From bca7ce804308fdc24404d26a02d2e10116ef6289 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 1 Jun 2020 12:30:20 +0200
Subject: [PATCH 1/7] fixed persistent mode shared mem fuzzing

---
 examples/persistent_demo/Makefile             |  6 +-
 examples/persistent_demo/persistent_demo.c    |  1 +
 .../persistent_demo/persistent_demo_new.c     |  1 +
 examples/persistent_demo/test-instr.c         | 60 +++++++++++++++++++
 llvm_mode/GNUmakefile                         |  9 ++-
 llvm_mode/afl-llvm-rt.o.c                     | 44 +++++++++++++-
 6 files changed, 116 insertions(+), 5 deletions(-)
 create mode 100644 examples/persistent_demo/test-instr.c

diff --git a/examples/persistent_demo/Makefile b/examples/persistent_demo/Makefile
index cbbb7239..ea8fd02a 100644
--- a/examples/persistent_demo/Makefile
+++ b/examples/persistent_demo/Makefile
@@ -1,6 +1,10 @@
 all:
 	afl-clang-fast -o persistent_demo persistent_demo.c
 	afl-clang-fast -o persistent_demo_new persistent_demo_new.c
+	afl-clang-fast -o test-instr test-instr.c
+
+document:
+	afl-clang-fast -D_AFL_DOCUMENT_MUTATIONS -o test-instr test-instr.c
 
 clean:
-	rm -f persistent_demo persistent_demo_new
+	rm -f persistent_demo persistent_demo_new test-instr
diff --git a/examples/persistent_demo/persistent_demo.c b/examples/persistent_demo/persistent_demo.c
index 2da49bb0..4cedc32c 100644
--- a/examples/persistent_demo/persistent_demo.c
+++ b/examples/persistent_demo/persistent_demo.c
@@ -41,6 +41,7 @@ int main(int argc, char **argv) {
      terminate normally. This limits the impact of accidental memory leaks
      and similar hiccups. */
 
+  __AFL_INIT();
   while (__AFL_LOOP(1000)) {
 
     /*** PLACEHOLDER CODE ***/
diff --git a/examples/persistent_demo/persistent_demo_new.c b/examples/persistent_demo/persistent_demo_new.c
index 36411e13..69468bdd 100644
--- a/examples/persistent_demo/persistent_demo_new.c
+++ b/examples/persistent_demo/persistent_demo_new.c
@@ -42,6 +42,7 @@ int main(int argc, char **argv) {
      terminate normally. This limits the impact of accidental memory leaks
      and similar hiccups. */
 
+  __AFL_INIT();
   buf = __AFL_FUZZ_TESTCASE_BUF;
 
   while (__AFL_LOOP(1000)) {
diff --git a/examples/persistent_demo/test-instr.c b/examples/persistent_demo/test-instr.c
new file mode 100644
index 00000000..069e74dd
--- /dev/null
+++ b/examples/persistent_demo/test-instr.c
@@ -0,0 +1,60 @@
+/*
+   american fuzzy lop++ - a trivial program to test the build
+   --------------------------------------------------------
+   Originally written by Michal Zalewski
+   Copyright 2014 Google Inc. All rights reserved.
+   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+     http://www.apache.org/licenses/LICENSE-2.0
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+__AFL_FUZZ_INIT();
+
+int main(int argc, char **argv) {
+
+  __AFL_INIT();
+  unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;
+  
+  while(__AFL_LOOP(2147483647)) {
+  
+    unsigned int len = __AFL_FUZZ_TESTCASE_LEN;
+
+#ifdef _AFL_DOCUMENT_MUTATIONS
+    static unsigned int counter = 0;
+    char fn[32];
+    sprintf(fn, "%09u:test-instr", counter);
+    int fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+    if (fd_doc >= 0) {
+      if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) {
+        fprintf(stderr, "write of mutation file failed: %s\n", fn);
+        unlink(fn);
+      }
+      close(fd_doc);
+    }
+    counter++;
+#endif
+
+    if (!len) continue;
+  
+    if (buf[0] == '0')
+      printf("Looks like a zero to me!\n");
+    else if (buf[0] == '1')
+      printf("Pretty sure that is a one!\n");
+    else
+      printf("Neither one or zero? How quaint!\n");
+  }
+
+  return 0;
+
+}
+
diff --git a/llvm_mode/GNUmakefile b/llvm_mode/GNUmakefile
index 50a6be2b..0666fde0 100644
--- a/llvm_mode/GNUmakefile
+++ b/llvm_mode/GNUmakefile
@@ -354,16 +354,21 @@ endif
 ../cmplog-instructions-pass.so:	cmplog-instructions-pass.cc afl-llvm-common.o | test_deps
 	$(CXX) $(CLANG_CFL) -shared $< -o $@ $(CLANG_LFL) afl-llvm-common.o
 
+document:
+	$(CLANG_BIN) -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS) -Wno-unused-result -fPIC -c afl-llvm-rt.o.c -o ../afl-llvm-rt.o
+	@$(CLANG_BIN) -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS) -Wno-unused-result -m32 -fPIC -c afl-llvm-rt.o.c -o ../afl-llvm-rt-32.o 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
+	@$(CLANG_BIN) -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS) -Wno-unused-result -m64 -fPIC -c afl-llvm-rt.o.c -o ../afl-llvm-rt-64.o 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
+
 ../afl-llvm-rt.o: afl-llvm-rt.o.c | test_deps
 	$(CLANG_BIN) $(CFLAGS) -Wno-unused-result -fPIC -c $< -o $@
 
 ../afl-llvm-rt-32.o: afl-llvm-rt.o.c | test_deps
 	@printf "[*] Building 32-bit variant of the runtime (-m32)... "
-	@$(CC_SAVE) $(CFLAGS) -Wno-unused-result -m32 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
+	@$(CLANG_BIN) $(CFLAGS) -Wno-unused-result -m32 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
 
 ../afl-llvm-rt-64.o: afl-llvm-rt.o.c | test_deps
 	@printf "[*] Building 64-bit variant of the runtime (-m64)... "
-	@$(CC_SAVE) $(CFLAGS) -Wno-unused-result -m64 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
+	@$(CLANG_BIN) $(CFLAGS) -Wno-unused-result -m64 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
 
 test_build: $(PROGS)
 	@echo "[*] Testing the CC wrapper and instrumentation output..."
diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c
index 3a0584e4..7a763f1b 100644
--- a/llvm_mode/afl-llvm-rt.o.c
+++ b/llvm_mode/afl-llvm-rt.o.c
@@ -78,6 +78,8 @@ u8 *__afl_area_ptr = __afl_area_initial;
 u8 *__afl_dictionary;
 u8 *__afl_fuzz_ptr;
 u32 __afl_fuzz_len;
+u32 __afl_fuzz_len_dummy;
+u32 *__afl_fuzz_len_shmem = &__afl_fuzz_len_dummy;
 
 u32 __afl_final_loc;
 u32 __afl_map_size = MAP_SIZE;
@@ -163,6 +165,8 @@ static void __afl_map_shm_fuzz() {
     exit(1);
 
   }
+  
+   __afl_fuzz_len_shmem = (u32*) mmap(NULL, sizeof(int), PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
 
 }
 
@@ -443,9 +447,26 @@ static void __afl_start_snapshots(void) {
 
     }
 
-    __afl_fuzz_len = (was_killed >> 8);
+    *__afl_fuzz_len_shmem = __afl_fuzz_len = (was_killed >> 8);
     was_killed = (was_killed & 0xff);
 
+#ifdef _AFL_DOCUMENT_MUTATIONS
+    if (__afl_fuzz_ptr) {
+      static uint32_t counter = 0;
+      char fn[32];
+      sprintf(fn, "%09u:forkserver", counter);
+      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+      if (fd_doc >= 0) {
+        if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) {
+          fprintf(stderr, "write of mutation file failed: %s\n", fn);
+          unlink(fn);
+        }
+        close(fd_doc);
+      }
+      counter++;
+    }
+#endif
+
     /* If we stopped the child in persistent mode, but there was a race
        condition and afl-fuzz already issued SIGKILL, write off the old
        process. */
@@ -620,9 +641,26 @@ static void __afl_start_forkserver(void) {
 
     }
 
-    __afl_fuzz_len = (was_killed >> 8);
+    *__afl_fuzz_len_shmem = __afl_fuzz_len = (was_killed >> 8);
     was_killed = (was_killed & 0xff);
 
+#ifdef _AFL_DOCUMENT_MUTATIONS
+    if (__afl_fuzz_ptr) {
+      static uint32_t counter = 0;
+      char fn[32];
+      sprintf(fn, "%09u:forkserver", counter);
+      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+      if (fd_doc >= 0) {
+        if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) {
+          fprintf(stderr, "write of mutation file failed: %s\n", fn);
+          unlink(fn);
+        }
+        close(fd_doc);
+      }
+      counter++;
+    }
+#endif
+
     /* If we stopped the child in persistent mode, but there was a race
        condition and afl-fuzz already issued SIGKILL, write off the old
        process. */
@@ -719,6 +757,8 @@ int __afl_persistent_loop(unsigned int max_cnt) {
 
       raise(SIGSTOP);
 
+      __afl_fuzz_len = *__afl_fuzz_len_shmem;
+
       __afl_area_ptr[0] = 1;
       memset(__afl_prev_loc, 0, NGRAM_SIZE_MAX * sizeof(PREV_LOC_T));
 

From 0de25f08ba2e39f680a1440e9b84ee9cf4136f9a Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 1 Jun 2020 12:30:55 +0200
Subject: [PATCH 2/7] code format

---
 examples/persistent_demo/test-instr.c | 17 +++++++----
 llvm_mode/afl-llvm-rt.o.c             | 41 ++++++++++++++++++++-------
 src/afl-fuzz-init.c                   |  2 --
 src/afl-fuzz.c                        |  6 +---
 4 files changed, 43 insertions(+), 23 deletions(-)

diff --git a/examples/persistent_demo/test-instr.c b/examples/persistent_demo/test-instr.c
index 069e74dd..cd1c9b0e 100644
--- a/examples/persistent_demo/test-instr.c
+++ b/examples/persistent_demo/test-instr.c
@@ -24,34 +24,41 @@ int main(int argc, char **argv) {
 
   __AFL_INIT();
   unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;
-  
-  while(__AFL_LOOP(2147483647)) {
-  
+
+  while (__AFL_LOOP(2147483647)) {
+
     unsigned int len = __AFL_FUZZ_TESTCASE_LEN;
 
 #ifdef _AFL_DOCUMENT_MUTATIONS
     static unsigned int counter = 0;
-    char fn[32];
+    char                fn[32];
     sprintf(fn, "%09u:test-instr", counter);
     int fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
     if (fd_doc >= 0) {
+
       if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) {
+
         fprintf(stderr, "write of mutation file failed: %s\n", fn);
         unlink(fn);
+
       }
+
       close(fd_doc);
+
     }
+
     counter++;
 #endif
 
     if (!len) continue;
-  
+
     if (buf[0] == '0')
       printf("Looks like a zero to me!\n");
     else if (buf[0] == '1')
       printf("Pretty sure that is a one!\n");
     else
       printf("Neither one or zero? How quaint!\n");
+
   }
 
   return 0;
diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c
index 7a763f1b..b96ca7f4 100644
--- a/llvm_mode/afl-llvm-rt.o.c
+++ b/llvm_mode/afl-llvm-rt.o.c
@@ -74,11 +74,11 @@ u8 __afl_area_initial[MAP_INITIAL_SIZE];
 #else
 u8                  __afl_area_initial[MAP_SIZE];
 #endif
-u8 *__afl_area_ptr = __afl_area_initial;
-u8 *__afl_dictionary;
-u8 *__afl_fuzz_ptr;
-u32 __afl_fuzz_len;
-u32 __afl_fuzz_len_dummy;
+u8 * __afl_area_ptr = __afl_area_initial;
+u8 * __afl_dictionary;
+u8 * __afl_fuzz_ptr;
+u32  __afl_fuzz_len;
+u32  __afl_fuzz_len_dummy;
 u32 *__afl_fuzz_len_shmem = &__afl_fuzz_len_dummy;
 
 u32 __afl_final_loc;
@@ -165,8 +165,9 @@ static void __afl_map_shm_fuzz() {
     exit(1);
 
   }
-  
-   __afl_fuzz_len_shmem = (u32*) mmap(NULL, sizeof(int), PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+
+  __afl_fuzz_len_shmem = (u32 *)mmap(NULL, sizeof(int), PROT_READ | PROT_WRITE,
+                                     MAP_SHARED | MAP_ANONYMOUS, -1, 0);
 
 }
 
@@ -450,22 +451,31 @@ static void __afl_start_snapshots(void) {
     *__afl_fuzz_len_shmem = __afl_fuzz_len = (was_killed >> 8);
     was_killed = (was_killed & 0xff);
 
-#ifdef _AFL_DOCUMENT_MUTATIONS
+  #ifdef _AFL_DOCUMENT_MUTATIONS
     if (__afl_fuzz_ptr) {
+
       static uint32_t counter = 0;
-      char fn[32];
+      char            fn[32];
       sprintf(fn, "%09u:forkserver", counter);
       s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
       if (fd_doc >= 0) {
+
         if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) {
+
           fprintf(stderr, "write of mutation file failed: %s\n", fn);
           unlink(fn);
+
         }
+
         close(fd_doc);
+
       }
+
       counter++;
+
     }
-#endif
+
+  #endif
 
     /* If we stopped the child in persistent mode, but there was a race
        condition and afl-fuzz already issued SIGKILL, write off the old
@@ -646,19 +656,28 @@ static void __afl_start_forkserver(void) {
 
 #ifdef _AFL_DOCUMENT_MUTATIONS
     if (__afl_fuzz_ptr) {
+
       static uint32_t counter = 0;
-      char fn[32];
+      char            fn[32];
       sprintf(fn, "%09u:forkserver", counter);
       s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
       if (fd_doc >= 0) {
+
         if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) {
+
           fprintf(stderr, "write of mutation file failed: %s\n", fn);
           unlink(fn);
+
         }
+
         close(fd_doc);
+
       }
+
       counter++;
+
     }
+
 #endif
 
     /* If we stopped the child in persistent mode, but there was a race
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 840b57f4..ea281b7b 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -1949,7 +1949,6 @@ static void handle_skipreq(int sig) {
 
 }
 
-
 /* Setup shared map for fuzzing with input via sharedmem */
 
 void setup_testcase_shmem(afl_state_t *afl) {
@@ -1978,7 +1977,6 @@ void setup_testcase_shmem(afl_state_t *afl) {
 
 }
 
-
 /* Do a PATH search and find target binary to see that it exists and
    isn't a shell script - a common and painful mistake. We also check for
    a valid ELF header and for evidence of AFL instrumentation. */
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 1c797424..54d59a9b 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1179,11 +1179,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
   check_binary(afl, argv[optind]);
 
-  if (afl->shmem_testcase_mode) {
-
-    setup_testcase_shmem(afl);
-
-  }
+  if (afl->shmem_testcase_mode) { setup_testcase_shmem(afl); }
 
   afl->start_time = get_cur_time();
 

From 15c0ad60c530906131fc089d8f5b05710c69f109 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 1 Jun 2020 13:15:16 +0200
Subject: [PATCH 3/7] minimal changes to a test

---
 examples/persistent_demo/Makefile     | 2 +-
 examples/persistent_demo/test-instr.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/persistent_demo/Makefile b/examples/persistent_demo/Makefile
index ea8fd02a..e2cf97f5 100644
--- a/examples/persistent_demo/Makefile
+++ b/examples/persistent_demo/Makefile
@@ -4,7 +4,7 @@ all:
 	afl-clang-fast -o test-instr test-instr.c
 
 document:
-	afl-clang-fast -D_AFL_DOCUMENT_MUTATIONS -o test-instr test-instr.c
+	AFL_DONT_OPTIMIZE=1 afl-clang-fast -D_AFL_DOCUMENT_MUTATIONS -o test-instr test-instr.c
 
 clean:
 	rm -f persistent_demo persistent_demo_new test-instr
diff --git a/examples/persistent_demo/test-instr.c b/examples/persistent_demo/test-instr.c
index cd1c9b0e..4cd07102 100644
--- a/examples/persistent_demo/test-instr.c
+++ b/examples/persistent_demo/test-instr.c
@@ -36,7 +36,7 @@ int main(int argc, char **argv) {
     int fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
     if (fd_doc >= 0) {
 
-      if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) {
+      if (write(fd_doc, buf, len) != __afl_fuzz_len) {
 
         fprintf(stderr, "write of mutation file failed: %s\n", fn);
         unlink(fn);

From ac998e9222c5a7572716cd2ec1affd00d7a45e3d Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 1 Jun 2020 13:15:34 +0200
Subject: [PATCH 4/7] minimal changes to a test

---
 examples/persistent_demo/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/persistent_demo/Makefile b/examples/persistent_demo/Makefile
index e2cf97f5..6fa1c30e 100644
--- a/examples/persistent_demo/Makefile
+++ b/examples/persistent_demo/Makefile
@@ -1,7 +1,7 @@
 all:
 	afl-clang-fast -o persistent_demo persistent_demo.c
 	afl-clang-fast -o persistent_demo_new persistent_demo_new.c
-	afl-clang-fast -o test-instr test-instr.c
+	AFL_DONT_OPTIMIZE=1 afl-clang-fast -o test-instr test-instr.c
 
 document:
 	AFL_DONT_OPTIMIZE=1 afl-clang-fast -D_AFL_DOCUMENT_MUTATIONS -o test-instr test-instr.c

From 9a65fe904dd0895b9f7d27aae1fbce22fcb598ef Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 1 Jun 2020 13:37:50 +0200
Subject: [PATCH 5/7] small changes to libfuzzer driver

---
 examples/aflpp_driver/aflpp_driver.cpp | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/examples/aflpp_driver/aflpp_driver.cpp b/examples/aflpp_driver/aflpp_driver.cpp
index 3dcc8c3c..a6b168cd 100644
--- a/examples/aflpp_driver/aflpp_driver.cpp
+++ b/examples/aflpp_driver/aflpp_driver.cpp
@@ -252,27 +252,27 @@ int main(int argc, char **argv) {
   else if(argc == 2 && (N = atoi(argv[1])) > 0)
       Printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
   else if (argc > 1) {
-    if (!getenv("AFL_DRIVER_DONT_DEFER")) {
+//    if (!getenv("AFL_DRIVER_DONT_DEFER")) {
       __afl_sharedmem_fuzzing = 0;
       __afl_manual_init();
-    }
+//    }
     return ExecuteFilesOnyByOne(argc, argv);
     exit(0);
   }
 
   assert(N > 0);
 
-  if (!getenv("AFL_DRIVER_DONT_DEFER"))
-    __afl_manual_init();
-
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
   // on the first execution of LLVMFuzzerTestOneInput is ignored.
   uint8_t dummy_input[1] = {0};
   LLVMFuzzerTestOneInput(dummy_input, 1);
 
+//  if (!getenv("AFL_DRIVER_DONT_DEFER"))
+  __afl_manual_init();
+
   int num_runs = 0;
   while (__afl_persistent_loop(N)) {
-    if (__afl_fuzz_len > 0) {
+    if (__afl_fuzz_len) {
       num_runs++;
       LLVMFuzzerTestOneInput(__afl_fuzz_ptr, __afl_fuzz_len);
     }

From adcffce0a083cf32ea41f5631ec0e9d77dfdd115 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 1 Jun 2020 14:57:05 +0200
Subject: [PATCH 6/7] fix libfuzzer driver

---
 examples/aflpp_driver/aflpp_driver.cpp | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/examples/aflpp_driver/aflpp_driver.cpp b/examples/aflpp_driver/aflpp_driver.cpp
index a6b168cd..1feae1c3 100644
--- a/examples/aflpp_driver/aflpp_driver.cpp
+++ b/examples/aflpp_driver/aflpp_driver.cpp
@@ -262,14 +262,14 @@ int main(int argc, char **argv) {
 
   assert(N > 0);
 
-  // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
-  // on the first execution of LLVMFuzzerTestOneInput is ignored.
-  uint8_t dummy_input[1] = {0};
-  LLVMFuzzerTestOneInput(dummy_input, 1);
-
 //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
   __afl_manual_init();
 
+  // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
+  // on the first execution of LLVMFuzzerTestOneInput is ignored.
+  //uint8_t dummy_input[1] = {0};
+  //LLVMFuzzerTestOneInput(dummy_input, 1);
+
   int num_runs = 0;
   while (__afl_persistent_loop(N)) {
     if (__afl_fuzz_len) {

From 1d15048f2f79bb6836e8a50676a8ecc8cff1e5d0 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 1 Jun 2020 15:30:44 +0200
Subject: [PATCH 7/7] hopeful finally change for libfuzzer driver

---
 examples/aflpp_driver/aflpp_driver.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/aflpp_driver/aflpp_driver.cpp b/examples/aflpp_driver/aflpp_driver.cpp
index 1feae1c3..f2c604da 100644
--- a/examples/aflpp_driver/aflpp_driver.cpp
+++ b/examples/aflpp_driver/aflpp_driver.cpp
@@ -267,8 +267,8 @@ int main(int argc, char **argv) {
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
   // on the first execution of LLVMFuzzerTestOneInput is ignored.
-  //uint8_t dummy_input[1] = {0};
-  //LLVMFuzzerTestOneInput(dummy_input, 1);
+  uint8_t dummy_input[1] = {0};
+  LLVMFuzzerTestOneInput(dummy_input, 1);
 
   int num_runs = 0;
   while (__afl_persistent_loop(N)) {