new forkserver - server part

include/types.h

@@ -49,6 +49,13 @@ typedef uint128_t         u128;
 #define FS_ERROR_OLD_CMPLOG 32
 #define FS_ERROR_OLD_CMPLOG_QEMU 64
 
+/* New Forkserver */
+#define FS_NEW_VERSION_MIN 1
+#define FS_NEW_VERSION_MAX 1
+#define FS_NEW_OPT_MAPSIZE     0x00000001  // parameter: 32 bit value
+#define FS_NEW_OPT_SHDMEM_FUZZ 0x00000002  // paramter: none
+#define FS_NEW_OPT_AUTODICT    0x00000800  // autodictionary data
+
 /* Reporting options */
 #define FS_OPT_ENABLED 0x80000001
 #define FS_OPT_MAPSIZE 0x40000000

src/afl-forkserver.c

@@ -389,7 +389,7 @@ static void afl_fauxsrv_execv(afl_forkserver_t *fsrv, char **argv) {
   while (1) {
 
     uint32_t was_killed;
-    int      status;
+    u32      status;
 
     /* Wait for parent by reading from the pipe. Exit if read fails. */
 
@@ -524,7 +524,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
                     volatile u8 *stop_soon_p, u8 debug_child_output) {
 
   int   st_pipe[2], ctl_pipe[2];
-  s32   status;
+  u32   status;
   s32   rlen;
   char *ignore_autodict = getenv("AFL_NO_AUTODICT");
 
@@ -1017,15 +1017,176 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
   if (rlen == 4) {
 
+    /*
+     *  The new fork server model works like this:
+     *    Client: sends "AFLx" in little endian, with x being the forkserver
+     *            protocol version.
+     *    Server: replies with XOR of the message or exits with an error if it
+     *            is not a supported version.
+     *    Client: sends 32 bit of options and then sends all parameters of
+     *            the options, one after another, increasing by option number.
+     *            Ends with "AFLx".
+     *  After the initial protocol version confirmation the server does not
+     *  send any data anymore - except a future option requires this.
+     */
+
     if (status >= 0x41464c00 && status <= 0x41464cff) {
 
+      u32 version = status - 0x41464c00;
+
+      if (!version) {
+
         FATAL(
-          "Target uses the new forkserver model, you need to switch to a newer "
+            "Fork server version is not assigned, this should not happen. "
-          "afl-fuzz too!");
+            "Recompile target.");
+
+      } else if (version < FS_NEW_VERSION_MIN || version > FS_NEW_VERSION_MAX) {
+
+        FATAL(
+            "Fork server version is not not supported.  Recompile the target.");
 
       }
 
-    if (!be_quiet) { OKF("All right - fork server is up."); }
+      status ^= 0xffffffff;
+      if (write(fsrv->fsrv_ctl_fd, &status, 4) != 4) {
+
+        FATAL("Writing to forkserver failed.");
+
+      }
+
+      if (!be_quiet) {
+
+        OKF("All right - new fork server model v%u is up.", version);
+
+      }
+
+      rlen = read(fsrv->fsrv_st_fd, &status, 4);
+
+      if (getenv("AFL_DEBUG")) {
+
+        ACTF("Forkserver options received: (%08x)", status);
+
+      }
+
+      if ((status & FS_NEW_OPT_MAPSIZE)) {
+
+        u32 tmp_map_size;
+        rlen = read(fsrv->fsrv_st_fd, &tmp_map_size, 4);
+
+        if (!fsrv->map_size) { fsrv->map_size = MAP_SIZE; }
+
+        fsrv->real_map_size = tmp_map_size;
+
+        if (tmp_map_size % 64) {
+
+          tmp_map_size = (((tmp_map_size + 63) >> 6) << 6);
+
+        }
+
+        if (!be_quiet) { ACTF("Target map size: %u", fsrv->real_map_size); }
+        if (tmp_map_size > fsrv->map_size) {
+
+          FATAL(
+              "Target's coverage map size of %u is larger than the one this "
+              "AFL++ is set with (%u). Either set AFL_MAP_SIZE=%u and "
+              "restart "
+              " afl-fuzz, or change MAP_SIZE_POW2 in config.h and recompile "
+              "afl-fuzz",
+              tmp_map_size, fsrv->map_size, tmp_map_size);
+
+        }
+
+        fsrv->map_size = tmp_map_size;
+
+      }
+
+      if ((status & FS_NEW_OPT_SHDMEM_FUZZ)) {
+
+        if (fsrv->support_shmem_fuzz) {
+
+          fsrv->use_shmem_fuzz = 1;
+          if (!be_quiet) { ACTF("Using SHARED MEMORY FUZZING feature."); }
+
+        } else {
+
+          FATAL(
+              "Target requested sharedmem fuzzing, but we failed to enable "
+              "it.");
+
+        }
+
+      }
+
+      if ((status & FS_NEW_OPT_AUTODICT)) {
+
+        u32 dict_size;
+        if (read(fsrv->fsrv_st_fd, &dict_size, 4) != 4) {
+
+          FATAL("Reading from forkserver failed.");
+
+        }
+
+        if (dict_size < 2 || dict_size > 0xffffff) {
+
+          FATAL("Dictionary has an illegal size: %d", dict_size);
+
+        }
+
+        u32 offset = 0, count = 0;
+        u8 *dict = ck_alloc(dict_size);
+        if (dict == NULL) {
+
+          FATAL("Could not allocate %u bytes of autodictionary memory",
+                dict_size);
+
+        }
+
+        while (dict_size != 0) {
+
+          rlen = read(fsrv->fsrv_st_fd, dict + offset, dict_size);
+          if (rlen > 0) {
+
+            dict_size -= rlen;
+            offset += rlen;
+
+          } else {
+
+            FATAL(
+                "Reading autodictionary fail at position %u with %u bytes "
+                "left.",
+                offset, dict_size);
+
+          }
+
+        }
+
+        offset = 0;
+        while (offset < dict_size && (u8)dict[offset] + offset < dict_size) {
+
+          fsrv->add_extra_func(fsrv->afl_ptr, dict + offset + 1,
+                               (u8)dict[offset]);
+          offset += (1 + dict[offset]);
+          count++;
+
+        }
+
+        if (!be_quiet) { ACTF("Loaded %u autodictionary entries", count); }
+        ck_free(dict);
+
+      }
+
+      u32 status2;
+      rlen = read(fsrv->fsrv_st_fd, &status2, 4);
+
+      if (status2 != status) { FATAL("Error in forkserver communication"); }
+
+    } else {
+
+      WARNF(
+          "Old fork server model is used by the target, this still works "
+          "though.");
+
+      if (!be_quiet) { OKF("All right - old fork server is up."); }
 
       if (getenv("AFL_DEBUG")) {
 
@@ -1039,7 +1200,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
       if ((status & FS_OPT_ENABLED) == FS_OPT_ENABLED) {
 
         // workaround for recent AFL++ versions
-      if ((status & FS_OPT_OLD_AFLPP_WORKAROUND) == FS_OPT_OLD_AFLPP_WORKAROUND)
+        if ((status & FS_OPT_OLD_AFLPP_WORKAROUND) ==
+            FS_OPT_OLD_AFLPP_WORKAROUND)
           status = (status & 0xf0ffffff);
 
         if ((status & FS_OPT_NEWCMPLOG) == 0 && fsrv->cmplog_binary) {
@@ -1110,7 +1272,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
             FATAL(
                 "Target's coverage map size of %u is larger than the one this "
-              "AFL++ is set with (%u). Either set AFL_MAP_SIZE=%u and restart "
+                "AFL++ is set with (%u). Either set AFL_MAP_SIZE=%u and "
+                "restart "
                 " afl-fuzz, or change MAP_SIZE_POW2 in config.h and recompile "
                 "afl-fuzz",
                 tmp_map_size, fsrv->map_size, tmp_map_size);
@@ -1183,7 +1346,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
             u8 *dict = ck_alloc(len);
             if (dict == NULL) {
 
-            FATAL("Could not allocate %u bytes of autodictionary memory", len);
+              FATAL("Could not allocate %u bytes of autodictionary memory",
+                    len);
 
             }
 
@@ -1226,6 +1390,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
       }
 
+    }
+
     return;
 
   }