Fixes to afl-cc and documentation (#1974)

* Always compile with -ldl when building for CODE_COVERAGE

When building with CODE_COVERAGE, the afl runtime contains code that
calls `dladdr` which requires -ldl. Under most circumstances, clang
already adds this (e.g. when building with pc-table), but there are some
circumstances where it isn't added automatically.

* Add visibility declaration to __afl_connected

When building with hidden visibility, the use of __AFL_LOOP inside such
code can cause linker errors due to __afl_connected being declared
"hidden".

* Update docs to clarify that CODE_COVERAGE=1 is required for dynamic_covfilter
This commit is contained in:
Christian Holler (:decoder)
2024-01-30 15:30:18 +01:00
committed by GitHub
parent 75af391408
commit 644e069450
3 changed files with 16 additions and 2 deletions

View File

@ -66,6 +66,10 @@ ifdef MSAN_BUILD
override LDFLAGS += -fsanitize=memory
endif
ifdef CODE_COVERAGE
override CFLAGS += -D__AFL_CODE_COVERAGE=1
endif
ifeq "$(findstring android, $(shell $(CC) --version 2>/dev/null))" ""
ifeq "$(shell echo 'int main() {return 0; }' | $(CC) $(CFLAGS) -Werror -x c - -flto=full -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
CFLAGS_FLTO ?= -flto=full

View File

@ -1521,7 +1521,7 @@ void add_defs_persistent_mode(aflcc_state_t *aflcc) {
"({ static volatile const char *_B __attribute__((used,unused)); "
" _B = (const char*)\"" PERSIST_SIG
"\"; "
"extern int __afl_connected;"
"extern __attribute__((visibility(\"default\"))) int __afl_connected;"
#ifdef __APPLE__
"__attribute__((visibility(\"default\"))) "
"int _L(unsigned int) __asm__(\"___afl_persistent_loop\"); "
@ -2311,6 +2311,11 @@ void add_runtime(aflcc_state_t *aflcc) {
}
#if __AFL_CODE_COVERAGE
// Required for dladdr used in afl-compiler-rt.o
insert_param(aflcc, "-ldl");
#endif
#if !defined(__APPLE__) && !defined(__sun)
if (!aflcc->shared_linking && !aflcc->partial_linking)
insert_object(aflcc, "dynamic_list.txt", "-Wl,--dynamic-list=%s", 0);

View File

@ -7,7 +7,12 @@ where doing this dynamically without requiring a new build can be beneficial.
Especially when dealing with larger builds, it is much more convenient to
select the target code locations at runtime instead of doing so at build time.
There are two ways of doing this in AFL++:
There are two ways of doing this in AFL++. Both approaches require a build of
AFL++ with `CODE_COVERAGE=1`, so make sure to build AFL++ first by invoking
`CODE_COVERAGE=1 make`
Once you have built AFL++, you can choose out of two approaches:
## Simple Selection with `AFL_PC_FILTER`