ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-15 19:38:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Collect persistent coverage data and dump it at the end of the run

Browse Source 
With CODE_COVERAGE builds, we need to collect the coverage data of each
iteration in a persistant buffer that has the same size as the regular
trace buffer used for fuzzing. We dump this information at the end of
the run and when combined with pointer data and module info, this can be
used to calculate code coverage.
This commit is contained in:
Christian Holler (:decoder)
2024-06-19 12:36:58 +02:00
parent b8568034f0
commit 8fcca6fb41
4 changed files with 55 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/afl-fuzz-run.c
View File

@ -60,6 +60,27 @@ fuzz_run_target(afl_state_t *afl, afl_forkserver_t *fsrv, u32 timeout) {
fsrv_run_result_t res = afl_fsrv_run_target(fsrv, timeout, &afl->stop_soon);
#ifdef __AFL_CODE_COVERAGE
if (unlikely(!fsrv->persistent_trace_bits)) {
// On the first run, we allocate the persistent map to collect coverage.
fsrv->persistent_trace_bits = (u8 *)malloc(fsrv->map_size);
memset(fsrv->persistent_trace_bits, 0, fsrv->map_size);
}
for (u32 i = 0; i < fsrv->map_size; ++i) {
if (fsrv->persistent_trace_bits[i] != 255 && fsrv->trace_bits[i]) {
fsrv->persistent_trace_bits[i]++;
}
}
#endif
/* If post_run() function is defined in custom mutator, the function will be
called each time after AFL++ executes the target program. */