ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-14 02:58:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

move taint_mode var

Browse Source
This commit is contained in:
van Hauser
2020-08-11 15:10:18 +02:00
parent 4f695b6f4c
commit 457f627101
6 changed files with 24 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/afl-forkserver.c
View File

@ -497,7 +497,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
char pid_buf[16];
sprintf(pid_buf, "%d", fsrv->fsrv_pid);
if (fsrv->qemu_mode == 2) {
if (fsrv->taint_mode) {
setenv("__AFL_TARGET_PID3", pid_buf, 1);

6
src/afl-fuzz-init.c
View File

@ -961,7 +961,7 @@ void perform_dry_run(afl_state_t *afl) {
}
/* perform taint gathering on the input seed */
if (afl->fsrv.taint_mode)
if (afl->taint_mode)
perform_taint_run(afl, q, q->fname, use_mem, q->len);
q = q->next;
@ -1502,7 +1502,7 @@ static void handle_existing_out_dir(afl_state_t *afl) {
if (delete_files(fn, CASE_PREFIX)) { goto dir_cleanup_failed; }
ck_free(fn);
if (afl->fsrv.taint_mode) {
if (afl->taint_mode) {
fn = alloc_printf("%s/taint", afl->out_dir);
mkdir(fn, 0755); // ignore errors
@ -1745,7 +1745,7 @@ void setup_dirs_fds(afl_state_t *afl) {
/* Taint directory if taint_mode. */
if (afl->fsrv.taint_mode) {
if (afl->taint_mode) {
tmp = alloc_printf("%s/taint", afl->out_dir);
if (mkdir(tmp, 0700)) { PFATAL("Unable to create '%s'", tmp); }

2
src/afl-fuzz-one.c
View File

@ -460,7 +460,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
u32 tmp_val = 0;
if (unlikely(afl->fsrv.taint_mode)) {
if (unlikely(afl->taint_mode)) {
tmp_val = afl->queue_cycle % 2;
ret_val = 0;

3
src/afl-fuzz-queue.c
View File

@ -220,6 +220,7 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
} else {
FATAL("count not create '%s'", fnw);
q->taint_bytes_new = 0;
}
@ -419,7 +420,7 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u8 *mem, u32 len,
afl->last_path_time = get_cur_time();
/* trigger the tain gathering if this is not a dry run */
if (afl->fsrv.taint_mode && mem) {
if (afl->taint_mode && mem) {
perform_taint_run(afl, q, fname, mem, len);

2
src/afl-fuzz-run.c
View File

@ -349,7 +349,7 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
}
if (unlikely(afl->fsrv.taint_mode))
if (unlikely(afl->taint_mode))
q->exec_cksum = 0;
else if (q->exec_cksum) {

30
src/afl-fuzz.c
View File

@ -288,7 +288,7 @@ int main(int argc, char **argv_orig, char **envp) {
switch (opt) {
case 'A':
afl->fsrv.taint_mode = 1;
afl->taint_mode = 1;
if (!mem_limit_given) { afl->fsrv.mem_limit = MEM_LIMIT_QEMU; }
break;
@ -829,10 +829,10 @@ int main(int argc, char **argv_orig, char **envp) {
}
if (afl->fsrv.taint_mode && afl->fsrv.map_size < MAX_FILE) {
if (afl->taint_mode && afl->fsrv.map_size < MAX_FILE) {
real_map_size = map_size;
map_size = afl->fsrv.map_size = afl->shm.map_size = MAX_FILE;
map_size = MAX_FILE;
}
@ -891,10 +891,13 @@ int main(int argc, char **argv_orig, char **envp) {
if (afl->crash_mode) { FATAL("-C and -n are mutually exclusive"); }
if (afl->fsrv.qemu_mode) { FATAL("-Q and -n are mutually exclusive"); }
if (afl->unicorn_mode) { FATAL("-U and -n are mutually exclusive"); }
if (afl->fsrv.taint_mode) { FATAL("-A and -n are mutually exclusive"); }
if (afl->taint_mode) { FATAL("-A and -n are mutually exclusive"); }
}
if (afl->limit_time_sig != 0 && afl->taint_mode) { FATAL("-A and -L are mutually exclusive"); }
if (afl->unicorn_mode != 0 && afl->taint_mode) { FATAL("-A and -U are mutually exclusive"); }
if (get_afl_env("AFL_DISABLE_TRIM")) { afl->disable_trim = 1; }
if (getenv("AFL_NO_UI") && getenv("AFL_FORCE_UI")) {
@ -992,7 +995,7 @@ int main(int argc, char **argv_orig, char **envp) {
if (afl->afl_env.afl_preload) {
if (afl->fsrv.qemu_mode || afl->fsrv.taint_mode) {
if (afl->fsrv.qemu_mode || afl->taint_mode) {
u8 *qemu_preload = getenv("QEMU_SET_ENV");
u8 *afl_preload = getenv("AFL_PRELOAD");
@ -1088,17 +1091,17 @@ int main(int argc, char **argv_orig, char **envp) {
afl->fsrv.trace_bits =
afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode);
if (!afl->in_bitmap) { memset(afl->virgin_bits, 255, afl->fsrv.map_size); }
memset(afl->virgin_tmout, 255, afl->fsrv.map_size);
memset(afl->virgin_crash, 255, afl->fsrv.map_size);
if (map_size != real_map_size) {
if (real_map_size && map_size != real_map_size) {
afl->fsrv.map_size = real_map_size;
if (afl->cmplog_binary) afl->cmplog_fsrv.map_size = real_map_size;
}
if (!afl->in_bitmap) { memset(afl->virgin_bits, 255, afl->fsrv.map_size); }
memset(afl->virgin_tmout, 255, afl->fsrv.map_size);
memset(afl->virgin_crash, 255, afl->fsrv.map_size);
init_count_class16();
if (afl->is_main_node && check_main_node_exists(afl) == 1) {
@ -1260,7 +1263,7 @@ int main(int argc, char **argv_orig, char **envp) {
}
if (afl->fsrv.taint_mode) {
if (afl->taint_mode) {
ACTF("Spawning qemu_taint forkserver");
@ -1268,7 +1271,6 @@ int main(int argc, char **argv_orig, char **envp) {
setenv("AFL_DISABLE_LLVM_INSTRUMENTATION", "1", 0);
afl_fsrv_init_dup(&afl->taint_fsrv, &afl->fsrv);
afl->taint_fsrv.qemu_mode = 2;
afl->taint_fsrv.taint_mode = 1;
afl->taint_fsrv.trace_bits = afl->fsrv.trace_bits;
@ -1399,7 +1401,7 @@ int main(int argc, char **argv_orig, char **envp) {
break;
case 1:
if (afl->limit_time_sig == 0 && !afl->custom_only &&
!afl->python_only && !afl->fsrv.taint_mode) {
!afl->python_only && !afl->taint_mode) {
afl->limit_time_sig = -1;
afl->limit_time_puppet = 0;
@ -1588,7 +1590,7 @@ stop_fuzzing:
}
if (afl->cmplog_binary) afl_fsrv_deinit(&afl->cmplog_fsrv);
if (afl->fsrv.taint_mode) afl_fsrv_deinit(&afl->taint_fsrv);
if (afl->taint_mode) afl_fsrv_deinit(&afl->taint_fsrv);
afl_fsrv_deinit(&afl->fsrv);
if (afl->orig_cmdline) { ck_free(afl->orig_cmdline); }
if (afl->argv_taint) { ck_free(afl->argv_taint); }