mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-15 03:18:07 +00:00
Autodictionary (#309)
* lto module clean-up * step 1/3 * step 1/3 completed * if tmp is ever made non-static * parts 2 and 3 - autodictionary is complete * variable map_size support * variable map size: changed overlooked functions * remove debug for autodict * 64 bit alignment of map size * fix review comments * force 64 bit alignment on both sides * typo * better map transfer, display snapshot in UI * update readme
This commit is contained in:
van Hauser
GitHub
@ -77,7 +77,6 @@ typedef struct afl_forkserver {
|
||||
|
||||
void (*function_ptr)(void *afl_tmp, u8 *mem, u32 len);
|
||||
|
||||
|
||||
} afl_forkserver_t;
|
||||
|
||||
void afl_fsrv_init(afl_forkserver_t *fsrv);
|
||||
|
||||
@ -50,7 +50,8 @@ Example build output from a libtiff build:
|
||||
libtool: link: afl-clang-lto -g -O2 -Wall -W -o thumbnail thumbnail.o ../libtiff/.libs/libtiff.a ../port/.libs/libport.a -llzma -ljbig -ljpeg -lz -lm
|
||||
afl-clang-lto++2.63d by Marc "vanHauser" Heuse <mh@mh-sec.de> in mode LTO
|
||||
afl-llvm-lto++2.63d by Marc "vanHauser" Heuse <mh@mh-sec.de>
|
||||
[+] Instrumented 11836 locations with no collisions (on average 1007 collisions would be in afl-gcc/afl-clang-fast) (non-hardened mode).
|
||||
AUTODICTIONARY: 11 strings found
|
||||
[+] Instrumented 12071 locations with no collisions (on average 1046 collisions would be in afl-gcc/afl-clang-fast) (non-hardened mode).
|
||||
```
|
||||
|
||||
## Building llvm 11
|
||||
|
||||
@ -468,15 +468,13 @@ bool AFLLTOPass::runOnModule(Module &M) {
|
||||
TmpConstStr.append("\0", 1);
|
||||
ConstStr = StringRef(TmpConstStr);
|
||||
|
||||
if (isSizedcmp && constLen > sizedLen) { constLen = sizedLen; }
|
||||
if (isSizedcmp && constLen > sizedLen) constLen = sizedLen;
|
||||
|
||||
/*
|
||||
if (!be_quiet)
|
||||
errs() << callInst->getCalledFunction()->getName() << ": len "
|
||||
<< constLen << ": " << ConstStr << "\n";
|
||||
*/
|
||||
if (debug)
|
||||
errs() << callInst->getCalledFunction()->getName() << ": len "
|
||||
<< constLen << ": " << ConstStr << "\n";
|
||||
|
||||
if (constLen && constLen < MAX_DICT_FILE)
|
||||
if (constLen >= MIN_AUTO_EXTRA && constLen <= MAX_DICT_FILE)
|
||||
dictionary.push_back(ConstStr.str().substr(0, constLen));
|
||||
|
||||
}
|
||||
@ -514,14 +512,22 @@ bool AFLLTOPass::runOnModule(Module &M) {
|
||||
|
||||
if (getenv("AFL_LLVM_LTO_DONTWRITEID") == NULL) {
|
||||
|
||||
GlobalVariable *AFLFinalLoc = new GlobalVariable(
|
||||
M, Int32Ty, true, GlobalValue::ExternalLinkage, 0, "__afl_final_loc",
|
||||
0, GlobalVariable::GeneralDynamicTLSModel, 0, false);
|
||||
ConstantInt *const_loc =
|
||||
ConstantInt::get(Int32Ty, (((afl_global_id + 8) >> 3) << 3));
|
||||
StoreInst *StoreFinalLoc = IRB.CreateStore(const_loc, AFLFinalLoc);
|
||||
StoreFinalLoc->setMetadata(M.getMDKindID("nosanitize"),
|
||||
MDNode::get(C, None));
|
||||
uint32_t write_loc = afl_global_id;
|
||||
|
||||
if (afl_global_id % 8) write_loc = (((afl_global_id + 8) >> 3) << 3);
|
||||
|
||||
if (write_loc <= MAP_SIZE && write_loc <= 0x800000) {
|
||||
|
||||
GlobalVariable *AFLFinalLoc = new GlobalVariable(
|
||||
M, Int32Ty, true, GlobalValue::ExternalLinkage, 0,
|
||||
"__afl_final_loc", 0, GlobalVariable::GeneralDynamicTLSModel, 0,
|
||||
false);
|
||||
ConstantInt *const_loc = ConstantInt::get(Int32Ty, write_loc);
|
||||
StoreInst * StoreFinalLoc = IRB.CreateStore(const_loc, AFLFinalLoc);
|
||||
StoreFinalLoc->setMetadata(M.getMDKindID("nosanitize"),
|
||||
MDNode::get(C, None));
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@ -537,7 +543,9 @@ bool AFLLTOPass::runOnModule(Module &M) {
|
||||
|
||||
}
|
||||
|
||||
if (!be_quiet) printf("AUTODICTIONARY: %lu strings found\n", count);
|
||||
if (!be_quiet)
|
||||
printf("AUTODICTIONARY: %lu string%s found\n", count,
|
||||
count == 1 ? "" : "s");
|
||||
|
||||
if (count) {
|
||||
|
||||
@ -549,13 +557,16 @@ bool AFLLTOPass::runOnModule(Module &M) {
|
||||
|
||||
}
|
||||
|
||||
count = 0;
|
||||
|
||||
for (auto token : dictionary) {
|
||||
|
||||
if (offset + token.length() < 0xfffff0) {
|
||||
if (offset + token.length() < 0xfffff0 && count < MAX_AUTO_EXTRAS) {
|
||||
|
||||
ptr[offset++] = (uint8_t)token.length();
|
||||
memcpy(ptr + offset, token.c_str(), token.length());
|
||||
offset += token.length();
|
||||
count++;
|
||||
|
||||
}
|
||||
|
||||
|
||||
@ -208,7 +208,7 @@ static void __afl_start_snapshots(void) {
|
||||
assume we're not running in forkserver mode and just execute program. */
|
||||
|
||||
status |= (FS_OPT_ENABLED | FS_OPT_SNAPSHOT);
|
||||
if (map_size <= 0x1000000)
|
||||
if (map_size <= 0x800000)
|
||||
status |= (FS_OPT_SET_MAPSIZE(map_size) | FS_OPT_MAPSIZE);
|
||||
if (__afl_dictionary_len > 0 && __afl_dictionary) status |= FS_OPT_AUTODICT;
|
||||
memcpy(tmp, &status, 4);
|
||||
@ -373,7 +373,7 @@ static void __afl_start_forkserver(void) {
|
||||
|
||||
void (*old_sigchld_handler)(int) = 0; // = signal(SIGCHLD, SIG_DFL);
|
||||
|
||||
if (map_size <= 0x1000000)
|
||||
if (map_size <= 0x800000)
|
||||
status |= (FS_OPT_SET_MAPSIZE(map_size) | FS_OPT_MAPSIZE);
|
||||
if (__afl_dictionary_len > 0 && __afl_dictionary) status |= FS_OPT_AUTODICT;
|
||||
if (status) status |= (FS_OPT_ENABLED);
|
||||
|
||||
@ -367,24 +367,29 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
|
||||
if ((status & FS_OPT_MAPSIZE) == FS_OPT_MAPSIZE) {
|
||||
|
||||
fsrv->map_size = FS_OPT_GET_MAPSIZE(status);
|
||||
if (fsrv->map_size % 8)
|
||||
if (fsrv->map_size % 8) // should not happen
|
||||
fsrv->map_size = (((fsrv->map_size + 8) >> 3) << 3);
|
||||
if (!be_quiet) ACTF("Target map size: %u", fsrv->map_size);
|
||||
|
||||
}
|
||||
|
||||
if (fsrv->function_ptr == NULL || fsrv->function_opt == NULL) {
|
||||
|
||||
// this is not afl-fuzz - we deny and return
|
||||
status = (0xffffffff ^ (FS_OPT_ENABLED | FS_OPT_AUTODICT));
|
||||
if (write(fsrv->fsrv_ctl_fd, &status, 4) != 4)
|
||||
FATAL("Writing to forkserver failed.");
|
||||
return;
|
||||
if (fsrv->map_size > MAP_SIZE)
|
||||
FATAL(
|
||||
"Target's coverage map size of %u is larger than the one this "
|
||||
"afl++ is compiled with (%u)\n",
|
||||
fsrv->map_size, MAP_SIZE);
|
||||
|
||||
}
|
||||
|
||||
if ((status & FS_OPT_AUTODICT) == FS_OPT_AUTODICT) {
|
||||
|
||||
if (fsrv->function_ptr == NULL || fsrv->function_opt == NULL) {
|
||||
|
||||
// this is not afl-fuzz - we deny and return
|
||||
status = (0xffffffff ^ (FS_OPT_ENABLED | FS_OPT_AUTODICT));
|
||||
if (write(fsrv->fsrv_ctl_fd, &status, 4) != 4)
|
||||
FATAL("Writing to forkserver failed.");
|
||||
return;
|
||||
|
||||
}
|
||||
|
||||
if (!be_quiet) ACTF("Using AUTODICT feature.");
|
||||
status = (FS_OPT_ENABLED | FS_OPT_AUTODICT);
|
||||
if (write(fsrv->fsrv_ctl_fd, &status, 4) != 4)
|
||||
|
||||
@ -38,12 +38,479 @@ void cmplog_exec_child(afl_forkserver_t *fsrv, char **argv) {
|
||||
|
||||
if (!fsrv->qemu_mode && argv[0] != fsrv->cmplog_binary) {
|
||||
|
||||
#if 0
|
||||
afl->fsrv.child_timed_out = 0;
|
||||
afl->cmplog_fsrv_pid = fork();
|
||||
|
||||
if (afl->cmplog_fsrv_pid < 0) PFATAL("fork() failed");
|
||||
|
||||
if (!afl->cmplog_fsrv_pid) {
|
||||
|
||||
/* CHILD PROCESS */
|
||||
|
||||
struct rlimit r;
|
||||
|
||||
/* Umpf. On OpenBSD, the default fd limit for root users is set to
|
||||
soft 128. Let's try to fix that... */
|
||||
|
||||
if (!getrlimit(RLIMIT_NOFILE, &r) && r.rlim_cur < FORKSRV_FD + 2) {
|
||||
|
||||
r.rlim_cur = FORKSRV_FD + 2;
|
||||
setrlimit(RLIMIT_NOFILE, &r); /* Ignore errors */
|
||||
|
||||
}
|
||||
|
||||
if (afl->fsrv.mem_limit) {
|
||||
|
||||
r.rlim_max = r.rlim_cur = ((rlim_t)afl->fsrv.mem_limit) << 20;
|
||||
|
||||
#ifdef RLIMIT_AS
|
||||
setrlimit(RLIMIT_AS, &r); /* Ignore errors */
|
||||
#else
|
||||
/* This takes care of OpenBSD, which doesn't have RLIMIT_AS, but
|
||||
according to reliable sources, RLIMIT_DATA covers anonymous
|
||||
maps - so we should be getting good protection against OOM bugs. */
|
||||
|
||||
setrlimit(RLIMIT_DATA, &r); /* Ignore errors */
|
||||
#endif /* ^RLIMIT_AS */
|
||||
|
||||
}
|
||||
|
||||
/* Dumping cores is slow and can lead to anomalies if SIGKILL is delivered
|
||||
before the dump is complete. */
|
||||
|
||||
// r.rlim_max = r.rlim_cur = 0;
|
||||
// setrlimit(RLIMIT_CORE, &r); /* Ignore errors */
|
||||
|
||||
/* Isolate the process and configure standard descriptors. If
|
||||
afl->fsrv.out_file is specified, stdin is /dev/null; otherwise,
|
||||
afl->fsrv.out_fd is cloned instead. */
|
||||
|
||||
setsid();
|
||||
|
||||
if (!(afl->afl_env.afl_debug_child_output)) {
|
||||
|
||||
dup2(afl->fsrv.dev_null_fd, 1);
|
||||
dup2(afl->fsrv.dev_null_fd, 2);
|
||||
|
||||
}
|
||||
|
||||
if (!afl->fsrv.use_stdin) {
|
||||
|
||||
dup2(afl->fsrv.dev_null_fd, 0);
|
||||
|
||||
} else {
|
||||
|
||||
dup2(afl->fsrv.out_fd, 0);
|
||||
close(afl->fsrv.out_fd);
|
||||
|
||||
}
|
||||
|
||||
/* Set up control and status pipes, close the unneeded original fds. */
|
||||
|
||||
if (dup2(ctl_pipe[0], FORKSRV_FD) < 0) PFATAL("dup2() failed");
|
||||
if (dup2(st_pipe[1], FORKSRV_FD + 1) < 0) PFATAL("dup2() failed");
|
||||
|
||||
close(ctl_pipe[0]);
|
||||
close(ctl_pipe[1]);
|
||||
close(st_pipe[0]);
|
||||
close(st_pipe[1]);
|
||||
|
||||
close(afl->fsrv.out_dir_fd);
|
||||
close(afl->fsrv.dev_null_fd);
|
||||
#ifndef HAVE_ARC4RANDOM
|
||||
close(afl->fsrv.dev_urandom_fd);
|
||||
#endif
|
||||
if (afl->fsrv.plot_file != NULL) fclose(afl->fsrv.plot_file);
|
||||
|
||||
/* This should improve performance a bit, since it stops the linker from
|
||||
doing extra work post-fork(). */
|
||||
|
||||
if (!getenv("LD_BIND_LAZY")) setenv("LD_BIND_NOW", "1", 0);
|
||||
|
||||
/* Set sane defaults for ASAN if nothing else specified. */
|
||||
|
||||
setenv("ASAN_OPTIONS",
|
||||
"abort_on_error=1:"
|
||||
"detect_leaks=0:"
|
||||
"malloc_context_size=0:"
|
||||
"symbolize=0:"
|
||||
"allocator_may_return_null=1",
|
||||
0);
|
||||
|
||||
/* MSAN is tricky, because it doesn't support abort_on_error=1 at this
|
||||
point. So, we do this in a very hacky way. */
|
||||
|
||||
setenv("MSAN_OPTIONS",
|
||||
"exit_code=" STRINGIFY(MSAN_ERROR) ":"
|
||||
"symbolize=0:"
|
||||
"abort_on_error=1:"
|
||||
"malloc_context_size=0:"
|
||||
"allocator_may_return_null=1:"
|
||||
"msan_track_origins=0",
|
||||
0);
|
||||
|
||||
setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1);
|
||||
|
||||
if (!afl->qemu_mode && afl->argv[0] != afl->cmplog_binary) {
|
||||
|
||||
ck_free(afl->argv[0]);
|
||||
afl->argv[0] = afl->cmplog_binary;
|
||||
|
||||
}
|
||||
|
||||
execv(afl->argv[0], afl->argv);
|
||||
|
||||
/* Use a distinctive bitmap signature to tell the parent about execv()
|
||||
falling through. */
|
||||
|
||||
*(u32 *)afl->fsrv.trace_bits = EXEC_FAIL_SIG;
|
||||
exit(0);
|
||||
|
||||
}
|
||||
|
||||
/* PARENT PROCESS */
|
||||
|
||||
/* Close the unneeded endpoints. */
|
||||
|
||||
close(ctl_pipe[0]);
|
||||
close(st_pipe[1]);
|
||||
|
||||
afl->cmplog_fsrv_ctl_fd = ctl_pipe[1];
|
||||
afl->cmplog_fsrv_st_fd = st_pipe[0];
|
||||
|
||||
/* Wait for the fork server to come up, but don't wait too long. */
|
||||
|
||||
rlen = 0;
|
||||
if (afl->fsrv.exec_tmout) {
|
||||
|
||||
rlen = 4;
|
||||
u32 timeout_ms = afl->fsrv.exec_tmout * FORK_WAIT_MULT;
|
||||
/* Reuse readfds as exceptfds to see when the child closed the pipe */
|
||||
u32 exec_ms = read_timed(afl->cmplog_fsrv_st_fd, &status, rlen, timeout_ms,
|
||||
&afl->stop_soon);
|
||||
|
||||
if (!exec_ms) {
|
||||
|
||||
PFATAL("Error in timed read");
|
||||
|
||||
} else if (exec_ms > timeout_ms) {
|
||||
|
||||
afl->fsrv.child_timed_out = 1;
|
||||
kill(afl->cmplog_fsrv_pid, SIGKILL);
|
||||
rlen = read(afl->cmplog_fsrv_st_fd, &status, 4);
|
||||
|
||||
}
|
||||
|
||||
} else {
|
||||
|
||||
rlen = read(afl->cmplog_fsrv_st_fd, &status, 4);
|
||||
|
||||
}
|
||||
|
||||
/* If we have a four-byte "hello" message from the server, we're all set.
|
||||
Otherwise, try to figure out what went wrong. */
|
||||
|
||||
if (afl->fsrv.child_timed_out)
|
||||
FATAL(
|
||||
"Timeout while initializing cmplog fork server (adjusting -t may "
|
||||
"help)");
|
||||
|
||||
if (rlen == 4) {
|
||||
|
||||
OKF("All right - fork server is up.");
|
||||
return;
|
||||
|
||||
}
|
||||
|
||||
if (waitpid(afl->cmplog_fsrv_pid, &status, 0) <= 0)
|
||||
PFATAL("waitpid() failed");
|
||||
|
||||
if (WIFSIGNALED(status)) {
|
||||
|
||||
if (afl->fsrv.mem_limit && afl->fsrv.mem_limit < 500 &&
|
||||
afl->fsrv.uses_asan) {
|
||||
|
||||
SAYF("\n" cLRD "[-] " cRST
|
||||
"Whoops, the target binary crashed suddenly, "
|
||||
"before receiving any input\n"
|
||||
" from the fuzzer! Since it seems to be built with ASAN and you "
|
||||
"have a\n"
|
||||
" restrictive memory limit configured, this is expected; please "
|
||||
"read\n"
|
||||
" %s/notes_for_asan.md for help.\n",
|
||||
doc_path);
|
||||
|
||||
} else if (!afl->fsrv.mem_limit) {
|
||||
|
||||
SAYF("\n" cLRD "[-] " cRST
|
||||
"Whoops, the target binary crashed suddenly, "
|
||||
"before receiving any input\n"
|
||||
" from the fuzzer! There are several probable explanations:\n\n"
|
||||
|
||||
" - The binary is just buggy and explodes entirely on its own. "
|
||||
"If so, you\n"
|
||||
" need to fix the underlying problem or find a better "
|
||||
"replacement.\n\n"
|
||||
|
||||
MSG_FORK_ON_APPLE
|
||||
|
||||
" - Less likely, there is a horrible bug in the fuzzer. If other "
|
||||
"options\n"
|
||||
" fail, poke <afl-users@googlegroups.com> for troubleshooting "
|
||||
"tips.\n");
|
||||
|
||||
} else {
|
||||
|
||||
u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
|
||||
|
||||
SAYF("\n" cLRD "[-] " cRST
|
||||
"Whoops, the target binary crashed suddenly, "
|
||||
"before receiving any input\n"
|
||||
" from the fuzzer! There are several probable explanations:\n\n"
|
||||
|
||||
" - The current memory limit (%s) is too restrictive, causing "
|
||||
"the\n"
|
||||
" target to hit an OOM condition in the dynamic linker. Try "
|
||||
"bumping up\n"
|
||||
" the limit with the -m setting in the command line. A simple "
|
||||
"way confirm\n"
|
||||
" this diagnosis would be:\n\n"
|
||||
|
||||
MSG_ULIMIT_USAGE
|
||||
" /path/to/fuzzed_app )\n\n"
|
||||
|
||||
" Tip: you can use http://jwilk.net/software/recidivm to "
|
||||
"quickly\n"
|
||||
" estimate the required amount of virtual memory for the "
|
||||
"binary.\n\n"
|
||||
|
||||
" - The binary is just buggy and explodes entirely on its own. "
|
||||
"If so, you\n"
|
||||
" need to fix the underlying problem or find a better "
|
||||
"replacement.\n\n"
|
||||
|
||||
MSG_FORK_ON_APPLE
|
||||
|
||||
" - Less likely, there is a horrible bug in the fuzzer. If other "
|
||||
"options\n"
|
||||
" fail, poke <afl-users@googlegroups.com> for troubleshooting "
|
||||
"tips.\n",
|
||||
stringify_mem_size(val_buf, sizeof(val_buf),
|
||||
afl->fsrv.mem_limit << 20),
|
||||
afl->fsrv.mem_limit - 1);
|
||||
|
||||
}
|
||||
|
||||
FATAL("Cmplog fork server crashed with signal %d", WTERMSIG(status));
|
||||
|
||||
}
|
||||
|
||||
if (*(u32 *)afl->fsrv.trace_bits == EXEC_FAIL_SIG)
|
||||
FATAL("Unable to execute target application ('%s')", afl->argv[0]);
|
||||
|
||||
if (afl->fsrv.mem_limit && afl->fsrv.mem_limit < 500 && afl->fsrv.uses_asan) {
|
||||
|
||||
SAYF("\n" cLRD "[-] " cRST
|
||||
"Hmm, looks like the target binary terminated "
|
||||
"before we could complete a\n"
|
||||
" handshake with the injected code. Since it seems to be built "
|
||||
"with ASAN and\n"
|
||||
" you have a restrictive memory limit configured, this is "
|
||||
"expected; please\n"
|
||||
" read %s/notes_for_asan.md for help.\n",
|
||||
doc_path);
|
||||
|
||||
} else if (!afl->fsrv.mem_limit) {
|
||||
|
||||
SAYF("\n" cLRD "[-] " cRST
|
||||
"Hmm, looks like the target binary terminated "
|
||||
"before we could complete a\n"
|
||||
" handshake with the injected code. Perhaps there is a horrible "
|
||||
"bug in the\n"
|
||||
" fuzzer. Poke <afl-users@googlegroups.com> for troubleshooting "
|
||||
"tips.\n");
|
||||
|
||||
} else {
|
||||
|
||||
u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
|
||||
|
||||
SAYF(
|
||||
"\n" cLRD "[-] " cRST
|
||||
"Hmm, looks like the target binary terminated "
|
||||
"before we could complete a\n"
|
||||
" handshake with the injected code. There are %s probable "
|
||||
"explanations:\n\n"
|
||||
|
||||
"%s"
|
||||
" - The current memory limit (%s) is too restrictive, causing an "
|
||||
"OOM\n"
|
||||
" fault in the dynamic linker. This can be fixed with the -m "
|
||||
"option. A\n"
|
||||
" simple way to confirm the diagnosis may be:\n\n"
|
||||
|
||||
MSG_ULIMIT_USAGE
|
||||
" /path/to/fuzzed_app )\n\n"
|
||||
|
||||
" Tip: you can use http://jwilk.net/software/recidivm to quickly\n"
|
||||
" estimate the required amount of virtual memory for the "
|
||||
"binary.\n\n"
|
||||
|
||||
" - Less likely, there is a horrible bug in the fuzzer. If other "
|
||||
"options\n"
|
||||
" fail, poke <afl-users@googlegroups.com> for troubleshooting "
|
||||
"tips.\n",
|
||||
getenv(DEFER_ENV_VAR) ? "three" : "two",
|
||||
getenv(DEFER_ENV_VAR)
|
||||
? " - You are using deferred forkserver, but __AFL_INIT() is "
|
||||
"never\n"
|
||||
" reached before the program terminates.\n\n"
|
||||
: "",
|
||||
stringify_mem_size(val_buf, sizeof(val_buf), afl->fsrv.mem_limit << 20),
|
||||
afl->fsrv.mem_limit - 1);
|
||||
|
||||
}
|
||||
|
||||
FATAL("Cmplog fork server handshake failed");
|
||||
|
||||
}
|
||||
|
||||
u8 run_cmplog_target(afl_state_t *afl, u32 timeout) {
|
||||
|
||||
int status = 0;
|
||||
u32 exec_ms;
|
||||
|
||||
u32 tb4;
|
||||
s32 res;
|
||||
|
||||
afl->fsrv.child_timed_out = 0;
|
||||
|
||||
/* After this memset, afl->fsrv.trace_bits[] are effectively volatile, so we
|
||||
must prevent any earlier operations from venturing into that
|
||||
territory. */
|
||||
|
||||
memset(afl->fsrv.trace_bits, 0, afl->fsrv.map_size);
|
||||
MEM_BARRIER();
|
||||
|
||||
/* Since we always have a forkserver (or a fauxserver) running, we can simply
|
||||
tell them to have at it and read back the pid from it.*/
|
||||
|
||||
if ((res = write(afl->cmplog_fsrv_ctl_fd, &afl->cmplog_prev_timed_out, 4)) !=
|
||||
4) {
|
||||
|
||||
if (afl->stop_soon) return 0;
|
||||
RPFATAL(res,
|
||||
"Unable to request new process from cmplog fork server (OOM?)");
|
||||
|
||||
}
|
||||
|
||||
if ((res = read(afl->cmplog_fsrv_st_fd, &afl->cmplog_child_pid, 4)) != 4) {
|
||||
|
||||
if (afl->stop_soon) return 0;
|
||||
RPFATAL(res,
|
||||
"Unable to request new process from cmplog fork server (OOM?)");
|
||||
|
||||
}
|
||||
|
||||
if (afl->cmplog_child_pid <= 0)
|
||||
FATAL("Cmplog fork server is misbehaving (OOM?)");
|
||||
|
||||
/* Configure timeout, as requested by user, then wait for child to terminate.
|
||||
*/
|
||||
exec_ms =
|
||||
read_timed(afl->cmplog_fsrv_st_fd, &status, 4, timeout, &afl->stop_soon);
|
||||
|
||||
if (exec_ms > timeout) {
|
||||
|
||||
/* If there was no response from forkserver after timeout seconds,
|
||||
we kill the child. The forkserver should inform us afterwards */
|
||||
|
||||
kill(afl->cmplog_child_pid, SIGKILL);
|
||||
afl->fsrv.child_timed_out = 1;
|
||||
|
||||
/* After killing the child, the forkserver should tell us */
|
||||
if (!read(afl->cmplog_fsrv_st_fd, &status, 4)) exec_ms = 0;
|
||||
|
||||
}
|
||||
|
||||
if (!exec_ms) { // Something went wrong.
|
||||
|
||||
if (afl->stop_soon) return 0;
|
||||
SAYF("\n" cLRD "[-] " cRST
|
||||
"Unable to communicate with fork server. Some possible reasons:\n\n"
|
||||
" - You've run out of memory. Use -m to increase the the memory "
|
||||
"limit\n"
|
||||
" to something higher than %lld.\n"
|
||||
" - The binary or one of the libraries it uses manages to create\n"
|
||||
" threads before the forkserver initializes.\n"
|
||||
" - The binary, at least in some circumstances, exits in a way "
|
||||
"that\n"
|
||||
" also kills the parent process - raise() could be the "
|
||||
"culprit.\n\n"
|
||||
"If all else fails you can disable the fork server via "
|
||||
"AFL_NO_FORKSRV=1.\n",
|
||||
afl->fsrv.mem_limit);
|
||||
RPFATAL(res, "Unable to communicate with fork server");
|
||||
|
||||
}
|
||||
|
||||
if (!WIFSTOPPED(status)) afl->cmplog_child_pid = 0;
|
||||
|
||||
if (afl->slowest_exec_ms < exec_ms) afl->slowest_exec_ms = exec_ms;
|
||||
|
||||
++afl->total_execs;
|
||||
|
||||
/* Any subsequent operations on afl->fsrv.trace_bits must not be moved by the
|
||||
compiler below this point. Past this location, afl->fsrv.trace_bits[]
|
||||
behave very normally and do not have to be treated as volatile. */
|
||||
|
||||
MEM_BARRIER();
|
||||
|
||||
tb4 = *(u32 *)afl->fsrv.trace_bits;
|
||||
|
||||
#ifdef WORD_SIZE_64
|
||||
classify_counts(afl, (u64 *)afl->fsrv.trace_bits);
|
||||
#else
|
||||
classify_counts(afl, (u32 *)afl->fsrv.trace_bits);
|
||||
#endif /* ^WORD_SIZE_64 */
|
||||
|
||||
afl->cmplog_prev_timed_out = afl->fsrv.child_timed_out;
|
||||
|
||||
/* Report outcome to caller. */
|
||||
|
||||
if (WIFSIGNALED(status) && !afl->stop_soon) {
|
||||
|
||||
afl->kill_signal = WTERMSIG(status);
|
||||
|
||||
if (afl->fsrv.child_timed_out && afl->kill_signal == SIGKILL)
|
||||
return FAULT_TMOUT;
|
||||
|
||||
return FAULT_CRASH;
|
||||
|
||||
}
|
||||
|
||||
/* A somewhat nasty hack for MSAN, which doesn't support abort_on_error and
|
||||
must use a special exit code. */
|
||||
|
||||
if (afl->fsrv.uses_asan && WEXITSTATUS(status) == MSAN_ERROR) {
|
||||
|
||||
afl->kill_signal = 0;
|
||||
return FAULT_CRASH;
|
||||
|
||||
}
|
||||
|
||||
if ((afl->dumb_mode == 1 || afl->no_forkserver) && tb4 == EXEC_FAIL_SIG)
|
||||
return FAULT_ERROR;
|
||||
|
||||
return FAULT_NONE;
|
||||
#else
|
||||
ck_free(argv[0]);
|
||||
argv[0] = fsrv->cmplog_binary;
|
||||
|
||||
}
|
||||
|
||||
execv(argv[0], argv);
|
||||
#endif
|
||||
|
||||
}
|
||||
|
||||
@ -104,4 +571,3 @@ u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
|
||||
@ -366,9 +366,9 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
/* Lord, forgive me this. */
|
||||
|
||||
SAYF(SET_G1 bSTG bLT bH bSTOP cCYA
|
||||
SAYF(SET_G1 bSTG bLT bH bSTOP cCYA
|
||||
" process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA
|
||||
" overall results " bSTG bH2 bH2 bRT "\n");
|
||||
" overall results " bSTG bH2 bH2 bRT "\n");
|
||||
|
||||
if (afl->dumb_mode) {
|
||||
|
||||
@ -450,9 +450,9 @@ void show_stats(afl_state_t *afl) {
|
||||
" uniq hangs : " cRST "%-6s" bSTG bV "\n",
|
||||
time_tmp, tmp);
|
||||
|
||||
SAYF(bVR bH bSTOP cCYA
|
||||
SAYF(bVR bH bSTOP cCYA
|
||||
" cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA
|
||||
" map coverage " bSTG bH bHT bH20 bH2 bVL "\n");
|
||||
" map coverage " bSTG bH bHT bH20 bH2 bVL "\n");
|
||||
|
||||
/* This gets funny because we want to print several variable-length variables
|
||||
together, but then cram them into a fixed-width field - so we need to
|
||||
@ -482,9 +482,9 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp);
|
||||
|
||||
SAYF(bVR bH bSTOP cCYA
|
||||
SAYF(bVR bH bSTOP cCYA
|
||||
" stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA
|
||||
" findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
|
||||
" findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
|
||||
|
||||
sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_favored),
|
||||
((double)afl->queued_favored) * 100 / afl->queued_paths);
|
||||
@ -558,7 +558,7 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
/* Aaaalmost there... hold on! */
|
||||
|
||||
SAYF(bVR bH cCYA bSTOP
|
||||
SAYF(bVR bH cCYA bSTOP
|
||||
" fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA
|
||||
" path geometry " bSTG bH5 bH2 bVL "\n");
|
||||
|
||||
@ -737,6 +737,8 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
if (afl->cpu_core_count) {
|
||||
|
||||
char *spacing = SP10, snap[24] = " " cLGN "snapshot" cRST " ";
|
||||
|
||||
double cur_runnable = get_runnable_processes();
|
||||
u32 cur_utilization = cur_runnable * 100 / afl->cpu_core_count;
|
||||
|
||||
@ -751,23 +753,25 @@ void show_stats(afl_state_t *afl) {
|
||||
|
||||
if (!afl->no_cpu_meter_red && cur_utilization >= 150) cpu_color = cLRD;
|
||||
|
||||
if (afl->fsrv.snapshot) spacing = snap;
|
||||
|
||||
#ifdef HAVE_AFFINITY
|
||||
|
||||
if (afl->cpu_aff >= 0) {
|
||||
|
||||
SAYF(SP10 cGRA "[cpu%03u:%s%3u%%" cGRA "]\r" cRST, MIN(afl->cpu_aff, 999),
|
||||
cpu_color, MIN(cur_utilization, 999));
|
||||
SAYF("%s" cGRA "[cpu%03u:%s%3u%%" cGRA "]\r" cRST, spacing,
|
||||
MIN(afl->cpu_aff, 999), cpu_color, MIN(cur_utilization, 999));
|
||||
|
||||
} else {
|
||||
|
||||
SAYF(SP10 cGRA " [cpu:%s%3u%%" cGRA "]\r" cRST, cpu_color,
|
||||
SAYF("%s" cGRA " [cpu:%s%3u%%" cGRA "]\r" cRST, spacing, cpu_color,
|
||||
MIN(cur_utilization, 999));
|
||||
|
||||
}
|
||||
|
||||
#else
|
||||
|
||||
SAYF(SP10 cGRA " [cpu:%s%3u%%" cGRA "]\r" cRST, cpu_color,
|
||||
SAYF("%s" cGRA " [cpu:%s%3u%%" cGRA "]\r" cRST, spacing, cpu_color,
|
||||
MIN(cur_utilization, 999));
|
||||
|
||||
#endif /* ^HAVE_AFFINITY */
|
||||
|
||||
Reference in New Issue
Block a user