mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-16 11:58:08 +00:00
push to stable (#1734)
* afl++ -> AFL++ * update readme * more debug * slightly different weighting algo (#1719) * better seed selection * slightly different weighting calculation * remove unnecessary memset * Add "Hangs saved" to afl-whatsup (#1717) The hangs could show long or infinite loops. This is important. Co-authored-by: van Hauser <vh@thc.org> * nits * afl-showmap: Start a only a single fork server (#1718) A forkserver is started by afl_fsrv_get_mapsize() when dynamically finding the map size. When an input directory option is specified a second fork server was also started. This commit re-arranges the inits for several forkserver struct members so that we can re-use the server started by the get_mapsize() call when not in coresight/qemu/unicorn modes and just start the server otherwise. * Source Code Coverage support for Nyx (Part 1) (#1720) * Additional source code reformatting in afl-compiler-rt * Add source code coverage support to afl-compiler-rt (for use with Nyx) * doc, code format * llvm 17 changes * more llvm 17 * add frida mode tutorial * fix effector map * docs * Should memset EFF_ALEN(len) of eff_map (#1722) * fix reallocs * fix afl-system-config for macos * afl-fuzz.c: Document -i - in --help (#1725) afl-fuzz.c: Document `-i -` in `--help`, to write that `-i` can be passed '-' to resume the prior fuzzing job. Also reference AFL_AUTORESUME so users know they can set that parameter to sidestep the issue entirely. * tritondse custom mutator attempt * tritondse fixes * update libnyx (#1727) * GNUmakefile: Update LLVM instructions (#1728) Update LLVM instructions, because versions higher than 14 are supported and to be explicit that LLD is also required * disable macos in the ci, works fine for me * fix makefile * better tritondse support * next steps for tritondse * qemuafl: Persistent mode for PPC32 targets * update qemu_mode * afl-clang-lto incomptable with -flto=thin * add @responsefile support for afl-cc --------- Co-authored-by: fxlb <devel.fx.lebail@orange.fr> Co-authored-by: Nick Potenski <nick.potenski@garmin.com> Co-authored-by: Christian Holler (:decoder) <choller@mozilla.com> Co-authored-by: lazymio <mio@lazym.io> Co-authored-by: Moshe Kaplan <me@moshekaplan.com> Co-authored-by: Sergej Schumilo <sergej@schumilo.de> Co-authored-by: Dominik Maier <domenukk@gmail.com>
This commit is contained in:
van Hauser
GitHub
17
custom_mutators/aflpp_tritondse/README.md
Normal file
17
custom_mutators/aflpp_tritondse/README.md
Normal file
@ -0,0 +1,17 @@
|
||||
# An AFL++ custom mutator using TritonDSE
|
||||
|
||||
## Installing the requirements
|
||||
|
||||
`pip3 install tritondse`
|
||||
|
||||
## How to run with an example
|
||||
|
||||
```
|
||||
../../afl-cc -o ../../test-instr ../../test-instr.c
|
||||
mkdir -p in
|
||||
echo aaaa > in/in
|
||||
TRITON_DSE_TARGET=../../test-instr AFL_CUSTOM_MUTATOR_ONLY=1 AFL_SYNC_TIME=1 AFL_PYTHON_MODULE=aflpp_tritondse PYTHONPATH=. ../../afl-fuzz -i in -o out -- ../../test-instr
|
||||
```
|
||||
|
||||
Note that this custom mutator works differently, new finds are synced
|
||||
after 10-60 seconds to the fuzzing instance.
|
||||
148
custom_mutators/aflpp_tritondse/aflpp_tritondse.py
Normal file
148
custom_mutators/aflpp_tritondse/aflpp_tritondse.py
Normal file
@ -0,0 +1,148 @@
|
||||
import sys
|
||||
import os
|
||||
import logging
|
||||
import hashlib
|
||||
|
||||
from tritondse import CleLoader
|
||||
from tritondse import CompositeData
|
||||
from tritondse import Config
|
||||
from tritondse import CoverageStrategy
|
||||
from tritondse import ProcessState
|
||||
from tritondse import Program
|
||||
from tritondse import Seed
|
||||
from tritondse import SeedFormat
|
||||
from tritondse import SymbolicExecutor
|
||||
from tritondse import SymbolicExplorator
|
||||
|
||||
is_debug = False
|
||||
out_path = ""
|
||||
input_file = None
|
||||
prog = None
|
||||
config = None
|
||||
dse = None
|
||||
cycle = 0
|
||||
count = 0
|
||||
hashes = set()
|
||||
format = SeedFormat.RAW
|
||||
|
||||
def pre_exec_hook(se: SymbolicExecutor, state: ProcessState):
|
||||
global count
|
||||
global hashes
|
||||
if se.seed.hash not in hashes:
|
||||
hashes.add(se.seed.hash)
|
||||
filename = out_path + "/id:" + f"{count:06}" + "," + se.seed.hash
|
||||
if not os.path.exists(filename):
|
||||
if is_debug:
|
||||
print('Creating queue input ' + filename)
|
||||
with open(filename, 'wb') as file:
|
||||
if input_file:
|
||||
file.write(se.seed.content.files[input_file])
|
||||
else:
|
||||
file.write(se.seed.content)
|
||||
count += 1
|
||||
#if input_file:
|
||||
# if is_debug:
|
||||
# print('Writing to ' + input_file + ' the content: ' + str(se.seed.content))
|
||||
# with open(input_file, 'wb') as file:
|
||||
# file.write(se.seed.content)
|
||||
|
||||
|
||||
def init(seed):
|
||||
global config
|
||||
global dse
|
||||
global format
|
||||
global input_file
|
||||
global is_debug
|
||||
global out_path
|
||||
global prog
|
||||
# Load the program (LIEF-based program loader).
|
||||
prog = CleLoader(os.environ['AFL_CUSTOM_INFO_PROGRAM'])
|
||||
# Process other configuration environment variables.
|
||||
argv = None
|
||||
try:
|
||||
foo = os.environ['AFL_DEBUG']
|
||||
is_debug = True
|
||||
except KeyError:
|
||||
pass
|
||||
try:
|
||||
foo = os.environ['AFL_CUSTOM_INFO_OUT']
|
||||
out_path = foo + '/../tritondse/queue'
|
||||
except KeyError:
|
||||
pass
|
||||
try:
|
||||
foo = os.environ['AFL_CUSTOM_INFO_PROGRAM_INPUT']
|
||||
input_file = foo
|
||||
except KeyError:
|
||||
pass
|
||||
try:
|
||||
argv_list = os.environ['AFL_CUSTOM_INFO_PROGRAM_ARGV']
|
||||
argv_tmp = [ os.environ['AFL_CUSTOM_INFO_PROGRAM'] ]
|
||||
argv_tmp += argv_list.split()
|
||||
argv = []
|
||||
# now check for @@
|
||||
for item in argv_tmp:
|
||||
if "@@" in item:
|
||||
input_file = out_path + '/../.input'
|
||||
argv.append(input_file)
|
||||
else:
|
||||
argv.append(item)
|
||||
except KeyError:
|
||||
pass
|
||||
# Create the output directory
|
||||
os.makedirs(out_path, exist_ok=True)
|
||||
# Debug
|
||||
if is_debug:
|
||||
print('DEBUG target: ' + os.environ['AFL_CUSTOM_INFO_PROGRAM'])
|
||||
if argv:
|
||||
print('DEBUG argv: ')
|
||||
print(argv)
|
||||
if input_file:
|
||||
print('DEBUG input_file: ' + input_file)
|
||||
print('DEBUG out_path: ' + out_path)
|
||||
print('')
|
||||
if input_file:
|
||||
format = SeedFormat.COMPOSITE
|
||||
# Now set up TritonDSE
|
||||
config = Config(coverage_strategy = CoverageStrategy.PATH,
|
||||
debug = is_debug,
|
||||
pipe_stdout = is_debug,
|
||||
pipe_stderr = is_debug,
|
||||
execution_timeout = 1,
|
||||
program_argv = argv,
|
||||
smt_timeout= 50,
|
||||
seed_format = format)
|
||||
# Create an instance of the Symbolic Explorator
|
||||
dse = SymbolicExplorator(config, prog)
|
||||
# Add callbacks.
|
||||
dse.callback_manager.register_pre_execution_callback(pre_exec_hook)
|
||||
|
||||
|
||||
#def fuzz(buf, add_buf, max_size):
|
||||
# return b""
|
||||
|
||||
|
||||
def queue_new_entry(filename_new_queue, filename_orig_queue):
|
||||
global cycle
|
||||
global dse
|
||||
# Add seed to the worklist.
|
||||
with open(filename_new_queue, "rb") as file:
|
||||
data = file.read()
|
||||
hash = hashlib.md5(data).hexdigest()
|
||||
if hash not in hashes:
|
||||
hashes.add(hash)
|
||||
if is_debug:
|
||||
print("NEW FILE " + filename_new_queue + " hash " + hash + " count " + str(cycle))
|
||||
cycle += 1
|
||||
if input_file:
|
||||
seed = Seed(CompositeData(files={"stdin": b"", # nothing on stdin
|
||||
input_file: data}))
|
||||
else:
|
||||
seed = Seed(data)
|
||||
dse.add_input_seed(seed)
|
||||
# Start exploration!
|
||||
#dse.step()
|
||||
dse.explore()
|
||||
pass
|
||||
|
||||
def splice_optout():
|
||||
pass
|
||||
Reference in New Issue
Block a user