ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-14 02:58:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

add gcc_plugin to code formatter and run it

Browse Source
This commit is contained in:
hexcoder-
2019-10-19 16:19:46 +02:00
parent 230c135d4e
commit 8a78637719
13 changed files with 509 additions and 416 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
Makefile
View File

@ -213,6 +213,9 @@ code-format:
./.custom-format.py -i llvm_mode/*.c ./.custom-format.py -i llvm_mode/*.c
./.custom-format.py -i llvm_mode/*.h ./.custom-format.py -i llvm_mode/*.h
./.custom-format.py -i llvm_mode/*.cc ./.custom-format.py -i llvm_mode/*.cc
./.custom-format.py -i gcc_plugin/*.c
./.custom-format.py -i gcc_plugin/*.h
./.custom-format.py -i gcc_plugin/*.cc
./.custom-format.py -i qemu_mode/patches/*.h ./.custom-format.py -i qemu_mode/patches/*.h
./.custom-format.py -i qemu_mode/libcompcov/*.c ./.custom-format.py -i qemu_mode/libcompcov/*.c
./.custom-format.py -i qemu_mode/libcompcov/*.cc ./.custom-format.py -i qemu_mode/libcompcov/*.cc

136
gcc_plugin/afl-gcc-fast.c
View File

@ -36,16 +36,15 @@
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
static u8* obj_path; /* Path to runtime libraries */ static u8* obj_path; /* Path to runtime libraries */
static u8** cc_params; /* Parameters passed to the real CC */ static u8** cc_params; /* Parameters passed to the real CC */
static u32 cc_par_cnt = 1; /* Param count, including argv0 */ static u32 cc_par_cnt = 1; /* Param count, including argv0 */
/* Try to find the runtime libraries. If that fails, abort. */ /* Try to find the runtime libraries. If that fails, abort. */
static void find_obj(u8* argv0) { static void find_obj(u8* argv0) {
u8 *afl_path = getenv("AFL_PATH"); u8* afl_path = getenv("AFL_PATH");
u8 *slash, *tmp; u8 *slash, *tmp;
if (afl_path) { if (afl_path) {
@ -53,9 +52,11 @@ static void find_obj(u8* argv0) {
tmp = alloc_printf("%s/afl-gcc-rt.o", afl_path); tmp = alloc_printf("%s/afl-gcc-rt.o", afl_path);
if (!access(tmp, R_OK)) { if (!access(tmp, R_OK)) {
obj_path = afl_path; obj_path = afl_path;
ck_free(tmp); ck_free(tmp);
return; return;
} }
ck_free(tmp); ck_free(tmp);
@ -66,7 +67,7 @@ static void find_obj(u8* argv0) {
if (slash) { if (slash) {
u8 *dir; u8* dir;
*slash = 0; *slash = 0;
dir = ck_strdup(argv0); dir = ck_strdup(argv0);
@ -75,9 +76,11 @@ static void find_obj(u8* argv0) {
tmp = alloc_printf("%s/afl-gcc-rt.o", dir); tmp = alloc_printf("%s/afl-gcc-rt.o", dir);
if (!access(tmp, R_OK)) { if (!access(tmp, R_OK)) {
obj_path = dir; obj_path = dir;
ck_free(tmp); ck_free(tmp);
return; return;
} }
ck_free(tmp); ck_free(tmp);
@ -86,36 +89,45 @@ static void find_obj(u8* argv0) {
} }
if (!access(AFL_PATH "/afl-gcc-rt.o", R_OK)) { if (!access(AFL_PATH "/afl-gcc-rt.o", R_OK)) {
obj_path = AFL_PATH; obj_path = AFL_PATH;
return; return;
} }
FATAL("Unable to find 'afl-gcc-rt.o' or 'afl-gcc-pass.so'. Please set AFL_PATH"); FATAL(
} "Unable to find 'afl-gcc-rt.o' or 'afl-gcc-pass.so'. Please set "
"AFL_PATH");
}
/* Copy argv to cc_params, making the necessary edits. */ /* Copy argv to cc_params, making the necessary edits. */
static void edit_params(u32 argc, char** argv) { static void edit_params(u32 argc, char** argv) {
u8 fortify_set = 0, asan_set = 0, x_set = 0, maybe_linking = 1; u8 fortify_set = 0, asan_set = 0, x_set = 0, maybe_linking = 1;
u8 *name; u8* name;
cc_params = ck_alloc((argc + 64) * sizeof(u8*)); cc_params = ck_alloc((argc + 64) * sizeof(u8*));
name = strrchr(argv[0], '/'); name = strrchr(argv[0], '/');
if (!name) name = argv[0]; else ++name; if (!name)
name = argv[0];
else
++name;
if (!strcmp(name, "afl-g++-fast")) { if (!strcmp(name, "afl-g++-fast")) {
u8* alt_cxx = getenv("AFL_CXX"); u8* alt_cxx = getenv("AFL_CXX");
cc_params[0] = alt_cxx ? alt_cxx : (u8*)"g++"; cc_params[0] = alt_cxx ? alt_cxx : (u8*)"g++";
} else { } else {
u8* alt_cc = getenv("AFL_CC"); u8* alt_cc = getenv("AFL_CC");
cc_params[0] = alt_cc ? alt_cc : (u8*)"gcc"; cc_params[0] = alt_cc ? alt_cc : (u8*)"gcc";
} }
char* fplugin_arg = alloc_printf("-fplugin=%s/afl-gcc-pass.so", obj_path); char* fplugin_arg = alloc_printf("-fplugin=%s/afl-gcc-pass.so", obj_path);
cc_params[cc_par_cnt++] = fplugin_arg; cc_params[cc_par_cnt++] = fplugin_arg;
@ -124,6 +136,7 @@ static void edit_params(u32 argc, char** argv) {
if (argc == 1 && !strcmp(argv[1], "-v")) maybe_linking = 0; if (argc == 1 && !strcmp(argv[1], "-v")) maybe_linking = 0;
while (--argc) { while (--argc) {
u8* cur = *(++argv); u8* cur = *(++argv);
#if defined(__x86_64__) #if defined(__x86_64__)
@ -133,10 +146,11 @@ static void edit_params(u32 argc, char** argv) {
if (!strcmp(cur, "-x")) x_set = 1; if (!strcmp(cur, "-x")) x_set = 1;
if (!strcmp(cur, "-c") || !strcmp(cur, "-S") || !strcmp(cur, "-E") || if (!strcmp(cur, "-c") || !strcmp(cur, "-S") || !strcmp(cur, "-E") ||
!strcmp(cur, "-v")) maybe_linking = 0; !strcmp(cur, "-v"))
maybe_linking = 0;
if (!strcmp(cur, "-fsanitize=address") || if (!strcmp(cur, "-fsanitize=address") || !strcmp(cur, "-fsanitize=memory"))
!strcmp(cur, "-fsanitize=memory")) asan_set = 1; asan_set = 1;
if (strstr(cur, "FORTIFY_SOURCE")) fortify_set = 1; if (strstr(cur, "FORTIFY_SOURCE")) fortify_set = 1;
@ -150,8 +164,7 @@ static void edit_params(u32 argc, char** argv) {
cc_params[cc_par_cnt++] = "-fstack-protector-all"; cc_params[cc_par_cnt++] = "-fstack-protector-all";
if (!fortify_set) if (!fortify_set) cc_params[cc_par_cnt++] = "-D_FORTIFY_SOURCE=2";
cc_params[cc_par_cnt++] = "-D_FORTIFY_SOURCE=2";
} }
@ -217,31 +230,37 @@ static void edit_params(u32 argc, char** argv) {
*/ */
cc_params[cc_par_cnt++] = "-D__AFL_LOOP(_A)=" cc_params[cc_par_cnt++] =
"({ static volatile char *_B __attribute__((used)); " "-D__AFL_LOOP(_A)="
" _B = (char*)\"" PERSIST_SIG "\"; " "({ static volatile char *_B __attribute__((used)); "
" _B = (char*)\"" PERSIST_SIG
"\"; "
#ifdef __APPLE__ #ifdef __APPLE__
"int _L(unsigned int) __asm__(\"___afl_persistent_loop\"); " "int _L(unsigned int) __asm__(\"___afl_persistent_loop\"); "
#else #else
"int _L(unsigned int) __asm__(\"__afl_persistent_loop\"); " "int _L(unsigned int) __asm__(\"__afl_persistent_loop\"); "
#endif /* ^__APPLE__ */ #endif /* ^__APPLE__ */
"_L(_A); })"; "_L(_A); })";
cc_params[cc_par_cnt++] = "-D__AFL_INIT()=" cc_params[cc_par_cnt++] =
"do { static volatile char *_A __attribute__((used)); " "-D__AFL_INIT()="
" _A = (char*)\"" DEFER_SIG "\"; " "do { static volatile char *_A __attribute__((used)); "
" _A = (char*)\"" DEFER_SIG
"\"; "
#ifdef __APPLE__ #ifdef __APPLE__
"void _I(void) __asm__(\"___afl_manual_init\"); " "void _I(void) __asm__(\"___afl_manual_init\"); "
#else #else
"void _I(void) __asm__(\"__afl_manual_init\"); " "void _I(void) __asm__(\"__afl_manual_init\"); "
#endif /* ^__APPLE__ */ #endif /* ^__APPLE__ */
"_I(); } while (0)"; "_I(); } while (0)";
if (maybe_linking) { if (maybe_linking) {
if (x_set) { if (x_set) {
cc_params[cc_par_cnt++] = "-x"; cc_params[cc_par_cnt++] = "-x";
cc_params[cc_par_cnt++] = "none"; cc_params[cc_par_cnt++] = "none";
} }
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-gcc-rt.o", obj_path); cc_params[cc_par_cnt++] = alloc_printf("%s/afl-gcc-rt.o", obj_path);
@ -252,46 +271,58 @@ static void edit_params(u32 argc, char** argv) {
} }
/* Main entry point */ /* Main entry point */
int main(int argc, char** argv) { int main(int argc, char** argv) {
if (argc < 2 || strcmp(argv[1], "-h") == 0) { if (argc < 2 || strcmp(argv[1], "-h") == 0) {
printf(cCYA "afl-gcc-fast" VERSION cRST " initially by <aseipp@pobox.com>, maintainer: hexcoder-\n" printf(
"\n" cCYA
"This is a helper application for afl-fuzz. It serves as a drop-in replacement\n" "afl-gcc-fast" VERSION cRST
"for gcc, letting you recompile third-party code with the required runtime\n" " initially by <aseipp@pobox.com>, maintainer: hexcoder-\n"
"instrumentation. A common use pattern would be one of the following:\n\n" "\n"
"This is a helper application for afl-fuzz. It serves as a drop-in "
"replacement\n"
"for gcc, letting you recompile third-party code with the required "
"runtime\n"
"instrumentation. A common use pattern would be one of the "
"following:\n\n"
" CC=%s/afl-gcc-fast ./configure\n" " CC=%s/afl-gcc-fast ./configure\n"
" CXX=%s/afl-g++-fast ./configure\n\n" " CXX=%s/afl-g++-fast ./configure\n\n"
"In contrast to the traditional afl-gcc tool, this version is implemented as\n" "In contrast to the traditional afl-gcc tool, this version is "
"a GCC plugin and tends to offer improved performance with slow programs\n" "implemented as\n"
"(similarly to the LLVM plugin used by afl-clang-fast).\n\n" "a GCC plugin and tends to offer improved performance with slow "
"programs\n"
"(similarly to the LLVM plugin used by afl-clang-fast).\n\n"
"You can specify custom next-stage toolchain via AFL_CC and AFL_CXX. Setting\n" "You can specify custom next-stage toolchain via AFL_CC and AFL_CXX. "
"AFL_HARDEN enables hardening optimizations in the compiled code.\n\n", "Setting\n"
BIN_PATH, BIN_PATH); "AFL_HARDEN enables hardening optimizations in the compiled code.\n\n",
BIN_PATH, BIN_PATH);
exit(1); exit(1);
} else if (isatty(2) && !getenv("AFL_QUIET")) { } else if (isatty(2) && !getenv("AFL_QUIET")) {
SAYF(cCYA "afl-gcc-fast" VERSION cRST " initially by <aseipp@pobox.com>, maintainer: hexcoder-\n"); SAYF(cCYA "afl-gcc-fast" VERSION cRST
" initially by <aseipp@pobox.com>, maintainer: hexcoder-\n");
} }
find_obj(argv[0]); find_obj(argv[0]);
edit_params(argc, argv); edit_params(argc, argv);
/*if (isatty(2) && !getenv("AFL_QUIET")) { /*if (isatty(2) && !getenv("AFL_QUIET")) {
printf("Calling \"%s\" with:\n", cc_params[0]);
for(int i=1; i<cc_par_cnt; i++) printf("%s\n", cc_params[i]); printf("Calling \"%s\" with:\n", cc_params[0]);
} for(int i=1; i<cc_par_cnt; i++) printf("%s\n", cc_params[i]);
*/
}
*/
execvp(cc_params[0], (char**)cc_params); execvp(cc_params[0], (char**)cc_params);
FATAL("Oops, failed to execute '%s' - check your PATH", cc_params[0]); FATAL("Oops, failed to execute '%s' - check your PATH", cc_params[0]);
@ -299,3 +330,4 @@ int main(int argc, char** argv) {
return 0; return 0;
} }

688
gcc_plugin/afl-gcc-pass.so.cc
View File

@ -52,7 +52,8 @@
#include "../config.h" #include "../config.h"
#include "../include/debug.h" #include "../include/debug.h"
/* clear helper AFL types pulls in, which intervene with gcc-plugin geaders from GCC-8 */ /* clear helper AFL types pulls in, which intervene with gcc-plugin geaders from
* GCC-8 */
#ifdef likely #ifdef likely
#undef likely #undef likely
#endif #endif
@ -60,7 +61,6 @@
#undef unlikely #undef unlikely
#endif #endif
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
#include <unistd.h> #include <unistd.h>
@ -92,191 +92,206 @@
/* -------------------------------------------------------------------------- */ /* -------------------------------------------------------------------------- */
/* -- AFL instrumentation pass ---------------------------------------------- */ /* -- AFL instrumentation pass ---------------------------------------------- */
static int be_quiet = 0; static int be_quiet = 0;
static unsigned int inst_ratio = 100; static unsigned int inst_ratio = 100;
static bool inst_ext = true; static bool inst_ext = true;
static std::list<std::string> myWhitelist; static std::list<std::string> myWhitelist;
static unsigned int ext_call_instrument(function *fun) { static unsigned int ext_call_instrument(function *fun) {
/* Instrument all the things! */
basic_block bb;
unsigned finst_blocks = 0;
unsigned fcnt_blocks = 0;
tree fntype = build_function_type_list( /* Instrument all the things! */
void_type_node, /* return */ basic_block bb;
uint32_type_node, /* args */ unsigned finst_blocks = 0;
NULL_TREE); /* done */ unsigned fcnt_blocks = 0;
tree fndecl = build_fn_decl("__afl_trace", fntype);
TREE_STATIC(fndecl) = 1; /* Defined elsewhere */
TREE_PUBLIC(fndecl) = 1; /* Public */
DECL_EXTERNAL(fndecl) = 1; /* External linkage */
DECL_ARTIFICIAL(fndecl) = 1; /* Injected by compiler */
FOR_EACH_BB_FN(bb, fun) { tree fntype = build_function_type_list(void_type_node, /* return */
gimple_seq fcall; uint32_type_node, /* args */
gimple_seq seq = NULL; NULL_TREE); /* done */
gimple_stmt_iterator bentry; tree fndecl = build_fn_decl("__afl_trace", fntype);
++fcnt_blocks; TREE_STATIC(fndecl) = 1; /* Defined elsewhere */
TREE_PUBLIC(fndecl) = 1; /* Public */
DECL_EXTERNAL(fndecl) = 1; /* External linkage */
DECL_ARTIFICIAL(fndecl) = 1; /* Injected by compiler */
// only instrument if this basic block is the destination of a previous FOR_EACH_BB_FN(bb, fun) {
// basic block that has multiple successors
// this gets rid of ~5-10% of instrumentations that are unnecessary
// result: a little more speed and less map pollution
int more_than_one = -1; gimple_seq fcall;
edge ep; gimple_seq seq = NULL;
edge_iterator eip; gimple_stmt_iterator bentry;
FOR_EACH_EDGE (ep, eip, bb->preds) { ++fcnt_blocks;
int count = 0;
if (more_than_one == -1)
more_than_one = 0;
basic_block Pred = ep->src; // only instrument if this basic block is the destination of a previous
edge es; // basic block that has multiple successors
edge_iterator eis; // this gets rid of ~5-10% of instrumentations that are unnecessary
FOR_EACH_EDGE (es, eis, Pred->succs) { // result: a little more speed and less map pollution
basic_block Succ = es->dest;
if (Succ != NULL) count++;
}
if (count > 1)
more_than_one = 1;
}
if (more_than_one != 1)
continue;
/* Bail on this block if we trip the specified ratio */ int more_than_one = -1;
if (R(100) >= inst_ratio) continue; edge ep;
edge_iterator eip;
FOR_EACH_EDGE(ep, eip, bb->preds) {
/* Make up cur_loc */ int count = 0;
unsigned int rand_loc = R(MAP_SIZE); if (more_than_one == -1) more_than_one = 0;
tree cur_loc = build_int_cst(uint32_type_node, rand_loc);
/* Update bitmap via external call */ basic_block Pred = ep->src;
/* to quote: edge es;
* /+ Trace a basic block with some ID +/ edge_iterator eis;
* void __afl_trace(u32 x); FOR_EACH_EDGE(es, eis, Pred->succs) {
*/
fcall = gimple_build_call(fndecl, 1, cur_loc); /* generate the function _call_ to above built reference, with *1* parameter -> the random const for the location */ basic_block Succ = es->dest;
gimple_seq_add_stmt(&seq, fcall); /* and insert into a sequence */ if (Succ != NULL) count++;
/* Done - grab the entry to the block and insert sequence */ }
bentry = gsi_after_labels(bb);
gsi_insert_seq_before(&bentry, seq, GSI_SAME_STMT);
++finst_blocks; if (count > 1) more_than_one = 1;
}
/* Say something nice. */ }
if (!be_quiet) {
if (!finst_blocks) if (more_than_one != 1) continue;
WARNF(G_("No instrumentation targets found in " cBRI "%s" cRST ),
function_name(fun)); /* Bail on this block if we trip the specified ratio */
else if (finst_blocks < fcnt_blocks) if (R(100) >= inst_ratio) continue;
OKF(G_("Instrumented %2u /%2u locations in " cBRI "%s" cRST ),
finst_blocks, fcnt_blocks, /* Make up cur_loc */
function_name(fun)); unsigned int rand_loc = R(MAP_SIZE);
else tree cur_loc = build_int_cst(uint32_type_node, rand_loc);
OKF(G_("Instrumented %2u locations in " cBRI "%s" cRST ),
finst_blocks, /* Update bitmap via external call */
function_name(fun)); /* to quote:
} * /+ Trace a basic block with some ID +/
* void __afl_trace(u32 x);
*/
fcall = gimple_build_call(
fndecl, 1,
cur_loc); /* generate the function _call_ to above built reference, with
*1* parameter -> the random const for the location */
gimple_seq_add_stmt(&seq, fcall); /* and insert into a sequence */
/* Done - grab the entry to the block and insert sequence */
bentry = gsi_after_labels(bb);
gsi_insert_seq_before(&bentry, seq, GSI_SAME_STMT);
++finst_blocks;
}
/* Say something nice. */
if (!be_quiet) {
if (!finst_blocks)
WARNF(G_("No instrumentation targets found in " cBRI "%s" cRST),
function_name(fun));
else if (finst_blocks < fcnt_blocks)
OKF(G_("Instrumented %2u /%2u locations in " cBRI "%s" cRST),
finst_blocks, fcnt_blocks, function_name(fun));
else
OKF(G_("Instrumented %2u locations in " cBRI "%s" cRST), finst_blocks,
function_name(fun));
}
return 0;
return 0;
} }
static unsigned int inline_instrument(function *fun) { static unsigned int inline_instrument(function *fun) {
/* Instrument all the things! */ /* Instrument all the things! */
basic_block bb; basic_block bb;
unsigned finst_blocks = 0; unsigned finst_blocks = 0;
unsigned fcnt_blocks = 0; unsigned fcnt_blocks = 0;
/* Set up global type declarations */ /* Set up global type declarations */
tree map_type = build_pointer_type(unsigned_char_type_node); tree map_type = build_pointer_type(unsigned_char_type_node);
tree map_ptr_g = build_decl(UNKNOWN_LOCATION, VAR_DECL, tree map_ptr_g =
get_identifier_with_length("__afl_area_ptr", 14), map_type); build_decl(UNKNOWN_LOCATION, VAR_DECL,
TREE_USED(map_ptr_g) = 1; get_identifier_with_length("__afl_area_ptr", 14), map_type);
TREE_STATIC(map_ptr_g) = 1; /* Defined elsewhere */ TREE_USED(map_ptr_g) = 1;
DECL_EXTERNAL(map_ptr_g) = 1; /* External linkage */ TREE_STATIC(map_ptr_g) = 1; /* Defined elsewhere */
DECL_PRESERVE_P(map_ptr_g) = 1; DECL_EXTERNAL(map_ptr_g) = 1; /* External linkage */
DECL_ARTIFICIAL(map_ptr_g) = 1; /* Injected by compiler */ DECL_PRESERVE_P(map_ptr_g) = 1;
rest_of_decl_compilation(map_ptr_g, 1, 0); DECL_ARTIFICIAL(map_ptr_g) = 1; /* Injected by compiler */
rest_of_decl_compilation(map_ptr_g, 1, 0);
tree prev_loc_g = build_decl(UNKNOWN_LOCATION, VAR_DECL, tree prev_loc_g = build_decl(UNKNOWN_LOCATION, VAR_DECL,
get_identifier_with_length("__afl_prev_loc", 14), uint32_type_node); get_identifier_with_length("__afl_prev_loc", 14),
TREE_USED(prev_loc_g) = 1; uint32_type_node);
TREE_STATIC(prev_loc_g) = 1; /* Defined elsewhere */ TREE_USED(prev_loc_g) = 1;
DECL_EXTERNAL(prev_loc_g) = 1; /* External linkage */ TREE_STATIC(prev_loc_g) = 1; /* Defined elsewhere */
DECL_PRESERVE_P(prev_loc_g) = 1; DECL_EXTERNAL(prev_loc_g) = 1; /* External linkage */
DECL_ARTIFICIAL(prev_loc_g) = 1; /* Injected by compiler */ DECL_PRESERVE_P(prev_loc_g) = 1;
rest_of_decl_compilation(prev_loc_g, 1, 0); DECL_ARTIFICIAL(prev_loc_g) = 1; /* Injected by compiler */
rest_of_decl_compilation(prev_loc_g, 1, 0);
FOR_EACH_BB_FN(bb, fun) { FOR_EACH_BB_FN(bb, fun) {
gimple_seq seq = NULL;
gimple_stmt_iterator bentry;
++fcnt_blocks;
// only instrument if this basic block is the destination of a previous gimple_seq seq = NULL;
// basic block that has multiple successors gimple_stmt_iterator bentry;
// this gets rid of ~5-10% of instrumentations that are unnecessary ++fcnt_blocks;
// result: a little more speed and less map pollution
int more_than_one = -1; // only instrument if this basic block is the destination of a previous
edge ep; // basic block that has multiple successors
edge_iterator eip; // this gets rid of ~5-10% of instrumentations that are unnecessary
FOR_EACH_EDGE (ep, eip, bb->preds) { // result: a little more speed and less map pollution
int count = 0;
if (more_than_one == -1)
more_than_one = 0;
basic_block Pred = ep->src; int more_than_one = -1;
edge es; edge ep;
edge_iterator eis; edge_iterator eip;
FOR_EACH_EDGE (es, eis, Pred->succs) { FOR_EACH_EDGE(ep, eip, bb->preds) {
basic_block Succ = es->dest;
if (Succ != NULL) count++;
}
if (count > 1)
more_than_one = 1;
}
if (more_than_one != 1)
continue;
/* Bail on this block if we trip the specified ratio */ int count = 0;
if (R(100) >= inst_ratio) continue; if (more_than_one == -1) more_than_one = 0;
/* Make up cur_loc */ basic_block Pred = ep->src;
edge es;
edge_iterator eis;
FOR_EACH_EDGE(es, eis, Pred->succs) {
unsigned int rand_loc = R(MAP_SIZE); basic_block Succ = es->dest;
tree cur_loc = build_int_cst(uint32_type_node, rand_loc); if (Succ != NULL) count++;
/* Load prev_loc, xor with cur_loc */ }
// gimple_assign <var_decl, prev_loc.0_1, prev_loc, NULL, NULL>
tree prev_loc = create_tmp_var_raw(uint32_type_node, "prev_loc");
gassign *g = gimple_build_assign(prev_loc, VAR_DECL, prev_loc_g);
gimple_seq_add_stmt(&seq, g); // load prev_loc
update_stmt(g);
// gimple_assign <bit_xor_expr, _2, prev_loc.0_1, 47231, NULL> if (count > 1) more_than_one = 1;
tree area_off = create_tmp_var_raw(uint32_type_node, "area_off");
g = gimple_build_assign(area_off, BIT_XOR_EXPR, prev_loc, cur_loc);
gimple_seq_add_stmt(&seq, g); // area_off = prev_loc ^ cur_loc
update_stmt(g);
/* Update bitmap */ }
tree one = build_int_cst(unsigned_char_type_node, 1); if (more_than_one != 1) continue;
// tree zero = build_int_cst(unsigned_char_type_node, 0);
// gimple_assign <addr_expr, p_6, &map[_2], NULL, NULL> /* Bail on this block if we trip the specified ratio */
tree map_ptr = create_tmp_var(map_type, "map_ptr"); if (R(100) >= inst_ratio) continue;
tree map_ptr2 = create_tmp_var(map_type, "map_ptr2");
g = gimple_build_assign(map_ptr, map_ptr_g); /* Make up cur_loc */
gimple_seq_add_stmt(&seq, g); // map_ptr = __afl_area_ptr
update_stmt(g); unsigned int rand_loc = R(MAP_SIZE);
tree cur_loc = build_int_cst(uint32_type_node, rand_loc);
/* Load prev_loc, xor with cur_loc */
// gimple_assign <var_decl, prev_loc.0_1, prev_loc, NULL, NULL>
tree prev_loc = create_tmp_var_raw(uint32_type_node, "prev_loc");
gassign *g = gimple_build_assign(prev_loc, VAR_DECL, prev_loc_g);
gimple_seq_add_stmt(&seq, g); // load prev_loc
update_stmt(g);
// gimple_assign <bit_xor_expr, _2, prev_loc.0_1, 47231, NULL>
tree area_off = create_tmp_var_raw(uint32_type_node, "area_off");
g = gimple_build_assign(area_off, BIT_XOR_EXPR, prev_loc, cur_loc);
gimple_seq_add_stmt(&seq, g); // area_off = prev_loc ^ cur_loc
update_stmt(g);
/* Update bitmap */
tree one = build_int_cst(unsigned_char_type_node, 1);
// tree zero = build_int_cst(unsigned_char_type_node, 0);
// gimple_assign <addr_expr, p_6, &map[_2], NULL, NULL>
tree map_ptr = create_tmp_var(map_type, "map_ptr");
tree map_ptr2 = create_tmp_var(map_type, "map_ptr2");
g = gimple_build_assign(map_ptr, map_ptr_g);
gimple_seq_add_stmt(&seq, g); // map_ptr = __afl_area_ptr
update_stmt(g);
#if 0 #if 0
tree addr = build2(ADDR_EXPR, map_type, map_ptr, area_off); tree addr = build2(ADDR_EXPR, map_type, map_ptr, area_off);
@ -284,68 +299,69 @@ static unsigned int inline_instrument(function *fun) {
gimple_seq_add_stmt(&seq, g); // map_ptr2 = map_ptr + area_off gimple_seq_add_stmt(&seq, g); // map_ptr2 = map_ptr + area_off
update_stmt(g); update_stmt(g);
#else #else
g = gimple_build_assign(map_ptr2, PLUS_EXPR, map_ptr, area_off); g = gimple_build_assign(map_ptr2, PLUS_EXPR, map_ptr, area_off);
gimple_seq_add_stmt(&seq, g); // map_ptr2 = map_ptr + area_off gimple_seq_add_stmt(&seq, g); // map_ptr2 = map_ptr + area_off
update_stmt(g); update_stmt(g);
#endif #endif
// gimple_assign <mem_ref, _3, *p_6, NULL, NULL> // gimple_assign <mem_ref, _3, *p_6, NULL, NULL>
tree tmp1 = create_tmp_var_raw(unsigned_char_type_node, "tmp1"); tree tmp1 = create_tmp_var_raw(unsigned_char_type_node, "tmp1");
g = gimple_build_assign(tmp1, MEM_REF, map_ptr2); g = gimple_build_assign(tmp1, MEM_REF, map_ptr2);
gimple_seq_add_stmt(&seq, g); // tmp1 = *map_ptr2 gimple_seq_add_stmt(&seq, g); // tmp1 = *map_ptr2
update_stmt(g); update_stmt(g);
// gimple_assign <plus_expr, _4, _3, 1, NULL> // gimple_assign <plus_expr, _4, _3, 1, NULL>
tree tmp2 = create_tmp_var_raw(unsigned_char_type_node, "tmp2"); tree tmp2 = create_tmp_var_raw(unsigned_char_type_node, "tmp2");
g = gimple_build_assign(tmp2, PLUS_EXPR, tmp1, one); g = gimple_build_assign(tmp2, PLUS_EXPR, tmp1, one);
gimple_seq_add_stmt(&seq, g); // tmp2 = tmp1 + 1 gimple_seq_add_stmt(&seq, g); // tmp2 = tmp1 + 1
update_stmt(g); update_stmt(g);
// TODO: neverZero: here we have to check if tmp3 == 0 // TODO: neverZero: here we have to check if tmp3 == 0
// and add 1 if so // and add 1 if so
// gimple_assign <ssa_name, *p_6, _4, NULL, NULL> // gimple_assign <ssa_name, *p_6, _4, NULL, NULL>
// tree map_ptr3 = create_tmp_var_raw(map_type, "map_ptr3"); // tree map_ptr3 = create_tmp_var_raw(map_type, "map_ptr3");
g = gimple_build_assign(map_ptr_g, INDIRECT_REF, tmp2); g = gimple_build_assign(map_ptr_g, INDIRECT_REF, tmp2);
gimple_seq_add_stmt(&seq, g); // *map_ptr3 = tmp2 gimple_seq_add_stmt(&seq, g); // *map_ptr3 = tmp2
update_stmt(g); update_stmt(g);
/* Set prev_loc to cur_loc >> 1 */ /* Set prev_loc to cur_loc >> 1 */
// gimple_assign <integer_cst, prev_loc, 23615, NULL, NULL> // gimple_assign <integer_cst, prev_loc, 23615, NULL, NULL>
tree shifted_loc = build_int_cst(TREE_TYPE(prev_loc_g), rand_loc >> 1); tree shifted_loc = build_int_cst(TREE_TYPE(prev_loc_g), rand_loc >> 1);
tree prev_loc2 = create_tmp_var_raw(uint32_type_node, "prev_loc2"); tree prev_loc2 = create_tmp_var_raw(uint32_type_node, "prev_loc2");
g = gimple_build_assign(prev_loc2, shifted_loc); g = gimple_build_assign(prev_loc2, shifted_loc);
gimple_seq_add_stmt(&seq, g); // __afl_prev_loc = cur_loc >> 1 gimple_seq_add_stmt(&seq, g); // __afl_prev_loc = cur_loc >> 1
update_stmt(g); update_stmt(g);
g = gimple_build_assign(prev_loc_g, prev_loc2); g = gimple_build_assign(prev_loc_g, prev_loc2);
gimple_seq_add_stmt(&seq, g); // __afl_prev_loc = cur_loc >> 1 gimple_seq_add_stmt(&seq, g); // __afl_prev_loc = cur_loc >> 1
update_stmt(g); update_stmt(g);
/* Done - grab the entry to the block and insert sequence */ /* Done - grab the entry to the block and insert sequence */
bentry = gsi_after_labels(bb); bentry = gsi_after_labels(bb);
gsi_insert_seq_before(&bentry, seq, GSI_NEW_STMT); gsi_insert_seq_before(&bentry, seq, GSI_NEW_STMT);
++finst_blocks; ++finst_blocks;
}
/* Say something nice. */ }
if (!be_quiet) {
if (!finst_blocks)
WARNF(G_("No instrumentation targets found in " cBRI "%s" cRST ),
function_name(fun));
else if (finst_blocks < fcnt_blocks)
OKF(G_("Instrumented %2u /%2u locations in " cBRI "%s" cRST ),
finst_blocks, fcnt_blocks,
function_name(fun));
else
OKF(G_("Instrumented %2u locations in " cBRI "%s" cRST ),
finst_blocks,
function_name(fun));
}
/* Say something nice. */
if (!be_quiet) {
if (!finst_blocks)
WARNF(G_("No instrumentation targets found in " cBRI "%s" cRST),
function_name(fun));
else if (finst_blocks < fcnt_blocks)
OKF(G_("Instrumented %2u /%2u locations in " cBRI "%s" cRST),
finst_blocks, fcnt_blocks, function_name(fun));
else
OKF(G_("Instrumented %2u locations in " cBRI "%s" cRST), finst_blocks,
function_name(fun));
}
return 0;
return 0;
} }
/* -------------------------------------------------------------------------- */ /* -------------------------------------------------------------------------- */
@ -353,80 +369,102 @@ static unsigned int inline_instrument(function *fun) {
static const struct pass_data afl_pass_data = { static const struct pass_data afl_pass_data = {
.type = GIMPLE_PASS, .type = GIMPLE_PASS,
.name = "afl-inst", .name = "afl-inst",
.optinfo_flags = OPTGROUP_NONE, .optinfo_flags = OPTGROUP_NONE,
.tv_id = TV_NONE,
.properties_required = 0,
.properties_provided = 0,
.properties_destroyed = 0,
.todo_flags_start = 0,
// NOTE(aseipp): it's very, very important to include
// at least 'TODO_update_ssa' here so that GCC will
// properly update the resulting SSA form, e.g., to
// include new PHI nodes for newly added symbols or
// names. Do not remove this. Do not taunt Happy Fun
// Ball.
.todo_flags_finish = TODO_update_ssa | TODO_verify_il | TODO_cleanup_cfg,
.tv_id = TV_NONE,
.properties_required = 0,
.properties_provided = 0,
.properties_destroyed = 0,
.todo_flags_start = 0,
// NOTE(aseipp): it's very, very important to include
// at least 'TODO_update_ssa' here so that GCC will
// properly update the resulting SSA form, e.g., to
// include new PHI nodes for newly added symbols or
// names. Do not remove this. Do not taunt Happy Fun
// Ball.
.todo_flags_finish = TODO_update_ssa | TODO_verify_il | TODO_cleanup_cfg,
}; };
namespace { namespace {
class afl_pass : public gimple_opt_pass { class afl_pass : public gimple_opt_pass {
private:
bool do_ext_call;
public: private:
afl_pass(bool ext_call, gcc::context *g) : gimple_opt_pass(afl_pass_data, g), do_ext_call(ext_call) {} bool do_ext_call;
virtual unsigned int execute(function *fun) { public:
afl_pass(bool ext_call, gcc::context *g)
: gimple_opt_pass(afl_pass_data, g), do_ext_call(ext_call) {
if (!myWhitelist.empty()) { }
bool instrumentBlock = false;
/* EXPR_FILENAME virtual unsigned int execute(function *fun) {
This macro returns the name of the file in which the entity was declared, as
a char*. For an entity declared implicitly by the compiler (like __builtin_
memcpy), this will be the string "<internal>".
*/
const char *fname = DECL_SOURCE_FILE(fun->decl);
if (0 != strncmp("<internal>", fname, 10) if (!myWhitelist.empty()) {
&& 0 != strncmp("<built-in>", fname, 10))
{
std::string instFilename(fname);
/* Continue only if we know where we actually are */ bool instrumentBlock = false;
if (!instFilename.empty()) {
for (std::list<std::string>::iterator it = myWhitelist.begin(); it != myWhitelist.end(); ++it) {
/* We don't check for filename equality here because
* filenames might actually be full paths. Instead we
* check that the actual filename ends in the filename
* specified in the list. */
if (instFilename.length() >= it->length()) {
if (instFilename.compare(instFilename.length() - it->length(), it->length(), *it) == 0) {
instrumentBlock = true;
break;
}
}
}
}
}
/* Either we couldn't figure out our location or the location is /* EXPR_FILENAME
* not whitelisted, so we skip instrumentation. */ This macro returns the name of the file in which the entity was declared,
if (!instrumentBlock) return 0; as a char*. For an entity declared implicitly by the compiler (like
} __builtin_ memcpy), this will be the string "<internal>".
*/
const char *fname = DECL_SOURCE_FILE(fun->decl);
return do_ext_call ? ext_call_instrument(fun) : inline_instrument(fun); if (0 != strncmp("<internal>", fname, 10) &&
} 0 != strncmp("<built-in>", fname, 10)) {
}; /* class afl_pass */
} /* anon namespace */ std::string instFilename(fname);
/* Continue only if we know where we actually are */
if (!instFilename.empty()) {
for (std::list<std::string>::iterator it = myWhitelist.begin();
it != myWhitelist.end(); ++it) {
/* We don't check for filename equality here because
* filenames might actually be full paths. Instead we
* check that the actual filename ends in the filename
* specified in the list. */
if (instFilename.length() >= it->length()) {
if (instFilename.compare(instFilename.length() - it->length(),
it->length(), *it) == 0) {
instrumentBlock = true;
break;
}
}
}
}
}
/* Either we couldn't figure out our location or the location is
* not whitelisted, so we skip instrumentation. */
if (!instrumentBlock) return 0;
}
return do_ext_call ? ext_call_instrument(fun) : inline_instrument(fun);
}
}; /* class afl_pass */
} // namespace
static struct opt_pass *make_afl_pass(bool ext_call, gcc::context *ctxt) { static struct opt_pass *make_afl_pass(bool ext_call, gcc::context *ctxt) {
return new afl_pass(ext_call, ctxt);
return new afl_pass(ext_call, ctxt);
} }
/* -------------------------------------------------------------------------- */ /* -------------------------------------------------------------------------- */
@ -435,71 +473,93 @@ static struct opt_pass *make_afl_pass(bool ext_call, gcc::context *ctxt) {
int plugin_is_GPL_compatible = 1; int plugin_is_GPL_compatible = 1;
static struct plugin_info afl_plugin_info = { static struct plugin_info afl_plugin_info = {
.version = "20191015",
.help = "AFL++ gcc plugin\n", .version = "20191015",
.help = "AFL++ gcc plugin\n",
}; };
int plugin_init(struct plugin_name_args *plugin_info, int plugin_init(struct plugin_name_args * plugin_info,
struct plugin_gcc_version *version) { struct plugin_gcc_version *version) {
struct register_pass_info afl_pass_info; struct register_pass_info afl_pass_info;
struct timeval tv; struct timeval tv;
struct timezone tz; struct timezone tz;
u32 rand_seed; u32 rand_seed;
/* Setup random() so we get Actually Random(TM) outputs from R() */ /* Setup random() so we get Actually Random(TM) outputs from R() */
gettimeofday(&tv, &tz); gettimeofday(&tv, &tz);
rand_seed = tv.tv_sec ^ tv.tv_usec ^ getpid(); rand_seed = tv.tv_sec ^ tv.tv_usec ^ getpid();
srandom(rand_seed); srandom(rand_seed);
/* Pass information */ /* Pass information */
afl_pass_info.pass = make_afl_pass(inst_ext, g); afl_pass_info.pass = make_afl_pass(inst_ext, g);
afl_pass_info.reference_pass_name = "ssa"; afl_pass_info.reference_pass_name = "ssa";
afl_pass_info.ref_pass_instance_number = 1; afl_pass_info.ref_pass_instance_number = 1;
afl_pass_info.pos_op = PASS_POS_INSERT_AFTER; afl_pass_info.pos_op = PASS_POS_INSERT_AFTER;
if (!plugin_default_version_check(version, &gcc_version)) { if (!plugin_default_version_check(version, &gcc_version)) {
FATAL(G_("Incompatible gcc/plugin versions!"));
}
/* Show a banner */ FATAL(G_("Incompatible gcc/plugin versions!"));
if (isatty(2) && !getenv("AFL_QUIET")) {
SAYF(G_(cCYA "afl-gcc-pass" VERSION cRST " initially by <aseipp@pobox.com>, maintainer: hexcoder-\n"));
} else
be_quiet = 1;
/* Decide instrumentation ratio */ }
char* inst_ratio_str = getenv("AFL_INST_RATIO");
if (inst_ratio_str) { /* Show a banner */
if (sscanf(inst_ratio_str, "%u", &inst_ratio) != 1 || !inst_ratio || inst_ratio > 100) if (isatty(2) && !getenv("AFL_QUIET")) {
FATAL(G_("Bad value of AFL_INST_RATIO (must be between 1 and 100)"));
else {
if (!be_quiet)
ACTF(G_("%s instrumentation at ratio of %u%% in %s mode."),
inst_ext ? G_("Call-based") : G_("Inline"),
inst_ratio,
getenv("AFL_HARDEN") ? G_("hardened") : G_("non-hardened"));
}
}
char* instWhiteListFilename = getenv("AFL_GCC_WHITELIST"); SAYF(G_(cCYA "afl-gcc-pass" VERSION cRST
if (instWhiteListFilename) { " initially by <aseipp@pobox.com>, maintainer: hexcoder-\n"));
std::string line;
std::ifstream fileStream; } else
fileStream.open(instWhiteListFilename);
if (!fileStream) be_quiet = 1;
fatal_error(0, "Unable to open AFL_GCC_WHITELIST");
getline(fileStream, line); /* Decide instrumentation ratio */
while (fileStream) { char *inst_ratio_str = getenv("AFL_INST_RATIO");
myWhitelist.push_back(line);
getline(fileStream, line); if (inst_ratio_str) {
}
} else if (!be_quiet && getenv("AFL_LLVM_WHITELIST")) if (sscanf(inst_ratio_str, "%u", &inst_ratio) != 1 || !inst_ratio ||
SAYF(cYEL "[-] " cRST "AFL_LLVM_WHITELIST environment variable detected - did you mean AFL_GCC_WHITELIST?\n"); inst_ratio > 100)
FATAL(G_("Bad value of AFL_INST_RATIO (must be between 1 and 100)"));
else {
if (!be_quiet)
ACTF(G_("%s instrumentation at ratio of %u%% in %s mode."),
inst_ext ? G_("Call-based") : G_("Inline"), inst_ratio,
getenv("AFL_HARDEN") ? G_("hardened") : G_("non-hardened"));
}
}
char *instWhiteListFilename = getenv("AFL_GCC_WHITELIST");
if (instWhiteListFilename) {
std::string line;
std::ifstream fileStream;
fileStream.open(instWhiteListFilename);
if (!fileStream) fatal_error(0, "Unable to open AFL_GCC_WHITELIST");
getline(fileStream, line);
while (fileStream) {
myWhitelist.push_back(line);
getline(fileStream, line);
}
} else if (!be_quiet && getenv("AFL_LLVM_WHITELIST"))
SAYF(cYEL "[-] " cRST
"AFL_LLVM_WHITELIST environment variable detected - did you mean "
"AFL_GCC_WHITELIST?\n");
/* Go go gadget */
register_callback(plugin_info->base_name, PLUGIN_INFO, NULL,
&afl_plugin_info);
register_callback(plugin_info->base_name, PLUGIN_PASS_MANAGER_SETUP, NULL,
&afl_pass_info);
return 0;
/* Go go gadget */
register_callback(plugin_info->base_name, PLUGIN_INFO, NULL, &afl_plugin_info);
register_callback(plugin_info->base_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &afl_pass_info);
return 0;
} }

32
gcc_plugin/afl-gcc-rt.o.c
View File

@ -34,27 +34,27 @@
#include <sys/wait.h> #include <sys/wait.h>
#include <sys/types.h> #include <sys/types.h>
/* Globals needed by the injected instrumentation. The __afl_area_initial region /* Globals needed by the injected instrumentation. The __afl_area_initial region
is used for instrumentation output before __afl_map_shm() has a chance to run. is used for instrumentation output before __afl_map_shm() has a chance to
It will end up as .comm, so it shouldn't be too wasteful. */ run. It will end up as .comm, so it shouldn't be too wasteful. */
u8 __afl_area_initial[MAP_SIZE]; u8 __afl_area_initial[MAP_SIZE];
u8* __afl_area_ptr = __afl_area_initial; u8 *__afl_area_ptr = __afl_area_initial;
u32 __afl_prev_loc; u32 __afl_prev_loc;
/* Running in persistent mode? */ /* Running in persistent mode? */
static u8 is_persistent; static u8 is_persistent;
/* Trace a basic block with some ID */ /* Trace a basic block with some ID */
void __afl_trace(u32 x) { void __afl_trace(u32 x) {
u32 l = __afl_prev_loc; u32 l = __afl_prev_loc;
u32 n = l ^ x; u32 n = l ^ x;
*(__afl_area_ptr+n) += 1; *(__afl_area_ptr + n) += 1;
__afl_prev_loc = (x >> 1); __afl_prev_loc = (x >> 1);
return; return;
} }
/* SHM setup. */ /* SHM setup. */
@ -86,15 +86,14 @@ static void __afl_map_shm(void) {
} }
/* Fork server logic. */ /* Fork server logic. */
static void __afl_start_forkserver(void) { static void __afl_start_forkserver(void) {
static u8 tmp[4]; static u8 tmp[4];
s32 child_pid; s32 child_pid;
u8 child_stopped = 0; u8 child_stopped = 0;
/* Phone home and tell the parent that we're OK. If parent isn't there, /* Phone home and tell the parent that we're OK. If parent isn't there,
assume we're not running in forkserver mode and just execute program. */ assume we're not running in forkserver mode and just execute program. */
@ -115,8 +114,10 @@ static void __afl_start_forkserver(void) {
process. */ process. */
if (child_stopped && was_killed) { if (child_stopped && was_killed) {
child_stopped = 0; child_stopped = 0;
if (waitpid(child_pid, &status, 0) < 0) exit(1); if (waitpid(child_pid, &status, 0) < 0) exit(1);
} }
if (!child_stopped) { if (!child_stopped) {
@ -150,8 +151,7 @@ static void __afl_start_forkserver(void) {
if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) exit(1); if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) exit(1);
if (waitpid(child_pid, &status, is_persistent ? WUNTRACED : 0) < 0) if (waitpid(child_pid, &status, is_persistent ? WUNTRACED : 0) < 0) exit(1);
exit(1);
/* In persistent mode, the child stops itself with SIGSTOP to indicate /* In persistent mode, the child stops itself with SIGSTOP to indicate
a successful run. In this case, we want to wake it up without forking a successful run. In this case, we want to wake it up without forking
@ -167,7 +167,6 @@ static void __afl_start_forkserver(void) {
} }
/* A simplified persistent mode handler, used as explained in README.llvm. */ /* A simplified persistent mode handler, used as explained in README.llvm. */
int __afl_persistent_loop(unsigned int max_cnt) { int __afl_persistent_loop(unsigned int max_cnt) {
@ -177,7 +176,7 @@ int __afl_persistent_loop(unsigned int max_cnt) {
if (first_pass) { if (first_pass) {
cycle_cnt = max_cnt; cycle_cnt = max_cnt;
first_pass = 0; first_pass = 0;
return 1; return 1;
@ -188,11 +187,12 @@ int __afl_persistent_loop(unsigned int max_cnt) {
raise(SIGSTOP); raise(SIGSTOP);
return 1; return 1;
} else return 0; } else
return 0;
} }
/* This one can be called from user code when deferred forkserver mode /* This one can be called from user code when deferred forkserver mode
is enabled. */ is enabled. */
@ -210,7 +210,6 @@ void __afl_manual_init(void) {
} }
/* Proper initialization routine. */ /* Proper initialization routine. */
__attribute__((constructor(101))) void __afl_auto_init(void) { __attribute__((constructor(101))) void __afl_auto_init(void) {
@ -222,3 +221,4 @@ __attribute__((constructor(101))) void __afl_auto_init(void) {
__afl_manual_init(); __afl_manual_init();
} }

2
include/afl-fuzz.h
View File

@ -252,7 +252,7 @@ extern u8 *in_dir, /* Input directory with test cases */
*file_extension, /* File extension */ *file_extension, /* File extension */
*orig_cmdline, /* Original command line */ *orig_cmdline, /* Original command line */
*doc_path, /* Path to documentation dir */ *doc_path, /* Path to documentation dir */
*infoexec, /* Command to execute on a new crash */ *infoexec, /* Command to execute on a new crash */
*out_file; /* File to fuzz, if any */ *out_file; /* File to fuzz, if any */
extern u32 exec_tmout; /* Configurable exec timeout (ms) */ extern u32 exec_tmout; /* Configurable exec timeout (ms) */

8
src/afl-fuzz-bitmap.c
View File

@ -683,10 +683,12 @@ u8 save_if_interesting(char** argv, void* mem, u32 len, u8 fault) {
#endif /* ^!SIMPLE_FILES */ #endif /* ^!SIMPLE_FILES */
++unique_crashes; ++unique_crashes;
if (infoexec) // if the user wants to be informed on new crashes - do that if (infoexec) // if the user wants to be informed on new crashes - do
// that
if (system(infoexec) == -1) if (system(infoexec) == -1)
hnb += 0; // we dont care if system errors, but we dont want a compiler warning either hnb += 0; // we dont care if system errors, but we dont want a
// compiler warning either
last_crash_time = get_cur_time(); last_crash_time = get_cur_time();
last_crash_execs = total_execs; last_crash_execs = total_execs;

4
src/afl-fuzz-globals.c
View File

@ -74,8 +74,8 @@ u8 *in_dir, /* Input directory with test cases */
*file_extension, /* File extension */ *file_extension, /* File extension */
*orig_cmdline; /* Original command line */ *orig_cmdline; /* Original command line */
u8 *doc_path, /* Path to documentation dir */ u8 *doc_path, /* Path to documentation dir */
*infoexec, /* Command to execute on a new crash */ *infoexec, /* Command to execute on a new crash */
*out_file; /* File to fuzz, if any */ *out_file; /* File to fuzz, if any */
u32 exec_tmout = EXEC_TIMEOUT; /* Configurable exec timeout (ms) */ u32 exec_tmout = EXEC_TIMEOUT; /* Configurable exec timeout (ms) */
u32 hang_tmout = EXEC_TIMEOUT; /* Timeout used for hang det (ms) */ u32 hang_tmout = EXEC_TIMEOUT; /* Timeout used for hang det (ms) */

6
src/afl-fuzz-init.c
View File

@ -138,7 +138,8 @@ void bind_to_free_cpu(void) {
for (i = 0; i < proccount; i++) { for (i = 0; i < proccount; i++) {
if (procs[i].ki_oncpu < sizeof(cpu_used) && procs[i].ki_pctcpu > 2) cpu_used[procs[i].ki_oncpu] = 1; if (procs[i].ki_oncpu < sizeof(cpu_used) && procs[i].ki_pctcpu > 2)
cpu_used[procs[i].ki_oncpu] = 1;
} }
@ -166,7 +167,8 @@ void bind_to_free_cpu(void) {
for (i = 0; i < proccount; i++) { for (i = 0; i < proccount; i++) {
if (procs[i].p_cpuid < sizeof(cpu_used) && procs[i].p_pctcpu > 0) cpu_used[procs[i].p_cpuid] = 1; if (procs[i].p_cpuid < sizeof(cpu_used) && procs[i].p_pctcpu > 0)
cpu_used[procs[i].p_cpuid] = 1;
} }

6
src/afl-fuzz-run.c
View File

@ -288,8 +288,7 @@ void write_to_testcase(void* mem, u32 len) {
if (out_file) { if (out_file) {
unlink(out_file); /* Ignore errors. unlink(out_file); /* Ignore errors. */
// */
fd = open(out_file, O_WRONLY | O_CREAT | O_EXCL, 0600); fd = open(out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
@ -331,8 +330,7 @@ void write_with_gap(void* mem, u32 len, u32 skip_at, u32 skip_len) {
if (out_file) { if (out_file) {
unlink(out_file); /* Ignore errors. unlink(out_file); /* Ignore errors. */
// */
fd = open(out_file, O_WRONLY | O_CREAT | O_EXCL, 0600); fd = open(out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);

18
src/afl-fuzz-stats.c
View File

@ -334,9 +334,9 @@ void show_stats(void) {
/* Lord, forgive me this. */ /* Lord, forgive me this. */
SAYF(SET_G1 bSTG bLT bH bSTOP cCYA SAYF(SET_G1 bSTG bLT bH bSTOP cCYA
" process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA
" overall results " bSTG bH2 bH2 bRT "\n"); " overall results " bSTG bH2 bH2 bRT "\n");
if (dumb_mode) { if (dumb_mode) {
@ -413,9 +413,9 @@ void show_stats(void) {
" uniq hangs : " cRST "%-6s" bSTG bV "\n", " uniq hangs : " cRST "%-6s" bSTG bV "\n",
DTD(cur_ms, last_hang_time), tmp); DTD(cur_ms, last_hang_time), tmp);
SAYF(bVR bH bSTOP cCYA SAYF(bVR bH bSTOP cCYA
" cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA
" map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); " map coverage " bSTG bH bHT bH20 bH2 bVL "\n");
/* This gets funny because we want to print several variable-length variables /* This gets funny because we want to print several variable-length variables
together, but then cram them into a fixed-width field - so we need to together, but then cram them into a fixed-width field - so we need to
@ -443,9 +443,9 @@ void show_stats(void) {
SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp); SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp);
SAYF(bVR bH bSTOP cCYA SAYF(bVR bH bSTOP cCYA
" stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA
" findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
sprintf(tmp, "%s (%0.02f%%)", DI(queued_favored), sprintf(tmp, "%s (%0.02f%%)", DI(queued_favored),
((double)queued_favored) * 100 / queued_paths); ((double)queued_favored) * 100 / queued_paths);
@ -514,7 +514,7 @@ void show_stats(void) {
/* Aaaalmost there... hold on! */ /* Aaaalmost there... hold on! */
SAYF(bVR bH cCYA bSTOP SAYF(bVR bH cCYA bSTOP
" fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA
" path geometry " bSTG bH5 bH2 bVL "\n"); " path geometry " bSTG bH5 bH2 bVL "\n");
@ -633,13 +633,13 @@ void show_stats(void) {
sprintf(tmp, "%s/%s", DI(stage_finds[STAGE_CUSTOM_MUTATOR]), sprintf(tmp, "%s/%s", DI(stage_finds[STAGE_CUSTOM_MUTATOR]),
DI(stage_cycles[STAGE_CUSTOM_MUTATOR])); DI(stage_cycles[STAGE_CUSTOM_MUTATOR]));
SAYF(bV bSTOP " custom mut. : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB SAYF(bV bSTOP " custom mut. : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB
"\n" bLB bH30 bH20 bH2 bH bRB bSTOP cRST RESET_G1, "\n" bLB bH30 bH20 bH2 bH bRB bSTOP cRST RESET_G1,
tmp); tmp);
} else { } else {
SAYF(bV bSTOP " trim : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB SAYF(bV bSTOP " trim : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB
"\n" bLB bH30 bH20 bH2 bRB bSTOP cRST RESET_G1, "\n" bLB bH30 bH20 bH2 bRB bSTOP cRST RESET_G1,
tmp); tmp);
} }

8
src/afl-fuzz.c
View File

@ -76,7 +76,8 @@ static void usage(u8* argv0) {
"Other stuff:\n" "Other stuff:\n"
" -T text - text banner to show on the screen\n" " -T text - text banner to show on the screen\n"
" -M / -S id - distributed mode (see parallel_fuzzing.txt)\n" " -M / -S id - distributed mode (see parallel_fuzzing.txt)\n"
" -I command - execute this command/script when a new crash is found\n" " -I command - execute this command/script when a new crash is "
"found\n"
" -B bitmap.txt - mutate a specific test case, use the out/fuzz_bitmap " " -B bitmap.txt - mutate a specific test case, use the out/fuzz_bitmap "
"file\n" "file\n"
" -C - crash exploration mode (the peruvian rabbit thing)\n" " -C - crash exploration mode (the peruvian rabbit thing)\n"
@ -138,10 +139,7 @@ int main(int argc, char** argv) {
switch (opt) { switch (opt) {
case 'I': case 'I': infoexec = optarg; break;
infoexec = optarg;
break;
case 's': { case 's': {

4
test-instr.c
View File

@ -35,7 +35,8 @@ int main(int argc, char** argv) {
} }
// we support three input cases (plus a 4th if stdin is used but there is no input) // we support three input cases (plus a 4th if stdin is used but there is no
// input)
if (buf[0] == '0') if (buf[0] == '0')
printf("Looks like a zero to me!\n"); printf("Looks like a zero to me!\n");
else if (buf[0] == '1') else if (buf[0] == '1')
@ -46,3 +47,4 @@ int main(int argc, char** argv) {
return 0; return 0;
} }

10
unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h
View File

@ -49,7 +49,7 @@ void HELPER(afl_compcov_log_32)(void* uc_ptr, uint64_t cur_loc, uint64_t arg1,
if ((arg1 & 0xff000000) == (arg2 & 0xff000000)) { if ((arg1 & 0xff000000) == (arg2 & 0xff000000)) {
INC_AFL_AREA(cur_loc +2); INC_AFL_AREA(cur_loc + 2);
if ((arg1 & 0xff0000) == (arg2 & 0xff0000)) { if ((arg1 & 0xff0000) == (arg2 & 0xff0000)) {
INC_AFL_AREA(cur_loc + 1); INC_AFL_AREA(cur_loc + 1);
@ -68,7 +68,7 @@ void HELPER(afl_compcov_log_64)(void* uc_ptr, uint64_t cur_loc, uint64_t arg1,
if ((arg1 & 0xff00000000000000) == (arg2 & 0xff00000000000000)) { if ((arg1 & 0xff00000000000000) == (arg2 & 0xff00000000000000)) {
INC_AFL_AREA(cur_loc +6); INC_AFL_AREA(cur_loc + 6);
if ((arg1 & 0xff000000000000) == (arg2 & 0xff000000000000)) { if ((arg1 & 0xff000000000000) == (arg2 & 0xff000000000000)) {
INC_AFL_AREA(cur_loc + 5); INC_AFL_AREA(cur_loc + 5);
@ -84,11 +84,7 @@ void HELPER(afl_compcov_log_64)(void* uc_ptr, uint64_t cur_loc, uint64_t arg1,
if ((arg1 & 0xff0000) == (arg2 & 0xff0000)) { if ((arg1 & 0xff0000) == (arg2 & 0xff0000)) {
INC_AFL_AREA(cur_loc + 1); INC_AFL_AREA(cur_loc + 1);
if ((arg1 & 0xff00) == (arg2 & 0xff00)) { if ((arg1 & 0xff00) == (arg2 & 0xff00)) { INC_AFL_AREA(cur_loc); }
INC_AFL_AREA(cur_loc);
}
} }