diff --git a/docs/env_variables.md b/docs/env_variables.md index ed44c256..3052663a 100644 --- a/docs/env_variables.md +++ b/docs/env_variables.md @@ -664,6 +664,24 @@ checks or alter some of the more exotic semantics of the tool: Note that will not be exact and with slow targets it can take seconds until there is a slice for the time test. + - When using `AFL_PRELOAD` with a preload that disable `fork()` calls in + the target, the forkserver becomes unable to fork. + To overcome this issue, the `AFL_PRELOAD_DISCRIMINATE_FORKSERVER_PARENT` + permits to be able to check in the preloaded library if the environment + variable `AFL_FORKSERVER_PARENT` is set, to be able to use vanilla + `fork()` in the forkserver, and the placeholder in the target. + Here is a POC : + ```C + // AFL_PRELOAD_DISCRIMINATE_FORKSERVER_PARENT=1 afl-fuzz ... + pid_t fork(void) + { + if (getenv("AFL_FORKSERVER_PARENT") == NULL) + return 0; // We are in the target + else + return real_fork(); // We are in the forkserver + } + ``` + ## 6) Settings for afl-qemu-trace The QEMU wrapper used to instrument binary-only code supports several settings: diff --git a/include/envs.h b/include/envs.h index 7913e6b9..433b51a5 100644 --- a/include/envs.h +++ b/include/envs.h @@ -118,7 +118,8 @@ static char *afl_environment_variables[] = { "AFL_CFISAN_VERBOSE", "AFL_USE_LSAN", "AFL_WINE_PATH", "AFL_NO_SNAPSHOT", "AFL_EXPAND_HAVOC_NOW", "AFL_USE_FASAN", "AFL_USE_QASAN", "AFL_PRINT_FILENAMES", "AFL_PIZZA_MODE", "AFL_NO_FASTRESUME", - "AFL_SAN_ABSTRACTION", "AFL_SAN_NO_INST", "AFL_SAN_RECOVER", NULL}; + "AFL_SAN_ABSTRACTION", "AFL_SAN_NO_INST", "AFL_SAN_RECOVER", + "AFL_PRELOAD_DISCRIMINATE_FORKSERVER_PARENT", NULL}; extern char *afl_environment_variables[];