mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-11 01:31:37 +00:00
added gcc_plugin
This commit is contained in:
van Hauser
parent
3252523823
commit
8a4cdd56d4
7
Makefile
7
Makefile
@ -181,7 +181,7 @@ all_done: test_build
|
||||
.NOTPARALLEL: clean
|
||||
|
||||
clean:
|
||||
rm -f $(PROGS) afl-as as afl-g++ afl-clang afl-clang++ *.o *~ a.out core core.[1-9][0-9]* *.stackdump test .test .test1 .test2 test-instr .test-instr0 .test-instr1 qemu_mode/qemu-3.1.0.tar.xz afl-qemu-trace
|
||||
rm -f $(PROGS) afl-as as afl-g++ afl-clang afl-clang++ *.o *~ a.out core core.[1-9][0-9]* *.stackdump test .test .test1 .test2 test-instr .test-instr0 .test-instr1 qemu_mode/qemu-3.1.0.tar.xz afl-qemu-trace afl-gcc-fast afl-gcc-pass.so afl-gcc-rt.o afl-g++-fast
|
||||
rm -rf out_dir qemu_mode/qemu-3.1.0
|
||||
$(MAKE) -C llvm_mode clean
|
||||
$(MAKE) -C libdislocator clean
|
||||
@ -193,6 +193,7 @@ install: all
|
||||
install -m 755 $(PROGS) $(SH_PROGS) $${DESTDIR}$(BIN_PATH)
|
||||
rm -f $${DESTDIR}$(BIN_PATH)/afl-as
|
||||
if [ -f afl-qemu-trace ]; then install -m 755 afl-qemu-trace $${DESTDIR}$(BIN_PATH); fi
|
||||
if [ -f afl-gcc-fast ]; then set e; install -m 755 afl-gcc-fast $${DESTDIR}$(BIN_PATH); ln -sf afl-gcc-fast $${DESTDIR}$(BIN_PATH)/afl-g++-fast; install -m 755 afl-gcc-pass.so afl-gcc-rt.o $${DESTDIR}$(HELPER_PATH); fi
|
||||
ifndef AFL_TRACE_PC
|
||||
if [ -f afl-clang-fast -a -f libLLVMInsTrim.so -a -f afl-llvm-rt.o ]; then set -e; install -m 755 afl-clang-fast $${DESTDIR}$(BIN_PATH); ln -sf afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang-fast++; install -m 755 libLLVMInsTrim.so afl-llvm-pass.so afl-llvm-rt.o $${DESTDIR}$(HELPER_PATH); fi
|
||||
else
|
||||
@ -204,7 +205,9 @@ endif
|
||||
if [ -f split-compares-pass.so ]; then set -e; install -m 755 split-compares-pass.so $${DESTDIR}$(HELPER_PATH); fi
|
||||
if [ -f split-switches-pass.so ]; then set -e; install -m 755 split-switches-pass.so $${DESTDIR}$(HELPER_PATH); fi
|
||||
|
||||
set -e; for i in afl-g++ afl-clang afl-clang++; do ln -sf afl-gcc $${DESTDIR}$(BIN_PATH)/$$i; done
|
||||
set -e; ln -sf afl-gcc $${DESTDIR}$(BIN_PATH)/afl-g++
|
||||
set -e; if [ -f afl-clang-fast ] ; then ln -sf afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang ; ln -sf afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang++ ; else ln -sf afl-gcc $${DESTDIR}$(BIN_PATH)/afl-clang ; ln -sf afl-gcc $${DESTDIR}$(BIN_PATH)/afl-clang++; fi
|
||||
|
||||
install -m 755 afl-as $${DESTDIR}$(HELPER_PATH)
|
||||
ln -sf afl-as $${DESTDIR}$(HELPER_PATH)/as
|
||||
install -m 644 docs/README docs/ChangeLog docs/*.txt $${DESTDIR}$(DOC_PATH)
|
||||
|
||||
62
afl-fuzz.c
62
afl-fuzz.c
@ -5234,6 +5234,7 @@ static u32 calculate_score(struct queue_entry* q) {
|
||||
|
||||
// MOpt mode
|
||||
if (limit_time_sig != 0 && max_depth - q->depth < 3) perf_score *= 2;
|
||||
else if (perf_score < 1) perf_score = 1; // Add a lower bound to AFLFast's energy assignment strategies
|
||||
|
||||
/* Make sure that we don't go over limit. */
|
||||
|
||||
@ -10224,8 +10225,7 @@ static u8 core_fuzzing(char** argv) {
|
||||
stage_max = (doing_det ? HAVOC_CYCLES_INIT : HAVOC_CYCLES) *
|
||||
perf_score / havoc_div / 100;
|
||||
|
||||
}
|
||||
else {
|
||||
} else {
|
||||
|
||||
static u8 tmp[32];
|
||||
|
||||
@ -10243,20 +10243,13 @@ static u8 core_fuzzing(char** argv) {
|
||||
|
||||
//for (; swarm_now < swarm_num; swarm_now++)
|
||||
{
|
||||
|
||||
|
||||
if (key_puppet == 1)
|
||||
{
|
||||
if (unlikely(orig_hit_cnt_puppet == 0))
|
||||
{
|
||||
if (key_puppet == 1) {
|
||||
if (unlikely(orig_hit_cnt_puppet == 0)) {
|
||||
orig_hit_cnt_puppet = queued_paths + unique_crashes;
|
||||
last_limit_time_start = get_cur_time();
|
||||
|
||||
SPLICE_CYCLES_puppet = (UR(SPLICE_CYCLES_puppet_up - SPLICE_CYCLES_puppet_low + 1) + SPLICE_CYCLES_puppet_low);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
{
|
||||
havoc_stage_puppet:
|
||||
|
||||
@ -10266,14 +10259,11 @@ static u8 core_fuzzing(char** argv) {
|
||||
splice_cycle variable is set, generate different descriptions and such. */
|
||||
|
||||
if (!splice_cycle) {
|
||||
|
||||
stage_name = "MOpt core avoc";
|
||||
stage_short = "MOpt core havoc";
|
||||
stage_max = (doing_det ? HAVOC_CYCLES_INIT : HAVOC_CYCLES) *
|
||||
perf_score / havoc_div / 100;
|
||||
|
||||
}
|
||||
else {
|
||||
} else {
|
||||
static u8 tmp[32];
|
||||
perf_score = orig_perf;
|
||||
sprintf(tmp, "MOpt core splice %u", splice_cycle);
|
||||
@ -10282,31 +10272,20 @@ static u8 core_fuzzing(char** argv) {
|
||||
stage_max = SPLICE_HAVOC * perf_score / havoc_div / 100;
|
||||
}
|
||||
|
||||
|
||||
|
||||
if (stage_max < HAVOC_MIN) stage_max = HAVOC_MIN;
|
||||
|
||||
temp_len = len;
|
||||
|
||||
orig_hit_cnt = queued_paths + unique_crashes;
|
||||
|
||||
havoc_queued = queued_paths;
|
||||
|
||||
|
||||
|
||||
for (stage_cur = 0; stage_cur < stage_max; stage_cur++) {
|
||||
|
||||
u32 use_stacking = 1 << (1 + UR(HAVOC_STACK_POW2));
|
||||
|
||||
stage_cur_val = use_stacking;
|
||||
|
||||
|
||||
for (i = 0; i < operator_num; i++)
|
||||
{
|
||||
for (i = 0; i < operator_num; i++) {
|
||||
core_operator_cycles_puppet_v3[i] = core_operator_cycles_puppet_v2[i];
|
||||
}
|
||||
|
||||
|
||||
for (i = 0; i < use_stacking; i++) {
|
||||
|
||||
switch (select_algorithm()) {
|
||||
@ -10366,8 +10345,7 @@ static u8 core_fuzzing(char** argv) {
|
||||
if (UR(2)) {
|
||||
u32 pos = UR(temp_len - 1);
|
||||
*(u16*)(out_buf + pos) -= 1 + UR(ARITH_MAX);
|
||||
}
|
||||
else {
|
||||
} else {
|
||||
u32 pos = UR(temp_len - 1);
|
||||
u16 num = 1 + UR(ARITH_MAX);
|
||||
*(u16*)(out_buf + pos) =
|
||||
@ -10377,8 +10355,7 @@ static u8 core_fuzzing(char** argv) {
|
||||
if (UR(2)) {
|
||||
u32 pos = UR(temp_len - 1);
|
||||
*(u16*)(out_buf + pos) += 1 + UR(ARITH_MAX);
|
||||
}
|
||||
else {
|
||||
} else {
|
||||
u32 pos = UR(temp_len - 1);
|
||||
u16 num = 1 + UR(ARITH_MAX);
|
||||
*(u16*)(out_buf + pos) =
|
||||
@ -10394,8 +10371,7 @@ static u8 core_fuzzing(char** argv) {
|
||||
if (UR(2)) {
|
||||
u32 pos = UR(temp_len - 3);
|
||||
*(u32*)(out_buf + pos) -= 1 + UR(ARITH_MAX);
|
||||
}
|
||||
else {
|
||||
} else {
|
||||
u32 pos = UR(temp_len - 3);
|
||||
u32 num = 1 + UR(ARITH_MAX);
|
||||
*(u32*)(out_buf + pos) =
|
||||
@ -10405,8 +10381,7 @@ static u8 core_fuzzing(char** argv) {
|
||||
if (UR(2)) {
|
||||
u32 pos = UR(temp_len - 3);
|
||||
*(u32*)(out_buf + pos) += 1 + UR(ARITH_MAX);
|
||||
}
|
||||
else {
|
||||
} else {
|
||||
u32 pos = UR(temp_len - 3);
|
||||
u32 num = 1 + UR(ARITH_MAX);
|
||||
*(u32*)(out_buf + pos) =
|
||||
@ -10429,8 +10404,7 @@ static u8 core_fuzzing(char** argv) {
|
||||
if (UR(2)) {
|
||||
*(u16*)(out_buf + UR(temp_len - 1)) =
|
||||
interesting_16[UR(sizeof(interesting_16) >> 1)];
|
||||
}
|
||||
else {
|
||||
} else {
|
||||
*(u16*)(out_buf + UR(temp_len - 1)) = SWAP16(
|
||||
interesting_16[UR(sizeof(interesting_16) >> 1)]);
|
||||
}
|
||||
@ -10446,8 +10420,7 @@ static u8 core_fuzzing(char** argv) {
|
||||
if (UR(2)) {
|
||||
*(u32*)(out_buf + UR(temp_len - 3)) =
|
||||
interesting_32[UR(sizeof(interesting_32) >> 2)];
|
||||
}
|
||||
else {
|
||||
} else {
|
||||
*(u32*)(out_buf + UR(temp_len - 3)) = SWAP32(
|
||||
interesting_32[UR(sizeof(interesting_32) >> 2)]);
|
||||
}
|
||||
@ -10466,7 +10439,6 @@ static u8 core_fuzzing(char** argv) {
|
||||
break;
|
||||
|
||||
|
||||
|
||||
case 13: {
|
||||
|
||||
/* Delete bytes. We're making this a bit more likely
|
||||
@ -10507,8 +10479,7 @@ static u8 core_fuzzing(char** argv) {
|
||||
clone_len = choose_block_len(temp_len);
|
||||
clone_from = UR(temp_len - clone_len + 1);
|
||||
|
||||
}
|
||||
else {
|
||||
} else {
|
||||
|
||||
clone_len = choose_block_len(HAVOC_BLK_XL);
|
||||
clone_from = 0;
|
||||
@ -10575,17 +10546,10 @@ static u8 core_fuzzing(char** argv) {
|
||||
|
||||
}
|
||||
|
||||
|
||||
tmp_core_time += 1;
|
||||
|
||||
|
||||
|
||||
|
||||
u64 temp_total_found = queued_paths + unique_crashes;
|
||||
|
||||
|
||||
|
||||
|
||||
if (common_fuzz_stuff(argv, out_buf, temp_len))
|
||||
goto abandon_entry_puppet;
|
||||
|
||||
|
||||
@ -17,6 +17,10 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
|
||||
Version ++2.52d (tbd):
|
||||
-----------------------------
|
||||
|
||||
- if llvm_mode was compiled, afl-clang/afl-clang++ will point to these
|
||||
instead of afl-gcc
|
||||
- added gcc_plugin which is like llvm_mode but for gcc. This version
|
||||
supports gcc version 5 to 8. See gcc_plugin/README (https://github.com/T12z/afl)
|
||||
- added instrim, a much faster llvm_mode instrumentation at the cost of
|
||||
path discovery. See llvm_mode/README.instrim (https://github.com/csienslab/instrim)
|
||||
- added MOpt (github.com/puppet-meteor/MOpt-AFL) mode, see docs/README.MOpt
|
||||
|
||||
@ -17,6 +17,7 @@ afl-qemu-optimize-entrypoint.diff by mh(at)mh-sec(dot)de
|
||||
afl-qemu-speed.diff by abiondo on github
|
||||
afl-qemu-optimize-map.diff by mh(at)mh-sec(dot)de
|
||||
|
||||
+ gcc_plugin (https://github.com/T12z/afl)
|
||||
+ instrim (https://github.com/csienslab/instrim) was integrated
|
||||
+ MOpt (github.com/puppet-meteor/MOpt-AFL) was imported
|
||||
+ AFLfast additions (github.com/mboehme/aflfast) were incorporated.
|
||||
|
||||
@ -25,6 +25,9 @@ american fuzzy lop plus plus
|
||||
Also newly integrated is instrim, a very effective CFG llvm_mode
|
||||
instrumentation implementation from https://github.com/csienslab/instrim
|
||||
|
||||
Similar to llvm_mode a gcc_plugin that supports versions 5 to 8 is
|
||||
now available (from https://github.com/T12z/afl)
|
||||
|
||||
A more thorough list is available in the PATCHES file.
|
||||
|
||||
So all in all this is the best-of AFL that is currently out there :-)
|
||||
|
||||
75
gcc_plugin/Makefile
Normal file
75
gcc_plugin/Makefile
Normal file
@ -0,0 +1,75 @@
|
||||
#
|
||||
# american fuzzy lop - GCC plugin instrumentation
|
||||
# -----------------------------------------------
|
||||
#
|
||||
# Written by Austin Seipp <aseipp@pobox.com> and
|
||||
# Laszlo Szekeres <lszekeres@google.com> and
|
||||
# Michal Zalewski <lcamtuf@google.com>
|
||||
#
|
||||
# GCC integration design is based on the LLVM design, which comes
|
||||
# from Laszlo Szekeres.
|
||||
#
|
||||
# Copyright 2015 Google Inc. All rights reserved.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at:
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
|
||||
PREFIX ?= /usr/local
|
||||
HELPER_PATH = $(PREFIX)/lib/afl
|
||||
BIN_PATH = $(PREFIX)/bin
|
||||
|
||||
CFLAGS ?= -O3 -g -funroll-loops
|
||||
CFLAGS += -Wall -D_FORTIFY_SOURCE=2 -Wno-pointer-sign \
|
||||
-DAFL_PATH=\"$(HELPER_PATH)\" -DBIN_PATH=\"$(BIN_PATH)\" \
|
||||
|
||||
CXXFLAGS ?= -O3 -g -funroll-loops
|
||||
CXXEFLAGS := $(CXXFLAGS) -Wall -D_FORTIFY_SOURCE=2
|
||||
|
||||
CC ?= gcc
|
||||
CXX ?= g++
|
||||
|
||||
PLUGIN_FLAGS = -fPIC -fno-rtti -I"$(shell $(CC) -print-file-name=plugin)/include"
|
||||
|
||||
PROGS = ../afl-gcc-fast ../afl-gcc-pass.so ../afl-gcc-rt.o
|
||||
|
||||
all: test_deps $(PROGS) test_build all_done
|
||||
|
||||
test_deps:
|
||||
@echo "[*] Checking for working '$(CC)'..."
|
||||
@which $(CC) >/dev/null 2>&1 || ( echo "[-] Oops, can't find '$(CC)'. Make sure that it's in your \$$PATH (or set \$$CC and \$$CXX)."; exit 1 )
|
||||
@echo "[*] Checking for '../afl-showmap'..."
|
||||
@test -f ../afl-showmap || ( echo "[-] Oops, can't find '../afl-showmap'. Be sure to compile AFL first."; exit 1 )
|
||||
@echo "[+] All set and ready to build."
|
||||
|
||||
../afl-gcc-fast: afl-gcc-fast.c | test_deps
|
||||
$(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
|
||||
ln -sf afl-gcc-fast ../afl-g++-fast
|
||||
|
||||
../afl-gcc-pass.so: afl-gcc-pass.so.cc | test_deps
|
||||
$(CXX) $(CXXEFLAGS) $(PLUGIN_FLAGS) -shared $< -o $@
|
||||
|
||||
../afl-gcc-rt.o: afl-gcc-rt.o.c | test_deps
|
||||
$(CC) $(CFLAGS) -fPIC -c $< -o $@
|
||||
|
||||
test_build: $(PROGS)
|
||||
@echo "[*] Testing the CC wrapper and instrumentation output..."
|
||||
# unset AFL_USE_ASAN AFL_USE_MSAN; AFL_QUIET=1 AFL_INST_RATIO=100 AFL_PATH=. AFL_CC=$(CC) ../afl-gcc-fast $(CFLAGS) ../test-instr.c -o test-instr $(LDFLAGS)
|
||||
unset AFL_USE_ASAN AFL_USE_MSAN; AFL_INST_RATIO=100 AFL_PATH=. AFL_CC=$(CC) ../afl-gcc-fast $(CFLAGS) ../test-instr.c -o test-instr $(LDFLAGS)
|
||||
echo 0 | ../afl-showmap -m none -q -o .test-instr0 ./test-instr
|
||||
echo 1 | ../afl-showmap -m none -q -o .test-instr1 ./test-instr
|
||||
@rm -f test-instr
|
||||
@cmp -s .test-instr0 .test-instr1; DR="$$?"; rm -f .test-instr0 .test-instr1; if [ "$$DR" = "0" ]; then echo; echo "Oops, the instrumentation does not seem to be behaving correctly!"; echo; echo "Please ping <lcamtuf@google.com> to troubleshoot the issue."; echo; exit 1; fi
|
||||
@echo "[+] All right, the instrumentation seems to be working!"
|
||||
|
||||
all_done: test_build
|
||||
@echo "[+] All done! You can now use '../afl-gcc-fast' to compile programs."
|
||||
|
||||
.NOTPARALLEL: clean
|
||||
|
||||
clean:
|
||||
rm -f *.o *.so *~ a.out core core.[1-9][0-9]* test-instr .test-instr0 .test-instr1
|
||||
rm -f $(PROGS) ../afl-g++-fast
|
||||
157
gcc_plugin/README.gcc
Normal file
157
gcc_plugin/README.gcc
Normal file
@ -0,0 +1,157 @@
|
||||
===========================================
|
||||
Fast GCC-based instrumentation for afl-fuzz
|
||||
===========================================
|
||||
|
||||
(See ../docs/README for the general instruction manual.)
|
||||
(See ../llvm_mode/README.llvm for the LLVM-based instrumentation.)
|
||||
|
||||
1) Introduction
|
||||
---------------
|
||||
|
||||
The code in this directory allows you to instrument programs for AFL using
|
||||
true compiler-level instrumentation, instead of the more crude
|
||||
assembly-level rewriting approach taken by afl-gcc and afl-clang. This has
|
||||
several interesting properties:
|
||||
|
||||
- The compiler can make many optimizations that are hard to pull off when
|
||||
manually inserting assembly. As a result, some slow, CPU-bound programs will
|
||||
run up to around 2x faster.
|
||||
|
||||
The gains are less pronounced for fast binaries, where the speed is limited
|
||||
chiefly by the cost of creating new processes. In such cases, the gain will
|
||||
probably stay within 10%.
|
||||
|
||||
- The instrumentation is CPU-independent. At least in principle, you should
|
||||
be able to rely on it to fuzz programs on non-x86 architectures (after
|
||||
building afl-fuzz with AFL_NOX86=1).
|
||||
|
||||
- Because the feature relies on the internals of GCC, it is gcc-specific
|
||||
and will *not* work with LLVM (see ../llvm_plugin for an alternative).
|
||||
|
||||
Once this implementation is shown to be sufficiently robust and portable, it
|
||||
will probably replace afl-gcc. For now, it can be built separately and
|
||||
co-exists with the original code.
|
||||
|
||||
The idea and much of the implementation comes from Laszlo Szekeres.
|
||||
|
||||
2) How to use
|
||||
-------------
|
||||
|
||||
In order to leverage this mechanism, you need to have GCC and the plugin headers
|
||||
installed on your system. That should be all you need. On Debian machines, these
|
||||
headers can be acquired by installing the `gcc-<VERSION>-plugin-dev` packages.
|
||||
|
||||
To build the instrumentation itself, type 'make'. This will generate binaries
|
||||
called afl-gcc-fast and afl-g++-fast in the parent directory. Once this
|
||||
is done, you can instrument third-party code in a way similar to the standard
|
||||
operating mode of AFL, e.g.:
|
||||
|
||||
CC=/path/to/afl/afl-gcc-fast ./configure [...options...]
|
||||
make
|
||||
|
||||
Be sure to also include CXX set to afl-g++-fast for C++ code.
|
||||
|
||||
The tool honors roughly the same environmental variables as afl-gcc (see
|
||||
../docs/env_variables.txt). This includes AFL_INST_RATIO, AFL_USE_ASAN,
|
||||
AFL_HARDEN, and AFL_DONT_OPTIMIZE.
|
||||
|
||||
Note: if you want the GCC plugin to be installed on your system for all
|
||||
users, you need to build it before issuing 'make install' in the parent
|
||||
directory.
|
||||
|
||||
3) Gotchas, feedback, bugs
|
||||
--------------------------
|
||||
|
||||
This is an early-stage mechanism, so field reports are welcome. You can send bug
|
||||
reports to <aseipp@pobox.com>.
|
||||
|
||||
4) Bonus feature #1: deferred instrumentation
|
||||
---------------------------------------------
|
||||
|
||||
AFL tries to optimize performance by executing the targeted binary just once,
|
||||
stopping it just before main(), and then cloning this "master" process to get
|
||||
a steady supply of targets to fuzz.
|
||||
|
||||
Although this approach eliminates much of the OS-, linker- and libc-level
|
||||
costs of executing the program, it does not always help with binaries that
|
||||
perform other time-consuming initialization steps - say, parsing a large config
|
||||
file before getting to the fuzzed data.
|
||||
|
||||
In such cases, it's beneficial to initialize the forkserver a bit later, once
|
||||
most of the initialization work is already done, but before the binary attempts
|
||||
to read the fuzzed input and parse it; in some cases, this can offer a 10x+
|
||||
performance gain. You can implement delayed initialization in LLVM mode in a
|
||||
fairly simple way.
|
||||
|
||||
First, locate a suitable location in the code where the delayed cloning can
|
||||
take place. This needs to be done with *extreme* care to avoid breaking the
|
||||
binary. In particular, the program will probably malfunction if you select
|
||||
a location after:
|
||||
|
||||
- The creation of any vital threads or child processes - since the forkserver
|
||||
can't clone them easily.
|
||||
|
||||
- The initialization of timers via setitimer() or equivalent calls.
|
||||
|
||||
- The creation of temporary files, network sockets, offset-sensitive file
|
||||
descriptors, and similar shared-state resources - but only provided that
|
||||
their state meaningfully influences the behavior of the program later on.
|
||||
|
||||
- Any access to the fuzzed input, including reading the metadata about its
|
||||
size.
|
||||
|
||||
With the location selected, add this code in the appropriate spot:
|
||||
|
||||
#ifdef __AFL_HAVE_MANUAL_CONTROL
|
||||
__AFL_INIT();
|
||||
#endif
|
||||
|
||||
You don't need the #ifdef guards, but they will make the program still work as
|
||||
usual when compiled with a tool other than afl-gcc-fast/afl-clang-fast.
|
||||
|
||||
Finally, recompile the program with afl-gcc-fast (afl-gcc or afl-clang will
|
||||
*not* generate a deferred-initialization binary) - and you should be all set!
|
||||
|
||||
5) Bonus feature #2: persistent mode
|
||||
------------------------------------
|
||||
|
||||
Some libraries provide APIs that are stateless, or whose state can be reset in
|
||||
between processing different input files. When such a reset is performed, a
|
||||
single long-lived process can be reused to try out multiple test cases,
|
||||
eliminating the need for repeated fork() calls and the associated OS overhead.
|
||||
|
||||
The basic structure of the program that does this would be:
|
||||
|
||||
while (__AFL_LOOP(1000)) {
|
||||
|
||||
/* Read input data. */
|
||||
/* Call library code to be fuzzed. */
|
||||
/* Reset state. */
|
||||
|
||||
}
|
||||
|
||||
/* Exit normally */
|
||||
|
||||
The numerical value specified within the loop controls the maximum number
|
||||
of iterations before AFL will restart the process from scratch. This minimizes
|
||||
the impact of memory leaks and similar glitches; 1000 is a good starting point.
|
||||
|
||||
A more detailed template is shown in ../experimental/persistent_demo/.
|
||||
Similarly to the previous mode, the feature works only with afl-gcc-fast or
|
||||
afl-clang-fast; #ifdef guards can be used to suppress it when using other
|
||||
compilers.
|
||||
|
||||
Note that as with the previous mode, the feature is easy to misuse; if you
|
||||
do not reset the critical state fully, you may end up with false positives or
|
||||
waste a whole lot of CPU power doing nothing useful at all. Be particularly
|
||||
wary of memory leaks and the state of file descriptors.
|
||||
|
||||
When running in this mode, the execution paths will inherently vary a bit
|
||||
depending on whether the input loop is being entered for the first time or
|
||||
executed again. To avoid spurious warnings, the feature implies
|
||||
AFL_NO_VAR_CHECK and hides the "variable path" warnings in the UI.
|
||||
|
||||
PS. Because there are task switches still involved, the mode isn't as fast as
|
||||
"pure" in-process fuzzing offered, say, by LLVM's LibFuzzer; but it is a lot
|
||||
faster than the normal fork() model, and compared to in-process fuzzing,
|
||||
should be a lot more robust.
|
||||
283
gcc_plugin/afl-gcc-fast.c
Normal file
283
gcc_plugin/afl-gcc-fast.c
Normal file
@ -0,0 +1,283 @@
|
||||
/*
|
||||
american fuzzy lop - GCC wrapper for GCC plugin
|
||||
------------------------------------------------
|
||||
|
||||
Written by Austin Seipp <aseipp@pobox.com> and
|
||||
Laszlo Szekeres <lszekeres@google.com> and
|
||||
Michal Zalewski <lcamtuf@google.com>
|
||||
|
||||
GCC integration design is based on the LLVM design, which comes
|
||||
from Laszlo Szekeres.
|
||||
|
||||
Copyright 2015 Google Inc. All rights reserved.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at:
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
This program is a drop-in replacement for gcc, similar in most
|
||||
respects to ../afl-gcc, but with compiler instrumentation through a
|
||||
plugin. It tries to figure out compilation mode, adds a bunch of
|
||||
flags, and then calls the real compiler.
|
||||
|
||||
*/
|
||||
|
||||
#define AFL_MAIN
|
||||
|
||||
#include "../config.h"
|
||||
#include "../types.h"
|
||||
#include "../debug.h"
|
||||
#include "../alloc-inl.h"
|
||||
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
static u8* obj_path; /* Path to runtime libraries */
|
||||
static u8** cc_params; /* Parameters passed to the real CC */
|
||||
static u32 cc_par_cnt = 1; /* Param count, including argv0 */
|
||||
|
||||
|
||||
/* Try to find the runtime libraries. If that fails, abort. */
|
||||
|
||||
static void find_obj(u8* argv0) {
|
||||
|
||||
u8 *afl_path = getenv("AFL_PATH");
|
||||
u8 *slash, *tmp;
|
||||
|
||||
if (afl_path) {
|
||||
|
||||
tmp = alloc_printf("%s/afl-gcc-rt.o", afl_path);
|
||||
|
||||
if (!access(tmp, R_OK)) {
|
||||
obj_path = afl_path;
|
||||
ck_free(tmp);
|
||||
return;
|
||||
}
|
||||
|
||||
ck_free(tmp);
|
||||
|
||||
}
|
||||
|
||||
slash = strrchr(argv0, '/');
|
||||
|
||||
if (slash) {
|
||||
|
||||
u8 *dir;
|
||||
|
||||
*slash = 0;
|
||||
dir = ck_strdup(argv0);
|
||||
*slash = '/';
|
||||
|
||||
tmp = alloc_printf("%s/afl-gcc-rt.o", dir);
|
||||
|
||||
if (!access(tmp, R_OK)) {
|
||||
obj_path = dir;
|
||||
ck_free(tmp);
|
||||
return;
|
||||
}
|
||||
|
||||
ck_free(tmp);
|
||||
ck_free(dir);
|
||||
|
||||
}
|
||||
|
||||
if (!access(AFL_PATH "/afl-gcc-rt.o", R_OK)) {
|
||||
obj_path = AFL_PATH;
|
||||
return;
|
||||
}
|
||||
|
||||
FATAL("Unable to find 'afl-gcc-rt.o' or 'afl-gcc-pass.so'. Please set AFL_PATH");
|
||||
}
|
||||
|
||||
|
||||
/* Copy argv to cc_params, making the necessary edits. */
|
||||
|
||||
static void edit_params(u32 argc, char** argv) {
|
||||
|
||||
u8 fortify_set = 0, asan_set = 0, x_set = 0, maybe_linking = 1;
|
||||
u8 *name;
|
||||
|
||||
cc_params = ck_alloc((argc + 64) * sizeof(u8*));
|
||||
|
||||
name = strrchr(argv[0], '/');
|
||||
if (!name) name = argv[0]; else name++;
|
||||
|
||||
if (!strcmp(name, "afl-g++-fast")) {
|
||||
u8* alt_cxx = getenv("AFL_CXX");
|
||||
cc_params[0] = alt_cxx ? alt_cxx : (u8*)"g++";
|
||||
} else {
|
||||
u8* alt_cc = getenv("AFL_CC");
|
||||
cc_params[0] = alt_cc ? alt_cc : (u8*)"gcc";
|
||||
}
|
||||
|
||||
char* fplugin_arg = alloc_printf("-fplugin=%s/afl-gcc-pass.so", obj_path);
|
||||
cc_params[cc_par_cnt++] = fplugin_arg;
|
||||
|
||||
while (--argc) {
|
||||
u8* cur = *(++argv);
|
||||
|
||||
#if defined(__x86_64__)
|
||||
if (!strcmp(cur, "-m32")) FATAL("-m32 is not supported");
|
||||
#endif
|
||||
|
||||
if (!strcmp(cur, "-x")) x_set = 1;
|
||||
|
||||
if (!strcmp(cur, "-c") || !strcmp(cur, "-S") || !strcmp(cur, "-E") ||
|
||||
!strcmp(cur, "-v")) maybe_linking = 0;
|
||||
|
||||
if (!strcmp(cur, "-fsanitize=address") ||
|
||||
!strcmp(cur, "-fsanitize=memory")) asan_set = 1;
|
||||
|
||||
if (strstr(cur, "FORTIFY_SOURCE")) fortify_set = 1;
|
||||
|
||||
cc_params[cc_par_cnt++] = cur;
|
||||
|
||||
}
|
||||
|
||||
if (getenv("AFL_HARDEN")) {
|
||||
|
||||
cc_params[cc_par_cnt++] = "-fstack-protector-all";
|
||||
|
||||
if (!fortify_set)
|
||||
cc_params[cc_par_cnt++] = "-D_FORTIFY_SOURCE=2";
|
||||
|
||||
}
|
||||
|
||||
if (!asan_set) {
|
||||
|
||||
if (getenv("AFL_USE_ASAN")) {
|
||||
|
||||
cc_params[cc_par_cnt++] = "-fsanitize=address";
|
||||
|
||||
if (getenv("AFL_USE_MSAN"))
|
||||
FATAL("ASAN and MSAN are mutually exclusive");
|
||||
|
||||
} else if (getenv("AFL_USE_MSAN")) {
|
||||
|
||||
cc_params[cc_par_cnt++] = "-fsanitize=memory";
|
||||
|
||||
if (getenv("AFL_USE_ASAN"))
|
||||
FATAL("ASAN and MSAN are mutually exclusive");
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
if (!getenv("AFL_DONT_OPTIMIZE")) {
|
||||
|
||||
cc_params[cc_par_cnt++] = "-g";
|
||||
cc_params[cc_par_cnt++] = "-O3";
|
||||
cc_params[cc_par_cnt++] = "-funroll-loops";
|
||||
|
||||
}
|
||||
|
||||
cc_params[cc_par_cnt++] = "-D__AFL_HAVE_MANUAL_CONTROL=1";
|
||||
|
||||
/* When the user tries to use persistent or deferred forkserver modes by
|
||||
appending a single line to the program, we want to reliably inject a
|
||||
signature into the binary (to be picked up by afl-fuzz) and we want
|
||||
to call a function from the runtime .o file. This is unnecessarily
|
||||
painful for three reasons:
|
||||
|
||||
1) We need to convince the compiler not to optimize out the signature.
|
||||
This is done with __attribute__((used)).
|
||||
|
||||
2) We need to convince the linker, when called with -Wl,--gc-sections,
|
||||
not to do the same. This is done by forcing an assignment to a
|
||||
'volatile' pointer.
|
||||
|
||||
3) We need to declare __afl_persistent_loop() in the global namespace,
|
||||
but doing this within a method in a class is hard - :: and extern "C"
|
||||
are forbidden and __attribute__((alias(...))) doesn't work. Hence the
|
||||
__asm__ aliasing trick.
|
||||
|
||||
*/
|
||||
|
||||
cc_params[cc_par_cnt++] = "-D__AFL_LOOP(_A)="
|
||||
"({ static volatile char *_B __attribute__((used)); "
|
||||
" _B = (char*)\"" PERSIST_SIG "\"; "
|
||||
#ifdef __APPLE__
|
||||
"int _L(unsigned int) __asm__(\"___afl_persistent_loop\"); "
|
||||
#else
|
||||
"int _L(unsigned int) __asm__(\"__afl_persistent_loop\"); "
|
||||
#endif /* ^__APPLE__ */
|
||||
"_L(_A); })";
|
||||
|
||||
cc_params[cc_par_cnt++] = "-D__AFL_INIT()="
|
||||
"do { static volatile char *_A __attribute__((used)); "
|
||||
" _A = (char*)\"" DEFER_SIG "\"; "
|
||||
#ifdef __APPLE__
|
||||
"void _I(void) __asm__(\"___afl_manual_init\"); "
|
||||
#else
|
||||
"void _I(void) __asm__(\"__afl_manual_init\"); "
|
||||
#endif /* ^__APPLE__ */
|
||||
"_I(); } while (0)";
|
||||
|
||||
if (maybe_linking) {
|
||||
|
||||
if (x_set) {
|
||||
cc_params[cc_par_cnt++] = "-x";
|
||||
cc_params[cc_par_cnt++] = "none";
|
||||
}
|
||||
|
||||
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-gcc-rt.o", obj_path);
|
||||
|
||||
}
|
||||
|
||||
cc_params[cc_par_cnt] = NULL;
|
||||
|
||||
}
|
||||
|
||||
|
||||
/* Main entry point */
|
||||
|
||||
int main(int argc, char** argv) {
|
||||
|
||||
if (isatty(2) && !getenv("AFL_QUIET")) {
|
||||
|
||||
SAYF(cCYA "afl-gcc-fast" cRST " initial version 1.94 by <aseipp@pobox.com>, updated to " cBRI VERSION cRST " by <thorsten.schulz@uni-rostock.de>\n");
|
||||
|
||||
}
|
||||
|
||||
if (argc < 2) {
|
||||
|
||||
SAYF("\n"
|
||||
"This is a helper application for afl-fuzz. It serves as a drop-in replacement\n"
|
||||
"for gcc, letting you recompile third-party code with the required runtime\n"
|
||||
"instrumentation. A common use pattern would be one of the following:\n\n"
|
||||
|
||||
" CC=%s/afl-gcc-fast ./configure\n"
|
||||
" CXX=%s/afl-g++-fast ./configure\n\n"
|
||||
|
||||
"In contrast to the traditional afl-gcc tool, this version is implemented as\n"
|
||||
"a GCC plugin and tends to offer improved performance with slow programs\n"
|
||||
"(similarly to the LLVM plugin used by afl-clang-fast).\n\n"
|
||||
|
||||
"You can specify custom next-stage toolchain via AFL_CC and AFL_CXX. Setting\n"
|
||||
"AFL_HARDEN enables hardening optimizations in the compiled code.\n\n",
|
||||
BIN_PATH, BIN_PATH);
|
||||
|
||||
exit(1);
|
||||
|
||||
}
|
||||
|
||||
|
||||
find_obj(argv[0]);
|
||||
|
||||
edit_params(argc, argv);
|
||||
/*if (isatty(2) && !getenv("AFL_QUIET")) {
|
||||
printf("Calling \"%s\" with:\n", cc_params[0]);
|
||||
for(int i=1; i<cc_par_cnt; i++) printf("%s\n", cc_params[i]);
|
||||
}
|
||||
*/
|
||||
execvp(cc_params[0], (char**)cc_params);
|
||||
|
||||
FATAL("Oops, failed to execute '%s' - check your PATH", cc_params[0]);
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
372
gcc_plugin/afl-gcc-pass.so.cc
Normal file
372
gcc_plugin/afl-gcc-pass.so.cc
Normal file
@ -0,0 +1,372 @@
|
||||
//
|
||||
// There are two TODOs in this file:
|
||||
// - dont instrument blocks that are uninterested
|
||||
// - implement whitelist feature
|
||||
//
|
||||
|
||||
/*
|
||||
american fuzzy lop - GCC instrumentation pass
|
||||
---------------------------------------------
|
||||
|
||||
Written by Austin Seipp <aseipp@pobox.com> with bits from
|
||||
Emese Revfy <re.emese@gmail.com>
|
||||
|
||||
Updated by Thorsten Schulz <thorsten.schulz@uni-rostock.de>
|
||||
|
||||
GCC integration design is based on the LLVM design, which comes
|
||||
from Laszlo Szekeres. Some of the boilerplate code below for
|
||||
afl_pass to adapt to different GCC versions was taken from Emese
|
||||
Revfy's Size Overflow plugin for GCC, licensed under the GPLv2/v3.
|
||||
|
||||
(NOTE: this plugin code is under GPLv3, in order to comply with the
|
||||
GCC runtime library exception, which states that you may distribute
|
||||
"Target Code" from the compiler under a license of your choice, as
|
||||
long as the "Compilation Process" is "Eligible", and contains no
|
||||
GPL-incompatible software in GCC "during the process of
|
||||
transforming high level code to target code". In this case, the
|
||||
plugin will be used to generate "Target Code" during the
|
||||
"Compilation Process", and thus it must be GPLv3 to be "eligible".)
|
||||
|
||||
Copyright (C) 2015 Austin Seipp
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
*/
|
||||
|
||||
//#define BUILD_INLINE_INST
|
||||
|
||||
#include "../config.h"
|
||||
#include "../debug.h"
|
||||
|
||||
/* clear helper AFL types pulls in, which intervene with gcc-plugin geaders from GCC-8 */
|
||||
#ifdef likely
|
||||
#undef likely
|
||||
#endif
|
||||
#ifdef unlikely
|
||||
#undef unlikely
|
||||
#endif
|
||||
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include <gcc-plugin.h>
|
||||
#include <plugin-version.h>
|
||||
#include <diagnostic.h>
|
||||
#include <tree.h>
|
||||
#include <tree-ssa.h>
|
||||
#include <tree-pass.h>
|
||||
#include <tree-ssa-alias.h>
|
||||
#include <basic-block.h>
|
||||
#include <gimple-expr.h>
|
||||
#include <gimple.h>
|
||||
#include <gimple-iterator.h>
|
||||
#include <version.h>
|
||||
#include <toplev.h>
|
||||
#include <intl.h>
|
||||
#include <context.h>
|
||||
#include <stringpool.h>
|
||||
#include <cgraph.h>
|
||||
#include <cfgloop.h>
|
||||
|
||||
/* -------------------------------------------------------------------------- */
|
||||
/* -- AFL instrumentation pass ---------------------------------------------- */
|
||||
|
||||
static int be_quiet = 0;
|
||||
static unsigned int inst_ratio = 100;
|
||||
static bool inst_ext = true; /* I reckon inline is broken / unfunctional */
|
||||
|
||||
|
||||
static unsigned int ext_call_instrument(function *fun) {
|
||||
/* Instrument all the things! */
|
||||
basic_block bb;
|
||||
unsigned finst_blocks = 0;
|
||||
unsigned fcnt_blocks = 0;
|
||||
|
||||
FOR_ALL_BB_FN(bb, fun) {
|
||||
gimple_seq fcall;
|
||||
gimple_seq seq = NULL;
|
||||
gimple_stmt_iterator bentry;
|
||||
|
||||
if (!fcnt_blocks++) continue; /* skip block 0 */
|
||||
|
||||
// TODO: if the predecessor does not have to destinations
|
||||
// then skip this block :TODO
|
||||
|
||||
/* Bail on this block if we trip the specified ratio */
|
||||
if (R(100) >= inst_ratio) continue;
|
||||
|
||||
/* Make up cur_loc */
|
||||
|
||||
unsigned int rand_loc = R(MAP_SIZE);
|
||||
tree cur_loc = build_int_cst(uint64_type_node, rand_loc);
|
||||
|
||||
/* Update bitmap via external call */
|
||||
/* to quote:
|
||||
* /+ Trace a basic block with some ID +/
|
||||
* void __afl_trace(u16 x);
|
||||
*/
|
||||
|
||||
tree fntype = build_function_type_list(
|
||||
void_type_node, /* return */
|
||||
uint16_type_node, /* args */
|
||||
NULL_TREE); /* done */
|
||||
tree fndecl = build_fn_decl("__afl_trace", fntype);
|
||||
TREE_STATIC(fndecl) = 1; /* Defined elsewhere */
|
||||
TREE_PUBLIC(fndecl) = 1; /* Public */
|
||||
DECL_EXTERNAL(fndecl) = 1; /* External linkage */
|
||||
DECL_ARTIFICIAL(fndecl) = 1; /* Injected by compiler */
|
||||
|
||||
fcall = gimple_build_call(fndecl, 1, cur_loc); /* generate the function _call_ to above built reference, with *1* parameter -> the random const for the location */
|
||||
gimple_seq_add_stmt(&seq, fcall); /* and insert into a sequence */
|
||||
|
||||
/* Done - grab the entry to the block and insert sequence */
|
||||
bentry = gsi_start_bb(bb);
|
||||
gsi_insert_seq_before(&bentry, seq, GSI_SAME_STMT);
|
||||
|
||||
finst_blocks++;
|
||||
}
|
||||
fcnt_blocks--; /* discard the first in the count */
|
||||
|
||||
/* Say something nice. */
|
||||
if (!be_quiet) {
|
||||
if (!finst_blocks)
|
||||
WARNF(G_("No instrumentation targets found in " cBRI "%s" cRST ),
|
||||
function_name(fun));
|
||||
else if (finst_blocks < fcnt_blocks)
|
||||
OKF(G_("Instrumented %2u /%2u locations in " cBRI "%s" cRST ),
|
||||
finst_blocks, fcnt_blocks,
|
||||
function_name(fun));
|
||||
else
|
||||
OKF(G_("Instrumented %2u locations in " cBRI "%s" cRST ),
|
||||
finst_blocks,
|
||||
function_name(fun));
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static unsigned int inline_instrument(function *fun) {
|
||||
#ifdef BUILD_INLINE_INST /* ifdef inline away, so I don't have to refactor it */
|
||||
/* Instrument all the things! */
|
||||
basic_block bb;
|
||||
unsigned finst_blocks = 0;
|
||||
unsigned fcnt_blocks = 0;
|
||||
|
||||
/* Set up global type declarations */
|
||||
tree map_type = build_pointer_type(unsigned_char_type_node);
|
||||
tree map_ptr_g = build_decl(UNKNOWN_LOCATION, VAR_DECL, get_identifier_with_length("__afl_area_ptr",14), map_type);
|
||||
TREE_USED(map_ptr_g) = 1;
|
||||
TREE_STATIC(map_ptr_g) = 1; /* Defined elsewhere */
|
||||
DECL_EXTERNAL(map_ptr_g) = 1; /* External linkage */
|
||||
DECL_PRESERVE_P(map_ptr_g) = 1;
|
||||
DECL_ARTIFICIAL(map_ptr_g) = 1;
|
||||
rest_of_decl_compilation(map_ptr_g, 1, 0);
|
||||
|
||||
tree prev_loc_g = build_decl(UNKNOWN_LOCATION, VAR_DECL, get_identifier_with_length("__afl_prev_loc",14), uint16_type_node);
|
||||
TREE_USED(prev_loc_g) = 1;
|
||||
TREE_STATIC(prev_loc_g) = 1; /* Defined elsewhere */
|
||||
DECL_EXTERNAL(prev_loc_g) = 1; /* External linkage */
|
||||
DECL_PRESERVE_P(prev_loc_g) = 1;
|
||||
DECL_ARTIFICIAL(prev_loc_g) = 1;
|
||||
rest_of_decl_compilation(prev_loc_g, 1, 0);
|
||||
|
||||
FOR_ALL_BB_FN(bb, fun) {
|
||||
gimple *g;
|
||||
gimple_seq seq = NULL;
|
||||
gimple_stmt_iterator bentry;
|
||||
|
||||
if (!fcnt_blocks++) continue; /* skip block 0 */
|
||||
|
||||
/* Bail on this block if we trip the specified ratio */
|
||||
if (R(100) >= inst_ratio) continue;
|
||||
|
||||
/* Make up cur_loc */
|
||||
|
||||
unsigned int rand_loc = R(MAP_SIZE);
|
||||
tree cur_loc = build_int_cst(uint64_type_node, rand_loc);
|
||||
|
||||
/* Load prev_loc, xor with cur_loc */
|
||||
|
||||
tree area_off = create_tmp_var(uint64_type_node, "area_off");
|
||||
g = gimple_build_assign(area_off, BIT_XOR_EXPR, prev_loc_g, cur_loc);
|
||||
gimple_seq_add_stmt(&seq, g); // area_off = prev_loc ^ cur_loc
|
||||
|
||||
/* Update bitmap */
|
||||
|
||||
// tree zero = build_int_cst(unsigned_char_type_node, 0);
|
||||
tree one = build_int_cst(unsigned_char_type_node, 1);
|
||||
|
||||
tree tmp1 = create_tmp_var(map_type, "tmp1");
|
||||
g = gimple_build_assign(tmp1, PLUS_EXPR, map_ptr_g, area_off);
|
||||
gimple_seq_add_stmt(&seq, g); // tmp1 = __afl_area_ptr + area_off
|
||||
SAYF(G_("%d,"), fcnt_blocks);
|
||||
|
||||
tree tmp2 = create_tmp_var(unsigned_char_type_node, "tmp2");
|
||||
//tree tmp1_ptr = build_simple_mem_ref_loc(UNKNOWN_LOCATION, tmp1);
|
||||
g = gimple_build_assign(tmp2, INDIRECT_REF, tmp1);
|
||||
gimple_seq_add_stmt(&seq, g); // tmp2 = *tmp1
|
||||
|
||||
tree tmp3 = create_tmp_var(unsigned_char_type_node, "tmp3");
|
||||
g = gimple_build_assign(tmp3, PLUS_EXPR, tmp2, one);
|
||||
gimple_seq_add_stmt(&seq, g); // tmp3 = tmp2 + 1
|
||||
|
||||
// tree tmp4 = create_tmp_var(map_type, "tmp4");
|
||||
// g = gimple_build_assign(tmp4, PLUS_EXPR, map_ptr_g, area_off);
|
||||
// gimple_seq_add_stmt(&seq, g); // tmp4 = __afl_area_ptr + area_off
|
||||
|
||||
// tree deref2 = build2(MEM_REF, map_type, tmp4, zero);
|
||||
tree deref2 = build4(ARRAY_REF, map_type, map_ptr_g, area_off, NULL, NULL);
|
||||
g = gimple_build_assign(deref2, MODIFY_EXPR, tmp3);
|
||||
gimple_seq_add_stmt(&seq, g); // *tmp4 = tmp3
|
||||
SAYF(G_("+%d,"), fcnt_blocks);
|
||||
|
||||
/* Set prev_loc to cur_loc >> 1 */
|
||||
|
||||
tree shifted_loc = build_int_cst(TREE_TYPE(prev_loc_g), rand_loc >> 1);
|
||||
g = gimple_build_assign(prev_loc_g, MODIFY_EXPR, shifted_loc);
|
||||
gimple_seq_add_stmt(&seq, g); // __afl_pred_loc = cur_loc >> 1
|
||||
|
||||
/* Done - grab the entry to the block and insert sequence */
|
||||
|
||||
bentry = gsi_start_bb(bb);
|
||||
gsi_insert_seq_before(&bentry, seq, GSI_SAME_STMT);
|
||||
|
||||
inst_blocks++;
|
||||
finst_blocks++;
|
||||
}
|
||||
|
||||
/* Say something nice. */
|
||||
if (!be_quiet) {
|
||||
if (!finst_blocks)
|
||||
WARNF(G_("No instrumentation targets found in " cBRI "%s" cRST ),
|
||||
function_name(fun));
|
||||
else if (finst_blocks < fcnt_blocks)
|
||||
OKF(G_("Instrumented %2u /%2u locations in " cBRI "%s" cRST ),
|
||||
finst_blocks, fcnt_blocks,
|
||||
function_name(fun));
|
||||
else
|
||||
OKF(G_("Instrumented %2u locations in " cBRI "%s" cRST ),
|
||||
finst_blocks,
|
||||
function_name(fun));
|
||||
}
|
||||
|
||||
#endif
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* -------------------------------------------------------------------------- */
|
||||
/* -- Boilerplate and initialization ---------------------------------------- */
|
||||
|
||||
static const struct pass_data afl_pass_data = {
|
||||
|
||||
.type = GIMPLE_PASS,
|
||||
.name = "afl-inst",
|
||||
.optinfo_flags = OPTGROUP_NONE,
|
||||
|
||||
.tv_id = TV_NONE,
|
||||
.properties_required = 0,
|
||||
.properties_provided = 0,
|
||||
.properties_destroyed = 0,
|
||||
.todo_flags_start = 0,
|
||||
// NOTE(aseipp): it's very, very important to include
|
||||
// at least 'TODO_update_ssa' here so that GCC will
|
||||
// properly update the resulting SSA form, e.g., to
|
||||
// include new PHI nodes for newly added symbols or
|
||||
// names. Do not remove this. Do not taunt Happy Fun
|
||||
// Ball.
|
||||
.todo_flags_finish = TODO_update_ssa | TODO_verify_il | TODO_cleanup_cfg,
|
||||
};
|
||||
|
||||
namespace {
|
||||
|
||||
class afl_pass : public gimple_opt_pass {
|
||||
private:
|
||||
bool do_ext_call;
|
||||
|
||||
public:
|
||||
afl_pass(bool ext_call, gcc::context *g) : gimple_opt_pass(afl_pass_data, g), do_ext_call(ext_call) {}
|
||||
|
||||
virtual unsigned int execute(function *fun) {
|
||||
// TODO: implement whitelist feature here :TODO
|
||||
return do_ext_call ? ext_call_instrument(fun) : inline_instrument(fun);
|
||||
}
|
||||
}; /* class afl_pass */
|
||||
|
||||
} /* anon namespace */
|
||||
|
||||
static struct opt_pass *make_afl_pass(bool ext_call, gcc::context *ctxt) {
|
||||
return new afl_pass(ext_call, ctxt);
|
||||
}
|
||||
|
||||
/* -------------------------------------------------------------------------- */
|
||||
/* -- Initialization -------------------------------------------------------- */
|
||||
|
||||
int plugin_is_GPL_compatible = 1;
|
||||
|
||||
static struct plugin_info afl_plugin_info = {
|
||||
.version = "20181200",
|
||||
.help = "AFL gcc plugin\n",
|
||||
};
|
||||
|
||||
int plugin_init(struct plugin_name_args *plugin_info,
|
||||
struct plugin_gcc_version *version) {
|
||||
|
||||
struct register_pass_info afl_pass_info;
|
||||
struct timeval tv;
|
||||
struct timezone tz;
|
||||
u32 rand_seed;
|
||||
|
||||
/* Setup random() so we get Actually Random(TM) outputs from R() */
|
||||
gettimeofday(&tv, &tz);
|
||||
rand_seed = tv.tv_sec ^ tv.tv_usec ^ getpid();
|
||||
srandom(rand_seed);
|
||||
|
||||
/* Pass information */
|
||||
afl_pass_info.pass = make_afl_pass(inst_ext, g);
|
||||
afl_pass_info.reference_pass_name = "ssa";
|
||||
afl_pass_info.ref_pass_instance_number = 1;
|
||||
afl_pass_info.pos_op = PASS_POS_INSERT_AFTER;
|
||||
|
||||
if (!plugin_default_version_check(version, &gcc_version)) {
|
||||
FATAL(G_("Incompatible gcc/plugin versions!"));
|
||||
}
|
||||
|
||||
/* Show a banner */
|
||||
if (isatty(2) && !getenv("AFL_QUIET")) {
|
||||
SAYF(G_(cCYA "afl-gcc-pass" cRST " initial version 1.94 by <aseipp@pobox.com>, updated to " cBRI VERSION cRST " by <thorsten.schulz@uni-rostock.de>\n"));
|
||||
} else
|
||||
be_quiet = 1;
|
||||
|
||||
/* Decide instrumentation ratio */
|
||||
char* inst_ratio_str = getenv("AFL_INST_RATIO");
|
||||
|
||||
if (inst_ratio_str) {
|
||||
if (sscanf(inst_ratio_str, "%u", &inst_ratio) != 1 || !inst_ratio || inst_ratio > 100)
|
||||
FATAL(G_("Bad value of AFL_INST_RATIO (must be between 1 and 100)"));
|
||||
else {
|
||||
if (!be_quiet)
|
||||
ACTF(G_("%s instrumentation at ratio of %u%% in %s mode."),
|
||||
inst_ext ? G_("Call-based") : G_("Inline"),
|
||||
inst_ratio,
|
||||
getenv("AFL_HARDEN") ? G_("hardened") : G_("non-hardened"));
|
||||
}
|
||||
}
|
||||
|
||||
/* Go go gadget */
|
||||
register_callback(plugin_info->base_name, PLUGIN_INFO, NULL, &afl_plugin_info);
|
||||
register_callback(plugin_info->base_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &afl_pass_info);
|
||||
return 0;
|
||||
}
|
||||
224
gcc_plugin/afl-gcc-rt.o.c
Normal file
224
gcc_plugin/afl-gcc-rt.o.c
Normal file
@ -0,0 +1,224 @@
|
||||
/*
|
||||
american fuzzy lop - GCC plugin instrumentation bootstrap
|
||||
---------------------------------------------------------
|
||||
|
||||
Written by Austin Seipp <aseipp@pobox.com> and
|
||||
Laszlo Szekeres <lszekeres@google.com> and
|
||||
Michal Zalewski <lcamtuf@google.com>
|
||||
|
||||
GCC integration design is based on the LLVM design, which comes
|
||||
from Laszlo Szekeres.
|
||||
|
||||
Copyright 2015 Google Inc. All rights reserved.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at:
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
This code is the rewrite of afl-as.h's main_payload.
|
||||
|
||||
*/
|
||||
|
||||
#include "../config.h"
|
||||
#include "../types.h"
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <signal.h>
|
||||
#include <unistd.h>
|
||||
#include <assert.h>
|
||||
|
||||
#include <sys/mman.h>
|
||||
#include <sys/shm.h>
|
||||
#include <sys/wait.h>
|
||||
#include <sys/types.h>
|
||||
|
||||
|
||||
/* Globals needed by the injected instrumentation. The __afl_area_initial region
|
||||
is used for instrumentation output before __afl_map_shm() has a chance to run.
|
||||
It will end up as .comm, so it shouldn't be too wasteful. */
|
||||
|
||||
u8 __afl_area_initial[MAP_SIZE];
|
||||
u8* __afl_area_ptr = __afl_area_initial;
|
||||
u16 __afl_prev_loc;
|
||||
|
||||
|
||||
/* Running in persistent mode? */
|
||||
|
||||
static u8 is_persistent;
|
||||
|
||||
/* Trace a basic block with some ID */
|
||||
void __afl_trace(u16 x) {
|
||||
u16 l = __afl_prev_loc;
|
||||
u16 n = l ^ x;
|
||||
*(__afl_area_ptr+n) += 1;
|
||||
__afl_prev_loc = (x >> 1);
|
||||
return;
|
||||
}
|
||||
|
||||
/* SHM setup. */
|
||||
|
||||
static void __afl_map_shm(void) {
|
||||
|
||||
u8 *id_str = getenv(SHM_ENV_VAR);
|
||||
|
||||
/* If we're running under AFL, attach to the appropriate region, replacing the
|
||||
early-stage __afl_area_initial region that is needed to allow some really
|
||||
hacky .init code to work correctly in projects such as OpenSSL. */
|
||||
|
||||
if (id_str) {
|
||||
|
||||
u32 shm_id = atoi(id_str);
|
||||
|
||||
__afl_area_ptr = shmat(shm_id, NULL, 0);
|
||||
|
||||
/* Whooooops. */
|
||||
|
||||
if (__afl_area_ptr == (void *)-1) exit(1);
|
||||
|
||||
/* Write something into the bitmap so that even with low AFL_INST_RATIO,
|
||||
our parent doesn't give up on us. */
|
||||
|
||||
__afl_area_ptr[0] = 1;
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
/* Fork server logic. */
|
||||
|
||||
static void __afl_start_forkserver(void) {
|
||||
|
||||
static u8 tmp[4];
|
||||
s32 child_pid;
|
||||
|
||||
u8 child_stopped = 0;
|
||||
|
||||
/* Phone home and tell the parent that we're OK. If parent isn't there,
|
||||
assume we're not running in forkserver mode and just execute program. */
|
||||
|
||||
if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
|
||||
|
||||
while (1) {
|
||||
|
||||
u32 was_killed;
|
||||
int status;
|
||||
|
||||
/* Wait for parent by reading from the pipe. Abort if read fails. */
|
||||
|
||||
if (read(FORKSRV_FD, &was_killed, 4) != 4) exit(1);
|
||||
|
||||
/* If we stopped the child in persistent mode, but there was a race
|
||||
condition and afl-fuzz already issued SIGKILL, write off the old
|
||||
process. */
|
||||
|
||||
if (child_stopped && was_killed) {
|
||||
child_stopped = 0;
|
||||
if (waitpid(child_pid, &status, 0) < 0) exit(1);
|
||||
}
|
||||
|
||||
if (!child_stopped) {
|
||||
|
||||
/* Once woken up, create a clone of our process. */
|
||||
|
||||
child_pid = fork();
|
||||
if (child_pid < 0) exit(1);
|
||||
|
||||
/* In child process: close fds, resume execution. */
|
||||
|
||||
if (!child_pid) {
|
||||
|
||||
close(FORKSRV_FD);
|
||||
close(FORKSRV_FD + 1);
|
||||
return;
|
||||
|
||||
}
|
||||
|
||||
} else {
|
||||
|
||||
/* Special handling for persistent mode: if the child is alive but
|
||||
currently stopped, simply restart it with SIGCONT. */
|
||||
|
||||
kill(child_pid, SIGCONT);
|
||||
child_stopped = 0;
|
||||
|
||||
}
|
||||
|
||||
/* In parent process: write PID to pipe, then wait for child. */
|
||||
|
||||
if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) exit(1);
|
||||
|
||||
if (waitpid(child_pid, &status, is_persistent ? WUNTRACED : 0) < 0)
|
||||
exit(1);
|
||||
|
||||
/* In persistent mode, the child stops itself with SIGSTOP to indicate
|
||||
a successful run. In this case, we want to wake it up without forking
|
||||
again. */
|
||||
|
||||
if (WIFSTOPPED(status)) child_stopped = 1;
|
||||
|
||||
/* Relay wait status to pipe, then loop back. */
|
||||
|
||||
if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(1);
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
/* A simplified persistent mode handler, used as explained in README.llvm. */
|
||||
|
||||
int __afl_persistent_loop(unsigned int max_cnt) {
|
||||
|
||||
static u8 first_pass = 1;
|
||||
static u32 cycle_cnt;
|
||||
|
||||
if (first_pass) {
|
||||
|
||||
cycle_cnt = max_cnt;
|
||||
first_pass = 0;
|
||||
return 1;
|
||||
|
||||
}
|
||||
|
||||
if (is_persistent && --cycle_cnt) {
|
||||
|
||||
raise(SIGSTOP);
|
||||
return 1;
|
||||
|
||||
} else return 0;
|
||||
|
||||
}
|
||||
|
||||
|
||||
/* This one can be called from user code when deferred forkserver mode
|
||||
is enabled. */
|
||||
|
||||
void __afl_manual_init(void) {
|
||||
|
||||
static u8 init_done;
|
||||
|
||||
if (!init_done) {
|
||||
|
||||
__afl_map_shm();
|
||||
__afl_start_forkserver();
|
||||
init_done = 1;
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
/* Proper initialization routine. */
|
||||
|
||||
__attribute__((constructor(101))) void __afl_auto_init(void) {
|
||||
|
||||
is_persistent = !!getenv(PERSIST_ENV_VAR);
|
||||
|
||||
if (getenv(DEFER_ENV_VAR)) return;
|
||||
|
||||
__afl_manual_init();
|
||||
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user