ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-13 02:28:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

custom mutators might work again like this

Browse Source
This commit is contained in:
Dominik Maier
2020-03-23 18:18:54 +01:00
parent 83f925ccc9
commit 77b81e7361
5 changed files with 338 additions and 232 deletions
Download Patch File Download Diff File Expand all files Collapse all files

74
examples/custom_mutators/custom_mutator_helpers.h
View File

@ -5,7 +5,9 @@
#include "types.h"
#include <stdlib.h>
#define LIMIT_RAND(limit) (rand() % (limit))
#define RAND_BELOW(limit) (rand() % (limit))
typedef struct{} afl_t;
static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
@ -13,13 +15,13 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
static s16 interesting_16[] = {INTERESTING_8, INTERESTING_16};
static s32 interesting_32[] = {INTERESTING_8, INTERESTING_16, INTERESTING_32};
switch (LIMIT_RAND(12)) {
switch (RAND_BELOW(12)) {
case 0: {
/* Flip a single bit somewhere. Spooky! */
s32 bit_idx = ((LIMIT_RAND(end - begin) + begin) << 3) + LIMIT_RAND(8);
s32 bit_idx = ((RAND_BELOW(end - begin) + begin) << 3) + RAND_BELOW(8);
out_buf[bit_idx >> 3] ^= 128 >> (bit_idx & 7);
@ -31,8 +33,8 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
/* Set byte to interesting value. */
u8 val = interesting_8[LIMIT_RAND(sizeof(interesting_8))];
out_buf[(LIMIT_RAND(end - begin) + begin)] = val;
u8 val = interesting_8[RAND_BELOW(sizeof(interesting_8))];
out_buf[(RAND_BELOW(end - begin) + begin)] = val;
break;
@ -44,19 +46,19 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
if (end - begin < 2) break;
s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
s32 byte_idx = (RAND_BELOW(end - begin) + begin);
if (byte_idx >= end - 1) break;
switch (LIMIT_RAND(2)) {
switch (RAND_BELOW(2)) {
case 0:
*(u16 *)(out_buf + byte_idx) =
interesting_16[LIMIT_RAND(sizeof(interesting_16) >> 1)];
interesting_16[RAND_BELOW(sizeof(interesting_16) >> 1)];
break;
case 1:
*(u16 *)(out_buf + byte_idx) =
SWAP16(interesting_16[LIMIT_RAND(sizeof(interesting_16) >> 1)]);
SWAP16(interesting_16[RAND_BELOW(sizeof(interesting_16) >> 1)]);
break;
}
@ -71,19 +73,19 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
if (end - begin < 4) break;
s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
s32 byte_idx = (RAND_BELOW(end - begin) + begin);
if (byte_idx >= end - 3) break;
switch (LIMIT_RAND(2)) {
switch (RAND_BELOW(2)) {
case 0:
*(u32 *)(out_buf + byte_idx) =
interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)];
interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)];
break;
case 1:
*(u32 *)(out_buf + byte_idx) =
SWAP32(interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)]);
SWAP32(interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)]);
break;
}
@ -98,19 +100,19 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
if (end - begin < 8) break;
s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
s32 byte_idx = (RAND_BELOW(end - begin) + begin);
if (byte_idx >= end - 7) break;
switch (LIMIT_RAND(2)) {
switch (RAND_BELOW(2)) {
case 0:
*(u64 *)(out_buf + byte_idx) =
(s64)interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)];
(s64)interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)];
break;
case 1:
*(u64 *)(out_buf + byte_idx) =
SWAP64((s64)interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)]);
SWAP64((s64)interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)]);
break;
}
@ -123,7 +125,7 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
/* Randomly subtract from byte. */
out_buf[(LIMIT_RAND(end - begin) + begin)] -= 1 + LIMIT_RAND(ARITH_MAX);
out_buf[(RAND_BELOW(end - begin) + begin)] -= 1 + RAND_BELOW(ARITH_MAX);
break;
@ -133,7 +135,7 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
/* Randomly add to byte. */
out_buf[(LIMIT_RAND(end - begin) + begin)] += 1 + LIMIT_RAND(ARITH_MAX);
out_buf[(RAND_BELOW(end - begin) + begin)] += 1 + RAND_BELOW(ARITH_MAX);
break;
@ -145,17 +147,17 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
if (end - begin < 2) break;
s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
s32 byte_idx = (RAND_BELOW(end - begin) + begin);
if (byte_idx >= end - 1) break;
if (LIMIT_RAND(2)) {
if (RAND_BELOW(2)) {
*(u16 *)(out_buf + byte_idx) -= 1 + LIMIT_RAND(ARITH_MAX);
*(u16 *)(out_buf + byte_idx) -= 1 + RAND_BELOW(ARITH_MAX);
} else {
u16 num = 1 + LIMIT_RAND(ARITH_MAX);
u16 num = 1 + RAND_BELOW(ARITH_MAX);
*(u16 *)(out_buf + byte_idx) =
SWAP16(SWAP16(*(u16 *)(out_buf + byte_idx)) - num);
@ -172,17 +174,17 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
if (end - begin < 2) break;
s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
s32 byte_idx = (RAND_BELOW(end - begin) + begin);
if (byte_idx >= end - 1) break;
if (LIMIT_RAND(2)) {
if (RAND_BELOW(2)) {
*(u16 *)(out_buf + byte_idx) += 1 + LIMIT_RAND(ARITH_MAX);
*(u16 *)(out_buf + byte_idx) += 1 + RAND_BELOW(ARITH_MAX);
} else {
u16 num = 1 + LIMIT_RAND(ARITH_MAX);
u16 num = 1 + RAND_BELOW(ARITH_MAX);
*(u16 *)(out_buf + byte_idx) =
SWAP16(SWAP16(*(u16 *)(out_buf + byte_idx)) + num);
@ -199,17 +201,17 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
if (end - begin < 4) break;
s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
s32 byte_idx = (RAND_BELOW(end - begin) + begin);
if (byte_idx >= end - 3) break;
if (LIMIT_RAND(2)) {
if (RAND_BELOW(2)) {
*(u32 *)(out_buf + byte_idx) -= 1 + LIMIT_RAND(ARITH_MAX);
*(u32 *)(out_buf + byte_idx) -= 1 + RAND_BELOW(ARITH_MAX);
} else {
u32 num = 1 + LIMIT_RAND(ARITH_MAX);
u32 num = 1 + RAND_BELOW(ARITH_MAX);
*(u32 *)(out_buf + byte_idx) =
SWAP32(SWAP32(*(u32 *)(out_buf + byte_idx)) - num);
@ -226,17 +228,17 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
if (end - begin < 4) break;
s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
s32 byte_idx = (RAND_BELOW(end - begin) + begin);
if (byte_idx >= end - 3) break;
if (LIMIT_RAND(2)) {
if (RAND_BELOW(2)) {
*(u32 *)(out_buf + byte_idx) += 1 + LIMIT_RAND(ARITH_MAX);
*(u32 *)(out_buf + byte_idx) += 1 + RAND_BELOW(ARITH_MAX);
} else {
u32 num = 1 + LIMIT_RAND(ARITH_MAX);
u32 num = 1 + RAND_BELOW(ARITH_MAX);
*(u32 *)(out_buf + byte_idx) =
SWAP32(SWAP32(*(u32 *)(out_buf + byte_idx)) + num);
@ -253,7 +255,7 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
why not. We use XOR with 1-255 to eliminate the
possibility of a no-op. */
out_buf[(LIMIT_RAND(end - begin) + begin)] ^= 1 + LIMIT_RAND(255);
out_buf[(RAND_BELOW(end - begin) + begin)] ^= 1 + RAND_BELOW(255);
break;