nyx code format

This commit is contained in:
vanhauser-thc
2021-12-28 17:26:54 +01:00
parent f511ebd125
commit 8b8aaa93bd
6 changed files with 229 additions and 179 deletions

View File

@ -39,6 +39,7 @@
*/
typedef enum NyxReturnValue {
Normal,
Crash,
Asan,
@ -47,22 +48,23 @@ typedef enum NyxReturnValue {
Error,
IoError,
Abort,
} NyxReturnValue;
typedef struct {
void* (*nyx_new)(const char *sharedir,
const char *workdir,
uint32_t worker_id,
uint32_t cpu_id,
bool create_snapshot);
void *(*nyx_new)(const char *sharedir, const char *workdir,
uint32_t worker_id, uint32_t cpu_id, bool create_snapshot);
void (*nyx_shutdown)(void *qemu_process);
void (*nyx_option_set_reload_mode)(void *qemu_process, bool enable);
void (*nyx_option_set_timeout)(void *qemu_process, uint8_t timeout_sec, uint32_t timeout_usec);
void (*nyx_option_set_timeout)(void *qemu_process, uint8_t timeout_sec,
uint32_t timeout_usec);
void (*nyx_option_apply)(void *qemu_process);
void (*nyx_set_afl_input)(void *qemu_process, uint8_t *buffer, uint32_t size);
enum NyxReturnValue (*nyx_exec)(void *qemu_process);
uint8_t *(*nyx_get_bitmap_buffer)(void *qemu_process);
size_t (*nyx_get_bitmap_buffer_size)(void *qemu_process);
} nyx_plugin_handler_t;
#endif

View File

@ -389,43 +389,47 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
#ifdef __linux__
if (fsrv->nyx_mode) {
if(fsrv->nyx_runner != NULL){
return;
}
if (fsrv->nyx_runner != NULL) { return; }
if (!be_quiet) { ACTF("Spinning up the NYX backend..."); }
if(fsrv->out_dir_path == NULL){
FATAL("Nyx workdir path not found...");
}
if (fsrv->out_dir_path == NULL) { FATAL("Nyx workdir path not found..."); }
char *x = alloc_printf("%s/workdir", fsrv->out_dir_path);
if(fsrv->nyx_id == 0xFFFFFFFF){
FATAL("Nyx ID is not set...");
}
if (fsrv->nyx_id == 0xFFFFFFFF) { FATAL("Nyx ID is not set..."); }
if (fsrv->nyx_bind_cpu_id == 0xFFFFFFFF) {
FATAL("Nyx CPU ID is not set...");
}
if (fsrv->nyx_parent) {
fsrv->nyx_runner = fsrv->nyx_handlers->nyx_new(fsrv->target_path, x, fsrv->nyx_id, fsrv->nyx_bind_cpu_id, !fsrv->nyx_standalone);
}
else{
fsrv->nyx_runner = fsrv->nyx_handlers->nyx_new(fsrv->target_path, x, fsrv->nyx_id, fsrv->nyx_bind_cpu_id, true);
fsrv->nyx_runner = fsrv->nyx_handlers->nyx_new(
fsrv->target_path, x, fsrv->nyx_id, fsrv->nyx_bind_cpu_id,
!fsrv->nyx_standalone);
} else {
fsrv->nyx_runner = fsrv->nyx_handlers->nyx_new(
fsrv->target_path, x, fsrv->nyx_id, fsrv->nyx_bind_cpu_id, true);
}
if(fsrv->nyx_runner == NULL){
FATAL("Something went wrong ...");
}
if (fsrv->nyx_runner == NULL) { FATAL("Something went wrong ..."); }
fsrv->map_size = fsrv->nyx_handlers->nyx_get_bitmap_buffer_size(fsrv->nyx_runner);;
fsrv->map_size =
fsrv->nyx_handlers->nyx_get_bitmap_buffer_size(fsrv->nyx_runner);
;
fsrv->real_map_size = fsrv->map_size;
fsrv->trace_bits = fsrv->nyx_handlers->nyx_get_bitmap_buffer(fsrv->nyx_runner);
fsrv->trace_bits =
fsrv->nyx_handlers->nyx_get_bitmap_buffer(fsrv->nyx_runner);
fsrv->nyx_handlers->nyx_option_set_reload_mode(fsrv->nyx_runner, getenv("NYX_DISABLE_SNAPSHOT_MODE") == NULL);
fsrv->nyx_handlers->nyx_option_set_reload_mode(
fsrv->nyx_runner, getenv("NYX_DISABLE_SNAPSHOT_MODE") == NULL);
fsrv->nyx_handlers->nyx_option_apply(fsrv->nyx_runner);
fsrv->nyx_handlers->nyx_option_set_timeout(fsrv->nyx_runner, 2, 0);
@ -434,6 +438,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
/* dry run */
fsrv->nyx_handlers->nyx_set_afl_input(fsrv->nyx_runner, "INIT", 4);
switch (fsrv->nyx_handlers->nyx_exec(fsrv->nyx_runner)) {
case Abort:
fsrv->nyx_handlers->nyx_shutdown(fsrv->nyx_runner);
FATAL("Error: Nyx abort occured...");
@ -447,9 +452,13 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
break;
default:
break;
}
return;
}
#endif
if (!be_quiet) { ACTF("Spinning up the fork server..."); }
@ -1163,10 +1172,9 @@ void afl_fsrv_kill(afl_forkserver_t *fsrv) {
fsrv->child_pid = -1;
#ifdef __linux__
if(fsrv->nyx_mode){
fsrv->nyx_handlers->nyx_shutdown(fsrv->nyx_runner);
}
if (fsrv->nyx_mode) { fsrv->nyx_handlers->nyx_shutdown(fsrv->nyx_runner); }
#endif
}
/* Get the map size from the target forkserver */
@ -1185,9 +1193,12 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
#ifdef __linux__
if (fsrv->nyx_mode) {
fsrv->nyx_handlers->nyx_set_afl_input(fsrv->nyx_runner, buf, len);
return;
}
#endif
#ifdef AFL_PERSISTENT_RECORD
if (unlikely(fsrv->persistent_record)) {
@ -1308,16 +1319,21 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
static uint32_t last_timeout_value = 0;
if (last_timeout_value != timeout) {
fsrv->nyx_handlers->nyx_option_set_timeout(fsrv->nyx_runner, timeout/1000, (timeout%1000) * 1000);
fsrv->nyx_handlers->nyx_option_set_timeout(
fsrv->nyx_runner, timeout / 1000, (timeout % 1000) * 1000);
fsrv->nyx_handlers->nyx_option_apply(fsrv->nyx_runner);
last_timeout_value = timeout;
}
enum NyxReturnValue ret_val = fsrv->nyx_handlers->nyx_exec(fsrv->nyx_runner);
enum NyxReturnValue ret_val =
fsrv->nyx_handlers->nyx_exec(fsrv->nyx_runner);
fsrv->total_execs++;
switch (ret_val) {
case Normal:
return FSRV_RUN_OK;
case Crash:
@ -1334,18 +1350,26 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
FATAL("Error: Nyx abort occured...");
case IoError:
if (*stop_soon_p) {
return 0;
}
else{
} else {
FATAL("Error: QEMU-Nyx has died...");
}
break;
case Error:
FATAL("Error: Nyx runtime error has occured...");
break;
}
return FSRV_RUN_OK;
}
#endif
/* After this memset, fsrv->trace_bits[] are effectively volatile, so we
must prevent any earlier operations from venturing into that
@ -1353,9 +1377,12 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
#ifdef __linux__
if (!fsrv->nyx_mode) {
memset(fsrv->trace_bits, 0, fsrv->map_size);
MEM_BARRIER();
}
#else
memset(fsrv->trace_bits, 0, fsrv->map_size);
MEM_BARRIER();

View File

@ -411,10 +411,9 @@ void bind_to_free_cpu(afl_state_t *afl) {
OKF("Found a free CPU core, try binding to #%u.", i);
if (bind_cpu(afl, i)) {
#ifdef __linux__
if(afl->fsrv.nyx_mode){
afl->fsrv.nyx_bind_cpu_id = i;
}
if (afl->fsrv.nyx_mode) { afl->fsrv.nyx_bind_cpu_id = i; }
#endif
/* Success :) */
break;
@ -1096,8 +1095,11 @@ void perform_dry_run(afl_state_t *afl) {
case FSRV_RUN_NOINST:
#ifdef __linux__
if (afl->fsrv.nyx_mode && afl->fsrv.nyx_runner != NULL) {
afl->fsrv.nyx_handlers->nyx_shutdown(afl->fsrv.nyx_runner);
}
#endif
FATAL("No instrumentation detected");
@ -2453,9 +2455,7 @@ void fix_up_sync(afl_state_t *afl) {
x = alloc_printf("%s/%s", afl->out_dir, afl->sync_id);
#ifdef __linux__
if(afl->fsrv.nyx_mode){
afl->fsrv.out_dir_path = afl->out_dir;
}
if (afl->fsrv.nyx_mode) { afl->fsrv.out_dir_path = afl->out_dir; }
#endif
afl->sync_dir = afl->out_dir;
afl->out_dir = x;
@ -2596,16 +2596,25 @@ void check_binary(afl_state_t *afl, u8 *fname) {
afl->fsrv.target_path = ck_strdup(fname);
#ifdef __linux__
if (afl->fsrv.nyx_mode) {
/* check if target_path is a nyx sharedir */
if (stat(afl->fsrv.target_path, &st) || S_ISDIR(st.st_mode)) {
char *tmp = alloc_printf("%s/config.ron", afl->fsrv.target_path);
if (stat(tmp, &st) || S_ISREG(st.st_mode)) {
free(tmp);
return;
}
}
FATAL("Directory '%s' not found or is not a nyx share directory", afl->fsrv.target_path);
FATAL("Directory '%s' not found or is not a nyx share directory",
afl->fsrv.target_path);
}
#endif
if (stat(afl->fsrv.target_path, &st) || !S_ISREG(st.st_mode) ||
!(st.st_mode & 0111) || (f_len = st.st_size) < 4) {

View File

@ -681,13 +681,15 @@ void show_stats(afl_state_t *afl) {
#ifdef __linux__
if (afl->fsrv.nyx_mode) {
sprintf(banner + banner_pad,
"%s " cLCY VERSION cLBL " {%s} " cLGN "(%s) " cPIN "[%s] - Nyx",
afl->crash_mode ? cPIN "peruvian were-rabbit"
: cYEL "american fuzzy lop",
si, afl->use_banner, afl->power_name);
}
else{
} else {
#endif
sprintf(banner + banner_pad,
"%s " cLCY VERSION cLBL " {%s} " cLGN "(%s) " cPIN "[%s]",
@ -696,8 +698,11 @@ void show_stats(afl_state_t *afl) {
si, afl->use_banner, afl->power_name);
#ifdef __linux__
}
#endif
}
SAYF("\n%s\n", banner);

View File

@ -393,59 +393,42 @@ static void fasan_check_afl_preload(char *afl_preload) {
#include <dlfcn.h>
nyx_plugin_handler_t *afl_load_libnyx_plugin(u8 *libnyx_binary) {
void * handle;
nyx_plugin_handler_t *plugin = calloc(1, sizeof(nyx_plugin_handler_t));
ACTF("Trying to load libnyx.so plugin...");
handle = dlopen((char *)libnyx_binary, RTLD_NOW);
if (!handle) {
goto fail;
}
if (!handle) { goto fail; }
plugin->nyx_new = dlsym(handle, "nyx_new");
if (plugin->nyx_new == NULL){
goto fail;
}
if (plugin->nyx_new == NULL) { goto fail; }
plugin->nyx_shutdown = dlsym(handle, "nyx_shutdown");
if (plugin->nyx_shutdown == NULL){
goto fail;
}
if (plugin->nyx_shutdown == NULL) { goto fail; }
plugin->nyx_option_set_reload_mode = dlsym(handle, "nyx_option_set_reload_mode");
if (plugin->nyx_option_set_reload_mode == NULL){
goto fail;
}
plugin->nyx_option_set_reload_mode =
dlsym(handle, "nyx_option_set_reload_mode");
if (plugin->nyx_option_set_reload_mode == NULL) { goto fail; }
plugin->nyx_option_set_timeout = dlsym(handle, "nyx_option_set_timeout");
if (plugin->nyx_option_set_timeout == NULL){
goto fail;
}
if (plugin->nyx_option_set_timeout == NULL) { goto fail; }
plugin->nyx_option_apply = dlsym(handle, "nyx_option_apply");
if (plugin->nyx_option_apply == NULL){
goto fail;
}
if (plugin->nyx_option_apply == NULL) { goto fail; }
plugin->nyx_set_afl_input = dlsym(handle, "nyx_set_afl_input");
if (plugin->nyx_set_afl_input == NULL){
goto fail;
}
if (plugin->nyx_set_afl_input == NULL) { goto fail; }
plugin->nyx_exec = dlsym(handle, "nyx_exec");
if (plugin->nyx_exec == NULL){
goto fail;
}
if (plugin->nyx_exec == NULL) { goto fail; }
plugin->nyx_get_bitmap_buffer = dlsym(handle, "nyx_get_bitmap_buffer");
if (plugin->nyx_get_bitmap_buffer == NULL){
goto fail;
}
if (plugin->nyx_get_bitmap_buffer == NULL) { goto fail; }
plugin->nyx_get_bitmap_buffer_size = dlsym(handle, "nyx_get_bitmap_buffer_size");
if (plugin->nyx_get_bitmap_buffer_size == NULL){
goto fail;
}
plugin->nyx_get_bitmap_buffer_size =
dlsym(handle, "nyx_get_bitmap_buffer_size");
if (plugin->nyx_get_bitmap_buffer_size == NULL) { goto fail; }
OKF("libnyx plugin is ready!");
return plugin;
@ -455,7 +438,9 @@ nyx_plugin_handler_t* afl_load_libnyx_plugin(u8* libnyx_binary){
FATAL("failed to load libnyx: %s\n", dlerror());
free(plugin);
return NULL;
}
#endif
/* Main entry point */
@ -921,10 +906,7 @@ int main(int argc, char **argv_orig, char **envp) {
#ifdef __linux__
case 'X': /* NYX mode */
if (afl->fsrv.nyx_mode) {
FATAL("Multiple -X options not supported");
}
if (afl->fsrv.nyx_mode) { FATAL("Multiple -X options not supported"); }
afl->fsrv.nyx_parent = true;
afl->fsrv.nyx_standalone = true;
@ -934,11 +916,7 @@ int main(int argc, char **argv_orig, char **envp) {
break;
case 'Y': /* NYX distributed mode */
if (afl->fsrv.nyx_mode) {
FATAL("Multiple -Y options not supported");
}
if (afl->fsrv.nyx_mode) { FATAL("Multiple -Y options not supported"); }
afl->fsrv.nyx_mode = 1;
break;
@ -1290,10 +1268,13 @@ int main(int argc, char **argv_orig, char **envp) {
#ifdef __linux__
if (afl->fsrv.nyx_mode) {
OKF("afl++ Nyx mode is enabled (developed and mainted by Sergej Schumilo)");
OKF("Nyx is open source, get it at "
"https://github.com/Nyx-Fuzz");
}
#endif
if (afl->sync_id && afl->is_main_node &&
afl->afl_env.afl_custom_mutator_only) {
@ -1340,28 +1321,51 @@ int main(int argc, char **argv_orig, char **envp) {
#ifdef __linux__
if (afl->fsrv.nyx_mode) {
if (afl->fsrv.nyx_standalone && strncmp(afl->sync_id, "default", strlen("default")) != 0){
FATAL("distributed fuzzing is not supported in this Nyx mode (use -Y instead)");
if (afl->fsrv.nyx_standalone &&
strncmp(afl->sync_id, "default", strlen("default")) != 0) {
FATAL(
"distributed fuzzing is not supported in this Nyx mode (use -Y "
"instead)");
}
if (!afl->fsrv.nyx_standalone) {
if (afl->is_main_node) {
if (strncmp("0", afl->sync_id, strlen("0") != 0)) {
FATAL("for Nyx -Y mode, the Main (-M) parameter has to be set to 0 (-M 0)");
FATAL(
"for Nyx -Y mode, the Main (-M) parameter has to be set to 0 (-M "
"0)");
}
afl->fsrv.nyx_id = 0;
}
if (afl->is_secondary_node) {
long nyx_id = strtol(afl->sync_id, NULL, 10);
if (nyx_id == 0 || nyx_id == LONG_MAX) {
FATAL("for Nyx -Y mode, the Secondary (-S) parameter has to be a numeric value and >= 1 (e.g. -S 1)");
FATAL(
"for Nyx -Y mode, the Secondary (-S) parameter has to be a "
"numeric value and >= 1 (e.g. -S 1)");
}
afl->fsrv.nyx_id = nyx_id;
}
}
}
#endif
if (afl->sync_id) {
@ -1589,16 +1593,22 @@ int main(int argc, char **argv_orig, char **envp) {
#ifdef __linux__
if (!afl->fsrv.nyx_mode) {
check_crash_handling();
check_cpu_governor(afl);
}
else{
} else {
u8 *libnyx_binary = find_afl_binary(argv[0], "nyx_mode/libnyx.so");
afl->fsrv.nyx_handlers = afl_load_libnyx_plugin(libnyx_binary);
if (afl->fsrv.nyx_handlers == NULL) {
FATAL("failed to initialize libnyx.so...");
}
}
#else
check_crash_handling();
check_cpu_governor(afl);
@ -2085,10 +2095,14 @@ int main(int argc, char **argv_orig, char **envp) {
if (!afl->queue_buf[entry]->disabled) { ++valid_seeds; }
if (!afl->pending_not_fuzzed || !valid_seeds) {
#ifdef __linux__
if (afl->fsrv.nyx_mode) {
afl->fsrv.nyx_handlers->nyx_shutdown(afl->fsrv.nyx_runner);
}
#endif
FATAL("We need at least one valid input seed that does not crash!");

View File

@ -105,15 +105,8 @@ static sharedmem_t * shm_fuzz;
static const u8 count_class_human[256] = {
[0] = 0,
[1] = 1,
[2] = 2,
[3] = 3,
[4] = 4,
[8] = 5,
[16] = 6,
[32] = 7,
[128] = 8
[0] = 0, [1] = 1, [2] = 2, [3] = 3, [4] = 4,
[8] = 5, [16] = 6, [32] = 7, [128] = 8
};