ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-14 02:58:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

code format

Browse Source
This commit is contained in:
Dominik Maier
2020-03-25 11:31:01 +01:00
committed by van Hauser
parent 89512d4e05
commit 6d3dc83c5d
11 changed files with 175 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
examples/custom_mutators/custom_mutator_helpers.h
View File

@ -7,11 +7,13 @@
#define RAND_BELOW(limit) (rand() % (limit)) #define RAND_BELOW(limit) (rand() % (limit))
typedef struct{} afl_t; typedef struct {
} afl_t;
static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) { static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
static s8 interesting_8[] = {INTERESTING_8}; static s8 interesting_8[] = {INTERESTING_8};
static s16 interesting_16[] = {INTERESTING_8, INTERESTING_16}; static s16 interesting_16[] = {INTERESTING_8, INTERESTING_16};
static s32 interesting_32[] = {INTERESTING_8, INTERESTING_16, INTERESTING_32}; static s32 interesting_32[] = {INTERESTING_8, INTERESTING_16, INTERESTING_32};
@ -111,8 +113,8 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
(s64)interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)]; (s64)interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)];
break; break;
case 1: case 1:
*(u64 *)(out_buf + byte_idx) = *(u64 *)(out_buf + byte_idx) = SWAP64(
SWAP64((s64)interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)]); (s64)interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)]);
break; break;
} }
@ -266,3 +268,4 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
} }
#endif #endif

29
examples/custom_mutators/example.c
View File

@ -23,7 +23,6 @@ static const char *commands[] = {
}; };
typedef struct my_mutator { typedef struct my_mutator {
afl_t *afl; afl_t *afl;
@ -34,21 +33,26 @@ typedef struct my_mutator {
/** /**
* Initialize this custom mutator * Initialize this custom mutator
* *
* @param[in] afl a pointer to the internal state object. Can be ignored for now. * @param[in] afl a pointer to the internal state object. Can be ignored for
* @param[in] seed A seed for this mutator - the same seed should always mutate in the same way. * now.
* @param[in] seed A seed for this mutator - the same seed should always mutate
* in the same way.
* @return Pointer to the data object this custom mutator instance should use. * @return Pointer to the data object this custom mutator instance should use.
* There may be multiple instances of this mutator in one afl-fuzz run! * There may be multiple instances of this mutator in one afl-fuzz run!
* Returns NULL on error. * Returns NULL on error.
*/ */
my_mutator_t *afl_custom_init(afl_t *afl, unsigned int seed) { my_mutator_t *afl_custom_init(afl_t *afl, unsigned int seed) {
srand(seed); // needed also by surgical_havoc_mutate() srand(seed); // needed also by surgical_havoc_mutate()
my_mutator_t *data = calloc(1, sizeof(my_mutator_t)); my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
if (!data) { if (!data) {
perror("afl_custom_init alloc"); perror("afl_custom_init alloc");
return NULL; return NULL;
} }
data->afl = afl; data->afl = afl;
return data; return data;
@ -71,8 +75,8 @@ my_mutator_t *afl_custom_init(afl_t *afl, unsigned int seed) {
*/ */
size_t afl_custom_fuzz(my_mutator_t *data, uint8_t **buf, size_t buf_size, size_t afl_custom_fuzz(my_mutator_t *data, uint8_t **buf, size_t buf_size,
uint8_t *add_buf, uint8_t *add_buf,
size_t add_buf_size, // add_buf can be NULL size_t add_buf_size, // add_buf can be NULL
size_t max_size) { size_t max_size) {
// Make sure that the packet size does not exceed the maximum size expected by // Make sure that the packet size does not exceed the maximum size expected by
// the fuzzer // the fuzzer
@ -113,7 +117,8 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t **buf, size_t buf_size,
* will release the memory after saving the test case. * will release the memory after saving the test case.
* @return Size of the output buffer after processing * @return Size of the output buffer after processing
*/ */
size_t afl_custom_pre_save(my_mutator_t *data, uint8_t *buf, size_t buf_size, uint8_t **out_buf) { size_t afl_custom_pre_save(my_mutator_t *data, uint8_t *buf, size_t buf_size,
uint8_t **out_buf) {
size_t out_buf_size; size_t out_buf_size;
@ -183,7 +188,8 @@ int afl_custom_init_trim(my_mutator_t *data, uint8_t *buf, size_t buf_size) {
* the memory after saving the test case. * the memory after saving the test case.
* @param[out] out_buf_size Pointer to the size of the trimmed test case * @param[out] out_buf_size Pointer to the size of the trimmed test case
*/ */
void afl_custom_trim(my_mutator_t *data, uint8_t **out_buf, size_t *out_buf_size) { void afl_custom_trim(my_mutator_t *data, uint8_t **out_buf,
size_t *out_buf_size) {
*out_buf_size = trim_buf_size - 1; *out_buf_size = trim_buf_size - 1;
@ -233,8 +239,8 @@ int afl_custom_post_trim(my_mutator_t *data, int success) {
* not produce data larger than max_size. * not produce data larger than max_size.
* @return Size of the mutated output. * @return Size of the mutated output.
*/ */
size_t afl_custom_havoc_mutation(my_mutator_t *data, uint8_t **buf, size_t buf_size, size_t afl_custom_havoc_mutation(my_mutator_t *data, uint8_t **buf,
size_t max_size) { size_t buf_size, size_t max_size) {
if (buf_size == 0) { if (buf_size == 0) {
@ -292,7 +298,8 @@ uint8_t afl_custom_queue_get(my_mutator_t *data, const uint8_t *filename) {
* @param filename_new_queue File name of the new queue entry * @param filename_new_queue File name of the new queue entry
* @param filename_orig_queue File name of the original queue entry * @param filename_orig_queue File name of the original queue entry
*/ */
void afl_custom_queue_new_entry(my_mutator_t *data, const uint8_t *filename_new_queue, void afl_custom_queue_new_entry(my_mutator_t * data,
const uint8_t *filename_new_queue,
const uint8_t *filename_orig_queue) { const uint8_t *filename_orig_queue) {
/* Additional analysis on the original or new test case */ /* Additional analysis on the original or new test case */

19
include/afl-fuzz.h
View File

@ -290,8 +290,8 @@ typedef struct py_mutator {
PyObject *py_module; PyObject *py_module;
PyObject *py_functions[PY_FUNC_COUNT]; PyObject *py_functions[PY_FUNC_COUNT];
void *afl_state; void * afl_state;
void *py_data; void * py_data;
} py_mutator_t; } py_mutator_t;
@ -592,7 +592,7 @@ struct custom_mutator {
const char *name; const char *name;
void * dh; void * dh;
void *data; /* custom mutator data ptr */ void *data; /* custom mutator data ptr */
/* hooks for the custom mutator function */ /* hooks for the custom mutator function */
@ -620,8 +620,8 @@ struct custom_mutator {
* not produce data larger than max_size. * not produce data larger than max_size.
* @return Size of the mutated output. * @return Size of the mutated output.
*/ */
size_t (*afl_custom_fuzz)(void *data, u8 **buf, size_t buf_size, size_t (*afl_custom_fuzz)(void *data, u8 **buf, size_t buf_size, u8 *add_buf,
u8 *add_buf, size_t add_buf_size, size_t max_size); size_t add_buf_size, size_t max_size);
/** /**
* A post-processing function to use right before AFL writes the test case to * A post-processing function to use right before AFL writes the test case to
@ -711,8 +711,8 @@ struct custom_mutator {
* not produce data larger than max_size. * not produce data larger than max_size.
* @return Size of the mutated output. * @return Size of the mutated output.
*/ */
size_t (*afl_custom_havoc_mutation)(void *data, u8 **buf, size_t (*afl_custom_havoc_mutation)(void *data, u8 **buf, size_t buf_size,
size_t buf_size, size_t max_size); size_t max_size);
/** /**
* Return the probability (in percentage) that afl_custom_havoc_mutation * Return the probability (in percentage) that afl_custom_havoc_mutation
@ -748,9 +748,8 @@ struct custom_mutator {
* @param filename_orig_queue File name of the original queue entry. This * @param filename_orig_queue File name of the original queue entry. This
* argument can be NULL while initializing the fuzzer * argument can be NULL while initializing the fuzzer
*/ */
void (*afl_custom_queue_new_entry)(void *data, void (*afl_custom_queue_new_entry)(void *data, const u8 *filename_new_queue,
const u8 * filename_new_queue, const u8 *filename_orig_queue);
const u8 * filename_orig_queue);
/** /**
* Deinitialize the custom mutator. * Deinitialize the custom mutator.
* *

25
include/common.h
View File

@ -78,7 +78,7 @@ static u64 get_cur_time_us(void) {
Will return buf for convenience. */ Will return buf for convenience. */
static u8 *stringify_int(u8 *buf, size_t len, u64 val) { static u8 *stringify_int(u8 *buf, size_t len, u64 val) {
\
#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \ #define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \
do { \ do { \
\ \
@ -233,23 +233,22 @@ static u8 *stringify_time_diff(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) {
} }
/* Unsafe Describe integer. The buf sizes are not checked. /* Unsafe Describe integer. The buf sizes are not checked.
This is unsafe but fast. This is unsafe but fast.
Will return buf for convenience. */ Will return buf for convenience. */
static u8 *u_stringify_int(u8 *buf, u64 val) { static u8 *u_stringify_int(u8 *buf, u64 val) {
\
#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \ #define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \
do { \ do { \
\ \
if (val < (_divisor) * (_limit_mult)) { \ if (val < (_divisor) * (_limit_mult)) { \
\ \
sprintf(buf, _fmt, ((_cast)val) / (_divisor)); \ sprintf(buf, _fmt, ((_cast)val) / (_divisor)); \
return buf; \ return buf; \
\ \
} \ } \
\ \
} while (0) } while (0)
/* 0-9999 */ /* 0-9999 */

38
llvm_mode/afl-clang-fast.c
View File

@ -485,37 +485,37 @@ static void edit_params(u32 argc, char **argv) {
// if (maybe_linking) { // if (maybe_linking) {
if (x_set) { if (x_set) {
cc_params[cc_par_cnt++] = "-x"; cc_params[cc_par_cnt++] = "-x";
cc_params[cc_par_cnt++] = "none"; cc_params[cc_par_cnt++] = "none";
} }
#ifndef __ANDROID__ #ifndef __ANDROID__
switch (bit_mode) { switch (bit_mode) {
case 0: case 0:
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt.o", obj_path); cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt.o", obj_path);
break; break;
case 32: case 32:
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt-32.o", obj_path); cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt-32.o", obj_path);
if (access(cc_params[cc_par_cnt - 1], R_OK)) if (access(cc_params[cc_par_cnt - 1], R_OK))
FATAL("-m32 is not supported by your compiler"); FATAL("-m32 is not supported by your compiler");
break; break;
case 64: case 64:
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt-64.o", obj_path); cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt-64.o", obj_path);
if (access(cc_params[cc_par_cnt - 1], R_OK)) if (access(cc_params[cc_par_cnt - 1], R_OK))
FATAL("-m64 is not supported by your compiler"); FATAL("-m64 is not supported by your compiler");
break; break;
} }
#endif #endif

22
src/afl-fuzz-mutators.c
View File

@ -78,8 +78,7 @@ void destroy_custom_mutator(afl_state_t *afl) {
afl->mutator->afl_custom_deinit(afl->mutator->data); afl->mutator->afl_custom_deinit(afl->mutator->data);
if (afl->mutator->dh) if (afl->mutator->dh) dlclose(afl->mutator->dh);
dlclose(afl->mutator->dh);
ck_free(afl->mutator); ck_free(afl->mutator);
afl->mutator = NULL; afl->mutator = NULL;
@ -103,11 +102,13 @@ void load_custom_mutator(afl_state_t *afl, const char *fn) {
/* Mutator */ /* Mutator */
/* "afl_custom_init", required */ /* "afl_custom_init", required */
afl->mutator->afl_custom_init = dlsym(dh, "afl_custom_init"); afl->mutator->afl_custom_init = dlsym(dh, "afl_custom_init");
if (!afl->mutator->afl_custom_init) FATAL("Symbol 'afl_custom_init' not found."); if (!afl->mutator->afl_custom_init)
FATAL("Symbol 'afl_custom_init' not found.");
/* "afl_custom_deinit", required */ /* "afl_custom_deinit", required */
afl->mutator->afl_custom_deinit = dlsym(dh, "afl_custom_deinit"); afl->mutator->afl_custom_deinit = dlsym(dh, "afl_custom_deinit");
if (!afl->mutator->afl_custom_deinit) FATAL("Symbol 'afl_custom_deinit' not found."); if (!afl->mutator->afl_custom_deinit)
FATAL("Symbol 'afl_custom_deinit' not found.");
/* "afl_custom_fuzz" or "afl_custom_mutator", required */ /* "afl_custom_fuzz" or "afl_custom_mutator", required */
afl->mutator->afl_custom_fuzz = dlsym(dh, "afl_custom_fuzz"); afl->mutator->afl_custom_fuzz = dlsym(dh, "afl_custom_fuzz");
@ -198,7 +199,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
/* Initialize trimming in the custom mutator */ /* Initialize trimming in the custom mutator */
afl->stage_cur = 0; afl->stage_cur = 0;
afl->stage_max = afl->mutator->afl_custom_init_trim(afl->mutator->data, in_buf, q->len); afl->stage_max =
afl->mutator->afl_custom_init_trim(afl->mutator->data, in_buf, q->len);
if (afl->not_on_tty && afl->debug) if (afl->not_on_tty && afl->debug)
SAYF("[Custom Trimming] START: Max %d iterations, %u bytes", afl->stage_max, SAYF("[Custom Trimming] START: Max %d iterations, %u bytes", afl->stage_max,
@ -206,7 +208,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
while (afl->stage_cur < afl->stage_max) { while (afl->stage_cur < afl->stage_max) {
sprintf(afl->stage_name_buf, "ptrim %s", u_stringify_int(val_buf, trim_exec)); sprintf(afl->stage_name_buf, "ptrim %s",
u_stringify_int(val_buf, trim_exec));
u32 cksum; u32 cksum;
@ -250,7 +253,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
} }
/* Tell the custom mutator that the trimming was successful */ /* Tell the custom mutator that the trimming was successful */
afl->stage_cur = afl->mutator->afl_custom_post_trim(afl->mutator->data, 1); afl->stage_cur =
afl->mutator->afl_custom_post_trim(afl->mutator->data, 1);
if (afl->not_on_tty && afl->debug) if (afl->not_on_tty && afl->debug)
SAYF("[Custom Trimming] SUCCESS: %d/%d iterations (now at %u bytes)", SAYF("[Custom Trimming] SUCCESS: %d/%d iterations (now at %u bytes)",
@ -259,7 +263,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
} else { } else {
/* Tell the custom mutator that the trimming was unsuccessful */ /* Tell the custom mutator that the trimming was unsuccessful */
afl->stage_cur = afl->mutator->afl_custom_post_trim(afl->mutator->data, 0); afl->stage_cur =
afl->mutator->afl_custom_post_trim(afl->mutator->data, 0);
if (afl->not_on_tty && afl->debug) if (afl->not_on_tty && afl->debug)
SAYF("[Custom Trimming] FAILURE: %d/%d iterations", afl->stage_cur, SAYF("[Custom Trimming] FAILURE: %d/%d iterations", afl->stage_cur,
afl->stage_max); afl->stage_max);
@ -304,3 +309,4 @@ abort_trimming:
return fault; return fault;
} }

7
src/afl-fuzz-one.c
View File

@ -360,7 +360,8 @@ u8 fuzz_one_original(afl_state_t *afl) {
/* The custom mutator will decide to skip this test case or not. */ /* The custom mutator will decide to skip this test case or not. */
if (!afl->mutator->afl_custom_queue_get(afl->mutator->data, afl->queue_cur->fname)) if (!afl->mutator->afl_custom_queue_get(afl->mutator->data,
afl->queue_cur->fname))
return 1; return 1;
} }
@ -1723,8 +1724,8 @@ havoc_stage:
if (stacked_custom && rand_below(afl, 100) < stacked_custom_prob) { if (stacked_custom && rand_below(afl, 100) < stacked_custom_prob) {
temp_len = afl->mutator->afl_custom_havoc_mutation(afl->mutator->data, &out_buf, temp_len = afl->mutator->afl_custom_havoc_mutation(
temp_len, MAX_FILE); afl->mutator->data, &out_buf, temp_len, MAX_FILE);
} }

46
src/afl-fuzz-python.c
View File

@ -29,8 +29,10 @@
#ifdef USE_PYTHON #ifdef USE_PYTHON
static void *unsupported(afl_state_t *afl, unsigned int seed) { static void *unsupported(afl_state_t *afl, unsigned int seed) {
FATAL("Python Mutator cannot be called twice yet"); FATAL("Python Mutator cannot be called twice yet");
return NULL; return NULL;
} }
size_t fuzz_py(void *py_mutator, u8 **buf, size_t buf_size, u8 *add_buf, size_t fuzz_py(void *py_mutator, u8 **buf, size_t buf_size, u8 *add_buf,
@ -77,7 +79,8 @@ size_t fuzz_py(void *py_mutator, u8 **buf, size_t buf_size, u8 *add_buf,
PyTuple_SetItem(py_args, 2, py_value); PyTuple_SetItem(py_args, 2, py_value);
py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_FUZZ], py_args); py_value = PyObject_CallObject(
((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_FUZZ], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
@ -99,7 +102,6 @@ size_t fuzz_py(void *py_mutator, u8 **buf, size_t buf_size, u8 *add_buf,
} }
static py_mutator_t *init_py_module(afl_state_t *afl, u8 *module_name) { static py_mutator_t *init_py_module(afl_state_t *afl, u8 *module_name) {
if (!module_name) return NULL; if (!module_name) return NULL;
@ -223,7 +225,8 @@ void finalize_py_module(void *py_mutator) {
} }
static void init_py(afl_state_t *afl, py_mutator_t *py_mutator, unsigned int seed) { static void init_py(afl_state_t *afl, py_mutator_t *py_mutator,
unsigned int seed) {
PyObject *py_args, *py_value; PyObject *py_args, *py_value;
@ -244,7 +247,8 @@ static void init_py(afl_state_t *afl, py_mutator_t *py_mutator, unsigned int see
PyTuple_SetItem(py_args, 0, py_value); PyTuple_SetItem(py_args, 0, py_value);
py_value = PyObject_CallObject(py_mutator->py_functions[PY_FUNC_INIT], py_args); py_value =
PyObject_CallObject(py_mutator->py_functions[PY_FUNC_INIT], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
@ -289,9 +293,7 @@ void load_custom_mutator_py(afl_state_t *afl, char *module_name) {
py_mutator_t *py_mutator; py_mutator_t *py_mutator;
py_mutator = init_py_module(afl, module_name); py_mutator = init_py_module(afl, module_name);
if (!py_mutator) { if (!py_mutator) { FATAL("Failed to load python mutator."); }
FATAL("Failed to load python mutator.");
}
PyObject **py_functions = py_mutator->py_functions; PyObject **py_functions = py_mutator->py_functions;
@ -334,7 +336,6 @@ void load_custom_mutator_py(afl_state_t *afl, char *module_name) {
} }
size_t pre_save_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) { size_t pre_save_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) {
size_t out_buf_size; size_t out_buf_size;
@ -350,7 +351,8 @@ size_t pre_save_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) {
PyTuple_SetItem(py_args, 0, py_value); PyTuple_SetItem(py_args, 0, py_value);
py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_PRE_SAVE], py_args); py_value = PyObject_CallObject(
((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_PRE_SAVE], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
@ -386,7 +388,8 @@ u32 init_trim_py(void *py_mutator, u8 *buf, size_t buf_size) {
PyTuple_SetItem(py_args, 0, py_value); PyTuple_SetItem(py_args, 0, py_value);
py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_INIT_TRIM], py_args); py_value = PyObject_CallObject(
((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_INIT_TRIM], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
if (py_value != NULL) { if (py_value != NULL) {
@ -424,7 +427,8 @@ u32 post_trim_py(void *py_mutator, u8 success) {
PyTuple_SetItem(py_args, 0, py_value); PyTuple_SetItem(py_args, 0, py_value);
py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_POST_TRIM], py_args); py_value = PyObject_CallObject(
((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_POST_TRIM], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
if (py_value != NULL) { if (py_value != NULL) {
@ -451,7 +455,8 @@ void trim_py(void *py_mutator, u8 **out_buf, size_t *out_buf_size) {
PyObject *py_args, *py_value; PyObject *py_args, *py_value;
py_args = PyTuple_New(0); py_args = PyTuple_New(0);
py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_TRIM], py_args); py_value = PyObject_CallObject(
((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_TRIM], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
if (py_value != NULL) { if (py_value != NULL) {
@ -503,8 +508,9 @@ size_t havoc_mutation_py(void *py_mutator, u8 **buf, size_t buf_size,
PyTuple_SetItem(py_args, 1, py_value); PyTuple_SetItem(py_args, 1, py_value);
py_value = py_value = PyObject_CallObject(
PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_HAVOC_MUTATION], py_args); ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_HAVOC_MUTATION],
py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
@ -533,7 +539,9 @@ u8 havoc_mutation_probability_py(void *py_mutator) {
py_args = PyTuple_New(0); py_args = PyTuple_New(0);
py_value = PyObject_CallObject( py_value = PyObject_CallObject(
((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_HAVOC_MUTATION_PROBABILITY], py_args); ((py_mutator_t *)py_mutator)
->py_functions[PY_FUNC_HAVOC_MUTATION_PROBABILITY],
py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
if (py_value != NULL) { if (py_value != NULL) {
@ -573,7 +581,8 @@ u8 queue_get_py(void *py_mutator, const u8 *filename) {
PyTuple_SetItem(py_args, 0, py_value); PyTuple_SetItem(py_args, 0, py_value);
// Call Python function // Call Python function
py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_QUEUE_GET], py_args); py_value = PyObject_CallObject(
((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_QUEUE_GET], py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
if (py_value != NULL) { if (py_value != NULL) {
@ -642,8 +651,9 @@ void queue_new_entry_py(void *py_mutator, const u8 *filename_new_queue,
PyTuple_SetItem(py_args, 1, py_value); PyTuple_SetItem(py_args, 1, py_value);
// Call // Call
py_value = py_value = PyObject_CallObject(
PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_QUEUE_NEW_ENTRY], py_args); ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_QUEUE_NEW_ENTRY],
py_args);
Py_DECREF(py_args); Py_DECREF(py_args);
if (py_value == NULL) { if (py_value == NULL) {

3
src/afl-fuzz-queue.c
View File

@ -147,7 +147,8 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
/* At the initialization stage, queue_cur is NULL */ /* At the initialization stage, queue_cur is NULL */
if (afl->queue_cur) fname_orig = afl->queue_cur->fname; if (afl->queue_cur) fname_orig = afl->queue_cur->fname;
afl->mutator->afl_custom_queue_new_entry(afl->mutator->data, fname, fname_orig); afl->mutator->afl_custom_queue_new_entry(afl->mutator->data, fname,
fname_orig);
} }

8
src/afl-fuzz-run.c
View File

@ -217,8 +217,8 @@ void write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
if (afl->mutator && afl->mutator->afl_custom_pre_save) { if (afl->mutator && afl->mutator->afl_custom_pre_save) {
u8 * new_data; u8 * new_data;
size_t new_size = size_t new_size = afl->mutator->afl_custom_pre_save(afl->mutator->data, mem,
afl->mutator->afl_custom_pre_save(afl->mutator->data, mem, len, &new_data); len, &new_data);
ck_write(fd, new_data, new_size, afl->fsrv.out_file); ck_write(fd, new_data, new_size, afl->fsrv.out_file);
free(new_data); free(new_data);
@ -627,8 +627,8 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
u32 remove_pos = remove_len; u32 remove_pos = remove_len;
sprintf(afl->stage_name_buf, "trim %s/%s", sprintf(afl->stage_name_buf, "trim %s/%s",
u_stringify_int(val_bufs[0], remove_len), u_stringify_int(val_bufs[0], remove_len),
u_stringify_int(val_bufs[1], remove_len)); u_stringify_int(val_bufs[1], remove_len));
afl->stage_cur = 0; afl->stage_cur = 0;
afl->stage_max = q->len / remove_len; afl->stage_max = q->len / remove_len;

119
src/afl-fuzz-stats.c
View File

@ -361,9 +361,9 @@ void show_stats(afl_state_t *afl) {
/* Lord, forgive me this. */ /* Lord, forgive me this. */
SAYF(SET_G1 bSTG bLT bH bSTOP cCYA SAYF(SET_G1 bSTG bLT bH bSTOP cCYA
" process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA
" overall results " bSTG bH2 bH2 bRT "\n"); " overall results " bSTG bH2 bH2 bRT "\n");
if (afl->dumb_mode) { if (afl->dumb_mode) {
@ -406,8 +406,7 @@ void show_stats(afl_state_t *afl) {
(afl->last_path_time || afl->resuming_fuzz || afl->queue_cycle == 1 || (afl->last_path_time || afl->resuming_fuzz || afl->queue_cycle == 1 ||
afl->in_bitmap || afl->crash_mode)) { afl->in_bitmap || afl->crash_mode)) {
u_stringify_time_diff(time_tmp, cur_ms, u_stringify_time_diff(time_tmp, cur_ms, afl->last_path_time);
afl->last_path_time);
SAYF(bV bSTOP " last new path : " cRST "%-33s ", time_tmp); SAYF(bV bSTOP " last new path : " cRST "%-33s ", time_tmp);
} else { } else {
@ -446,9 +445,9 @@ void show_stats(afl_state_t *afl) {
" uniq hangs : " cRST "%-6s" bSTG bV "\n", " uniq hangs : " cRST "%-6s" bSTG bV "\n",
time_tmp, tmp); time_tmp, tmp);
SAYF(bVR bH bSTOP cCYA SAYF(bVR bH bSTOP cCYA
" cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA
" map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); " map coverage " bSTG bH bHT bH20 bH2 bVL "\n");
/* This gets funny because we want to print several variable-length variables /* This gets funny because we want to print several variable-length variables
together, but then cram them into a fixed-width field - so we need to together, but then cram them into a fixed-width field - so we need to
@ -477,9 +476,9 @@ void show_stats(afl_state_t *afl) {
SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp); SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp);
SAYF(bVR bH bSTOP cCYA SAYF(bVR bH bSTOP cCYA
" stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA
" findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_favored), sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_favored),
((double)afl->queued_favored) * 100 / afl->queued_paths); ((double)afl->queued_favored) * 100 / afl->queued_paths);
@ -533,30 +532,27 @@ void show_stats(afl_state_t *afl) {
if (afl->stats_avg_exec < 100) { if (afl->stats_avg_exec < 100) {
sprintf(tmp, "%s/sec (%s)", sprintf(tmp, "%s/sec (%s)", u_stringify_float(IB(0), afl->stats_avg_exec),
u_stringify_float(IB(0), afl->stats_avg_exec), afl->stats_avg_exec < 20 ? "zzzz..." : "slow!");
afl->stats_avg_exec < 20 ? "zzzz..." : "slow!");
SAYF(bV bSTOP " exec speed : " cLRD "%-20s ", tmp); SAYF(bV bSTOP " exec speed : " cLRD "%-20s ", tmp);
} else { } else {
sprintf(tmp, "%s/sec", sprintf(tmp, "%s/sec", u_stringify_float(IB(0), afl->stats_avg_exec));
u_stringify_float(IB(0), afl->stats_avg_exec));
SAYF(bV bSTOP " exec speed : " cRST "%-20s ", tmp); SAYF(bV bSTOP " exec speed : " cRST "%-20s ", tmp);
} }
sprintf(tmp, "%s (%s%s unique)", sprintf(tmp, "%s (%s%s unique)", u_stringify_int(IB(0), afl->total_tmouts),
u_stringify_int(IB(0), afl->total_tmouts), u_stringify_int(IB(1), afl->unique_tmouts),
u_stringify_int(IB(1), afl->unique_tmouts), (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
(afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
SAYF(bSTG bV bSTOP " total tmouts : " cRST "%-22s" bSTG bV "\n", tmp); SAYF(bSTG bV bSTOP " total tmouts : " cRST "%-22s" bSTG bV "\n", tmp);
/* Aaaalmost there... hold on! */ /* Aaaalmost there... hold on! */
SAYF(bVR bH cCYA bSTOP SAYF(bVR bH cCYA bSTOP
" fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA
" path geometry " bSTG bH5 bH2 bVL "\n"); " path geometry " bSTG bH5 bH2 bVL "\n");
@ -567,12 +563,12 @@ void show_stats(afl_state_t *afl) {
} else { } else {
sprintf(tmp, "%s/%s, %s/%s, %s/%s", sprintf(tmp, "%s/%s, %s/%s, %s/%s",
u_stringify_int(IB(0), afl->stage_finds[STAGE_FLIP1]), u_stringify_int(IB(0), afl->stage_finds[STAGE_FLIP1]),
u_stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP1]), u_stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP1]),
u_stringify_int(IB(2), afl->stage_finds[STAGE_FLIP2]), u_stringify_int(IB(2), afl->stage_finds[STAGE_FLIP2]),
u_stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP2]), u_stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP2]),
u_stringify_int(IB(3), afl->stage_finds[STAGE_FLIP4]), u_stringify_int(IB(3), afl->stage_finds[STAGE_FLIP4]),
u_stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP4])); u_stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP4]));
} }
@ -582,12 +578,12 @@ void show_stats(afl_state_t *afl) {
if (!afl->skip_deterministic) if (!afl->skip_deterministic)
sprintf(tmp, "%s/%s, %s/%s, %s/%s", sprintf(tmp, "%s/%s, %s/%s, %s/%s",
u_stringify_int(IB(0), afl->stage_finds[STAGE_FLIP8]), u_stringify_int(IB(0), afl->stage_finds[STAGE_FLIP8]),
u_stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP8]), u_stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP8]),
u_stringify_int(IB(2), afl->stage_finds[STAGE_FLIP16]), u_stringify_int(IB(2), afl->stage_finds[STAGE_FLIP16]),
u_stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP16]), u_stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP16]),
u_stringify_int(IB(4), afl->stage_finds[STAGE_FLIP32]), u_stringify_int(IB(4), afl->stage_finds[STAGE_FLIP32]),
u_stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP32])); u_stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP32]));
SAYF(bV bSTOP " byte flips : " cRST "%-36s " bSTG bV bSTOP SAYF(bV bSTOP " byte flips : " cRST "%-36s " bSTG bV bSTOP
" pending : " cRST "%-10s" bSTG bV "\n", " pending : " cRST "%-10s" bSTG bV "\n",
@ -595,12 +591,12 @@ void show_stats(afl_state_t *afl) {
if (!afl->skip_deterministic) if (!afl->skip_deterministic)
sprintf(tmp, "%s/%s, %s/%s, %s/%s", sprintf(tmp, "%s/%s, %s/%s, %s/%s",
u_stringify_int(IB(0), afl->stage_finds[STAGE_ARITH8]), u_stringify_int(IB(0), afl->stage_finds[STAGE_ARITH8]),
u_stringify_int(IB(1), afl->stage_cycles[STAGE_ARITH8]), u_stringify_int(IB(1), afl->stage_cycles[STAGE_ARITH8]),
u_stringify_int(IB(2), afl->stage_finds[STAGE_ARITH16]), u_stringify_int(IB(2), afl->stage_finds[STAGE_ARITH16]),
u_stringify_int(IB(3), afl->stage_cycles[STAGE_ARITH16]), u_stringify_int(IB(3), afl->stage_cycles[STAGE_ARITH16]),
u_stringify_int(IB(4), afl->stage_finds[STAGE_ARITH32]), u_stringify_int(IB(4), afl->stage_finds[STAGE_ARITH32]),
u_stringify_int(IB(5), afl->stage_cycles[STAGE_ARITH32])); u_stringify_int(IB(5), afl->stage_cycles[STAGE_ARITH32]));
SAYF(bV bSTOP " arithmetics : " cRST "%-36s " bSTG bV bSTOP SAYF(bV bSTOP " arithmetics : " cRST "%-36s " bSTG bV bSTOP
" pend fav : " cRST "%-10s" bSTG bV "\n", " pend fav : " cRST "%-10s" bSTG bV "\n",
@ -621,25 +617,26 @@ void show_stats(afl_state_t *afl) {
if (!afl->skip_deterministic) if (!afl->skip_deterministic)
sprintf(tmp, "%s/%s, %s/%s, %s/%s", sprintf(tmp, "%s/%s, %s/%s, %s/%s",
u_stringify_int(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]), u_stringify_int(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]),
u_stringify_int(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]), u_stringify_int(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]),
u_stringify_int(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]), u_stringify_int(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]),
u_stringify_int(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]), u_stringify_int(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]),
u_stringify_int(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]), u_stringify_int(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]),
u_stringify_int(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO])); u_stringify_int(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO]));
SAYF(bV bSTOP " dictionary : " cRST "%-36s " bSTG bV bSTOP SAYF(bV bSTOP " dictionary : " cRST "%-36s " bSTG bV bSTOP
" imported : " cRST "%-10s" bSTG bV "\n", " imported : " cRST "%-10s" bSTG bV "\n",
tmp, tmp,
afl->sync_id ? u_stringify_int(IB(0), afl->queued_imported) : (u8 *)"n/a"); afl->sync_id ? u_stringify_int(IB(0), afl->queued_imported)
: (u8 *)"n/a");
sprintf(tmp, "%s/%s, %s/%s, %s/%s", sprintf(tmp, "%s/%s, %s/%s, %s/%s",
u_stringify_int(IB(0), afl->stage_finds[STAGE_HAVOC]), u_stringify_int(IB(0), afl->stage_finds[STAGE_HAVOC]),
u_stringify_int(IB(2), afl->stage_cycles[STAGE_HAVOC]), u_stringify_int(IB(2), afl->stage_cycles[STAGE_HAVOC]),
u_stringify_int(IB(3), afl->stage_finds[STAGE_SPLICE]), u_stringify_int(IB(3), afl->stage_finds[STAGE_SPLICE]),
u_stringify_int(IB(4), afl->stage_cycles[STAGE_SPLICE]), u_stringify_int(IB(4), afl->stage_cycles[STAGE_SPLICE]),
u_stringify_int(IB(5), afl->stage_finds[STAGE_RADAMSA]), u_stringify_int(IB(5), afl->stage_finds[STAGE_RADAMSA]),
u_stringify_int(IB(6), afl->stage_cycles[STAGE_RADAMSA])); u_stringify_int(IB(6), afl->stage_cycles[STAGE_RADAMSA]));
SAYF(bV bSTOP " havoc/rad : " cRST "%-36s " bSTG bV bSTOP, tmp); SAYF(bV bSTOP " havoc/rad : " cRST "%-36s " bSTG bV bSTOP, tmp);
@ -660,14 +657,14 @@ void show_stats(afl_state_t *afl) {
if (afl->shm.cmplog_mode) { if (afl->shm.cmplog_mode) {
sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s", sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s",
u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]), u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]), u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]), u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]),
u_stringify_int(IB(4), afl->stage_finds[STAGE_COLORIZATION]), u_stringify_int(IB(4), afl->stage_finds[STAGE_COLORIZATION]),
u_stringify_int(IB(5), afl->stage_cycles[STAGE_COLORIZATION]), u_stringify_int(IB(5), afl->stage_cycles[STAGE_COLORIZATION]),
u_stringify_int(IB(6), afl->stage_finds[STAGE_ITS]), u_stringify_int(IB(6), afl->stage_finds[STAGE_ITS]),
u_stringify_int(IB(7), afl->stage_cycles[STAGE_ITS])); u_stringify_int(IB(7), afl->stage_cycles[STAGE_ITS]));
SAYF(bV bSTOP " custom/rq : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n", SAYF(bV bSTOP " custom/rq : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
tmp); tmp);
@ -675,10 +672,10 @@ void show_stats(afl_state_t *afl) {
} else { } else {
sprintf(tmp, "%s/%s, %s/%s", sprintf(tmp, "%s/%s, %s/%s",
u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]), u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]), u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR])); u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
SAYF(bV bSTOP " py/custom : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n", SAYF(bV bSTOP " py/custom : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
tmp); tmp);