ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-14 02:58:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix various spelling errors (#2293)

Browse Source 
* Fix spelling errors in log messages

* Fix doc comment syntax

* Fix spelling errors in Markdown documentation

* Fix spelling errors in comments
This commit is contained in:
David Robillard
2025-02-09 18:32:42 -05:00
committed by GitHub
parent 6a4b5807b6
commit 7765d4ac33
81 changed files with 150 additions and 150 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
afl-whatsup
View File

@ -115,7 +115,7 @@ PLATFORM=`uname -s`
#if [ "$PLATFORM" = "Linux" ] ; then
# CUR_TIME=`cat /proc/uptime | awk '{printf "%.0f\n", $1}'`
#else
# This will lead to inacurate results but will prevent the script from breaking on platforms other than Linux
# This will lead to inaccurate results but will prevent the script from breaking on platforms other than Linux
CUR_TIME=`date +%s`
#fi

2
custom_mutators/aflpp/README.md
View File

@ -1,4 +1,4 @@
# custum mutator: AFL++
# custom mutator: AFL++
this is the AFL++ havoc mutator as a custom mutator module for AFL++.

2
custom_mutators/atnwalk/atnwalk.c
View File

@ -409,7 +409,7 @@ size_t afl_custom_fuzz(atnwalk_mutator_t *data, uint8_t *buf, size_t buf_size,
} else {
// new_size fits into buf, so re-use it
// new_size fits into buf, so reuse it
*out_buf = buf;
}

2
custom_mutators/autotokens/standalone/README.md
View File

@ -7,6 +7,6 @@ just type `make` to build.
You *MUST* use a dictionary file to have an effective grammarless grammar fuzzer!
```
autotokens-standalone -h # to see all parameteres
autotokens-standalone -h # to see all parameters
autotokens-standalone -x foo.dict inputfile outputfile # example
```

2
custom_mutators/examples/XmlMutatorMin.py
View File

@ -304,7 +304,7 @@ class XmlMutatorMin:
# Log something
if self.verbose:
print("Reseting tag #%i '%s'" % (rand_elem_id, rand_elem.tag))
print("Resetting tag #%i '%s'" % (rand_elem_id, rand_elem.tag))
# Reset the node
rand_elem.clear()

4
custom_mutators/examples/wrapper_afl_min.py
View File

@ -80,12 +80,12 @@ def fuzz(buf, add_buf, max_size):
via_buffer = False
log("fuzz(): Can't initialize mutator with AFL buffer")
# If init from AFL buffer wasn't succesful
# If init from AFL buffer wasn't successful
if not via_buffer:
log("fuzz(): Returning unmodified AFL buffer")
return buf
# Sucessful initialization -> mutate
# Successful initialization -> mutate
try:
__mutator__.mutate(max=5)
log("fuzz(): Input mutated")

2
custom_mutators/gramatron/build_gramatron_mutator.sh
View File

@ -143,7 +143,7 @@ test -e json-c/.libs/libjson-c.a || {
echo
echo
echo "[+] Json-c successfully prepared!"
echo "[+] Builing gramatron now."
echo "[+] Building gramatron now."
$CC -O3 -g -fPIC -Wno-unused-result -Wl,--allow-multiple-definition -I../../include -o gramatron.so -shared -I. -I/prg/dev/include gramfuzz.c gramfuzz-helpers.c gramfuzz-mutators.c gramfuzz-util.c hashmap.c ../../src/afl-performance.o json-c/.libs/libjson-c.a || exit 1
echo
echo "[+] gramatron successfully built!"

2
custom_mutators/honggfuzz/README.md
View File

@ -1,4 +1,4 @@
# custum mutator: honggfuzz mangle
# custom mutator: honggfuzz mangle
this is the honggfuzz mutator in mangle.c as a custom mutator
module for AFL++. It is the original mangle.c, mangle.h and honggfuzz.h

2
custom_mutators/honggfuzz/mangle.c
View File

@ -850,7 +850,7 @@ static void mangle_ASCIINumChange(run_t *run, bool printable) {
size_t len = 0;
uint64_t val = 0;
/* 20 is maximum lenght of a string representing a 64-bit unsigned value */
/* 20 is maximum length of a string representing a 64-bit unsigned value */
for (len = 0; (len < 20) && (len < left); len++) {
char c = run->dynfile->data[off + len];

2
custom_mutators/libfuzzer/FuzzerDataFlowTrace.cpp
View File

@ -40,7 +40,7 @@ bool BlockCoverage::AppendCoverage(const std::string &S) {
// Coverage lines have this form:
// CN X Y Z T
// where N is the number of the function, T is the total number of instrumented
// BBs, and X,Y,Z, if present, are the indecies of covered BB.
// BBs, and X,Y,Z, if present, are the indices of covered BB.
// BB #0, which is the entry block, is not explicitly listed.
bool BlockCoverage::AppendCoverage(std::istream &IN) {

2
custom_mutators/libfuzzer/FuzzerDictionary.h
View File

@ -106,7 +106,7 @@ private:
};
// Parses one dictionary entry.
// If successful, write the enty to Unit and returns true,
// If successful, write the entry to Unit and returns true,
// otherwise returns false.
bool ParseOneDictionaryEntry(const std::string &Str, Unit *U);
// Parses the dictionary file, fills Units, returns true iff all lines

2
custom_mutators/libfuzzer/FuzzerFork.cpp
View File

@ -427,7 +427,7 @@ void FuzzWithFork(Random &Rand, const FuzzingOptions &Options,
Env.RunOneMergeJob(Job.get());
// Continue if our crash is one of the ignorred ones.
// Continue if our crash is one of the ignored ones.
if (Options.IgnoreTimeouts && ExitCode == Options.TimeoutExitCode)
Env.NumTimeouts++;
else if (Options.IgnoreOOMs && ExitCode == Options.OOMExitCode)

2
custom_mutators/libfuzzer/FuzzerMerge.cpp
View File

@ -452,7 +452,7 @@ void CrashResistantMerge(const Vector<std::string> &Args,
auto ExitCode = ExecuteCommand(Cmd);
if (!ExitCode) {
VPrintf(V, "MERGE-OUTER: succesfull in %zd attempt(s)\n", Attempt);
VPrintf(V, "MERGE-OUTER: succesful in %zd attempt(s)\n", Attempt);
break;
}

4
custom_mutators/libfuzzer/FuzzerMutate.cpp
View File

@ -498,9 +498,9 @@ size_t ChangeBinaryInteger(uint8_t *Data, size_t Size, Random &Rand) {
T Add = Rand(21);
Add -= 10;
if (Rand.RandBool())
Val = Bswap(T(Bswap(Val) + Add)); // Add assuming different endiannes.
Val = Bswap(T(Bswap(Val) + Add)); // Add assuming different endianness.
else
Val = Val + Add; // Add assuming current endiannes.
Val = Val + Add; // Add assuming current endianness.
if (Add == 0 || Rand.RandBool()) // Maybe negate.
Val = -Val;

2
custom_mutators/libfuzzer/FuzzerTracePC.cpp
View File

@ -460,7 +460,7 @@ static size_t InternalStrnlen(const char *S, size_t MaxLen) {
}
// Finds min of (strlen(S1), strlen(S2)).
// Needed bacause one of these strings may actually be non-zero terminated.
// Needed because one of these strings may actually be non-zero terminated.
static size_t InternalStrnlen2(const char *S1, const char *S2) {
size_t Len = 0;

2
custom_mutators/libfuzzer/README.md
View File

@ -1,4 +1,4 @@
# custum mutator: libfuzzer LLVMFuzzerMutate()
# custom mutator: libfuzzer LLVMFuzzerMutate()
This uses the libfuzzer LLVMFuzzerMutate() function in llvm 12.

2
custom_mutators/radamsa/GNUmakefile
View File

@ -2,7 +2,7 @@ CUR_DIR := $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))
all: radamsa-mutator.so
# These can be overriden:
# These can be overridden:
CFLAGS ?= $(CFLAGS_FLTO)
# These are required: (otherwise radamsa gets very very slooooow)

2
custom_mutators/radamsa/README.md
View File

@ -1,4 +1,4 @@
# custum mutator: libradamsa
# custom mutator: libradamsa
Pretranslated radamsa library. This code belongs to the radamsa author.

2
custom_mutators/symcc/README.md
View File

@ -1,4 +1,4 @@
# custum mutator: symcc
# custom mutator: symcc
This uses the symcc to find new paths into the target.

2
custom_mutators/symqemu/README.md
View File

@ -1,4 +1,4 @@
# custum mutator: symqemu
# custom mutator: symqemu
This uses the symcc to find new paths into the target.

4
docs/FAQ.md
View File

@ -106,7 +106,7 @@ If you find an interesting or important question missing, submit it via
<details>
<summary id="should-you-ever-stop-afl-fuzz-minimize-the-corpus-and-restart">Should you ever stop afl-fuzz, minimize the corpus and restart?</summary><p>
To stop afl-fuzz, minimize it's corpus and restart you would usually do:
To stop afl-fuzz, minimize its corpus and restart you would usually do:
```
Control-C # to terminate afl-fuzz
@ -274,7 +274,7 @@ If you find an interesting or important question missing, submit it via
the existing map will be used also for the newly loaded libraries, which
allows it to work, however, the efficiency of the fuzzing will be partially
degraded. Note that there is additionally `AFL_IGNORE_PROBLEMS_COVERAGE` to
additionally tell AFL++ to ignore any coverage from the late loaded libaries.
additionally tell AFL++ to ignore any coverage from the late loaded libraries.
</p></details>
<details>

2
docs/SAND.md
View File

@ -7,7 +7,7 @@
## Motivation
SAND introduces a new fuzzing workflow that can greatly reduce (or even eliminate) sanitizer overhead and combine different sanitizers in one fuzzing compaign.
SAND introduces a new fuzzing workflow that can greatly reduce (or even eliminate) sanitizer overhead and combine different sanitizers in one fuzzing campaign.
The key point of SAND is that: sanitizing all inputs is wasting fuzzing power, because bug-triggering inputs are extremely rare (~1%). Obviously, not all inputs worth going through sanitizers. Therefore, if we can somehow "predict" if an input could trigger bugs (defined as "execution pattern"), we could greatly save fuzzing power by only sanitizing a small proportion of all inputs. That's exactly how SAND works.

2
docs/afl-fuzz_approach.md
View File

@ -6,7 +6,7 @@ coverage to effortlessly pick up subtle, local-scale changes to program control
flow.
Note: If you are interested in a more current up-to-date deep dive how AFL++
works then we commend this blog post:
works then we recommend this blog post:
[https://blog.ritsec.club/posts/afl-under-hood/](https://blog.ritsec.club/posts/afl-under-hood/)
Simplifying a bit, the overall algorithm can be summed up as:

2
docs/custom_mutators.md
View File

@ -151,7 +151,7 @@ def deinit(): # optional for Python
splicing - or anything else - and can also be ignored. If you are not
using this additional data then define `splice_optout` (see above).
This function is optional.
Returing a length of 0 is valid and is interpreted as skipping this
Returning a length of 0 is valid and is interpreted as skipping this
one mutation result.
For non-Python: the returned output buffer is under **your** memory
management!

2
docs/env_variables.md
View File

@ -247,7 +247,7 @@ used if several separated instrumentations are performed which are then later
combined.
- `AFL_LLVM_LTO_CALLER` activates collision free CALLER instrumentation
- `AFL_LLVM_LTO_CALLER` sets the maximum mumber of single block functions
- `AFL_LLVM_LTO_CALLER` sets the maximum number of single block functions
to dig deeper into a real function. Default 0.
- `AFL_LLVM_DOCUMENT_IDS=file` will document to a file which edge ID was given
to which function. This helps to identify functions with variable bytes or

2
docs/fuzzing_binary-only_targets.md
View File

@ -196,7 +196,7 @@ afl-clang-fast's.
RetroWrite is a static binary rewriter that can be combined with AFL++. If you
have an x86_64 or arm64 binary that does not contain C++ exceptions and - if
x86_64 - still has it's symbols and compiled with position independent code
x86_64 - still has its symbols and compiled with position independent code
(PIC/PIE), then the RetroWrite solution might be for you.
It decompiles to ASM files which can then be instrumented with afl-gcc.
Note that afl-gcc is only present until AFL++ v4.21c and was subsequently removed as it is obsolete.

2
frida_mode/DEBUGGING.md
View File

@ -39,7 +39,7 @@ is *VERY* important to carry out these basic steps first before taking on the
additional complexity of debugging with FRIDA mode or `afl-fuzz`.
- Run your harness outside of the fuzzer, passing it a representative seed as
it's input `./harness <input>`.
its input `./harness <input>`.
- Pass your harness multiple seeds to check that it is stable when running
multiple tests as it will when running in fork server mode `./harness <input1>
<intput2>`.

2
frida_mode/MapDensity.md
View File

@ -107,7 +107,7 @@ every block of code we execute, performance is critical.
However, the design of the binary instrumentation modes of AFL++ has moved on.
Both QEMU and FRIDA modes use a two stage process when executing a target
application. Each block is first compiled or instrumented, and then it is
executed. The compiled blocks can be re-used each time the target executes them.
executed. The compiled blocks can be reused each time the target executes them.
Since a blocks ID is based on its address, and this is known at compile time, we
only need to generate this ID once per block and so this ID generation no longer

6
frida_mode/README.md
View File

@ -200,10 +200,10 @@ instrumented address block translations.
* `AFL_FRIDA_INST_NO_SUPPRESS` - Disable deterministic branch suppression.
Deterministic branch suppression skips the preamble which generates coverage
information at the start of each block, if the block is reached by a
deterministic branch. This reduces map polution, and may improve performance
deterministic branch. This reduces map pollution, and may improve performance
when all the executing blocks have been prefetched and backpatching applied.
However, in the event that backpatching is incomplete, this may incur a
performance penatly as branch instructions are disassembled on each branch.
performance penalty as branch instructions are disassembled on each branch.
* `AFL_FRIDA_INST_SEED` - Sets the initial seed for the hash function used to
generate block (and hence edge) IDs. Setting this to a constant value may be
useful for debugging purposes, e.g., investigating unstable edges.
@ -215,7 +215,7 @@ instrumented address block translations.
coverage information for unstable edges (e.g., to be loaded within IDA
lighthouse).
* `AFL_FRIDA_JS_SCRIPT` - Set the script to be loaded by the FRIDA scripting
engine. See [Scipting.md](Scripting.md) for details.
engine. See [Scripting.md](Scripting.md) for details.
* `AFL_FRIDA_OUTPUT_STDOUT` - Redirect the standard output of the target
application to the named file (supersedes the setting of `AFL_DEBUG_CHILD`).
* `AFL_FRIDA_OUTPUT_STDERR` - Redirect the standard error of the target

16
frida_mode/Scripting.md
View File

@ -724,16 +724,16 @@ class Afl {
* it takes as arguments a `NativePointer` and a `number`. It can be
* called multiple times to exclude several ranges.
*/
static addExcludedRange(addressess, size) {
Afl.jsApiAddExcludeRange(addressess, size);
static addExcludedRange(addresses, size) {
Afl.jsApiAddExcludeRange(addresses, size);
}
/**
* This is equivalent to setting a value in `AFL_FRIDA_INST_RANGES`,
* it takes as arguments a `NativePointer` and a `number`. It can be
* called multiple times to include several ranges.
*/
static addIncludedRange(addressess, size) {
Afl.jsApiAddIncludeRange(addressess, size);
static addIncludedRange(addresses, size) {
Afl.jsApiAddIncludeRange(addresses, size);
}
/**
* This must always be called at the end of your script. This lets
@ -771,7 +771,7 @@ class Afl {
}
/**
* Print a message to the STDOUT. This should be preferred to
* FRIDA's `console.log` since FRIDA will queue it's log messages.
* FRIDA's `console.log` since FRIDA will queue its log messages.
* If `console.log` is used in a callback in particular, then there
* may no longer be a thread running to service this queue.
*/
@ -893,14 +893,14 @@ class Afl {
}
/**
* This is equivalent to setting `AFL_FRIDA_PERSISTENT_ADDR`, again a
* `NativePointer` should be provided as it's argument.
* `NativePointer` should be provided as its argument.
*/
static setPersistentAddress(address) {
Afl.jsApiSetPersistentAddress(address);
}
/**
* This is equivalent to setting `AFL_FRIDA_PERSISTENT_CNT`, a
* `number` should be provided as it's argument.
* `number` should be provided as its argument.
*/
static setPersistentCount(count) {
Afl.jsApiSetPersistentCount(count);
@ -920,7 +920,7 @@ class Afl {
}
/**
* This is equivalent to setting `AFL_FRIDA_PERSISTENT_RET`, again a
* `NativePointer` should be provided as it's argument.
* `NativePointer` should be provided as its argument.
*/
static setPersistentReturn(address) {
Afl.jsApiSetPersistentReturn(address);

2
frida_mode/many-linux/README.md
View File

@ -4,6 +4,6 @@ This folder contains a Docker image to allow the building of
`afl-frida-trace.so` using the `many-linux` docker image. This docker image is
based on CentOS Linux 5. By building `afl-frida-trace.so` for such an old
version of Linux, given the strong backward compatibility of Linux, this should
work on the majority of Linux environments. This may be useful for targetting
work on the majority of Linux environments. This may be useful for targeting
Linux distributions other than your development environment. `many-local` builds
`AFLplusplus` from the local working copy in the `many-linux` environment.

2
frida_mode/src/cmplog/cmplog.c
View File

@ -166,7 +166,7 @@ gboolean cmplog_is_readable(guint64 addr, size_t size) {
*/
if (addr < DEFAULT_MMAP_MIN_ADDR) { return false; }
/* Check our addres/length don't wrap around */
/* Check our address/length don't wrap around */
if (SIZE_MAX - addr < size) { return false; }
GumAddress inner_base = addr;

2
frida_mode/src/instrument/instrument.c
View File

@ -186,7 +186,7 @@ static void instrument_basic_block(GumStalkerIterator *iterator,
* execution), we instead ensure that we honour the additional
* instrumentation requested (e.g. coverage, asan and complog) when a block
* is compiled no matter where we are during initialization. We will end up
* re-using these blocks if the code under test calls a block which is also
* reusing these blocks if the code under test calls a block which is also
* used during initialization.
*
* Coverage data generated during initialization isn't a problem since the

4
frida_mode/src/instrument/instrument_arm64.c
View File

@ -285,7 +285,7 @@ static void instrument_coverage_switch(GumStalkerObserver *self,
/*
* If the branch is deterministic, then we should start execution at the
* begining of the block. From here, we will branch and skip the coverage
* beginning of the block. From here, we will branch and skip the coverage
* code and jump right to the target code of the instrumented block.
* Otherwise, if the branch is non-deterministic, then we need to branch
* part way into the block to where the coverage instrumentation starts.
@ -516,7 +516,7 @@ void instrument_coverage_optimize(const cs_insn *instr,
* an instruction to load x16,x17 from beyond the red-zone on the stack. A
* pair of registers are saved/restored because on AARCH64, the stack pointer
* must be 16 byte aligned. This instruction is emitted into the block before
* the tranformer (from which we are called) is executed. If is is possible
* the transformer (from which we are called) is executed. If is is possible
* for Stalker to make a direct branch (the target block is close enough), it
* can forego pushing the registers and instead branch at an offset into the
* block to skip this restoration prolog.

16
frida_mode/src/js/api.js
View File

@ -5,16 +5,16 @@ class Afl {
* it takes as arguments a `NativePointer` and a `number`. It can be
* called multiple times to exclude several ranges.
*/
static addExcludedRange(addressess, size) {
Afl.jsApiAddExcludeRange(addressess, size);
static addExcludedRange(addresses, size) {
Afl.jsApiAddExcludeRange(addresses, size);
}
/**
* This is equivalent to setting a value in `AFL_FRIDA_INST_RANGES`,
* it takes as arguments a `NativePointer` and a `number`. It can be
* called multiple times to include several ranges.
*/
static addIncludedRange(addressess, size) {
Afl.jsApiAddIncludeRange(addressess, size);
static addIncludedRange(addresses, size) {
Afl.jsApiAddIncludeRange(addresses, size);
}
/**
* This must always be called at the end of your script. This lets
@ -52,7 +52,7 @@ class Afl {
}
/**
* Print a message to the STDOUT. This should be preferred to
* FRIDA's `console.log` since FRIDA will queue it's log messages.
* FRIDA's `console.log` since FRIDA will queue its log messages.
* If `console.log` is used in a callback in particular, then there
* may no longer be a thread running to service this queue.
*/
@ -205,14 +205,14 @@ class Afl {
}
/**
* This is equivalent to setting `AFL_FRIDA_PERSISTENT_ADDR`, again a
* `NativePointer` should be provided as it's argument.
* `NativePointer` should be provided as its argument.
*/
static setPersistentAddress(address) {
Afl.jsApiSetPersistentAddress(address);
}
/**
* This is equivalent to setting `AFL_FRIDA_PERSISTENT_CNT`, a
* `number` should be provided as it's argument.
* `number` should be provided as its argument.
*/
static setPersistentCount(count) {
Afl.jsApiSetPersistentCount(count);
@ -232,7 +232,7 @@ class Afl {
}
/**
* This is equivalent to setting `AFL_FRIDA_PERSISTENT_RET`, again a
* `NativePointer` should be provided as it's argument.
* `NativePointer` should be provided as its argument.
*/
static setPersistentReturn(address) {
Afl.jsApiSetPersistentReturn(address);

2
frida_mode/src/ranges.c
View File

@ -37,7 +37,7 @@ static void convert_address_token(gchar *token, GumMemoryRange *range) {
if (token_count != 2) {
FFATAL("Invalid range (should have two addresses seperated by a '-'): %s\n",
FFATAL("Invalid range (should have two addresses separated by a '-'): %s\n",
token);
}

16
frida_mode/ts/lib/afl.ts
View File

@ -11,8 +11,8 @@ class Afl {
* it takes as arguments a `NativePointer` and a `number`. It can be
* called multiple times to exclude several ranges.
*/
public static addExcludedRange(addressess: NativePointer, size: number): void {
Afl.jsApiAddExcludeRange(addressess, size);
public static addExcludedRange(addresses: NativePointer, size: number): void {
Afl.jsApiAddExcludeRange(addresses, size);
}
/**
@ -20,8 +20,8 @@ class Afl {
* it takes as arguments a `NativePointer` and a `number`. It can be
* called multiple times to include several ranges.
*/
public static addIncludedRange(addressess: NativePointer, size: number): void {
Afl.jsApiAddIncludeRange(addressess, size);
public static addIncludedRange(addresses: NativePointer, size: number): void {
Afl.jsApiAddIncludeRange(addresses, size);
}
/**
@ -66,7 +66,7 @@ class Afl {
/**
* Print a message to the STDOUT. This should be preferred to
* FRIDA's `console.log` since FRIDA will queue it's log messages.
* FRIDA's `console.log` since FRIDA will queue its log messages.
* If `console.log` is used in a callback in particular, then there
* may no longer be a thread running to service this queue.
*/
@ -241,7 +241,7 @@ class Afl {
/**
* This is equivalent to setting `AFL_FRIDA_PERSISTENT_ADDR`, again a
* `NativePointer` should be provided as it's argument.
* `NativePointer` should be provided as its argument.
*/
public static setPersistentAddress(address: NativePointer): void {
Afl.jsApiSetPersistentAddress(address);
@ -249,7 +249,7 @@ class Afl {
/**
* This is equivalent to setting `AFL_FRIDA_PERSISTENT_CNT`, a
* `number` should be provided as it's argument.
* `number` should be provided as its argument.
*/
public static setPersistentCount(count: number): void {
Afl.jsApiSetPersistentCount(count);
@ -272,7 +272,7 @@ class Afl {
/**
* This is equivalent to setting `AFL_FRIDA_PERSISTENT_RET`, again a
* `NativePointer` should be provided as it's argument.
* `NativePointer` should be provided as its argument.
*/
public static setPersistentReturn(address: NativePointer): void {
Afl.jsApiSetPersistentReturn(address);

8
include/afl-fuzz.h
View File

@ -920,7 +920,7 @@ struct custom_mutator {
/**
* Opt-out of a splicing input for the fuzz mutator
*
* Empty dummy function. It's presence tells afl-fuzz not to pass a
* Empty dummy function. Its presence tells afl-fuzz not to pass a
* splice data pointer and len.
*
* @param data pointer returned in afl_custom_init by this custom mutator
@ -952,12 +952,12 @@ struct custom_mutator {
/**
* Describe the current testcase, generated by the last mutation.
* This will be called, for example, to give the written testcase a name
* after a crash ocurred. It can help to reproduce crashing mutations.
* after a crash occurred. It can help to reproduce crashing mutations.
*
* (Optional)
*
* @param data pointer returned by afl_customm_init for this custom mutator
* @paramp[in] max_description_len maximum size avaliable for the description.
* @paramp[in] max_description_len maximum size available for the description.
* A longer return string is legal, but will be truncated.
* @return A valid ptr to a 0-terminated string.
* An empty or NULL return will result in a default description
@ -1134,7 +1134,7 @@ struct custom_mutator {
void afl_state_init(afl_state_t *, uint32_t map_size);
void afl_state_deinit(afl_state_t *);
/* Set stop_soon flag on all childs, kill all childs */
/* Set stop_soon flag on all children, kill all children */
void afl_states_stop(void);
/* Set clear_screen flag on all states */
void afl_states_clear_screen(void);

4
include/common.h
View File

@ -76,8 +76,8 @@ u8 *find_afl_binary(u8 *own_loc, u8 *fname);
int parse_afl_kill_signal(u8 *numeric_signal_as_str, int default_signal);
/* Configure the signals that are used to kill the forkserver
and the forked childs. If `afl_kill_signal_env` or `afl_fsrv_kill_signal_env`
is NULL, the appropiate values are read from the environment. */
and the forked children. If `afl_kill_signal_env` or `afl_fsrv_kill_signal_env`
is NULL, the appropriate values are read from the environment. */
void configure_afl_kill_signals(afl_forkserver_t *fsrv,
char *afl_kill_signal_env,
char *afl_fsrv_kill_signal_env,

6
include/config.h
View File

@ -39,7 +39,7 @@
However if a target has problematic constructors and init arrays then
this can fail. Hence afl-fuzz deploys a larger default map. The largest
map seen so far is the xlsx fuzzer for libreoffice which is 5MB.
At runtime this value can be overriden via AFL_MAP_SIZE.
At runtime this value can be overridden via AFL_MAP_SIZE.
Default: 8MB (defined in bytes) */
#define DEFAULT_SHMEM_SIZE (8 * 1024 * 1024)
@ -107,7 +107,7 @@
/* Now non-cmplog configuration options */
/* -------------------------------------*/
/* If a persistent target keeps state and found crashes are not reproducable
/* If a persistent target keeps state and found crashes are not reproducible
then enable this option and set the AFL_PERSISTENT_RECORD env variable
to a number. These number of testcases prior and including the crash case
will be kept and written to the crash/ directory as RECORD:... files.
@ -544,7 +544,7 @@
#define AFL_TXT_MAX_LEN 65535
/* What is the minimum percentage of ascii characters present to be classifed
/* What is the minimum percentage of ascii characters present to be classified
as "is_ascii"? */
#define AFL_TXT_MIN_PERCENT 99

4
include/t1ha.h
View File

@ -63,7 +63,7 @@
* // To enable unaligned access, but indicate that it significantly slow.
* #define T1HA_SYS_UNALIGNED_ACCESS 1
*
* // To enable unaligned access, and indicate that it effecient.
* // To enable unaligned access, and indicate that it's efficient.
* #define T1HA_SYS_UNALIGNED_ACCESS 2
*
*
@ -512,7 +512,7 @@ T1HA_API uint64_t t1ha2_atonce128(uint64_t *__restrict extra_result,
uint64_t seed);
/* The init/update/final trinity for streaming.
* Return 64 or 128-bit result depentently from `extra_result` argument. */
* Return 64 or 128-bit result dependently from `extra_result` argument. */
T1HA_API void t1ha2_init(t1ha_context_t *ctx, uint64_t seed_x, uint64_t seed_y);
T1HA_API void t1ha2_update(t1ha_context_t *__restrict ctx,
const void *__restrict data, size_t length);

2
instrumentation/README.injections.md
View File

@ -29,7 +29,7 @@ Alternatively you can set `AFL_LLVM_INJECTIONS_ALL` to enable all.
## How to modify
If you want to add more fuctions to check for e.g. SQL injections:
If you want to add more functions to check for e.g. SQL injections:
Add these to `instrumentation/injection-pass.cc` and recompile.
If you want to test for more injection inputs:

2
instrumentation/README.persistent_mode.md
View File

@ -8,7 +8,7 @@ most effective way to fuzz, as the speed can easily be x10 or x20 times faster
without any disadvantages. *All professional fuzzing uses this mode.*
Persistent mode requires that the target can be called in one or more functions,
and that it's state can be completely reset so that multiple calls can be
and that its state can be completely reset so that multiple calls can be
performed without resource leaks, and that earlier runs will have no impact on
future runs. An indicator for this is the `stability` value in the `afl-fuzz`
UI. If this decreases to lower values in persistent mode compared to

2
instrumentation/SanitizerCoverageLTO.so.cc
View File

@ -512,7 +512,7 @@ bool ModuleSanitizerCoverageLTO::instrumentModule(
}
// we make this the default as the fixed map has problems with
// defered forkserver, early constructors, ifuncs and maybe more
// deferred forkserver, early constructors, ifuncs and maybe more
/*if (getenv("AFL_LLVM_MAP_DYNAMIC"))*/
map_addr = 0;

2
instrumentation/SanitizerCoveragePCGUARD.so.cc
View File

@ -338,7 +338,7 @@ Function *ModuleSanitizerCoverageAFL::CreateInitCallsForSections(
if (TargetTriple.isOSBinFormatCOFF()) {
// In COFF files, if the contructors are set as COMDAT (they are because
// In COFF files, if the constructors are set as COMDAT (they are because
// COFF supports COMDAT) and the linker flag /OPT:REF (strip unreferenced
// functions and data) is used, the constructors get stripped. To prevent
// this, give the constructors weak ODR linkage and ensure the linker knows

2
instrumentation/afl-llvm-common.cc
View File

@ -157,7 +157,7 @@ bool isIgnoreFunction(const llvm::Function *F) {
// mangled name of the user-written function
for (auto const &ignoreListFunc : ignoreSubstringList) {
// hexcoder: F->getName().contains() not avaiilable in llvm 3.8.0
// hexcoder: F->getName().contains() not available in llvm 3.8.0
if (StringRef::npos != F->getName().find(ignoreListFunc)) { return true; }
}

4
instrumentation/afl-llvm-pass.so.cc
View File

@ -226,14 +226,14 @@ bool AFLCoverage::runOnModule(Module &M) {
#if LLVM_VERSION_MAJOR >= 11 /* use new pass manager */
if (getenv("AFL_SAN_NO_INST")) {
if (debug) {
fprintf(stderr, "Intrument disabled\n");
fprintf(stderr, "Instrument disabled\n");
}
return PreservedAnalyses::all();
}
#else
if (getenv("AFL_SAN_NO_INST")) {
if (debug) {
fprintf(stderr, "Intrument disabled\n");
fprintf(stderr, "Instrument disabled\n");
}
return true;
}

10
instrumentation/split-compares-pass.so.cc
View File

@ -112,7 +112,7 @@ class SplitComparesTransform : public ModulePass {
/// simplify a signed comparison (signed less or greater than)
bool simplifySignedCompare(CmpInst *IcmpInst, Module &M,
CmpWorklist &worklist);
/// splits an icmp into nested icmps recursivly until target_bitwidth is
/// splits an icmp into nested icmps recursively until target_bitwidth is
/// reached
bool splitCompare(CmpInst *I, Module &M, CmpWorklist &worklist);
@ -679,7 +679,7 @@ bool SplitComparesTransform::splitCompare(CmpInst *cmp_inst, Module &M,
PHINode *PN = nullptr;
/* now we have to destinguish between == != and > < */
/* now we have to distinguish between == != and > < */
switch (pred) {
case CmpInst::ICMP_EQ:
@ -767,7 +767,7 @@ bool SplitComparesTransform::splitCompare(CmpInst *cmp_inst, Module &M,
} else {
// Never gonna appen
// Never gonna happen
if (!be_quiet)
fprintf(stderr,
"Error: split-compare: Equals or signed not removed: %d\n",
@ -1435,14 +1435,14 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
case CmpInst::FCMP_UEQ:
case CmpInst::FCMP_OEQ:
/* if the exponents are satifying the compare do a fraction cmp in
/* if the exponents are satisfying the compare do a fraction cmp in
* middle_bb */
BranchInst::Create(middle_bb, end_bb, icmp_exponent_result,
signequal2_bb);
break;
case CmpInst::FCMP_ONE:
case CmpInst::FCMP_UNE:
/* if the exponents are satifying the compare do a fraction cmp in
/* if the exponents are satisfying the compare do a fraction cmp in
* middle_bb */
BranchInst::Create(end_bb, middle_bb, icmp_exponent_result,
signequal2_bb);

16
nyx_mode/custom_harness/example.c
View File

@ -17,14 +17,14 @@ int main(int argc, char **argv) {
*/
hprintf("Agent test\n");
/* Request information on available (host) capabilites (optional) */
/* Request information on available (host) capabilities (optional) */
host_config_t host_config;
kAFL_hypercall(HYPERCALL_KAFL_GET_HOST_CONFIG, (uintptr_t)&host_config);
hprintf("[capablities] host_config.bitmap_size: 0x%" PRIx64 "\n",
hprintf("[capabilities] host_config.bitmap_size: 0x%" PRIx64 "\n",
host_config.bitmap_size);
hprintf("[capablities] host_config.ijon_bitmap_size: 0x%" PRIx64 "\n",
hprintf("[capabilities] host_config.ijon_bitmap_size: 0x%" PRIx64 "\n",
host_config.ijon_bitmap_size);
hprintf("[capablities] host_config.payload_buffer_size: 0x%" PRIx64 "x\n",
hprintf("[capabilities] host_config.payload_buffer_size: 0x%" PRIx64 "x\n",
host_config.payload_buffer_size);
/* this is our "bitmap" that is later shared with the fuzzer (you can also
@ -47,9 +47,9 @@ int main(int argc, char **argv) {
*/
agent_config.agent_tracing =
1; /* set this flag to propagade that instrumentation-based fuzzing is
availabe */
available */
agent_config.agent_ijon_tracing = 0; /* set this flag to propagade that IJON
extension is implmented agent-wise */
extension is implemented agent-wise */
agent_config.trace_buffer_vaddr =
(uintptr_t)trace_buffer; /* trace "bitmap" pointer - required for
instrumentation-only fuzzing */
@ -106,8 +106,8 @@ int main(int argc, char **argv) {
if (payload_buffer->data[3] == 'X') {
((uint8_t *)trace_buffer)[4] = 0x1;
/* Notifiy the hypervisor and the fuzzer that a "crash" has
* occured. Also a string is passed by this hypercall (this is
/* Notify the hypervisor and the fuzzer that a "crash" has
* occurred. Also a string is passed by this hypercall (this is
* currently not supported by AFL++-Nyx) */
kAFL_hypercall(HYPERCALL_KAFL_PANIC_EXTENDED,
(uintptr_t) "Something went wrong\n");

2
qemu_mode/hooking_bridge/README.md
View File

@ -11,7 +11,7 @@ Run build_qemu_support.sh as you do to compile qemuafl, additionally with three
* `ENABLE_HOOKING=1` to compile the bridge
* `GLIB_H` and `GLIB_CONFIG_H` point to headers `glib.h` and `glibconfig.h` to wherever they are installed on your system
## Writting hooks
## Writing hooks
1. Create one or more hooking functions in a shared library, say `hook.so`.
2. Include `exports.h` in your hook build. You can find this header at `<your AFL++ path>/qemu_mode/hooking_bridge/inc`.
3. Shown below is an example which will use to walkthrough hook creation

2
qemu_mode/libcompcov/pmparser.h
View File

@ -101,7 +101,7 @@ void _pmparser_split_line(char *buf, char *addr1, char *addr2, char *perm,
void pmparser_print(procmaps_struct *map, int order);
/**
* gobal variables
* global variables
*/
// procmaps_struct *g_last_head=NULL;
// procmaps_struct *g_current=NULL;

2
qemu_mode/libqasan/patch.c
View File

@ -175,7 +175,7 @@ static void find_libc(void) {
}
/* Why this shit? https://twitter.com/andreafioraldi/status/1227635146452541441
Unfortunatly, symbol override with LD_PRELOAD is not enough to prevent libc
Unfortunately, symbol override with LD_PRELOAD is not enough to prevent libc
code to call this optimized XMM-based routines.
We patch them at runtime to call our unoptimized version of the same routine.
*/

4
src/afl-analyze.c
View File

@ -974,7 +974,7 @@ int main(int argc, char **argv_orig, char **envp) {
break;
case 'Y': // fallthough
case 'Y': // fallthrough
#ifdef __linux__
case 'X': /* NYX mode */
@ -987,7 +987,7 @@ int main(int argc, char **argv_orig, char **envp) {
break;
#else
case 'X':
FATAL("Nyx mode is only availabe on linux...");
FATAL("Nyx mode is only available on linux...");
break;
#endif

4
src/afl-forkserver.c
View File

@ -438,7 +438,7 @@ static void afl_fauxsrv_execv(afl_forkserver_t *fsrv, char **argv) {
}
// enable terminating on sigpipe in the childs
// enable terminating on sigpipe in the children
struct sigaction sa;
memset((char *)&sa, 0, sizeof(sa));
sa.sa_handler = SIG_DFL;
@ -878,7 +878,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
/* CHILD PROCESS */
// enable terminating on sigpipe in the childs
// enable terminating on sigpipe in the children
struct sigaction sa;
memset((char *)&sa, 0, sizeof(sa));
sa.sa_handler = SIG_DFL;

2
src/afl-fuzz-mutators.c
View File

@ -155,7 +155,7 @@ void destroy_custom_mutators(afl_state_t *afl) {
LIST_FOREACH_CLEAR(&afl->custom_mutator_list, struct custom_mutator, {
if (!el->data) { FATAL("Deintializing NULL mutator"); }
if (!el->data) { FATAL("Deinitializing NULL mutator"); }
if (el->afl_custom_deinit) el->afl_custom_deinit(el->data);
if (el->dh) dlclose(el->dh);

2
src/afl-fuzz-one.c
View File

@ -6185,7 +6185,7 @@ u8 fuzz_one(afl_state_t *afl) {
#endif
/*
-L command line paramter => limit_time_sig value
-L command line parameter => limit_time_sig value
limit_time_sig == 0 then run the default mutator
limit_time_sig > 0 then run MOpt
limit_time_sig < 0 both are run

2
src/afl-fuzz-python.c
View File

@ -68,7 +68,7 @@ static void *unsupported(afl_state_t *afl, unsigned int seed) {
}
/* sorry for this makro...
/* sorry for this macro...
it just fills in `&py_mutator->something_buf, &py_mutator->something_size`. */
#define BUF_PARAMS(name) (void **)&((py_mutator_t *)py_mutator)->name##_buf

2
src/afl-fuzz-queue.c
View File

@ -1468,7 +1468,7 @@ inline u8 *queue_testcase_get(afl_state_t *afl, struct queue_entry *q) {
}
/* Cache full. We neet to evict one or more to map one.
/* Cache full. We need to evict one or more to map one.
Get a random one which is not in use */
do {

10
src/afl-fuzz-redqueen.c
View File

@ -35,12 +35,12 @@
// CMP attribute enum
enum {
IS_EQUAL = 1, // arithemtic equal comparison
IS_EQUAL = 1, // arithmetic equal comparison
IS_GREATER = 2, // arithmetic greater comparison
IS_LESSER = 4, // arithmetic lesser comparison
IS_FP = 8, // is a floating point, not an integer
/* --- below are internal settings, not from target cmplog */
IS_FP_MOD = 16, // arithemtic changed floating point
IS_FP_MOD = 16, // arithmetic changed floating point
IS_INT_MOD = 32, // arithmetic changed integer
IS_TRANSFORM = 64 // transformed integer
@ -68,7 +68,7 @@ enum {
LVL1 = 1, // Integer solving
LVL2 = 2, // unused except for setting the queue entry
LVL3 = 4 // expensive tranformations
LVL3 = 4 // expensive transformations
};
@ -203,7 +203,7 @@ static void type_replace(afl_state_t *afl, u8 *buf, u32 len) {
u8 c;
for (i = 0; i < len; ++i) {
// wont help for UTF or non-latin charsets
// won't help for UTF or non-latin charsets
do {
switch (buf[i]) {
@ -1437,7 +1437,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
// here we add and subtract 1 from the value, but only if it is not an
// == or != comparison
// Bits: 1 = Equal, 2 = Greater, 4 = Lesser, 8 = Float
// 16 = modified float, 32 = modified integer (modified = wont match
// 16 = modified float, 32 = modified integer (modified = won't match
// in original buffer)
if (!afl->cmplog_enable_arith || lvl < LVL3 || attr == IS_TRANSFORM) {

2
src/afl-fuzz-sanfuzz.c
View File

@ -24,7 +24,7 @@
*/
/* This file roughly folows afl-fuzz-asanfuzz */
/* This file roughly follows afl-fuzz-asanfuzz */
#include <sys/select.h>

2
src/afl-fuzz-state.c
View File

@ -764,7 +764,7 @@ void afl_state_deinit(afl_state_t *afl) {
void afl_states_stop(void) {
/* We may be inside a signal handler.
Set flags first, send kill signals to child proceses later. */
Set flags first, send kill signals to child processes later. */
LIST_FOREACH(&afl_states, afl_state_t, {
el->stop_soon = 1;

4
src/afl-fuzz-stats.c
View File

@ -2129,13 +2129,13 @@ void show_stats_pizza(afl_state_t *afl) {
} else {
strcpy(tmp, "18 year aniversary mode");
strcpy(tmp, "18 year anniversary mode");
}
SAYF(bV bSTOP
" dictionary : " cRST "%-36s " bSTG bV bSTOP
" patrons from old resturant : " cRST "%-10s " bSTG bV
" patrons from old restaurant : " cRST "%-10s " bSTG bV
"\n",
tmp,
afl->sync_id ? u_stringify_int(IB(0), afl->queued_imported)

10
src/afl-fuzz.c
View File

@ -402,7 +402,7 @@ static void usage(u8 *argv0, int more_help) {
"AFL_STATSD_HOST: change default statsd host (default 127.0.0.1)\n"
"AFL_STATSD_PORT: change default statsd port (default: 8125)\n"
"AFL_STATSD_TAGS_FLAVOR: set statsd tags format (default: disable tags)\n"
" suported formats: dogstatsd, librato, signalfx, influxdb\n"
" supported formats: dogstatsd, librato, signalfx, influxdb\n"
"AFL_NO_FASTRESUME: do not read or write a fast resume file\n"
"AFL_NO_SYNC: disables all syncing\n"
"AFL_SYNC_TIME: sync time between fuzzing instances (in minutes)\n"
@ -1170,7 +1170,7 @@ int main(int argc, char **argv_orig, char **envp) {
#else
case 'X':
case 'Y':
FATAL("Nyx mode is only availabe on linux...");
FATAL("Nyx mode is only available on linux...");
break;
#endif
case 'A': /* CoreSight mode */
@ -2329,7 +2329,7 @@ int main(int argc, char **argv_orig, char **envp) {
if (NZLIBREAD(fr_fd, ver_string, sizeof(ver_string)) !=
sizeof(ver_string))
WARNF("Emtpy fastresume.bin, ignoring, cannot perform FAST RESUME");
WARNF("Empty fastresume.bin, ignoring, cannot perform FAST RESUME");
else if (expect_ver != *ver)
WARNF(
"Different AFL++ version or feature usage, cannot perform FAST "
@ -2603,7 +2603,7 @@ int main(int argc, char **argv_orig, char **envp) {
} else {
WARNF("Unkown abstraction: %s, fallback to unique trace.\n",
WARNF("Unknown abstraction: %s, fallback to unique trace.\n",
san_abstraction);
afl->san_abstraction = SIMPLIFY_TRACE;
@ -3583,7 +3583,7 @@ stop_fuzzing:
ZLIBCLOSE(fr_fd);
afl->var_byte_count = count_bytes(afl, afl->var_bytes);
OKF("fastresume.bin succesfully written with %u bytes.", w);
OKF("fastresume.bin successfully written with %u bytes.", w);
} else {

2
src/afl-gotcpu.c
View File

@ -214,7 +214,7 @@ int main(int argc, char **argv) {
#if defined(__linux__)
if (sched_setaffinity(0, sizeof(c), &c)) {
const char *error_code = "Unkown error code";
const char *error_code = "Unknown error code";
if (errno == EFAULT) error_code = "EFAULT";
if (errno == EINVAL) error_code = "EINVAL";
if (errno == EPERM) error_code = "EPERM";

6
src/afl-showmap.c
View File

@ -1259,7 +1259,7 @@ int main(int argc, char **argv_orig, char **envp) {
break;
/* FIXME: We want to use -P for consistency, but it is already unsed for
/* FIXME: We want to use -P for consistency, but it is already unused for
* undocumenetd feature "Another afl-cmin specific feature." */
case 'A': /* CoreSight mode */
@ -1307,7 +1307,7 @@ int main(int argc, char **argv_orig, char **envp) {
break;
#else
case 'X':
FATAL("Nyx mode is only availabe on linux...");
FATAL("Nyx mode is only available on linux...");
break;
#endif
@ -1684,7 +1684,7 @@ int main(int argc, char **argv_orig, char **envp) {
} else {
if ((coverage_map = (u8 *)malloc(map_size + 64)) == NULL)
FATAL("coult not grab memory");
FATAL("could not grab memory");
edges_only = false;
}

6
src/afl-tmin.c
View File

@ -1014,7 +1014,7 @@ int main(int argc, char **argv_orig, char **envp) {
break;
case 'Y': // fallthough
case 'Y': // fallthrough
#ifdef __linux__
case 'X': /* NYX mode */
@ -1027,7 +1027,7 @@ int main(int argc, char **argv_orig, char **envp) {
break;
#else
case 'X':
FATAL("Nyx mode is only availabe on linux...");
FATAL("Nyx mode is only available on linux...");
break;
#endif
@ -1035,7 +1035,7 @@ int main(int argc, char **argv_orig, char **envp) {
/* Minimizes a testcase to the minimum that still times out */
if (hang_mode) { FATAL("Multipe -H options not supported"); }
if (hang_mode) { FATAL("Multiple -H options not supported"); }
if (edges_only) {
FATAL("Edges only and hang mode are mutually exclusive.");

2
test/checkcommit.sh
View File

@ -6,7 +6,7 @@ test -z "$1" -o -n "$4" && {
echo "Syntax: $0 commit-id <indir> \"<cmdline>\""
echo
echo "Switches to the defined commit ID, compiles with profiling and runs"
echo "afl-fuzz on a defind target and input directory, saving timing,"
echo "afl-fuzz on a defined target and input directory, saving timing,"
echo "fuzzer_stats and profiling output to \"<commit-id>.out\""
echo "Honors CFLAGS and LDFLAGS"
echo

2
unicorn_mode/helper_scripts/ida_context_loader.py
View File

@ -63,7 +63,7 @@ def parse_mapping_index(filepath: str):
def get_input_name():
"""Get the name of the input file
:retrun: Name of the input file
:return: Name of the input file
"""
input_filepath = ida_nalt.get_input_file_path()

2
unicorn_mode/helper_scripts/unicorn_dumper_gdb.py
View File

@ -171,7 +171,7 @@ def dump_process_memory(output_dir):
# ---------------------------------------------
# ---- ARM Extention (dump floating point regs)
# ---- ARM Extension (dump floating point regs)
def dump_float(rge=32):

2
unicorn_mode/helper_scripts/unicorn_dumper_pwndbg.py
View File

@ -75,7 +75,7 @@ def map_arch():
return "arm64be"
elif "arm" in arch:
cpsr = pwndbg.gdblib.regs["cpsr"]
# check endianess
# check endianness
if pwndbg.gdblib.arch.endian == "big":
# check for THUMB mode
if cpsr & (1 << 5):

2
unicorn_mode/helper_scripts/unicorn_loader.py
View File

@ -26,7 +26,7 @@ from unicorn.arm64_const import *
from unicorn.x86_const import *
from unicorn.mips_const import *
# If Capstone libraries are availible (only check once)
# If Capstone libraries are available (only check once)
try:
from capstone import *

6
unicorn_mode/samples/c/harness.c
View File

@ -42,7 +42,7 @@ static const int64_t STACK_ADDRESS = (((int64_t) 0x01) << 58);
static const int64_t STACK_SIZE = 0x10000;
// Location where the input will be placed (make sure the emulated program knows this somehow, too ;) )
static const int64_t INPUT_LOCATION = 0x10000;
// Inside the location, we have an ofset in our special case
// Inside the location, we have an offset in our special case
static const int64_t INPUT_OFFSET = 0x16;
// Maximum allowable size of mutated data from AFL
static const int64_t INPUT_SIZE_MAX = 0x10000;
@ -65,7 +65,7 @@ static void hook_code(uc_engine *uc, uint64_t address, uint32_t size, void *user
/*
The sample uses strlen, since we don't have a loader or libc, we'll fake it.
We know the strlen will return the lenght of argv[1] that we just planted.
We know the strlen will return the length of argv[1] that we just planted.
It will be a lot faster than an actual strlen for this specific purpose.
*/
static void hook_strlen(uc_engine *uc, uint64_t address, uint32_t size, void *user_data) {
@ -247,7 +247,7 @@ int main(int argc, char **argv, char **envp) {
place_input_callback, // Callback that places the input (automatically loaded from the file at filename) in the unicorninstance
&end_address, // Where to exit (this is an array)
1, // Count of end addresses
NULL, // Optional calback to run after each exec
NULL, // Optional callback to run after each exec
false, // true, if the optional callback should be run also for non-crashes
1, // For persistent mode: How many rounds to run
NULL // additional data pointer

8
unicorn_mode/samples/persistent/harness.c
View File

@ -12,7 +12,7 @@
$ make
$ ../../../afl-fuzz -m none -i sample_inputs -o out -- ./harness @@
(Re)run a simgle input with block tracing using:
(Re)run a single input with block tracing using:
$ ./harness -t [inputfile]
*/
@ -46,7 +46,7 @@ static const int64_t STACK_ADDRESS = (((int64_t) 0x01) << 58);
static const int64_t STACK_SIZE = 0x10000;
// Location where the input will be placed (make sure the emulated program knows this somehow, too ;) )
static const int64_t INPUT_LOCATION = 0x10000;
// Inside the location, we have an ofset in our special case
// Inside the location, we have an offset in our special case
static const int64_t INPUT_OFFSET = 0x16;
// Maximum allowable size of mutated data from AFL
static const int64_t INPUT_SIZE_MAX = 0x10000;
@ -233,7 +233,7 @@ int main(int argc, char **argv, char **envp) {
// build a "dummy" argv with length 2 at 0x10000:
// 0x10000 argv[0] NULL
// 0x10008 argv[1] (char *)0x10016 --. points to the next offset.
// 0x10016 argv[1][0], ... <-^ contains the acutal input data. (INPUT_LOCATION + INPUT_OFFSET)
// 0x10016 argv[1][0], ... <-^ contains the actual input data. (INPUT_LOCATION + INPUT_OFFSET)
uc_mem_write(uc, 0x10008, "\x16\x00\x01", 3); // little endian of 0x10016, see above
@ -260,7 +260,7 @@ int main(int argc, char **argv, char **envp) {
place_input_callback, // Callback that places the input (automatically loaded from the file at filename) in the unicorninstance
&end_address, // Where to exit (this is an array)
1, // Count of end addresses
NULL, // Optional calback to run after each exec
NULL, // Optional callback to run after each exec
false, // true, if the optional callback should be run also for non-crashes
1000, // For persistent mode: How many rounds to run
NULL // additional data pointer

4
unicorn_mode/samples/speedtest/c/harness.c
View File

@ -308,7 +308,7 @@ int main(int argc, char **argv, char **envp) {
}
uint64_t start_address;
if(fscanf(f, "%llx", (unsigned long long) &start_address) == EOF) {
puts("Start address not found in target.offests.main");
puts("Start address not found in target.offsets.main");
exit(-1);
}
fclose(f);
@ -371,7 +371,7 @@ int main(int argc, char **argv, char **envp) {
place_input_callback, // Callback that places the input (automatically loaded from the file at filename) in the unicorninstance
exits, // Where to exit (this is an array)
exit_count, // Count of end addresses
NULL, // Optional calback to run after each exec
NULL, // Optional callback to run after each exec
false, // true, if the optional callback should be run also for non-crashes
1000, // For persistent mode: How many rounds to run
NULL // additional data pointer

2
unicorn_mode/samples/speedtest/get_offsets.py
View File

@ -43,7 +43,7 @@ for line in objdump_output.split("\n"):
if "<main>:" in line:
if main_loc is not None:
raise Exception("Found multiple main functions, odd target!")
# main_loc is the label, so it's parsed differntly (i.e. `0000000000001220 <main>:`)
# main_loc is the label, so it's parsed differently (i.e. `0000000000001220 <main>:`)
main_loc = "0x" + line.strip().split(" ", 1)[0].strip()
else:
[

2
utils/autodict_ql/memcmp-strings.py
View File

@ -62,7 +62,7 @@ def do_string_analysis(corpdir, infile1):
or ("<" in str11)
or (">" in str11)
):
print("Space / Paranthesis String : %s" % str11)
print("Space / Parenthesis String : %s" % str11)
else:
with open(corpdir + "/memcmp-str{0}".format(n), "w") as file:
file.write(str11)

2
utils/autodict_ql/stan-strings.py
View File

@ -62,7 +62,7 @@ def do_string_analysis(corpdir, infile1):
or ("<" in str11)
or (">" in str11)
):
print("Space / Paranthesis String : %s" % str11)
print("Space / Parenthesis String : %s" % str11)
else:
with open(corpdir + "/seed-str{0}".format(n), "w") as file:
file.write(str11)

2
utils/autodict_ql/strcmp-strings.py
View File

@ -62,7 +62,7 @@ def do_string_analysis(corpdir, infile1):
or ("<" in str11)
or (">" in str11)
):
print("Space / Paranthesis String : %s" % str11)
print("Space / Parenthesis String : %s" % str11)
else:
with open(corpdir + "/strcmp-str{0}".format(n), "w") as file:
file.write(str11)

2
utils/autodict_ql/strncmp-strings.py
View File

@ -62,7 +62,7 @@ def do_string_analysis(corpdir, infile1):
or ("<" in str11)
or (">" in str11)
):
print("Space / Paranthesis String : %s" % str11)
print("Space / Parenthesis String : %s" % str11)
else:
with open(corpdir + "/strncmp-str{0}".format(n), "w") as file:
file.write(str11)

2
utils/defork/README.md
View File

@ -3,7 +3,7 @@
when the target forks, this breaks all normal fuzzing runs.
Sometimes, though, it is enough to just run the child process.
If this is the case, then this LD_PRELOAD library will always return 0 on fork,
the target will belive it is running as the child, post-fork.
the target will believe it is running as the child, post-fork.
This is defork.c from the amazing preeny project
https://github.com/zardus/preeny

6
utils/mutation_chain/mutation_chain.py
View File

@ -26,7 +26,7 @@ def fillDictWithFilenameKeys(dir):
dict[filename] = None
return dict
# recusively compute the chain of queue items that led to the AFL crash file
# recursively compute the chain of queue items that led to the AFL crash file
def compute_mutation_chain(filename, current_fuzzer, n):
if re.match(".*src:(\\d+),", filename):
@ -104,7 +104,7 @@ def main():
parser.add_argument(
"-n", "--node",
action = 'store',
help = '[Only used in single mode; optinal] name of the fuzzer node that contains the crash file supplied in the --file argument (e.g. \'fuzzer03\'). Defaults to \'fuzzer01\' if not supplied',
help = '[Only used in single mode; optional] name of the fuzzer node that contains the crash file supplied in the --file argument (e.g. \'fuzzer03\'). Defaults to \'fuzzer01\' if not supplied',
required = False
)
@ -130,7 +130,7 @@ def main():
print("Error: \'" + crash_file_path + "\' does not exist.\nPlease verify whether the node and filename are correct.")
return
# Create the interal representation of the various queues of parallel fuzzing nodes
# Create the internal representation of the various queues of parallel fuzzing nodes
for dir in os.listdir(args.input):
if re.match("^fuzzer\\d+", dir):
queues[dir] = fillDictWithFilenameKeys(args.input + '/' + dir + '/queue')