ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-15 03:18:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

code format and changelog

Browse Source
This commit is contained in:
vanhauser-thc
2024-06-18 15:42:34 +02:00
parent 3ebf41ba34
commit b8568034f0
4 changed files with 54 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/Changelog.md
View File

@ -4,6 +4,11 @@
release of the tool. See README.md for the general instruction manual. release of the tool. See README.md for the general instruction manual.
### Version ++4.22a (dev) ### Version ++4.22a (dev)
- afl-fuzz:
- fastresume feature added. if you abort fuzzing and resume fuzzing
with `-i -` or `AFL_AUTORESUME=1` and the target binary has not changed
then a dump will be loaded and the calibration phase skipped.
to disable this feature set `AFL_NO_FASTRESUME=1`
- frida_mode: - frida_mode:
- AFL_FRIDA_PERSISTENT_ADDR can now be be any reachable address not just - AFL_FRIDA_PERSISTENT_ADDR can now be be any reachable address not just
a function entry a function entry

3
include/envs.h
View File

@ -115,7 +115,8 @@ static char *afl_environment_variables[] = {
"AFL_TRACE_PC", "AFL_USE_ASAN", "AFL_USE_MSAN", "AFL_USE_TRACE_PC", "AFL_TRACE_PC", "AFL_USE_ASAN", "AFL_USE_MSAN", "AFL_USE_TRACE_PC",
"AFL_USE_UBSAN", "AFL_USE_TSAN", "AFL_USE_CFISAN", "AFL_USE_LSAN", "AFL_USE_UBSAN", "AFL_USE_TSAN", "AFL_USE_CFISAN", "AFL_USE_LSAN",
"AFL_WINE_PATH", "AFL_NO_SNAPSHOT", "AFL_EXPAND_HAVOC_NOW", "AFL_USE_FASAN", "AFL_WINE_PATH", "AFL_NO_SNAPSHOT", "AFL_EXPAND_HAVOC_NOW", "AFL_USE_FASAN",
"AFL_USE_QASAN", "AFL_PRINT_FILENAMES", "AFL_PIZZA_MODE", "AFL_NO_FASTRESUME", NULL "AFL_USE_QASAN", "AFL_PRINT_FILENAMES", "AFL_PIZZA_MODE",
"AFL_NO_FASTRESUME", NULL
}; };

4
src/afl-fuzz-queue.c
View File

@ -401,7 +401,9 @@ void mark_as_redundant(afl_state_t *afl, struct queue_entry *q, u8 state) {
} else { } else {
if (unlink(fn)) { /*PFATAL("Unable to remove '%s'", fn);*/ } if (unlink(fn)) { /*PFATAL("Unable to remove '%s'", fn);*/
}
} }

86
src/afl-fuzz.c
View File

@ -3214,63 +3214,65 @@ stop_fuzzing:
#endif #endif
if (!afl->afl_env.afl_no_fastresume) { if (!afl->afl_env.afl_no_fastresume) {
/* create fastresume.bin */
u8 fr[PATH_MAX];
snprintf(fr, PATH_MAX, "%s/fastresume.bin", afl->out_dir);
ACTF("Writing %s ...", fr);
if ((fr_fd = open(fr, O_WRONLY | O_TRUNC | O_CREAT, DEFAULT_PERMISSION)) >=
0) {
u8 ver_string[8]; /* create fastresume.bin */
u32 w = 0; u8 fr[PATH_MAX];
u64 *ver = (u64 *)ver_string; snprintf(fr, PATH_MAX, "%s/fastresume.bin", afl->out_dir);
*ver = afl->shm.cmplog_mode + (sizeof(struct queue_entry) << 1); ACTF("Writing %s ...", fr);
if ((fr_fd = open(fr, O_WRONLY | O_TRUNC | O_CREAT, DEFAULT_PERMISSION)) >=
0) {
w += write(fr_fd, ver_string, sizeof(ver_string)); u8 ver_string[8];
u32 w = 0;
u64 *ver = (u64 *)ver_string;
*ver = afl->shm.cmplog_mode + (sizeof(struct queue_entry) << 1);
w += write(fr_fd, afl->virgin_bits, afl->fsrv.map_size); w += write(fr_fd, ver_string, sizeof(ver_string));
w += write(fr_fd, afl->virgin_tmout, afl->fsrv.map_size);
w += write(fr_fd, afl->virgin_crash, afl->fsrv.map_size);
w += write(fr_fd, afl->var_bytes, afl->fsrv.map_size);
u8 on[1] = {1}, off[1] = {0}; w += write(fr_fd, afl->virgin_bits, afl->fsrv.map_size);
u8 *o_start = (u8 *)&(afl->queue_buf[0]->colorized); w += write(fr_fd, afl->virgin_tmout, afl->fsrv.map_size);
u8 *o_end = (u8 *)&(afl->queue_buf[0]->mother); w += write(fr_fd, afl->virgin_crash, afl->fsrv.map_size);
u32 q_len = o_end - o_start; w += write(fr_fd, afl->var_bytes, afl->fsrv.map_size);
u32 m_len = (afl->fsrv.map_size >> 3);
struct queue_entry *q;
afl->pending_not_fuzzed = afl->queued_items; u8 on[1] = {1}, off[1] = {0};
afl->active_items = afl->queued_items; u8 *o_start = (u8 *)&(afl->queue_buf[0]->colorized);
u8 *o_end = (u8 *)&(afl->queue_buf[0]->mother);
u32 q_len = o_end - o_start;
u32 m_len = (afl->fsrv.map_size >> 3);
struct queue_entry *q;
for (u32 i = 0; i < afl->queued_items; i++) { afl->pending_not_fuzzed = afl->queued_items;
afl->active_items = afl->queued_items;
q = afl->queue_buf[i]; for (u32 i = 0; i < afl->queued_items; i++) {
ck_write(fr_fd, (u8 *)&(q->colorized), q_len, "queue data");
if (!q->trace_mini) {
ck_write(fr_fd, off, 1, "no_mini"); q = afl->queue_buf[i];
w += q_len + 1; ck_write(fr_fd, (u8 *)&(q->colorized), q_len, "queue data");
if (!q->trace_mini) {
} else { ck_write(fr_fd, off, 1, "no_mini");
w += q_len + 1;
ck_write(fr_fd, on, 1, "yes_mini"); } else {
ck_write(fr_fd, q->trace_mini, m_len, "trace_mini");
w += q_len + m_len + 1; ck_write(fr_fd, on, 1, "yes_mini");
ck_write(fr_fd, q->trace_mini, m_len, "trace_mini");
w += q_len + m_len + 1;
}
} }
close(fr_fd);
afl->var_byte_count = count_bytes(afl, afl->var_bytes);
OKF("Written fastresume.bin with %u bytes!", w);
} else {
WARNF("Could not create fastresume.bin");
} }
close(fr_fd);
afl->var_byte_count = count_bytes(afl, afl->var_bytes);
OKF("Written fastresume.bin with %u bytes!", w);
} else {
WARNF("Could not create fastresume.bin");
}
} }
destroy_queue(afl); destroy_queue(afl);