ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-18 04:38:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

aflpp driver cpp -> c

Browse Source
This commit is contained in:
van Hauser
2020-07-30 11:11:30 +02:00
parent 35a448ee92
commit 49b77207dd
3 changed files with 38 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
examples/aflpp_driver/GNUmakefile
View File

@ -11,17 +11,17 @@ FLAGS=-O3 -funroll-loops -g
all: libAFLDriver.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so all: libAFLDriver.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so
aflpp_driver.o: aflpp_driver.cpp aflpp_driver.o: aflpp_driver.c
$(LLVM_BINDIR)clang++ $(FLAGS) -stdlib=libc++ -std=c++11 -c aflpp_driver.cpp $(LLVM_BINDIR)clang -I. -I../../include $(FLAGS) -c aflpp_driver.c
libAFLDriver.a: aflpp_driver.o libAFLDriver.a: aflpp_driver.o
ar ru libAFLDriver.a aflpp_driver.o ar ru libAFLDriver.a aflpp_driver.o
debug: debug:
$(LLVM_BINDIR)clang++ -Wno-deprecated -I../../include $(FLAGS) -D_DEBUG=\"1\" -c -o afl-performance.o ../../src/afl-performance.c $(LLVM_BINDIR)clang -Wno-deprecated -I../../include $(FLAGS) -D_DEBUG=\"1\" -c -o afl-performance.o ../../src/afl-performance.c
$(LLVM_BINDIR)clang++ -I../../include -D_DEBUG=\"1\" -g -stdlib=libc++ -funroll-loops -std=c++11 -c aflpp_driver.cpp $(LLVM_BINDIR)clang -I../../include -D_DEBUG=\"1\" -g -funroll-loops -c aflpp_driver.c
#$(LLVM_BINDIR)clang++ -S -emit-llvm -Wno-deprecated -I../../include $(FLAGS) -D_DEBUG=\"1\" -c -o afl-performance.ll ../../src/afl-performance.c #$(LLVM_BINDIR)clang -S -emit-llvm -Wno-deprecated -I../../include $(FLAGS) -D_DEBUG=\"1\" -c -o afl-performance.ll ../../src/afl-performance.c
#$(LLVM_BINDIR)clang++ -S -emit-llvm -I../../include -D_DEBUG=\"1\" -g -stdlib=libc++ -funroll-loops -std=c++11 -c aflpp_driver.cpp #$(LLVM_BINDIR)clang -S -emit-llvm -I../../include -D_DEBUG=\"1\" -g -funroll-loops -c aflpp_driver.c
ar ru libAFLDriver.a afl-performance.o aflpp_driver.o ar ru libAFLDriver.a afl-performance.o aflpp_driver.o
aflpp_qemu_driver.o: aflpp_qemu_driver.c aflpp_qemu_driver.o: aflpp_qemu_driver.c
@ -37,8 +37,8 @@ aflpp_qemu_driver_hook.o: aflpp_qemu_driver_hook.c
$(LLVM_BINDIR)clang -fPIC $(FLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c $(LLVM_BINDIR)clang -fPIC $(FLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c
test: debug test: debug
#clang++ -S -emit-llvm -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -stdlib=libc++ -funroll-loops -std=c++11 -o aflpp_driver_test.ll aflpp_driver_test.cpp #clang -S -emit-llvm -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -funroll-loops -o aflpp_driver_test.ll aflpp_driver_test.c
afl-clang-fast++ -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -stdlib=libc++ -funroll-loops -std=c++11 -o aflpp_driver_test aflpp_driver_test.cpp libAFLDriver.a afl-clang-fast -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -funroll-loops -o aflpp_driver_test aflpp_driver_test.c libAFLDriver.a afl-performance.o
clean: clean:
rm -f *.o libAFLDriver*.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so *~ core aflpp_driver_test rm -f *.o libAFLDriver*.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so *~ core aflpp_driver_test

56
examples/aflpp_driver/aflpp_driver.cpp → examples/aflpp_driver/aflpp_driver.c
View File

@ -49,10 +49,12 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#include <unistd.h> #include <unistd.h>
#include <limits.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <fstream> #include "config.h"
#include <iostream>
#include <vector>
#ifdef _DEBUG #ifdef _DEBUG
#include "hash.h" #include "hash.h"
@ -98,20 +100,16 @@ extern unsigned int *__afl_fuzz_len;
extern unsigned char *__afl_fuzz_ptr; extern unsigned char *__afl_fuzz_ptr;
// libFuzzer interface is thin, so we don't include any libFuzzer headers. // libFuzzer interface is thin, so we don't include any libFuzzer headers.
extern "C" {
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size); int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
__attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv); __attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
}
// Notify AFL about persistent mode. // Notify AFL about persistent mode.
static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##"; static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##";
extern "C" int __afl_persistent_loop(unsigned int); int __afl_persistent_loop(unsigned int);
static volatile char suppress_warning2 = AFL_PERSISTENT[0];
// Notify AFL about deferred forkserver. // Notify AFL about deferred forkserver.
static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##"; static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
extern "C" void __afl_manual_init(); void __afl_manual_init();
static volatile char suppress_warning1 = AFL_DEFER_FORKSVR[0];
// Input buffer. // Input buffer.
static const size_t kMaxAflInputSize = 1 << 20; static const size_t kMaxAflInputSize = 1 << 20;
@ -119,11 +117,11 @@ static uint8_t AflInputBuf[kMaxAflInputSize];
// Use this optionally defined function to output sanitizer messages even if // Use this optionally defined function to output sanitizer messages even if
// user asks to close stderr. // user asks to close stderr.
__attribute__((weak)) extern "C" void __sanitizer_set_report_fd(void *); __attribute__((weak)) void __sanitizer_set_report_fd(void *);
// Keep track of where stderr content is being written to, so that // Keep track of where stderr content is being written to, so that
// dup_and_close_stderr can use the correct one. // dup_and_close_stderr can use the correct one.
static FILE *output_file = stderr; static FILE *output_file;
// Experimental feature to use afl_driver without AFL's deferred mode. // Experimental feature to use afl_driver without AFL's deferred mode.
// Needs to run before __afl_auto_init. // Needs to run before __afl_auto_init.
@ -179,7 +177,7 @@ static void dup_and_close_stderr() {
abort(); abort();
if (!__sanitizer_set_report_fd) if (!__sanitizer_set_report_fd)
return; return;
__sanitizer_set_report_fd(reinterpret_cast<void *>(output_fd)); __sanitizer_set_report_fd((void*)output_fd);
discard_output(output_fileno); discard_output(output_fileno);
} }
@ -205,27 +203,25 @@ static void maybe_close_fd_mask() {
// Define LLVMFuzzerMutate to avoid link failures for targets that use it // Define LLVMFuzzerMutate to avoid link failures for targets that use it
// with libFuzzer's LLVMFuzzerCustomMutator. // with libFuzzer's LLVMFuzzerCustomMutator.
extern "C" size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) { size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
assert(false && "LLVMFuzzerMutate should not be called from afl_driver"); //assert(false && "LLVMFuzzerMutate should not be called from afl_driver");
return 0; return 0;
} }
// Execute any files provided as parameters. // Execute any files provided as parameters.
static int ExecuteFilesOnyByOne(int argc, char **argv) { static int ExecuteFilesOnyByOne(int argc, char **argv) {
unsigned char *buf = malloc(MAX_FILE);
for (int i = 1; i < argc; i++) { for (int i = 1; i < argc; i++) {
std::ifstream in(argv[i], std::ios::binary); int fd = open(argv[i], O_RDONLY);
in.seekg(0, in.end); if (fd == -1) continue;
size_t length = in.tellg(); ssize_t length = read(fd, buf, MAX_FILE);
in.seekg (0, in.beg); if (length > 0) {
std::cout << "Reading " << length << " bytes from " << argv[i] << std::endl; printf("Reading %zu bytes from %s\n", length, argv[i]);
// Allocate exactly length bytes so that we reliably catch buffer overflows. LLVMFuzzerTestOneInput(buf, length);
std::vector<char> bytes(length); printf("Execution successful.\n");
in.read(bytes.data(), bytes.size());
assert(in);
LLVMFuzzerTestOneInput(reinterpret_cast<const uint8_t *>(bytes.data()),
bytes.size());
std::cout << "Execution successful" << std::endl;
} }
}
free(buf);
return 0; return 0;
} }
@ -244,14 +240,18 @@ int main(int argc, char **argv) {
"======================================================\n", "======================================================\n",
argv[0], argv[0], argv[0]); argv[0], argv[0], argv[0]);
output_file = stderr;
maybe_duplicate_stderr(); maybe_duplicate_stderr();
maybe_close_fd_mask(); maybe_close_fd_mask();
if (LLVMFuzzerInitialize) if (LLVMFuzzerInitialize)
LLVMFuzzerInitialize(&argc, &argv); LLVMFuzzerInitialize(&argc, &argv);
// Do any other expensive one-time initialization here. // Do any other expensive one-time initialization here.
uint8_t dummy_input[1] = {0}; uint8_t dummy_input[64] = {0};
int N = 100000; memcpy(dummy_input, (void*)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
memcpy(dummy_input + 32, (void*)AFL_DEFER_FORKSVR, sizeof(AFL_DEFER_FORKSVR));
int N = INT_MAX;
if (argc == 2 && argv[1][0] == '-') if (argc == 2 && argv[1][0] == '-')
N = atoi(argv[1] + 1); N = atoi(argv[1] + 1);
else if(argc == 2 && (N = atoi(argv[1])) > 0) else if(argc == 2 && (N = atoi(argv[1])) > 0)

3
examples/aflpp_driver/aflpp_driver_test.cpp → examples/aflpp_driver/aflpp_driver_test.c
View File

@ -1,9 +1,10 @@
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
#include <stdint.h> #include <stdint.h>
#include "hash.h" #include "hash.h"
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
fprintf(stderr, "FUNC crc: %016llx len: %lu\n", hash64((u8*)Data, (unsigned int) Size, (unsigned long long int) 0xa5b35705), Size); fprintf(stderr, "FUNC crc: %016llx len: %lu\n", hash64((u8*)Data, (unsigned int) Size, (unsigned long long int) 0xa5b35705), Size);