diff --git a/afl-whatsup b/afl-whatsup index 6fa2dfc2..1300c28e 100755 --- a/afl-whatsup +++ b/afl-whatsup @@ -115,7 +115,7 @@ PLATFORM=`uname -s` #if [ "$PLATFORM" = "Linux" ] ; then # CUR_TIME=`cat /proc/uptime | awk '{printf "%.0f\n", $1}'` #else - # This will lead to inacurate results but will prevent the script from breaking on platforms other than Linux + # This will lead to inaccurate results but will prevent the script from breaking on platforms other than Linux CUR_TIME=`date +%s` #fi diff --git a/custom_mutators/aflpp/README.md b/custom_mutators/aflpp/README.md index 04d605c1..eff01cc2 100644 --- a/custom_mutators/aflpp/README.md +++ b/custom_mutators/aflpp/README.md @@ -1,4 +1,4 @@ -# custum mutator: AFL++ +# custom mutator: AFL++ this is the AFL++ havoc mutator as a custom mutator module for AFL++. diff --git a/custom_mutators/atnwalk/atnwalk.c b/custom_mutators/atnwalk/atnwalk.c index 45ccc181..d9347e7d 100644 --- a/custom_mutators/atnwalk/atnwalk.c +++ b/custom_mutators/atnwalk/atnwalk.c @@ -409,7 +409,7 @@ size_t afl_custom_fuzz(atnwalk_mutator_t *data, uint8_t *buf, size_t buf_size, } else { - // new_size fits into buf, so re-use it + // new_size fits into buf, so reuse it *out_buf = buf; } diff --git a/custom_mutators/autotokens/standalone/README.md b/custom_mutators/autotokens/standalone/README.md index 9e9babf7..9d6bce1a 100644 --- a/custom_mutators/autotokens/standalone/README.md +++ b/custom_mutators/autotokens/standalone/README.md @@ -7,6 +7,6 @@ just type `make` to build. You *MUST* use a dictionary file to have an effective grammarless grammar fuzzer! ``` -autotokens-standalone -h # to see all parameteres +autotokens-standalone -h # to see all parameters autotokens-standalone -x foo.dict inputfile outputfile # example ``` diff --git a/custom_mutators/examples/XmlMutatorMin.py b/custom_mutators/examples/XmlMutatorMin.py index 3e6cd0ff..41f6efbb 100644 --- a/custom_mutators/examples/XmlMutatorMin.py +++ b/custom_mutators/examples/XmlMutatorMin.py @@ -304,7 +304,7 @@ class XmlMutatorMin: # Log something if self.verbose: - print("Reseting tag #%i '%s'" % (rand_elem_id, rand_elem.tag)) + print("Resetting tag #%i '%s'" % (rand_elem_id, rand_elem.tag)) # Reset the node rand_elem.clear() diff --git a/custom_mutators/examples/wrapper_afl_min.py b/custom_mutators/examples/wrapper_afl_min.py index 5cd60031..aa84ad0f 100644 --- a/custom_mutators/examples/wrapper_afl_min.py +++ b/custom_mutators/examples/wrapper_afl_min.py @@ -80,12 +80,12 @@ def fuzz(buf, add_buf, max_size): via_buffer = False log("fuzz(): Can't initialize mutator with AFL buffer") - # If init from AFL buffer wasn't succesful + # If init from AFL buffer wasn't successful if not via_buffer: log("fuzz(): Returning unmodified AFL buffer") return buf - # Sucessful initialization -> mutate + # Successful initialization -> mutate try: __mutator__.mutate(max=5) log("fuzz(): Input mutated") diff --git a/custom_mutators/gramatron/build_gramatron_mutator.sh b/custom_mutators/gramatron/build_gramatron_mutator.sh index c830329e..f6c53464 100755 --- a/custom_mutators/gramatron/build_gramatron_mutator.sh +++ b/custom_mutators/gramatron/build_gramatron_mutator.sh @@ -143,7 +143,7 @@ test -e json-c/.libs/libjson-c.a || { echo echo echo "[+] Json-c successfully prepared!" -echo "[+] Builing gramatron now." +echo "[+] Building gramatron now." $CC -O3 -g -fPIC -Wno-unused-result -Wl,--allow-multiple-definition -I../../include -o gramatron.so -shared -I. -I/prg/dev/include gramfuzz.c gramfuzz-helpers.c gramfuzz-mutators.c gramfuzz-util.c hashmap.c ../../src/afl-performance.o json-c/.libs/libjson-c.a || exit 1 echo echo "[+] gramatron successfully built!" diff --git a/custom_mutators/honggfuzz/README.md b/custom_mutators/honggfuzz/README.md index 4bf5c462..5a786562 100644 --- a/custom_mutators/honggfuzz/README.md +++ b/custom_mutators/honggfuzz/README.md @@ -1,4 +1,4 @@ -# custum mutator: honggfuzz mangle +# custom mutator: honggfuzz mangle this is the honggfuzz mutator in mangle.c as a custom mutator module for AFL++. It is the original mangle.c, mangle.h and honggfuzz.h diff --git a/custom_mutators/honggfuzz/mangle.c b/custom_mutators/honggfuzz/mangle.c index 7b7ccb91..f15b49e0 100644 --- a/custom_mutators/honggfuzz/mangle.c +++ b/custom_mutators/honggfuzz/mangle.c @@ -850,7 +850,7 @@ static void mangle_ASCIINumChange(run_t *run, bool printable) { size_t len = 0; uint64_t val = 0; - /* 20 is maximum lenght of a string representing a 64-bit unsigned value */ + /* 20 is maximum length of a string representing a 64-bit unsigned value */ for (len = 0; (len < 20) && (len < left); len++) { char c = run->dynfile->data[off + len]; diff --git a/custom_mutators/libfuzzer/FuzzerDataFlowTrace.cpp b/custom_mutators/libfuzzer/FuzzerDataFlowTrace.cpp index 489665f7..a3db8f64 100644 --- a/custom_mutators/libfuzzer/FuzzerDataFlowTrace.cpp +++ b/custom_mutators/libfuzzer/FuzzerDataFlowTrace.cpp @@ -40,7 +40,7 @@ bool BlockCoverage::AppendCoverage(const std::string &S) { // Coverage lines have this form: // CN X Y Z T // where N is the number of the function, T is the total number of instrumented -// BBs, and X,Y,Z, if present, are the indecies of covered BB. +// BBs, and X,Y,Z, if present, are the indices of covered BB. // BB #0, which is the entry block, is not explicitly listed. bool BlockCoverage::AppendCoverage(std::istream &IN) { diff --git a/custom_mutators/libfuzzer/FuzzerDictionary.h b/custom_mutators/libfuzzer/FuzzerDictionary.h index ddd2d2f1..86ebb40d 100644 --- a/custom_mutators/libfuzzer/FuzzerDictionary.h +++ b/custom_mutators/libfuzzer/FuzzerDictionary.h @@ -106,7 +106,7 @@ private: }; // Parses one dictionary entry. -// If successful, write the enty to Unit and returns true, +// If successful, write the entry to Unit and returns true, // otherwise returns false. bool ParseOneDictionaryEntry(const std::string &Str, Unit *U); // Parses the dictionary file, fills Units, returns true iff all lines diff --git a/custom_mutators/libfuzzer/FuzzerFork.cpp b/custom_mutators/libfuzzer/FuzzerFork.cpp index d6ffed74..aaaaef68 100644 --- a/custom_mutators/libfuzzer/FuzzerFork.cpp +++ b/custom_mutators/libfuzzer/FuzzerFork.cpp @@ -427,7 +427,7 @@ void FuzzWithFork(Random &Rand, const FuzzingOptions &Options, Env.RunOneMergeJob(Job.get()); - // Continue if our crash is one of the ignorred ones. + // Continue if our crash is one of the ignored ones. if (Options.IgnoreTimeouts && ExitCode == Options.TimeoutExitCode) Env.NumTimeouts++; else if (Options.IgnoreOOMs && ExitCode == Options.OOMExitCode) diff --git a/custom_mutators/libfuzzer/FuzzerMerge.cpp b/custom_mutators/libfuzzer/FuzzerMerge.cpp index b341f5b3..2aadd4d0 100644 --- a/custom_mutators/libfuzzer/FuzzerMerge.cpp +++ b/custom_mutators/libfuzzer/FuzzerMerge.cpp @@ -452,7 +452,7 @@ void CrashResistantMerge(const Vector &Args, auto ExitCode = ExecuteCommand(Cmd); if (!ExitCode) { - VPrintf(V, "MERGE-OUTER: succesfull in %zd attempt(s)\n", Attempt); + VPrintf(V, "MERGE-OUTER: succesful in %zd attempt(s)\n", Attempt); break; } diff --git a/custom_mutators/libfuzzer/FuzzerMutate.cpp b/custom_mutators/libfuzzer/FuzzerMutate.cpp index edfe0455..0457bdfa 100644 --- a/custom_mutators/libfuzzer/FuzzerMutate.cpp +++ b/custom_mutators/libfuzzer/FuzzerMutate.cpp @@ -498,9 +498,9 @@ size_t ChangeBinaryInteger(uint8_t *Data, size_t Size, Random &Rand) { T Add = Rand(21); Add -= 10; if (Rand.RandBool()) - Val = Bswap(T(Bswap(Val) + Add)); // Add assuming different endiannes. + Val = Bswap(T(Bswap(Val) + Add)); // Add assuming different endianness. else - Val = Val + Add; // Add assuming current endiannes. + Val = Val + Add; // Add assuming current endianness. if (Add == 0 || Rand.RandBool()) // Maybe negate. Val = -Val; diff --git a/custom_mutators/libfuzzer/FuzzerTracePC.cpp b/custom_mutators/libfuzzer/FuzzerTracePC.cpp index 1177325e..04d843b2 100644 --- a/custom_mutators/libfuzzer/FuzzerTracePC.cpp +++ b/custom_mutators/libfuzzer/FuzzerTracePC.cpp @@ -460,7 +460,7 @@ static size_t InternalStrnlen(const char *S, size_t MaxLen) { } // Finds min of (strlen(S1), strlen(S2)). -// Needed bacause one of these strings may actually be non-zero terminated. +// Needed because one of these strings may actually be non-zero terminated. static size_t InternalStrnlen2(const char *S1, const char *S2) { size_t Len = 0; diff --git a/custom_mutators/libfuzzer/README.md b/custom_mutators/libfuzzer/README.md index cb4773b7..48a29510 100644 --- a/custom_mutators/libfuzzer/README.md +++ b/custom_mutators/libfuzzer/README.md @@ -1,4 +1,4 @@ -# custum mutator: libfuzzer LLVMFuzzerMutate() +# custom mutator: libfuzzer LLVMFuzzerMutate() This uses the libfuzzer LLVMFuzzerMutate() function in llvm 12. diff --git a/custom_mutators/radamsa/GNUmakefile b/custom_mutators/radamsa/GNUmakefile index 3798b110..77f8af71 100644 --- a/custom_mutators/radamsa/GNUmakefile +++ b/custom_mutators/radamsa/GNUmakefile @@ -2,7 +2,7 @@ CUR_DIR := $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST)))) all: radamsa-mutator.so -# These can be overriden: +# These can be overridden: CFLAGS ?= $(CFLAGS_FLTO) # These are required: (otherwise radamsa gets very very slooooow) diff --git a/custom_mutators/radamsa/README.md b/custom_mutators/radamsa/README.md index 81264b82..d6de356e 100644 --- a/custom_mutators/radamsa/README.md +++ b/custom_mutators/radamsa/README.md @@ -1,4 +1,4 @@ -# custum mutator: libradamsa +# custom mutator: libradamsa Pretranslated radamsa library. This code belongs to the radamsa author. diff --git a/custom_mutators/symcc/README.md b/custom_mutators/symcc/README.md index a6839a37..11767d28 100644 --- a/custom_mutators/symcc/README.md +++ b/custom_mutators/symcc/README.md @@ -1,4 +1,4 @@ -# custum mutator: symcc +# custom mutator: symcc This uses the symcc to find new paths into the target. diff --git a/custom_mutators/symqemu/README.md b/custom_mutators/symqemu/README.md index c3071afc..9e29fd96 100644 --- a/custom_mutators/symqemu/README.md +++ b/custom_mutators/symqemu/README.md @@ -1,4 +1,4 @@ -# custum mutator: symqemu +# custom mutator: symqemu This uses the symcc to find new paths into the target. diff --git a/docs/FAQ.md b/docs/FAQ.md index 242a379b..ca857a5b 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -106,7 +106,7 @@ If you find an interesting or important question missing, submit it via
Should you ever stop afl-fuzz, minimize the corpus and restart?

- To stop afl-fuzz, minimize it's corpus and restart you would usually do: + To stop afl-fuzz, minimize its corpus and restart you would usually do: ``` Control-C # to terminate afl-fuzz @@ -274,7 +274,7 @@ If you find an interesting or important question missing, submit it via the existing map will be used also for the newly loaded libraries, which allows it to work, however, the efficiency of the fuzzing will be partially degraded. Note that there is additionally `AFL_IGNORE_PROBLEMS_COVERAGE` to - additionally tell AFL++ to ignore any coverage from the late loaded libaries. + additionally tell AFL++ to ignore any coverage from the late loaded libraries.

diff --git a/docs/SAND.md b/docs/SAND.md index 38f88084..b9d6647f 100644 --- a/docs/SAND.md +++ b/docs/SAND.md @@ -7,7 +7,7 @@ ## Motivation -SAND introduces a new fuzzing workflow that can greatly reduce (or even eliminate) sanitizer overhead and combine different sanitizers in one fuzzing compaign. +SAND introduces a new fuzzing workflow that can greatly reduce (or even eliminate) sanitizer overhead and combine different sanitizers in one fuzzing campaign. The key point of SAND is that: sanitizing all inputs is wasting fuzzing power, because bug-triggering inputs are extremely rare (~1%). Obviously, not all inputs worth going through sanitizers. Therefore, if we can somehow "predict" if an input could trigger bugs (defined as "execution pattern"), we could greatly save fuzzing power by only sanitizing a small proportion of all inputs. That's exactly how SAND works. diff --git a/docs/afl-fuzz_approach.md b/docs/afl-fuzz_approach.md index 9ea06325..4ebce154 100644 --- a/docs/afl-fuzz_approach.md +++ b/docs/afl-fuzz_approach.md @@ -6,7 +6,7 @@ coverage to effortlessly pick up subtle, local-scale changes to program control flow. Note: If you are interested in a more current up-to-date deep dive how AFL++ -works then we commend this blog post: +works then we recommend this blog post: [https://blog.ritsec.club/posts/afl-under-hood/](https://blog.ritsec.club/posts/afl-under-hood/) Simplifying a bit, the overall algorithm can be summed up as: diff --git a/docs/custom_mutators.md b/docs/custom_mutators.md index 3067ceab..2548d659 100644 --- a/docs/custom_mutators.md +++ b/docs/custom_mutators.md @@ -151,7 +151,7 @@ def deinit(): # optional for Python splicing - or anything else - and can also be ignored. If you are not using this additional data then define `splice_optout` (see above). This function is optional. - Returing a length of 0 is valid and is interpreted as skipping this + Returning a length of 0 is valid and is interpreted as skipping this one mutation result. For non-Python: the returned output buffer is under **your** memory management! diff --git a/docs/env_variables.md b/docs/env_variables.md index 5246b63f..727feb16 100644 --- a/docs/env_variables.md +++ b/docs/env_variables.md @@ -247,7 +247,7 @@ used if several separated instrumentations are performed which are then later combined. - `AFL_LLVM_LTO_CALLER` activates collision free CALLER instrumentation - - `AFL_LLVM_LTO_CALLER` sets the maximum mumber of single block functions + - `AFL_LLVM_LTO_CALLER` sets the maximum number of single block functions to dig deeper into a real function. Default 0. - `AFL_LLVM_DOCUMENT_IDS=file` will document to a file which edge ID was given to which function. This helps to identify functions with variable bytes or diff --git a/docs/fuzzing_binary-only_targets.md b/docs/fuzzing_binary-only_targets.md index 2f64958d..0441a3e3 100644 --- a/docs/fuzzing_binary-only_targets.md +++ b/docs/fuzzing_binary-only_targets.md @@ -196,7 +196,7 @@ afl-clang-fast's. RetroWrite is a static binary rewriter that can be combined with AFL++. If you have an x86_64 or arm64 binary that does not contain C++ exceptions and - if -x86_64 - still has it's symbols and compiled with position independent code +x86_64 - still has its symbols and compiled with position independent code (PIC/PIE), then the RetroWrite solution might be for you. It decompiles to ASM files which can then be instrumented with afl-gcc. Note that afl-gcc is only present until AFL++ v4.21c and was subsequently removed as it is obsolete. diff --git a/frida_mode/DEBUGGING.md b/frida_mode/DEBUGGING.md index 207a48bf..ddd08b04 100644 --- a/frida_mode/DEBUGGING.md +++ b/frida_mode/DEBUGGING.md @@ -39,7 +39,7 @@ is *VERY* important to carry out these basic steps first before taking on the additional complexity of debugging with FRIDA mode or `afl-fuzz`. - Run your harness outside of the fuzzer, passing it a representative seed as - it's input `./harness `. + its input `./harness `. - Pass your harness multiple seeds to check that it is stable when running multiple tests as it will when running in fork server mode `./harness `. diff --git a/frida_mode/MapDensity.md b/frida_mode/MapDensity.md index 50f2720f..b4a4063b 100644 --- a/frida_mode/MapDensity.md +++ b/frida_mode/MapDensity.md @@ -107,7 +107,7 @@ every block of code we execute, performance is critical. However, the design of the binary instrumentation modes of AFL++ has moved on. Both QEMU and FRIDA modes use a two stage process when executing a target application. Each block is first compiled or instrumented, and then it is -executed. The compiled blocks can be re-used each time the target executes them. +executed. The compiled blocks can be reused each time the target executes them. Since a blocks ID is based on its address, and this is known at compile time, we only need to generate this ID once per block and so this ID generation no longer diff --git a/frida_mode/README.md b/frida_mode/README.md index bfca443c..22f14bbd 100644 --- a/frida_mode/README.md +++ b/frida_mode/README.md @@ -200,10 +200,10 @@ instrumented address block translations. * `AFL_FRIDA_INST_NO_SUPPRESS` - Disable deterministic branch suppression. Deterministic branch suppression skips the preamble which generates coverage information at the start of each block, if the block is reached by a - deterministic branch. This reduces map polution, and may improve performance + deterministic branch. This reduces map pollution, and may improve performance when all the executing blocks have been prefetched and backpatching applied. However, in the event that backpatching is incomplete, this may incur a - performance penatly as branch instructions are disassembled on each branch. + performance penalty as branch instructions are disassembled on each branch. * `AFL_FRIDA_INST_SEED` - Sets the initial seed for the hash function used to generate block (and hence edge) IDs. Setting this to a constant value may be useful for debugging purposes, e.g., investigating unstable edges. @@ -215,7 +215,7 @@ instrumented address block translations. coverage information for unstable edges (e.g., to be loaded within IDA lighthouse). * `AFL_FRIDA_JS_SCRIPT` - Set the script to be loaded by the FRIDA scripting - engine. See [Scipting.md](Scripting.md) for details. + engine. See [Scripting.md](Scripting.md) for details. * `AFL_FRIDA_OUTPUT_STDOUT` - Redirect the standard output of the target application to the named file (supersedes the setting of `AFL_DEBUG_CHILD`). * `AFL_FRIDA_OUTPUT_STDERR` - Redirect the standard error of the target diff --git a/frida_mode/Scripting.md b/frida_mode/Scripting.md index 653687f0..2042ff0c 100644 --- a/frida_mode/Scripting.md +++ b/frida_mode/Scripting.md @@ -724,16 +724,16 @@ class Afl { * it takes as arguments a `NativePointer` and a `number`. It can be * called multiple times to exclude several ranges. */ - static addExcludedRange(addressess, size) { - Afl.jsApiAddExcludeRange(addressess, size); + static addExcludedRange(addresses, size) { + Afl.jsApiAddExcludeRange(addresses, size); } /** * This is equivalent to setting a value in `AFL_FRIDA_INST_RANGES`, * it takes as arguments a `NativePointer` and a `number`. It can be * called multiple times to include several ranges. */ - static addIncludedRange(addressess, size) { - Afl.jsApiAddIncludeRange(addressess, size); + static addIncludedRange(addresses, size) { + Afl.jsApiAddIncludeRange(addresses, size); } /** * This must always be called at the end of your script. This lets @@ -771,7 +771,7 @@ class Afl { } /** * Print a message to the STDOUT. This should be preferred to - * FRIDA's `console.log` since FRIDA will queue it's log messages. + * FRIDA's `console.log` since FRIDA will queue its log messages. * If `console.log` is used in a callback in particular, then there * may no longer be a thread running to service this queue. */ @@ -893,14 +893,14 @@ class Afl { } /** * This is equivalent to setting `AFL_FRIDA_PERSISTENT_ADDR`, again a - * `NativePointer` should be provided as it's argument. + * `NativePointer` should be provided as its argument. */ static setPersistentAddress(address) { Afl.jsApiSetPersistentAddress(address); } /** * This is equivalent to setting `AFL_FRIDA_PERSISTENT_CNT`, a - * `number` should be provided as it's argument. + * `number` should be provided as its argument. */ static setPersistentCount(count) { Afl.jsApiSetPersistentCount(count); @@ -920,7 +920,7 @@ class Afl { } /** * This is equivalent to setting `AFL_FRIDA_PERSISTENT_RET`, again a - * `NativePointer` should be provided as it's argument. + * `NativePointer` should be provided as its argument. */ static setPersistentReturn(address) { Afl.jsApiSetPersistentReturn(address); diff --git a/frida_mode/many-linux/README.md b/frida_mode/many-linux/README.md index 4bd7a6c1..80717fae 100644 --- a/frida_mode/many-linux/README.md +++ b/frida_mode/many-linux/README.md @@ -4,6 +4,6 @@ This folder contains a Docker image to allow the building of `afl-frida-trace.so` using the `many-linux` docker image. This docker image is based on CentOS Linux 5. By building `afl-frida-trace.so` for such an old version of Linux, given the strong backward compatibility of Linux, this should -work on the majority of Linux environments. This may be useful for targetting +work on the majority of Linux environments. This may be useful for targeting Linux distributions other than your development environment. `many-local` builds `AFLplusplus` from the local working copy in the `many-linux` environment. diff --git a/frida_mode/src/cmplog/cmplog.c b/frida_mode/src/cmplog/cmplog.c index b752ac20..1b34c75e 100644 --- a/frida_mode/src/cmplog/cmplog.c +++ b/frida_mode/src/cmplog/cmplog.c @@ -166,7 +166,7 @@ gboolean cmplog_is_readable(guint64 addr, size_t size) { */ if (addr < DEFAULT_MMAP_MIN_ADDR) { return false; } - /* Check our addres/length don't wrap around */ + /* Check our address/length don't wrap around */ if (SIZE_MAX - addr < size) { return false; } GumAddress inner_base = addr; diff --git a/frida_mode/src/instrument/instrument.c b/frida_mode/src/instrument/instrument.c index d30e21ec..037521a9 100644 --- a/frida_mode/src/instrument/instrument.c +++ b/frida_mode/src/instrument/instrument.c @@ -186,7 +186,7 @@ static void instrument_basic_block(GumStalkerIterator *iterator, * execution), we instead ensure that we honour the additional * instrumentation requested (e.g. coverage, asan and complog) when a block * is compiled no matter where we are during initialization. We will end up - * re-using these blocks if the code under test calls a block which is also + * reusing these blocks if the code under test calls a block which is also * used during initialization. * * Coverage data generated during initialization isn't a problem since the diff --git a/frida_mode/src/instrument/instrument_arm64.c b/frida_mode/src/instrument/instrument_arm64.c index 1147275f..c756b140 100644 --- a/frida_mode/src/instrument/instrument_arm64.c +++ b/frida_mode/src/instrument/instrument_arm64.c @@ -285,7 +285,7 @@ static void instrument_coverage_switch(GumStalkerObserver *self, /* * If the branch is deterministic, then we should start execution at the - * begining of the block. From here, we will branch and skip the coverage + * beginning of the block. From here, we will branch and skip the coverage * code and jump right to the target code of the instrumented block. * Otherwise, if the branch is non-deterministic, then we need to branch * part way into the block to where the coverage instrumentation starts. @@ -516,7 +516,7 @@ void instrument_coverage_optimize(const cs_insn *instr, * an instruction to load x16,x17 from beyond the red-zone on the stack. A * pair of registers are saved/restored because on AARCH64, the stack pointer * must be 16 byte aligned. This instruction is emitted into the block before - * the tranformer (from which we are called) is executed. If is is possible + * the transformer (from which we are called) is executed. If is is possible * for Stalker to make a direct branch (the target block is close enough), it * can forego pushing the registers and instead branch at an offset into the * block to skip this restoration prolog. diff --git a/frida_mode/src/js/api.js b/frida_mode/src/js/api.js index 9e2b15c5..9bd0afa5 100644 --- a/frida_mode/src/js/api.js +++ b/frida_mode/src/js/api.js @@ -5,16 +5,16 @@ class Afl { * it takes as arguments a `NativePointer` and a `number`. It can be * called multiple times to exclude several ranges. */ - static addExcludedRange(addressess, size) { - Afl.jsApiAddExcludeRange(addressess, size); + static addExcludedRange(addresses, size) { + Afl.jsApiAddExcludeRange(addresses, size); } /** * This is equivalent to setting a value in `AFL_FRIDA_INST_RANGES`, * it takes as arguments a `NativePointer` and a `number`. It can be * called multiple times to include several ranges. */ - static addIncludedRange(addressess, size) { - Afl.jsApiAddIncludeRange(addressess, size); + static addIncludedRange(addresses, size) { + Afl.jsApiAddIncludeRange(addresses, size); } /** * This must always be called at the end of your script. This lets @@ -52,7 +52,7 @@ class Afl { } /** * Print a message to the STDOUT. This should be preferred to - * FRIDA's `console.log` since FRIDA will queue it's log messages. + * FRIDA's `console.log` since FRIDA will queue its log messages. * If `console.log` is used in a callback in particular, then there * may no longer be a thread running to service this queue. */ @@ -205,14 +205,14 @@ class Afl { } /** * This is equivalent to setting `AFL_FRIDA_PERSISTENT_ADDR`, again a - * `NativePointer` should be provided as it's argument. + * `NativePointer` should be provided as its argument. */ static setPersistentAddress(address) { Afl.jsApiSetPersistentAddress(address); } /** * This is equivalent to setting `AFL_FRIDA_PERSISTENT_CNT`, a - * `number` should be provided as it's argument. + * `number` should be provided as its argument. */ static setPersistentCount(count) { Afl.jsApiSetPersistentCount(count); @@ -232,7 +232,7 @@ class Afl { } /** * This is equivalent to setting `AFL_FRIDA_PERSISTENT_RET`, again a - * `NativePointer` should be provided as it's argument. + * `NativePointer` should be provided as its argument. */ static setPersistentReturn(address) { Afl.jsApiSetPersistentReturn(address); diff --git a/frida_mode/src/ranges.c b/frida_mode/src/ranges.c index 714fd9be..1cb8ad29 100644 --- a/frida_mode/src/ranges.c +++ b/frida_mode/src/ranges.c @@ -37,7 +37,7 @@ static void convert_address_token(gchar *token, GumMemoryRange *range) { if (token_count != 2) { - FFATAL("Invalid range (should have two addresses seperated by a '-'): %s\n", + FFATAL("Invalid range (should have two addresses separated by a '-'): %s\n", token); } diff --git a/frida_mode/ts/lib/afl.ts b/frida_mode/ts/lib/afl.ts index 7d1fac6b..b8615069 100644 --- a/frida_mode/ts/lib/afl.ts +++ b/frida_mode/ts/lib/afl.ts @@ -11,8 +11,8 @@ class Afl { * it takes as arguments a `NativePointer` and a `number`. It can be * called multiple times to exclude several ranges. */ - public static addExcludedRange(addressess: NativePointer, size: number): void { - Afl.jsApiAddExcludeRange(addressess, size); + public static addExcludedRange(addresses: NativePointer, size: number): void { + Afl.jsApiAddExcludeRange(addresses, size); } /** @@ -20,8 +20,8 @@ class Afl { * it takes as arguments a `NativePointer` and a `number`. It can be * called multiple times to include several ranges. */ - public static addIncludedRange(addressess: NativePointer, size: number): void { - Afl.jsApiAddIncludeRange(addressess, size); + public static addIncludedRange(addresses: NativePointer, size: number): void { + Afl.jsApiAddIncludeRange(addresses, size); } /** @@ -66,7 +66,7 @@ class Afl { /** * Print a message to the STDOUT. This should be preferred to - * FRIDA's `console.log` since FRIDA will queue it's log messages. + * FRIDA's `console.log` since FRIDA will queue its log messages. * If `console.log` is used in a callback in particular, then there * may no longer be a thread running to service this queue. */ @@ -241,7 +241,7 @@ class Afl { /** * This is equivalent to setting `AFL_FRIDA_PERSISTENT_ADDR`, again a - * `NativePointer` should be provided as it's argument. + * `NativePointer` should be provided as its argument. */ public static setPersistentAddress(address: NativePointer): void { Afl.jsApiSetPersistentAddress(address); @@ -249,7 +249,7 @@ class Afl { /** * This is equivalent to setting `AFL_FRIDA_PERSISTENT_CNT`, a - * `number` should be provided as it's argument. + * `number` should be provided as its argument. */ public static setPersistentCount(count: number): void { Afl.jsApiSetPersistentCount(count); @@ -272,7 +272,7 @@ class Afl { /** * This is equivalent to setting `AFL_FRIDA_PERSISTENT_RET`, again a - * `NativePointer` should be provided as it's argument. + * `NativePointer` should be provided as its argument. */ public static setPersistentReturn(address: NativePointer): void { Afl.jsApiSetPersistentReturn(address); diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index dae2fc56..a96b4873 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -920,7 +920,7 @@ struct custom_mutator { /** * Opt-out of a splicing input for the fuzz mutator * - * Empty dummy function. It's presence tells afl-fuzz not to pass a + * Empty dummy function. Its presence tells afl-fuzz not to pass a * splice data pointer and len. * * @param data pointer returned in afl_custom_init by this custom mutator @@ -952,12 +952,12 @@ struct custom_mutator { /** * Describe the current testcase, generated by the last mutation. * This will be called, for example, to give the written testcase a name - * after a crash ocurred. It can help to reproduce crashing mutations. + * after a crash occurred. It can help to reproduce crashing mutations. * * (Optional) * * @param data pointer returned by afl_customm_init for this custom mutator - * @paramp[in] max_description_len maximum size avaliable for the description. + * @paramp[in] max_description_len maximum size available for the description. * A longer return string is legal, but will be truncated. * @return A valid ptr to a 0-terminated string. * An empty or NULL return will result in a default description @@ -1134,7 +1134,7 @@ struct custom_mutator { void afl_state_init(afl_state_t *, uint32_t map_size); void afl_state_deinit(afl_state_t *); -/* Set stop_soon flag on all childs, kill all childs */ +/* Set stop_soon flag on all children, kill all children */ void afl_states_stop(void); /* Set clear_screen flag on all states */ void afl_states_clear_screen(void); diff --git a/include/common.h b/include/common.h index a78dd60a..79f4a8b8 100644 --- a/include/common.h +++ b/include/common.h @@ -76,8 +76,8 @@ u8 *find_afl_binary(u8 *own_loc, u8 *fname); int parse_afl_kill_signal(u8 *numeric_signal_as_str, int default_signal); /* Configure the signals that are used to kill the forkserver - and the forked childs. If `afl_kill_signal_env` or `afl_fsrv_kill_signal_env` - is NULL, the appropiate values are read from the environment. */ + and the forked children. If `afl_kill_signal_env` or `afl_fsrv_kill_signal_env` + is NULL, the appropriate values are read from the environment. */ void configure_afl_kill_signals(afl_forkserver_t *fsrv, char *afl_kill_signal_env, char *afl_fsrv_kill_signal_env, diff --git a/include/config.h b/include/config.h index c43d984c..4ef78c6a 100644 --- a/include/config.h +++ b/include/config.h @@ -39,7 +39,7 @@ However if a target has problematic constructors and init arrays then this can fail. Hence afl-fuzz deploys a larger default map. The largest map seen so far is the xlsx fuzzer for libreoffice which is 5MB. - At runtime this value can be overriden via AFL_MAP_SIZE. + At runtime this value can be overridden via AFL_MAP_SIZE. Default: 8MB (defined in bytes) */ #define DEFAULT_SHMEM_SIZE (8 * 1024 * 1024) @@ -107,7 +107,7 @@ /* Now non-cmplog configuration options */ /* -------------------------------------*/ -/* If a persistent target keeps state and found crashes are not reproducable +/* If a persistent target keeps state and found crashes are not reproducible then enable this option and set the AFL_PERSISTENT_RECORD env variable to a number. These number of testcases prior and including the crash case will be kept and written to the crash/ directory as RECORD:... files. @@ -544,7 +544,7 @@ #define AFL_TXT_MAX_LEN 65535 -/* What is the minimum percentage of ascii characters present to be classifed +/* What is the minimum percentage of ascii characters present to be classified as "is_ascii"? */ #define AFL_TXT_MIN_PERCENT 99 diff --git a/include/t1ha.h b/include/t1ha.h index 1af29395..40e1f1d0 100644 --- a/include/t1ha.h +++ b/include/t1ha.h @@ -63,7 +63,7 @@ * // To enable unaligned access, but indicate that it significantly slow. * #define T1HA_SYS_UNALIGNED_ACCESS 1 * - * // To enable unaligned access, and indicate that it effecient. + * // To enable unaligned access, and indicate that it's efficient. * #define T1HA_SYS_UNALIGNED_ACCESS 2 * * @@ -512,7 +512,7 @@ T1HA_API uint64_t t1ha2_atonce128(uint64_t *__restrict extra_result, uint64_t seed); /* The init/update/final trinity for streaming. - * Return 64 or 128-bit result depentently from `extra_result` argument. */ + * Return 64 or 128-bit result dependently from `extra_result` argument. */ T1HA_API void t1ha2_init(t1ha_context_t *ctx, uint64_t seed_x, uint64_t seed_y); T1HA_API void t1ha2_update(t1ha_context_t *__restrict ctx, const void *__restrict data, size_t length); diff --git a/instrumentation/README.injections.md b/instrumentation/README.injections.md index 16cc3713..cbaa63e2 100644 --- a/instrumentation/README.injections.md +++ b/instrumentation/README.injections.md @@ -29,7 +29,7 @@ Alternatively you can set `AFL_LLVM_INJECTIONS_ALL` to enable all. ## How to modify -If you want to add more fuctions to check for e.g. SQL injections: +If you want to add more functions to check for e.g. SQL injections: Add these to `instrumentation/injection-pass.cc` and recompile. If you want to test for more injection inputs: diff --git a/instrumentation/README.persistent_mode.md b/instrumentation/README.persistent_mode.md index 41782b5b..1b438e42 100644 --- a/instrumentation/README.persistent_mode.md +++ b/instrumentation/README.persistent_mode.md @@ -8,7 +8,7 @@ most effective way to fuzz, as the speed can easily be x10 or x20 times faster without any disadvantages. *All professional fuzzing uses this mode.* Persistent mode requires that the target can be called in one or more functions, -and that it's state can be completely reset so that multiple calls can be +and that its state can be completely reset so that multiple calls can be performed without resource leaks, and that earlier runs will have no impact on future runs. An indicator for this is the `stability` value in the `afl-fuzz` UI. If this decreases to lower values in persistent mode compared to diff --git a/instrumentation/SanitizerCoverageLTO.so.cc b/instrumentation/SanitizerCoverageLTO.so.cc index 25eabcda..7f355b68 100644 --- a/instrumentation/SanitizerCoverageLTO.so.cc +++ b/instrumentation/SanitizerCoverageLTO.so.cc @@ -512,7 +512,7 @@ bool ModuleSanitizerCoverageLTO::instrumentModule( } // we make this the default as the fixed map has problems with - // defered forkserver, early constructors, ifuncs and maybe more + // deferred forkserver, early constructors, ifuncs and maybe more /*if (getenv("AFL_LLVM_MAP_DYNAMIC"))*/ map_addr = 0; diff --git a/instrumentation/SanitizerCoveragePCGUARD.so.cc b/instrumentation/SanitizerCoveragePCGUARD.so.cc index 1706ed4f..439d3626 100644 --- a/instrumentation/SanitizerCoveragePCGUARD.so.cc +++ b/instrumentation/SanitizerCoveragePCGUARD.so.cc @@ -338,7 +338,7 @@ Function *ModuleSanitizerCoverageAFL::CreateInitCallsForSections( if (TargetTriple.isOSBinFormatCOFF()) { - // In COFF files, if the contructors are set as COMDAT (they are because + // In COFF files, if the constructors are set as COMDAT (they are because // COFF supports COMDAT) and the linker flag /OPT:REF (strip unreferenced // functions and data) is used, the constructors get stripped. To prevent // this, give the constructors weak ODR linkage and ensure the linker knows diff --git a/instrumentation/afl-llvm-common.cc b/instrumentation/afl-llvm-common.cc index caafff3e..829763ca 100644 --- a/instrumentation/afl-llvm-common.cc +++ b/instrumentation/afl-llvm-common.cc @@ -157,7 +157,7 @@ bool isIgnoreFunction(const llvm::Function *F) { // mangled name of the user-written function for (auto const &ignoreListFunc : ignoreSubstringList) { - // hexcoder: F->getName().contains() not avaiilable in llvm 3.8.0 + // hexcoder: F->getName().contains() not available in llvm 3.8.0 if (StringRef::npos != F->getName().find(ignoreListFunc)) { return true; } } diff --git a/instrumentation/afl-llvm-pass.so.cc b/instrumentation/afl-llvm-pass.so.cc index 29146b70..4823f2d1 100644 --- a/instrumentation/afl-llvm-pass.so.cc +++ b/instrumentation/afl-llvm-pass.so.cc @@ -226,14 +226,14 @@ bool AFLCoverage::runOnModule(Module &M) { #if LLVM_VERSION_MAJOR >= 11 /* use new pass manager */ if (getenv("AFL_SAN_NO_INST")) { if (debug) { - fprintf(stderr, "Intrument disabled\n"); + fprintf(stderr, "Instrument disabled\n"); } return PreservedAnalyses::all(); } #else if (getenv("AFL_SAN_NO_INST")) { if (debug) { - fprintf(stderr, "Intrument disabled\n"); + fprintf(stderr, "Instrument disabled\n"); } return true; } diff --git a/instrumentation/split-compares-pass.so.cc b/instrumentation/split-compares-pass.so.cc index cc031073..186233bc 100644 --- a/instrumentation/split-compares-pass.so.cc +++ b/instrumentation/split-compares-pass.so.cc @@ -112,7 +112,7 @@ class SplitComparesTransform : public ModulePass { /// simplify a signed comparison (signed less or greater than) bool simplifySignedCompare(CmpInst *IcmpInst, Module &M, CmpWorklist &worklist); - /// splits an icmp into nested icmps recursivly until target_bitwidth is + /// splits an icmp into nested icmps recursively until target_bitwidth is /// reached bool splitCompare(CmpInst *I, Module &M, CmpWorklist &worklist); @@ -679,7 +679,7 @@ bool SplitComparesTransform::splitCompare(CmpInst *cmp_inst, Module &M, PHINode *PN = nullptr; - /* now we have to destinguish between == != and > < */ + /* now we have to distinguish between == != and > < */ switch (pred) { case CmpInst::ICMP_EQ: @@ -767,7 +767,7 @@ bool SplitComparesTransform::splitCompare(CmpInst *cmp_inst, Module &M, } else { - // Never gonna appen + // Never gonna happen if (!be_quiet) fprintf(stderr, "Error: split-compare: Equals or signed not removed: %d\n", @@ -1435,14 +1435,14 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) { case CmpInst::FCMP_UEQ: case CmpInst::FCMP_OEQ: - /* if the exponents are satifying the compare do a fraction cmp in + /* if the exponents are satisfying the compare do a fraction cmp in * middle_bb */ BranchInst::Create(middle_bb, end_bb, icmp_exponent_result, signequal2_bb); break; case CmpInst::FCMP_ONE: case CmpInst::FCMP_UNE: - /* if the exponents are satifying the compare do a fraction cmp in + /* if the exponents are satisfying the compare do a fraction cmp in * middle_bb */ BranchInst::Create(end_bb, middle_bb, icmp_exponent_result, signequal2_bb); diff --git a/nyx_mode/custom_harness/example.c b/nyx_mode/custom_harness/example.c index a67d42c6..e01bf363 100644 --- a/nyx_mode/custom_harness/example.c +++ b/nyx_mode/custom_harness/example.c @@ -17,14 +17,14 @@ int main(int argc, char **argv) { */ hprintf("Agent test\n"); - /* Request information on available (host) capabilites (optional) */ + /* Request information on available (host) capabilities (optional) */ host_config_t host_config; kAFL_hypercall(HYPERCALL_KAFL_GET_HOST_CONFIG, (uintptr_t)&host_config); - hprintf("[capablities] host_config.bitmap_size: 0x%" PRIx64 "\n", + hprintf("[capabilities] host_config.bitmap_size: 0x%" PRIx64 "\n", host_config.bitmap_size); - hprintf("[capablities] host_config.ijon_bitmap_size: 0x%" PRIx64 "\n", + hprintf("[capabilities] host_config.ijon_bitmap_size: 0x%" PRIx64 "\n", host_config.ijon_bitmap_size); - hprintf("[capablities] host_config.payload_buffer_size: 0x%" PRIx64 "x\n", + hprintf("[capabilities] host_config.payload_buffer_size: 0x%" PRIx64 "x\n", host_config.payload_buffer_size); /* this is our "bitmap" that is later shared with the fuzzer (you can also @@ -47,9 +47,9 @@ int main(int argc, char **argv) { */ agent_config.agent_tracing = 1; /* set this flag to propagade that instrumentation-based fuzzing is - availabe */ + available */ agent_config.agent_ijon_tracing = 0; /* set this flag to propagade that IJON - extension is implmented agent-wise */ + extension is implemented agent-wise */ agent_config.trace_buffer_vaddr = (uintptr_t)trace_buffer; /* trace "bitmap" pointer - required for instrumentation-only fuzzing */ @@ -106,8 +106,8 @@ int main(int argc, char **argv) { if (payload_buffer->data[3] == 'X') { ((uint8_t *)trace_buffer)[4] = 0x1; - /* Notifiy the hypervisor and the fuzzer that a "crash" has - * occured. Also a string is passed by this hypercall (this is + /* Notify the hypervisor and the fuzzer that a "crash" has + * occurred. Also a string is passed by this hypercall (this is * currently not supported by AFL++-Nyx) */ kAFL_hypercall(HYPERCALL_KAFL_PANIC_EXTENDED, (uintptr_t) "Something went wrong\n"); diff --git a/qemu_mode/hooking_bridge/README.md b/qemu_mode/hooking_bridge/README.md index 6bc9ba14..88fac29d 100644 --- a/qemu_mode/hooking_bridge/README.md +++ b/qemu_mode/hooking_bridge/README.md @@ -11,7 +11,7 @@ Run build_qemu_support.sh as you do to compile qemuafl, additionally with three * `ENABLE_HOOKING=1` to compile the bridge * `GLIB_H` and `GLIB_CONFIG_H` point to headers `glib.h` and `glibconfig.h` to wherever they are installed on your system -## Writting hooks +## Writing hooks 1. Create one or more hooking functions in a shared library, say `hook.so`. 2. Include `exports.h` in your hook build. You can find this header at `/qemu_mode/hooking_bridge/inc`. 3. Shown below is an example which will use to walkthrough hook creation diff --git a/qemu_mode/libcompcov/pmparser.h b/qemu_mode/libcompcov/pmparser.h index db8efa30..376b8091 100644 --- a/qemu_mode/libcompcov/pmparser.h +++ b/qemu_mode/libcompcov/pmparser.h @@ -101,7 +101,7 @@ void _pmparser_split_line(char *buf, char *addr1, char *addr2, char *perm, void pmparser_print(procmaps_struct *map, int order); /** - * gobal variables + * global variables */ // procmaps_struct *g_last_head=NULL; // procmaps_struct *g_current=NULL; diff --git a/qemu_mode/libqasan/patch.c b/qemu_mode/libqasan/patch.c index 4ce8c3d8..356bd2ab 100644 --- a/qemu_mode/libqasan/patch.c +++ b/qemu_mode/libqasan/patch.c @@ -175,7 +175,7 @@ static void find_libc(void) { } /* Why this shit? https://twitter.com/andreafioraldi/status/1227635146452541441 - Unfortunatly, symbol override with LD_PRELOAD is not enough to prevent libc + Unfortunately, symbol override with LD_PRELOAD is not enough to prevent libc code to call this optimized XMM-based routines. We patch them at runtime to call our unoptimized version of the same routine. */ diff --git a/src/afl-analyze.c b/src/afl-analyze.c index 2ff8a1e1..4cfeb487 100644 --- a/src/afl-analyze.c +++ b/src/afl-analyze.c @@ -974,7 +974,7 @@ int main(int argc, char **argv_orig, char **envp) { break; - case 'Y': // fallthough + case 'Y': // fallthrough #ifdef __linux__ case 'X': /* NYX mode */ @@ -987,7 +987,7 @@ int main(int argc, char **argv_orig, char **envp) { break; #else case 'X': - FATAL("Nyx mode is only availabe on linux..."); + FATAL("Nyx mode is only available on linux..."); break; #endif diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c index 8ea58b39..d46ab160 100644 --- a/src/afl-forkserver.c +++ b/src/afl-forkserver.c @@ -438,7 +438,7 @@ static void afl_fauxsrv_execv(afl_forkserver_t *fsrv, char **argv) { } - // enable terminating on sigpipe in the childs + // enable terminating on sigpipe in the children struct sigaction sa; memset((char *)&sa, 0, sizeof(sa)); sa.sa_handler = SIG_DFL; @@ -878,7 +878,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv, /* CHILD PROCESS */ - // enable terminating on sigpipe in the childs + // enable terminating on sigpipe in the children struct sigaction sa; memset((char *)&sa, 0, sizeof(sa)); sa.sa_handler = SIG_DFL; diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c index 2f6af4bc..dbc23ac6 100644 --- a/src/afl-fuzz-mutators.c +++ b/src/afl-fuzz-mutators.c @@ -155,7 +155,7 @@ void destroy_custom_mutators(afl_state_t *afl) { LIST_FOREACH_CLEAR(&afl->custom_mutator_list, struct custom_mutator, { - if (!el->data) { FATAL("Deintializing NULL mutator"); } + if (!el->data) { FATAL("Deinitializing NULL mutator"); } if (el->afl_custom_deinit) el->afl_custom_deinit(el->data); if (el->dh) dlclose(el->dh); diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c index fd5ed87c..36127964 100644 --- a/src/afl-fuzz-one.c +++ b/src/afl-fuzz-one.c @@ -6185,7 +6185,7 @@ u8 fuzz_one(afl_state_t *afl) { #endif /* - -L command line paramter => limit_time_sig value + -L command line parameter => limit_time_sig value limit_time_sig == 0 then run the default mutator limit_time_sig > 0 then run MOpt limit_time_sig < 0 both are run diff --git a/src/afl-fuzz-python.c b/src/afl-fuzz-python.c index 59af01c8..8436efc0 100644 --- a/src/afl-fuzz-python.c +++ b/src/afl-fuzz-python.c @@ -68,7 +68,7 @@ static void *unsupported(afl_state_t *afl, unsigned int seed) { } - /* sorry for this makro... + /* sorry for this macro... it just fills in `&py_mutator->something_buf, &py_mutator->something_size`. */ #define BUF_PARAMS(name) (void **)&((py_mutator_t *)py_mutator)->name##_buf diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c index 8db89775..4d68c4c4 100644 --- a/src/afl-fuzz-queue.c +++ b/src/afl-fuzz-queue.c @@ -1468,7 +1468,7 @@ inline u8 *queue_testcase_get(afl_state_t *afl, struct queue_entry *q) { } - /* Cache full. We neet to evict one or more to map one. + /* Cache full. We need to evict one or more to map one. Get a random one which is not in use */ do { diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c index 954e5671..5703ebd1 100644 --- a/src/afl-fuzz-redqueen.c +++ b/src/afl-fuzz-redqueen.c @@ -35,12 +35,12 @@ // CMP attribute enum enum { - IS_EQUAL = 1, // arithemtic equal comparison + IS_EQUAL = 1, // arithmetic equal comparison IS_GREATER = 2, // arithmetic greater comparison IS_LESSER = 4, // arithmetic lesser comparison IS_FP = 8, // is a floating point, not an integer /* --- below are internal settings, not from target cmplog */ - IS_FP_MOD = 16, // arithemtic changed floating point + IS_FP_MOD = 16, // arithmetic changed floating point IS_INT_MOD = 32, // arithmetic changed integer IS_TRANSFORM = 64 // transformed integer @@ -68,7 +68,7 @@ enum { LVL1 = 1, // Integer solving LVL2 = 2, // unused except for setting the queue entry - LVL3 = 4 // expensive tranformations + LVL3 = 4 // expensive transformations }; @@ -203,7 +203,7 @@ static void type_replace(afl_state_t *afl, u8 *buf, u32 len) { u8 c; for (i = 0; i < len; ++i) { - // wont help for UTF or non-latin charsets + // won't help for UTF or non-latin charsets do { switch (buf[i]) { @@ -1437,7 +1437,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h, // here we add and subtract 1 from the value, but only if it is not an // == or != comparison // Bits: 1 = Equal, 2 = Greater, 4 = Lesser, 8 = Float - // 16 = modified float, 32 = modified integer (modified = wont match + // 16 = modified float, 32 = modified integer (modified = won't match // in original buffer) if (!afl->cmplog_enable_arith || lvl < LVL3 || attr == IS_TRANSFORM) { diff --git a/src/afl-fuzz-sanfuzz.c b/src/afl-fuzz-sanfuzz.c index 87879138..d9a36ad8 100644 --- a/src/afl-fuzz-sanfuzz.c +++ b/src/afl-fuzz-sanfuzz.c @@ -24,7 +24,7 @@ */ -/* This file roughly folows afl-fuzz-asanfuzz */ +/* This file roughly follows afl-fuzz-asanfuzz */ #include diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c index 126425b8..11554369 100644 --- a/src/afl-fuzz-state.c +++ b/src/afl-fuzz-state.c @@ -764,7 +764,7 @@ void afl_state_deinit(afl_state_t *afl) { void afl_states_stop(void) { /* We may be inside a signal handler. - Set flags first, send kill signals to child proceses later. */ + Set flags first, send kill signals to child processes later. */ LIST_FOREACH(&afl_states, afl_state_t, { el->stop_soon = 1; diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index 3a43373f..20da0434 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -2129,13 +2129,13 @@ void show_stats_pizza(afl_state_t *afl) { } else { - strcpy(tmp, "18 year aniversary mode"); + strcpy(tmp, "18 year anniversary mode"); } SAYF(bV bSTOP " dictionary : " cRST "%-36s " bSTG bV bSTOP - " patrons from old resturant : " cRST "%-10s " bSTG bV + " patrons from old restaurant : " cRST "%-10s " bSTG bV "\n", tmp, afl->sync_id ? u_stringify_int(IB(0), afl->queued_imported) diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 39f13d6d..2830ace2 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -402,7 +402,7 @@ static void usage(u8 *argv0, int more_help) { "AFL_STATSD_HOST: change default statsd host (default 127.0.0.1)\n" "AFL_STATSD_PORT: change default statsd port (default: 8125)\n" "AFL_STATSD_TAGS_FLAVOR: set statsd tags format (default: disable tags)\n" - " suported formats: dogstatsd, librato, signalfx, influxdb\n" + " supported formats: dogstatsd, librato, signalfx, influxdb\n" "AFL_NO_FASTRESUME: do not read or write a fast resume file\n" "AFL_NO_SYNC: disables all syncing\n" "AFL_SYNC_TIME: sync time between fuzzing instances (in minutes)\n" @@ -1170,7 +1170,7 @@ int main(int argc, char **argv_orig, char **envp) { #else case 'X': case 'Y': - FATAL("Nyx mode is only availabe on linux..."); + FATAL("Nyx mode is only available on linux..."); break; #endif case 'A': /* CoreSight mode */ @@ -2329,7 +2329,7 @@ int main(int argc, char **argv_orig, char **envp) { if (NZLIBREAD(fr_fd, ver_string, sizeof(ver_string)) != sizeof(ver_string)) - WARNF("Emtpy fastresume.bin, ignoring, cannot perform FAST RESUME"); + WARNF("Empty fastresume.bin, ignoring, cannot perform FAST RESUME"); else if (expect_ver != *ver) WARNF( "Different AFL++ version or feature usage, cannot perform FAST " @@ -2603,7 +2603,7 @@ int main(int argc, char **argv_orig, char **envp) { } else { - WARNF("Unkown abstraction: %s, fallback to unique trace.\n", + WARNF("Unknown abstraction: %s, fallback to unique trace.\n", san_abstraction); afl->san_abstraction = SIMPLIFY_TRACE; @@ -3583,7 +3583,7 @@ stop_fuzzing: ZLIBCLOSE(fr_fd); afl->var_byte_count = count_bytes(afl, afl->var_bytes); - OKF("fastresume.bin succesfully written with %u bytes.", w); + OKF("fastresume.bin successfully written with %u bytes.", w); } else { diff --git a/src/afl-gotcpu.c b/src/afl-gotcpu.c index 6a3bd037..f86aa802 100644 --- a/src/afl-gotcpu.c +++ b/src/afl-gotcpu.c @@ -214,7 +214,7 @@ int main(int argc, char **argv) { #if defined(__linux__) if (sched_setaffinity(0, sizeof(c), &c)) { - const char *error_code = "Unkown error code"; + const char *error_code = "Unknown error code"; if (errno == EFAULT) error_code = "EFAULT"; if (errno == EINVAL) error_code = "EINVAL"; if (errno == EPERM) error_code = "EPERM"; diff --git a/src/afl-showmap.c b/src/afl-showmap.c index 97eb303e..881ca2a6 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -1259,7 +1259,7 @@ int main(int argc, char **argv_orig, char **envp) { break; - /* FIXME: We want to use -P for consistency, but it is already unsed for + /* FIXME: We want to use -P for consistency, but it is already unused for * undocumenetd feature "Another afl-cmin specific feature." */ case 'A': /* CoreSight mode */ @@ -1307,7 +1307,7 @@ int main(int argc, char **argv_orig, char **envp) { break; #else case 'X': - FATAL("Nyx mode is only availabe on linux..."); + FATAL("Nyx mode is only available on linux..."); break; #endif @@ -1684,7 +1684,7 @@ int main(int argc, char **argv_orig, char **envp) { } else { if ((coverage_map = (u8 *)malloc(map_size + 64)) == NULL) - FATAL("coult not grab memory"); + FATAL("could not grab memory"); edges_only = false; } diff --git a/src/afl-tmin.c b/src/afl-tmin.c index da924d6b..4e3319b5 100644 --- a/src/afl-tmin.c +++ b/src/afl-tmin.c @@ -1014,7 +1014,7 @@ int main(int argc, char **argv_orig, char **envp) { break; - case 'Y': // fallthough + case 'Y': // fallthrough #ifdef __linux__ case 'X': /* NYX mode */ @@ -1027,7 +1027,7 @@ int main(int argc, char **argv_orig, char **envp) { break; #else case 'X': - FATAL("Nyx mode is only availabe on linux..."); + FATAL("Nyx mode is only available on linux..."); break; #endif @@ -1035,7 +1035,7 @@ int main(int argc, char **argv_orig, char **envp) { /* Minimizes a testcase to the minimum that still times out */ - if (hang_mode) { FATAL("Multipe -H options not supported"); } + if (hang_mode) { FATAL("Multiple -H options not supported"); } if (edges_only) { FATAL("Edges only and hang mode are mutually exclusive."); diff --git a/test/checkcommit.sh b/test/checkcommit.sh index 35eae540..eef3b88b 100755 --- a/test/checkcommit.sh +++ b/test/checkcommit.sh @@ -6,7 +6,7 @@ test -z "$1" -o -n "$4" && { echo "Syntax: $0 commit-id \"\"" echo echo "Switches to the defined commit ID, compiles with profiling and runs" - echo "afl-fuzz on a defind target and input directory, saving timing," + echo "afl-fuzz on a defined target and input directory, saving timing," echo "fuzzer_stats and profiling output to \".out\"" echo "Honors CFLAGS and LDFLAGS" echo diff --git a/unicorn_mode/helper_scripts/ida_context_loader.py b/unicorn_mode/helper_scripts/ida_context_loader.py index d7984c77..96c6cc0b 100644 --- a/unicorn_mode/helper_scripts/ida_context_loader.py +++ b/unicorn_mode/helper_scripts/ida_context_loader.py @@ -63,7 +63,7 @@ def parse_mapping_index(filepath: str): def get_input_name(): """Get the name of the input file - :retrun: Name of the input file + :return: Name of the input file """ input_filepath = ida_nalt.get_input_file_path() diff --git a/unicorn_mode/helper_scripts/unicorn_dumper_gdb.py b/unicorn_mode/helper_scripts/unicorn_dumper_gdb.py index a202ac0e..c7ad4f2f 100644 --- a/unicorn_mode/helper_scripts/unicorn_dumper_gdb.py +++ b/unicorn_mode/helper_scripts/unicorn_dumper_gdb.py @@ -171,7 +171,7 @@ def dump_process_memory(output_dir): # --------------------------------------------- -# ---- ARM Extention (dump floating point regs) +# ---- ARM Extension (dump floating point regs) def dump_float(rge=32): diff --git a/unicorn_mode/helper_scripts/unicorn_dumper_pwndbg.py b/unicorn_mode/helper_scripts/unicorn_dumper_pwndbg.py index 76eaf54f..142ac70f 100644 --- a/unicorn_mode/helper_scripts/unicorn_dumper_pwndbg.py +++ b/unicorn_mode/helper_scripts/unicorn_dumper_pwndbg.py @@ -75,7 +75,7 @@ def map_arch(): return "arm64be" elif "arm" in arch: cpsr = pwndbg.gdblib.regs["cpsr"] - # check endianess + # check endianness if pwndbg.gdblib.arch.endian == "big": # check for THUMB mode if cpsr & (1 << 5): diff --git a/unicorn_mode/helper_scripts/unicorn_loader.py b/unicorn_mode/helper_scripts/unicorn_loader.py index 4219c6ab..fc8dd45f 100644 --- a/unicorn_mode/helper_scripts/unicorn_loader.py +++ b/unicorn_mode/helper_scripts/unicorn_loader.py @@ -26,7 +26,7 @@ from unicorn.arm64_const import * from unicorn.x86_const import * from unicorn.mips_const import * -# If Capstone libraries are availible (only check once) +# If Capstone libraries are available (only check once) try: from capstone import * diff --git a/unicorn_mode/samples/c/harness.c b/unicorn_mode/samples/c/harness.c index 30972ce7..e618d9b8 100644 --- a/unicorn_mode/samples/c/harness.c +++ b/unicorn_mode/samples/c/harness.c @@ -42,7 +42,7 @@ static const int64_t STACK_ADDRESS = (((int64_t) 0x01) << 58); static const int64_t STACK_SIZE = 0x10000; // Location where the input will be placed (make sure the emulated program knows this somehow, too ;) ) static const int64_t INPUT_LOCATION = 0x10000; -// Inside the location, we have an ofset in our special case +// Inside the location, we have an offset in our special case static const int64_t INPUT_OFFSET = 0x16; // Maximum allowable size of mutated data from AFL static const int64_t INPUT_SIZE_MAX = 0x10000; @@ -65,7 +65,7 @@ static void hook_code(uc_engine *uc, uint64_t address, uint32_t size, void *user /* The sample uses strlen, since we don't have a loader or libc, we'll fake it. -We know the strlen will return the lenght of argv[1] that we just planted. +We know the strlen will return the length of argv[1] that we just planted. It will be a lot faster than an actual strlen for this specific purpose. */ static void hook_strlen(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) { @@ -247,7 +247,7 @@ int main(int argc, char **argv, char **envp) { place_input_callback, // Callback that places the input (automatically loaded from the file at filename) in the unicorninstance &end_address, // Where to exit (this is an array) 1, // Count of end addresses - NULL, // Optional calback to run after each exec + NULL, // Optional callback to run after each exec false, // true, if the optional callback should be run also for non-crashes 1, // For persistent mode: How many rounds to run NULL // additional data pointer diff --git a/unicorn_mode/samples/persistent/harness.c b/unicorn_mode/samples/persistent/harness.c index 37b652e0..85634a78 100644 --- a/unicorn_mode/samples/persistent/harness.c +++ b/unicorn_mode/samples/persistent/harness.c @@ -12,7 +12,7 @@ $ make $ ../../../afl-fuzz -m none -i sample_inputs -o out -- ./harness @@ - (Re)run a simgle input with block tracing using: + (Re)run a single input with block tracing using: $ ./harness -t [inputfile] */ @@ -46,7 +46,7 @@ static const int64_t STACK_ADDRESS = (((int64_t) 0x01) << 58); static const int64_t STACK_SIZE = 0x10000; // Location where the input will be placed (make sure the emulated program knows this somehow, too ;) ) static const int64_t INPUT_LOCATION = 0x10000; -// Inside the location, we have an ofset in our special case +// Inside the location, we have an offset in our special case static const int64_t INPUT_OFFSET = 0x16; // Maximum allowable size of mutated data from AFL static const int64_t INPUT_SIZE_MAX = 0x10000; @@ -233,7 +233,7 @@ int main(int argc, char **argv, char **envp) { // build a "dummy" argv with length 2 at 0x10000: // 0x10000 argv[0] NULL // 0x10008 argv[1] (char *)0x10016 --. points to the next offset. - // 0x10016 argv[1][0], ... <-^ contains the acutal input data. (INPUT_LOCATION + INPUT_OFFSET) + // 0x10016 argv[1][0], ... <-^ contains the actual input data. (INPUT_LOCATION + INPUT_OFFSET) uc_mem_write(uc, 0x10008, "\x16\x00\x01", 3); // little endian of 0x10016, see above @@ -260,7 +260,7 @@ int main(int argc, char **argv, char **envp) { place_input_callback, // Callback that places the input (automatically loaded from the file at filename) in the unicorninstance &end_address, // Where to exit (this is an array) 1, // Count of end addresses - NULL, // Optional calback to run after each exec + NULL, // Optional callback to run after each exec false, // true, if the optional callback should be run also for non-crashes 1000, // For persistent mode: How many rounds to run NULL // additional data pointer diff --git a/unicorn_mode/samples/speedtest/c/harness.c b/unicorn_mode/samples/speedtest/c/harness.c index 184934b9..66825370 100644 --- a/unicorn_mode/samples/speedtest/c/harness.c +++ b/unicorn_mode/samples/speedtest/c/harness.c @@ -308,7 +308,7 @@ int main(int argc, char **argv, char **envp) { } uint64_t start_address; if(fscanf(f, "%llx", (unsigned long long) &start_address) == EOF) { - puts("Start address not found in target.offests.main"); + puts("Start address not found in target.offsets.main"); exit(-1); } fclose(f); @@ -371,7 +371,7 @@ int main(int argc, char **argv, char **envp) { place_input_callback, // Callback that places the input (automatically loaded from the file at filename) in the unicorninstance exits, // Where to exit (this is an array) exit_count, // Count of end addresses - NULL, // Optional calback to run after each exec + NULL, // Optional callback to run after each exec false, // true, if the optional callback should be run also for non-crashes 1000, // For persistent mode: How many rounds to run NULL // additional data pointer diff --git a/unicorn_mode/samples/speedtest/get_offsets.py b/unicorn_mode/samples/speedtest/get_offsets.py index 72fb6293..08a1247d 100755 --- a/unicorn_mode/samples/speedtest/get_offsets.py +++ b/unicorn_mode/samples/speedtest/get_offsets.py @@ -43,7 +43,7 @@ for line in objdump_output.split("\n"): if "
:" in line: if main_loc is not None: raise Exception("Found multiple main functions, odd target!") - # main_loc is the label, so it's parsed differntly (i.e. `0000000000001220
:`) + # main_loc is the label, so it's parsed differently (i.e. `0000000000001220
:`) main_loc = "0x" + line.strip().split(" ", 1)[0].strip() else: [ diff --git a/utils/autodict_ql/memcmp-strings.py b/utils/autodict_ql/memcmp-strings.py index 270a697c..0b8293ef 100644 --- a/utils/autodict_ql/memcmp-strings.py +++ b/utils/autodict_ql/memcmp-strings.py @@ -62,7 +62,7 @@ def do_string_analysis(corpdir, infile1): or ("<" in str11) or (">" in str11) ): - print("Space / Paranthesis String : %s" % str11) + print("Space / Parenthesis String : %s" % str11) else: with open(corpdir + "/memcmp-str{0}".format(n), "w") as file: file.write(str11) diff --git a/utils/autodict_ql/stan-strings.py b/utils/autodict_ql/stan-strings.py index 81cb0b97..d61dafe7 100644 --- a/utils/autodict_ql/stan-strings.py +++ b/utils/autodict_ql/stan-strings.py @@ -62,7 +62,7 @@ def do_string_analysis(corpdir, infile1): or ("<" in str11) or (">" in str11) ): - print("Space / Paranthesis String : %s" % str11) + print("Space / Parenthesis String : %s" % str11) else: with open(corpdir + "/seed-str{0}".format(n), "w") as file: file.write(str11) diff --git a/utils/autodict_ql/strcmp-strings.py b/utils/autodict_ql/strcmp-strings.py index 9c2520c9..59a2a0f6 100644 --- a/utils/autodict_ql/strcmp-strings.py +++ b/utils/autodict_ql/strcmp-strings.py @@ -62,7 +62,7 @@ def do_string_analysis(corpdir, infile1): or ("<" in str11) or (">" in str11) ): - print("Space / Paranthesis String : %s" % str11) + print("Space / Parenthesis String : %s" % str11) else: with open(corpdir + "/strcmp-str{0}".format(n), "w") as file: file.write(str11) diff --git a/utils/autodict_ql/strncmp-strings.py b/utils/autodict_ql/strncmp-strings.py index 6206b4c4..171dfe73 100644 --- a/utils/autodict_ql/strncmp-strings.py +++ b/utils/autodict_ql/strncmp-strings.py @@ -62,7 +62,7 @@ def do_string_analysis(corpdir, infile1): or ("<" in str11) or (">" in str11) ): - print("Space / Paranthesis String : %s" % str11) + print("Space / Parenthesis String : %s" % str11) else: with open(corpdir + "/strncmp-str{0}".format(n), "w") as file: file.write(str11) diff --git a/utils/defork/README.md b/utils/defork/README.md index 657ef274..2a34a354 100644 --- a/utils/defork/README.md +++ b/utils/defork/README.md @@ -3,7 +3,7 @@ when the target forks, this breaks all normal fuzzing runs. Sometimes, though, it is enough to just run the child process. If this is the case, then this LD_PRELOAD library will always return 0 on fork, -the target will belive it is running as the child, post-fork. +the target will believe it is running as the child, post-fork. This is defork.c from the amazing preeny project https://github.com/zardus/preeny diff --git a/utils/mutation_chain/mutation_chain.py b/utils/mutation_chain/mutation_chain.py index eb20bbd0..86f77697 100644 --- a/utils/mutation_chain/mutation_chain.py +++ b/utils/mutation_chain/mutation_chain.py @@ -26,7 +26,7 @@ def fillDictWithFilenameKeys(dir): dict[filename] = None return dict -# recusively compute the chain of queue items that led to the AFL crash file +# recursively compute the chain of queue items that led to the AFL crash file def compute_mutation_chain(filename, current_fuzzer, n): if re.match(".*src:(\\d+),", filename): @@ -104,7 +104,7 @@ def main(): parser.add_argument( "-n", "--node", action = 'store', - help = '[Only used in single mode; optinal] name of the fuzzer node that contains the crash file supplied in the --file argument (e.g. \'fuzzer03\'). Defaults to \'fuzzer01\' if not supplied', + help = '[Only used in single mode; optional] name of the fuzzer node that contains the crash file supplied in the --file argument (e.g. \'fuzzer03\'). Defaults to \'fuzzer01\' if not supplied', required = False ) @@ -130,7 +130,7 @@ def main(): print("Error: \'" + crash_file_path + "\' does not exist.\nPlease verify whether the node and filename are correct.") return - # Create the interal representation of the various queues of parallel fuzzing nodes + # Create the internal representation of the various queues of parallel fuzzing nodes for dir in os.listdir(args.input): if re.match("^fuzzer\\d+", dir): queues[dir] = fillDictWithFilenameKeys(args.input + '/' + dir + '/queue')