mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-14 11:08:06 +00:00
first experiment cmplog
This commit is contained in:
Andrea Fioraldi
@ -168,7 +168,9 @@ enum {
|
||||
/* 16 */ STAGE_SPLICE,
|
||||
/* 17 */ STAGE_PYTHON,
|
||||
/* 18 */ STAGE_RADAMSA,
|
||||
/* 19 */ STAGE_CUSTOM_MUTATOR
|
||||
/* 19 */ STAGE_CUSTOM_MUTATOR,
|
||||
/* 20 */ STAGE_COLORIZATION,
|
||||
/* 21 */ STAGE_ITS,
|
||||
|
||||
};
|
||||
|
||||
@ -645,6 +647,14 @@ char** get_qemu_argv(u8*, char**, int);
|
||||
char** get_wine_argv(u8*, char**, int);
|
||||
void save_cmdline(u32, char**);
|
||||
|
||||
/* RedQueen */
|
||||
|
||||
extern u8* cmplog_binary;
|
||||
extern s32 cmplog_forksrv_pid;
|
||||
|
||||
void init_cmplog_forkserver(char **argv);
|
||||
u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len, u32 exec_cksum);
|
||||
|
||||
/**** Inline routines ****/
|
||||
|
||||
/* Generate a random number (from 0 to limit - 1). This may
|
||||
|
||||
49
include/cmplog.h
Normal file
49
include/cmplog.h
Normal file
@ -0,0 +1,49 @@
|
||||
#ifndef _AFL_REDQUEEN_H
|
||||
#define _AFL_REDQUEEN_H
|
||||
|
||||
#include "config.h"
|
||||
|
||||
#define CMP_MAP_W 65536
|
||||
#define CMP_MAP_H 256
|
||||
|
||||
#define SHAPE_BYTES(x) (x+1)
|
||||
|
||||
#define CMP_TYPE_INS 0
|
||||
#define CMP_TYPE_RTN 1
|
||||
|
||||
struct cmp_header {
|
||||
|
||||
unsigned hits : 20;
|
||||
|
||||
unsigned cnt : 20;
|
||||
unsigned id : 16;
|
||||
|
||||
unsigned shape : 5; // from 0 to 31
|
||||
unsigned type : 1;
|
||||
|
||||
} __attribute__((packed));
|
||||
|
||||
struct cmp_operands {
|
||||
|
||||
u64 v0;
|
||||
u64 v1;
|
||||
|
||||
};
|
||||
|
||||
struct cmpfn_operands {
|
||||
|
||||
u8 v0[32];
|
||||
u8 v1[32];
|
||||
|
||||
};
|
||||
|
||||
typedef struct cmp_operands cmp_map_list[CMP_MAP_H];
|
||||
|
||||
struct cmp_map {
|
||||
|
||||
struct cmp_header headers[CMP_MAP_W];
|
||||
struct cmp_operands log[CMP_MAP_W][CMP_MAP_H];
|
||||
|
||||
};
|
||||
|
||||
#endif
|
||||
@ -361,6 +361,10 @@
|
||||
|
||||
#define AFL_QEMU_NOT_ZERO
|
||||
|
||||
/* AFL RedQueen */
|
||||
|
||||
#define CMPLOG_SHM_ENV_VAR "__AFL_CMPLOG_SHM_ID"
|
||||
|
||||
/* Uncomment this to use inferior block-coverage-based instrumentation. Note
|
||||
that you need to recompile the target binary for this to have any effect: */
|
||||
|
||||
|
||||
@ -30,5 +30,7 @@
|
||||
void setup_shm(unsigned char dumb_mode);
|
||||
void remove_shm(void);
|
||||
|
||||
extern int cmplog_mode;
|
||||
|
||||
#endif
|
||||
|
||||
|
||||
@ -197,8 +197,10 @@ static void edit_params(u32 argc, char** argv) {
|
||||
// /laf
|
||||
|
||||
#ifdef USE_TRACE_PC
|
||||
cc_params[cc_par_cnt++] =
|
||||
"-fsanitize-coverage=trace-pc-guard"; // edge coverage by default
|
||||
if (getenv("AFL_CMPLOG"))
|
||||
cc_params[cc_par_cnt++] = "-fsanitize-coverage=trace-pc-guard,trace-cmp";
|
||||
else
|
||||
cc_params[cc_par_cnt++] = "-fsanitize-coverage=trace-pc-guard"; // edge coverage by default
|
||||
// cc_params[cc_par_cnt++] = "-mllvm";
|
||||
// cc_params[cc_par_cnt++] =
|
||||
// "-fsanitize-coverage=trace-cmp,trace-div,trace-gep";
|
||||
|
||||
@ -25,6 +25,7 @@
|
||||
#endif
|
||||
#include "config.h"
|
||||
#include "types.h"
|
||||
#include "cmplog.h"
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
@ -32,6 +33,7 @@
|
||||
#include <unistd.h>
|
||||
#include <string.h>
|
||||
#include <assert.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include <sys/mman.h>
|
||||
#include <sys/shm.h>
|
||||
@ -64,6 +66,9 @@ u32 __afl_prev_loc;
|
||||
__thread u32 __afl_prev_loc;
|
||||
#endif
|
||||
|
||||
struct cmp_map* __afl_cmp_map;
|
||||
__thread u32 __afl_cmp_counter;
|
||||
|
||||
/* Running in persistent mode? */
|
||||
|
||||
static u8 is_persistent;
|
||||
@ -124,6 +129,27 @@ static void __afl_map_shm(void) {
|
||||
|
||||
}
|
||||
|
||||
if (getenv("__AFL_CMPLOG_MODE__")) {
|
||||
|
||||
id_str = getenv(CMPLOG_SHM_ENV_VAR);
|
||||
|
||||
if (id_str) {
|
||||
|
||||
u32 shm_id = atoi(id_str);
|
||||
|
||||
__afl_cmp_map = shmat(shm_id, NULL, 0);
|
||||
|
||||
if (__afl_cmp_map == (void*)-1) _exit(1);
|
||||
|
||||
}
|
||||
|
||||
} else if (getenv("AFL_CMPLOG")) {
|
||||
|
||||
// during compilation, do this to avoid segfault
|
||||
__afl_cmp_map = calloc(sizeof(struct cmp_map), 1);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
/* Fork server logic. */
|
||||
@ -135,7 +161,7 @@ static void __afl_start_forkserver(void) {
|
||||
|
||||
u8 child_stopped = 0;
|
||||
|
||||
void (*old_sigchld_handler)(int) = signal(SIGCHLD, SIG_DFL);
|
||||
void (*old_sigchld_handler)(int)=0;// = signal(SIGCHLD, SIG_DFL);
|
||||
|
||||
/* Phone home and tell the parent that we're OK. If parent isn't there,
|
||||
assume we're not running in forkserver mode and just execute program. */
|
||||
@ -296,6 +322,104 @@ __attribute__((constructor(CONST_PRIO))) void __afl_auto_init(void) {
|
||||
|
||||
}
|
||||
|
||||
///// CmpLog instrumentation
|
||||
|
||||
void __sanitizer_cov_trace_cmp1(uint8_t Arg1, uint8_t Arg2) {
|
||||
return;
|
||||
}
|
||||
|
||||
void __sanitizer_cov_trace_cmp2(uint16_t Arg1, uint16_t Arg2) {
|
||||
|
||||
uintptr_t k = (uintptr_t)__builtin_return_address(0);
|
||||
k = (k >> 4) ^ (k << 8);
|
||||
k &= CMP_MAP_W - 1;
|
||||
|
||||
u32 hits = __afl_cmp_map->headers[k].hits;
|
||||
__afl_cmp_map->headers[k].hits = hits+1;
|
||||
// if (!__afl_cmp_map->headers[k].cnt)
|
||||
// __afl_cmp_map->headers[k].cnt = __afl_cmp_counter++;
|
||||
|
||||
__afl_cmp_map->headers[k].shape = 1;
|
||||
//__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
|
||||
|
||||
hits &= CMP_MAP_H -1;
|
||||
__afl_cmp_map->log[k][hits].v0 = Arg1;
|
||||
__afl_cmp_map->log[k][hits].v1 = Arg2;
|
||||
|
||||
}
|
||||
|
||||
void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) {
|
||||
|
||||
uintptr_t k = (uintptr_t)__builtin_return_address(0);
|
||||
k = (k >> 4) ^ (k << 8);
|
||||
k &= CMP_MAP_W - 1;
|
||||
|
||||
u32 hits = __afl_cmp_map->headers[k].hits;
|
||||
__afl_cmp_map->headers[k].hits = hits+1;
|
||||
|
||||
__afl_cmp_map->headers[k].shape = 3;
|
||||
|
||||
hits &= CMP_MAP_H -1;
|
||||
__afl_cmp_map->log[k][hits].v0 = Arg1;
|
||||
__afl_cmp_map->log[k][hits].v1 = Arg2;
|
||||
|
||||
}
|
||||
|
||||
void __sanitizer_cov_trace_cmp8(uint64_t Arg1, uint64_t Arg2) {
|
||||
|
||||
uintptr_t k = (uintptr_t)__builtin_return_address(0);
|
||||
k = (k >> 4) ^ (k << 8);
|
||||
k &= CMP_MAP_W - 1;
|
||||
|
||||
u32 hits = __afl_cmp_map->headers[k].hits;
|
||||
__afl_cmp_map->headers[k].hits = hits+1;
|
||||
|
||||
__afl_cmp_map->headers[k].shape = 7;
|
||||
|
||||
hits &= CMP_MAP_H -1;
|
||||
__afl_cmp_map->log[k][hits].v0 = Arg1;
|
||||
__afl_cmp_map->log[k][hits].v1 = Arg2;
|
||||
|
||||
}
|
||||
|
||||
#if defined(__APPLE__)
|
||||
#pragma weak __sanitizer_cov_trace_const_cmp1 = __sanitizer_cov_trace_cmp1
|
||||
#pragma weak __sanitizer_cov_trace_const_cmp2 = __sanitizer_cov_trace_cmp2
|
||||
#pragma weak __sanitizer_cov_trace_const_cmp4 = __sanitizer_cov_trace_cmp4
|
||||
#pragma weak __sanitizer_cov_trace_const_cmp8 = __sanitizer_cov_trace_cmp8
|
||||
#else
|
||||
void __sanitizer_cov_trace_const_cmp1(uint8_t Arg1, uint8_t Arg2)
|
||||
__attribute__((alias("__sanitizer_cov_trace_cmp1")));
|
||||
void __sanitizer_cov_trace_const_cmp2(uint16_t Arg1, uint16_t Arg2)
|
||||
__attribute__((alias("__sanitizer_cov_trace_cmp2")));
|
||||
void __sanitizer_cov_trace_const_cmp4(uint32_t Arg1, uint32_t Arg2)
|
||||
__attribute__((alias("__sanitizer_cov_trace_cmp4")));
|
||||
void __sanitizer_cov_trace_const_cmp8(uint64_t Arg1, uint64_t Arg2)
|
||||
__attribute__((alias("__sanitizer_cov_trace_cmp8")));
|
||||
#endif /* defined(__APPLE__) */
|
||||
|
||||
void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t* Cases) {
|
||||
|
||||
for (uint64_t i = 0; i < Cases[0]; i++) {
|
||||
|
||||
uintptr_t k = (uintptr_t)__builtin_return_address(0) +i;
|
||||
k = (k >> 4) ^ (k << 8);
|
||||
k &= CMP_MAP_W - 1;
|
||||
|
||||
u32 hits = __afl_cmp_map->headers[k].hits;
|
||||
__afl_cmp_map->headers[k].hits = hits+1;
|
||||
|
||||
__afl_cmp_map->headers[k].shape = 7;
|
||||
|
||||
hits &= CMP_MAP_H -1;
|
||||
__afl_cmp_map->log[k][hits].v0 = Val;
|
||||
__afl_cmp_map->log[k][hits].v1 = Cases[i + 2];
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
/* The following stuff deals with supporting -fsanitize-coverage=trace-pc-guard.
|
||||
It remains non-operational in the traditional, plugin-backed LLVM mode.
|
||||
For more info about 'trace-pc-guard', see README.llvm.
|
||||
|
||||
950
src/afl-fuzz-cmplog.c
Normal file
950
src/afl-fuzz-cmplog.c
Normal file
@ -0,0 +1,950 @@
|
||||
#include "afl-fuzz.h"
|
||||
#include "cmplog.h"
|
||||
|
||||
#define SWAP64(_x) \
|
||||
({ \
|
||||
\
|
||||
u64 _ret = (_x); \
|
||||
_ret = \
|
||||
(_ret & 0x00000000FFFFFFFF) << 32 | (_ret & 0xFFFFFFFF00000000) >> 32; \
|
||||
_ret = \
|
||||
(_ret & 0x0000FFFF0000FFFF) << 16 | (_ret & 0xFFFF0000FFFF0000) >> 16; \
|
||||
_ret = \
|
||||
(_ret & 0x00FF00FF00FF00FF) << 8 | (_ret & 0xFF00FF00FF00FF00) >> 8; \
|
||||
_ret; \
|
||||
\
|
||||
})
|
||||
|
||||
u8 common_fuzz_cmplog_stuff(char** argv, u8* out_buf, u32 len);
|
||||
|
||||
extern struct cmp_map* cmp_map; // defined in afl-sharedmem.c
|
||||
|
||||
u8* cmplog_binary;
|
||||
char** its_argv;
|
||||
|
||||
///// Colorization
|
||||
|
||||
struct range {
|
||||
u32 start;
|
||||
u32 end;
|
||||
struct range * next;
|
||||
};
|
||||
|
||||
struct range* add_range(struct range* ranges, u32 start, u32 end) {
|
||||
|
||||
struct range* r = ck_alloc_nozero(sizeof(struct range));
|
||||
r->start = start;
|
||||
r->end = end;
|
||||
r->next = ranges;
|
||||
return r;
|
||||
|
||||
}
|
||||
|
||||
struct range* pop_biggest_range(struct range** ranges) {
|
||||
|
||||
struct range* r = *ranges;
|
||||
struct range* prev = NULL;
|
||||
struct range* rmax = NULL;
|
||||
struct range* prev_rmax = NULL;
|
||||
u32 max_size = 0;
|
||||
|
||||
while (r) {
|
||||
u32 s = r->end - r->start;
|
||||
if (s >= max_size) {
|
||||
max_size = s;
|
||||
prev_rmax = prev;
|
||||
rmax = r;
|
||||
}
|
||||
prev = r;
|
||||
r = r->next;
|
||||
}
|
||||
|
||||
if (rmax) {
|
||||
if (prev_rmax)
|
||||
prev_rmax->next = rmax->next;
|
||||
else
|
||||
*ranges = rmax->next;
|
||||
}
|
||||
|
||||
return rmax;
|
||||
|
||||
}
|
||||
|
||||
u8 get_exec_checksum(u8* buf, u32 len, u32* cksum) {
|
||||
|
||||
if (unlikely(common_fuzz_stuff(its_argv, buf, len)))
|
||||
return 1;
|
||||
|
||||
*cksum = hash32(trace_bits, MAP_SIZE, HASH_CONST);
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
static void rand_replace(u8* buf, u32 len) {
|
||||
|
||||
u32 i;
|
||||
for (i = 0; i < len; ++i)
|
||||
buf[i] = UR(256);
|
||||
|
||||
}
|
||||
|
||||
u8 colorization(u8* buf, u32 len, u32 exec_cksum) {
|
||||
|
||||
struct range* ranges = add_range(NULL, 0, len);
|
||||
u8* backup = ck_alloc_nozero(len);
|
||||
|
||||
u64 orig_hit_cnt, new_hit_cnt;
|
||||
orig_hit_cnt = queued_paths + unique_crashes;
|
||||
|
||||
stage_name = "colorization";
|
||||
stage_short = "colorization";
|
||||
stage_max = 1000;
|
||||
|
||||
struct range* rng;
|
||||
stage_cur = stage_max;
|
||||
while ((rng = pop_biggest_range(&ranges)) != NULL && stage_cur) {
|
||||
|
||||
u32 s = rng->end - rng->start;
|
||||
memcpy(backup, buf + rng->start, s);
|
||||
rand_replace(buf + rng->start, s);
|
||||
|
||||
u32 cksum;
|
||||
if (unlikely(get_exec_checksum(buf, len, &cksum)))
|
||||
return 1;
|
||||
|
||||
if (cksum != exec_cksum) {
|
||||
|
||||
ranges = add_range(ranges, rng->start, rng->start + s/2);
|
||||
ranges = add_range(ranges, rng->start + s/2 +1, rng->end);
|
||||
memcpy(buf + rng->start, backup, s);
|
||||
|
||||
}
|
||||
|
||||
ck_free(rng);
|
||||
--stage_cur;
|
||||
|
||||
}
|
||||
|
||||
new_hit_cnt = queued_paths + unique_crashes;
|
||||
stage_finds[STAGE_COLORIZATION] += new_hit_cnt - orig_hit_cnt;
|
||||
stage_cycles[STAGE_COLORIZATION] += stage_max - stage_cur;
|
||||
|
||||
while (ranges) {
|
||||
rng = ranges;
|
||||
ranges = ranges->next;
|
||||
ck_free(rng);
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
///// Input to State replacement
|
||||
|
||||
u8 its_fuzz(u32 idx, u32 size, u8* buf, u32 len, u8* status) {
|
||||
|
||||
u64 orig_hit_cnt, new_hit_cnt;
|
||||
|
||||
orig_hit_cnt = queued_paths + unique_crashes;
|
||||
|
||||
if (unlikely(common_fuzz_stuff(its_argv, buf, len)))
|
||||
return 1;
|
||||
|
||||
new_hit_cnt = queued_paths + unique_crashes;
|
||||
|
||||
if (unlikely(new_hit_cnt != orig_hit_cnt)) {
|
||||
|
||||
*status = 1;
|
||||
|
||||
} else {
|
||||
|
||||
if (size >= MIN_AUTO_EXTRA && size <= MAX_AUTO_EXTRA)
|
||||
maybe_add_auto(&buf[idx], size);
|
||||
*status = 2;
|
||||
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
|
||||
u8* orig_buf, u8* buf, u32 len, u8 do_reverse, u8* status) {
|
||||
|
||||
u64* buf_64 = (u64*)&buf[idx];
|
||||
u32* buf_32 = (u32*)&buf[idx];
|
||||
u16* buf_16 = (u16*)&buf[idx];
|
||||
// u8* buf_8 = &buf[idx];
|
||||
u64* o_buf_64 = (u64*)&orig_buf[idx];
|
||||
u32* o_buf_32 = (u32*)&orig_buf[idx];
|
||||
u16* o_buf_16 = (u16*)&orig_buf[idx];
|
||||
// u8* o_buf_8 = &orig_buf[idx];
|
||||
|
||||
u32 its_len = len - idx;
|
||||
*status = 0;
|
||||
|
||||
if (SHAPE_BYTES(h->shape) == 8) {
|
||||
if (its_len >= 8 && *buf_64 == pattern && *o_buf_64 == pattern) {
|
||||
*buf_64 = repl;
|
||||
if (unlikely(its_fuzz(idx, 8, buf, len, status)))
|
||||
return 1;
|
||||
*buf_64 = pattern;
|
||||
}
|
||||
// reverse encoding
|
||||
if (do_reverse)
|
||||
if (unlikely(cmp_extend_encoding(h, SWAP64(pattern), SWAP64(repl), idx,
|
||||
orig_buf, buf, len, 0, status)))
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (SHAPE_BYTES(h->shape) == 4 || *status == 2) {
|
||||
if (its_len >= 4 && *buf_32 == (u32)pattern && *o_buf_32 == (u32)pattern) {
|
||||
*buf_32 = (u32)repl;
|
||||
if (unlikely(its_fuzz(idx, 4, buf, len, status)))
|
||||
return 1;
|
||||
*buf_32 = pattern;
|
||||
}
|
||||
// reverse encoding
|
||||
if (do_reverse)
|
||||
if (unlikely(cmp_extend_encoding(h, SWAP32(pattern), SWAP32(repl), idx,
|
||||
orig_buf, buf, len, 0, status)))
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (SHAPE_BYTES(h->shape) == 2 || *status == 2) {
|
||||
if (its_len >= 2 && *buf_16 == (u16)pattern && *o_buf_16 == (u16)pattern) {
|
||||
*buf_16 = (u16)repl;
|
||||
if (unlikely(its_fuzz(idx, 2, buf, len, status)))
|
||||
return 1;
|
||||
*buf_16 = (u16)pattern;
|
||||
}
|
||||
// reverse encoding
|
||||
if (do_reverse)
|
||||
if (unlikely(cmp_extend_encoding(h, SWAP16(pattern), SWAP16(repl), idx,
|
||||
orig_buf, buf, len, 0, status)))
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*if (SHAPE_BYTES(h->shape) == 1 || *status == 2) {
|
||||
if (its_len >= 2 && *buf_8 == (u8)pattern && *o_buf_8 == (u8)pattern) {
|
||||
*buf_8 = (u8)repl;
|
||||
if (unlikely(its_fuzz(idx, 1, buf, len, status)))
|
||||
return 1;
|
||||
*buf_16 = (u16)pattern;
|
||||
}
|
||||
}*/
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
|
||||
|
||||
struct cmp_header* h = &cmp_map->headers[key];
|
||||
u32 i, j, idx;
|
||||
|
||||
u32 loggeds = h->hits;
|
||||
if (h->hits > CMP_MAP_H)
|
||||
loggeds = CMP_MAP_H;
|
||||
|
||||
u8 status;
|
||||
// opt not in the paper
|
||||
u32 fails = 0;
|
||||
|
||||
for (i = 0; i < loggeds; ++i) {
|
||||
|
||||
struct cmp_operands* o = &cmp_map->log[key][i];
|
||||
|
||||
// opt not in the paper
|
||||
for (j = 0; j < i; ++j)
|
||||
if (cmp_map->log[key][j].v0 == o->v0 && cmp_map->log[key][i].v1 == o->v1)
|
||||
goto cmp_fuzz_next_iter;
|
||||
|
||||
for (idx = 0; idx < len && fails < 8; ++idx) {
|
||||
|
||||
if (unlikely(cmp_extend_encoding(h, o->v0, o->v1, idx, orig_buf, buf, len, 1, &status)))
|
||||
return 1;
|
||||
if (status == 2) ++fails;
|
||||
else if (status == 1) break;
|
||||
|
||||
if (unlikely(cmp_extend_encoding(h, o->v1, o->v0, idx, orig_buf, buf, len, 1, &status)))
|
||||
return 1;
|
||||
if (status == 2) ++fails;
|
||||
else if (status == 1) break;
|
||||
|
||||
}
|
||||
|
||||
cmp_fuzz_next_iter:
|
||||
stage_cur++;
|
||||
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
///// Input to State stage
|
||||
|
||||
// queue_cur->exec_cksum
|
||||
u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len, u32 exec_cksum) {
|
||||
|
||||
its_argv = argv;
|
||||
|
||||
if (unlikely(colorization(buf, len, exec_cksum)))
|
||||
return 1;
|
||||
|
||||
// do it manually, forkserver clear only trace_bits
|
||||
memset(cmp_map->headers, 0, sizeof(cmp_map->headers));
|
||||
|
||||
if (unlikely(common_fuzz_cmplog_stuff(argv, buf, len)))
|
||||
return 1;
|
||||
|
||||
u64 orig_hit_cnt, new_hit_cnt;
|
||||
u64 orig_execs = total_execs;
|
||||
orig_hit_cnt = queued_paths + unique_crashes;
|
||||
|
||||
stage_name = "input-to-state";
|
||||
stage_short = "its";
|
||||
stage_max = 0;
|
||||
stage_cur = 0;
|
||||
|
||||
u32 k;
|
||||
for (k = 0; k < CMP_MAP_W; ++k) {
|
||||
|
||||
if (!cmp_map->headers[k].hits)
|
||||
continue;
|
||||
if (cmp_map->headers[k].hits > CMP_MAP_H)
|
||||
stage_max += CMP_MAP_H;
|
||||
else
|
||||
stage_max += cmp_map->headers[k].hits;
|
||||
|
||||
}
|
||||
|
||||
for (k = 0; k < CMP_MAP_W; ++k) {
|
||||
|
||||
if (!cmp_map->headers[k].hits)
|
||||
continue;
|
||||
cmp_fuzz(k, orig_buf, buf, len);
|
||||
|
||||
}
|
||||
|
||||
memcpy(buf, orig_buf, len);
|
||||
|
||||
new_hit_cnt = queued_paths + unique_crashes;
|
||||
stage_finds[STAGE_ITS] += new_hit_cnt - orig_hit_cnt;
|
||||
stage_cycles[STAGE_ITS] += total_execs - orig_execs;
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
|
||||
//// CmpLog forkserver
|
||||
|
||||
s32 cmplog_forksrv_pid,
|
||||
cmplog_child_pid,
|
||||
cmplog_fsrv_ctl_fd,
|
||||
cmplog_fsrv_st_fd;
|
||||
|
||||
void init_cmplog_forkserver(char **argv) {
|
||||
|
||||
static struct itimerval it;
|
||||
int st_pipe[2], ctl_pipe[2];
|
||||
int status;
|
||||
s32 rlen;
|
||||
|
||||
ACTF("Spinning up the cmplog fork server...");
|
||||
|
||||
if (pipe(st_pipe) || pipe(ctl_pipe)) PFATAL("pipe() failed");
|
||||
|
||||
child_timed_out = 0;
|
||||
cmplog_forksrv_pid = fork();
|
||||
|
||||
if (cmplog_forksrv_pid < 0) PFATAL("fork() failed");
|
||||
|
||||
if (!cmplog_forksrv_pid) {
|
||||
|
||||
/* CHILD PROCESS */
|
||||
|
||||
struct rlimit r;
|
||||
|
||||
/* Umpf. On OpenBSD, the default fd limit for root users is set to
|
||||
soft 128. Let's try to fix that... */
|
||||
|
||||
if (!getrlimit(RLIMIT_NOFILE, &r) && r.rlim_cur < FORKSRV_FD + 2) {
|
||||
|
||||
r.rlim_cur = FORKSRV_FD + 2;
|
||||
setrlimit(RLIMIT_NOFILE, &r); /* Ignore errors */
|
||||
|
||||
}
|
||||
|
||||
if (mem_limit) {
|
||||
|
||||
r.rlim_max = r.rlim_cur = ((rlim_t)mem_limit) << 20;
|
||||
|
||||
#ifdef RLIMIT_AS
|
||||
setrlimit(RLIMIT_AS, &r); /* Ignore errors */
|
||||
#else
|
||||
/* This takes care of OpenBSD, which doesn't have RLIMIT_AS, but
|
||||
according to reliable sources, RLIMIT_DATA covers anonymous
|
||||
maps - so we should be getting good protection against OOM bugs. */
|
||||
|
||||
setrlimit(RLIMIT_DATA, &r); /* Ignore errors */
|
||||
#endif /* ^RLIMIT_AS */
|
||||
|
||||
}
|
||||
|
||||
/* Dumping cores is slow and can lead to anomalies if SIGKILL is delivered
|
||||
before the dump is complete. */
|
||||
|
||||
// r.rlim_max = r.rlim_cur = 0;
|
||||
// setrlimit(RLIMIT_CORE, &r); /* Ignore errors */
|
||||
|
||||
/* Isolate the process and configure standard descriptors. If out_file is
|
||||
specified, stdin is /dev/null; otherwise, out_fd is cloned instead. */
|
||||
|
||||
setsid();
|
||||
|
||||
if (!getenv("AFL_DEBUG_CHILD_OUTPUT")) {
|
||||
|
||||
dup2(dev_null_fd, 1);
|
||||
dup2(dev_null_fd, 2);
|
||||
|
||||
}
|
||||
|
||||
if (!use_stdin) {
|
||||
|
||||
dup2(dev_null_fd, 0);
|
||||
|
||||
} else {
|
||||
|
||||
dup2(out_fd, 0);
|
||||
close(out_fd);
|
||||
|
||||
}
|
||||
|
||||
/* Set up control and status pipes, close the unneeded original fds. */
|
||||
|
||||
if (dup2(ctl_pipe[0], FORKSRV_FD) < 0) PFATAL("dup2() failed");
|
||||
if (dup2(st_pipe[1], FORKSRV_FD + 1) < 0) PFATAL("dup2() failed");
|
||||
|
||||
close(ctl_pipe[0]);
|
||||
close(ctl_pipe[1]);
|
||||
close(st_pipe[0]);
|
||||
close(st_pipe[1]);
|
||||
|
||||
close(out_dir_fd);
|
||||
close(dev_null_fd);
|
||||
#ifndef HAVE_ARC4RANDOM
|
||||
close(dev_urandom_fd);
|
||||
#endif
|
||||
close(plot_file == NULL ? -1 : fileno(plot_file));
|
||||
|
||||
/* This should improve performance a bit, since it stops the linker from
|
||||
doing extra work post-fork(). */
|
||||
|
||||
if (!getenv("LD_BIND_LAZY")) setenv("LD_BIND_NOW", "1", 0);
|
||||
|
||||
/* Set sane defaults for ASAN if nothing else specified. */
|
||||
|
||||
setenv("ASAN_OPTIONS",
|
||||
"abort_on_error=1:"
|
||||
"detect_leaks=0:"
|
||||
"malloc_context_size=0:"
|
||||
"symbolize=0:"
|
||||
"allocator_may_return_null=1",
|
||||
0);
|
||||
|
||||
/* MSAN is tricky, because it doesn't support abort_on_error=1 at this
|
||||
point. So, we do this in a very hacky way. */
|
||||
|
||||
setenv("MSAN_OPTIONS",
|
||||
"exit_code=" STRINGIFY(MSAN_ERROR) ":"
|
||||
"symbolize=0:"
|
||||
"abort_on_error=1:"
|
||||
"malloc_context_size=0:"
|
||||
"allocator_may_return_null=1:"
|
||||
"msan_track_origins=0",
|
||||
0);
|
||||
|
||||
setenv("__AFL_CMPLOG_MODE__", "1", 1);
|
||||
|
||||
argv[0] = cmplog_binary;
|
||||
execv(cmplog_binary, argv);
|
||||
|
||||
/* Use a distinctive bitmap signature to tell the parent about execv()
|
||||
falling through. */
|
||||
|
||||
*(u32 *)trace_bits = EXEC_FAIL_SIG;
|
||||
exit(0);
|
||||
|
||||
}
|
||||
|
||||
/* PARENT PROCESS */
|
||||
|
||||
/* Close the unneeded endpoints. */
|
||||
|
||||
close(ctl_pipe[0]);
|
||||
close(st_pipe[1]);
|
||||
|
||||
cmplog_fsrv_ctl_fd = ctl_pipe[1];
|
||||
cmplog_fsrv_st_fd = st_pipe[0];
|
||||
|
||||
/* Wait for the fork server to come up, but don't wait too long. */
|
||||
|
||||
if (exec_tmout) {
|
||||
|
||||
it.it_value.tv_sec = ((exec_tmout * FORK_WAIT_MULT) / 1000);
|
||||
it.it_value.tv_usec = ((exec_tmout * FORK_WAIT_MULT) % 1000) * 1000;
|
||||
|
||||
}
|
||||
|
||||
setitimer(ITIMER_REAL, &it, NULL);
|
||||
|
||||
rlen = read(cmplog_fsrv_st_fd, &status, 4);
|
||||
|
||||
it.it_value.tv_sec = 0;
|
||||
it.it_value.tv_usec = 0;
|
||||
|
||||
setitimer(ITIMER_REAL, &it, NULL);
|
||||
|
||||
/* If we have a four-byte "hello" message from the server, we're all set.
|
||||
Otherwise, try to figure out what went wrong. */
|
||||
|
||||
if (rlen == 4) {
|
||||
|
||||
OKF("All right - fork server is up.");
|
||||
return;
|
||||
|
||||
}
|
||||
|
||||
if (child_timed_out)
|
||||
FATAL("Timeout while initializing cmplog fork server (adjusting -t may help)");
|
||||
|
||||
if (waitpid(cmplog_forksrv_pid, &status, 0) <= 0) PFATAL("waitpid() failed");
|
||||
|
||||
if (WIFSIGNALED(status)) {
|
||||
|
||||
if (mem_limit && mem_limit < 500 && uses_asan) {
|
||||
|
||||
SAYF("\n" cLRD "[-] " cRST
|
||||
"Whoops, the target binary crashed suddenly, "
|
||||
"before receiving any input\n"
|
||||
" from the fuzzer! Since it seems to be built with ASAN and you "
|
||||
"have a\n"
|
||||
" restrictive memory limit configured, this is expected; please "
|
||||
"read\n"
|
||||
" %s/notes_for_asan.txt for help.\n",
|
||||
doc_path);
|
||||
|
||||
} else if (!mem_limit) {
|
||||
|
||||
SAYF("\n" cLRD "[-] " cRST
|
||||
"Whoops, the target binary crashed suddenly, "
|
||||
"before receiving any input\n"
|
||||
" from the fuzzer! There are several probable explanations:\n\n"
|
||||
|
||||
" - The binary is just buggy and explodes entirely on its own. "
|
||||
"If so, you\n"
|
||||
" need to fix the underlying problem or find a better "
|
||||
"replacement.\n\n"
|
||||
|
||||
MSG_FORK_ON_APPLE
|
||||
|
||||
" - Less likely, there is a horrible bug in the fuzzer. If other "
|
||||
"options\n"
|
||||
" fail, poke <afl-users@googlegroups.com> for troubleshooting "
|
||||
"tips.\n");
|
||||
|
||||
} else {
|
||||
|
||||
SAYF("\n" cLRD "[-] " cRST
|
||||
"Whoops, the target binary crashed suddenly, "
|
||||
"before receiving any input\n"
|
||||
" from the fuzzer! There are several probable explanations:\n\n"
|
||||
|
||||
" - The current memory limit (%s) is too restrictive, causing "
|
||||
"the\n"
|
||||
" target to hit an OOM condition in the dynamic linker. Try "
|
||||
"bumping up\n"
|
||||
" the limit with the -m setting in the command line. A simple "
|
||||
"way confirm\n"
|
||||
" this diagnosis would be:\n\n"
|
||||
|
||||
MSG_ULIMIT_USAGE
|
||||
" /path/to/fuzzed_app )\n\n"
|
||||
|
||||
" Tip: you can use http://jwilk.net/software/recidivm to "
|
||||
"quickly\n"
|
||||
" estimate the required amount of virtual memory for the "
|
||||
"binary.\n\n"
|
||||
|
||||
" - The binary is just buggy and explodes entirely on its own. "
|
||||
"If so, you\n"
|
||||
" need to fix the underlying problem or find a better "
|
||||
"replacement.\n\n"
|
||||
|
||||
MSG_FORK_ON_APPLE
|
||||
|
||||
" - Less likely, there is a horrible bug in the fuzzer. If other "
|
||||
"options\n"
|
||||
" fail, poke <afl-users@googlegroups.com> for troubleshooting "
|
||||
"tips.\n",
|
||||
DMS(mem_limit << 20), mem_limit - 1);
|
||||
|
||||
}
|
||||
|
||||
FATAL("Cmplog fork server crashed with signal %d", WTERMSIG(status));
|
||||
|
||||
}
|
||||
|
||||
if (*(u32 *)trace_bits == EXEC_FAIL_SIG)
|
||||
FATAL("Unable to execute target application ('%s')", argv[0]);
|
||||
|
||||
if (mem_limit && mem_limit < 500 && uses_asan) {
|
||||
|
||||
SAYF("\n" cLRD "[-] " cRST
|
||||
"Hmm, looks like the target binary terminated "
|
||||
"before we could complete a\n"
|
||||
" handshake with the injected code. Since it seems to be built "
|
||||
"with ASAN and\n"
|
||||
" you have a restrictive memory limit configured, this is "
|
||||
"expected; please\n"
|
||||
" read %s/notes_for_asan.txt for help.\n",
|
||||
doc_path);
|
||||
|
||||
} else if (!mem_limit) {
|
||||
|
||||
SAYF("\n" cLRD "[-] " cRST
|
||||
"Hmm, looks like the target binary terminated "
|
||||
"before we could complete a\n"
|
||||
" handshake with the injected code. Perhaps there is a horrible "
|
||||
"bug in the\n"
|
||||
" fuzzer. Poke <afl-users@googlegroups.com> for troubleshooting "
|
||||
"tips.\n");
|
||||
|
||||
} else {
|
||||
|
||||
SAYF(
|
||||
"\n" cLRD "[-] " cRST
|
||||
"Hmm, looks like the target binary terminated "
|
||||
"before we could complete a\n"
|
||||
" handshake with the injected code. There are %s probable "
|
||||
"explanations:\n\n"
|
||||
|
||||
"%s"
|
||||
" - The current memory limit (%s) is too restrictive, causing an "
|
||||
"OOM\n"
|
||||
" fault in the dynamic linker. This can be fixed with the -m "
|
||||
"option. A\n"
|
||||
" simple way to confirm the diagnosis may be:\n\n"
|
||||
|
||||
MSG_ULIMIT_USAGE
|
||||
" /path/to/fuzzed_app )\n\n"
|
||||
|
||||
" Tip: you can use http://jwilk.net/software/recidivm to quickly\n"
|
||||
" estimate the required amount of virtual memory for the "
|
||||
"binary.\n\n"
|
||||
|
||||
" - Less likely, there is a horrible bug in the fuzzer. If other "
|
||||
"options\n"
|
||||
" fail, poke <afl-users@googlegroups.com> for troubleshooting "
|
||||
"tips.\n",
|
||||
getenv(DEFER_ENV_VAR) ? "three" : "two",
|
||||
getenv(DEFER_ENV_VAR)
|
||||
? " - You are using deferred forkserver, but __AFL_INIT() is "
|
||||
"never\n"
|
||||
" reached before the program terminates.\n\n"
|
||||
: "",
|
||||
DMS(mem_limit << 20), mem_limit - 1);
|
||||
|
||||
}
|
||||
|
||||
FATAL("Cmplog fork server handshake failed");
|
||||
|
||||
}
|
||||
|
||||
u8 run_cmplog_target(char** argv, u32 timeout) {
|
||||
|
||||
static struct itimerval it;
|
||||
static u32 prev_timed_out = 0;
|
||||
static u64 exec_ms = 0;
|
||||
|
||||
int status = 0;
|
||||
u32 tb4;
|
||||
|
||||
child_timed_out = 0;
|
||||
|
||||
/* After this memset, trace_bits[] are effectively volatile, so we
|
||||
must prevent any earlier operations from venturing into that
|
||||
territory. */
|
||||
|
||||
memset(trace_bits, 0, MAP_SIZE);
|
||||
MEM_BARRIER();
|
||||
|
||||
/* If we're running in "dumb" mode, we can't rely on the fork server
|
||||
logic compiled into the target program, so we will just keep calling
|
||||
execve(). There is a bit of code duplication between here and
|
||||
init_forkserver(), but c'est la vie. */
|
||||
|
||||
if (dumb_mode == 1 || no_forkserver) {
|
||||
|
||||
cmplog_child_pid = fork();
|
||||
|
||||
if (cmplog_child_pid < 0) PFATAL("fork() failed");
|
||||
|
||||
if (!cmplog_child_pid) {
|
||||
|
||||
struct rlimit r;
|
||||
|
||||
if (mem_limit) {
|
||||
|
||||
r.rlim_max = r.rlim_cur = ((rlim_t)mem_limit) << 20;
|
||||
|
||||
#ifdef RLIMIT_AS
|
||||
|
||||
setrlimit(RLIMIT_AS, &r); /* Ignore errors */
|
||||
|
||||
#else
|
||||
|
||||
setrlimit(RLIMIT_DATA, &r); /* Ignore errors */
|
||||
|
||||
#endif /* ^RLIMIT_AS */
|
||||
|
||||
}
|
||||
|
||||
r.rlim_max = r.rlim_cur = 0;
|
||||
|
||||
setrlimit(RLIMIT_CORE, &r); /* Ignore errors */
|
||||
|
||||
/* Isolate the process and configure standard descriptors. If out_file is
|
||||
specified, stdin is /dev/null; otherwise, out_fd is cloned instead. */
|
||||
|
||||
setsid();
|
||||
|
||||
dup2(dev_null_fd, 1);
|
||||
dup2(dev_null_fd, 2);
|
||||
|
||||
if (out_file) {
|
||||
|
||||
dup2(dev_null_fd, 0);
|
||||
|
||||
} else {
|
||||
|
||||
dup2(out_fd, 0);
|
||||
close(out_fd);
|
||||
|
||||
}
|
||||
|
||||
/* On Linux, would be faster to use O_CLOEXEC. Maybe TODO. */
|
||||
|
||||
close(dev_null_fd);
|
||||
close(out_dir_fd);
|
||||
#ifndef HAVE_ARC4RANDOM
|
||||
close(dev_urandom_fd);
|
||||
#endif
|
||||
close(fileno(plot_file));
|
||||
|
||||
/* Set sane defaults for ASAN if nothing else specified. */
|
||||
|
||||
setenv("ASAN_OPTIONS",
|
||||
"abort_on_error=1:"
|
||||
"detect_leaks=0:"
|
||||
"symbolize=0:"
|
||||
"allocator_may_return_null=1",
|
||||
0);
|
||||
|
||||
setenv("MSAN_OPTIONS", "exit_code=" STRINGIFY(MSAN_ERROR) ":"
|
||||
"symbolize=0:"
|
||||
"msan_track_origins=0", 0);
|
||||
|
||||
setenv("__AFL_CMPLOG_MODE__", "1", 1);
|
||||
|
||||
argv[0] = cmplog_binary;
|
||||
execv(cmplog_binary, argv);
|
||||
|
||||
/* Use a distinctive bitmap value to tell the parent about execv()
|
||||
falling through. */
|
||||
|
||||
*(u32*)trace_bits = EXEC_FAIL_SIG;
|
||||
exit(0);
|
||||
|
||||
}
|
||||
|
||||
} else {
|
||||
|
||||
s32 res;
|
||||
|
||||
/* In non-dumb mode, we have the fork server up and running, so simply
|
||||
tell it to have at it, and then read back PID. */
|
||||
|
||||
if ((res = write(cmplog_fsrv_ctl_fd, &prev_timed_out, 4)) != 4) {
|
||||
|
||||
if (stop_soon) return 0;
|
||||
RPFATAL(res, "Unable to request new process from cmplog fork server (OOM?)");
|
||||
|
||||
}
|
||||
|
||||
if ((res = read(cmplog_fsrv_st_fd, &cmplog_child_pid, 4)) != 4) {
|
||||
|
||||
if (stop_soon) return 0;
|
||||
RPFATAL(res, "Unable to request new process from cmplog fork server (OOM?)");
|
||||
|
||||
}
|
||||
|
||||
if (cmplog_child_pid <= 0) FATAL("Cmplog fork server is misbehaving (OOM?)");
|
||||
|
||||
}
|
||||
|
||||
/* Configure timeout, as requested by user, then wait for child to terminate.
|
||||
*/
|
||||
|
||||
it.it_value.tv_sec = (timeout / 1000);
|
||||
it.it_value.tv_usec = (timeout % 1000) * 1000;
|
||||
|
||||
setitimer(ITIMER_REAL, &it, NULL);
|
||||
|
||||
/* The SIGALRM handler simply kills the cmplog_child_pid and sets child_timed_out. */
|
||||
|
||||
if (dumb_mode == 1 || no_forkserver) {
|
||||
|
||||
if (waitpid(cmplog_child_pid, &status, 0) <= 0) PFATAL("waitpid() failed");
|
||||
|
||||
} else {
|
||||
|
||||
s32 res;
|
||||
|
||||
if ((res = read(cmplog_fsrv_st_fd, &status, 4)) != 4) {
|
||||
|
||||
if (stop_soon) return 0;
|
||||
SAYF(
|
||||
"\n" cLRD "[-] " cRST
|
||||
"Unable to communicate with fork server. Some possible reasons:\n\n"
|
||||
" - You've run out of memory. Use -m to increase the the memory "
|
||||
"limit\n"
|
||||
" to something higher than %lld.\n"
|
||||
" - The binary or one of the libraries it uses manages to create\n"
|
||||
" threads before the forkserver initializes.\n"
|
||||
" - The binary, at least in some circumstances, exits in a way "
|
||||
"that\n"
|
||||
" also kills the parent process - raise() could be the "
|
||||
"culprit.\n\n"
|
||||
"If all else fails you can disable the fork server via "
|
||||
"AFL_NO_FORKSRV=1.\n",
|
||||
mem_limit);
|
||||
RPFATAL(res, "Unable to communicate with fork server");
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
if (!WIFSTOPPED(status)) cmplog_child_pid = 0;
|
||||
|
||||
getitimer(ITIMER_REAL, &it);
|
||||
exec_ms =
|
||||
(u64)timeout - (it.it_value.tv_sec * 1000 + it.it_value.tv_usec / 1000);
|
||||
if (slowest_exec_ms < exec_ms) slowest_exec_ms = exec_ms;
|
||||
|
||||
it.it_value.tv_sec = 0;
|
||||
it.it_value.tv_usec = 0;
|
||||
|
||||
setitimer(ITIMER_REAL, &it, NULL);
|
||||
|
||||
++total_execs;
|
||||
|
||||
/* Any subsequent operations on trace_bits must not be moved by the
|
||||
compiler below this point. Past this location, trace_bits[] behave
|
||||
very normally and do not have to be treated as volatile. */
|
||||
|
||||
MEM_BARRIER();
|
||||
|
||||
tb4 = *(u32*)trace_bits;
|
||||
|
||||
#ifdef WORD_SIZE_64
|
||||
classify_counts((u64*)trace_bits);
|
||||
#else
|
||||
classify_counts((u32*)trace_bits);
|
||||
#endif /* ^WORD_SIZE_64 */
|
||||
|
||||
prev_timed_out = child_timed_out;
|
||||
|
||||
/* Report outcome to caller. */
|
||||
|
||||
if (WIFSIGNALED(status) && !stop_soon) {
|
||||
|
||||
kill_signal = WTERMSIG(status);
|
||||
|
||||
if (child_timed_out && kill_signal == SIGKILL) return FAULT_TMOUT;
|
||||
|
||||
return FAULT_CRASH;
|
||||
|
||||
}
|
||||
|
||||
/* A somewhat nasty hack for MSAN, which doesn't support abort_on_error and
|
||||
must use a special exit code. */
|
||||
|
||||
if (uses_asan && WEXITSTATUS(status) == MSAN_ERROR) {
|
||||
|
||||
kill_signal = 0;
|
||||
return FAULT_CRASH;
|
||||
|
||||
}
|
||||
|
||||
if ((dumb_mode == 1 || no_forkserver) && tb4 == EXEC_FAIL_SIG)
|
||||
return FAULT_ERROR;
|
||||
|
||||
return FAULT_NONE;
|
||||
|
||||
}
|
||||
|
||||
u8 common_fuzz_cmplog_stuff(char** argv, u8* out_buf, u32 len) {
|
||||
|
||||
u8 fault;
|
||||
|
||||
if (post_handler) {
|
||||
|
||||
out_buf = post_handler(out_buf, &len);
|
||||
if (!out_buf || !len) return 0;
|
||||
|
||||
}
|
||||
|
||||
write_to_testcase(out_buf, len);
|
||||
|
||||
fault = run_cmplog_target(argv, exec_tmout);
|
||||
|
||||
if (stop_soon) return 1;
|
||||
|
||||
if (fault == FAULT_TMOUT) {
|
||||
|
||||
if (subseq_tmouts++ > TMOUT_LIMIT) {
|
||||
|
||||
++cur_skipped_paths;
|
||||
return 1;
|
||||
|
||||
}
|
||||
|
||||
} else
|
||||
|
||||
subseq_tmouts = 0;
|
||||
|
||||
/* Users can hit us with SIGUSR1 to request the current input
|
||||
to be abandoned. */
|
||||
|
||||
if (skip_requested) {
|
||||
|
||||
skip_requested = 0;
|
||||
++cur_skipped_paths;
|
||||
return 1;
|
||||
|
||||
}
|
||||
|
||||
/* This handles FAULT_ERROR for us: */
|
||||
|
||||
/* queued_discovered += save_if_interesting(argv, out_buf, len, fault);
|
||||
|
||||
if (!(stage_cur % stats_update_freq) || stage_cur + 1 == stage_max)
|
||||
show_stats(); */
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
@ -531,6 +531,13 @@ u8 fuzz_one_original(char** argv) {
|
||||
|
||||
}
|
||||
|
||||
if (cmplog_mode) {
|
||||
|
||||
if(input_to_state_stage(argv, in_buf, out_buf, len, queue_cur->exec_cksum))
|
||||
goto abandon_entry;
|
||||
|
||||
}
|
||||
|
||||
/* Skip right away if -d is given, if it has not been chosen sufficiently
|
||||
often to warrant the expensive deterministic stage (fuzz_level), or
|
||||
if it has gone through deterministic testing in earlier, resumed runs
|
||||
|
||||
@ -405,6 +405,8 @@ u8 calibrate_case(char** argv, struct queue_entry* q, u8* use_mem, u32 handicap,
|
||||
count its spin-up time toward binary calibration. */
|
||||
|
||||
if (dumb_mode != 1 && !no_forkserver && !forksrv_pid) init_forkserver(argv);
|
||||
if (dumb_mode != 1 && !no_forkserver && !cmplog_forksrv_pid && cmplog_mode)
|
||||
init_cmplog_forkserver(argv);
|
||||
|
||||
if (q->exec_cksum) memcpy(first_trace, trace_bits, MAP_SIZE);
|
||||
|
||||
|
||||
@ -596,9 +596,11 @@ void show_stats(void) {
|
||||
: cRST),
|
||||
tmp);
|
||||
|
||||
sprintf(tmp, "%s/%s, %s/%s", DI(stage_finds[STAGE_PYTHON]),
|
||||
sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s", DI(stage_finds[STAGE_PYTHON]),
|
||||
DI(stage_cycles[STAGE_PYTHON]), DI(stage_finds[STAGE_CUSTOM_MUTATOR]),
|
||||
DI(stage_cycles[STAGE_CUSTOM_MUTATOR]));
|
||||
DI(stage_cycles[STAGE_CUSTOM_MUTATOR]), DI(stage_finds[STAGE_COLORIZATION]),
|
||||
DI(stage_cycles[STAGE_COLORIZATION]), DI(stage_finds[STAGE_ITS]),
|
||||
DI(stage_cycles[STAGE_ITS]));
|
||||
|
||||
SAYF(bV bSTOP " py/custom : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
|
||||
tmp);
|
||||
|
||||
@ -100,6 +100,7 @@ static void usage(u8* argv0) {
|
||||
" -f file - location read by the fuzzed program (stdin)\n"
|
||||
" -t msec - timeout for each run (auto-scaled, 50-%d ms)\n"
|
||||
" -m megs - memory limit for child process (%d MB)\n"
|
||||
" -c program - enable CmpLog specifying a binary compiled for it\n"
|
||||
" -Q - use binary-only instrumentation (QEMU mode)\n"
|
||||
" -U - use unicorn-based instrumentation (Unicorn mode)\n"
|
||||
" -W - use qemu-based instrumentation with Wine (Wine "
|
||||
@ -193,12 +194,21 @@ int main(int argc, char** argv) {
|
||||
init_seed = tv.tv_sec ^ tv.tv_usec ^ getpid();
|
||||
|
||||
while ((opt = getopt(argc, argv,
|
||||
"+i:I:o:f:m:t:T:dnCB:S:M:x:QNUWe:p:s:V:E:L:hR")) > 0)
|
||||
"+i:I:o:f:m:t:T:dnCB:S:M:x:QNUWe:p:s:V:E:L:hRP:")) > 0)
|
||||
|
||||
switch (opt) {
|
||||
|
||||
case 'I': infoexec = optarg; break;
|
||||
|
||||
case 'c': {
|
||||
|
||||
cmplog_mode = 1;
|
||||
cmplog_binary = ck_strdup(optarg);
|
||||
// TODO check cmplog_binary validity
|
||||
break;
|
||||
|
||||
}
|
||||
|
||||
case 's': {
|
||||
|
||||
init_seed = strtoul(optarg, 0L, 10);
|
||||
|
||||
@ -35,6 +35,7 @@
|
||||
#include "alloc-inl.h"
|
||||
#include "hash.h"
|
||||
#include "sharedmem.h"
|
||||
#include "cmplog.h"
|
||||
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
@ -68,8 +69,12 @@ char g_shm_file_path[L_tmpnam];
|
||||
/* ========================================= */
|
||||
#else
|
||||
static s32 shm_id; /* ID of the SHM region */
|
||||
static s32 cmplog_shm_id;
|
||||
#endif
|
||||
|
||||
int cmplog_mode;
|
||||
struct cmp_map* cmp_map;
|
||||
|
||||
/* Get rid of shared memory (atexit handler). */
|
||||
|
||||
void remove_shm(void) {
|
||||
@ -91,6 +96,8 @@ void remove_shm(void) {
|
||||
|
||||
#else
|
||||
shmctl(shm_id, IPC_RMID, NULL);
|
||||
if (cmplog_mode)
|
||||
shmctl(cmplog_shm_id, IPC_RMID, NULL);
|
||||
#endif
|
||||
|
||||
}
|
||||
@ -149,6 +156,14 @@ void setup_shm(unsigned char dumb_mode) {
|
||||
|
||||
if (shm_id < 0) PFATAL("shmget() failed");
|
||||
|
||||
if (cmplog_mode) {
|
||||
|
||||
cmplog_shm_id = shmget(IPC_PRIVATE, sizeof(struct cmp_map), IPC_CREAT | IPC_EXCL | 0600);
|
||||
|
||||
if (cmplog_shm_id < 0) PFATAL("shmget() failed");
|
||||
|
||||
}
|
||||
|
||||
atexit(remove_shm);
|
||||
|
||||
shm_str = alloc_printf("%d", shm_id);
|
||||
@ -162,8 +177,21 @@ void setup_shm(unsigned char dumb_mode) {
|
||||
|
||||
ck_free(shm_str);
|
||||
|
||||
if (cmplog_mode) {
|
||||
|
||||
shm_str = alloc_printf("%d", cmplog_shm_id);
|
||||
|
||||
if (!dumb_mode) setenv(CMPLOG_SHM_ENV_VAR, shm_str, 1);
|
||||
|
||||
ck_free(shm_str);
|
||||
|
||||
}
|
||||
|
||||
trace_bits = shmat(shm_id, NULL, 0);
|
||||
|
||||
if (cmplog_mode)
|
||||
cmp_map = shmat(cmplog_shm_id, NULL, 0);
|
||||
|
||||
if (!trace_bits) PFATAL("shmat() failed");
|
||||
|
||||
#endif
|
||||
|
||||
Reference in New Issue
Block a user