ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-14 02:58:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

skim import

Browse Source
This commit is contained in:
van Hauser
2020-12-17 10:55:33 +01:00
parent 14c67f15c9
commit d07b0169cb
4 changed files with 114 additions and 240 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
GNUmakefile
View File

@ -77,13 +77,17 @@ ifeq "$(shell echo 'int main() {return 0; }' | $(CC) -fno-move-loop-invariants -
SPECIAL_PERFORMANCE += -fno-move-loop-invariants -fdisable-tree-cunrolli
endif
ifneq "$(shell uname)" "Darwin"
ifeq "$(shell echo 'int main() {return 0; }' | $(CC) $(CFLAGS) -Werror -x c - -march=native -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
ifndef SOURCE_DATE_EPOCH
#CFLAGS_OPT += -march=native
SPECIAL_PERFORMANCE += -march=native
HAVE_MARCHNATIVE = 1
CFLAGS_OPT += -march=native
endif
endif
ifneq "$(shell uname)" "Darwin"
ifeq "$(HAVE_MARCHNATIVE)" "1"
SPECIAL_PERFORMANCE += -march=native
endif
# OS X does not like _FORTIFY_SOURCE=2
ifndef DEBUG
CFLAGS_OPT += -D_FORTIFY_SOURCE=2
@ -117,6 +121,7 @@ ifdef INTROSPECTION
CFLAGS_OPT += -DINTROSPECTION=1
endif
ifneq "$(shell uname -m)" "x86_64"
ifneq "$(patsubst i%86,i386,$(shell uname -m))" "i386"
ifneq "$(shell uname -m)" "amd64"

9
include/afl-fuzz.h
View File

@ -1014,14 +1014,9 @@ void write_bitmap(afl_state_t *);
u32 count_bits(afl_state_t *, u8 *);
u32 count_bytes(afl_state_t *, u8 *);
u32 count_non_255_bytes(afl_state_t *, u8 *);
#ifdef WORD_SIZE_64
void simplify_trace(afl_state_t *, u64 *);
void classify_counts(afl_forkserver_t *);
#else
void simplify_trace(afl_state_t *, u32 *);
void classify_counts(afl_forkserver_t *);
#endif
void simplify_trace(afl_state_t *, u8 *);
void init_count_class16(void);
void classify_counts(afl_forkserver_t *fsrv);
void minimize_bits(afl_state_t *, u8 *, u8 *);
#ifndef SIMPLE_FILES
u8 *describe_op(afl_state_t *, u8, size_t);

320
src/afl-fuzz-bitmap.c
View File

@ -49,101 +49,6 @@ void write_bitmap(afl_state_t *afl) {
}
/* Check if the current execution path brings anything new to the table.
Update virgin bits to reflect the finds. Returns 1 if the only change is
the hit-count for a particular tuple; 2 if there are new tuples seen.
Updates the map, so subsequent calls will always return 0.
This function is called after every exec() on a fairly large buffer, so
it needs to be fast. We do this in 32-bit and 64-bit flavors. */
u8 __attribute__((hot)) has_new_bits(afl_state_t *afl, u8 *virgin_map) {
#ifdef WORD_SIZE_64
u64 *current = (u64 *)afl->fsrv.trace_bits;
u64 *virgin = (u64 *)virgin_map;
u32 i = (afl->fsrv.map_size >> 3);
#else
u32 *current = (u32 *)afl->fsrv.trace_bits;
u32 *virgin = (u32 *)virgin_map;
u32 i = (afl->fsrv.map_size >> 2);
#endif /* ^WORD_SIZE_64 */
// the map size must be a minimum of 8 bytes.
// for variable/dynamic map sizes this is ensured in the forkserver
u8 ret = 0;
while (i--) {
/* Optimize for (*current & *virgin) == 0 - i.e., no bits in current bitmap
that have not been already cleared from the virgin map - since this will
almost always be the case. */
// the (*current) is unnecessary but speeds up the overall comparison
if (unlikely(*current) && unlikely(*current & *virgin)) {
if (likely(ret < 2)) {
u8 *cur = (u8 *)current;
u8 *vir = (u8 *)virgin;
/* Looks like we have not found any new bytes yet; see if any non-zero
bytes in current[] are pristine in virgin[]. */
#ifdef WORD_SIZE_64
if (*virgin == 0xffffffffffffffff || (cur[0] && vir[0] == 0xff) ||
(cur[1] && vir[1] == 0xff) || (cur[2] && vir[2] == 0xff) ||
(cur[3] && vir[3] == 0xff) || (cur[4] && vir[4] == 0xff) ||
(cur[5] && vir[5] == 0xff) || (cur[6] && vir[6] == 0xff) ||
(cur[7] && vir[7] == 0xff)) {
ret = 2;
} else {
ret = 1;
}
#else
if (*virgin == 0xffffffff || (cur[0] && vir[0] == 0xff) ||
(cur[1] && vir[1] == 0xff) || (cur[2] && vir[2] == 0xff) ||
(cur[3] && vir[3] == 0xff))
ret = 2;
else
ret = 1;
#endif /* ^WORD_SIZE_64 */
}
*virgin &= ~*current;
}
++current;
++virgin;
}
if (unlikely(ret) && likely(virgin_map == afl->virgin_bits)) {
afl->bitmap_changed = 1;
}
return ret;
}
/* Count the number of bits set in the provided bitmap. Used for the status
screen several times every second, does not have to be fast. */
@ -242,77 +147,11 @@ const u8 simplify_lookup[256] = {
};
#ifdef WORD_SIZE_64
void simplify_trace(afl_state_t *afl, u64 *mem) {
u32 i = (afl->fsrv.map_size >> 3);
while (i--) {
/* Optimize for sparse bitmaps. */
if (unlikely(*mem)) {
u8 *mem8 = (u8 *)mem;
mem8[0] = simplify_lookup[mem8[0]];
mem8[1] = simplify_lookup[mem8[1]];
mem8[2] = simplify_lookup[mem8[2]];
mem8[3] = simplify_lookup[mem8[3]];
mem8[4] = simplify_lookup[mem8[4]];
mem8[5] = simplify_lookup[mem8[5]];
mem8[6] = simplify_lookup[mem8[6]];
mem8[7] = simplify_lookup[mem8[7]];
} else {
*mem = 0x0101010101010101ULL;
}
++mem;
}
}
#else
void simplify_trace(afl_state_t *afl, u32 *mem) {
u32 i = (afl->fsrv.map_size >> 2);
while (i--) {
/* Optimize for sparse bitmaps. */
if (unlikely(*mem)) {
u8 *mem8 = (u8 *)mem;
mem8[0] = simplify_lookup[mem8[0]];
mem8[1] = simplify_lookup[mem8[1]];
mem8[2] = simplify_lookup[mem8[2]];
mem8[3] = simplify_lookup[mem8[3]];
} else
*mem = 0x01010101;
++mem;
}
}
#endif /* ^WORD_SIZE_64 */
/* Destructively classify execution counts in a trace. This is used as a
preprocessing step for any newly acquired traces. Called on every exec,
must be fast. */
static const u8 count_class_lookup8[256] = {
const u8 count_class_lookup8[256] = {
[0] = 0,
[1] = 1,
@ -326,7 +165,7 @@ static const u8 count_class_lookup8[256] = {
};
static u16 count_class_lookup16[65536];
u16 count_class_lookup16[65536];
void init_count_class16(void) {
@ -345,64 +184,88 @@ void init_count_class16(void) {
}
/* Import coverage processing routines. */
#ifdef WORD_SIZE_64
#include "coverage-64.h"
#else
#include "coverage-32.h"
#endif
/* Check if the current execution path brings anything new to the table.
Update virgin bits to reflect the finds. Returns 1 if the only change is
the hit-count for a particular tuple; 2 if there are new tuples seen.
Updates the map, so subsequent calls will always return 0.
This function is called after every exec() on a fairly large buffer, so
it needs to be fast. We do this in 32-bit and 64-bit flavors. */
inline u8 has_new_bits(afl_state_t *afl, u8 *virgin_map) {
#ifdef WORD_SIZE_64
void __attribute__((hot)) classify_counts(afl_forkserver_t *fsrv) {
u64 *current = (u64 *)afl->fsrv.trace_bits;
u64 *virgin = (u64 *)virgin_map;
u64 *mem = (u64 *)fsrv->trace_bits;
u32 i = (fsrv->map_size >> 3);
while (i--) {
/* Optimize for sparse bitmaps. */
if (unlikely(*mem)) {
u16 *mem16 = (u16 *)mem;
mem16[0] = count_class_lookup16[mem16[0]];
mem16[1] = count_class_lookup16[mem16[1]];
mem16[2] = count_class_lookup16[mem16[2]];
mem16[3] = count_class_lookup16[mem16[3]];
}
++mem;
}
}
u32 i = (afl->fsrv.map_size >> 3);
#else
void __attribute__((hot)) classify_counts(afl_forkserver_t *fsrv) {
u32 *current = (u32 *)afl->fsrv.trace_bits;
u32 *virgin = (u32 *)virgin_map;
u32 *mem = (u32 *)fsrv->trace_bits;
u32 i = (fsrv->map_size >> 2);
while (i--) {
/* Optimize for sparse bitmaps. */
if (unlikely(*mem)) {
u16 *mem16 = (u16 *)mem;
mem16[0] = count_class_lookup16[mem16[0]];
mem16[1] = count_class_lookup16[mem16[1]];
}
++mem;
}
}
u32 i = (afl->fsrv.map_size >> 2);
#endif /* ^WORD_SIZE_64 */
u8 ret = 0;
while (i--) {
if (unlikely(*current)) discover_word(&ret, current, virgin);
current++;
virgin++;
}
if (unlikely(ret) && likely(virgin_map == afl->virgin_bits))
afl->bitmap_changed = 1;
return ret;
}
/* A combination of classify_counts and has_new_bits. If 0 is returned, then the
* trace bits are kept as-is. Otherwise, the trace bits are overwritten with
* classified values.
*
* This accelerates the processing: in most cases, no interesting behavior
* happen, and the trace bits will be discarded soon. This function optimizes
* for such cases: one-pass scan on trace bits without modifying anything. Only
* on rare cases it fall backs to the slow path: classify_counts() first, then
* return has_new_bits(). */
inline u8 has_new_bits_unclassified(afl_state_t *afl, u8 *virgin_map) {
/* Handle the hot path first: no new coverage */
u8 *end = afl->fsrv.trace_bits + afl->fsrv.map_size;
#ifdef WORD_SIZE_64
if (!skim((u64 *)virgin_map, (u64 *)afl->fsrv.trace_bits, (u64 *)end))
return 0;
#else
if (!skim((u32 *)virgin_map, (u32 *)afl->fsrv.trace_bits, (u32 *)end))
return 0;
#endif /* ^WORD_SIZE_64 */
classify_counts(&afl->fsrv);
return has_new_bits(afl, virgin_map);
}
/* Compact trace bytes into a smaller bitmap. We effectively just drop the
count information here. This is called only sporadically, for some
new paths. */
@ -581,7 +444,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
u8 *queue_fn = "";
u8 new_bits = '\0';
s32 fd;
u8 keeping = 0, res;
u8 keeping = 0, res, classified = 0;
u64 cksum = 0;
u8 fn[PATH_MAX];
@ -605,13 +468,17 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
/* Keep only if there are new bits in the map, add to queue for
future fuzzing, etc. */
if (!(new_bits = has_new_bits(afl, afl->virgin_bits))) {
new_bits = has_new_bits_unclassified(afl, afl->virgin_bits);
if (likely(!new_bits)) {
if (unlikely(afl->crash_mode)) { ++afl->total_crashes; }
return 0;
}
classified = new_bits;
#ifndef SIMPLE_FILES
queue_fn = alloc_printf(
@ -715,11 +582,14 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
if (likely(!afl->non_instrumented_mode)) {
#ifdef WORD_SIZE_64
simplify_trace(afl, (u64 *)afl->fsrv.trace_bits);
#else
simplify_trace(afl, (u32 *)afl->fsrv.trace_bits);
#endif /* ^WORD_SIZE_64 */
if (!classified) {
classify_counts(&afl->fsrv);
classified = 1;
}
simplify_trace(afl, afl->fsrv.trace_bits);
if (!has_new_bits(afl, afl->virgin_tmout)) { return keeping; }
@ -764,6 +634,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
u8 new_fault;
write_to_testcase(afl, mem, len);
new_fault = fuzz_run_target(afl, &afl->fsrv, afl->hang_tmout);
classify_counts(&afl->fsrv);
/* A corner case that one user reported bumping into: increasing the
timeout actually uncovers a crash. Make sure we don't discard it if
@ -812,11 +683,14 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
if (likely(!afl->non_instrumented_mode)) {
#ifdef WORD_SIZE_64
simplify_trace(afl, (u64 *)afl->fsrv.trace_bits);
#else
simplify_trace(afl, (u32 *)afl->fsrv.trace_bits);
#endif /* ^WORD_SIZE_64 */
if (!classified) {
classify_counts(&afl->fsrv);
classified = 1;
}
simplify_trace(afl, afl->fsrv.trace_bits);
if (!has_new_bits(afl, afl->virgin_crash)) { return keeping; }

6
src/afl-fuzz-run.c
View File

@ -62,8 +62,6 @@ fuzz_run_target(afl_state_t *afl, afl_forkserver_t *fsrv, u32 timeout) {
time_spent_start = (spec.tv_sec * 1000000000) + spec.tv_nsec;
#endif
// TODO: Don't classify for faults?
classify_counts(fsrv);
return res;
}
@ -379,6 +377,7 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
}
classify_counts(&afl->fsrv);
cksum = hash64(afl->fsrv.trace_bits, afl->fsrv.map_size, HASH_CONST);
if (q->exec_cksum != cksum) {
@ -767,13 +766,14 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
write_with_gap(afl, in_buf, q->len, remove_pos, trim_avail);
fault = fuzz_run_target(afl, &afl->fsrv, afl->fsrv.exec_tmout);
++afl->trim_execs;
if (afl->stop_soon || fault == FSRV_RUN_ERROR) { goto abort_trimming; }
/* Note that we don't keep track of crashes or hangs here; maybe TODO?
*/
++afl->trim_execs;
classify_counts(&afl->fsrv);
cksum = hash64(afl->fsrv.trace_bits, afl->fsrv.map_size, HASH_CONST);
/* If the deletion had no impact on the trace, make it permanent. This