64 Commits

Author SHA1 Message Date
fff7f1c558 Dev (#1962)
* Pure Python (3.6) port of benchmark.sh as benchmark.py, no other changes

* Test standard and persistent modes separately

* Add support for multi-core benchmarking

* Save the results to a json file

* Allow config of all experiment params, average across runs

* Add start_time_of_run and total_execs_per_sec, cleanup for PR

* benchmark: cleanup, add results, add a data exploration notebook

* benchmark: add a README, lower default runs from 5 to 3

* benchmark: notebook wording tweaks

* copy 'detect_leaks=0' from ASAN to LSAN

fix for issue #1733, set "detect_leaks=0" when ASAN_OPTIONS contains it and LSAN_OPTIONS are not set.

* fix of fix: make sure ASAN_OPTIONS and LSAN_OPTIONS agree on leak detection

* fix lsan fix

* clang-format 16->17

* Add missing initialisation for havoc_queued during the custom mutator's stage.

* fix dictionary and cmin

* Use direct call to write to OpenBSD

The linker on OpenBSD emits a warning when linking this file:
warning: syscall() may go away, please rewrite code to use direct calls

* Fix possible doc inconsistency for custom mutator's queue_get function.

* update todos

* benchmark: Add support for COMPARISON file

* benchmark: show the number of cores used in COMPARISON

* benchmark: lower minimum Python version to 3.8

* benchmark: use afl's execs/s; increase CPU model width

* benchmark: disallow duplicate entries for the same CPU in COMPARISON

* Update benchmark.py

* fix inf in stats

* Fix benchmark.py

* missing closing parenthesis

* Update benchmark.py

* benchmark: remove self-calculation of execs/sec

* benchmark: update COMPARISON

* benchmark: Update Jupyter notebook and results file.

* benchmark: rename afl_execs_per_sec to execs_per_sec

* benchmark: update README

* update

* add benchmark

* nits

* add benchmarks

* Update unicornafl ref

* Pass correct Nyx ID when creating a Nyx runner

* Fix typo in docker pull command, add exampe to mount current dir as volume (#1914)

* mini fix

* add custom_post_run.c

* update afl-fuzz-run

* update python module

* format code

* update

* merge function

* changes

* code format

* improve cmplog

* nit

* nit

* fix

* fix

* Stop hardcoding the path /usr/local/lib/afl in afl-ld-lto.c and respect the configured PREFIX.

* Add benchmark for Raspberry Pi 5

* ryzen 5950 benchmark

* add missing raspery5

* comparison -> comparison.md

* removing options "-Wl,-rpath" "LLVM_LIBDIR" when using gcc

* fixing -Wl,-rpath=<LLVM_LIBDIR>

* nits

* fix

* afl-cc fixes

* nit

* add n_fuzz to ignore_timeouts

* fix

* Fix #1927

* in-depth blog post

* add AFL_FUZZER_LOOPCOUNT

* AFL_FUZZER_LOOPCOUNT

* fix 2 mutation bugs

* v4.09c release

* v4.10a init

* switch to explore powerschedule as default

* fix MUT_INSERTASCIINUM

* fix MUT_STRATEGY_ARRAY_SIZE

* fix bad fix for MUT_STRATEGY_ARRAY_SIZE

* remove afl-network-client on uninstall

* update nyx

* Improve binary-only related docs

* llvm 18 build fixes.

* code format

* Fix custom_send link

Add a leading '/' to walk in the repo root instead of current dir.

* Use ../ instead

* initial simple injection detection support

* inject docs

* fix for issue #1916, iLLVM crash in split-floatingpoint-compares

* LLVM 17 bug workaround

* finish injection implementation

* remove tmp todo

* update changelog

* forgot to add the injection pass

* Output afl-clang-fast stuffs only if necessary (#1912)

* afl-cc header

* afl-cc common declarations

 - Add afl-cc-state.c
 - Strip includes, find_object, debug/be_quiet/have_*/callname setting from afl-cc.c
 - Use debugf_args in main
 - Modify execvp stuffs to fit new aflcc struct

* afl-cc show usage

* afl-cc mode selecting

1. compiler_mode by callname in argv[0]
2. compiler_mode by env "AFL_CC_COMPILER"
3. compiler_mode/instrument_mode by command line options "--afl-..."
4. instrument_mode/compiler_mode by various env vars including "AFL_LLVM_INSTRUMENT"
5. final checking steps
6. print "... - mode: %s-%s\n"
7. determine real argv[0] according to compiler_mode

* afl-cc macro defs

* afl-cc linking behaviors

* afl-cc fsanitize behaviors

* afl-cc misc

* afl-cc body update

* afl-cc all-in-one

formated with custom-format.py

* nits

---------

Co-authored-by: vanhauser-thc <vh@thc.org>

* changelog

* update grammar mutator

* lto llvm 12+

* docs(custom_mutators): fix missing ':' (#1953)

* Fix broken LTO mode and response file support (#1948)

* Strip `-Wl,-no-undefined` during compilation (#1952)

Make the compiler wrapper stripping `-Wl,-no-undefined` in addition to `-Wl,--no-undefined`.
Both versions of the flag are accepted by clang and, therefore, used by building systems in the wild (e.g., samba will not build without this fix).

* Remove dead code in write_to_testcase (#1955)

The custom_mutators_count check in if case is duplicate with if condition.
The else case is custom_mutators_count == 0, neither custom_mutator_list iteration nor sent check needed.

Signed-off-by: Xeonacid <h.dwwwwww@gmail.com>

* update qemuafl

* WIP: Add ability to generate drcov trace using QEMU backend (#1956)

* Document new drcov QEMU plugin

* Add link to lightkeeper for QEMU drcov file loading

---------

Co-authored-by: Jean-Romain Garnier <jean-romain.garnier@airbus.com>

* code format

* changelog

* sleep on uid != 0 afl-system-config

* fix segv about skip_next, warn on unsupported cases of linking options (#1958)

* todos

* ensure afl-cc only allows available compiler modes

* update grammar mutator

* disable aslr on apple

* fix for arm64

* help selective instrumentation

* typos

* macos

* add compiler test script

* apple fixes

---------

Signed-off-by: Xeonacid <h.dwwwwww@gmail.com>
Co-authored-by: Chris Ball <chris@printf.net>
Co-authored-by: hexcoder <hexcoder-@users.noreply.github.com>
Co-authored-by: hexcoder- <heiko@hexco.de>
Co-authored-by: Manuel Carrasco <m.carrasco@imperial.ac.uk>
Co-authored-by: Jasper Lievisse Adriaanse <j@jasper.la>
Co-authored-by: ifyGecko <26214995+ifyGecko@users.noreply.github.com>
Co-authored-by: Dominik Maier <domenukk@gmail.com>
Co-authored-by: Christian Holler (:decoder) <choller@mozilla.com>
Co-authored-by: Carlo Maragno <ste.maragno@gmail.com>
Co-authored-by: yangzao <yangzaocn@outlook.com>
Co-authored-by: Romain Geissler <romain.geissler@amadeus.com>
Co-authored-by: Jakob Lell <jakob@jakoblell.com>
Co-authored-by: vincenzo MEZZELA <vincenzo.mezzela@amadeus.com>
Co-authored-by: Andrea Fioraldi <andreafioraldi@gmail.com>
Co-authored-by: Bet4 <0xbet4@gmail.com>
Co-authored-by: David Carlier <devnexen@gmail.com>
Co-authored-by: Xeonacid <h.dwwwwww@gmail.com>
Co-authored-by: Sonic <50692172+SonicStark@users.noreply.github.com>
Co-authored-by: Nils Bars <nils.bars@rub.de>
Co-authored-by: Jean-Romain Garnier <7504819+JRomainG@users.noreply.github.com>
Co-authored-by: Jean-Romain Garnier <jean-romain.garnier@airbus.com>
2024-01-20 10:19:46 +00:00
b547a6ab0d nits 2023-07-10 17:43:21 +02:00
cac713ec30 llvm 15 2023-06-24 15:48:23 +02:00
2b500ce97e llvm 15 fixes 2023-06-01 12:27:34 +02:00
029e039cbc code format 2023-05-21 17:49:14 +02:00
vH
f567a89dae more llvm 17 2023-04-28 15:39:01 +02:00
vH
00c86b7cb1 llvm 17 changes 2023-04-28 14:56:52 +02:00
3e84d6a2ae afl++ -> AFL++ 2023-04-27 11:49:00 +02:00
531380d6ab llvm-lto: allow skipping initialization 2023-04-24 17:55:58 +02:00
6cc8d607fb remove -z option, use -p mmopt instead 2023-04-13 11:44:39 +02:00
824385f52c make llvm 17 work 2023-04-12 14:03:29 +02:00
a0818c4fce LLVM instrumentation disable build warning.
Since clang 16 is the version for Ubuntu 23 04/Fedora 38 and is easy enough to fix..
2023-04-10 12:38:26 +01:00
be96253f52 nits 2023-03-31 11:02:27 +02:00
c594a58583 Stop using removed pipeline extensions
LLVM commit 7ae6838defb21737963b1dd8ff9de7e87052c74f removed the
following extensions:

- PassManagerBuilder::EP_OptimizerLast
- PassManagerBuilder::EP_EnabledOnOptLevel0
- PassManagerBuilder::EP_FullLinkTimeOptimizationLast
2023-03-28 12:15:20 -03:00
80eabd6e8a AFL_LLVM_DICT2FILE_NO_MAIN support 2023-02-13 11:34:14 +01:00
b27a4a3689 Fix loading and registeration of LTO pass for new pass manager 2022-09-14 15:54:29 +02:00
5452d4652b Fix naming clash between AFL's sancov LTO pass and upstream sancov pass
There was some confusion here due to name reuse. The
initializeModuleSanitizerCoverageLegacyPassPass() function was
actually calling the initialization of the upstream pass (which
no longer supports legacy PM and thus fails to build on LLVM 15).
The intention was to call the LTO initialization here.

Fix this by renaming symbols to avoid collision.
2022-09-14 11:36:05 +02:00
b847e0f414 clang format 14 2022-07-12 09:04:54 +02:00
fc520a2bde fix 2022-07-04 21:57:42 +02:00
24458ae285 nits 2022-07-04 18:13:21 +02:00
fa2b040476 fix LTO with cmplog and laf 2022-03-18 15:00:24 +01:00
05119990b6 LLVM 14 fixes 2022-02-22 11:13:00 +01:00
c5117b42ca fix iselect instrumentation 2022-01-17 20:15:27 +01:00
75ac9c013c better instrumentlist filename detection 2021-12-14 10:15:09 +01:00
db360332c4 make llvm 14-dev working. again. 2021-12-09 14:33:56 +01:00
fc094dee13 change dlopen solution 2021-12-03 11:35:30 +01:00
22827e8070 unify LLVM_VERSION_... usage 2021-12-01 11:38:55 +01:00
8c4435e7ef fix for llvm < 11 2021-11-23 21:08:28 +01:00
90d7931af6 fixes 2021-11-23 19:37:27 +01:00
11f89ab785 do not add zero byte on string compares with len 2021-11-23 19:34:21 +01:00
6ce3d7fede add AFL_USE_TSAN 2021-11-04 15:53:17 +01:00
7a7630ae91 support llvm >= 11 2021-11-03 13:18:02 +01:00
ccded9fc5c vectorized coverage only possible for llvm 14 :( 2021-11-03 12:49:54 +01:00
ce41f881a0 nosan 2021-11-02 19:53:15 +01:00
682e1d835c select support for LTO 2021-11-02 19:20:18 +01:00
45b8e05793 fix off by one bug of PCGUARD instrumentation
fix bug #1120
2021-10-30 22:27:49 +08:00
bb8a4d71da format and remove warning 2021-10-18 20:53:54 +02:00
65afe5addc LLVM coverage making it more C++ too. 2021-10-09 18:31:12 +01:00
580401591f LLVM passes making slightly more C++ 2021-10-09 17:23:32 +01:00
c3fbf5dca3 add more string functions for dictionary features 2021-07-30 08:33:18 +02:00
9ec63d3f17 fix frida, fix dictionary generation to honor AFL_LLVM_{ALLOW/DENY}LIST 2021-07-14 14:31:27 +02:00
f1bcd378a2 fix failures for some sized string instrumentations 2021-07-07 12:19:05 +02:00
96c802fce8 fix stupid typos 2021-06-01 18:41:38 +02:00
97225f1f6f adapt to incompatible LLVM 13 API 2021-06-01 18:36:28 +02:00
7665354405 threadsafe doc fixes, code format 2021-06-01 10:13:16 +02:00
97a1f89881 Merge branch 'dev' into going_atomic 2021-05-31 19:18:24 +02:00
b246de7891 add support for AFL_LLVM_THREADSAFE_INST to other LLVM passes 2021-05-30 15:25:10 +02:00
c9d066038f fix PCGUARD, build aflpp_driver with fPIC 2021-04-30 10:27:43 +02:00
ec49c7fbf5 Change other LLVM modes to atomic increments 2021-04-17 22:32:33 +02:00
8868648f76 fix LTO selective instrumentation 2021-03-22 10:45:39 +01:00