ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-10 01:01:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

shm debug and fixes

Browse Source
This commit is contained in:
van Hauser 2020-06-12 11:57:54 +02:00
parent 7d19b108c4
commit db2e04361d
5 changed files with 30 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
examples/aflpp_driver/GNUmakefile
View File

@ -7,7 +7,7 @@ ifneq "" "$(LLVM_BINDIR)"
LLVM_BINDIR := $(LLVM_BINDIR)/
endif
FLAGS=-O3 -funroll-loops
FLAGS=-O2 -funroll-loops
all: libAFLDriver.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so
@ -21,7 +21,6 @@ debug:
$(LLVM_BINDIR)clang++ -I../../include -D_DEBUG=\"1\" $(FLAGS) -stdlib=libc++ -funroll-loops -std=c++11 -c aflpp_driver.cpp
ar ru libAFLDriver.a aflpp_driver.o
aflpp_qemu_driver.o: aflpp_qemu_driver.c
$(LLVM_BINDIR)clang $(FLAGS) -O0 -funroll-loops -c aflpp_qemu_driver.c
@ -35,7 +34,7 @@ aflpp_qemu_driver_hook.o: aflpp_qemu_driver_hook.c
$(LLVM_BINDIR)clang -fPIC $(FLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c
test: libAFLDriver.a aflpp_driver_test.cpp
afl-clang-fast++ -Wl,--allow-multiple-definition -stdlib=libc++ -funroll-loops -std=c++11 -o aflpp_driver_test aflpp_driver_test.cpp libAFLDriver.a
afl-clang-fast++ -I../../include -Wl,--allow-multiple-definition -stdlib=libc++ -funroll-loops -std=c++11 -o aflpp_driver_test aflpp_driver_test.cpp libAFLDriver.a
clean:
rm -f *.o libAFLDriver*.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so *~ core aflpp_driver_test

10
examples/aflpp_driver/aflpp_driver.cpp
View File

@ -230,6 +230,8 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
}
int main(int argc, char **argv) {
unsigned char in_buf[1024000];
size_t in_buf_len;
Printf(
"======================= INFO =========================\n"
"This binary is built for AFL-fuzz.\n"
@ -278,10 +280,16 @@ int main(int argc, char **argv) {
while (__afl_persistent_loop(N)) {
#ifdef _DEBUG
fprintf(stderr, "CLIENT crc: %08x len: %u\n", hash32(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705), *__afl_fuzz_len);
fprintf(stderr, "RECV:");
for (int i = 0; i < *__afl_fuzz_len; i++)
fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
fprintf(stderr,"\n");
#endif
if (*__afl_fuzz_len) {
num_runs++;
LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
in_buf_len = *__afl_fuzz_len;
memcpy(in_buf, __afl_fuzz_ptr, in_buf_len);
LLVMFuzzerTestOneInput(in_buf, in_buf_len);
}
}
Printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);

8
examples/aflpp_driver/aflpp_driver_test.cpp
View File

@ -1,19 +1,21 @@
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include "hash.h"
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
fprintf(stderr, "Received size %lu\n", Size);
fprintf(stderr, "FUNC crc: %08x len: %lu\n", hash32(Data, Size, 0xa5b35705), Size);
if (Size < 4)
if (Size < 5)
return 0;
if (Data[0] == 'F')
if (Data[1] == 'A')
if (Data[2] == '$')
if (Data[3] == '$')
abort();
if (Data[4] == '$')
abort();
return 0;

4
llvm_mode/afl-llvm-rt.o.c
View File

@ -139,7 +139,7 @@ static void __afl_map_shm_fuzz() {
}
map = (u8 *)mmap(0, MAX_FILE, PROT_READ, MAP_SHARED, shm_fd, 0);
map = (u8 *)mmap(0, MAX_FILE + sizeof(u32), PROT_READ, MAP_SHARED, shm_fd, 0);
#else
u32 shm_id = atoi(id_str);
@ -157,7 +157,7 @@ static void __afl_map_shm_fuzz() {
}
__afl_fuzz_len = (u32 *)map;
__afl_fuzz_ptr = (u8 *)(map + sizeof(u32));
__afl_fuzz_ptr = map + sizeof(u32);
if (getenv("AFL_DEBUG")) {

14
src/afl-forkserver.c
View File

@ -32,6 +32,7 @@
#include "common.h"
#include "list.h"
#include "forkserver.h"
#include "hash.h"
#include <stdio.h>
#include <unistd.h>
@ -837,8 +838,17 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
*fsrv->shmem_fuzz_len = len;
memcpy(fsrv->shmem_fuzz, buf, len);
// fprintf(stderr, "FS crc: %08x len: %u\n", hash32(fsrv->shmem_fuzz,
// *fsrv->shmem_fuzz_len, 0xa5b35705), *fsrv->shmem_fuzz_len);
#ifdef _DEBUG
fprintf(stderr, "FS crc: %08x len: %u\n", hash32(fsrv->shmem_fuzz,
*fsrv->shmem_fuzz_len, 0xa5b35705), *fsrv->shmem_fuzz_len);
fprintf(stderr, "SHM :");
for (int i = 0; i < *fsrv->shmem_fuzz_len; i++)
fprintf(stderr, "%02x", fsrv->shmem_fuzz[i]);
fprintf(stderr, "\nORIG:");
for (int i = 0; i < *fsrv->shmem_fuzz_len; i++)
fprintf(stderr, "%02x", buf[i]);
fprintf(stderr, "\n");
#endif
} else {