132 Commits

Author SHA1 Message Date
fff7f1c558 Dev (#1962)
* Pure Python (3.6) port of benchmark.sh as benchmark.py, no other changes

* Test standard and persistent modes separately

* Add support for multi-core benchmarking

* Save the results to a json file

* Allow config of all experiment params, average across runs

* Add start_time_of_run and total_execs_per_sec, cleanup for PR

* benchmark: cleanup, add results, add a data exploration notebook

* benchmark: add a README, lower default runs from 5 to 3

* benchmark: notebook wording tweaks

* copy 'detect_leaks=0' from ASAN to LSAN

fix for issue #1733, set "detect_leaks=0" when ASAN_OPTIONS contains it and LSAN_OPTIONS are not set.

* fix of fix: make sure ASAN_OPTIONS and LSAN_OPTIONS agree on leak detection

* fix lsan fix

* clang-format 16->17

* Add missing initialisation for havoc_queued during the custom mutator's stage.

* fix dictionary and cmin

* Use direct call to write to OpenBSD

The linker on OpenBSD emits a warning when linking this file:
warning: syscall() may go away, please rewrite code to use direct calls

* Fix possible doc inconsistency for custom mutator's queue_get function.

* update todos

* benchmark: Add support for COMPARISON file

* benchmark: show the number of cores used in COMPARISON

* benchmark: lower minimum Python version to 3.8

* benchmark: use afl's execs/s; increase CPU model width

* benchmark: disallow duplicate entries for the same CPU in COMPARISON

* Update benchmark.py

* fix inf in stats

* Fix benchmark.py

* missing closing parenthesis

* Update benchmark.py

* benchmark: remove self-calculation of execs/sec

* benchmark: update COMPARISON

* benchmark: Update Jupyter notebook and results file.

* benchmark: rename afl_execs_per_sec to execs_per_sec

* benchmark: update README

* update

* add benchmark

* nits

* add benchmarks

* Update unicornafl ref

* Pass correct Nyx ID when creating a Nyx runner

* Fix typo in docker pull command, add exampe to mount current dir as volume (#1914)

* mini fix

* add custom_post_run.c

* update afl-fuzz-run

* update python module

* format code

* update

* merge function

* changes

* code format

* improve cmplog

* nit

* nit

* fix

* fix

* Stop hardcoding the path /usr/local/lib/afl in afl-ld-lto.c and respect the configured PREFIX.

* Add benchmark for Raspberry Pi 5

* ryzen 5950 benchmark

* add missing raspery5

* comparison -> comparison.md

* removing options "-Wl,-rpath" "LLVM_LIBDIR" when using gcc

* fixing -Wl,-rpath=<LLVM_LIBDIR>

* nits

* fix

* afl-cc fixes

* nit

* add n_fuzz to ignore_timeouts

* fix

* Fix #1927

* in-depth blog post

* add AFL_FUZZER_LOOPCOUNT

* AFL_FUZZER_LOOPCOUNT

* fix 2 mutation bugs

* v4.09c release

* v4.10a init

* switch to explore powerschedule as default

* fix MUT_INSERTASCIINUM

* fix MUT_STRATEGY_ARRAY_SIZE

* fix bad fix for MUT_STRATEGY_ARRAY_SIZE

* remove afl-network-client on uninstall

* update nyx

* Improve binary-only related docs

* llvm 18 build fixes.

* code format

* Fix custom_send link

Add a leading '/' to walk in the repo root instead of current dir.

* Use ../ instead

* initial simple injection detection support

* inject docs

* fix for issue #1916, iLLVM crash in split-floatingpoint-compares

* LLVM 17 bug workaround

* finish injection implementation

* remove tmp todo

* update changelog

* forgot to add the injection pass

* Output afl-clang-fast stuffs only if necessary (#1912)

* afl-cc header

* afl-cc common declarations

 - Add afl-cc-state.c
 - Strip includes, find_object, debug/be_quiet/have_*/callname setting from afl-cc.c
 - Use debugf_args in main
 - Modify execvp stuffs to fit new aflcc struct

* afl-cc show usage

* afl-cc mode selecting

1. compiler_mode by callname in argv[0]
2. compiler_mode by env "AFL_CC_COMPILER"
3. compiler_mode/instrument_mode by command line options "--afl-..."
4. instrument_mode/compiler_mode by various env vars including "AFL_LLVM_INSTRUMENT"
5. final checking steps
6. print "... - mode: %s-%s\n"
7. determine real argv[0] according to compiler_mode

* afl-cc macro defs

* afl-cc linking behaviors

* afl-cc fsanitize behaviors

* afl-cc misc

* afl-cc body update

* afl-cc all-in-one

formated with custom-format.py

* nits

---------

Co-authored-by: vanhauser-thc <vh@thc.org>

* changelog

* update grammar mutator

* lto llvm 12+

* docs(custom_mutators): fix missing ':' (#1953)

* Fix broken LTO mode and response file support (#1948)

* Strip `-Wl,-no-undefined` during compilation (#1952)

Make the compiler wrapper stripping `-Wl,-no-undefined` in addition to `-Wl,--no-undefined`.
Both versions of the flag are accepted by clang and, therefore, used by building systems in the wild (e.g., samba will not build without this fix).

* Remove dead code in write_to_testcase (#1955)

The custom_mutators_count check in if case is duplicate with if condition.
The else case is custom_mutators_count == 0, neither custom_mutator_list iteration nor sent check needed.

Signed-off-by: Xeonacid <h.dwwwwww@gmail.com>

* update qemuafl

* WIP: Add ability to generate drcov trace using QEMU backend (#1956)

* Document new drcov QEMU plugin

* Add link to lightkeeper for QEMU drcov file loading

---------

Co-authored-by: Jean-Romain Garnier <jean-romain.garnier@airbus.com>

* code format

* changelog

* sleep on uid != 0 afl-system-config

* fix segv about skip_next, warn on unsupported cases of linking options (#1958)

* todos

* ensure afl-cc only allows available compiler modes

* update grammar mutator

* disable aslr on apple

* fix for arm64

* help selective instrumentation

* typos

* macos

* add compiler test script

* apple fixes

---------

Signed-off-by: Xeonacid <h.dwwwwww@gmail.com>
Co-authored-by: Chris Ball <chris@printf.net>
Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com>
Co-authored-by: hexcoder- <heiko@hexco.de>
Co-authored-by: Manuel Carrasco <m.carrasco@imperial.ac.uk>
Co-authored-by: Jasper Lievisse Adriaanse <j@jasper.la>
Co-authored-by: ifyGecko <26214995+ifyGecko@users.noreply.github.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Christian Holler (:decoder) <choller@mozilla.com>
Co-authored-by: Carlo Maragno <ste.maragno@gmail.com>
Co-authored-by: yangzao <yangzaocn@outlook.com>
Co-authored-by: Romain Geissler <romain.geissler@amadeus.com>
Co-authored-by: Jakob Lell <jakob@jakoblell.com>
Co-authored-by: vincenzo MEZZELA <vincenzo.mezzela@amadeus.com>
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
Co-authored-by: Bet4 <0xbet4@gmail.com>
Co-authored-by: David Carlier <devnexen@gmail.com>
Co-authored-by: Xeonacid <h.dwwwwww@gmail.com>
Co-authored-by: Sonic <50692172+SonicStark@users.noreply.github.com>
Co-authored-by: Nils Bars <nils.bars@rub.de>
Co-authored-by: Jean-Romain Garnier <7504819+JRomainG@users.noreply.github.com>
Co-authored-by: Jean-Romain Garnier <jean-romain.garnier@airbus.com>
2024-01-20 10:19:46 +00:00
cf458a7d25 Add an env to afl-clang-fast to disable setting rpath if LLVM path isn't
recognized
2023-10-23 21:57:21 -04:00
48bff70cdd add AFL_NO_CFG_FUZZING to env list 2023-10-06 18:53:44 +02:00
549e5dd926 AFL_IGNORE_SEED_PROBLEMS 2023-08-23 18:02:33 +02:00
8823f22a9c add AFL_FINAL_SYNC 2023-08-11 11:22:18 +02:00
b4bd33961c Merge pull request #1821 from junwha0511/crashing-seeds-as-new-crash
Implement an option for treating crashing seeds as new crash
2023-08-09 14:39:25 +00:00
247d8539fe Add AFL_NYX_LOG to redirect NYX hprintf messages to a file. 2023-08-04 15:39:57 -04:00
08a6fd7c29 update the old nyx env var naming scheme
(to have a more consistent naming overall)
2023-08-04 12:13:06 +02:00
8f31086a7f make nyx aux buffer size configurable 2023-08-03 14:40:10 +02:00
1429c9724e Add option for treating crashing input as new crash
Signed-off-by: Junwha Hong <qbit@unist.ac.kr>
2023-08-02 19:07:38 +09:00
70da0c2e40 better tritondse support 2023-05-10 16:09:18 +02:00
21865c6224 rename env to AFL_IGNORE_PROBLEMS_COVERAGE 2023-04-25 16:47:37 +02:00
7b33148b75 add AFL_LLVM_LTO_SKIPINIT to envs.h 2023-04-25 08:23:27 +02:00
e99d4ba976 Merge pull request #2 from AFLplusplus/dev
Dev
2023-04-21 16:48:47 +02:00
30495e6bfe frida mode: add dynamic loaded code exclusion
Add the AFL_FRIDA_INST_NO_DYNAMIC_LOAD environment variable and its
associated JS function setInstrumentNoDynamicLoad to prevent the
instrumentation of late dynamic loaded code.

Resolve #1708
2023-04-21 12:00:56 +02:00
7101ffa1ae Merge remote-tracking branch 'origin/dev' into atnwalk
# Conflicts:
#	include/afl-fuzz.h
#	src/afl-fuzz-run.c
2023-04-21 11:31:22 +02:00
9ab902402c fixed code clones in atnwalk.c, introduced new environment variable AFL_POST_PROCESS_KEEP_ORIGINAL in AFL++ to integrate atnwalk without re-compiling afl-fuzz 2023-04-17 17:09:48 +02:00
e9e440d7f3 Fixed according to PR comment, moved cli flag to an env variable 2023-03-05 20:25:39 +02:00
c33f8751e3 Merge pull request #1651 from AFLplusplus/dev
Dev
2023-02-21 01:11:00 +01:00
668f5e1fa9 debug output 2023-02-15 09:32:32 +01:00
80eabd6e8a AFL_LLVM_DICT2FILE_NO_MAIN support 2023-02-13 11:34:14 +01:00
0d55feb11d Add support for disabling branch suppression 2023-01-31 07:00:02 +00:00
8fe5e29104 ignore timeout env option 2023-01-18 14:56:26 +01:00
85b44bb730 add cmplog envs 2022-12-12 18:35:05 +01:00
6553e24b22 add env 2022-10-30 15:26:17 +01:00
05e0825d66 changelog update 2022-10-24 20:06:57 +02:00
7512316b46 Add AFL_FORK_SERVER_KILL_SIGNAL environment variable.
The AFL_FORK_SERVER_KILL_SIGNAL variable allows to configure the signal
used to kill the fork server on termination.
2022-10-21 12:47:00 +02:00
3200e6515b add AFL_NO_STARTUP_CALIBRATION feature 2022-08-14 12:30:23 +02:00
38fba71546 add env var 2022-08-09 10:49:05 +02:00
3562de440e Changes to add option for absolute coverage data 2022-08-04 18:46:29 +01:00
4fdd64d6d6 Added framework for logging register contents at the end of each basic block 2022-07-29 19:33:31 +01:00
4990823840 formatting 2022-06-17 21:08:37 +02:00
3d1a57deed feat: allow to skip readme creation on crash 2022-06-17 21:03:46 +02:00
c96238d85f Add AFL_SYNC_TIME variable for synchronization time tuning (#1425)
* Add AFL_SYNC_TIME variable for synchronization time tuning

* Documentation for AFL_SYNC_TIME variable
2022-05-27 12:52:31 +02:00
e9288bcfad add AFL_KEEP_TIMEOUTS 2022-04-08 22:44:10 +02:00
ef5543680a Merge pull request #1374 from CarloMara/stable
Add new mode to AFLplusplus
2022-04-03 09:31:23 +02:00
657e4cc812 Fix layout 2022-04-01 14:56:27 +02:00
852c036cae Add global caching of block translation to instrumentation 2022-02-18 17:39:21 +00:00
5f45f380c3 Changes to default CMOV instrumentation to off 2022-02-18 08:10:19 +00:00
cb1256499f Added instrumentation for CMOV instructions 2022-02-18 08:01:34 +00:00
056ebbff15 add AFL_EARLY_FORKSERVER support 2022-02-08 20:36:06 +01:00
fa3c0d8a37 change -y to -g/-G and add env var alternatives 2022-02-05 10:36:37 +01:00
d59a76261d Improvements to debug output 2021-12-20 18:14:57 +00:00
b3a0ecfd48 allow ignore dlopen issues 2021-12-17 09:42:05 +01:00
e1d3fe30de Changes to allow configuration of stalker adjacent blocks 2021-11-15 17:14:04 +00:00
93b8f17242 Add support for option to disable backpatch 2021-11-08 18:17:09 +00:00
3483715789 env 2021-11-07 14:10:02 +01:00
6ce3d7fede add AFL_USE_TSAN 2021-11-04 15:53:17 +01:00
f14b3bd9de Fix issues with Yama restrictions in FRIDA mode 2021-10-26 18:48:13 +01:00
e5f5d5886a Add unstable coverage support 2021-08-26 18:06:41 +01:00