ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-14 19:08:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

custom mutators might work again like this

Browse Source
This commit is contained in:
Dominik Maier
2020-03-23 18:18:54 +01:00
parent 83f925ccc9
commit 77b81e7361
5 changed files with 338 additions and 232 deletions
Download Patch File Download Diff File Expand all files Collapse all files

80
src/afl-fuzz-mutators.c
View File

@ -27,7 +27,7 @@
void load_custom_mutator(afl_state_t *, const char *);
#ifdef USE_PYTHON
void load_custom_mutator_py(afl_state_t *, const char *);
void load_custom_mutator_py(afl_state_t *, char *);
#endif
void setup_custom_mutator(afl_state_t *afl) {
@ -59,10 +59,7 @@ void setup_custom_mutator(afl_state_t *afl) {
FATAL(
"MOpt and Python mutator are mutually exclusive. We accept pull "
"requests that integrates MOpt with the optional mutators "
"(custom/radamsa/redquenn/...).");
if (init_py_module(afl, module_name))
FATAL("Failed to initialize Python module");
"(custom/radamsa/redqueen/...).");
load_custom_mutator_py(afl, module_name);
@ -79,18 +76,13 @@ void destroy_custom_mutator(afl_state_t *afl) {
if (afl->mutator) {
afl->mutator->afl_custom_deinit(afl->mutator->data);
if (afl->mutator->dh)
dlclose(afl->mutator->dh);
else {
/* Python mutator */
#ifdef USE_PYTHON
finalize_py_module(afl);
#endif
}
ck_free(afl->mutator);
afl->mutator = NULL;
}
@ -109,10 +101,13 @@ void load_custom_mutator(afl_state_t *afl, const char *fn) {
afl->mutator->dh = dh;
/* Mutator */
/* "afl_custom_init", optional for backward compatibility */
/* "afl_custom_init", required */
afl->mutator->afl_custom_init = dlsym(dh, "afl_custom_init");
if (!afl->mutator->afl_custom_init)
WARNF("Symbol 'afl_custom_init' not found.");
if (!afl->mutator->afl_custom_init) FATAL("Symbol 'afl_custom_init' not found.");
/* "afl_custom_deinit", required */
afl->mutator->afl_custom_deinit = dlsym(dh, "afl_custom_deinit");
if (!afl->mutator->afl_custom_deinit) FATAL("Symbol 'afl_custom_deinit' not found.");
/* "afl_custom_fuzz" or "afl_custom_mutator", required */
afl->mutator->afl_custom_fuzz = dlsym(dh, "afl_custom_fuzz");
@ -203,7 +198,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
/* Initialize trimming in the custom mutator */
afl->stage_cur = 0;
afl->stage_max = afl->mutator->afl_custom_init_trim(afl, in_buf, q->len);
afl->stage_max = afl->mutator->afl_custom_init_trim(afl->mutator->data, in_buf, q->len);
if (afl->not_on_tty && afl->debug)
SAYF("[Custom Trimming] START: Max %d iterations, %u bytes", afl->stage_max,
@ -309,54 +304,3 @@ abort_trimming:
return fault;
}
#ifdef USE_PYTHON
void load_custom_mutator_py(afl_state_t *afl, const char *module_name) {
PyObject **py_functions = afl->py_functions;
afl->mutator = ck_alloc(sizeof(struct custom_mutator));
afl->mutator->name = module_name;
ACTF("Loading Python mutator library from '%s'...", module_name);
if (py_functions[PY_FUNC_INIT]) afl->mutator->afl_custom_init = init_py;
/* "afl_custom_fuzz" should not be NULL, but the interface of Python mutator
is quite different from the custom mutator. */
afl->mutator->afl_custom_fuzz = fuzz_py;
if (py_functions[PY_FUNC_PRE_SAVE])
afl->mutator->afl_custom_pre_save = pre_save_py;
if (py_functions[PY_FUNC_INIT_TRIM])
afl->mutator->afl_custom_init_trim = init_trim_py;
if (py_functions[PY_FUNC_POST_TRIM])
afl->mutator->afl_custom_post_trim = post_trim_py;
if (py_functions[PY_FUNC_TRIM]) afl->mutator->afl_custom_trim = trim_py;
if (py_functions[PY_FUNC_HAVOC_MUTATION])
afl->mutator->afl_custom_havoc_mutation = havoc_mutation_py;
if (py_functions[PY_FUNC_HAVOC_MUTATION_PROBABILITY])
afl->mutator->afl_custom_havoc_mutation_probability =
havoc_mutation_probability_py;
if (py_functions[PY_FUNC_QUEUE_GET])
afl->mutator->afl_custom_queue_get = queue_get_py;
if (py_functions[PY_FUNC_QUEUE_NEW_ENTRY])
afl->mutator->afl_custom_queue_new_entry = queue_new_entry_py;
OKF("Python mutator '%s' installed successfully.", module_name);
/* Initialize the custom mutator */
if (afl->mutator->afl_custom_init)
afl->mutator->afl_custom_init(afl, rand_below(afl, 0xFFFFFFFF));
}
#endif