@ -34,7 +34,11 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
|
||||
the last 5 queue entries
|
||||
- rare: puts focus on queue entries that hits rare branches, also ignores
|
||||
runtime
|
||||
- llvm_mode: added Control Flow Integrity sanitizer (AFL_USE_CFISAN)
|
||||
- llvm_mode:
|
||||
- added Control Flow Integrity sanitizer (AFL_USE_CFISAN)
|
||||
- added AFL_LLVM_INSTRUMENT option to control the instrumentation type
|
||||
easier: DEFAULT, CFG (INSTRIM), LTO, CTX, NGRAM-x (x=2-16)
|
||||
- made USE_TRACE_PC compile obsolete
|
||||
- LTO collision free instrumented added in llvm_mode with afl-clang-lto -
|
||||
note that this mode is amazing, but quite some targets won't compile
|
||||
- Added llvm_mode NGRAM prev_loc coverage by Adrean Herrera
|
||||
@ -43,7 +47,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
|
||||
- llvm_mode InsTrim mode:
|
||||
- removed workaround for bug where paths were not instrumented and
|
||||
imported fix by author
|
||||
- made skipping 1 block functions an option and is disable by default,
|
||||
- made skipping 1 block functions an option and is disabled by default,
|
||||
set AFL_LLVM_INSTRIM_SKIPSINGLEBLOCK=1 to re-enable this
|
||||
- qemu_mode:
|
||||
- qemu_mode now uses solely the internal capstone version to fix builds
|
||||
@ -53,6 +57,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
|
||||
- now supports hang mode `-H` to minimize hangs
|
||||
- fixed potential afl-tmin missbehavior for targets with multiple hangs
|
||||
- Pressing Control-c in afl-cmin did not terminate it for some OS
|
||||
- the custom API was rewritten and is now the same for Python and shared
|
||||
libraries.
|
||||
|
||||
|
||||
### Version ++2.62c (release):
|
||||
|
||||
@ -93,6 +93,17 @@ of the settings discussed in section #1, with the exception of:
|
||||
|
||||
Then there are a few specific features that are only available in llvm_mode:
|
||||
|
||||
### Select the instrumentation mode
|
||||
|
||||
- AFL_LLVM_INSTRUMENT - this configures the instrumentation mode.
|
||||
Available options:
|
||||
DEFAULT - classic AFL (map[cur_loc ^ prev_loc >> 1]++)
|
||||
CFG - InsTrim instrumentation (see below)
|
||||
LTO - LTO instrumentation (see below)
|
||||
CTX - context sensitive instrumentation (see below)
|
||||
NGRAM-x - deeper previous location coverage (from NGRAM-2 up to NGRAM-16)
|
||||
Only one can be used.
|
||||
|
||||
### LTO
|
||||
|
||||
This is a different kind way of instrumentation: first it compiles all
|
||||
@ -112,9 +123,32 @@ Then there are a few specific features that are only available in llvm_mode:
|
||||
- AFL_LLVM_LTO_DONTWRITEID prevents that the highest location ID written
|
||||
into the instrumentation is set in a global variable
|
||||
|
||||
Instrim, LTO and ngram modes can not be used together.
|
||||
See llvm_mode/README.LTO.md for more information.
|
||||
|
||||
### INSTRIM
|
||||
|
||||
This feature increases the speed by ~15% without any disadvantages.
|
||||
|
||||
- Setting AFL_LLVM_INSTRIM or AFL_LLVM_INSTRUMENT=CFG to activates this mode
|
||||
|
||||
- Setting AFL_LLVM_INSTRIM_LOOPHEAD=1 expands on INSTRIM to optimize loops.
|
||||
afl-fuzz will only be able to see the path the loop took, but not how
|
||||
many times it was called (unless it is a complex loop).
|
||||
|
||||
- Setting AFL_LLVM_INSTRIM_SKIPSINGLEBLOCK=1 will skip instrumenting
|
||||
functions with a single basic block. This is useful for most C and
|
||||
some C++ targets.
|
||||
|
||||
See llvm_mode/README.instrim.md
|
||||
|
||||
### NGRAM
|
||||
|
||||
- Setting AFL_LLVM_NGRAM_SIZE or AFL_LLVM_INSTRUMENT=NGRAM-{value}
|
||||
activates ngram prev_loc coverage, good values are 2, 4 or 8
|
||||
(any value between 2 and 16 is valid).
|
||||
|
||||
See llvm_mode/README.ngram.md
|
||||
|
||||
### LAF-INTEL
|
||||
|
||||
This great feature will split compares to series of single byte comparisons
|
||||
@ -139,32 +173,6 @@ Then there are a few specific features that are only available in llvm_mode:
|
||||
|
||||
See llvm_mode/README.whitelist.md for more information.
|
||||
|
||||
### INSTRIM
|
||||
|
||||
This feature increases the speed by whopping 20% but at the cost of a
|
||||
lower path discovery and therefore coverage.
|
||||
|
||||
- Setting AFL_LLVM_INSTRIM activates this mode
|
||||
|
||||
- Setting AFL_LLVM_INSTRIM_LOOPHEAD=1 expands on INSTRIM to optimize loops.
|
||||
afl-fuzz will only be able to see the path the loop took, but not how
|
||||
many times it was called (unless it is a complex loop).
|
||||
|
||||
- Setting AFL_LLVM_INSTRIM_SKIPSINGLEBLOCK=1 will skip instrumenting
|
||||
functions with a single basic block. This is useful for most C and
|
||||
some C++ targets.
|
||||
|
||||
Instrim, LTO and ngram modes can not be used together.
|
||||
See llvm_mode/README.instrim.md
|
||||
|
||||
### NGRAM
|
||||
|
||||
- Setting AFL_LLVM_NGRAM_SIZE activates ngram prev_loc coverage, good
|
||||
values are 2, 4 or 8.
|
||||
|
||||
Instrim, LTO and ngram modes can not be used together.
|
||||
See llvm_mode/README.ngram.md
|
||||
|
||||
### NOT_ZERO
|
||||
|
||||
- Setting AFL_LLVM_NOT_ZERO=1 during compilation will use counters
|
||||
|
||||
@ -134,15 +134,22 @@ ifeq "$(AFL_REAL_LD)" ""
|
||||
endif
|
||||
endif
|
||||
|
||||
AFL_CLANG_FUSELD=
|
||||
ifneq "$(AFL_CLANG_FLTO)" ""
|
||||
ifeq "$(shell echo 'int main() {return 0; }' | $(CC) -x c - -fuse-ld=`command -v ld` -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
|
||||
AFL_CLANG_FUSELD=1
|
||||
endif
|
||||
endif
|
||||
|
||||
CFLAGS ?= -O3 -funroll-loops -D_FORTIFY_SOURCE=2
|
||||
override CFLAGS = -Wall \
|
||||
-g -Wno-pointer-sign -I ../include/ \
|
||||
-DAFL_PATH=\"$(HELPER_PATH)\" -DBIN_PATH=\"$(BIN_PATH)\" \
|
||||
-DLLVM_BINDIR=\"$(LLVM_BINDIR)\" -DVERSION=\"$(VERSION)\" \
|
||||
-DLLVM_VERSION=\"$(LLVMVER)\" -DAFL_CLANG_FLTO=\"$(AFL_CLANG_FLTO)\" \
|
||||
-DAFL_REAL_LD=\"$(AFL_REAL_LD)\" -Wno-unused-function
|
||||
-DAFL_REAL_LD=\"$(AFL_REAL_LD)\" -DAFL_CLANG_FUSELD=\"$(AFL_CLANG_FUSELD)\" -Wno-unused-function
|
||||
ifdef AFL_TRACE_PC
|
||||
CFLAGS += -DUSE_TRACE_PC=1
|
||||
$(info Compile option AFL_TRACE_PC is deprecated, just set AFL_LLVM_INSTRUMENT=PCGUARD to activate when compiling targets )
|
||||
endif
|
||||
|
||||
CXXFLAGS ?= -O3 -funroll-loops -D_FORTIFY_SOURCE=2
|
||||
@ -162,10 +169,6 @@ ifeq "$(shell uname)" "OpenBSD"
|
||||
CLANG_LFL += `$(LLVM_CONFIG) --libdir`/libLLVM.so
|
||||
endif
|
||||
|
||||
ifeq "$(shell echo 'int main() {return 0; }' | $(CC) -x c - -fuse-ld=`command -v ld` -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
|
||||
CFLAGS += -DAFL_CLANG_FUSELD=1
|
||||
endif
|
||||
|
||||
ifeq "$(shell echo '$(HASH)include <sys/ipc.h>@$(HASH)include <sys/shm.h>@int main() { int _id = shmget(IPC_PRIVATE, 65536, IPC_CREAT | IPC_EXCL | 0600); shmctl(_id, IPC_RMID, 0); return 0;}' | tr @ '\n' | $(CC) -x c - -o .test2 2>/dev/null && echo 1 || echo 0 ; rm -f .test2 )" "1"
|
||||
SHMAT_OK=1
|
||||
else
|
||||
@ -180,11 +183,7 @@ ifeq "$(TEST_MMAP)" "1"
|
||||
LDFLAGS += -lrt
|
||||
endif
|
||||
|
||||
ifndef AFL_TRACE_PC
|
||||
PROGS = ../afl-clang-fast ../afl-ld ../afl-llvm-pass.so ../afl-llvm-lto-whitelist.so ../afl-llvm-lto-instrumentation.so ../libLLVMInsTrim.so ../afl-llvm-rt.o ../afl-llvm-rt-32.o ../afl-llvm-rt-64.o ../compare-transform-pass.so ../split-compares-pass.so ../split-switches-pass.so ../cmplog-routines-pass.so ../cmplog-instructions-pass.so
|
||||
else
|
||||
PROGS = ../afl-clang-fast ../afl-llvm-rt.o ../afl-llvm-rt-32.o ../afl-llvm-rt-64.o ../compare-transform-pass.so ../split-compares-pass.so ../split-switches-pass.so ../cmplog-routines-pass.so ../cmplog-instructions-pass.so
|
||||
endif
|
||||
|
||||
# If prerequisites are not given, warn, do not build anything, and exit with code 0
|
||||
ifeq "$(LLVMVER)" ""
|
||||
@ -222,14 +221,10 @@ no_build:
|
||||
@printf "%b\\n" "\\033[0;31mPrerequisites are not met, skipping build llvm_mode\\033[0m"
|
||||
|
||||
test_deps:
|
||||
ifndef AFL_TRACE_PC
|
||||
@echo "[*] Checking for working 'llvm-config'..."
|
||||
ifneq "$(LLVM_APPLE)" "1"
|
||||
@type $(LLVM_CONFIG) >/dev/null 2>&1 || ( echo "[-] Oops, can't find 'llvm-config'. Install clang or set \$$LLVM_CONFIG or \$$PATH beforehand."; echo " (Sometimes, the binary will be named llvm-config-3.5 or something like that.)"; exit 1 )
|
||||
endif
|
||||
else
|
||||
@echo "[!] Note: using -fsanitize=trace-pc mode (this will fail with older LLVM)."
|
||||
endif
|
||||
@echo "[*] Checking for working '$(CC)'..."
|
||||
@type $(CC) >/dev/null 2>&1 || ( echo "[-] Oops, can't find '$(CC)'. Make sure that it's in your \$$PATH (or set \$$CC and \$$CXX)."; exit 1 )
|
||||
@echo "[*] Checking for matching versions of '$(CC)' and '$(LLVM_CONFIG)'"
|
||||
@ -327,12 +322,8 @@ all_done: test_build
|
||||
|
||||
install: all
|
||||
install -d -m 755 $${DESTDIR}$(BIN_PATH) $${DESTDIR}$(HELPER_PATH) $${DESTDIR}$(DOC_PATH) $${DESTDIR}$(MISC_PATH)
|
||||
ifndef AFL_TRACE_PC
|
||||
if [ -f ../afl-clang-fast -a -f ../libLLVMInsTrim.so -a -f ../afl-llvm-rt.o ]; then set -e; install -m 755 ../afl-clang-fast $${DESTDIR}$(BIN_PATH); ln -sf afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang-fast++; install -m 755 ../libLLVMInsTrim.so ../afl-llvm-pass.so ../afl-llvm-rt.o $${DESTDIR}$(HELPER_PATH); fi
|
||||
if [ -f afl-clang-lto -a -f afl-ld ]; then set -e; install -m 755 afl-clang-lto $${DESTDIR}$(BIN_PATH); ln -sf afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang-lto++; install -m 755 afl-ld $${DESTDIR}$(HELPER_PATH); ln -sf afl-ld $${DESTDIR}$(HELPER_PATH)/ld; install -m 755 afl-llvm-lto-instrumentation.so $${DESTDIR}$(HELPER_PATH); install -m 755 afl-llvm-lto-whitelist.so $${DESTDIR}$(HELPER_PATH); fi
|
||||
else
|
||||
if [ -f ../afl-clang-fast -a -f ../afl-llvm-rt.o ]; then set -e; install -m 755 ../afl-clang-fast $${DESTDIR}$(BIN_PATH); ln -sf afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang-fast++; install -m 755 ../afl-llvm-rt.o $${DESTDIR}$(HELPER_PATH); fi
|
||||
endif
|
||||
if [ -f ../afl-clang-lto -a -f ../afl-ld ]; then set -e; ln -sf afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang-lto; ln -sf afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang-lto++; install -m 755 ../afl-ld $${DESTDIR}$(HELPER_PATH); ln -sf afl-ld $${DESTDIR}$(HELPER_PATH)/ld; install -m 755 ../afl-llvm-lto-instrumentation.so $${DESTDIR}$(HELPER_PATH); install -m 755 ../afl-llvm-lto-whitelist.so $${DESTDIR}$(HELPER_PATH); fi
|
||||
if [ -f ../afl-llvm-rt-32.o ]; then set -e; install -m 755 ../afl-llvm-rt-32.o $${DESTDIR}$(HELPER_PATH); fi
|
||||
if [ -f ../afl-llvm-rt-64.o ]; then set -e; install -m 755 ../afl-llvm-rt-64.o $${DESTDIR}$(HELPER_PATH); fi
|
||||
if [ -f ../compare-transform-pass.so ]; then set -e; install -m 755 ../compare-transform-pass.so $${DESTDIR}$(HELPER_PATH); fi
|
||||
|
||||
@ -5,13 +5,12 @@ InsTrim: Lightweight Instrumentation for Coverage-guided Fuzzing
|
||||
## Introduction
|
||||
|
||||
InsTrim uses CFG and markers to instrument just what is necessary in the
|
||||
binary in llvm_mode. It is about 20-25% faster but as a cost has a lower
|
||||
path discovery.
|
||||
binary in llvm_mode. It is about 10-15% faster without disadvantages.
|
||||
|
||||
## Usage
|
||||
|
||||
Set the environment variable `AFL_LLVM_INSTRIM=1` during compilation of
|
||||
the target.
|
||||
Set the environment variable `AFL_LLVM_INSTRUMENT=CFG` or `AFL_LLVM_INSTRIM=1`
|
||||
during compilation of the target.
|
||||
|
||||
There is also an advanced mode which instruments loops in a way so that
|
||||
afl-fuzz can see which loop path has been selected but not being able to
|
||||
|
||||
@ -16,5 +16,6 @@ the same results when compiling source code.
|
||||
## Usage
|
||||
|
||||
The size of `n` (i.e., the number of branches to remember) is an option
|
||||
that is specified in the `AFL_LLVM_NGRAM_SIZE` environment variable.
|
||||
Good values are 2, 4 or 8.
|
||||
that is specified either in the `AFL_LLVM_INSTRUMENT=NGRAM-{value}` or the
|
||||
`AFL_LLVM_NGRAM_SIZE` environment variable.
|
||||
Good values are 2, 4 or 8, valid are 2-16.
|
||||
|
||||
@ -29,11 +29,13 @@
|
||||
#include "types.h"
|
||||
#include "debug.h"
|
||||
#include "alloc-inl.h"
|
||||
#include "llvm-ngram-coverage.h"
|
||||
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <strings.h>
|
||||
#include <limits.h>
|
||||
#include <assert.h>
|
||||
|
||||
@ -41,7 +43,7 @@ static u8 * obj_path; /* Path to runtime libraries */
|
||||
static u8 **cc_params; /* Parameters passed to the real CC */
|
||||
static u32 cc_par_cnt = 1; /* Param count, including argv0 */
|
||||
static u8 llvm_fullpath[PATH_MAX];
|
||||
static u8 lto_mode;
|
||||
static u8 instrument_mode;
|
||||
static u8 * lto_flag = AFL_CLANG_FLTO;
|
||||
static u8 * march_opt = CFLAGS_OPT;
|
||||
static u8 debug;
|
||||
@ -49,6 +51,26 @@ static u8 cwd[4096];
|
||||
static u8 cmplog_mode;
|
||||
u8 use_stdin = 0; /* dummy */
|
||||
|
||||
enum {
|
||||
|
||||
INSTRUMENT_CLASSIC = 0,
|
||||
INSTRUMENT_AFL = 0,
|
||||
INSTRUMENT_DEFAULT = 0,
|
||||
INSTRUMENT_PCGUARD = 1,
|
||||
INSTRUMENT_INSTRIM = 2,
|
||||
INSTRUMENT_CFG = 2,
|
||||
INSTRUMENT_LTO = 3,
|
||||
INSTRUMENT_CTX = 4,
|
||||
INSTRUMENT_NGRAM = 5 // + ngram value of 2-16 = 7 - 21
|
||||
|
||||
};
|
||||
|
||||
char instrument_mode_string[6][16] = {
|
||||
|
||||
"DEFAULT", "PCGUARD", "CFG", "LTO", "CTX",
|
||||
|
||||
};
|
||||
|
||||
u8 *getthecwd() {
|
||||
|
||||
static u8 fail[] = "";
|
||||
@ -150,26 +172,11 @@ static void edit_params(u32 argc, char **argv, char **envp) {
|
||||
|
||||
has_llvm_config = (strlen(LLVM_BINDIR) > 0);
|
||||
|
||||
if (!strncmp(name, "afl-clang-lto", strlen("afl-clang-lto"))) {
|
||||
|
||||
#ifdef USE_TRACE_PC
|
||||
FATAL("afl-clang-lto does not work with TRACE_PC mode");
|
||||
#endif
|
||||
if (instrument_mode == INSTRUMENT_LTO)
|
||||
if (lto_flag[0] != '-')
|
||||
FATAL(
|
||||
"Using afl-clang-lto is not possible because Makefile magic did not "
|
||||
"identify the correct -flto flag");
|
||||
if (getenv("AFL_LLVM_INSTRIM") != NULL)
|
||||
FATAL("afl-clang-lto does not work with InsTrim mode");
|
||||
if (getenv("AFL_LLVM_NGRAM_SIZE") != NULL)
|
||||
FATAL("afl-clang-lto does not work with ngram coverage mode");
|
||||
lto_mode = 1;
|
||||
|
||||
}
|
||||
|
||||
if (getenv("AFL_LLVM_NGRAM_SIZE") != NULL &&
|
||||
getenv("AFL_LLVM_INSTRIM") != NULL)
|
||||
FATAL("AFL_LLVM_NGRAM_SIZE and AFL_LLVM_INSTRIM cannot be used together");
|
||||
|
||||
if (!strcmp(name, "afl-clang-fast++") || !strcmp(name, "afl-clang-lto++")) {
|
||||
|
||||
@ -260,17 +267,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
#ifdef USE_TRACE_PC
|
||||
|
||||
cc_params[cc_par_cnt++] =
|
||||
"-fsanitize-coverage=trace-pc-guard"; // edge coverage by default
|
||||
// cc_params[cc_par_cnt++] = "-mllvm";
|
||||
// cc_params[cc_par_cnt++] =
|
||||
// "-fsanitize-coverage=trace-cmp,trace-div,trace-gep";
|
||||
// cc_params[cc_par_cnt++] = "-sanitizer-coverage-block-threshold=0";
|
||||
#else
|
||||
|
||||
if (lto_mode) {
|
||||
if (instrument_mode == INSTRUMENT_LTO) {
|
||||
|
||||
char *old_path = getenv("PATH");
|
||||
char *new_path = alloc_printf("%s:%s", AFL_PATH, old_path);
|
||||
@ -299,8 +296,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
|
||||
|
||||
} else
|
||||
|
||||
if (getenv("USE_TRACE_PC") || getenv("AFL_USE_TRACE_PC") ||
|
||||
getenv("AFL_LLVM_USE_TRACE_PC") || getenv("AFL_TRACE_PC")) {
|
||||
if (instrument_mode == INSTRUMENT_PCGUARD) {
|
||||
|
||||
cc_params[cc_par_cnt++] =
|
||||
"-fsanitize-coverage=trace-pc-guard"; // edge coverage by default
|
||||
@ -310,15 +306,13 @@ static void edit_params(u32 argc, char **argv, char **envp) {
|
||||
cc_params[cc_par_cnt++] = "-Xclang";
|
||||
cc_params[cc_par_cnt++] = "-load";
|
||||
cc_params[cc_par_cnt++] = "-Xclang";
|
||||
if (getenv("AFL_LLVM_INSTRIM") != NULL || getenv("INSTRIM_LIB") != NULL)
|
||||
if (instrument_mode == INSTRUMENT_CFG)
|
||||
cc_params[cc_par_cnt++] = alloc_printf("%s/libLLVMInsTrim.so", obj_path);
|
||||
else
|
||||
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-pass.so", obj_path);
|
||||
|
||||
}
|
||||
|
||||
#endif /* ^USE_TRACE_PC */
|
||||
|
||||
cc_params[cc_par_cnt++] = "-Qunused-arguments";
|
||||
|
||||
/* Detect stray -v calls from ./configure scripts. */
|
||||
@ -389,7 +383,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
|
||||
|
||||
if (getenv("AFL_USE_CFISAN")) {
|
||||
|
||||
if (!lto_mode) {
|
||||
if (instrument_mode != INSTRUMENT_LTO) {
|
||||
|
||||
uint32_t i = 0, found = 0;
|
||||
while (envp[i] != NULL && !found)
|
||||
@ -403,15 +397,6 @@ static void edit_params(u32 argc, char **argv, char **envp) {
|
||||
|
||||
}
|
||||
|
||||
#ifdef USE_TRACE_PC
|
||||
|
||||
if (getenv("USE_TRACE_PC") || getenv("AFL_USE_TRACE_PC") ||
|
||||
getenv("AFL_LLVM_USE_TRACE_PC") || getenv("AFL_TRACE_PC"))
|
||||
if (getenv("AFL_INST_RATIO"))
|
||||
FATAL("AFL_INST_RATIO not available at compile time with 'trace-pc'.");
|
||||
|
||||
#endif /* USE_TRACE_PC */
|
||||
|
||||
if (!getenv("AFL_DONT_OPTIMIZE")) {
|
||||
|
||||
cc_params[cc_par_cnt++] = "-g";
|
||||
@ -534,7 +519,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
|
||||
int main(int argc, char **argv, char **envp) {
|
||||
|
||||
int i;
|
||||
char *callname = "afl-clang-fast";
|
||||
char *callname = "afl-clang-fast", *ptr;
|
||||
|
||||
if (getenv("AFL_DEBUG")) {
|
||||
|
||||
@ -545,83 +530,200 @@ int main(int argc, char **argv, char **envp) {
|
||||
|
||||
be_quiet = 1;
|
||||
|
||||
if (strstr(argv[0], "afl-clang-lto") != NULL) callname = "afl-clang-lto";
|
||||
|
||||
if (argc < 2 || strcmp(argv[1], "-h") == 0) {
|
||||
|
||||
#ifdef USE_TRACE_PC
|
||||
printf(cCYA "afl-clang-fast" VERSION cRST
|
||||
" [tpcg] by <lszekeres@google.com>\n")
|
||||
#else
|
||||
if (strstr(argv[0], "afl-clang-lto") == NULL)
|
||||
instrument_mode = INSTRUMENT_PCGUARD;
|
||||
#endif
|
||||
|
||||
printf("afl-clang-fast" VERSION " by <lszekeres@google.com>\n");
|
||||
if ((ptr = getenv("AFL_LLVM_INSTRUMENT")) != NULL) {
|
||||
|
||||
else {
|
||||
if (strncasecmp(ptr, "cfg", strlen("cfg")) == 0 ||
|
||||
strncasecmp(ptr, "instrim", strlen("instrim")) == 0)
|
||||
instrument_mode = INSTRUMENT_CFG;
|
||||
else if (strncasecmp(ptr, "pc-guard", strlen("pc-guard")) == 0 ||
|
||||
strncasecmp(ptr, "pcguard", strlen("pcgard")) == 0)
|
||||
instrument_mode = INSTRUMENT_PCGUARD;
|
||||
else if (strncasecmp(ptr, "lto", strlen("lto")) == 0)
|
||||
instrument_mode = INSTRUMENT_LTO;
|
||||
else if (strncasecmp(ptr, "ctx", strlen("ctx")) == 0)
|
||||
instrument_mode = INSTRUMENT_CTX;
|
||||
else if (strncasecmp(ptr, "ngram", strlen("ngram")) == 0) {
|
||||
|
||||
printf("afl-clang-lto" VERSION
|
||||
" by Marc \"vanHauser\" Heuse <mh@mh-sec.de>\n");
|
||||
ptr += strlen("ngram");
|
||||
while (*ptr && (*ptr < '0' || *ptr > '9'))
|
||||
ptr++;
|
||||
if (!*ptr)
|
||||
if ((ptr = getenv("AFL_LLVM_NGRAM_SIZE")) != NULL)
|
||||
FATAL(
|
||||
"you must set the NGRAM size with (e.g. for value 2) "
|
||||
"AFL_LLVM_INSTRUMENT=ngram-2");
|
||||
instrument_mode = INSTRUMENT_NGRAM + atoi(ptr);
|
||||
if (instrument_mode < INSTRUMENT_NGRAM + 2 ||
|
||||
instrument_mode > INSTRUMENT_NGRAM + NGRAM_SIZE_MAX)
|
||||
FATAL(
|
||||
"NGRAM instrumentation mode must be between 2 and NGRAM_SIZE_MAX "
|
||||
"(%u)",
|
||||
NGRAM_SIZE_MAX);
|
||||
|
||||
ptr = alloc_printf("%u", instrument_mode - INSTRUMENT_NGRAM);
|
||||
setenv("AFL_LLVM_NGRAM_SIZE", ptr, 1);
|
||||
|
||||
} else if (strncasecmp(ptr, "classic", strlen("classic")) != 0 ||
|
||||
|
||||
strncasecmp(ptr, "default", strlen("default")) != 0 ||
|
||||
strncasecmp(ptr, "afl", strlen("afl")) != 0)
|
||||
FATAL("unknown AFL_LLVM_INSTRUMENT value: %s", ptr);
|
||||
|
||||
}
|
||||
|
||||
if (getenv("USE_TRACE_PC") || getenv("AFL_USE_TRACE_PC") ||
|
||||
getenv("AFL_LLVM_USE_TRACE_PC") || getenv("AFL_TRACE_PC")) {
|
||||
|
||||
if (instrument_mode == 0)
|
||||
instrument_mode = INSTRUMENT_PCGUARD;
|
||||
else if (instrument_mode != INSTRUMENT_PCGUARD)
|
||||
FATAL("you can not set AFL_LLVM_INSTRUMENT and AFL_TRACE_PC together");
|
||||
|
||||
}
|
||||
|
||||
if (getenv("AFL_LLVM_INSTRIM") || getenv("INSTRIM") ||
|
||||
getenv("INSTRIM_LIB")) {
|
||||
|
||||
if (instrument_mode == 0)
|
||||
instrument_mode = INSTRUMENT_CFG;
|
||||
else if (instrument_mode != INSTRUMENT_CFG)
|
||||
FATAL(
|
||||
"you can not set AFL_LLVM_INSTRUMENT and AFL_LLVM_INSTRIM together");
|
||||
|
||||
}
|
||||
|
||||
if (getenv("AFL_LLVM_CTX")) {
|
||||
|
||||
if (instrument_mode == 0)
|
||||
instrument_mode = INSTRUMENT_CTX;
|
||||
else if (instrument_mode != INSTRUMENT_CTX)
|
||||
FATAL("you can not set AFL_LLVM_INSTRUMENT and AFL_LLVM_CTX together");
|
||||
|
||||
}
|
||||
|
||||
if (getenv("AFL_LLVM_NGRAM_SIZE")) {
|
||||
|
||||
if (instrument_mode == 0) {
|
||||
|
||||
instrument_mode = INSTRUMENT_NGRAM + atoi(getenv("AFL_LLVM_NGRAM_SIZE"));
|
||||
if (instrument_mode < INSTRUMENT_NGRAM + 2 ||
|
||||
instrument_mode > INSTRUMENT_NGRAM + NGRAM_SIZE_MAX)
|
||||
FATAL(
|
||||
"NGRAM instrumentation mode must be between 2 and NGRAM_SIZE_MAX "
|
||||
"(%u)",
|
||||
NGRAM_SIZE_MAX);
|
||||
|
||||
} else if (instrument_mode != INSTRUMENT_NGRAM)
|
||||
|
||||
FATAL(
|
||||
"you can not set AFL_LLVM_INSTRUMENT and AFL_LLVM_NGRAM_SIZE "
|
||||
"together");
|
||||
|
||||
}
|
||||
|
||||
if (instrument_mode < INSTRUMENT_NGRAM)
|
||||
ptr = instrument_mode_string[instrument_mode];
|
||||
else
|
||||
ptr = alloc_printf("NGRAM-%u", instrument_mode - INSTRUMENT_NGRAM);
|
||||
|
||||
if (strstr(argv[0], "afl-clang-lto") != NULL) {
|
||||
|
||||
if (instrument_mode == 0 || instrument_mode == INSTRUMENT_LTO) {
|
||||
|
||||
callname = "afl-clang-lto";
|
||||
instrument_mode = INSTRUMENT_LTO;
|
||||
ptr = instrument_mode_string[instrument_mode];
|
||||
|
||||
} else {
|
||||
|
||||
if (!be_quiet)
|
||||
WARNF("afl-clang-lto called with mode %s, using that mode instead",
|
||||
ptr);
|
||||
|
||||
}
|
||||
|
||||
#endif /* ^USE_TRACE_PC */
|
||||
}
|
||||
|
||||
SAYF(
|
||||
"\n"
|
||||
"%s[++] [options]\n"
|
||||
"\n"
|
||||
"This is a helper application for afl-fuzz. It serves as a drop-in "
|
||||
"replacement\n"
|
||||
"for clang, letting you recompile third-party code with the "
|
||||
"required "
|
||||
"runtime\n"
|
||||
"instrumentation. A common use pattern would be one of the "
|
||||
"following:\n\n"
|
||||
#ifndef AFL_CLANG_FLTO
|
||||
if (instrument_mode == INSTRUMENT_LTO)
|
||||
FATAL("instrumentation mode LTO specified but LLVM support not available");
|
||||
#endif
|
||||
|
||||
" CC=%s/afl-clang-fast ./configure\n"
|
||||
" CXX=%s/afl-clang-fast++ ./configure\n\n"
|
||||
if (argc < 2 || strcmp(argv[1], "-h") == 0) {
|
||||
|
||||
"In contrast to the traditional afl-clang tool, this version is "
|
||||
"implemented as\n"
|
||||
"an LLVM pass and tends to offer improved performance with slow "
|
||||
"programs.\n\n"
|
||||
if (instrument_mode != INSTRUMENT_LTO)
|
||||
printf("afl-clang-fast" VERSION " by <lszekeres@google.com> in %s mode\n",
|
||||
ptr);
|
||||
else
|
||||
printf("afl-clang-lto" VERSION
|
||||
" by Marc \"vanHauser\" Heuse <mh@mh-sec.de> in %s mode\n",
|
||||
ptr);
|
||||
|
||||
"Environment variables used:\n"
|
||||
"AFL_CC: path to the C compiler to use\n"
|
||||
"AFL_CXX: path to the C++ compiler to use\n"
|
||||
"AFL_PATH: path to instrumenting pass and runtime "
|
||||
"(afl-llvm-rt.*o)\n"
|
||||
"AFL_DONT_OPTIMIZE: disable optimization instead of -O3\n"
|
||||
"AFL_NO_BUILTIN: compile for use with libtokencap.so\n"
|
||||
"AFL_INST_RATIO: percentage of branches to instrument\n"
|
||||
"AFL_QUIET: suppress verbose output\n"
|
||||
"AFL_DEBUG: enable developer debugging output\n"
|
||||
"AFL_HARDEN: adds code hardening to catch memory bugs\n"
|
||||
"AFL_USE_ASAN: activate address sanitizer\n"
|
||||
"AFL_USE_MSAN: activate memory sanitizer\n"
|
||||
"AFL_USE_UBSAN: activate undefined behaviour sanitizer\n"
|
||||
"AFL_USE_CFISAN: activate control flow sanitizer\n"
|
||||
"AFL_LLVM_WHITELIST: enable whitelisting (selective "
|
||||
"instrumentation)\n"
|
||||
"AFL_LLVM_NOT_ZERO: use cycling trace counters that skip zero\n"
|
||||
"AFL_LLVM_USE_TRACE_PC: use LLVM trace-pc-guard instrumentation\n"
|
||||
"AFL_LLVM_LAF_SPLIT_COMPARES: enable cascaded comparisons\n"
|
||||
"AFL_LLVM_LAF_SPLIT_SWITCHES: casc. comp. in 'switch'\n"
|
||||
"AFL_LLVM_LAF_TRANSFORM_COMPARES: transform library comparison "
|
||||
"function calls\n"
|
||||
" to cascaded comparisons\n"
|
||||
"AFL_LLVM_LAF_SPLIT_FLOATS: transform floating point comp. to "
|
||||
"cascaded "
|
||||
"comp.\n"
|
||||
"AFL_LLVM_LAF_SPLIT_COMPARES_BITW: size limit (default 8)\n",
|
||||
callname, BIN_PATH, BIN_PATH);
|
||||
SAYF(
|
||||
"\n"
|
||||
"%s[++] [options]\n"
|
||||
"\n"
|
||||
"This is a helper application for afl-fuzz. It serves as a drop-in "
|
||||
"replacement\n"
|
||||
"for clang, letting you recompile third-party code with the "
|
||||
"required "
|
||||
"runtime\n"
|
||||
"instrumentation. A common use pattern would be one of the "
|
||||
"following:\n\n"
|
||||
|
||||
" CC=%s/afl-clang-fast ./configure\n"
|
||||
" CXX=%s/afl-clang-fast++ ./configure\n\n"
|
||||
|
||||
"In contrast to the traditional afl-clang tool, this version is "
|
||||
"implemented as\n"
|
||||
"an LLVM pass and tends to offer improved performance with slow "
|
||||
"programs.\n\n"
|
||||
|
||||
"Environment variables used:\n"
|
||||
"AFL_CC: path to the C compiler to use\n"
|
||||
"AFL_CXX: path to the C++ compiler to use\n"
|
||||
"AFL_PATH: path to instrumenting pass and runtime "
|
||||
"(afl-llvm-rt.*o)\n"
|
||||
"AFL_DONT_OPTIMIZE: disable optimization instead of -O3\n"
|
||||
"AFL_NO_BUILTIN: compile for use with libtokencap.so\n"
|
||||
"AFL_INST_RATIO: percentage of branches to instrument\n"
|
||||
"AFL_QUIET: suppress verbose output\n"
|
||||
"AFL_DEBUG: enable developer debugging output\n"
|
||||
"AFL_HARDEN: adds code hardening to catch memory bugs\n"
|
||||
"AFL_USE_ASAN: activate address sanitizer\n"
|
||||
"AFL_USE_MSAN: activate memory sanitizer\n"
|
||||
"AFL_USE_UBSAN: activate undefined behaviour sanitizer\n"
|
||||
"AFL_USE_CFISAN: activate control flow sanitizer\n"
|
||||
"AFL_LLVM_WHITELIST: enable whitelisting (selective "
|
||||
"instrumentation)\n"
|
||||
"AFL_LLVM_NOT_ZERO: use cycling trace counters that skip zero\n"
|
||||
"AFL_LLVM_LAF_SPLIT_COMPARES: enable cascaded comparisons\n"
|
||||
"AFL_LLVM_LAF_SPLIT_SWITCHES: casc. comp. in 'switch'\n"
|
||||
"AFL_LLVM_LAF_TRANSFORM_COMPARES: transform library comparison "
|
||||
"function calls\n"
|
||||
" to cascaded comparisons\n"
|
||||
"AFL_LLVM_LAF_SPLIT_FLOATS: transform floating point comp. to "
|
||||
"cascaded "
|
||||
"comp.\n"
|
||||
"AFL_LLVM_LAF_SPLIT_COMPARES_BITW: size limit (default 8)\n",
|
||||
callname, BIN_PATH, BIN_PATH);
|
||||
|
||||
SAYF(
|
||||
"\nafl-clang-fast specific environment variables:\n"
|
||||
"AFL_LLVM_CMPLOG: log operands of comparisons (RedQueen mutator)\n"
|
||||
"AFL_LLVM_INSTRUMENT: set instrumentation mode: DEFAULT, CFG "
|
||||
"(INSTRIM), LTO, CTX, NGRAM-2 ... NGRAM-16\n"
|
||||
"You can also use the old environment variables:"
|
||||
"AFL_LLVM_CTX: use context sensitive coverage\n"
|
||||
"AFL_LLVM_USE_TRACE_PC: use LLVM trace-pc-guard instrumentation\n"
|
||||
"AFL_LLVM_NGRAM_SIZE: use ngram prev_loc count coverage\n"
|
||||
"AFL_LLVM_INSTRIM: use light weight instrumentation InsTrim\n"
|
||||
"AFL_LLVM_INSTRIM_LOOPHEAD: optimize loop tracing for speed\n"
|
||||
"AFL_LLVM_NGRAM_SIZE: use ngram prev_loc coverage\n"
|
||||
"AFL_LLVM_CMPLOG: log operands of comparisons (RedQueen mutator)\n");
|
||||
"AFL_LLVM_INSTRIM_LOOPHEAD: optimize loop tracing for speed (sub "
|
||||
"option to INSTRIM)\n");
|
||||
|
||||
#ifdef AFL_CLANG_FLTO
|
||||
SAYF(
|
||||
@ -652,22 +754,17 @@ int main(int argc, char **argv, char **envp) {
|
||||
|
||||
getenv("AFL_DEBUG") != NULL) {
|
||||
|
||||
#ifdef USE_TRACE_PC
|
||||
SAYF(cCYA "afl-clang-fast" VERSION cRST
|
||||
" [tpcg] by <lszekeres@google.com>\n");
|
||||
#warning \
|
||||
"You do not need to specifically compile with USE_TRACE_PC anymore, setting the environment variable AFL_LLVM_USE_TRACE_PC is enough."
|
||||
#else
|
||||
if (strstr(argv[0], "afl-clang-lto") == NULL)
|
||||
if (instrument_mode != INSTRUMENT_LTO)
|
||||
|
||||
SAYF(cCYA "afl-clang-fast" VERSION cRST " by <lszekeres@google.com>\n");
|
||||
SAYF(cCYA "afl-clang-fast" VERSION cRST
|
||||
" by <lszekeres@google.com> in %s mode\n",
|
||||
ptr);
|
||||
|
||||
else
|
||||
|
||||
SAYF(cCYA "afl-clang-lto" VERSION cRST
|
||||
" by Marc \"vanHauser\" Heuse <mh@mh-sec.de>\n");
|
||||
|
||||
#endif /* ^USE_TRACE_PC */
|
||||
" by Marc \"vanHauser\" Heuse <mh@mh-sec.de> in mode %s\n",
|
||||
ptr);
|
||||
|
||||
}
|
||||
|
||||
|
||||
@ -216,11 +216,11 @@ bool AFLCoverage::runOnModule(Module &M) {
|
||||
|
||||
if (ngram_size_str)
|
||||
if (sscanf(ngram_size_str, "%u", &ngram_size) != 1 || ngram_size < 2 ||
|
||||
ngram_size > MAX_NGRAM_SIZE)
|
||||
ngram_size > NGRAM_SIZE_MAX)
|
||||
FATAL(
|
||||
"Bad value of AFL_NGRAM_SIZE (must be between 2 and MAX_NGRAM_SIZE "
|
||||
"Bad value of AFL_NGRAM_SIZE (must be between 2 and NGRAM_SIZE_MAX "
|
||||
"(%u))",
|
||||
MAX_NGRAM_SIZE);
|
||||
NGRAM_SIZE_MAX);
|
||||
|
||||
if (ngram_size == 1) ngram_size = 0;
|
||||
if (ngram_size)
|
||||
|
||||
@ -63,10 +63,10 @@ u8 __afl_area_initial[MAP_SIZE];
|
||||
u8 *__afl_area_ptr = __afl_area_initial;
|
||||
|
||||
#ifdef __ANDROID__
|
||||
PREV_LOC_T __afl_prev_loc[MAX_NGRAM_SIZE];
|
||||
PREV_LOC_T __afl_prev_loc[NGRAM_SIZE_MAX];
|
||||
u32 __afl_final_loc;
|
||||
#else
|
||||
__thread PREV_LOC_T __afl_prev_loc[MAX_NGRAM_SIZE];
|
||||
__thread PREV_LOC_T __afl_prev_loc[NGRAM_SIZE_MAX];
|
||||
__thread u32 __afl_final_loc;
|
||||
#endif
|
||||
|
||||
@ -282,7 +282,7 @@ int __afl_persistent_loop(unsigned int max_cnt) {
|
||||
|
||||
memset(__afl_area_ptr, 0, MAP_SIZE);
|
||||
__afl_area_ptr[0] = 1;
|
||||
memset(__afl_prev_loc, 0, MAX_NGRAM_SIZE * sizeof(PREV_LOC_T));
|
||||
memset(__afl_prev_loc, 0, NGRAM_SIZE_MAX * sizeof(PREV_LOC_T));
|
||||
|
||||
}
|
||||
|
||||
@ -299,7 +299,7 @@ int __afl_persistent_loop(unsigned int max_cnt) {
|
||||
raise(SIGSTOP);
|
||||
|
||||
__afl_area_ptr[0] = 1;
|
||||
memset(__afl_prev_loc, 0, MAX_NGRAM_SIZE * sizeof(PREV_LOC_T));
|
||||
memset(__afl_prev_loc, 0, NGRAM_SIZE_MAX * sizeof(PREV_LOC_T));
|
||||
|
||||
return 1;
|
||||
|
||||
|
||||
@ -12,7 +12,7 @@ typedef u64 PREV_LOC_T;
|
||||
#endif
|
||||
|
||||
/* Maximum ngram size */
|
||||
#define MAX_NGRAM_SIZE 128U
|
||||
#define NGRAM_SIZE_MAX 16U
|
||||
|
||||
#endif
|
||||
|
||||
|
||||
@ -1235,8 +1235,8 @@ bool SplitComparesTransform::runOnModule(Module &M) {
|
||||
|
||||
int bitw = 64;
|
||||
|
||||
char *bitw_env = getenv("LAF_SPLIT_COMPARES_BITW");
|
||||
if (!bitw_env) bitw_env = getenv("AFL_LLVM_LAF_SPLIT_COMPARES_BITW");
|
||||
char *bitw_env = getenv("AFL_LLVM_LAF_SPLIT_COMPARES_BITW");
|
||||
if (!bitw_env) bitw_env = getenv("LAF_SPLIT_COMPARES_BITW");
|
||||
if (bitw_env) { bitw = atoi(bitw_env); }
|
||||
|
||||
enableFPSplit = getenv("AFL_LLVM_LAF_SPLIT_FLOATS") != NULL;
|
||||
|
||||
@ -57,13 +57,14 @@ char *afl_environment_variables[] = {
|
||||
"AFL_INST_LIBS", "AFL_INST_RATIO", "AFL_KEEP_TRACES", "AFL_KEEP_ASSEMBLY",
|
||||
"AFL_LD_HARD_FAIL", "AFL_LD_LIMIT_MB", "AFL_LD_NO_CALLOC_OVER",
|
||||
"AFL_LD_PRELOAD", "AFL_LD_VERBOSE", "AFL_LLVM_CMPLOG", "AFL_LLVM_INSTRIM",
|
||||
"AFL_LLVM_INSTRIM_LOOPHEAD", "AFL_LLVM_INSTRIM_SKIPSINGLEBLOCK",
|
||||
"AFL_LLVM_LAF_SPLIT_COMPARES", "AFL_LLVM_LAF_SPLIT_COMPARES_BITW",
|
||||
"AFL_LLVM_LAF_SPLIT_FLOATS", "AFL_LLVM_LAF_SPLIT_SWITCHES",
|
||||
"AFL_LLVM_LAF_TRANSFORM_COMPARES", "AFL_LLVM_NGRAM_SIZE", "AFL_NGRAM_SIZE",
|
||||
"AFL_LLVM_NOT_ZERO", "AFL_LLVM_WHITELIST", "AFL_NO_AFFINITY",
|
||||
"AFL_LLVM_LTO_STARTID", "AFL_LLVM_LTO_DONTWRITEID", "AFL_NO_ARITH",
|
||||
"AFL_NO_BUILTIN", "AFL_NO_CPU_RED", "AFL_NO_FORKSRV", "AFL_NO_UI",
|
||||
"AFL_LLVM_INSTRUMENT", "AFL_LLVM_INSTRIM_LOOPHEAD",
|
||||
"AFL_LLVM_INSTRIM_SKIPSINGLEBLOCK", "AFL_LLVM_LAF_SPLIT_COMPARES",
|
||||
"AFL_LLVM_LAF_SPLIT_COMPARES_BITW", "AFL_LLVM_LAF_SPLIT_FLOATS",
|
||||
"AFL_LLVM_LAF_SPLIT_SWITCHES", "AFL_LLVM_LAF_TRANSFORM_COMPARES",
|
||||
"AFL_LLVM_NGRAM_SIZE", "AFL_NGRAM_SIZE", "AFL_LLVM_NOT_ZERO",
|
||||
"AFL_LLVM_WHITELIST", "AFL_NO_AFFINITY", "AFL_LLVM_LTO_STARTID",
|
||||
"AFL_LLVM_LTO_DONTWRITEID", "AFL_NO_ARITH", "AFL_NO_BUILTIN",
|
||||
"AFL_NO_CPU_RED", "AFL_NO_FORKSRV", "AFL_NO_UI",
|
||||
"AFL_NO_X86", // not really an env but we dont want to warn on it
|
||||
"AFL_PATH", "AFL_PERFORMANCE_FILE",
|
||||
//"AFL_PERSISTENT", // not implemented anymore, so warn additionally
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user