ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-14 02:58:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

general maintance

Browse Source
This commit is contained in:
van Hauser
2019-10-04 10:33:28 +02:00
parent 9af6395e92
commit 9c105098dd
12 changed files with 279 additions and 156 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
TODO
View File

@ -2,6 +2,9 @@
Roadmap 2.55d: Roadmap 2.55d:
============== ==============
afl-fuzz:
- radamsa mutator
gcc_plugin: gcc_plugin:
- needs to be rewritten - needs to be rewritten
- whitelist support - whitelist support
@ -18,7 +21,8 @@ qemu_mode:
custom_mutators: custom_mutators:
- rip what Superion is doing into custom mutators for js, php, etc. - rip what Superion is doing into custom mutators for js, php, etc.
unit testing / or large testcase campaign enhance test/test.sh script for checking if compcov features are working
correctly (especially float splitting)
The far away future: The far away future:

1
docs/ChangeLog
View File

@ -32,6 +32,7 @@ Version ++2.54d (dev):
and saves all mutations of the first run on the first file into out/queue/mutations and saves all mutations of the first run on the first file into out/queue/mutations
- libtokencap and libdislocator now compile to the afl_root directory and are - libtokencap and libdislocator now compile to the afl_root directory and are
installed to the .../lib/afl directory when present during make install installed to the .../lib/afl directory when present during make install
- more BSD support, e.g. free CPU binding code for FreeBSD (thanks to devnexen)
- reducing duplicate code in afl-fuzz - reducing duplicate code in afl-fuzz
- added "make help" - added "make help"
- removed compile warnings from python internal stuff - removed compile warnings from python internal stuff

6
include/afl-fuzz.h
View File

@ -78,7 +78,7 @@
/* For systems that have sched_setaffinity; right now just Linux, but one /* For systems that have sched_setaffinity; right now just Linux, but one
can hope... */ can hope... */
#if defined (__linux__) || defined(__FreeBSD__) #if defined(__linux__) || defined(__FreeBSD__)
#define HAVE_AFFINITY 1 #define HAVE_AFFINITY 1
#if defined(__FreeBSD__) #if defined(__FreeBSD__)
#include <sys/cpuset.h> #include <sys/cpuset.h>
@ -690,8 +690,8 @@ static u64 get_cur_time_us(void) {
} }
#ifdef _AFL_DOCUMENT_MUTATIONS #ifdef _AFL_DOCUMENT_MUTATIONS
extern u8 do_document; extern u8 do_document;
extern u32 document_counter; extern u32 document_counter;
#endif #endif
#endif #endif

10
llvm_mode/afl-llvm-pass.so.cc
View File

@ -105,7 +105,9 @@ bool AFLCoverage::runOnModule(Module &M) {
SAYF(cCYA "afl-llvm-pass" VERSION cRST " by <lszekeres@google.com>\n"); SAYF(cCYA "afl-llvm-pass" VERSION cRST " by <lszekeres@google.com>\n");
} else if (getenv("AFL_QUIET")) be_quiet = 1; } else if (getenv("AFL_QUIET"))
be_quiet = 1;
/* Decide instrumentation ratio */ /* Decide instrumentation ratio */
@ -222,9 +224,9 @@ bool AFLCoverage::runOnModule(Module &M) {
cur_loc = AFL_R(MAP_SIZE); cur_loc = AFL_R(MAP_SIZE);
/* There is a problem with Ubuntu 18.04 and llvm 6.0 (see issue #63). /* There is a problem with Ubuntu 18.04 and llvm 6.0 (see issue #63).
The inline function successors() is not inlined and also not found at runtime :-( The inline function successors() is not inlined and also not found at runtime
As I am unable to detect Ubuntu18.04 heree, the next best thing is to disable :-( As I am unable to detect Ubuntu18.04 heree, the next best thing is to
this optional optimization for LLVM 6.0.0 and Linux */ disable this optional optimization for LLVM 6.0.0 and Linux */
#if !(LLVM_VERSION_MAJOR == 6 && LLVM_VERSION_MINOR == 0) || !defined __linux__ #if !(LLVM_VERSION_MAJOR == 6 && LLVM_VERSION_MINOR == 0) || !defined __linux__
// only instrument if this basic block is the destination of a previous // only instrument if this basic block is the destination of a previous
// basic block that has multiple successors // basic block that has multiple successors

276
llvm_mode/split-compares-pass.so.cc
View File

@ -52,8 +52,8 @@ class SplitComparesTransform : public ModulePass {
private: private:
size_t splitIntCompares(Module &M, unsigned bitw); size_t splitIntCompares(Module &M, unsigned bitw);
size_t splitFPCompares(Module &M); size_t splitFPCompares(Module &M);
bool simplifyCompares(Module &M); bool simplifyCompares(Module &M);
bool simplifyIntSignedness(Module &M); bool simplifyIntSignedness(Module &M);
size_t nextPowerOfTwo(size_t in); size_t nextPowerOfTwo(size_t in);
}; };
@ -294,7 +294,11 @@ bool SplitComparesTransform::simplifyIntSignedness(Module &M) {
if (!intTyOp0 || !intTyOp1) { continue; } if (!intTyOp0 || !intTyOp1) { continue; }
/* i think this is not possible but to lazy to look it up */ /* i think this is not possible but to lazy to look it up */
if (intTyOp0->getBitWidth() != intTyOp1->getBitWidth()) { continue; } if (intTyOp0->getBitWidth() != intTyOp1->getBitWidth()) {
continue;
}
icomps.push_back(selectcmpInst); icomps.push_back(selectcmpInst);
@ -412,30 +416,36 @@ bool SplitComparesTransform::simplifyIntSignedness(Module &M) {
} }
size_t SplitComparesTransform::nextPowerOfTwo(size_t in) { size_t SplitComparesTransform::nextPowerOfTwo(size_t in) {
--in; --in;
in |= in >> 1; in |= in >> 1;
in |= in >> 2; in |= in >> 2;
in |= in >> 4; in |= in >> 4;
// in |= in >> 8; // in |= in >> 8;
// in |= in >> 16; // in |= in >> 16;
return in + 1; return in + 1;
} }
/* splits fcmps into two nested fcmps with sign compare and the rest */ /* splits fcmps into two nested fcmps with sign compare and the rest */
size_t SplitComparesTransform::splitFPCompares(Module &M) { size_t SplitComparesTransform::splitFPCompares(Module &M) {
size_t count = 0; size_t count = 0;
LLVMContext &C = M.getContext(); LLVMContext &C = M.getContext();
const DataLayout &dl = M.getDataLayout(); const DataLayout &dl = M.getDataLayout();
/* define unions with floating point and (sign, exponent, mantissa) triples */ /* define unions with floating point and (sign, exponent, mantissa) triples
*/
if (dl.isLittleEndian()) { if (dl.isLittleEndian()) {
}
else if (dl.isBigEndian()) { } else if (dl.isBigEndian()) {
}
else { } else {
return count; return count;
} }
std::vector<CmpInst *> fcomps; std::vector<CmpInst *> fcomps;
@ -477,6 +487,7 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
} }
} }
if (!fcomps.size()) { return count; } if (!fcomps.size()) { return count; }
IntegerType *Int1Ty = IntegerType::getInt1Ty(C); IntegerType *Int1Ty = IntegerType::getInt1Ty(C);
@ -492,37 +503,42 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
op0_size = op0->getType()->getPrimitiveSizeInBits(); op0_size = op0->getType()->getPrimitiveSizeInBits();
op1_size = op1->getType()->getPrimitiveSizeInBits(); op1_size = op1->getType()->getPrimitiveSizeInBits();
if (op0_size != op1_size) { if (op0_size != op1_size) { continue; }
continue;
}
const unsigned int sizeInBits = op0->getType()->getPrimitiveSizeInBits(); const unsigned int sizeInBits = op0->getType()->getPrimitiveSizeInBits();
const unsigned int precision = sizeInBits == 32 ? 24 : const unsigned int precision =
sizeInBits == 64 ? 53 : sizeInBits == 32
sizeInBits == 128 ? 113 : ? 24
sizeInBits == 16 ? 11 : : sizeInBits == 64
65; ? 53
: sizeInBits == 128 ? 113 : sizeInBits == 16 ? 11 : 65;
const unsigned shiftR_exponent = precision - 1; const unsigned shiftR_exponent = precision - 1;
const unsigned long long mask_fraction = ((1 << (precision - 2))) | ((1 << (precision - 2)) - 1); const unsigned long long mask_fraction =
const unsigned long long mask_exponent = (1 << (sizeInBits - precision)) - 1; ((1 << (precision - 2))) | ((1 << (precision - 2)) - 1);
const unsigned long long mask_exponent =
(1 << (sizeInBits - precision)) - 1;
// round up sizes to the next power of two // round up sizes to the next power of two
// this should help with integer compare splitting // this should help with integer compare splitting
size_t exTySizeBytes = ((sizeInBits - precision + 7) >> 3); size_t exTySizeBytes = ((sizeInBits - precision + 7) >> 3);
size_t frTySizeBytes = ((precision - 1 + 7) >> 3); size_t frTySizeBytes = ((precision - 1 + 7) >> 3);
IntegerType *IntExponentTy = IntegerType::get(C, nextPowerOfTwo(exTySizeBytes) << 3); IntegerType *IntExponentTy =
IntegerType *IntFractionTy = IntegerType::get(C, nextPowerOfTwo(frTySizeBytes) << 3); IntegerType::get(C, nextPowerOfTwo(exTySizeBytes) << 3);
IntegerType *IntFractionTy =
IntegerType::get(C, nextPowerOfTwo(frTySizeBytes) << 3);
BasicBlock *end_bb = bb->splitBasicBlock(BasicBlock::iterator(FcmpInst)); BasicBlock *end_bb = bb->splitBasicBlock(BasicBlock::iterator(FcmpInst));
/* create the integers from floats directly */ /* create the integers from floats directly */
Instruction *b_op0, *b_op1; Instruction *b_op0, *b_op1;
b_op0 = CastInst::Create(Instruction::BitCast, op0, IntegerType::get(C, op0_size)); b_op0 = CastInst::Create(Instruction::BitCast, op0,
IntegerType::get(C, op0_size));
bb->getInstList().insert(bb->getTerminator()->getIterator(), b_op0); bb->getInstList().insert(bb->getTerminator()->getIterator(), b_op0);
b_op1 = CastInst::Create(Instruction::BitCast, op1, IntegerType::get(C, op1_size)); b_op1 = CastInst::Create(Instruction::BitCast, op1,
IntegerType::get(C, op1_size));
bb->getInstList().insert(bb->getTerminator()->getIterator(), b_op1); bb->getInstList().insert(bb->getTerminator()->getIterator(), b_op1);
/* isolate signs of value of floating point type */ /* isolate signs of value of floating point type */
@ -531,31 +547,34 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
* the original operands so only the first bit remains.*/ * the original operands so only the first bit remains.*/
Instruction *s_s0, *t_s0, *s_s1, *t_s1, *icmp_sign_bit; Instruction *s_s0, *t_s0, *s_s1, *t_s1, *icmp_sign_bit;
s_s0 = BinaryOperator::Create(Instruction::LShr, b_op0, s_s0 = BinaryOperator::Create(
ConstantInt::get(b_op0->getType(), op0_size - 1)); Instruction::LShr, b_op0,
ConstantInt::get(b_op0->getType(), op0_size - 1));
bb->getInstList().insert(bb->getTerminator()->getIterator(), s_s0); bb->getInstList().insert(bb->getTerminator()->getIterator(), s_s0);
t_s0 = new TruncInst(s_s0, Int1Ty); t_s0 = new TruncInst(s_s0, Int1Ty);
bb->getInstList().insert(bb->getTerminator()->getIterator(), t_s0); bb->getInstList().insert(bb->getTerminator()->getIterator(), t_s0);
s_s1 = BinaryOperator::Create(Instruction::LShr, b_op1, s_s1 = BinaryOperator::Create(
ConstantInt::get(b_op1->getType(), op1_size - 1)); Instruction::LShr, b_op1,
ConstantInt::get(b_op1->getType(), op1_size - 1));
bb->getInstList().insert(bb->getTerminator()->getIterator(), s_s1); bb->getInstList().insert(bb->getTerminator()->getIterator(), s_s1);
t_s1 = new TruncInst(s_s1, Int1Ty); t_s1 = new TruncInst(s_s1, Int1Ty);
bb->getInstList().insert(bb->getTerminator()->getIterator(), t_s1); bb->getInstList().insert(bb->getTerminator()->getIterator(), t_s1);
/* compare of the sign bits */ /* compare of the sign bits */
icmp_sign_bit = CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, t_s0, t_s1); icmp_sign_bit =
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, t_s0, t_s1);
bb->getInstList().insert(bb->getTerminator()->getIterator(), icmp_sign_bit); bb->getInstList().insert(bb->getTerminator()->getIterator(), icmp_sign_bit);
/* create a new basic block which is executed if the signedness bits are /* create a new basic block which is executed if the signedness bits are
* equal */ * equal */
BasicBlock * signequal_bb = BasicBlock *signequal_bb =
BasicBlock::Create(C, "signequal", end_bb->getParent(), end_bb); BasicBlock::Create(C, "signequal", end_bb->getParent(), end_bb);
BranchInst::Create(end_bb, signequal_bb); BranchInst::Create(end_bb, signequal_bb);
/* create a new bb which is executed if exponents are equal */ /* create a new bb which is executed if exponents are equal */
BasicBlock * middle_bb = BasicBlock *middle_bb =
BasicBlock::Create(C, "injected", end_bb->getParent(), end_bb); BasicBlock::Create(C, "injected", end_bb->getParent(), end_bb);
BranchInst::Create(end_bb, middle_bb); BranchInst::Create(end_bb, middle_bb);
@ -570,128 +589,187 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
/* isolate the exponents */ /* isolate the exponents */
Instruction *s_e0, *m_e0, *t_e0, *s_e1, *m_e1, *t_e1; Instruction *s_e0, *m_e0, *t_e0, *s_e1, *m_e1, *t_e1;
s_e0 = BinaryOperator::Create(Instruction::LShr, b_op0, ConstantInt::get(b_op0->getType(), shiftR_exponent)); s_e0 = BinaryOperator::Create(
s_e1 = BinaryOperator::Create(Instruction::LShr, b_op1, ConstantInt::get(b_op1->getType(), shiftR_exponent)); Instruction::LShr, b_op0,
signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), s_e0); ConstantInt::get(b_op0->getType(), shiftR_exponent));
signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), s_e1); s_e1 = BinaryOperator::Create(
Instruction::LShr, b_op1,
ConstantInt::get(b_op1->getType(), shiftR_exponent));
signequal_bb->getInstList().insert(
signequal_bb->getTerminator()->getIterator(), s_e0);
signequal_bb->getInstList().insert(
signequal_bb->getTerminator()->getIterator(), s_e1);
t_e0 = new TruncInst(s_e0, IntExponentTy); t_e0 = new TruncInst(s_e0, IntExponentTy);
t_e1 = new TruncInst(s_e1, IntExponentTy); t_e1 = new TruncInst(s_e1, IntExponentTy);
signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), t_e0); signequal_bb->getInstList().insert(
signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), t_e1); signequal_bb->getTerminator()->getIterator(), t_e0);
signequal_bb->getInstList().insert(
signequal_bb->getTerminator()->getIterator(), t_e1);
if (sizeInBits - precision < exTySizeBytes * 8) { if (sizeInBits - precision < exTySizeBytes * 8) {
m_e0 = BinaryOperator::Create(Instruction::And, t_e0, ConstantInt::get(t_e0->getType(), mask_exponent));
m_e1 = BinaryOperator::Create(Instruction::And, t_e1, ConstantInt::get(t_e1->getType(), mask_exponent)); m_e0 = BinaryOperator::Create(
signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), m_e0); Instruction::And, t_e0,
signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), m_e1); ConstantInt::get(t_e0->getType(), mask_exponent));
m_e1 = BinaryOperator::Create(
Instruction::And, t_e1,
ConstantInt::get(t_e1->getType(), mask_exponent));
signequal_bb->getInstList().insert(
signequal_bb->getTerminator()->getIterator(), m_e0);
signequal_bb->getInstList().insert(
signequal_bb->getTerminator()->getIterator(), m_e1);
} else { } else {
m_e0 = t_e0; m_e0 = t_e0;
m_e1 = t_e1; m_e1 = t_e1;
} }
/* compare the exponents of the operands */ /* compare the exponents of the operands */
Instruction *icmp_exponent_result; Instruction *icmp_exponent_result;
switch (FcmpInst->getPredicate()) { switch (FcmpInst->getPredicate()) {
case CmpInst::FCMP_OEQ: case CmpInst::FCMP_OEQ:
icmp_exponent_result = icmp_exponent_result =
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, m_e0, m_e1); CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, m_e0, m_e1);
break; break;
case CmpInst::FCMP_ONE: case CmpInst::FCMP_ONE:
case CmpInst::FCMP_UNE: case CmpInst::FCMP_UNE:
icmp_exponent_result = icmp_exponent_result =
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_NE, m_e0, m_e1); CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_NE, m_e0, m_e1);
break; break;
case CmpInst::FCMP_OGT: case CmpInst::FCMP_OGT:
Instruction *icmp_exponent; Instruction *icmp_exponent;
icmp_exponent = icmp_exponent =
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_UGT, m_e0, m_e1); CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_UGT, m_e0, m_e1);
signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), icmp_exponent); signequal_bb->getInstList().insert(
icmp_exponent_result = BinaryOperator::Create(Instruction::Xor, icmp_exponent, t_s0); signequal_bb->getTerminator()->getIterator(), icmp_exponent);
break; icmp_exponent_result =
BinaryOperator::Create(Instruction::Xor, icmp_exponent, t_s0);
break;
case CmpInst::FCMP_OLT: case CmpInst::FCMP_OLT:
icmp_exponent = icmp_exponent =
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_ULT, m_e0, m_e1); CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_ULT, m_e0, m_e1);
signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), icmp_exponent); signequal_bb->getInstList().insert(
icmp_exponent_result = BinaryOperator::Create(Instruction::Xor, icmp_exponent, t_s0); signequal_bb->getTerminator()->getIterator(), icmp_exponent);
break; icmp_exponent_result =
default: BinaryOperator::Create(Instruction::Xor, icmp_exponent, t_s0);
continue; break;
default: continue;
} }
signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), icmp_exponent_result);
signequal_bb->getInstList().insert(
signequal_bb->getTerminator()->getIterator(), icmp_exponent_result);
{ {
auto term = signequal_bb->getTerminator();
/* if the exponents are different do a fraction cmp */
BranchInst::Create(middle_bb, end_bb, icmp_exponent_result, signequal_bb);
term->eraseFromParent();
}
auto term = signequal_bb->getTerminator();
/* if the exponents are different do a fraction cmp */
BranchInst::Create(middle_bb, end_bb, icmp_exponent_result, signequal_bb);
term->eraseFromParent();
}
/* isolate the mantissa aka fraction */ /* isolate the mantissa aka fraction */
Instruction *t_f0, *t_f1; Instruction *t_f0, *t_f1;
bool needTrunc = IntFractionTy->getPrimitiveSizeInBits() < op0_size; bool needTrunc = IntFractionTy->getPrimitiveSizeInBits() < op0_size;
//errs() << "Fractions: IntFractionTy size " << IntFractionTy->getPrimitiveSizeInBits() << ", op0_size " << op0_size << ", needTrunc " << needTrunc << "\n"; // errs() << "Fractions: IntFractionTy size " <<
// IntFractionTy->getPrimitiveSizeInBits() << ", op0_size " << op0_size << ",
// needTrunc " << needTrunc << "\n";
if (precision - 1 < frTySizeBytes * 8) { if (precision - 1 < frTySizeBytes * 8) {
Instruction *m_f0, *m_f1; Instruction *m_f0, *m_f1;
m_f0 = BinaryOperator::Create(Instruction::And, b_op0, ConstantInt::get(b_op0->getType(), mask_fraction)); m_f0 = BinaryOperator::Create(
m_f1 = BinaryOperator::Create(Instruction::And, b_op1, ConstantInt::get(b_op1->getType(), mask_fraction)); Instruction::And, b_op0,
middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), m_f0); ConstantInt::get(b_op0->getType(), mask_fraction));
middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), m_f1); m_f1 = BinaryOperator::Create(
Instruction::And, b_op1,
ConstantInt::get(b_op1->getType(), mask_fraction));
middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(),
m_f0);
middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(),
m_f1);
if (needTrunc) { if (needTrunc) {
t_f0 = new TruncInst(m_f0, IntFractionTy); t_f0 = new TruncInst(m_f0, IntFractionTy);
t_f1 = new TruncInst(m_f1, IntFractionTy); t_f1 = new TruncInst(m_f1, IntFractionTy);
middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f0); middle_bb->getInstList().insert(
middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f1); middle_bb->getTerminator()->getIterator(), t_f0);
middle_bb->getInstList().insert(
middle_bb->getTerminator()->getIterator(), t_f1);
} else { } else {
t_f0 = m_f0; t_f0 = m_f0;
t_f1 = m_f1; t_f1 = m_f1;
} }
} else { } else {
if (needTrunc) { if (needTrunc) {
t_f0 = new TruncInst(b_op0, IntFractionTy); t_f0 = new TruncInst(b_op0, IntFractionTy);
t_f1 = new TruncInst(b_op1, IntFractionTy); t_f1 = new TruncInst(b_op1, IntFractionTy);
middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f0); middle_bb->getInstList().insert(
middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f1); middle_bb->getTerminator()->getIterator(), t_f0);
middle_bb->getInstList().insert(
middle_bb->getTerminator()->getIterator(), t_f1);
} else { } else {
t_f0 = b_op0; t_f0 = b_op0;
t_f1 = b_op1; t_f1 = b_op1;
} }
} }
/* compare the fractions of the operands */ /* compare the fractions of the operands */
Instruction *icmp_fraction_result; Instruction *icmp_fraction_result;
switch (FcmpInst->getPredicate()) { switch (FcmpInst->getPredicate()) {
case CmpInst::FCMP_OEQ: case CmpInst::FCMP_OEQ:
icmp_fraction_result = icmp_fraction_result =
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, t_f0, t_f1); CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, t_f0, t_f1);
break; break;
case CmpInst::FCMP_UNE: case CmpInst::FCMP_UNE:
case CmpInst::FCMP_ONE: case CmpInst::FCMP_ONE:
icmp_fraction_result = icmp_fraction_result =
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_NE, t_f0, t_f1); CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_NE, t_f0, t_f1);
break; break;
case CmpInst::FCMP_OGT: case CmpInst::FCMP_OGT:
Instruction *icmp_fraction; Instruction *icmp_fraction;
icmp_fraction = icmp_fraction =
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_UGT, t_f0, t_f1); CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_UGT, t_f0, t_f1);
middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), icmp_fraction); middle_bb->getInstList().insert(
icmp_fraction_result = BinaryOperator::Create(Instruction::Xor, icmp_fraction, t_s0); middle_bb->getTerminator()->getIterator(), icmp_fraction);
break; icmp_fraction_result =
BinaryOperator::Create(Instruction::Xor, icmp_fraction, t_s0);
break;
case CmpInst::FCMP_OLT: case CmpInst::FCMP_OLT:
icmp_fraction = icmp_fraction =
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_ULT, t_f0, t_f1); CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_ULT, t_f0, t_f1);
middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), icmp_fraction); middle_bb->getInstList().insert(
icmp_fraction_result = BinaryOperator::Create(Instruction::Xor, icmp_fraction, t_s0); middle_bb->getTerminator()->getIterator(), icmp_fraction);
break; icmp_fraction_result =
default: BinaryOperator::Create(Instruction::Xor, icmp_fraction, t_s0);
continue; break;
default: continue;
} }
middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), icmp_fraction_result);
middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(),
icmp_fraction_result);
PHINode *PN = PHINode::Create(Int1Ty, 3, ""); PHINode *PN = PHINode::Create(Int1Ty, 3, "");
switch (FcmpInst->getPredicate()) { switch (FcmpInst->getPredicate()) {
case CmpInst::FCMP_OEQ: case CmpInst::FCMP_OEQ:
/* unequal signs cannot be equal values */ /* unequal signs cannot be equal values */
/* goto false branch */ /* goto false branch */
@ -700,7 +778,7 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
PN->addIncoming(ConstantInt::get(Int1Ty, 0), signequal_bb); PN->addIncoming(ConstantInt::get(Int1Ty, 0), signequal_bb);
/* fractions comparison */ /* fractions comparison */
PN->addIncoming(icmp_fraction_result, middle_bb); PN->addIncoming(icmp_fraction_result, middle_bb);
break; break;
case CmpInst::FCMP_ONE: case CmpInst::FCMP_ONE:
case CmpInst::FCMP_UNE: case CmpInst::FCMP_UNE:
/* unequal signs are unequal values */ /* unequal signs are unequal values */
@ -710,28 +788,29 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
PN->addIncoming(ConstantInt::get(Int1Ty, 1), signequal_bb); PN->addIncoming(ConstantInt::get(Int1Ty, 1), signequal_bb);
/* fractions comparison */ /* fractions comparison */
PN->addIncoming(icmp_fraction_result, middle_bb); PN->addIncoming(icmp_fraction_result, middle_bb);
break; break;
case CmpInst::FCMP_OGT: case CmpInst::FCMP_OGT:
/* if op1 is negative goto true branch, /* if op1 is negative goto true branch,
else go on comparing */ else go on comparing */
PN->addIncoming(t_s1, bb); PN->addIncoming(t_s1, bb);
PN->addIncoming(icmp_exponent_result, signequal_bb); PN->addIncoming(icmp_exponent_result, signequal_bb);
PN->addIncoming(icmp_fraction_result, middle_bb); PN->addIncoming(icmp_fraction_result, middle_bb);
break; break;
case CmpInst::FCMP_OLT: case CmpInst::FCMP_OLT:
/* if op0 is negative goto true branch, /* if op0 is negative goto true branch,
else go on comparing */ else go on comparing */
PN->addIncoming(t_s0, bb); PN->addIncoming(t_s0, bb);
PN->addIncoming(icmp_exponent_result, signequal_bb); PN->addIncoming(icmp_exponent_result, signequal_bb);
PN->addIncoming(icmp_fraction_result, middle_bb); PN->addIncoming(icmp_fraction_result, middle_bb);
break; break;
default: default: continue;
continue;
} }
BasicBlock::iterator ii(FcmpInst); BasicBlock::iterator ii(FcmpInst);
ReplaceInstWithInst(FcmpInst->getParent()->getInstList(), ii, PN); ReplaceInstWithInst(FcmpInst->getParent()->getInstList(), ii, PN);
++count; ++count;
} }
return count; return count;
@ -740,6 +819,7 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
/* splits icmps of size bitw into two nested icmps with bitw/2 size each */ /* splits icmps of size bitw into two nested icmps with bitw/2 size each */
size_t SplitComparesTransform::splitIntCompares(Module &M, unsigned bitw) { size_t SplitComparesTransform::splitIntCompares(Module &M, unsigned bitw) {
size_t count = 0; size_t count = 0;
LLVMContext &C = M.getContext(); LLVMContext &C = M.getContext();
@ -755,7 +835,7 @@ size_t SplitComparesTransform::splitIntCompares(Module &M, unsigned bitw) {
/* not supported yet */ /* not supported yet */
if (bitw > 64) { return 0; } if (bitw > 64) { return 0; }
/* get all EQ, NE, UGT, and ULT icmps of width bitw. if the /* get all EQ, NE, UGT, and ULT icmps of width bitw. if the
* functions simplifyCompares() and simplifyIntSignedness() * functions simplifyCompares() and simplifyIntSignedness()
* were executed only these four predicates should exist */ * were executed only these four predicates should exist */
for (auto &F : M) { for (auto &F : M) {
@ -938,7 +1018,9 @@ size_t SplitComparesTransform::splitIntCompares(Module &M, unsigned bitw) {
ReplaceInstWithInst(IcmpInst->getParent()->getInstList(), ii, PN); ReplaceInstWithInst(IcmpInst->getParent()->getInstList(), ii, PN);
} }
++count; ++count;
} }
return count; return count;
@ -958,27 +1040,29 @@ bool SplitComparesTransform::runOnModule(Module &M) {
simplifyIntSignedness(M); simplifyIntSignedness(M);
if (getenv("AFL_QUIET") == NULL) if (getenv("AFL_QUIET") == NULL)
errs() << "Split-compare-pass by laf.intel@gmail.com, extended by heiko@hexco.de\n"; errs() << "Split-compare-pass by laf.intel@gmail.com, extended by "
"heiko@hexco.de\n";
errs() << "Split-floatingpoint-compare-pass: " << splitFPCompares(M) << " FP comparisons splitted\n"; errs() << "Split-floatingpoint-compare-pass: " << splitFPCompares(M)
<< " FP comparisons splitted\n";
switch (bitw) { switch (bitw) {
case 64: case 64:
errs() << "Split-integer-compare-pass " << bitw << "bit: " errs() << "Split-integer-compare-pass " << bitw
<< splitIntCompares(M, bitw) << " splitted\n"; << "bit: " << splitIntCompares(M, bitw) << " splitted\n";
bitw >>= 1; bitw >>= 1;
[[clang::fallthrough]]; /*FALLTHRU*/ /* FALLTHROUGH */ [[clang::fallthrough]]; /*FALLTHRU*/ /* FALLTHROUGH */
case 32: case 32:
errs() << "Split-integer-compare-pass " << bitw << "bit: " errs() << "Split-integer-compare-pass " << bitw
<< splitIntCompares(M, bitw) << " splitted\n"; << "bit: " << splitIntCompares(M, bitw) << " splitted\n";
bitw >>= 1; bitw >>= 1;
[[clang::fallthrough]]; /*FALLTHRU*/ /* FALLTHROUGH */ [[clang::fallthrough]]; /*FALLTHRU*/ /* FALLTHROUGH */
case 16: case 16:
errs() << "Split-integer-compare-pass " << bitw << "bit: " errs() << "Split-integer-compare-pass " << bitw
<< splitIntCompares(M, bitw) << " splitted\n"; << "bit: " << splitIntCompares(M, bitw) << " splitted\n";
bitw >>= 1; bitw >>= 1;
break; break;

12
qemu_mode/patches/afl-qemu-cpu-inl.h
View File

@ -185,7 +185,7 @@ static void afl_setup(void) {
afl_end_code = (abi_ulong)-1; afl_end_code = (abi_ulong)-1;
} }
if (getenv("AFL_CODE_START")) if (getenv("AFL_CODE_START"))
afl_start_code = strtoll(getenv("AFL_CODE_START"), NULL, 16); afl_start_code = strtoll(getenv("AFL_CODE_START"), NULL, 16);
if (getenv("AFL_CODE_END")) if (getenv("AFL_CODE_END"))
@ -216,12 +216,12 @@ static void afl_setup(void) {
/* If AFL_QEMU_PERSISTENT_RET is not specified patch the return addr */ /* If AFL_QEMU_PERSISTENT_RET is not specified patch the return addr */
} }
if (getenv("AFL_QEMU_PERSISTENT_GPR")) if (getenv("AFL_QEMU_PERSISTENT_GPR")) persistent_save_gpr = 1;
persistent_save_gpr = 1;
if (getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET")) if (getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"))
persisent_retaddr_offset = strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 16); persisent_retaddr_offset =
strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 16);
if (getenv("AFL_QEMU_PERSISTENT_CNT")) if (getenv("AFL_QEMU_PERSISTENT_CNT"))
afl_persistent_cnt = strtoll(getenv("AFL_QEMU_PERSISTENT_CNT"), NULL, 16); afl_persistent_cnt = strtoll(getenv("AFL_QEMU_PERSISTENT_CNT"), NULL, 16);

5
src/afl-fuzz-globals.c
View File

@ -260,6 +260,7 @@ PyObject *py_functions[PY_FUNC_COUNT];
#endif #endif
#ifdef _AFL_DOCUMENT_MUTATIONS #ifdef _AFL_DOCUMENT_MUTATIONS
u8 do_document; u8 do_document;
u32 document_counter; u32 document_counter;
#endif #endif

39
src/afl-fuzz-init.c
View File

@ -32,7 +32,7 @@
void bind_to_free_cpu(void) { void bind_to_free_cpu(void) {
cpu_set_t c; cpu_set_t c;
u8 cpu_used[4096] = {0}; u8 cpu_used[4096] = {0};
u32 i; u32 i;
@ -114,28 +114,34 @@ void bind_to_free_cpu(void) {
closedir(d); closedir(d);
#elif defined(__FreeBSD__) #elif defined(__FreeBSD__)
struct kinfo_proc *procs; struct kinfo_proc* procs;
size_t nprocs; size_t nprocs;
size_t proccount; size_t proccount;
int s_name[] = {CTL_KERN, KERN_PROC, KERN_PROC_ALL}; int s_name[] = {CTL_KERN, KERN_PROC, KERN_PROC_ALL};
size_t s_name_l = sizeof(s_name)/sizeof(s_name[0]); size_t s_name_l = sizeof(s_name) / sizeof(s_name[0]);
if (sysctl(s_name, s_name_l, NULL, &nprocs, NULL, 0) != 0) return; if (sysctl(s_name, s_name_l, NULL, &nprocs, NULL, 0) != 0) return;
proccount = nprocs / sizeof(*procs); proccount = nprocs / sizeof(*procs);
nprocs = nprocs * 4/3; nprocs = nprocs * 4 / 3;
procs = ck_alloc(nprocs); procs = ck_alloc(nprocs);
if (sysctl(s_name, s_name_l, procs, &nprocs, NULL, 0) != 0) { if (sysctl(s_name, s_name_l, procs, &nprocs, NULL, 0) != 0) {
ck_free(procs); ck_free(procs);
return; return;
} }
for (i = 0; i < proccount; i ++) { for (i = 0; i < proccount; i++) {
if (procs[i].ki_oncpu < sizeof(cpu_used))
cpu_used[procs[i].ki_oncpu] = 1; if (procs[i].ki_oncpu < sizeof(cpu_used)) cpu_used[procs[i].ki_oncpu] = 1;
} }
ck_free(procs); ck_free(procs);
#else
#warning \
"For this platform we do not have free CPU binding code yet. If poxxible, please supply a PR to https://github.com/vanhauser-thc/AFLplusplus"
#endif #endif
for (i = 0; i < cpu_core_count; ++i) for (i = 0; i < cpu_core_count; ++i)
@ -166,7 +172,10 @@ void bind_to_free_cpu(void) {
#if defined(__linux__) #if defined(__linux__)
if (sched_setaffinity(0, sizeof(c), &c)) PFATAL("sched_setaffinity failed"); if (sched_setaffinity(0, sizeof(c), &c)) PFATAL("sched_setaffinity failed");
#elif defined(__FreeBSD__) #elif defined(__FreeBSD__)
if (pthread_setaffinity_np(pthread_self(), sizeof(c), &c)) PFATAL("pthread_setaffinity failed"); if (pthread_setaffinity_np(pthread_self(), sizeof(c), &c))
PFATAL("pthread_setaffinity failed");
#else
// this will need something for other platforms
#endif #endif
} }
@ -815,7 +824,8 @@ double get_runnable_processes(void) {
static double res; static double res;
#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__) #if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || \
defined(__NetBSD__)
/* I don't see any portable sysctl or so that would quickly give us the /* I don't see any portable sysctl or so that would quickly give us the
number of runnable processes; the 1-minute load average can be a number of runnable processes; the 1-minute load average can be a
@ -856,7 +866,7 @@ double get_runnable_processes(void) {
} }
#endif /* ^(__APPLE__ || __FreeBSD__ || __OpenBSD__ || __NetBSD__) */ #endif /* ^(__APPLE__ || __FreeBSD__ || __OpenBSD__ || __NetBSD__) */
return res; return res;
@ -1510,7 +1520,7 @@ void check_cpu_governor(void) {
FATAL("Suboptimal CPU scaling governor"); FATAL("Suboptimal CPU scaling governor");
#elif defined __APPLE__ #elif defined __APPLE__
u64 min = 0, max = 0; u64 min = 0, max = 0;
size_t mlen = sizeof(min); size_t mlen = sizeof(min);
if (getenv("AFL_SKIP_CPUFREQ")) return; if (getenv("AFL_SKIP_CPUFREQ")) return;
@ -1542,6 +1552,7 @@ void check_cpu_governor(void) {
min / 1024, max / 1024); min / 1024, max / 1024);
FATAL("Suboptimal CPU scaling governor"); FATAL("Suboptimal CPU scaling governor");
#endif #endif
} }
/* Count the number of logical CPU cores. */ /* Count the number of logical CPU cores. */

13
src/afl-fuzz-one.c
View File

@ -4231,7 +4231,6 @@ pacemaker_fuzzing:
#define core_fuzzing(a) common_fuzzing((a), MOpt_globals_core) #define core_fuzzing(a) common_fuzzing((a), MOpt_globals_core)
void pso_updating(void) { void pso_updating(void) {
g_now += 1; g_now += 1;
@ -4314,17 +4313,25 @@ u8 fuzz_one(char** argv) {
#ifdef _AFL_DOCUMENT_MUTATIONS #ifdef _AFL_DOCUMENT_MUTATIONS
if (do_document == 0) { if (do_document == 0) {
char *fn = alloc_printf("%s/mutations", out_dir);
char* fn = alloc_printf("%s/mutations", out_dir);
if (fn) { if (fn) {
do_document = mkdir(fn, 0700); // if it exists we do not care
do_document = mkdir(fn, 0700); // if it exists we do not care
do_document = 1; do_document = 1;
ck_free(fn); ck_free(fn);
} else } else
PFATAL("malloc()"); PFATAL("malloc()");
} else { } else {
do_document = 2; do_document = 2;
stop_soon = 2; stop_soon = 2;
} }
#endif #endif
if (limit_time_sig == 0) { if (limit_time_sig == 0) {

38
src/afl-fuzz-run.c
View File

@ -178,15 +178,21 @@ u8 run_target(char** argv, u32 timeout) {
if ((res = read(fsrv_st_fd, &status, 4)) != 4) { if ((res = read(fsrv_st_fd, &status, 4)) != 4) {
if (stop_soon) return 0; if (stop_soon) return 0;
SAYF("\n" cLRD "[-] " cRST SAYF(
"Unable to communicate with fork server. Some possible reasons:\n\n" "\n" cLRD "[-] " cRST
" - You've run out of memory. Use -m to increase the the memory limit\n" "Unable to communicate with fork server. Some possible reasons:\n\n"
" to something higher than %lld.\n" " - You've run out of memory. Use -m to increase the the memory "
" - The binary or one of the libraries it uses manages to create\n" "limit\n"
" threads before the forkserver initializes.\n" " to something higher than %lld.\n"
" - The binary, at least in some circumstances, exits in a way that\n" " - The binary or one of the libraries it uses manages to create\n"
" also kills the parent process - raise() could be the culprit.\n\n" " threads before the forkserver initializes.\n"
"If all else fails you can disable the fork server via AFL_NO_FORKSRV=1.\n", mem_limit); " - The binary, at least in some circumstances, exits in a way "
"that\n"
" also kills the parent process - raise() could be the "
"culprit.\n\n"
"If all else fails you can disable the fork server via "
"AFL_NO_FORKSRV=1.\n",
mem_limit);
RPFATAL(res, "Unable to communicate with fork server"); RPFATAL(res, "Unable to communicate with fork server");
} }
@ -261,15 +267,23 @@ void write_to_testcase(void* mem, u32 len) {
s32 fd = out_fd; s32 fd = out_fd;
#ifdef _AFL_DOCUMENT_MUTATIONS #ifdef _AFL_DOCUMENT_MUTATIONS
s32 doc_fd; s32 doc_fd;
char *fn = alloc_printf("%s/mutations/%09u:%s", out_dir, document_counter++, describe_op(0)); char* fn = alloc_printf("%s/mutations/%09u:%s", out_dir, document_counter++,
describe_op(0));
if (fn != NULL) { if (fn != NULL) {
if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600)) >= 0) { if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600)) >= 0) {
if (write(doc_fd, mem, len) != len) PFATAL("write to mutation file failed: %s", fn);
if (write(doc_fd, mem, len) != len)
PFATAL("write to mutation file failed: %s", fn);
close(doc_fd); close(doc_fd);
} }
ck_free(fn); ck_free(fn);
} }
#endif #endif
if (out_file) { if (out_file) {

27
src/afl-gotcpu.c
View File

@ -54,16 +54,16 @@
#if defined(__linux__) || defined(__FreeBSD__) || defined(__NetBSD__) #if defined(__linux__) || defined(__FreeBSD__) || defined(__NetBSD__)
#define HAVE_AFFINITY 1 #define HAVE_AFFINITY 1
# if defined(__FreeBSD__) #if defined(__FreeBSD__)
# include <pthread.h> #include <pthread.h>
# include <pthread_np.h> #include <pthread_np.h>
# include <sys/cpuset.h> #include <sys/cpuset.h>
# define cpu_set_t cpuset_t #define cpu_set_t cpuset_t
# elif defined(__NetBSD__) #elif defined(__NetBSD__)
# include <pthread.h> #include <pthread.h>
# include <sched.h> #include <sched.h>
# endif #endif
#endif /* __linux__ || __FreeBSD__ || __NetBSD__ */ #endif /* __linux__ || __FreeBSD__ || __NetBSD__ */
/* Get unix time in microseconds. */ /* Get unix time in microseconds. */
@ -163,18 +163,17 @@ int main(int argc, char** argv) {
if (!fr) { if (!fr) {
u32 util_perc; u32 util_perc;
#if defined(__linux__) || defined(__FreeBSD__) #if defined(__linux__) || defined(__FreeBSD__)
cpu_set_t c; cpu_set_t c;
CPU_ZERO(&c); CPU_ZERO(&c);
CPU_SET(i, &c); CPU_SET(i, &c);
#elif defined(__NetBSD__) #elif defined(__NetBSD__)
cpuset_t *c; cpuset_t* c;
c = cpuset_create(); c = cpuset_create();
if (c == NULL) if (c == NULL) PFATAL("cpuset_create failed");
PFATAL("cpuset_create failed");
cpuset_set(i, c); cpuset_set(i, c);
#endif #endif

2
test/test.sh
View File

@ -179,7 +179,7 @@ test -e ../afl-clang-fast && {
../afl-clang-fast -o test-persistent ../experimental/persistent_demo/persistent_demo.c > /dev/null 2>&1 ../afl-clang-fast -o test-persistent ../experimental/persistent_demo/persistent_demo.c > /dev/null 2>&1
test -e test-persistent && { test -e test-persistent && {
echo foo | ../afl-showmap -o /dev/null -q -r ./test-persistent && { echo foo | ../afl-showmap -o /dev/null -q -r ./test-persistent && {
$ECHO "$GREEN[+] lvm_mode persistent mode feature works correctly" $ECHO "$GREEN[+] llvm_mode persistent mode feature works correctly"
} || $ECHO "$RED[!] llvm_mode persistent mode feature failed to work" } || $ECHO "$RED[!] llvm_mode persistent mode feature failed to work"
} || $ECHO "$RED[!] llvm_mode persistent mode feature compilation failed" } || $ECHO "$RED[!] llvm_mode persistent mode feature compilation failed"
rm -f test-persistent rm -f test-persistent