afl-cmin help fix, aflpp_driver - + @@ support

afl-cmin

@@ -119,13 +119,13 @@ function usage() {
 "Environment variables used:\n" \
 "AFL_ALLOW_TMP: allow unsafe use of input/output directories under {/var}/tmp\n" \
 "AFL_CRASH_EXITCODE: optional child exit code to be interpreted as crash\n" \
-"AFL_FORKSRV_INIT_TMOUT: time the fuzzer waits for the target to come up, initially\n" \
+"AFL_FORKSRV_INIT_TMOUT: time the fuzzer waits for the forkserver to come up\n" \
 "AFL_KEEP_TRACES: leave the temporary <out_dir>/.traces directory\n" \
-"AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc. (default: SIGKILL)\n"
+"AFL_KILL_SIGNAL: Signal delivered to child processes on timeout (default: SIGKILL)\n" \
-"AFL_PATH: path for the afl-showmap binary if not found anywhere else\n" \
+"AFL_PATH: path for the afl-showmap binary if not found anywhere in PATH\n" \
 "AFL_PRINT_FILENAMES: If set, the filename currently processed will be " \
       "printed to stdout\n" \
-"AFL_SKIP_BIN_CHECK: skip check for target binary\n"
+"AFL_SKIP_BIN_CHECK: skip afl instrumentation checks for target binary\n"
    exit 1
 }
 

frida_mode/src/instrument/instrument_debug.c

@@ -20,7 +20,6 @@ static void instrument_debug(char *format, ...) {
   int len;
 
   va_start(ap, format);
-
   ret = vsnprintf(buffer, sizeof(buffer) - 1, format, ap);
   va_end(ap);
 

utils/aflpp_driver/README.md

@@ -13,6 +13,12 @@ If this is the clang compile command to build for libfuzzer:
 then just switch `clang++` with `afl-clang-fast++` and our compiler will
 magically insert libAFLDriver.a :)
 
+To use shared-memory testcases, you need nothing to do.
+To use stdin testcases give `-` as the only command line parameter.
+To use file input testcases give `@@` as the only command line parameter.
+
+IMPORTANT: if you use `afl-cmin` or `afl-cmin.bash` then either pass `-`
+or `@@` as command line parameters.
 
 ## aflpp_qemu_driver
 

utils/aflpp_driver/aflpp_driver.c

@@ -174,11 +174,17 @@ size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
 static int ExecuteFilesOnyByOne(int argc, char **argv) {
 
   unsigned char *buf = (unsigned char *)malloc(MAX_FILE);
+
   for (int i = 1; i < argc; i++) {
 
-    int fd = open(argv[i], O_RDONLY);
+    int fd = 0;
-    if (fd == -1) continue;
+
+    if (strcmp(argv[i], "-") != 0) { fd = open(argv[i], O_RDONLY); }
+
+    if (fd == -1) { continue; }
+
     ssize_t length = read(fd, buf, MAX_FILE);
+
     if (length > 0) {
 
       printf("Reading %zu bytes from %s\n", length, argv[i]);
@@ -187,7 +193,7 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 
     }
 
-    close(fd);
+    if (fd > 0) { close(fd); }
 
   }
 
@@ -199,15 +205,19 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 int main(int argc, char **argv) {
 
   printf(
-      "======================= INFO =========================\n"
+      "============================== INFO ================================\n"
       "This binary is built for afl++.\n"
+      "To use with afl-cmin or afl-cmin.bash pass '-' as single command line "
+      "option\n"
       "To run the target function on individual input(s) execute this:\n"
       "  %s INPUT_FILE1 [INPUT_FILE2 ... ]\n"
       "To fuzz with afl-fuzz execute this:\n"
       "  afl-fuzz [afl-flags] -- %s [-N]\n"
       "afl-fuzz will run N iterations before re-spawning the process (default: "
       "INT_MAX)\n"
-      "======================================================\n",
+      "For stdin input processing, pass '-' as single command line option.\n"
+      "For file input processing, pass '@@' as single command line option.\n"
+      "===================================================================\n",
       argv[0], argv[0]);
 
   if (getenv("AFL_GDB")) {
@@ -237,22 +247,35 @@ int main(int argc, char **argv) {
   memcpy(dummy_input, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
   memcpy(dummy_input + 32, (void *)AFL_DEFER_FORKSVR,
          sizeof(AFL_DEFER_FORKSVR));
+
   int N = INT_MAX;
-  if (argc == 2 && argv[1][0] == '-')
+
-    N = atoi(argv[1] + 1);
+  if (argc == 2 && !strcmp(argv[1], "-")) {
-  else if (argc == 2 && (N = atoi(argv[1])) > 0)
-    printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
-  else if (argc > 1) {
 
     __afl_sharedmem_fuzzing = 0;
     __afl_manual_init();
     return ExecuteFilesOnyByOne(argc, argv);
 
+  } else if (argc == 2 && argv[1][0] == '-') {
+
+    N = atoi(argv[1] + 1);
+
+  } else if (argc == 2 && (N = atoi(argv[1])) > 0) {
+
+    printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
+
+  } else if (argc > 1) {
+
+    __afl_sharedmem_fuzzing = 0;
+
+    if (argc == 2) { __afl_manual_init(); }
+
+    return ExecuteFilesOnyByOne(argc, argv);
+
   }
 
   assert(N > 0);
 
-  //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
   __afl_manual_init();
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
@@ -271,6 +294,7 @@ int main(int argc, char **argv) {
       fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
     fprintf(stderr, "\n");
 #endif
+
     if (*__afl_fuzz_len) {
 
       num_runs++;