ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-14 02:58:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'dev' of github.com:aflplusplus/aflplusplus into dev

Browse Source
This commit is contained in:
Dominik Maier
2020-06-02 14:10:44 +02:00
parent 62306f5ce8 1d15048f2f
commit fbd781fc83
9 changed files with 152 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
examples/aflpp_driver/aflpp_driver.cpp
View File

@ -252,17 +252,17 @@ int main(int argc, char **argv) {
else if(argc == 2 && (N = atoi(argv[1])) > 0)
Printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
else if (argc > 1) {
if (!getenv("AFL_DRIVER_DONT_DEFER")) {
// if (!getenv("AFL_DRIVER_DONT_DEFER")) {
__afl_sharedmem_fuzzing = 0;
__afl_manual_init();
}
// }
return ExecuteFilesOnyByOne(argc, argv);
exit(0);
}
assert(N > 0);
if (!getenv("AFL_DRIVER_DONT_DEFER"))
// if (!getenv("AFL_DRIVER_DONT_DEFER"))
__afl_manual_init();
// Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
@ -272,7 +272,7 @@ int main(int argc, char **argv) {
int num_runs = 0;
while (__afl_persistent_loop(N)) {
if (__afl_fuzz_len > 0) {
if (__afl_fuzz_len) {
num_runs++;
LLVMFuzzerTestOneInput(__afl_fuzz_ptr, __afl_fuzz_len);
}

6
examples/persistent_demo/Makefile
View File

@ -1,6 +1,10 @@
all:
afl-clang-fast -o persistent_demo persistent_demo.c
afl-clang-fast -o persistent_demo_new persistent_demo_new.c
AFL_DONT_OPTIMIZE=1 afl-clang-fast -o test-instr test-instr.c
document:
AFL_DONT_OPTIMIZE=1 afl-clang-fast -D_AFL_DOCUMENT_MUTATIONS -o test-instr test-instr.c
clean:
rm -f persistent_demo persistent_demo_new
rm -f persistent_demo persistent_demo_new test-instr

1
examples/persistent_demo/persistent_demo.c
View File

@ -41,6 +41,7 @@ int main(int argc, char **argv) {
terminate normally. This limits the impact of accidental memory leaks
and similar hiccups. */
__AFL_INIT();
while (__AFL_LOOP(1000)) {
/*** PLACEHOLDER CODE ***/

1
examples/persistent_demo/persistent_demo_new.c
View File

@ -42,6 +42,7 @@ int main(int argc, char **argv) {
terminate normally. This limits the impact of accidental memory leaks
and similar hiccups. */
__AFL_INIT();
buf = __AFL_FUZZ_TESTCASE_BUF;
while (__AFL_LOOP(1000)) {

67
examples/persistent_demo/test-instr.c Normal file
View File

@ -0,0 +1,67 @@
/*
american fuzzy lop++ - a trivial program to test the build
--------------------------------------------------------
Originally written by Michal Zalewski
Copyright 2014 Google Inc. All rights reserved.
Copyright 2019-2020 AFLplusplus Project. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at:
http://www.apache.org/licenses/LICENSE-2.0
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
__AFL_FUZZ_INIT();
int main(int argc, char **argv) {
__AFL_INIT();
unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;
while (__AFL_LOOP(2147483647)) {
unsigned int len = __AFL_FUZZ_TESTCASE_LEN;
#ifdef _AFL_DOCUMENT_MUTATIONS
static unsigned int counter = 0;
char fn[32];
sprintf(fn, "%09u:test-instr", counter);
int fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
if (fd_doc >= 0) {
if (write(fd_doc, buf, len) != __afl_fuzz_len) {
fprintf(stderr, "write of mutation file failed: %s\n", fn);
unlink(fn);
}
close(fd_doc);
}
counter++;
#endif
if (!len) continue;
if (buf[0] == '0')
printf("Looks like a zero to me!\n");
else if (buf[0] == '1')
printf("Pretty sure that is a one!\n");
else
printf("Neither one or zero? How quaint!\n");
}
return 0;
}

9
llvm_mode/GNUmakefile
View File

@ -354,16 +354,21 @@ endif
../cmplog-instructions-pass.so: cmplog-instructions-pass.cc afl-llvm-common.o | test_deps
$(CXX) $(CLANG_CFL) -shared $< -o $@ $(CLANG_LFL) afl-llvm-common.o
document:
$(CLANG_BIN) -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS) -Wno-unused-result -fPIC -c afl-llvm-rt.o.c -o ../afl-llvm-rt.o
@$(CLANG_BIN) -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS) -Wno-unused-result -m32 -fPIC -c afl-llvm-rt.o.c -o ../afl-llvm-rt-32.o 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
@$(CLANG_BIN) -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS) -Wno-unused-result -m64 -fPIC -c afl-llvm-rt.o.c -o ../afl-llvm-rt-64.o 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
../afl-llvm-rt.o: afl-llvm-rt.o.c | test_deps
$(CLANG_BIN) $(CFLAGS) -Wno-unused-result -fPIC -c $< -o $@
../afl-llvm-rt-32.o: afl-llvm-rt.o.c | test_deps
@printf "[*] Building 32-bit variant of the runtime (-m32)... "
@$(CC_SAVE) $(CFLAGS) -Wno-unused-result -m32 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
@$(CLANG_BIN) $(CFLAGS) -Wno-unused-result -m32 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
../afl-llvm-rt-64.o: afl-llvm-rt.o.c | test_deps
@printf "[*] Building 64-bit variant of the runtime (-m64)... "
@$(CC_SAVE) $(CFLAGS) -Wno-unused-result -m64 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
@$(CLANG_BIN) $(CFLAGS) -Wno-unused-result -m64 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
test_build: $(PROGS)
@echo "[*] Testing the CC wrapper and instrumentation output..."

69
llvm_mode/afl-llvm-rt.o.c
View File

@ -74,10 +74,12 @@ u8 __afl_area_initial[MAP_INITIAL_SIZE];
#else
u8 __afl_area_initial[MAP_SIZE];
#endif
u8 *__afl_area_ptr = __afl_area_initial;
u8 *__afl_dictionary;
u8 *__afl_fuzz_ptr;
u8 * __afl_area_ptr = __afl_area_initial;
u8 * __afl_dictionary;
u8 * __afl_fuzz_ptr;
u32 __afl_fuzz_len;
u32 __afl_fuzz_len_dummy;
u32 *__afl_fuzz_len_shmem = &__afl_fuzz_len_dummy;
u32 __afl_final_loc;
u32 __afl_map_size = MAP_SIZE;
@ -164,6 +166,9 @@ static void __afl_map_shm_fuzz() {
}
__afl_fuzz_len_shmem = (u32 *)mmap(NULL, sizeof(int), PROT_READ | PROT_WRITE,
MAP_SHARED | MAP_ANONYMOUS, -1, 0);
}
/* SHM setup. */
@ -443,9 +448,35 @@ static void __afl_start_snapshots(void) {
}
__afl_fuzz_len = (was_killed >> 8);
*__afl_fuzz_len_shmem = __afl_fuzz_len = (was_killed >> 8);
was_killed = (was_killed & 0xff);
#ifdef _AFL_DOCUMENT_MUTATIONS
if (__afl_fuzz_ptr) {
static uint32_t counter = 0;
char fn[32];
sprintf(fn, "%09u:forkserver", counter);
s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
if (fd_doc >= 0) {
if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) {
fprintf(stderr, "write of mutation file failed: %s\n", fn);
unlink(fn);
}
close(fd_doc);
}
counter++;
}
#endif
/* If we stopped the child in persistent mode, but there was a race
condition and afl-fuzz already issued SIGKILL, write off the old
process. */
@ -620,9 +651,35 @@ static void __afl_start_forkserver(void) {
}
__afl_fuzz_len = (was_killed >> 8);
*__afl_fuzz_len_shmem = __afl_fuzz_len = (was_killed >> 8);
was_killed = (was_killed & 0xff);
#ifdef _AFL_DOCUMENT_MUTATIONS
if (__afl_fuzz_ptr) {
static uint32_t counter = 0;
char fn[32];
sprintf(fn, "%09u:forkserver", counter);
s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
if (fd_doc >= 0) {
if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) {
fprintf(stderr, "write of mutation file failed: %s\n", fn);
unlink(fn);
}
close(fd_doc);
}
counter++;
}
#endif
/* If we stopped the child in persistent mode, but there was a race
condition and afl-fuzz already issued SIGKILL, write off the old
process. */
@ -719,6 +776,8 @@ int __afl_persistent_loop(unsigned int max_cnt) {
raise(SIGSTOP);
__afl_fuzz_len = *__afl_fuzz_len_shmem;
__afl_area_ptr[0] = 1;
memset(__afl_prev_loc, 0, NGRAM_SIZE_MAX * sizeof(PREV_LOC_T));

2
src/afl-fuzz-init.c
View File

@ -1949,7 +1949,6 @@ static void handle_skipreq(int sig) {
}
/* Setup shared map for fuzzing with input via sharedmem */
void setup_testcase_shmem(afl_state_t *afl) {
@ -1978,7 +1977,6 @@ void setup_testcase_shmem(afl_state_t *afl) {
}
/* Do a PATH search and find target binary to see that it exists and
isn't a shell script - a common and painful mistake. We also check for
a valid ELF header and for evidence of AFL instrumentation. */

6
src/afl-fuzz.c
View File

@ -1179,11 +1179,7 @@ int main(int argc, char **argv_orig, char **envp) {
check_binary(afl, argv[optind]);
if (afl->shmem_testcase_mode) {
setup_testcase_shmem(afl);
}
if (afl->shmem_testcase_mode) { setup_testcase_shmem(afl); }
afl->start_time = get_cur_time();