ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-13 02:28:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

allow -L -1 to enable mopt in parallel to classic mutation

Browse Source
This commit is contained in:
van Hauser
2020-04-13 12:12:27 +02:00
parent 5daec436f9
commit dda096da03
7 changed files with 56 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/afl-forkserver.c
View File

@ -365,9 +365,9 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
kill(fsrv->fsrv_pid, SIGKILL);
} else {
rlen = 4;
}
} else {
@ -631,9 +631,9 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
static void afl_fsrv_kill(afl_forkserver_t *fsrv) {
if (fsrv->child_pid > 0) kill(fsrv->child_pid, SIGKILL);
if (fsrv->fsrv_pid > 0) kill(fsrv->fsrv_pid, SIGKILL);
if (waitpid(fsrv->fsrv_pid, NULL, 0) <= 0) { WARNF("error waitpid\n"); }
if (fsrv->child_pid > 0) kill(fsrv->child_pid, SIGKILL);
if (fsrv->fsrv_pid > 0) kill(fsrv->fsrv_pid, SIGKILL);
if (waitpid(fsrv->fsrv_pid, NULL, 0) <= 0) { WARNF("error waitpid\n"); }
}

14
src/afl-fuzz-one.c
View File

@ -4377,7 +4377,7 @@ void pso_updating(afl_state_t *afl) {
u8 fuzz_one(afl_state_t *afl) {
int key_val_lv = 0;
int key_val_lv_1 = 0, key_val_lv_2 = 0;
#ifdef _AFL_DOCUMENT_MUTATIONS
@ -4397,22 +4397,22 @@ u8 fuzz_one(afl_state_t *afl) {
#endif
if (afl->limit_time_sig == 0) {
// if limit_time_sig == -1 then both are run after each other
key_val_lv = fuzz_one_original(afl);
if (afl->limit_time_sig <= 0) { key_val_lv_1 = fuzz_one_original(afl); }
} else {
if (afl->limit_time_sig != 0) {
if (afl->key_module == 0)
key_val_lv = pilot_fuzzing(afl);
key_val_lv_2 = pilot_fuzzing(afl);
else if (afl->key_module == 1)
key_val_lv = core_fuzzing(afl);
key_val_lv_2 = core_fuzzing(afl);
else if (afl->key_module == 2)
pso_updating(afl);
}
return key_val_lv;
return (key_val_lv_1 | key_val_lv_2);
#undef BUF_PARAMS

2
src/afl-fuzz-run.c
View File

@ -49,7 +49,7 @@ u8 run_target(afl_state_t *afl, afl_forkserver_t *fsrv, u32 timeout) {
memset(fsrv->trace_bits, 0, fsrv->map_size);
MEM_BARRIER();
/* we have the fork server (or faux server) up and running, so simply
tell it to have at it, and then read back PID. */

50
src/afl-fuzz.c
View File

@ -109,12 +109,12 @@ static void usage(afl_state_t *afl, u8 *argv0, int more_help) {
"Mutator settings:\n"
" -R[R] - add Radamsa as mutator, add another -R to exclusivly "
"run it\n"
" -L minutes - use MOpt(imize) mode and set the limit time for "
" -L minutes - use MOpt(imize) mode and set the time limit for "
"entering the\n"
" pacemaker mode (minutes of no new paths, 0 = "
"immediately).\n"
" a recommended value is 10-60. see "
"docs/README.MOpt.md\n"
" pacemaker mode (minutes of no new paths). 0 = "
"immediately,\n"
" -1 = immediately and together with normal mutation).\n"
" See docs/README.MOpt.md\n"
" -c program - enable CmpLog by specifying a binary compiled for "
"it.\n"
" if using QEMU, just use -c 0.\n\n"
@ -553,20 +553,33 @@ int main(int argc, char **argv_orig, char **envp) {
case 'L': { /* MOpt mode */
if (afl->limit_time_sig) FATAL("Multiple -L options not supported");
afl->limit_time_sig = 1;
afl->havoc_max_mult = HAVOC_MAX_MULT_MOPT;
if (sscanf(optarg, "%llu", &afl->limit_time_puppet) < 1 ||
optarg[0] == '-')
if (sscanf(optarg, "%d", &afl->limit_time_puppet) < 1)
FATAL("Bad syntax used for -L");
if (afl->limit_time_puppet == -1) {
afl->limit_time_sig = -1;
afl->limit_time_puppet = 0;
} else if (afl->limit_time_puppet < 0) {
FATAL("-L value must be between 0 and 2000000 or -1");
} else {
afl->limit_time_sig = 1;
}
u64 limit_time_puppet2 = afl->limit_time_puppet * 60 * 1000;
if (limit_time_puppet2 < afl->limit_time_puppet)
FATAL("limit_time overflow");
afl->limit_time_puppet = limit_time_puppet2;
SAYF("limit_time_puppet %llu\n", afl->limit_time_puppet);
SAYF("limit_time_puppet %d\n", afl->limit_time_puppet);
afl->swarm_now = 0;
if (afl->limit_time_puppet == 0) afl->key_puppet = 1;
@ -701,11 +714,14 @@ int main(int argc, char **argv_orig, char **envp) {
if (afl->use_radamsa) {
if (afl->limit_time_sig)
if (afl->limit_time_sig > 0)
FATAL(
"MOpt and Radamsa are mutually exclusive. We accept pull requests "
"that integrates MOpt with the optional mutators "
"(custom/radamsa/redquenn/...).");
"MOpt and Radamsa are mutually exclusive unless you specify -L -1. "
"We accept pull requests that integrates MOpt with the optional "
"mutators (custom/radamsa/redqueen/...).");
if (afl->limit_time_sig && afl->use_radamsa > 1)
FATAL("Radamsa in radamsa-only mode can not run together with -L");
OKF("Using Radamsa add-on");
@ -984,11 +1000,11 @@ int main(int argc, char **argv_orig, char **envp) {
if (afl->cmplog_binary) {
if (afl->limit_time_sig)
if (afl->limit_time_sig > 0)
FATAL(
"MOpt and CmpLog are mutually exclusive. We accept pull requests "
"that integrates MOpt with the optional mutators "
"(custom/radamsa/redquenn/...).");
"MOpt and CmpLog are mutually exclusive unless you specify -L -1. We "
"accept pull requests that integrates MOpt with the optional "
"mutators (custom/radamsa/redqueen/...).");
if (afl->unicorn_mode)
FATAL("CmpLog and Unicorn mode are not compatible at the moment, sorry");