* Pure Python (3.6) port of benchmark.sh as benchmark.py, no other changes
* Test standard and persistent modes separately
* Add support for multi-core benchmarking
* Save the results to a json file
* Allow config of all experiment params, average across runs
* Add start_time_of_run and total_execs_per_sec, cleanup for PR
* benchmark: cleanup, add results, add a data exploration notebook
* benchmark: add a README, lower default runs from 5 to 3
* benchmark: notebook wording tweaks
* copy 'detect_leaks=0' from ASAN to LSAN
fix for issue #1733, set "detect_leaks=0" when ASAN_OPTIONS contains it and LSAN_OPTIONS are not set.
* fix of fix: make sure ASAN_OPTIONS and LSAN_OPTIONS agree on leak detection
* fix lsan fix
* clang-format 16->17
* Add missing initialisation for havoc_queued during the custom mutator's stage.
* fix dictionary and cmin
* Use direct call to write to OpenBSD
The linker on OpenBSD emits a warning when linking this file:
warning: syscall() may go away, please rewrite code to use direct calls
* Fix possible doc inconsistency for custom mutator's queue_get function.
* update todos
* benchmark: Add support for COMPARISON file
* benchmark: show the number of cores used in COMPARISON
* benchmark: lower minimum Python version to 3.8
* benchmark: use afl's execs/s; increase CPU model width
* benchmark: disallow duplicate entries for the same CPU in COMPARISON
* Update benchmark.py
* fix inf in stats
* Fix benchmark.py
* missing closing parenthesis
* Update benchmark.py
* benchmark: remove self-calculation of execs/sec
* benchmark: update COMPARISON
* benchmark: Update Jupyter notebook and results file.
* benchmark: rename afl_execs_per_sec to execs_per_sec
* benchmark: update README
* update
* add benchmark
* nits
* add benchmarks
* Update unicornafl ref
* Pass correct Nyx ID when creating a Nyx runner
* Fix typo in docker pull command, add exampe to mount current dir as volume (#1914)
* mini fix
* add custom_post_run.c
* update afl-fuzz-run
* update python module
* format code
* update
* merge function
* changes
* code format
* improve cmplog
* nit
* nit
* fix
* fix
* Stop hardcoding the path /usr/local/lib/afl in afl-ld-lto.c and respect the configured PREFIX.
* Add benchmark for Raspberry Pi 5
* ryzen 5950 benchmark
* add missing raspery5
* comparison -> comparison.md
* removing options "-Wl,-rpath" "LLVM_LIBDIR" when using gcc
* fixing -Wl,-rpath=<LLVM_LIBDIR>
* nits
* fix
* afl-cc fixes
* nit
* add n_fuzz to ignore_timeouts
* fix
* Fix#1927
* in-depth blog post
* add AFL_FUZZER_LOOPCOUNT
* AFL_FUZZER_LOOPCOUNT
* fix 2 mutation bugs
* v4.09c release
* v4.10a init
* switch to explore powerschedule as default
* fix MUT_INSERTASCIINUM
* fix MUT_STRATEGY_ARRAY_SIZE
* fix bad fix for MUT_STRATEGY_ARRAY_SIZE
* remove afl-network-client on uninstall
* update nyx
* Improve binary-only related docs
* llvm 18 build fixes.
* code format
* Fix custom_send link
Add a leading '/' to walk in the repo root instead of current dir.
* Use ../ instead
* initial simple injection detection support
* inject docs
* fix for issue #1916, iLLVM crash in split-floatingpoint-compares
* LLVM 17 bug workaround
* finish injection implementation
* remove tmp todo
* update changelog
* forgot to add the injection pass
* Output afl-clang-fast stuffs only if necessary (#1912)
* afl-cc header
* afl-cc common declarations
- Add afl-cc-state.c
- Strip includes, find_object, debug/be_quiet/have_*/callname setting from afl-cc.c
- Use debugf_args in main
- Modify execvp stuffs to fit new aflcc struct
* afl-cc show usage
* afl-cc mode selecting
1. compiler_mode by callname in argv[0]
2. compiler_mode by env "AFL_CC_COMPILER"
3. compiler_mode/instrument_mode by command line options "--afl-..."
4. instrument_mode/compiler_mode by various env vars including "AFL_LLVM_INSTRUMENT"
5. final checking steps
6. print "... - mode: %s-%s\n"
7. determine real argv[0] according to compiler_mode
* afl-cc macro defs
* afl-cc linking behaviors
* afl-cc fsanitize behaviors
* afl-cc misc
* afl-cc body update
* afl-cc all-in-one
formated with custom-format.py
* nits
---------
Co-authored-by: vanhauser-thc <vh@thc.org>
* changelog
* update grammar mutator
* lto llvm 12+
* docs(custom_mutators): fix missing ':' (#1953)
* Fix broken LTO mode and response file support (#1948)
* Strip `-Wl,-no-undefined` during compilation (#1952)
Make the compiler wrapper stripping `-Wl,-no-undefined` in addition to `-Wl,--no-undefined`.
Both versions of the flag are accepted by clang and, therefore, used by building systems in the wild (e.g., samba will not build without this fix).
* Remove dead code in write_to_testcase (#1955)
The custom_mutators_count check in if case is duplicate with if condition.
The else case is custom_mutators_count == 0, neither custom_mutator_list iteration nor sent check needed.
Signed-off-by: Xeonacid <h.dwwwwww@gmail.com>
* update qemuafl
* WIP: Add ability to generate drcov trace using QEMU backend (#1956)
* Document new drcov QEMU plugin
* Add link to lightkeeper for QEMU drcov file loading
---------
Co-authored-by: Jean-Romain Garnier <jean-romain.garnier@airbus.com>
* code format
* changelog
* sleep on uid != 0 afl-system-config
* fix segv about skip_next, warn on unsupported cases of linking options (#1958)
* todos
* ensure afl-cc only allows available compiler modes
* update grammar mutator
* disable aslr on apple
* fix for arm64
* help selective instrumentation
* typos
* macos
* add compiler test script
* apple fixes
---------
Signed-off-by: Xeonacid <h.dwwwwww@gmail.com>
Co-authored-by: Chris Ball <chris@printf.net>
Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com>
Co-authored-by: hexcoder- <heiko@hexco.de>
Co-authored-by: Manuel Carrasco <m.carrasco@imperial.ac.uk>
Co-authored-by: Jasper Lievisse Adriaanse <j@jasper.la>
Co-authored-by: ifyGecko <26214995+ifyGecko@users.noreply.github.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Christian Holler (:decoder) <choller@mozilla.com>
Co-authored-by: Carlo Maragno <ste.maragno@gmail.com>
Co-authored-by: yangzao <yangzaocn@outlook.com>
Co-authored-by: Romain Geissler <romain.geissler@amadeus.com>
Co-authored-by: Jakob Lell <jakob@jakoblell.com>
Co-authored-by: vincenzo MEZZELA <vincenzo.mezzela@amadeus.com>
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
Co-authored-by: Bet4 <0xbet4@gmail.com>
Co-authored-by: David Carlier <devnexen@gmail.com>
Co-authored-by: Xeonacid <h.dwwwwww@gmail.com>
Co-authored-by: Sonic <50692172+SonicStark@users.noreply.github.com>
Co-authored-by: Nils Bars <nils.bars@rub.de>
Co-authored-by: Jean-Romain Garnier <7504819+JRomainG@users.noreply.github.com>
Co-authored-by: Jean-Romain Garnier <jean-romain.garnier@airbus.com>
Might as well recommend installing 14, as that's newer, and what's used
in Docker.
Also remove outdated Dockerfile versions, likely easier to remove
versions here entirely, and anyone that wants to see what version is
used, can look in the Dockerfile.
* afl++ -> AFL++
* update readme
* more debug
* slightly different weighting algo (#1719)
* better seed selection
* slightly different weighting calculation
* remove unnecessary memset
* Add "Hangs saved" to afl-whatsup (#1717)
The hangs could show long or infinite loops. This is important.
Co-authored-by: van Hauser <vh@thc.org>
* nits
* afl-showmap: Start a only a single fork server (#1718)
A forkserver is started by afl_fsrv_get_mapsize() when dynamically
finding the map size. When an input directory option is specified a
second fork server was also started. This commit re-arranges the inits
for several forkserver struct members so that we can re-use the server
started by the get_mapsize() call when not in coresight/qemu/unicorn
modes and just start the server otherwise.
* Source Code Coverage support for Nyx (Part 1) (#1720)
* Additional source code reformatting in afl-compiler-rt
* Add source code coverage support to afl-compiler-rt (for use with Nyx)
* doc, code format
* llvm 17 changes
* more llvm 17
* add frida mode tutorial
* fix effector map
* docs
* Should memset EFF_ALEN(len) of eff_map (#1722)
* fix reallocs
* fix afl-system-config for macos
* afl-fuzz.c: Document -i - in --help (#1725)
afl-fuzz.c: Document `-i -` in `--help`, to write that `-i` can be passed '-' to resume the prior fuzzing job. Also reference AFL_AUTORESUME so users know they can set that parameter to sidestep the issue entirely.
* tritondse custom mutator attempt
* tritondse fixes
* update libnyx (#1727)
* GNUmakefile: Update LLVM instructions (#1728)
Update LLVM instructions, because versions higher than 14 are supported and to be explicit that LLD is also required
* disable macos in the ci, works fine for me
* fix makefile
* better tritondse support
* next steps for tritondse
* qemuafl: Persistent mode for PPC32 targets
* update qemu_mode
* afl-clang-lto incomptable with -flto=thin
* add @responsefile support for afl-cc
---------
Co-authored-by: fxlb <devel.fx.lebail@orange.fr>
Co-authored-by: Nick Potenski <nick.potenski@garmin.com>
Co-authored-by: Christian Holler (:decoder) <choller@mozilla.com>
Co-authored-by: lazymio <mio@lazym.io>
Co-authored-by: Moshe Kaplan <me@moshekaplan.com>
Co-authored-by: Sergej Schumilo <sergej@schumilo.de>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
* Fix afl-cc to work correctly by default on OSX using xcode
- CLANG_ENV_VAR must be set for afl-as to work
- Use clang mode by default if no specific compiler selected
* Add OSX-specific documentation for configuring shared memory
When we started using AFL, it did not have an integrated GCC plugin.
There was one proposed by Austin Seipp, but for various reasons we
ended up using some of its infrastructure (runtime and wrapper), but
writing the GCC plugin proper from scratch.
With AFL++'s renewed interest in a GCC plugin, we rebased ours, with
some features that are or were missing in the one that was integrated:
* efficient, fully-functional inline and out-of-line instrumentation
Inline instrumentation was work in progress in the original plugin.
Controlled by AFL_GCC_OUT_OF_LINE.
* reproducible instrumentation
Obey -frandom-seed for pseudorandom number generation.
* licensing clarity and strict compliance
GPLv3+ for the plugin, that uses GCC internals; add a copy of the
license, as required.
* allow/deny list support
Copied and adjusted from the LLVM plugin implementation.
* neverZero support
Not as compact as the asm-wrapper version, but likely more efficient.
Both are quite thread-unsafe, with different caveats.
Controlled with AFL_GCC_SKIP_NEVERZERO.
