ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-15 11:28:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

cmplog runtime for LLVM

Browse Source
This commit is contained in:
Andrea Fioraldi
2020-01-30 22:40:09 +01:00
parent b8bad5a227
commit 95a98fb3e8
13 changed files with 1377 additions and 517 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
include/afl-fuzz.h
View File

@ -452,6 +452,11 @@ extern u32 a_extras_cnt; /* Total number of tokens available */
u8* (*post_handler)(u8* buf, u32* len);
/* CmpLog */
extern u8* cmplog_binary;
extern s32 cmplog_forksrv_pid;
/* hooks for the custom mutator function */
/**
* Perform custom mutations on a given input
@ -647,12 +652,13 @@ char** get_qemu_argv(u8*, char**, int);
char** get_wine_argv(u8*, char**, int);
void save_cmdline(u32, char**);
/* RedQueen */
extern u8* cmplog_binary;
extern s32 cmplog_forksrv_pid;
/* CmpLog */
void init_cmplog_forkserver(char** argv);
u8 common_fuzz_cmplog_stuff(char** argv, u8* out_buf, u32 len);
/* RedQueen */
u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len,
u32 exec_cksum);

30
include/cmplog.h
View File

@ -1,5 +1,31 @@
#ifndef _AFL_REDQUEEN_H
#define _AFL_REDQUEEN_H
/*
american fuzzy lop++ - cmplog header
------------------------------------
Originally written by Michal Zalewski
Forkserver design by Jann Horn <jannhorn@googlemail.com>
Now maintained by by Marc Heuse <mh@mh-sec.de>,
Heiko Eißfeldt <heiko.eissfeldt@hexco.de> and
Andrea Fioraldi <andreafioraldi@gmail.com>
Copyright 2016, 2017 Google Inc. All rights reserved.
Copyright 2019-2020 AFLplusplus Project. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0
Shared code to handle the shared memory. This is used by the fuzzer
as well the other components like afl-tmin, afl-showmap, etc...
*/
#ifndef _AFL_CMPLOG_H
#define _AFL_CMPLOG_H
#include "config.h"

1
include/sharedmem.h
View File

@ -31,6 +31,7 @@ void setup_shm(unsigned char dumb_mode);
void remove_shm(void);
extern int cmplog_mode;
extern struct cmp_map* cmp_map;
#endif

14
include/types.h
View File

@ -78,6 +78,20 @@ typedef int64_t s64;
\
})
#define SWAP64(_x) \
({ \
\
u64 _ret = (_x); \
_ret = \
(_ret & 0x00000000FFFFFFFF) << 32 | (_ret & 0xFFFFFFFF00000000) >> 32; \
_ret = \
(_ret & 0x0000FFFF0000FFFF) << 16 | (_ret & 0xFFFF0000FFFF0000) >> 16; \
_ret = \
(_ret & 0x00FF00FF00FF00FF) << 8 | (_ret & 0xFF00FF00FF00FF00) >> 8; \
_ret; \
\
})
#ifdef AFL_LLVM_PASS
#if defined(__linux__)
#define AFL_SR(s) (srandom(s))

17
llvm_mode/Makefile
View File

@ -19,8 +19,6 @@
# For Heiko:
#TEST_MMAP=1
AFL_TRACE_PC=1
PREFIX ?= /usr/local
HELPER_PATH = $(PREFIX)/lib/afl
BIN_PATH = $(PREFIX)/bin
@ -133,9 +131,9 @@ ifeq "$(TEST_MMAP)" "1"
endif
ifndef AFL_TRACE_PC
PROGS = ../afl-clang-fast ../afl-llvm-pass.so ../libLLVMInsTrim.so ../afl-llvm-rt.o ../afl-llvm-rt-32.o ../afl-llvm-rt-64.o ../compare-transform-pass.so ../split-compares-pass.so ../split-switches-pass.so
PROGS = ../afl-clang-fast ../afl-llvm-cmplog-rt.o ../afl-llvm-cmplog-rt-32.o ../afl-llvm-cmplog-rt-64.o ../afl-llvm-pass.so ../libLLVMInsTrim.so ../afl-llvm-rt.o ../afl-llvm-rt-32.o ../afl-llvm-rt-64.o ../compare-transform-pass.so ../split-compares-pass.so ../split-switches-pass.so
else
PROGS = ../afl-clang-fast ../afl-llvm-rt.o ../afl-llvm-rt-32.o ../afl-llvm-rt-64.o ../compare-transform-pass.so ../split-compares-pass.so ../split-switches-pass.so
PROGS = ../afl-clang-fast ../afl-llvm-cmplog-rt.o ../afl-llvm-cmplog-rt-32.o ../afl-llvm-cmplog-rt-64.o ../afl-llvm-rt.o ../afl-llvm-rt-32.o ../afl-llvm-rt-64.o ../compare-transform-pass.so ../split-compares-pass.so ../split-switches-pass.so
endif
ifneq "$(CLANGVER)" "$(LLVMVER)"
@ -228,6 +226,17 @@ endif
@printf "[*] Building 64-bit variant of the runtime (-m64)... "
@$(CC) $(CFLAGS) -m64 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
../afl-llvm-cmplog-rt.o: afl-llvm-cmplog-rt.o.c | test_deps
$(CC) $(CFLAGS) -fPIC -c $< -o $@
../afl-llvm-cmplog-rt-32.o: afl-llvm-cmplog-rt.o.c | test_deps
@printf "[*] Building 32-bit variant of the CmpLog runtime (-m32)... "
@$(CC) $(CFLAGS) -m32 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
../afl-llvm-cmplog-rt-64.o: afl-llvm-cmplog-rt.o.c | test_deps
@printf "[*] Building 64-bit variant of the CmpLog runtime (-m64)... "
@$(CC) $(CFLAGS) -m64 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
test_build: $(PROGS)
@echo "[*] Testing the CC wrapper and instrumentation output..."
unset AFL_USE_ASAN AFL_USE_MSAN AFL_INST_RATIO; AFL_QUIET=1 AFL_PATH=. AFL_CC=$(CC) AFL_LLVM_LAF_SPLIT_SWITCHES=1 AFL_LLVM_LAF_TRANSFORM_COMPARES=1 AFL_LLVM_LAF_SPLIT_COMPARES=1 ../afl-clang-fast $(CFLAGS) ../test-instr.c -o test-instr $(LDFLAGS)

42
llvm_mode/README.cmplog.md Normal file
View File

@ -0,0 +1,42 @@
# CmpLog instrumentation
The CmpLog instrumentation enables the logging of the comparisons operands in a
shared memory.
These values can be used by variuous mutator built on top of it.
At the moment we support the RedQueen mutator (input-2-state instructions only).
## Build
Tou use CmpLog, you have to build two versions of the instrumented target
program.
The first, using the regular AFL++ instrumentation.
The second, the CmpLog binary, setting AFL_LLVM_CMPLOG during the compilation.
For example:
```
./configure --cc=~/path/to/afl-clang-fast
make
cp ./program ./program.afl
make clean
export AFL_LLVM_CMPLOG=1
./configure --cc=~/path/to/afl-clang-fast
make
cp ./program ./program.cmplog
```
## Use
AFL++ have the -c option that can be used to specify a CmpLog binary (the second
built).
For example:
```
afl-fuzz -i input -o output -c ./program.cmplog -m none -- ./program.afl @@
```
Be careful to use -m none because CmpLog maps a lot of pages.

44
llvm_mode/afl-clang-fast.c
View File

@ -40,6 +40,7 @@ static u8* obj_path; /* Path to runtime libraries */
static u8** cc_params; /* Parameters passed to the real CC */
static u32 cc_par_cnt = 1; /* Param count, including argv0 */
static u8 llvm_fullpath[PATH_MAX];
static u8 cmplog_mode;
/* Try to find the runtime libraries. If that fails, abort. */
@ -196,16 +197,20 @@ static void edit_params(u32 argc, char** argv) {
// /laf
#ifdef USE_TRACE_PC
if (getenv("AFL_CMPLOG"))
if (cmplog_mode) {
cc_params[cc_par_cnt++] = "-fsanitize-coverage=trace-pc-guard,trace-cmp";
else
cc_params[cc_par_cnt++] =
"-fsanitize-coverage=trace-pc-guard"; // edge coverage by default
// cc_params[cc_par_cnt++] = "-mllvm";
// cc_params[cc_par_cnt++] =
// "-fsanitize-coverage=trace-cmp,trace-div,trace-gep";
// cc_params[cc_par_cnt++] = "-sanitizer-coverage-block-threshold=0";
} else {
#ifdef USE_TRACE_PC
cc_params[cc_par_cnt++] =
"-fsanitize-coverage=trace-pc-guard"; // edge coverage by default
// cc_params[cc_par_cnt++] = "-mllvm";
// cc_params[cc_par_cnt++] =
// "-fsanitize-coverage=trace-cmp,trace-div,trace-gep";
// cc_params[cc_par_cnt++] = "-sanitizer-coverage-block-threshold=0";
#else
cc_params[cc_par_cnt++] = "-Xclang";
cc_params[cc_par_cnt++] = "-load";
@ -216,6 +221,8 @@ static void edit_params(u32 argc, char** argv) {
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-pass.so", obj_path);
#endif /* ^USE_TRACE_PC */
}
cc_params[cc_par_cnt++] = "-Qunused-arguments";
/* Detect stray -v calls from ./configure scripts. */
@ -380,11 +387,17 @@ static void edit_params(u32 argc, char** argv) {
switch (bit_mode) {
case 0:
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt.o", obj_path);
if (cmplog_mode)
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-cmplog-rt.o", obj_path);
else
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt.o", obj_path);
break;
case 32:
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt-32.o", obj_path);
if (cmplog_mode)
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-cmplog-rt-32.o", obj_path);
else
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt-32.o", obj_path);
if (access(cc_params[cc_par_cnt - 1], R_OK))
FATAL("-m32 is not supported by your compiler");
@ -392,7 +405,10 @@ static void edit_params(u32 argc, char** argv) {
break;
case 64:
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt-64.o", obj_path);
if (cmplog_mode)
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-cmplog-rt-64.o", obj_path);
else
cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt-64.o", obj_path);
if (access(cc_params[cc_par_cnt - 1], R_OK))
FATAL("-m64 is not supported by your compiler");
@ -463,6 +479,10 @@ int main(int argc, char** argv) {
#endif /* ^USE_TRACE_PC */
}
cmplog_mode = getenv("AFL_CMPLOG") || getenv("AFL_LLVM_CMPLOG");
if (cmplog_mode)
printf("CmpLog mode by <andreafioraldi@gmail.com>\n");
#ifndef __ANDROID__
find_obj(argv[0]);

412
llvm_mode/afl-llvm-cmplog-rt.o.c Normal file
View File

@ -0,0 +1,412 @@
/*
american fuzzy lop++ - LLVM instrumentation bootstrap
---------------------------------------------------
Written by Laszlo Szekeres <lszekeres@google.com> and
Michal Zalewski
LLVM integration design comes from Laszlo Szekeres.
Copyright 2015, 2016 Google Inc. All rights reserved.
Copyright 2019-2020 AFLplusplus Project. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0
This code is the rewrite of afl-as.h's main_payload.
*/
#ifdef __ANDROID__
#include "android-ashmem.h"
#endif
#include "config.h"
#include "types.h"
#include "cmplog.h"
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <unistd.h>
#include <string.h>
#include <assert.h>
#include <stdint.h>
#include <sys/mman.h>
#include <sys/shm.h>
#include <sys/wait.h>
#include <sys/types.h>
/* This is a somewhat ugly hack for the experimental 'trace-pc-guard' mode.
Basically, we need to make sure that the forkserver is initialized after
the LLVM-generated runtime initialization pass, not before. */
#ifdef USE_TRACE_PC
#define CONST_PRIO 5
#else
#define CONST_PRIO 0
#endif /* ^USE_TRACE_PC */
#include <sys/mman.h>
#include <fcntl.h>
/* Globals needed by the injected instrumentation. The __afl_area_initial region
is used for instrumentation output before __afl_map_shm() has a chance to
run. It will end up as .comm, so it shouldn't be too wasteful. */
// In CmpLog, the only usage of __afl_area_ptr is to report errors
u8* __afl_area_ptr;
struct cmp_map* __afl_cmp_map;
__thread u32 __afl_cmp_counter;
/* Running in persistent mode? */
static u8 is_persistent;
/* SHM setup. */
static void __afl_map_shm(void) {
u8* id_str = getenv(SHM_ENV_VAR);
/* If we're running under AFL, attach to the appropriate region, replacing the
early-stage __afl_area_initial region that is needed to allow some really
hacky .init code to work correctly in projects such as OpenSSL. */
if (id_str) {
#ifdef USEMMAP
const char* shm_file_path = id_str;
int shm_fd = -1;
unsigned char* shm_base = NULL;
/* create the shared memory segment as if it was a file */
shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
if (shm_fd == -1) {
printf("shm_open() failed\n");
exit(1);
}
/* map the shared memory segment to the address space of the process */
shm_base = mmap(0, MAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, shm_fd, 0);
if (shm_base == MAP_FAILED) {
close(shm_fd);
shm_fd = -1;
printf("mmap() failed\n");
exit(2);
}
__afl_area_ptr = shm_base;
#else
u32 shm_id = atoi(id_str);
__afl_area_ptr = shmat(shm_id, NULL, 0);
#endif
/* Whooooops. */
if (__afl_area_ptr == (void*)-1) _exit(1);
/* Write something into the bitmap so that even with low AFL_INST_RATIO,
our parent doesn't give up on us. */
__afl_area_ptr[0] = 1;
}
id_str = getenv(CMPLOG_SHM_ENV_VAR);
if (id_str) {
u32 shm_id = atoi(id_str);
__afl_cmp_map = shmat(shm_id, NULL, 0);
if (__afl_cmp_map == (void*)-1) _exit(1);
}
}
/* Fork server logic. */
static void __afl_start_forkserver(void) {
static u8 tmp[4];
s32 child_pid;
u8 child_stopped = 0;
void (*old_sigchld_handler)(int) = 0; // = signal(SIGCHLD, SIG_DFL);
/* Phone home and tell the parent that we're OK. If parent isn't there,
assume we're not running in forkserver mode and just execute program. */
if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
while (1) {
u32 was_killed;
int status;
/* Wait for parent by reading from the pipe. Abort if read fails. */
if (read(FORKSRV_FD, &was_killed, 4) != 4) _exit(1);
/* If we stopped the child in persistent mode, but there was a race
condition and afl-fuzz already issued SIGKILL, write off the old
process. */
if (child_stopped && was_killed) {
child_stopped = 0;
if (waitpid(child_pid, &status, 0) < 0) _exit(1);
}
if (!child_stopped) {
/* Once woken up, create a clone of our process. */
child_pid = fork();
if (child_pid < 0) _exit(1);
/* In child process: close fds, resume execution. */
if (!child_pid) {
signal(SIGCHLD, old_sigchld_handler);
close(FORKSRV_FD);
close(FORKSRV_FD + 1);
return;
}
} else {
/* Special handling for persistent mode: if the child is alive but
currently stopped, simply restart it with SIGCONT. */
kill(child_pid, SIGCONT);
child_stopped = 0;
}
/* In parent process: write PID to pipe, then wait for child. */
if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) _exit(1);
if (waitpid(child_pid, &status, is_persistent ? WUNTRACED : 0) < 0)
_exit(1);
/* In persistent mode, the child stops itself with SIGSTOP to indicate
a successful run. In this case, we want to wake it up without forking
again. */
if (WIFSTOPPED(status)) child_stopped = 1;
/* Relay wait status to pipe, then loop back. */
if (write(FORKSRV_FD + 1, &status, 4) != 4) _exit(1);
}
}
/* A simplified persistent mode handler, used as explained in README.llvm. */
int __afl_persistent_loop(unsigned int max_cnt) {
static u8 first_pass = 1;
static u32 cycle_cnt;
if (first_pass) {
/* Make sure that every iteration of __AFL_LOOP() starts with a clean slate.
On subsequent calls, the parent will take care of that, but on the first
iteration, it's our job to erase any trace of whatever happened
before the loop. */
if (is_persistent) {
// memset(__afl_area_ptr, 0, MAP_SIZE);
__afl_area_ptr[0] = 1;
}
cycle_cnt = max_cnt;
first_pass = 0;
return 1;
}
if (is_persistent) {
if (--cycle_cnt) {
raise(SIGSTOP);
__afl_area_ptr[0] = 1;
return 1;
} else {
/* When exiting __AFL_LOOP(), make sure that the subsequent code that
follows the loop is not traced. We do that by pivoting back to the
dummy output region. */
// __afl_area_ptr = __afl_area_initial;
}
}
return 0;
}
/* This one can be called from user code when deferred forkserver mode
is enabled. */
void __afl_manual_init(void) {
static u8 init_done;
if (!init_done) {
__afl_map_shm();
__afl_start_forkserver();
init_done = 1;
}
}
/* Proper initialization routine. */
__attribute__((constructor(CONST_PRIO))) void __afl_auto_init(void) {
is_persistent = !!getenv(PERSIST_ENV_VAR);
if (getenv(DEFER_ENV_VAR)) return;
__afl_manual_init();
}
///// CmpLog instrumentation
void __sanitizer_cov_trace_cmp1(uint8_t Arg1, uint8_t Arg2) {
return;
}
void __sanitizer_cov_trace_cmp2(uint16_t Arg1, uint16_t Arg2) {
if (!__afl_cmp_map) return;
uintptr_t k = (uintptr_t)__builtin_return_address(0);
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
u32 hits = __afl_cmp_map->headers[k].hits;
__afl_cmp_map->headers[k].hits = hits + 1;
// if (!__afl_cmp_map->headers[k].cnt)
// __afl_cmp_map->headers[k].cnt = __afl_cmp_counter++;
__afl_cmp_map->headers[k].shape = 1;
//__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = Arg1;
__afl_cmp_map->log[k][hits].v1 = Arg2;
}
void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) {
if (!__afl_cmp_map) return;
uintptr_t k = (uintptr_t)__builtin_return_address(0);
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
u32 hits = __afl_cmp_map->headers[k].hits;
__afl_cmp_map->headers[k].hits = hits + 1;
__afl_cmp_map->headers[k].shape = 3;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = Arg1;
__afl_cmp_map->log[k][hits].v1 = Arg2;
}
void __sanitizer_cov_trace_cmp8(uint64_t Arg1, uint64_t Arg2) {
if (!__afl_cmp_map) return;
uintptr_t k = (uintptr_t)__builtin_return_address(0);
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
u32 hits = __afl_cmp_map->headers[k].hits;
__afl_cmp_map->headers[k].hits = hits + 1;
__afl_cmp_map->headers[k].shape = 7;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = Arg1;
__afl_cmp_map->log[k][hits].v1 = Arg2;
}
#if defined(__APPLE__)
#pragma weak __sanitizer_cov_trace_const_cmp1 = __sanitizer_cov_trace_cmp1
#pragma weak __sanitizer_cov_trace_const_cmp2 = __sanitizer_cov_trace_cmp2
#pragma weak __sanitizer_cov_trace_const_cmp4 = __sanitizer_cov_trace_cmp4
#pragma weak __sanitizer_cov_trace_const_cmp8 = __sanitizer_cov_trace_cmp8
#else
void __sanitizer_cov_trace_const_cmp1(uint8_t Arg1, uint8_t Arg2)
__attribute__((alias("__sanitizer_cov_trace_cmp1")));
void __sanitizer_cov_trace_const_cmp2(uint16_t Arg1, uint16_t Arg2)
__attribute__((alias("__sanitizer_cov_trace_cmp2")));
void __sanitizer_cov_trace_const_cmp4(uint32_t Arg1, uint32_t Arg2)
__attribute__((alias("__sanitizer_cov_trace_cmp4")));
void __sanitizer_cov_trace_const_cmp8(uint64_t Arg1, uint64_t Arg2)
__attribute__((alias("__sanitizer_cov_trace_cmp8")));
#endif /* defined(__APPLE__) */
void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t* Cases) {
for (uint64_t i = 0; i < Cases[0]; i++) {
uintptr_t k = (uintptr_t)__builtin_return_address(0) + i;
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
u32 hits = __afl_cmp_map->headers[k].hits;
__afl_cmp_map->headers[k].hits = hits + 1;
__afl_cmp_map->headers[k].shape = 7;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = Val;
__afl_cmp_map->log[k][hits].v1 = Cases[i + 2];
}
}

422
llvm_mode/afl-llvm-cmplog.rt.o.c Normal file
View File

@ -0,0 +1,422 @@
/*
american fuzzy lop++ - LLVM instrumentation bootstrap
---------------------------------------------------
Written by Laszlo Szekeres <lszekeres@google.com> and
Michal Zalewski
LLVM integration design comes from Laszlo Szekeres.
Copyright 2015, 2016 Google Inc. All rights reserved.
Copyright 2019-2020 AFLplusplus Project. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0
This code is the rewrite of afl-as.h's main_payload.
*/
#ifdef __ANDROID__
#include "android-ashmem.h"
#endif
#include "config.h"
#include "types.h"
#include "cmplog.h"
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <unistd.h>
#include <string.h>
#include <assert.h>
#include <stdint.h>
#include <sys/mman.h>
#include <sys/shm.h>
#include <sys/wait.h>
#include <sys/types.h>
/* This is a somewhat ugly hack for the experimental 'trace-pc-guard' mode.
Basically, we need to make sure that the forkserver is initialized after
the LLVM-generated runtime initialization pass, not before. */
#ifdef USE_TRACE_PC
#define CONST_PRIO 5
#else
#define CONST_PRIO 0
#endif /* ^USE_TRACE_PC */
#include <sys/mman.h>
#include <fcntl.h>
/* Globals needed by the injected instrumentation. The __afl_area_initial region
is used for instrumentation output before __afl_map_shm() has a chance to
run. It will end up as .comm, so it shouldn't be too wasteful. */
// In CmpLog, the only usage of __afl_area_ptr is to report errors
u8* __afl_area_ptr;
struct cmp_map* __afl_cmp_map;
__thread u32 __afl_cmp_counter;
/* Running in persistent mode? */
static u8 is_persistent;
/* SHM setup. */
static void __afl_map_shm(void) {
u8* id_str = getenv(SHM_ENV_VAR);
/* If we're running under AFL, attach to the appropriate region, replacing the
early-stage __afl_area_initial region that is needed to allow some really
hacky .init code to work correctly in projects such as OpenSSL. */
if (id_str) {
#ifdef USEMMAP
const char* shm_file_path = id_str;
int shm_fd = -1;
unsigned char* shm_base = NULL;
/* create the shared memory segment as if it was a file */
shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
if (shm_fd == -1) {
printf("shm_open() failed\n");
exit(1);
}
/* map the shared memory segment to the address space of the process */
shm_base = mmap(0, MAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, shm_fd, 0);
if (shm_base == MAP_FAILED) {
close(shm_fd);
shm_fd = -1;
printf("mmap() failed\n");
exit(2);
}
__afl_area_ptr = shm_base;
#else
u32 shm_id = atoi(id_str);
__afl_area_ptr = shmat(shm_id, NULL, 0);
#endif
/* Whooooops. */
if (__afl_area_ptr == (void*)-1) _exit(1);
/* Write something into the bitmap so that even with low AFL_INST_RATIO,
our parent doesn't give up on us. */
__afl_area_ptr[0] = 1;
}
id_str = getenv(CMPLOG_SHM_ENV_VAR);
if (id_str) {
u32 shm_id = atoi(id_str);
__afl_cmp_map = shmat(shm_id, NULL, 0);
if (__afl_cmp_map == (void*)-1) _exit(1);
}
}
/* Fork server logic. */
static void __afl_start_forkserver(void) {
static u8 tmp[4];
s32 child_pid;
u8 child_stopped = 0;
void (*old_sigchld_handler)(int) = 0; // = signal(SIGCHLD, SIG_DFL);
/* Phone home and tell the parent that we're OK. If parent isn't there,
assume we're not running in forkserver mode and just execute program. */
if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
while (1) {
u32 was_killed;
int status;
/* Wait for parent by reading from the pipe. Abort if read fails. */
if (read(FORKSRV_FD, &was_killed, 4) != 4) _exit(1);
/* If we stopped the child in persistent mode, but there was a race
condition and afl-fuzz already issued SIGKILL, write off the old
process. */
if (child_stopped && was_killed) {
child_stopped = 0;
if (waitpid(child_pid, &status, 0) < 0) _exit(1);
}
if (!child_stopped) {
/* Once woken up, create a clone of our process. */
child_pid = fork();
if (child_pid < 0) _exit(1);
/* In child process: close fds, resume execution. */
if (!child_pid) {
signal(SIGCHLD, old_sigchld_handler);
close(FORKSRV_FD);
close(FORKSRV_FD + 1);
return;
}
} else {
/* Special handling for persistent mode: if the child is alive but
currently stopped, simply restart it with SIGCONT. */
kill(child_pid, SIGCONT);
child_stopped = 0;
}
/* In parent process: write PID to pipe, then wait for child. */
if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) _exit(1);
if (waitpid(child_pid, &status, is_persistent ? WUNTRACED : 0) < 0)
_exit(1);
/* In persistent mode, the child stops itself with SIGSTOP to indicate
a successful run. In this case, we want to wake it up without forking
again. */
if (WIFSTOPPED(status)) child_stopped = 1;
/* Relay wait status to pipe, then loop back. */
if (write(FORKSRV_FD + 1, &status, 4) != 4) _exit(1);
}
}
/* A simplified persistent mode handler, used as explained in README.llvm. */
int __afl_persistent_loop(unsigned int max_cnt) {
static u8 first_pass = 1;
static u32 cycle_cnt;
if (first_pass) {
/* Make sure that every iteration of __AFL_LOOP() starts with a clean slate.
On subsequent calls, the parent will take care of that, but on the first
iteration, it's our job to erase any trace of whatever happened
before the loop. */
if (is_persistent) {
// memset(__afl_area_ptr, 0, MAP_SIZE);
__afl_area_ptr[0] = 1;
}
cycle_cnt = max_cnt;
first_pass = 0;
return 1;
}
if (is_persistent) {
if (--cycle_cnt) {
raise(SIGSTOP);
__afl_area_ptr[0] = 1;
return 1;
} else {
/* When exiting __AFL_LOOP(), make sure that the subsequent code that
follows the loop is not traced. We do that by pivoting back to the
dummy output region. */
// __afl_area_ptr = __afl_area_initial;
}
}
return 0;
}
/* This one can be called from user code when deferred forkserver mode
is enabled. */
void __afl_manual_init(void) {
static u8 init_done;
if (!init_done) {
__afl_map_shm();
__afl_start_forkserver();
init_done = 1;
}
}
/* Proper initialization routine. */
__attribute__((constructor(CONST_PRIO))) void __afl_auto_init(void) {
is_persistent = !!getenv(PERSIST_ENV_VAR);
if (getenv(DEFER_ENV_VAR)) return;
__afl_manual_init();
}
///// CmpLog instrumentation
void __sanitizer_cov_trace_cmp1(uint8_t Arg1, uint8_t Arg2) {
return;
}
void __sanitizer_cov_trace_cmp2(uint16_t Arg1, uint16_t Arg2) {
if (!__afl_cmp_map) return;
uintptr_t k = (uintptr_t)__builtin_return_address(0);
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
u32 hits = __afl_cmp_map->headers[k].hits;
__afl_cmp_map->headers[k].hits = hits + 1;
// if (!__afl_cmp_map->headers[k].cnt)
// __afl_cmp_map->headers[k].cnt = __afl_cmp_counter++;
__afl_cmp_map->headers[k].shape = 1;
//__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = Arg1;
__afl_cmp_map->log[k][hits].v1 = Arg2;
}
void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) {
if (!__afl_cmp_map) return;
uintptr_t k = (uintptr_t)__builtin_return_address(0);
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
u32 hits = __afl_cmp_map->headers[k].hits;
__afl_cmp_map->headers[k].hits = hits + 1;
__afl_cmp_map->headers[k].shape = 3;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = Arg1;
__afl_cmp_map->log[k][hits].v1 = Arg2;
}
void __sanitizer_cov_trace_cmp8(uint64_t Arg1, uint64_t Arg2) {
if (!__afl_cmp_map) return;
uintptr_t k = (uintptr_t)__builtin_return_address(0);
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
u32 hits = __afl_cmp_map->headers[k].hits;
__afl_cmp_map->headers[k].hits = hits + 1;
__afl_cmp_map->headers[k].shape = 7;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = Arg1;
__afl_cmp_map->log[k][hits].v1 = Arg2;
}
#if defined(__APPLE__)
#pragma weak __sanitizer_cov_trace_const_cmp1 = __sanitizer_cov_trace_cmp1
#pragma weak __sanitizer_cov_trace_const_cmp2 = __sanitizer_cov_trace_cmp2
#pragma weak __sanitizer_cov_trace_const_cmp4 = __sanitizer_cov_trace_cmp4
#pragma weak __sanitizer_cov_trace_const_cmp8 = __sanitizer_cov_trace_cmp8
#else
void __sanitizer_cov_trace_const_cmp1(uint8_t Arg1, uint8_t Arg2)
__attribute__((alias("__sanitizer_cov_trace_cmp1")));
void __sanitizer_cov_trace_const_cmp2(uint16_t Arg1, uint16_t Arg2)
__attribute__((alias("__sanitizer_cov_trace_cmp2")));
void __sanitizer_cov_trace_const_cmp4(uint32_t Arg1, uint32_t Arg2)
__attribute__((alias("__sanitizer_cov_trace_cmp4")));
void __sanitizer_cov_trace_const_cmp8(uint64_t Arg1, uint64_t Arg2)
__attribute__((alias("__sanitizer_cov_trace_cmp8")));
#endif /* defined(__APPLE__) */
void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t* Cases) {
for (uint64_t i = 0; i < Cases[0]; i++) {
uintptr_t k = (uintptr_t)__builtin_return_address(0) + i;
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
u32 hits = __afl_cmp_map->headers[k].hits;
__afl_cmp_map->headers[k].hits = hits + 1;
__afl_cmp_map->headers[k].shape = 7;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = Val;
__afl_cmp_map->log[k][hits].v1 = Cases[i + 2];
}
}
void __sanitizer_cov_trace_pc_guard(uint32_t* guard) {
}
void __sanitizer_cov_trace_pc_guard_init(uint32_t* start, uint32_t* stop) {
}
//// Library functions hooks
// TODO

123
llvm_mode/afl-llvm-rt.o.c
View File

@ -66,9 +66,6 @@ u32 __afl_prev_loc;
__thread u32 __afl_prev_loc;
#endif
struct cmp_map* __afl_cmp_map;
__thread u32 __afl_cmp_counter;
/* Running in persistent mode? */
static u8 is_persistent;
@ -129,27 +126,6 @@ static void __afl_map_shm(void) {
}
if (getenv("__AFL_CMPLOG_MODE__")) {
id_str = getenv(CMPLOG_SHM_ENV_VAR);
if (id_str) {
u32 shm_id = atoi(id_str);
__afl_cmp_map = shmat(shm_id, NULL, 0);
if (__afl_cmp_map == (void*)-1) _exit(1);
}
} else if (getenv("AFL_CMPLOG")) {
// during compilation, do this to avoid segfault
__afl_cmp_map = calloc(sizeof(struct cmp_map), 1);
}
}
/* Fork server logic. */
@ -322,105 +298,6 @@ __attribute__((constructor(CONST_PRIO))) void __afl_auto_init(void) {
}
///// CmpLog instrumentation
void __sanitizer_cov_trace_cmp1(uint8_t Arg1, uint8_t Arg2) {
return;
}
void __sanitizer_cov_trace_cmp2(uint16_t Arg1, uint16_t Arg2) {
uintptr_t k = (uintptr_t)__builtin_return_address(0);
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
u32 hits = __afl_cmp_map->headers[k].hits;
__afl_cmp_map->headers[k].hits = hits + 1;
// if (!__afl_cmp_map->headers[k].cnt)
// __afl_cmp_map->headers[k].cnt = __afl_cmp_counter++;
__afl_cmp_map->headers[k].shape = 1;
//__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = Arg1;
__afl_cmp_map->log[k][hits].v1 = Arg2;
}
void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) {
uintptr_t k = (uintptr_t)__builtin_return_address(0);
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
u32 hits = __afl_cmp_map->headers[k].hits;
__afl_cmp_map->headers[k].hits = hits + 1;
__afl_cmp_map->headers[k].shape = 3;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = Arg1;
__afl_cmp_map->log[k][hits].v1 = Arg2;
}
void __sanitizer_cov_trace_cmp8(uint64_t Arg1, uint64_t Arg2) {
uintptr_t k = (uintptr_t)__builtin_return_address(0);
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
u32 hits = __afl_cmp_map->headers[k].hits;
__afl_cmp_map->headers[k].hits = hits + 1;
__afl_cmp_map->headers[k].shape = 7;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = Arg1;
__afl_cmp_map->log[k][hits].v1 = Arg2;
}
#if defined(__APPLE__)
#pragma weak __sanitizer_cov_trace_const_cmp1 = __sanitizer_cov_trace_cmp1
#pragma weak __sanitizer_cov_trace_const_cmp2 = __sanitizer_cov_trace_cmp2
#pragma weak __sanitizer_cov_trace_const_cmp4 = __sanitizer_cov_trace_cmp4
#pragma weak __sanitizer_cov_trace_const_cmp8 = __sanitizer_cov_trace_cmp8
#else
void __sanitizer_cov_trace_const_cmp1(uint8_t Arg1, uint8_t Arg2)
__attribute__((alias("__sanitizer_cov_trace_cmp1")));
void __sanitizer_cov_trace_const_cmp2(uint16_t Arg1, uint16_t Arg2)
__attribute__((alias("__sanitizer_cov_trace_cmp2")));
void __sanitizer_cov_trace_const_cmp4(uint32_t Arg1, uint32_t Arg2)
__attribute__((alias("__sanitizer_cov_trace_cmp4")));
void __sanitizer_cov_trace_const_cmp8(uint64_t Arg1, uint64_t Arg2)
__attribute__((alias("__sanitizer_cov_trace_cmp8")));
#endif /* defined(__APPLE__) */
void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t* Cases) {
for (uint64_t i = 0; i < Cases[0]; i++) {
uintptr_t k = (uintptr_t)__builtin_return_address(0) + i;
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
u32 hits = __afl_cmp_map->headers[k].hits;
__afl_cmp_map->headers[k].hits = hits + 1;
__afl_cmp_map->headers[k].shape = 7;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = Val;
__afl_cmp_map->log[k][hits].v1 = Cases[i + 2];
}
}
/* The following stuff deals with supporting -fsanitize-coverage=trace-pc-guard.
It remains non-operational in the traditional, plugin-backed LLVM mode.
For more info about 'trace-pc-guard', see README.llvm.

399
src/afl-fuzz-cmplog.c
View File

@ -1,373 +1,33 @@
/*
american fuzzy lop++ - cmplog execution routines
------------------------------------------------
Originally written by Michal Zalewski
Forkserver design by Jann Horn <jannhorn@googlemail.com>
Now maintained by by Marc Heuse <mh@mh-sec.de>,
Heiko Eißfeldt <heiko.eissfeldt@hexco.de> and
Andrea Fioraldi <andreafioraldi@gmail.com>
Copyright 2016, 2017 Google Inc. All rights reserved.
Copyright 2019-2020 AFLplusplus Project. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0
Shared code to handle the shared memory. This is used by the fuzzer
as well the other components like afl-tmin, afl-showmap, etc...
*/
#include "afl-fuzz.h"
#include "cmplog.h"
#define SWAP64(_x) \
({ \
\
u64 _ret = (_x); \
_ret = \
(_ret & 0x00000000FFFFFFFF) << 32 | (_ret & 0xFFFFFFFF00000000) >> 32; \
_ret = \
(_ret & 0x0000FFFF0000FFFF) << 16 | (_ret & 0xFFFF0000FFFF0000) >> 16; \
_ret = \
(_ret & 0x00FF00FF00FF00FF) << 8 | (_ret & 0xFF00FF00FF00FF00) >> 8; \
_ret; \
\
})
u8 common_fuzz_cmplog_stuff(char** argv, u8* out_buf, u32 len);
extern struct cmp_map* cmp_map; // defined in afl-sharedmem.c
u8* cmplog_binary;
char** its_argv;
///// Colorization
struct range {
u32 start;
u32 end;
struct range* next;
};
struct range* add_range(struct range* ranges, u32 start, u32 end) {
struct range* r = ck_alloc_nozero(sizeof(struct range));
r->start = start;
r->end = end;
r->next = ranges;
return r;
}
struct range* pop_biggest_range(struct range** ranges) {
struct range* r = *ranges;
struct range* prev = NULL;
struct range* rmax = NULL;
struct range* prev_rmax = NULL;
u32 max_size = 0;
while (r) {
u32 s = r->end - r->start;
if (s >= max_size) {
max_size = s;
prev_rmax = prev;
rmax = r;
}
prev = r;
r = r->next;
}
if (rmax) {
if (prev_rmax)
prev_rmax->next = rmax->next;
else
*ranges = rmax->next;
}
return rmax;
}
u8 get_exec_checksum(u8* buf, u32 len, u32* cksum) {
if (unlikely(common_fuzz_stuff(its_argv, buf, len))) return 1;
*cksum = hash32(trace_bits, MAP_SIZE, HASH_CONST);
return 0;
}
static void rand_replace(u8* buf, u32 len) {
u32 i;
for (i = 0; i < len; ++i)
buf[i] = UR(256);
}
u8 colorization(u8* buf, u32 len, u32 exec_cksum) {
struct range* ranges = add_range(NULL, 0, len);
u8* backup = ck_alloc_nozero(len);
u64 orig_hit_cnt, new_hit_cnt;
orig_hit_cnt = queued_paths + unique_crashes;
stage_name = "colorization";
stage_short = "colorization";
stage_max = 1000;
struct range* rng;
stage_cur = stage_max;
while ((rng = pop_biggest_range(&ranges)) != NULL && stage_cur) {
u32 s = rng->end - rng->start;
memcpy(backup, buf + rng->start, s);
rand_replace(buf + rng->start, s);
u32 cksum;
if (unlikely(get_exec_checksum(buf, len, &cksum))) return 1;
if (cksum != exec_cksum) {
ranges = add_range(ranges, rng->start, rng->start + s / 2);
ranges = add_range(ranges, rng->start + s / 2 + 1, rng->end);
memcpy(buf + rng->start, backup, s);
}
ck_free(rng);
--stage_cur;
}
new_hit_cnt = queued_paths + unique_crashes;
stage_finds[STAGE_COLORIZATION] += new_hit_cnt - orig_hit_cnt;
stage_cycles[STAGE_COLORIZATION] += stage_max - stage_cur;
while (ranges) {
rng = ranges;
ranges = ranges->next;
ck_free(rng);
}
return 0;
}
///// Input to State replacement
u8 its_fuzz(u32 idx, u32 size, u8* buf, u32 len, u8* status) {
u64 orig_hit_cnt, new_hit_cnt;
orig_hit_cnt = queued_paths + unique_crashes;
if (unlikely(common_fuzz_stuff(its_argv, buf, len))) return 1;
new_hit_cnt = queued_paths + unique_crashes;
if (unlikely(new_hit_cnt != orig_hit_cnt)) {
*status = 1;
} else {
if (size >= MIN_AUTO_EXTRA && size <= MAX_AUTO_EXTRA)
maybe_add_auto(&buf[idx], size);
*status = 2;
}
return 0;
}
u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
u8* orig_buf, u8* buf, u32 len, u8 do_reverse,
u8* status) {
u64* buf_64 = (u64*)&buf[idx];
u32* buf_32 = (u32*)&buf[idx];
u16* buf_16 = (u16*)&buf[idx];
// u8* buf_8 = &buf[idx];
u64* o_buf_64 = (u64*)&orig_buf[idx];
u32* o_buf_32 = (u32*)&orig_buf[idx];
u16* o_buf_16 = (u16*)&orig_buf[idx];
// u8* o_buf_8 = &orig_buf[idx];
u32 its_len = len - idx;
*status = 0;
if (SHAPE_BYTES(h->shape) == 8) {
if (its_len >= 8 && *buf_64 == pattern && *o_buf_64 == pattern) {
*buf_64 = repl;
if (unlikely(its_fuzz(idx, 8, buf, len, status))) return 1;
*buf_64 = pattern;
}
// reverse encoding
if (do_reverse)
if (unlikely(cmp_extend_encoding(h, SWAP64(pattern), SWAP64(repl), idx,
orig_buf, buf, len, 0, status)))
return 1;
}
if (SHAPE_BYTES(h->shape) == 4 || *status == 2) {
if (its_len >= 4 && *buf_32 == (u32)pattern && *o_buf_32 == (u32)pattern) {
*buf_32 = (u32)repl;
if (unlikely(its_fuzz(idx, 4, buf, len, status))) return 1;
*buf_32 = pattern;
}
// reverse encoding
if (do_reverse)
if (unlikely(cmp_extend_encoding(h, SWAP32(pattern), SWAP32(repl), idx,
orig_buf, buf, len, 0, status)))
return 1;
}
if (SHAPE_BYTES(h->shape) == 2 || *status == 2) {
if (its_len >= 2 && *buf_16 == (u16)pattern && *o_buf_16 == (u16)pattern) {
*buf_16 = (u16)repl;
if (unlikely(its_fuzz(idx, 2, buf, len, status))) return 1;
*buf_16 = (u16)pattern;
}
// reverse encoding
if (do_reverse)
if (unlikely(cmp_extend_encoding(h, SWAP16(pattern), SWAP16(repl), idx,
orig_buf, buf, len, 0, status)))
return 1;
}
/*if (SHAPE_BYTES(h->shape) == 1 || *status == 2) {
if (its_len >= 2 && *buf_8 == (u8)pattern && *o_buf_8 == (u8)pattern) {
*buf_8 = (u8)repl;
if (unlikely(its_fuzz(idx, 1, buf, len, status)))
return 1;
*buf_16 = (u16)pattern;
}
}*/
return 0;
}
u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
struct cmp_header* h = &cmp_map->headers[key];
u32 i, j, idx;
u32 loggeds = h->hits;
if (h->hits > CMP_MAP_H) loggeds = CMP_MAP_H;
u8 status;
// opt not in the paper
u32 fails = 0;
for (i = 0; i < loggeds; ++i) {
struct cmp_operands* o = &cmp_map->log[key][i];
// opt not in the paper
for (j = 0; j < i; ++j)
if (cmp_map->log[key][j].v0 == o->v0 && cmp_map->log[key][i].v1 == o->v1)
goto cmp_fuzz_next_iter;
for (idx = 0; idx < len && fails < 8; ++idx) {
if (unlikely(cmp_extend_encoding(h, o->v0, o->v1, idx, orig_buf, buf, len,
1, &status)))
return 1;
if (status == 2)
++fails;
else if (status == 1)
break;
if (unlikely(cmp_extend_encoding(h, o->v1, o->v0, idx, orig_buf, buf, len,
1, &status)))
return 1;
if (status == 2)
++fails;
else if (status == 1)
break;
}
cmp_fuzz_next_iter:
stage_cur++;
}
return 0;
}
///// Input to State stage
// queue_cur->exec_cksum
u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len,
u32 exec_cksum) {
its_argv = argv;
if (unlikely(colorization(buf, len, exec_cksum))) return 1;
// do it manually, forkserver clear only trace_bits
memset(cmp_map->headers, 0, sizeof(cmp_map->headers));
if (unlikely(common_fuzz_cmplog_stuff(argv, buf, len))) return 1;
u64 orig_hit_cnt, new_hit_cnt;
u64 orig_execs = total_execs;
orig_hit_cnt = queued_paths + unique_crashes;
stage_name = "input-to-state";
stage_short = "its";
stage_max = 0;
stage_cur = 0;
u32 k;
for (k = 0; k < CMP_MAP_W; ++k) {
if (!cmp_map->headers[k].hits) continue;
if (cmp_map->headers[k].hits > CMP_MAP_H)
stage_max += CMP_MAP_H;
else
stage_max += cmp_map->headers[k].hits;
}
for (k = 0; k < CMP_MAP_W; ++k) {
if (!cmp_map->headers[k].hits) continue;
cmp_fuzz(k, orig_buf, buf, len);
}
memcpy(buf, orig_buf, len);
new_hit_cnt = queued_paths + unique_crashes;
stage_finds[STAGE_ITS] += new_hit_cnt - orig_hit_cnt;
stage_cycles[STAGE_ITS] += total_execs - orig_execs;
return 0;
}
//// CmpLog forkserver
s32 cmplog_forksrv_pid, cmplog_child_pid, cmplog_fsrv_ctl_fd, cmplog_fsrv_st_fd;
static s32 cmplog_child_pid, cmplog_fsrv_ctl_fd, cmplog_fsrv_st_fd;
void init_cmplog_forkserver(char** argv) {
@ -490,8 +150,6 @@ void init_cmplog_forkserver(char** argv) {
"msan_track_origins=0",
0);
setenv("__AFL_CMPLOG_MODE__", "1", 1);
argv[0] = cmplog_binary;
execv(cmplog_binary, argv);
@ -783,8 +441,6 @@ u8 run_cmplog_target(char** argv, u32 timeout) {
"symbolize=0:"
"msan_track_origins=0", 0);
setenv("__AFL_CMPLOG_MODE__", "1", 1);
argv[0] = cmplog_binary;
execv(cmplog_binary, argv);
@ -977,4 +633,3 @@ u8 common_fuzz_cmplog_stuff(char** argv, u8* out_buf, u32 len) {
return 0;
}

3
src/afl-fuzz-globals.c
View File

@ -251,6 +251,9 @@ u32 a_extras_cnt; /* Total number of tokens available */
u8 *(*post_handler)(u8 *buf, u32 *len);
u8* cmplog_binary;
s32 cmplog_forksrv_pid;
/* hooks for the custom mutator function */
size_t (*custom_mutator)(u8 *data, size_t size, u8 *mutated_out,
size_t max_size, unsigned int seed);

373
src/afl-fuzz-redqueen.c Normal file
View File

@ -0,0 +1,373 @@
/*
american fuzzy lop++ - redqueen implementation on top of cmplog
---------------------------------------------------------------
Originally written by Michal Zalewski
Forkserver design by Jann Horn <jannhorn@googlemail.com>
Now maintained by by Marc Heuse <mh@mh-sec.de>,
Heiko Eißfeldt <heiko.eissfeldt@hexco.de> and
Andrea Fioraldi <andreafioraldi@gmail.com>
Copyright 2016, 2017 Google Inc. All rights reserved.
Copyright 2019-2020 AFLplusplus Project. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0
Shared code to handle the shared memory. This is used by the fuzzer
as well the other components like afl-tmin, afl-showmap, etc...
*/
#include "afl-fuzz.h"
#include "cmplog.h"
static char** its_argv;
///// Colorization
struct range {
u32 start;
u32 end;
struct range* next;
};
struct range* add_range(struct range* ranges, u32 start, u32 end) {
struct range* r = ck_alloc_nozero(sizeof(struct range));
r->start = start;
r->end = end;
r->next = ranges;
return r;
}
struct range* pop_biggest_range(struct range** ranges) {
struct range* r = *ranges;
struct range* prev = NULL;
struct range* rmax = NULL;
struct range* prev_rmax = NULL;
u32 max_size = 0;
while (r) {
u32 s = r->end - r->start;
if (s >= max_size) {
max_size = s;
prev_rmax = prev;
rmax = r;
}
prev = r;
r = r->next;
}
if (rmax) {
if (prev_rmax)
prev_rmax->next = rmax->next;
else
*ranges = rmax->next;
}
return rmax;
}
u8 get_exec_checksum(u8* buf, u32 len, u32* cksum) {
if (unlikely(common_fuzz_stuff(its_argv, buf, len))) return 1;
*cksum = hash32(trace_bits, MAP_SIZE, HASH_CONST);
return 0;
}
static void rand_replace(u8* buf, u32 len) {
u32 i;
for (i = 0; i < len; ++i)
buf[i] = UR(256);
}
u8 colorization(u8* buf, u32 len, u32 exec_cksum) {
struct range* ranges = add_range(NULL, 0, len);
u8* backup = ck_alloc_nozero(len);
u64 orig_hit_cnt, new_hit_cnt;
orig_hit_cnt = queued_paths + unique_crashes;
stage_name = "colorization";
stage_short = "colorization";
stage_max = 1000;
struct range* rng;
stage_cur = stage_max;
while ((rng = pop_biggest_range(&ranges)) != NULL && stage_cur) {
u32 s = rng->end - rng->start;
memcpy(backup, buf + rng->start, s);
rand_replace(buf + rng->start, s);
u32 cksum;
if (unlikely(get_exec_checksum(buf, len, &cksum))) return 1;
if (cksum != exec_cksum) {
ranges = add_range(ranges, rng->start, rng->start + s / 2);
ranges = add_range(ranges, rng->start + s / 2 + 1, rng->end);
memcpy(buf + rng->start, backup, s);
}
ck_free(rng);
--stage_cur;
}
new_hit_cnt = queued_paths + unique_crashes;
stage_finds[STAGE_COLORIZATION] += new_hit_cnt - orig_hit_cnt;
stage_cycles[STAGE_COLORIZATION] += stage_max - stage_cur;
while (ranges) {
rng = ranges;
ranges = ranges->next;
ck_free(rng);
}
return 0;
}
///// Input to State replacement
u8 its_fuzz(u32 idx, u32 size, u8* buf, u32 len, u8* status) {
u64 orig_hit_cnt, new_hit_cnt;
orig_hit_cnt = queued_paths + unique_crashes;
if (unlikely(common_fuzz_stuff(its_argv, buf, len))) return 1;
new_hit_cnt = queued_paths + unique_crashes;
if (unlikely(new_hit_cnt != orig_hit_cnt)) {
*status = 1;
} else {
if (size >= MIN_AUTO_EXTRA && size <= MAX_AUTO_EXTRA)
maybe_add_auto(&buf[idx], size);
*status = 2;
}
return 0;
}
u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
u8* orig_buf, u8* buf, u32 len, u8 do_reverse,
u8* status) {
u64* buf_64 = (u64*)&buf[idx];
u32* buf_32 = (u32*)&buf[idx];
u16* buf_16 = (u16*)&buf[idx];
// u8* buf_8 = &buf[idx];
u64* o_buf_64 = (u64*)&orig_buf[idx];
u32* o_buf_32 = (u32*)&orig_buf[idx];
u16* o_buf_16 = (u16*)&orig_buf[idx];
// u8* o_buf_8 = &orig_buf[idx];
u32 its_len = len - idx;
*status = 0;
if (SHAPE_BYTES(h->shape) == 8) {
if (its_len >= 8 && *buf_64 == pattern && *o_buf_64 == pattern) {
*buf_64 = repl;
if (unlikely(its_fuzz(idx, 8, buf, len, status))) return 1;
*buf_64 = pattern;
}
// reverse encoding
if (do_reverse)
if (unlikely(cmp_extend_encoding(h, SWAP64(pattern), SWAP64(repl), idx,
orig_buf, buf, len, 0, status)))
return 1;
}
if (SHAPE_BYTES(h->shape) == 4 || *status == 2) {
if (its_len >= 4 && *buf_32 == (u32)pattern && *o_buf_32 == (u32)pattern) {
*buf_32 = (u32)repl;
if (unlikely(its_fuzz(idx, 4, buf, len, status))) return 1;
*buf_32 = pattern;
}
// reverse encoding
if (do_reverse)
if (unlikely(cmp_extend_encoding(h, SWAP32(pattern), SWAP32(repl), idx,
orig_buf, buf, len, 0, status)))
return 1;
}
if (SHAPE_BYTES(h->shape) == 2 || *status == 2) {
if (its_len >= 2 && *buf_16 == (u16)pattern && *o_buf_16 == (u16)pattern) {
*buf_16 = (u16)repl;
if (unlikely(its_fuzz(idx, 2, buf, len, status))) return 1;
*buf_16 = (u16)pattern;
}
// reverse encoding
if (do_reverse)
if (unlikely(cmp_extend_encoding(h, SWAP16(pattern), SWAP16(repl), idx,
orig_buf, buf, len, 0, status)))
return 1;
}
/*if (SHAPE_BYTES(h->shape) == 1 || *status == 2) {
if (its_len >= 2 && *buf_8 == (u8)pattern && *o_buf_8 == (u8)pattern) {
*buf_8 = (u8)repl;
if (unlikely(its_fuzz(idx, 1, buf, len, status)))
return 1;
*buf_16 = (u16)pattern;
}
}*/
return 0;
}
u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
struct cmp_header* h = &cmp_map->headers[key];
u32 i, j, idx;
u32 loggeds = h->hits;
if (h->hits > CMP_MAP_H) loggeds = CMP_MAP_H;
u8 status;
// opt not in the paper
u32 fails = 0;
for (i = 0; i < loggeds; ++i) {
struct cmp_operands* o = &cmp_map->log[key][i];
// opt not in the paper
for (j = 0; j < i; ++j)
if (cmp_map->log[key][j].v0 == o->v0 && cmp_map->log[key][i].v1 == o->v1)
goto cmp_fuzz_next_iter;
for (idx = 0; idx < len && fails < 8; ++idx) {
if (unlikely(cmp_extend_encoding(h, o->v0, o->v1, idx, orig_buf, buf, len,
1, &status)))
return 1;
if (status == 2)
++fails;
else if (status == 1)
break;
if (unlikely(cmp_extend_encoding(h, o->v1, o->v0, idx, orig_buf, buf, len,
1, &status)))
return 1;
if (status == 2)
++fails;
else if (status == 1)
break;
}
cmp_fuzz_next_iter:
stage_cur++;
}
return 0;
}
///// Input to State stage
// queue_cur->exec_cksum
u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len,
u32 exec_cksum) {
its_argv = argv;
if (unlikely(colorization(buf, len, exec_cksum))) return 1;
// do it manually, forkserver clear only trace_bits
memset(cmp_map->headers, 0, sizeof(cmp_map->headers));
if (unlikely(common_fuzz_cmplog_stuff(argv, buf, len))) return 1;
u64 orig_hit_cnt, new_hit_cnt;
u64 orig_execs = total_execs;
orig_hit_cnt = queued_paths + unique_crashes;
stage_name = "input-to-state";
stage_short = "its";
stage_max = 0;
stage_cur = 0;
u32 k;
for (k = 0; k < CMP_MAP_W; ++k) {
if (!cmp_map->headers[k].hits) continue;
if (cmp_map->headers[k].hits > CMP_MAP_H)
stage_max += CMP_MAP_H;
else
stage_max += cmp_map->headers[k].hits;
}
for (k = 0; k < CMP_MAP_W; ++k) {
if (!cmp_map->headers[k].hits) continue;
cmp_fuzz(k, orig_buf, buf, len);
}
memcpy(buf, orig_buf, len);
new_hit_cnt = queued_paths + unique_crashes;
stage_finds[STAGE_ITS] += new_hit_cnt - orig_hit_cnt;
stage_cycles[STAGE_ITS] += total_execs - orig_execs;
return 0;
}