ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-13 10:38:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

shm debug and fixes

Browse Source
This commit is contained in:
van Hauser
2020-06-12 11:57:54 +02:00
parent 7d19b108c4
commit db2e04361d
5 changed files with 30 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
examples/aflpp_driver/GNUmakefile
View File

@ -7,7 +7,7 @@ ifneq "" "$(LLVM_BINDIR)"
LLVM_BINDIR := $(LLVM_BINDIR)/
endif
FLAGS=-O3 -funroll-loops
FLAGS=-O2 -funroll-loops
all: libAFLDriver.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so
@ -20,7 +20,6 @@ libAFLDriver.a: aflpp_driver.o
debug:
$(LLVM_BINDIR)clang++ -I../../include -D_DEBUG=\"1\" $(FLAGS) -stdlib=libc++ -funroll-loops -std=c++11 -c aflpp_driver.cpp
ar ru libAFLDriver.a aflpp_driver.o
aflpp_qemu_driver.o: aflpp_qemu_driver.c
$(LLVM_BINDIR)clang $(FLAGS) -O0 -funroll-loops -c aflpp_qemu_driver.c
@ -35,7 +34,7 @@ aflpp_qemu_driver_hook.o: aflpp_qemu_driver_hook.c
$(LLVM_BINDIR)clang -fPIC $(FLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c
test: libAFLDriver.a aflpp_driver_test.cpp
afl-clang-fast++ -Wl,--allow-multiple-definition -stdlib=libc++ -funroll-loops -std=c++11 -o aflpp_driver_test aflpp_driver_test.cpp libAFLDriver.a
afl-clang-fast++ -I../../include -Wl,--allow-multiple-definition -stdlib=libc++ -funroll-loops -std=c++11 -o aflpp_driver_test aflpp_driver_test.cpp libAFLDriver.a
clean:
rm -f *.o libAFLDriver*.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so *~ core aflpp_driver_test

10
examples/aflpp_driver/aflpp_driver.cpp
View File

@ -230,6 +230,8 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
}
int main(int argc, char **argv) {
unsigned char in_buf[1024000];
size_t in_buf_len;
Printf(
"======================= INFO =========================\n"
"This binary is built for AFL-fuzz.\n"
@ -278,10 +280,16 @@ int main(int argc, char **argv) {
while (__afl_persistent_loop(N)) {
#ifdef _DEBUG
fprintf(stderr, "CLIENT crc: %08x len: %u\n", hash32(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705), *__afl_fuzz_len);
fprintf(stderr, "RECV:");
for (int i = 0; i < *__afl_fuzz_len; i++)
fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
fprintf(stderr,"\n");
#endif
if (*__afl_fuzz_len) {
num_runs++;
LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
in_buf_len = *__afl_fuzz_len;
memcpy(in_buf, __afl_fuzz_ptr, in_buf_len);
LLVMFuzzerTestOneInput(in_buf, in_buf_len);
}
}
Printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);

8
examples/aflpp_driver/aflpp_driver_test.cpp
View File

@ -1,19 +1,21 @@
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include "hash.h"
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
fprintf(stderr, "Received size %lu\n", Size);
fprintf(stderr, "FUNC crc: %08x len: %lu\n", hash32(Data, Size, 0xa5b35705), Size);
if (Size < 4)
if (Size < 5)
return 0;
if (Data[0] == 'F')
if (Data[1] == 'A')
if (Data[2] == '$')
if (Data[3] == '$')
abort();
if (Data[4] == '$')
abort();
return 0;