ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-14 02:58:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

code format

Browse Source
This commit is contained in:
Andrea Fioraldi
2020-02-07 20:44:36 +01:00
parent 420b1aa859
commit aa2cb66ea2
8 changed files with 149 additions and 132 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
examples/qemu_persistent_hook/read_into_rdi.c
View File

@ -2,35 +2,37 @@
#include <stdio.h> #include <stdio.h>
#include <unistd.h> #include <unistd.h>
#define g2h(x) ((void *)((unsigned long)(x) + guest_base)) #define g2h(x) ((void*)((unsigned long)(x) + guest_base))
#define h2g(x) ((uint64_t)(x) - guest_base) #define h2g(x) ((uint64_t)(x)-guest_base)
enum { enum {
R_EAX = 0,
R_ECX = 1,
R_EDX = 2,
R_EBX = 3,
R_ESP = 4,
R_EBP = 5,
R_ESI = 6,
R_EDI = 7,
R_R8 = 8,
R_R9 = 9,
R_R10 = 10,
R_R11 = 11,
R_R12 = 12,
R_R13 = 13,
R_R14 = 14,
R_R15 = 15,
R_AL = 0, R_EAX = 0,
R_CL = 1, R_ECX = 1,
R_DL = 2, R_EDX = 2,
R_BL = 3, R_EBX = 3,
R_AH = 4, R_ESP = 4,
R_CH = 5, R_EBP = 5,
R_DH = 6, R_ESI = 6,
R_BH = 7, R_EDI = 7,
R_R8 = 8,
R_R9 = 9,
R_R10 = 10,
R_R11 = 11,
R_R12 = 12,
R_R13 = 13,
R_R14 = 14,
R_R15 = 15,
R_AL = 0,
R_CL = 1,
R_DL = 2,
R_BL = 3,
R_AH = 4,
R_CH = 5,
R_DH = 6,
R_BH = 7,
}; };
void afl_persistent_hook(uint64_t* regs, uint64_t guest_base) { void afl_persistent_hook(uint64_t* regs, uint64_t guest_base) {
@ -40,3 +42,4 @@ void afl_persistent_hook(uint64_t* regs, uint64_t guest_base) {
printf("readed %ld bytes\n", r); printf("readed %ld bytes\n", r);
} }

12
examples/qemu_persistent_hook/test.c
View File

@ -6,16 +6,15 @@ int target_func(char *buf, int size) {
switch (buf[0]) { switch (buf[0]) {
case 1: case 1:
if (buf[1] == '\x44') { if (buf[1] == '\x44') { puts("a"); }
puts("a");
}
break; break;
case 0xff: case 0xff:
if (buf[2] == '\xff') { if (buf[2] == '\xff') {
if (buf[1] == '\x44') {
puts("b"); if (buf[1] == '\x44') { puts("b"); }
}
} }
break; break;
default: break; default: break;
@ -32,3 +31,4 @@ int main() {
target_func(data, 1024); target_func(data, 1024);
} }

4
qemu_mode/patches/afl-qemu-common.h
View File

@ -59,7 +59,7 @@
#define INC_AFL_AREA(loc) afl_area_ptr[loc]++ #define INC_AFL_AREA(loc) afl_area_ptr[loc]++
#endif #endif
typedef void (*afl_persistent_hook_fn)(uint64_t* regs, uint64_t guest_base); typedef void (*afl_persistent_hook_fn)(uint64_t *regs, uint64_t guest_base);
/* Declared in afl-qemu-cpu-inl.h */ /* Declared in afl-qemu-cpu-inl.h */
@ -81,7 +81,7 @@ extern afl_persistent_hook_fn afl_persistent_hook_ptr;
extern __thread abi_ulong afl_prev_loc; extern __thread abi_ulong afl_prev_loc;
extern struct cmp_map* __afl_cmp_map; extern struct cmp_map *__afl_cmp_map;
extern __thread u32 __afl_cmp_counter; extern __thread u32 __afl_cmp_counter;
void afl_debug_dump_saved_regs(); void afl_debug_dump_saved_regs();

43
qemu_mode/patches/afl-qemu-cpu-inl.h
View File

@ -82,7 +82,7 @@ u8 afl_compcov_level;
__thread abi_ulong afl_prev_loc; __thread abi_ulong afl_prev_loc;
struct cmp_map* __afl_cmp_map; struct cmp_map *__afl_cmp_map;
__thread u32 __afl_cmp_counter; __thread u32 __afl_cmp_counter;
/* Set in the child process in forkserver mode: */ /* Set in the child process in forkserver mode: */
@ -187,9 +187,9 @@ static void afl_setup(void) {
if (inst_r) afl_area_ptr[0] = 1; if (inst_r) afl_area_ptr[0] = 1;
} }
if (getenv("___AFL_EINS_ZWEI_POLIZEI___")) { // CmpLog forkserver if (getenv("___AFL_EINS_ZWEI_POLIZEI___")) { // CmpLog forkserver
id_str = getenv(CMPLOG_SHM_ENV_VAR); id_str = getenv(CMPLOG_SHM_ENV_VAR);
if (id_str) { if (id_str) {
@ -198,10 +198,10 @@ static void afl_setup(void) {
__afl_cmp_map = shmat(shm_id, NULL, 0); __afl_cmp_map = shmat(shm_id, NULL, 0);
if (__afl_cmp_map == (void*)-1) exit(1); if (__afl_cmp_map == (void *)-1) exit(1);
} }
} }
if (getenv("AFL_INST_LIBS")) { if (getenv("AFL_INST_LIBS")) {
@ -247,32 +247,42 @@ static void afl_setup(void) {
if (getenv("AFL_QEMU_PERSISTENT_GPR")) persistent_save_gpr = 1; if (getenv("AFL_QEMU_PERSISTENT_GPR")) persistent_save_gpr = 1;
if (getenv("AFL_QEMU_PERSISTENT_HOOK")) { if (getenv("AFL_QEMU_PERSISTENT_HOOK")) {
#ifdef AFL_QEMU_STATIC_BUILD #ifdef AFL_QEMU_STATIC_BUILD
fprintf(stderr, "[AFL] ERROR: you cannot use AFL_QEMU_PERSISTENT_HOOK when afl-qemu-trace is static\n"); fprintf(stderr,
"[AFL] ERROR: you cannot use AFL_QEMU_PERSISTENT_HOOK when "
"afl-qemu-trace is static\n");
exit(1); exit(1);
#else #else
persistent_save_gpr = 1; persistent_save_gpr = 1;
void* plib = dlopen(getenv("AFL_QEMU_PERSISTENT_HOOK"), RTLD_NOW); void *plib = dlopen(getenv("AFL_QEMU_PERSISTENT_HOOK"), RTLD_NOW);
if (!plib) { if (!plib) {
fprintf(stderr, "[AFL] ERROR: invalid AFL_QEMU_PERSISTENT_HOOK=%s\n", getenv("AFL_QEMU_PERSISTENT_HOOK"));
fprintf(stderr, "[AFL] ERROR: invalid AFL_QEMU_PERSISTENT_HOOK=%s\n",
getenv("AFL_QEMU_PERSISTENT_HOOK"));
exit(1); exit(1);
} }
afl_persistent_hook_ptr = dlsym(plib, "afl_persistent_hook"); afl_persistent_hook_ptr = dlsym(plib, "afl_persistent_hook");
if (!afl_persistent_hook_ptr) { if (!afl_persistent_hook_ptr) {
fprintf(stderr, "[AFL] ERROR: failed to find the function \"afl_persistent_hook\" in %s\n", getenv("AFL_QEMU_PERSISTENT_HOOK"));
fprintf(stderr,
"[AFL] ERROR: failed to find the function "
"\"afl_persistent_hook\" in %s\n",
getenv("AFL_QEMU_PERSISTENT_HOOK"));
exit(1); exit(1);
} }
#endif #endif
} }
if (getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET")) if (getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"))
persisent_retaddr_offset = persisent_retaddr_offset =
strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 0); strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 0);
@ -402,9 +412,12 @@ static void afl_forkserver(CPUState *cpu) {
if (WIFSTOPPED(status)) if (WIFSTOPPED(status))
child_stopped = 1; child_stopped = 1;
else if (unlikely(first_run && is_persistent)) { else if (unlikely(first_run && is_persistent)) {
fprintf(stderr, "[AFL] ERROR: no persistent iteration executed\n"); fprintf(stderr, "[AFL] ERROR: no persistent iteration executed\n");
exit(12); // Persistent is wrong exit(12); // Persistent is wrong
} }
first_run = 0; first_run = 0;
if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(7); if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(7);

96
qemu_mode/patches/afl-qemu-cpu-translate-inl.h
View File

@ -153,17 +153,15 @@ static void afl_cmplog_64(target_ulong cur_loc, target_ulong arg1,
} }
static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2, static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2,
TCGMemOp ot, int is_imm) { TCGMemOp ot, int is_imm) {
void *func; void *func;
if (cur_loc > afl_end_code || cur_loc < afl_start_code) if (cur_loc > afl_end_code || cur_loc < afl_start_code) return;
return;
if (__afl_cmp_map) { if (__afl_cmp_map) {
cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
cur_loc &= CMP_MAP_W - 1; cur_loc &= CMP_MAP_W - 1;
@ -177,16 +175,16 @@ static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2,
} }
tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2); tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2);
} else if (afl_compcov_level) { } else if (afl_compcov_level) {
if (!is_imm && afl_compcov_level < 2) return; if (!is_imm && afl_compcov_level < 2) return;
cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
cur_loc &= MAP_SIZE - 7; cur_loc &= MAP_SIZE - 7;
if (cur_loc >= afl_inst_rms) return; if (cur_loc >= afl_inst_rms) return;
switch (ot) { switch (ot) {
case MO_64: func = &afl_compcov_log_64; break; case MO_64: func = &afl_compcov_log_64; break;
@ -197,7 +195,7 @@ static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2,
} }
tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2); tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2);
} }
} }
@ -254,62 +252,60 @@ static void log_x86_sp_content(void) {
}*/ }*/
static void callback_to_persistent_hook(void) { static void callback_to_persistent_hook(void) {
afl_persistent_hook_ptr(persistent_saved_gpr, guest_base); afl_persistent_hook_ptr(persistent_saved_gpr, guest_base);
} }
static void i386_restore_state_for_persistent(TCGv* cpu_regs) { static void i386_restore_state_for_persistent(TCGv *cpu_regs) {
if (persistent_save_gpr) {
int i;
TCGv_ptr gpr_sv;
TCGv_ptr first_pass_ptr = tcg_const_ptr(&persistent_first_pass);
TCGv first_pass = tcg_temp_local_new();
TCGv one = tcg_const_tl(1);
tcg_gen_ld8u_tl(first_pass, first_pass_ptr, 0);
TCGLabel *lbl_restore_gpr = gen_new_label();
tcg_gen_brcond_tl(TCG_COND_NE, first_pass, one, lbl_restore_gpr);
if (persistent_save_gpr) {
int i;
TCGv_ptr gpr_sv;
TCGv_ptr first_pass_ptr = tcg_const_ptr(&persistent_first_pass);
TCGv first_pass = tcg_temp_local_new();
TCGv one = tcg_const_tl(1);
tcg_gen_ld8u_tl(first_pass, first_pass_ptr, 0);
TCGLabel *lbl_restore_gpr = gen_new_label();
tcg_gen_brcond_tl(TCG_COND_NE, first_pass, one, lbl_restore_gpr);
// save GRP registers // save GRP registers
for (i = 0; i < CPU_NB_REGS; ++i) { for (i = 0; i < CPU_NB_REGS; ++i) {
gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]);
tcg_gen_st_tl(cpu_regs[i], gpr_sv, 0); tcg_gen_st_tl(cpu_regs[i], gpr_sv, 0);
} }
gen_set_label(lbl_restore_gpr); gen_set_label(lbl_restore_gpr);
tcg_gen_afl_call0(&afl_persistent_loop);
if (afl_persistent_hook_ptr)
tcg_gen_afl_call0(callback_to_persistent_hook);
// restore GRP registers tcg_gen_afl_call0(&afl_persistent_loop);
for (i = 0; i < CPU_NB_REGS; ++i) {
if (afl_persistent_hook_ptr) tcg_gen_afl_call0(callback_to_persistent_hook);
gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]);
tcg_gen_ld_tl(cpu_regs[i], gpr_sv, 0); // restore GRP registers
for (i = 0; i < CPU_NB_REGS; ++i) {
gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]);
tcg_gen_ld_tl(cpu_regs[i], gpr_sv, 0);
} }
tcg_temp_free(first_pass); tcg_temp_free(first_pass);
} else if (afl_persistent_ret_addr == 0) { } else if (afl_persistent_ret_addr == 0) {
TCGv_ptr stack_off_ptr = tcg_const_ptr(&persistent_stack_offset); TCGv_ptr stack_off_ptr = tcg_const_ptr(&persistent_stack_offset);
TCGv stack_off = tcg_temp_new(); TCGv stack_off = tcg_temp_new();
tcg_gen_ld_tl(stack_off, stack_off_ptr, 0); tcg_gen_ld_tl(stack_off, stack_off_ptr, 0);
tcg_gen_sub_tl(cpu_regs[R_ESP], cpu_regs[R_ESP], stack_off); tcg_gen_sub_tl(cpu_regs[R_ESP], cpu_regs[R_ESP], stack_off);
tcg_temp_free(stack_off); tcg_temp_free(stack_off);
} }
} }

2
src/afl-fuzz-cmplog.c
View File

@ -442,7 +442,7 @@ u8 run_cmplog_target(char** argv, u32 timeout) {
setenv("MSAN_OPTIONS", "exit_code=" STRINGIFY(MSAN_ERROR) ":" setenv("MSAN_OPTIONS", "exit_code=" STRINGIFY(MSAN_ERROR) ":"
"symbolize=0:" "symbolize=0:"
"msan_track_origins=0", 0); "msan_track_origins=0", 0);
setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1); setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1);
if (!qemu_mode) argv[0] = cmplog_binary; if (!qemu_mode) argv[0] = cmplog_binary;

55
src/afl-fuzz-redqueen.c
View File

@ -122,9 +122,8 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) {
while ((rng = pop_biggest_range(&ranges)) != NULL && stage_cur) { while ((rng = pop_biggest_range(&ranges)) != NULL && stage_cur) {
u32 s = rng->end - rng->start; u32 s = rng->end - rng->start;
if (s == 0) if (s == 0) goto empty_range;
goto empty_range;
memcpy(backup, buf + rng->start, s); memcpy(backup, buf + rng->start, s);
rand_replace(buf + rng->start, s); rand_replace(buf + rng->start, s);
@ -137,9 +136,11 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) {
ranges = add_range(ranges, rng->start + s / 2 + 1, rng->end); ranges = add_range(ranges, rng->start + s / 2 + 1, rng->end);
memcpy(buf + rng->start, backup, s); memcpy(buf + rng->start, backup, s);
} else needs_write = 1; } else
empty_range: needs_write = 1;
empty_range:
ck_free(rng); ck_free(rng);
--stage_cur; --stage_cur;
@ -156,9 +157,9 @@ empty_range:
ck_free(rng); ck_free(rng);
} }
// save the input with the high entropy // save the input with the high entropy
if (needs_write) { if (needs_write) {
s32 fd; s32 fd;
@ -169,7 +170,7 @@ empty_range:
} else { } else {
unlink(queue_cur->fname); /* ignore errors */ unlink(queue_cur->fname); /* ignore errors */
fd = open(queue_cur->fname, O_WRONLY | O_CREAT | O_EXCL, 0600); fd = open(queue_cur->fname, O_WRONLY | O_CREAT | O_EXCL, 0600);
} }
@ -177,10 +178,10 @@ empty_range:
if (fd < 0) PFATAL("Unable to create '%s'", queue_cur->fname); if (fd < 0) PFATAL("Unable to create '%s'", queue_cur->fname);
ck_write(fd, buf, len, queue_cur->fname); ck_write(fd, buf, len, queue_cur->fname);
queue_cur->len = len; // no-op, just to be 100% safe queue_cur->len = len; // no-op, just to be 100% safe
close(fd); close(fd);
} }
return 0; return 0;
@ -305,24 +306,27 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
void try_to_add_to_dict(u64 v, u8 shape) { void try_to_add_to_dict(u64 v, u8 shape) {
u8* b = (u8*)&v; u8* b = (u8*)&v;
u32 k; u32 k;
u8 cons_ff = 0, cons_0 = 0; u8 cons_ff = 0, cons_0 = 0;
for (k = 0; k < shape; ++k) { for (k = 0; k < shape; ++k) {
if (b[k] == 0) ++cons_0; if (b[k] == 0)
else if (b[k] == 0xff) ++cons_0; ++cons_0;
else cons_0 = cons_ff = 0; else if (b[k] == 0xff)
++cons_0;
if (cons_0 > 1 || cons_ff > 1) else
return; cons_0 = cons_ff = 0;
if (cons_0 > 1 || cons_ff > 1) return;
} }
maybe_add_auto((u8*)&v, shape); maybe_add_auto((u8*)&v, shape);
u64 rev; u64 rev;
switch (shape) { switch (shape) {
case 1: break; case 1: break;
case 2: case 2:
rev = SWAP16((u16)v); rev = SWAP16((u16)v);
@ -336,8 +340,9 @@ void try_to_add_to_dict(u64 v, u8 shape) {
rev = SWAP64(v); rev = SWAP64(v);
maybe_add_auto((u8*)&rev, shape); maybe_add_auto((u8*)&rev, shape);
break; break;
} }
} }
u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) { u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
@ -380,13 +385,13 @@ u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
break; break;
} }
// If failed, add to dictionary // If failed, add to dictionary
if (fails == 8) { if (fails == 8) {
try_to_add_to_dict(o->v0, SHAPE_BYTES(h->shape)); try_to_add_to_dict(o->v0, SHAPE_BYTES(h->shape));
try_to_add_to_dict(o->v1, SHAPE_BYTES(h->shape)); try_to_add_to_dict(o->v1, SHAPE_BYTES(h->shape));
} }
cmp_fuzz_next_iter: cmp_fuzz_next_iter:

14
src/afl-fuzz-stats.c
View File

@ -334,9 +334,9 @@ void show_stats(void) {
/* Lord, forgive me this. */ /* Lord, forgive me this. */
SAYF(SET_G1 bSTG bLT bH bSTOP cCYA SAYF(SET_G1 bSTG bLT bH bSTOP cCYA
" process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA
" overall results " bSTG bH2 bH2 bRT "\n"); " overall results " bSTG bH2 bH2 bRT "\n");
if (dumb_mode) { if (dumb_mode) {
@ -413,9 +413,9 @@ void show_stats(void) {
" uniq hangs : " cRST "%-6s" bSTG bV "\n", " uniq hangs : " cRST "%-6s" bSTG bV "\n",
DTD(cur_ms, last_hang_time), tmp); DTD(cur_ms, last_hang_time), tmp);
SAYF(bVR bH bSTOP cCYA SAYF(bVR bH bSTOP cCYA
" cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA
" map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); " map coverage " bSTG bH bHT bH20 bH2 bVL "\n");
/* This gets funny because we want to print several variable-length variables /* This gets funny because we want to print several variable-length variables
together, but then cram them into a fixed-width field - so we need to together, but then cram them into a fixed-width field - so we need to
@ -443,9 +443,9 @@ void show_stats(void) {
SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp); SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp);
SAYF(bVR bH bSTOP cCYA SAYF(bVR bH bSTOP cCYA
" stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA
" findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
sprintf(tmp, "%s (%0.02f%%)", DI(queued_favored), sprintf(tmp, "%s (%0.02f%%)", DI(queued_favored),
((double)queued_favored) * 100 / queued_paths); ((double)queued_favored) * 100 / queued_paths);
@ -514,7 +514,7 @@ void show_stats(void) {
/* Aaaalmost there... hold on! */ /* Aaaalmost there... hold on! */
SAYF(bVR bH cCYA bSTOP SAYF(bVR bH cCYA bSTOP
" fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA
" path geometry " bSTG bH5 bH2 bVL "\n"); " path geometry " bSTG bH5 bH2 bVL "\n");