ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-14 11:08:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

http->https

Browse Source
This commit is contained in:
vanhauser-thc
2021-11-06 10:28:22 +01:00
parent ddc930f5ff
commit 9325a4fcbb
70 changed files with 85 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
GNUmakefile
View File

@ -10,7 +10,7 @@
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: # You may obtain a copy of the License at:
# #
# http://www.apache.org/licenses/LICENSE-2.0 # https://www.apache.org/licenses/LICENSE-2.0
# #
# For Heiko: # For Heiko:

2
GNUmakefile.gcc_plugin
View File

@ -17,7 +17,7 @@
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: # You may obtain a copy of the License at:
# #
# http://www.apache.org/licenses/LICENSE-2.0 # https://www.apache.org/licenses/LICENSE-2.0
# #
#TEST_MMAP=1 #TEST_MMAP=1
PREFIX ?= /usr/local PREFIX ?= /usr/local

2
GNUmakefile.llvm
View File

@ -12,7 +12,7 @@
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: # You may obtain a copy of the License at:
# #
# http://www.apache.org/licenses/LICENSE-2.0 # https://www.apache.org/licenses/LICENSE-2.0
# #
# For Heiko: # For Heiko:

1
TODO.md
View File

@ -2,7 +2,6 @@
## TODO ## TODO
- AFL_USE_TSAN to docs/env_variables.md after work over
- screen update during input2stage - screen update during input2stage
- better autodetection of shifting runtime timeout values - better autodetection of shifting runtime timeout values
- Update afl->pending_not_fuzzed for MOpt - Update afl->pending_not_fuzzed for MOpt

2
afl-cmin.bash
View File

@ -11,7 +11,7 @@
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: # You may obtain a copy of the License at:
# #
# http://www.apache.org/licenses/LICENSE-2.0 # https://www.apache.org/licenses/LICENSE-2.0
# #
# This tool tries to find the smallest subset of files in the input directory # This tool tries to find the smallest subset of files in the input directory
# that still trigger the full range of instrumentation data points seen in # that still trigger the full range of instrumentation data points seen in

2
afl-plot
View File

@ -12,7 +12,7 @@
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: # You may obtain a copy of the License at:
# #
# http://www.apache.org/licenses/LICENSE-2.0 # https://www.apache.org/licenses/LICENSE-2.0
# #
get_abs_path() { get_abs_path() {

2
afl-whatsup
View File

@ -12,7 +12,7 @@
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: # You may obtain a copy of the License at:
# #
# http://www.apache.org/licenses/LICENSE-2.0 # https://www.apache.org/licenses/LICENSE-2.0
# #
# This tool summarizes the status of any locally-running synchronized # This tool summarizes the status of any locally-running synchronized
# instances of afl-fuzz. # instances of afl-fuzz.

2
docs/Changelog.md
View File

@ -2760,7 +2760,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
- Updated the documentation and added notes_for_asan.txt. Based on feedback - Updated the documentation and added notes_for_asan.txt. Based on feedback
from Hanno Boeck, Ben Laurie, and others. from Hanno Boeck, Ben Laurie, and others.
- Moved the project to http://lcamtuf.coredump.cx/afl/. - Moved the project to https://lcamtuf.coredump.cx/afl/.
### Version 0.46b: ### Version 0.46b:

2
docs/INSTALL.md
View File

@ -150,4 +150,4 @@ sysctl kern.sysv.shmseg=48
sysctl kern.sysv.shmall=98304 sysctl kern.sysv.shmall=98304
``` ```
See [http://www.spy-hill.com/help/apple/SharedMemory.html](http://www.spy-hill.com/help/apple/SharedMemory.html) for documentation for these settings and how to make them permanent. See [https://www.spy-hill.com/help/apple/SharedMemory.html](https://www.spy-hill.com/help/apple/SharedMemory.html) for documentation for these settings and how to make them permanent.

2
docs/best_practices.md
View File

@ -108,7 +108,7 @@ Four steps are required to do this and it also requires quite some knowledge of
Follow this document on how to do this: [instrumentation/README.instrument_list.md](../instrumentation/README.instrument_list.md). Follow this document on how to do this: [instrumentation/README.instrument_list.md](../instrumentation/README.instrument_list.md).
If `PCGUARD` is used, then you need to follow this guide (needs llvm 12+!): If `PCGUARD` is used, then you need to follow this guide (needs llvm 12+!):
[http://clang.llvm.org/docs/SanitizerCoverage.html#partially-disabling-instrumentation](http://clang.llvm.org/docs/SanitizerCoverage.html#partially-disabling-instrumentation) [https://clang.llvm.org/docs/SanitizerCoverage.html#partially-disabling-instrumentation](https://clang.llvm.org/docs/SanitizerCoverage.html#partially-disabling-instrumentation)
Only exclude those functions from instrumentation that provide no value for coverage - that is if it does not process any fuzz data directly or indirectly (e.g. hash maps, thread management etc.). Only exclude those functions from instrumentation that provide no value for coverage - that is if it does not process any fuzz data directly or indirectly (e.g. hash maps, thread management etc.).
If however a function directly or indirectly handles fuzz data, then you should not put the function in a deny instrumentation list and rather live with the instability it comes with. If however a function directly or indirectly handles fuzz data, then you should not put the function in a deny instrumentation list and rather live with the instability it comes with.

2
docs/interpreting_output.md
View File

@ -56,7 +56,7 @@ Any existing output directory can be also used to resume aborted jobs; try:
If you have gnuplot installed, you can also generate some pretty graphs for any If you have gnuplot installed, you can also generate some pretty graphs for any
active fuzzing task using afl-plot. For an example of how this looks like, active fuzzing task using afl-plot. For an example of how this looks like,
see [http://lcamtuf.coredump.cx/afl/plot/](http://lcamtuf.coredump.cx/afl/plot/). see [https://lcamtuf.coredump.cx/afl/plot/](https://lcamtuf.coredump.cx/afl/plot/).
You can also manually build and install afl-plot-ui, which is a helper utility You can also manually build and install afl-plot-ui, which is a helper utility
for showing the graphs generated by afl-plot in a graphical window using GTK. for showing the graphs generated by afl-plot in a graphical window using GTK.

2
docs/known_limitations.md
View File

@ -31,6 +31,6 @@ Here are some of the most important caveats for AFL:
[https://www.fastly.com/blog/how-to-fuzz-server-american-fuzzy-lop](https://www.fastly.com/blog/how-to-fuzz-server-american-fuzzy-lop) [https://www.fastly.com/blog/how-to-fuzz-server-american-fuzzy-lop](https://www.fastly.com/blog/how-to-fuzz-server-american-fuzzy-lop)
- Occasionally, sentient machines rise against their creators. If this - Occasionally, sentient machines rise against their creators. If this
happens to you, please consult [http://lcamtuf.coredump.cx/prep/](http://lcamtuf.coredump.cx/prep/). happens to you, please consult [https://lcamtuf.coredump.cx/prep/](https://lcamtuf.coredump.cx/prep/).
Beyond this, see [INSTALL.md](INSTALL.md) for platform-specific tips. Beyond this, see [INSTALL.md](INSTALL.md) for platform-specific tips.

12
docs/sister_projects.md
View File

@ -15,7 +15,7 @@ instruction manual.
Allows fuzz-testing of Python programs. Uses custom instrumentation and its Allows fuzz-testing of Python programs. Uses custom instrumentation and its
own forkserver. own forkserver.
http://jwilk.net/software/python-afl https://jwilk.net/software/python-afl
### Go-fuzz (Dmitry Vyukov) ### Go-fuzz (Dmitry Vyukov)
@ -34,7 +34,7 @@ https://github.com/kmcallister/afl.rs
Adds AFL-compatible instrumentation to OCaml programs. Adds AFL-compatible instrumentation to OCaml programs.
https://github.com/ocamllabs/opam-repo-dev/pull/23 https://github.com/ocamllabs/opam-repo-dev/pull/23
http://canopy.mirage.io/Posts/Fuzzing https://canopy.mirage.io/Posts/Fuzzing
### AFL for GCJ Java and other GCC frontends (-) ### AFL for GCJ Java and other GCC frontends (-)
@ -54,7 +54,7 @@ some programs to be fuzzed without the fork / execve overhead. (Similar
functionality is now available as the "persistent" feature described in functionality is now available as the "persistent" feature described in
[the llvm_mode readme](../instrumentation/README.llvm.md)) [the llvm_mode readme](../instrumentation/README.llvm.md))
http://llvm.org/docs/LibFuzzer.html https://llvm.org/docs/LibFuzzer.html
## TriforceAFL (Tim Newsham and Jesse Hertz) ## TriforceAFL (Tim Newsham and Jesse Hertz)
@ -189,7 +189,7 @@ https://github.com/bshastry/afl-sancov
Makes it easy to estimate memory usage limits when fuzzing with ASAN or MSAN. Makes it easy to estimate memory usage limits when fuzzing with ASAN or MSAN.
http://jwilk.net/software/recidivm https://jwilk.net/software/recidivm
### aflize (Jacek Wielemborek) ### aflize (Jacek Wielemborek)
@ -274,7 +274,7 @@ https://goo.gl/j9EgFf
A simple SQL shell designed specifically for fuzzing the underlying library. A simple SQL shell designed specifically for fuzzing the underlying library.
http://www.sqlite.org/src/artifact/9e7e273da2030371 https://www.sqlite.org/src/artifact/9e7e273da2030371
### Support for Python mutation modules (Christian Holler) ### Support for Python mutation modules (Christian Holler)
@ -292,7 +292,7 @@ A similar guided approach as applied to fuzzing syscalls:
https://github.com/google/syzkaller/wiki/Found-Bugs https://github.com/google/syzkaller/wiki/Found-Bugs
https://github.com/dvyukov/linux/commit/33787098ffaaa83b8a7ccf519913ac5fd6125931 https://github.com/dvyukov/linux/commit/33787098ffaaa83b8a7ccf519913ac5fd6125931
http://events.linuxfoundation.org/sites/events/files/slides/AFL%20filesystem%20fuzzing%2C%20Vault%202016_0.pdf https://events.linuxfoundation.org/sites/events/files/slides/AFL%20filesystem%20fuzzing%2C%20Vault%202016_0.pdf
### Kernel Snapshot Fuzzing using Unicornafl (Security in Telecommunications) ### Kernel Snapshot Fuzzing using Unicornafl (Security in Telecommunications)

12
docs/technical_details.md
View File

@ -161,8 +161,8 @@ features of the underlying data format, as shown in this image:
Several practical examples of the results of this algorithm are discussed Several practical examples of the results of this algorithm are discussed
here: here:
http://lcamtuf.blogspot.com/2014/11/pulling-jpegs-out-of-thin-air.html https://lcamtuf.blogspot.com/2014/11/pulling-jpegs-out-of-thin-air.html
http://lcamtuf.blogspot.com/2014/11/afl-fuzz-nobody-expects-cdata-sections.html https://lcamtuf.blogspot.com/2014/11/afl-fuzz-nobody-expects-cdata-sections.html
The synthetic corpus produced by this process is essentially a compact The synthetic corpus produced by this process is essentially a compact
collection of "hmm, this does something new!" input files, and can be used to collection of "hmm, this does something new!" input files, and can be used to
@ -323,7 +323,7 @@ value of various fuzzing strategies and optimize their parameters so that they
work equally well across a wide range of file types. The strategies used by work equally well across a wide range of file types. The strategies used by
afl-fuzz are generally format-agnostic and are discussed in more detail here: afl-fuzz are generally format-agnostic and are discussed in more detail here:
http://lcamtuf.blogspot.com/2014/08/binary-fuzzing-strategies-what-works.html https://lcamtuf.blogspot.com/2014/08/binary-fuzzing-strategies-what-works.html
It is somewhat notable that especially early on, most of the work done by It is somewhat notable that especially early on, most of the work done by
`afl-fuzz` is actually highly deterministic, and progresses to random stacked `afl-fuzz` is actually highly deterministic, and progresses to random stacked
@ -376,7 +376,7 @@ valid grammar for the tested parser.
A discussion of how these features are implemented within afl-fuzz can be found A discussion of how these features are implemented within afl-fuzz can be found
here: here:
http://lcamtuf.blogspot.com/2015/01/afl-fuzz-making-up-grammar-with.html https://lcamtuf.blogspot.com/2015/01/afl-fuzz-making-up-grammar-with.html
In essence, when basic, typically easily-obtained syntax tokens are combined In essence, when basic, typically easily-obtained syntax tokens are combined
together in a purely random manner, the instrumentation and the evolutionary together in a purely random manner, the instrumentation and the evolutionary
@ -429,7 +429,7 @@ thrown away.
A detailed discussion of the value of this approach can be found here: A detailed discussion of the value of this approach can be found here:
http://lcamtuf.blogspot.com/2014/11/afl-fuzz-crash-exploration-mode.html https://lcamtuf.blogspot.com/2014/11/afl-fuzz-crash-exploration-mode.html
The method uses instrumentation feedback to explore the state of the crashing The method uses instrumentation feedback to explore the state of the crashing
program to get past the ambiguous faulting condition and then isolate the program to get past the ambiguous faulting condition and then isolate the
@ -447,7 +447,7 @@ goes through `execve()`, linking, and libc initialization only once, and is then
cloned from a stopped process image by leveraging copy-on-write. The cloned from a stopped process image by leveraging copy-on-write. The
implementation is described in more detail here: implementation is described in more detail here:
http://lcamtuf.blogspot.com/2014/10/fuzzing-binaries-without-execve.html https://lcamtuf.blogspot.com/2014/10/fuzzing-binaries-without-execve.html
The fork server is an integral aspect of the injected instrumentation and The fork server is an integral aspect of the injected instrumentation and
simply stops at the first instrumented function to await commands from simply stops at the first instrumented function to await commands from

2
frida_mode/Scripting.md
View File

@ -302,7 +302,7 @@ Consider the [following](test/js/test2.c) test code...
Licensed under the Apache License, Version 2.0 (the "License"); Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
*/ */
#include <fcntl.h> #include <fcntl.h>

4
include/afl-as.h
View File

@ -16,7 +16,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This file houses the assembly-level instrumentation injected into fuzzed This file houses the assembly-level instrumentation injected into fuzzed
programs. The instrumentation stores XORed pairs of data: identifiers of the programs. The instrumentation stores XORed pairs of data: identifiers of the
@ -396,7 +396,7 @@ static const u8 *main_payload_32 =
"\n"; "\n";
/* The OpenBSD hack is due to lahf and sahf not being recognized by some /* The OpenBSD hack is due to lahf and sahf not being recognized by some
versions of binutils: http://marc.info/?l=openbsd-cvs&m=141636589924400 versions of binutils: https://marc.info/?l=openbsd-cvs&m=141636589924400
The Apple code is a bit different when calling libc functions because The Apple code is a bit different when calling libc functions because
they are doing relocations differently from everybody else. We also need they are doing relocations differently from everybody else. We also need

2
include/afl-fuzz.h
View File

@ -16,7 +16,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This is the real deal: the program takes an instrumented binary and This is the real deal: the program takes an instrumented binary and
attempts a variety of basic fuzzing tricks, paying close attention to attempts a variety of basic fuzzing tricks, paying close attention to

2
include/afl-prealloc.h
View File

@ -16,7 +16,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
*/ */

2
include/alloc-inl.h
View File

@ -16,7 +16,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This allocator is not designed to resist malicious attackers (the canaries This allocator is not designed to resist malicious attackers (the canaries
are small and predictable), but provides a robust and portable way to detect are small and predictable), but provides a robust and portable way to detect

2
include/cmplog.h
View File

@ -18,7 +18,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
Shared code to handle the shared memory. This is used by the fuzzer Shared code to handle the shared memory. This is used by the fuzzer
as well the other components like afl-tmin, afl-showmap, etc... as well the other components like afl-tmin, afl-showmap, etc...

2
include/common.h
View File

@ -16,7 +16,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
Gather some functions common to multiple executables Gather some functions common to multiple executables

2
include/config.h
View File

@ -16,7 +16,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
*/ */

2
include/debug.h
View File

@ -16,7 +16,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
*/ */

2
include/forkserver.h
View File

@ -18,7 +18,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
Shared code that implements a forkserver. This is used by the fuzzer Shared code that implements a forkserver. This is used by the fuzzer
as well the other components like afl-tmin. as well the other components like afl-tmin.

2
include/hash.h
View File

@ -21,7 +21,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
*/ */

2
include/list.h
View File

@ -16,7 +16,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This allocator is not designed to resist malicious attackers (the canaries This allocator is not designed to resist malicious attackers (the canaries
are small and predictable), but provides a robust and portable way to detect are small and predictable), but provides a robust and portable way to detect

2
include/sharedmem.h
View File

@ -18,7 +18,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
Shared code to handle the shared memory. This is used by the fuzzer Shared code to handle the shared memory. This is used by the fuzzer
as well the other components like afl-tmin, afl-showmap, etc... as well the other components like afl-tmin, afl-showmap, etc...

2
include/snapshot-inl.h
View File

@ -18,7 +18,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
*/ */

2
include/types.h
View File

@ -16,7 +16,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
*/ */

2
instrumentation/README.llvm.md
View File

@ -75,7 +75,7 @@ load modules (you'll see "Service unavailable" when loading afl-llvm-pass.so).
To solve all your problems, you can grab pre-built binaries for your OS from: To solve all your problems, you can grab pre-built binaries for your OS from:
http://llvm.org/releases/download.html https://llvm.org/releases/download.html
...and then put the bin/ directory from the tarball at the beginning of your ...and then put the bin/ directory from the tarball at the beginning of your
$PATH when compiling the feature and building packages later on. You don't need $PATH when compiling the feature and building packages later on. You don't need

2
instrumentation/afl-compiler-rt.o.c
View File

@ -9,7 +9,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
*/ */

2
instrumentation/afl-gcc-pass.so.cc
View File

@ -30,7 +30,7 @@
GNU General Public License for more details. GNU General Public License for more details.
You should have received a copy of the GNU General Public License You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>. along with this program. If not, see <https://www.gnu.org/licenses/>.
*/ */

2
instrumentation/afl-llvm-dict2file.so.cc
View File

@ -10,7 +10,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This library is plugged into LLVM when invoking clang through afl-clang-lto. This library is plugged into LLVM when invoking clang through afl-clang-lto.

2
instrumentation/afl-llvm-lto-instrumentation.so.cc
View File

@ -10,7 +10,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This library is plugged into LLVM when invoking clang through afl-clang-lto. This library is plugged into LLVM when invoking clang through afl-clang-lto.

2
instrumentation/afl-llvm-lto-instrumentlist.so.cc
View File

@ -15,7 +15,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This library is plugged into LLVM when invoking clang through afl-clang-fast. This library is plugged into LLVM when invoking clang through afl-clang-fast.
It tells the compiler to add code roughly equivalent to the bits discussed It tells the compiler to add code roughly equivalent to the bits discussed

2
instrumentation/afl-llvm-pass.so.cc
View File

@ -18,7 +18,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This library is plugged into LLVM when invoking clang through afl-clang-fast. This library is plugged into LLVM when invoking clang through afl-clang-fast.
It tells the compiler to add code roughly equivalent to the bits discussed It tells the compiler to add code roughly equivalent to the bits discussed

2
instrumentation/afl-llvm-rt-lto.o.c
View File

@ -6,7 +6,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
*/ */

2
instrumentation/cmplog-instructions-pass.cc
View File

@ -11,7 +11,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
*/ */

2
instrumentation/cmplog-routines-pass.cc
View File

@ -11,7 +11,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
*/ */

2
instrumentation/cmplog-switches-pass.cc
View File

@ -11,7 +11,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
*/ */

2
instrumentation/compare-transform-pass.so.cc
View File

@ -5,7 +5,7 @@
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
* You may obtain a copy of the License at * You may obtain a copy of the License at
* *
* http://www.apache.org/licenses/LICENSE-2.0 * https://www.apache.org/licenses/LICENSE-2.0
* *
* Unless required by applicable law or agreed to in writing, software * Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, * distributed under the License is distributed on an "AS IS" BASIS,

2
instrumentation/split-compares-pass.so.cc
View File

@ -6,7 +6,7 @@
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
* You may obtain a copy of the License at * You may obtain a copy of the License at
* *
* http://www.apache.org/licenses/LICENSE-2.0 * https://www.apache.org/licenses/LICENSE-2.0
* *
* Unless required by applicable law or agreed to in writing, software * Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, * distributed under the License is distributed on an "AS IS" BASIS,

2
instrumentation/split-switches-pass.so.cc
View File

@ -5,7 +5,7 @@
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
* You may obtain a copy of the License at * You may obtain a copy of the License at
* *
* http://www.apache.org/licenses/LICENSE-2.0 * https://www.apache.org/licenses/LICENSE-2.0
* *
* Unless required by applicable law or agreed to in writing, software * Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, * distributed under the License is distributed on an "AS IS" BASIS,

2
qemu_mode/build_qemu_support.sh
View File

@ -19,7 +19,7 @@
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: # You may obtain a copy of the License at:
# #
# http://www.apache.org/licenses/LICENSE-2.0 # https://www.apache.org/licenses/LICENSE-2.0
# #
# This script downloads, patches, and builds a version of QEMU with # This script downloads, patches, and builds a version of QEMU with
# minor tweaks to allow non-instrumented binaries to be run under # minor tweaks to allow non-instrumented binaries to be run under

2
src/afl-analyze.c
View File

@ -15,7 +15,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
A nifty utility that grabs an input file and takes a stab at explaining A nifty utility that grabs an input file and takes a stab at explaining
its structure by observing how changes to it affect the execution path. its structure by observing how changes to it affect the execution path.

4
src/afl-as.c
View File

@ -15,7 +15,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
The sole purpose of this wrapper is to preprocess assembly files generated The sole purpose of this wrapper is to preprocess assembly files generated
by GCC / clang and inject the instrumentation bits included from afl-as.h. It by GCC / clang and inject the instrumentation bits included from afl-as.h. It
@ -101,7 +101,7 @@ static void edit_params(int argc, char **argv) {
/* On MacOS X, the Xcode cctool 'as' driver is a bit stale and does not work /* On MacOS X, the Xcode cctool 'as' driver is a bit stale and does not work
with the code generated by newer versions of clang that are hand-built with the code generated by newer versions of clang that are hand-built
by the user. See the thread here: http://goo.gl/HBWDtn. by the user. See the thread here: https://goo.gl/HBWDtn.
To work around this, when using clang and running without AFL_AS To work around this, when using clang and running without AFL_AS
specified, we will actually call 'clang -c' instead of 'as -q' to specified, we will actually call 'clang -c' instead of 'as -q' to

2
src/afl-cc.c
View File

@ -11,7 +11,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
*/ */

2
src/afl-common.c
View File

@ -15,7 +15,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
Gather some functions common to multiple executables Gather some functions common to multiple executables

8
src/afl-forkserver.c
View File

@ -19,7 +19,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
Shared code that implements a forkserver. This is used by the fuzzer Shared code that implements a forkserver. This is used by the fuzzer
as well the other components like afl-tmin. as well the other components like afl-tmin.
@ -351,7 +351,7 @@ static void report_error_and_exit(int error) {
/* Spins up fork server. The idea is explained here: /* Spins up fork server. The idea is explained here:
http://lcamtuf.blogspot.com/2014/10/fuzzing-binaries-without-execve.html https://lcamtuf.blogspot.com/2014/10/fuzzing-binaries-without-execve.html
In essence, the instrumentation allows us to skip execve(), and just keep In essence, the instrumentation allows us to skip execve(), and just keep
cloning a stopped child. So, we just execute once, and then send commands cloning a stopped child. So, we just execute once, and then send commands
@ -917,7 +917,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
MSG_ULIMIT_USAGE MSG_ULIMIT_USAGE
" /path/to/fuzzed_app )\n\n" " /path/to/fuzzed_app )\n\n"
" Tip: you can use http://jwilk.net/software/recidivm to " " Tip: you can use https://jwilk.net/software/recidivm to "
"quickly\n" "quickly\n"
" estimate the required amount of virtual memory for the " " estimate the required amount of virtual memory for the "
"binary.\n\n" "binary.\n\n"
@ -1017,7 +1017,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
MSG_ULIMIT_USAGE MSG_ULIMIT_USAGE
" /path/to/fuzzed_app )\n\n" " /path/to/fuzzed_app )\n\n"
" Tip: you can use http://jwilk.net/software/recidivm to quickly\n" " Tip: you can use https://jwilk.net/software/recidivm to quickly\n"
" estimate the required amount of virtual memory for the " " estimate the required amount of virtual memory for the "
"binary.\n\n" "binary.\n\n"

2
src/afl-fuzz-bitmap.c
View File

@ -15,7 +15,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This is the real deal: the program takes an instrumented binary and This is the real deal: the program takes an instrumented binary and
attempts a variety of basic fuzzing tricks, paying close attention to attempts a variety of basic fuzzing tricks, paying close attention to

2
src/afl-fuzz-cmplog.c
View File

@ -17,7 +17,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
Shared code to handle the shared memory. This is used by the fuzzer Shared code to handle the shared memory. This is used by the fuzzer
as well the other components like afl-tmin, afl-showmap, etc... as well the other components like afl-tmin, afl-showmap, etc...

2
src/afl-fuzz-extras.c
View File

@ -15,7 +15,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This is the real deal: the program takes an instrumented binary and This is the real deal: the program takes an instrumented binary and
attempts a variety of basic fuzzing tricks, paying close attention to attempts a variety of basic fuzzing tricks, paying close attention to

4
src/afl-fuzz-init.c
View File

@ -15,7 +15,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This is the real deal: the program takes an instrumented binary and This is the real deal: the program takes an instrumented binary and
attempts a variety of basic fuzzing tricks, paying close attention to attempts a variety of basic fuzzing tricks, paying close attention to
@ -974,7 +974,7 @@ void perform_dry_run(afl_state_t *afl) {
MSG_ULIMIT_USAGE MSG_ULIMIT_USAGE
" /path/to/binary [...] <testcase )\n\n" " /path/to/binary [...] <testcase )\n\n"
" Tip: you can use http://jwilk.net/software/recidivm to " " Tip: you can use https://jwilk.net/software/recidivm to "
"quickly\n" "quickly\n"
" estimate the required amount of virtual memory for the " " estimate the required amount of virtual memory for the "
"binary. Also,\n" "binary. Also,\n"

2
src/afl-fuzz-mutators.c
View File

@ -16,7 +16,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This is the real deal: the program takes an instrumented binary and This is the real deal: the program takes an instrumented binary and
attempts a variety of basic fuzzing tricks, paying close attention to attempts a variety of basic fuzzing tricks, paying close attention to

2
src/afl-fuzz-one.c
View File

@ -15,7 +15,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This is the real deal: the program takes an instrumented binary and This is the real deal: the program takes an instrumented binary and
attempts a variety of basic fuzzing tricks, paying close attention to attempts a variety of basic fuzzing tricks, paying close attention to

2
src/afl-fuzz-python.c
View File

@ -15,7 +15,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This is the real deal: the program takes an instrumented binary and This is the real deal: the program takes an instrumented binary and
attempts a variety of basic fuzzing tricks, paying close attention to attempts a variety of basic fuzzing tricks, paying close attention to

2
src/afl-fuzz-queue.c
View File

@ -14,7 +14,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This is the real deal: the program takes an instrumented binary and This is the real deal: the program takes an instrumented binary and
attempts a variety of basic fuzzing tricks, paying close attention to attempts a variety of basic fuzzing tricks, paying close attention to

2
src/afl-fuzz-redqueen.c
View File

@ -17,7 +17,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
Shared code to handle the shared memory. This is used by the fuzzer Shared code to handle the shared memory. This is used by the fuzzer
as well the other components like afl-tmin, afl-showmap, etc... as well the other components like afl-tmin, afl-showmap, etc...

2
src/afl-fuzz-run.c
View File

@ -16,7 +16,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This is the real deal: the program takes an instrumented binary and This is the real deal: the program takes an instrumented binary and
attempts a variety of basic fuzzing tricks, paying close attention to attempts a variety of basic fuzzing tricks, paying close attention to

2
src/afl-fuzz-state.c
View File

@ -15,7 +15,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This is the real deal: the program takes an instrumented binary and This is the real deal: the program takes an instrumented binary and
attempts a variety of basic fuzzing tricks, paying close attention to attempts a variety of basic fuzzing tricks, paying close attention to

2
src/afl-fuzz-stats.c
View File

@ -15,7 +15,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This is the real deal: the program takes an instrumented binary and This is the real deal: the program takes an instrumented binary and
attempts a variety of basic fuzzing tricks, paying close attention to attempts a variety of basic fuzzing tricks, paying close attention to

2
src/afl-fuzz.c
View File

@ -15,7 +15,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This is the real deal: the program takes an instrumented binary and This is the real deal: the program takes an instrumented binary and
attempts a variety of basic fuzzing tricks, paying close attention to attempts a variety of basic fuzzing tricks, paying close attention to

2
src/afl-gotcpu.c
View File

@ -15,7 +15,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
This tool provides a fairly accurate measurement of CPU preemption rate. This tool provides a fairly accurate measurement of CPU preemption rate.
It is meant to complement the quick-and-dirty load average widget shown It is meant to complement the quick-and-dirty load average widget shown

2
src/afl-ld-lto.c
View File

@ -15,7 +15,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
The sole purpose of this wrapper is to preprocess clang LTO files when The sole purpose of this wrapper is to preprocess clang LTO files when
linking with lld and performing the instrumentation on the whole program. linking with lld and performing the instrumentation on the whole program.

2
src/afl-performance.c
View File

@ -5,7 +5,7 @@
and related and neighboring rights to this software to the public domain and related and neighboring rights to this software to the public domain
worldwide. This software is distributed without any warranty. worldwide. This software is distributed without any warranty.
See <http://creativecommons.org/publicdomain/zero/1.0/>. See <https://creativecommons.org/publicdomain/zero/1.0/>.
This is xoshiro256++ 1.0, one of our all-purpose, rock-solid generators. This is xoshiro256++ 1.0, one of our all-purpose, rock-solid generators.
It has excellent (sub-ns) speed, a state (256 bits) that is large It has excellent (sub-ns) speed, a state (256 bits) that is large

2
src/afl-sharedmem.c
View File

@ -17,7 +17,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
Shared code to handle the shared memory. This is used by the fuzzer Shared code to handle the shared memory. This is used by the fuzzer
as well the other components like afl-tmin, afl-showmap, etc... as well the other components like afl-tmin, afl-showmap, etc...

2
src/afl-showmap.c
View File

@ -18,7 +18,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
A very simple tool that runs the targeted binary and displays A very simple tool that runs the targeted binary and displays
the contents of the trace bitmap in a human-readable form. Useful in the contents of the trace bitmap in a human-readable form. Useful in

2
src/afl-tmin.c
View File

@ -18,7 +18,7 @@
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
A simple test case minimizer that takes an input file and tries to remove A simple test case minimizer that takes an input file and tries to remove
as much data as possible while keeping the binary in a crashing state as much data as possible while keeping the binary in a crashing state

2
test-instr.c
View File

@ -7,7 +7,7 @@
Licensed under the Apache License, Version 2.0 (the "License"); Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at: You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0
*/ */
#include <stdio.h> #include <stdio.h>

2
unicorn_mode/build_unicorn_support.sh
View File

@ -20,7 +20,7 @@
# you may not use this file except in compliance with the License. # you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: # You may obtain a copy of the License at:
# #
# http://www.apache.org/licenses/LICENSE-2.0 # https://www.apache.org/licenses/LICENSE-2.0
# #
# This script downloads, patches, and builds a version of Unicorn with # This script downloads, patches, and builds a version of Unicorn with
# minor tweaks to allow Unicorn-emulated binaries to be run under # minor tweaks to allow Unicorn-emulated binaries to be run under