upd

.custom-format.py

@@ -21,15 +21,12 @@ import os
 # import re # TODO: for future use
 import shutil
 import importlib.metadata
-import hashlib
 
 # string_re = re.compile('(\\"(\\\\.|[^"\\\\])*\\")') # TODO: for future use
 
-CURRENT_LLVM = os.getenv('LLVM_VERSION', 18)
+CURRENT_LLVM = os.getenv('LLVM_VERSION', 17)
 CLANG_FORMAT_BIN = os.getenv("CLANG_FORMAT_BIN", "")
 
-FORMAT_CACHE_DIR = '.format-cache'
-os.makedirs(FORMAT_CACHE_DIR, exist_ok=True)
 
 def check_clang_format_pip_version():
     """
@@ -72,8 +69,6 @@ to install via pip.")
 if CLANG_FORMAT_PIP:
     CLANG_FORMAT_BIN = shutil.which("clang-format")
 
-CLANG_FORMAT_VERSION = subprocess.check_output([CLANG_FORMAT_BIN, '--version'])
-
 COLUMN_LIMIT = 80
 for line in fmt.split("\n"):
     line = line.split(":")
@@ -91,10 +86,9 @@ def custom_format(filename):
     out = ""
 
     for line in src.split("\n"):
-        define_start = False
         if line.lstrip().startswith("#"):
             if line[line.find("#") + 1:].lstrip().startswith("define"):
-                define_start = True
+                in_define = True
 
         if (
                 "/*" in line
@@ -132,7 +126,9 @@ def custom_format(filename):
                 and last_line.strip() != ""
         ):
             line = (" " * define_padding + "\\" if in_define else "") + "\n" + line
-        in_define = (define_start or in_define) and line.endswith("\\")
+
+        if not line.endswith("\\"):
+            in_define = False
 
         out += line + "\n"
         last_line = line
@@ -140,38 +136,6 @@ def custom_format(filename):
     return out
 
 
-def hash_code_and_formatter(code):
-    hasher = hashlib.sha256()
-
-    hasher.update(code.encode())
-    hasher.update(CLANG_FORMAT_VERSION)
-    with open(__file__, 'rb') as f:
-        hasher.update(f.read())
-
-    return hasher.hexdigest()
-
-
-def custom_format_cached(filename):
-    filename_hash = hashlib.sha256(filename.encode()).hexdigest()
-    cache_file = os.path.join(FORMAT_CACHE_DIR, filename_hash)
-
-    if os.path.exists(cache_file):
-        with open(filename) as f:
-            code = f.read()
-        code_hash = hash_code_and_formatter(code)
-        with open(cache_file) as f:
-            if f.read() == code_hash:
-                return code
-
-    code = custom_format(filename)
-
-    code_hash = hash_code_and_formatter(code)
-    with open(cache_file, 'w') as f:
-        f.write(code_hash)
-
-    return code
-
-
 args = sys.argv[1:]
 if len(args) == 0:
     print("Usage: ./format.py [-i] <filename>")
@@ -187,7 +151,7 @@ if args[0] == "-i":
     args = args[1:]
 
 for filename in args:
-    code = custom_format_cached(filename)
+    code = custom_format(filename)
     if in_place:
         with open(filename, "w") as f:
             f.write(code)

.github/workflows/ci.yml

@@ -14,18 +14,18 @@ jobs:
     runs-on: "${{ matrix.os }}"
     strategy:
       matrix:
-        os: [ubuntu-24.04, ubuntu-22.04, ubuntu-24.04-arm]
+        os: [ubuntu-22.04, ubuntu-20.04]
     env:
       AFL_SKIP_CPUFREQ: 1
       AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES: 1
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
       - name: update
         run: sudo apt-get update && sudo apt-get upgrade -y
       - name: debug
         run: apt-cache search plugin-dev | grep gcc-; echo; apt-cache search clang-format- | grep clang-format-
       - name: install packages
-        run: sudo apt-get install -y -m -f build-essential gcc-12 g++-12 git libtool libtool-bin automake flex bison libglib2.0-0 clang-15 llvm-15-dev libc++-dev findutils libcmocka-dev python3-dev python3-setuptools ninja-build python3-pip gcc-12-plugin-dev
+        run: sudo apt-get install -y -m -f build-essential gcc-10 g++-10 git libtool libtool-bin automake flex bison libglib2.0-0 clang-12 llvm-12-dev libc++-dev findutils libcmocka-dev python3-dev python3-setuptools ninja-build python3-pip gcc-10-plugin-dev
       - name: compiler installed
         run: gcc -v; echo; clang -v
       - name: install gcc plugin
@@ -34,25 +34,23 @@ jobs:
         run: export NO_NYX=1; export ASAN_BUILD=1; export LLVM_CONFIG=llvm-config-12; make ASAN_BUILD=1 NO_NYX=1 LLVM_CONFIG=llvm-config-12 distrib
       - name: run tests
         run: sudo -E ./afl-system-config; make tests
-  macos:
-    runs-on: macOS-latest
-    env:
-      AFL_MAP_SIZE: 65536
-      AFL_SKIP_CPUFREQ: 1
-      AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES: 1
-    steps:
-      - uses: actions/checkout@v3
-      - name: install
-        run: brew install make gcc llvm
-#     - name: fix install
-#       run: cd /usr/local/bin; ln -s gcc-12 gcc; ln -s g++-12 g++; which gcc; gcc -v
-#      - name: build
-#        run: export PATH=/usr/local/Cellar/llvm/*/":$PATH"; export CC=/usr/local/Cellar/llvm/*/bin/clang; export CXX="$CC"++; export LLVM_CONFIG=/usr/local/Cellar/llvm/*/bin/llvm-config; sudo -E ./afl-system-config; gmake ASAN_BUILD=1 afl-fuzz
-      - name: build
-        run: sudo -E ./afl-system-config; gmake ASAN_BUILD=1 afl-fuzz
-#     - name: frida
-#       run: export CC=/usr/local/Cellar/llvm/*/bin/clang; export CXX="$CC"++; cd frida_mode; gmake
-#     - name: run tests
-#       run: sudo -E ./afl-system-config; export CC=/usr/local/Cellar/llvm/*/bin/clang; export CXX="$CC"++; export PATH=/usr/local/Cellar/llvm/*/":/usr/local/bin:$PATH"; export LLVM_CONFIG=/usr/local/Cellar/llvm/*/bin/llvm-config; gmake tests
-#     - name: force frida test for MacOS
-#       run: export AFL_PATH=`pwd`; /usr/local/bin/gcc -o test-instr test-instr.c; mkdir in; echo > in/in; AFL_NO_UI=1 ./afl-fuzz -O -i in -o out -V 5 -- ./test-instr
+ # macos:
+ #   runs-on: macOS-latest
+ #   env:
+ #     AFL_MAP_SIZE: 65536
+ #     AFL_SKIP_CPUFREQ: 1
+ #     AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES: 1
+ #   steps:
+ #     - uses: actions/checkout@v3
+ #     - name: install
+ #       run: brew install make gcc llvm
+ #     - name: fix install
+ #       run: cd /usr/local/bin; ln -s gcc-11 gcc; ln -s g++-11 g++; which gcc; gcc -v
+ #     - name: build
+ #       run: export PATH=/usr/local/Cellar/llvm/*/":$PATH"; export CC=/usr/local/Cellar/llvm/*/bin/clang; export CXX="$CC"++; export LLVM_CONFIG=/usr/local/Cellar/llvm/*/bin/llvm-config; sudo -E ./afl-system-config; gmake ASAN_BUILD=1
+ #     - name: frida
+ #       run: export CC=/usr/local/Cellar/llvm/*/bin/clang; export CXX="$CC"++; cd frida_mode; gmake
+ #     - name: run tests
+ #       run: sudo -E ./afl-system-config; export CC=/usr/local/Cellar/llvm/*/bin/clang; export CXX="$CC"++; export PATH=/usr/local/Cellar/llvm/*/":/usr/local/bin:$PATH"; export LLVM_CONFIG=/usr/local/Cellar/llvm/*/bin/llvm-config; gmake tests
+ #     - name: force frida test for MacOS
+ #       run: export AFL_PATH=`pwd`; /usr/local/bin/gcc -o test-instr test-instr.c; mkdir in; echo > in/in; AFL_NO_UI=1 ./afl-fuzz -O -i in -o out -V 5 -- ./test-instr

.github/workflows/container.yml

@@ -16,11 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v3
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v2
       - name: Build amd64
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v3
         with:
           context: .
           tags: aflplusplus:test-amd64
@@ -35,41 +35,20 @@ jobs:
           apt-get install -y libcmocka-dev && 
           make -i tests
           "
-  build-and-test-arm64:
-    name: Test arm64 image
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Build arm64
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          tags: aflplusplus:test-arm64
-          load: true
-          cache-to: type=gha,mode=max
-          build-args: |
-            TEST_BUILD=1
-      - name: Test arm64
-        run: >
-          docker run --rm aflplusplus:test-arm64 bash -c "
-          apt-get update && 
-          apt-get install -y libcmocka-dev && 
-          make -i tests
-          "
 
   push:
     name: Push amd64 and arm64 images
     runs-on: ubuntu-latest
     needs:
       - build-and-test-amd64
-      - build-and-test-arm64
     if: ${{ github.event_name == 'push' && github.repository == 'AFLplusplus/AFLplusplus' }}
     steps:
       - name: Checkout
         uses: actions/checkout@v3
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+        with:
+          platforms: arm64
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: Login to docker.io

.github/workflows/rust_custom_mutator.yml

@@ -18,7 +18,7 @@ jobs:
         working-directory: custom_mutators/rust
     strategy:
       matrix:
-        os: [ubuntu-22.04]
+        os: [ubuntu-22.04, ubuntu-20.04]
     steps:
       - uses: actions/checkout@v3
       - name: Install Rust Toolchain

.gitignore

@@ -6,8 +6,6 @@
 *.pyc
 *.so
 *.swp
-.DS_Store
-.format-cache
 .sync_tmp
 .test
 .test2
@@ -113,5 +111,3 @@ utils/replay_record/persistent_demo_replay_compat
 utils/replay_record/persistent_demo_replay_argparse
 utils/plot_ui/afl-plot-ui
 vuln_prog
-argv_fuzz_demo
-argv_fuzz_persistent_demo

CONTRIBUTING.md

@@ -48,7 +48,7 @@ When working on the docs, please keep the following guidelines in mind:
   * Don't: fuzzing-network-service.md
 * Use a maximum of 80 characters per line to make reading in a console easier.
 * Make all pull requests against `dev`, see
-  [#how-to-submit-a-pull-request](#how-to-submit-a-pull-request).
+  [#how-to-submit-a-pull-request-to-afl](#how-to-submit-a-pull-request-to-afl).
 
 And finally, here are some best practices for writing docs content:
 
@@ -57,4 +57,4 @@ And finally, here are some best practices for writing docs content:
 * Use bulleted lists to present similar content in a way that makes it easy to
   scan.
 * Use numbered lists for procedures or prioritizing.
-* Link to related content, for example, prerequisites or in-depth discussions.
+* Link to related content, for example, prerequisites or in-depth discussions.

Dockerfile

@@ -61,7 +61,6 @@ RUN apt-get update && \
 
 RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-${GCC_VERSION} 0 && \
     update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-${GCC_VERSION} 0 && \
-    update-alternatives --install /usr/bin/c++ c++ /usr/bin/g++-${GCC_VERSION} 0 && \
     update-alternatives --install /usr/bin/clang clang /usr/bin/clang-${LLVM_VERSION} 0 && \
     update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-${LLVM_VERSION} 0
 

GNUmakefile

@@ -19,21 +19,21 @@
 # so use a variable for '#'
 HASH=\#
 
-PREFIX      ?= /usr/local
-BIN_PATH     = $(PREFIX)/bin
-HELPER_PATH  = $(PREFIX)/lib/afl
-DOC_PATH     = $(PREFIX)/share/doc/afl
-MISC_PATH    = $(PREFIX)/share/afl
-MAN_PATH     = $(PREFIX)/share/man/man8
-INCLUDE_PATH = $(PREFIX)/include/afl
+PREFIX     ?= /usr/local
+BIN_PATH    = $(PREFIX)/bin
+HELPER_PATH = $(PREFIX)/lib/afl
+DOC_PATH    = $(PREFIX)/share/doc/afl
+MISC_PATH   = $(PREFIX)/share/afl
+MAN_PATH    = $(PREFIX)/share/man/man8
 
 PROGNAME    = afl
 VERSION     = $(shell grep '^$(HASH)define VERSION ' ../config.h | cut -d '"' -f2)
 
+# PROGS intentionally omit afl-as, which gets installed elsewhere.
+
 PROGS       = afl-fuzz afl-showmap afl-tmin afl-gotcpu afl-analyze
-SH_PROGS    = afl-plot afl-cmin afl-cmin.bash afl-cmin.py afl-whatsup afl-addseeds afl-system-config afl-persistent-config afl-cc
-HEADERS     = include/afl-fuzz.h include/afl-mutations.h include/afl-persistent-replay.h include/afl-prealloc.h include/afl-record-compat.h include/alloc-inl.h include/android-ashmem.h include/cmplog.h include/common.h include/config.h include/coverage-32.h include/coverage-64.h include/debug.h include/envs.h include/forkserver.h include/hash.h include/list.h include/sharedmem.h include/snapshot-inl.h include/t1ha.h include/t1ha0_ia32aes_b.h include/t1ha_bits.h include/t1ha_selfcheck.h include/types.h include/xxhash.h
-MANPAGES=$(foreach p, $(PROGS) $(SH_PROGS), $(p).8)
+SH_PROGS    = afl-plot afl-cmin afl-cmin.bash afl-whatsup afl-addseeds afl-system-config afl-persistent-config afl-cc
+MANPAGES=$(foreach p, $(PROGS) $(SH_PROGS), $(p).8) afl-as.8
 ASAN_OPTIONS=detect_leaks=0
 
 SYS = $(shell uname -s)
@@ -41,6 +41,10 @@ ARCH = $(shell uname -m)
 
 $(info [*] Compiling AFL++ for OS $(SYS) on ARCH $(ARCH))
 
+ifdef NO_SPLICING
+  override CFLAGS_OPT += -DNO_SPLICING
+endif
+
 ifdef NO_UTF
   override CFLAGS_OPT += -DFANCY_BOXES_NO_UTF
 endif
@@ -61,31 +65,20 @@ ifdef MSAN_BUILD
   override CFLAGS += -fsanitize=memory -fno-omit-frame-pointer
   override LDFLAGS += -fsanitize=memory
 endif
-ifdef NO_SPLICING
-  $(info The NO_SPLICING parameter is deprecated)
-endif
-
 
 ifdef CODE_COVERAGE
   override CFLAGS += -D__AFL_CODE_COVERAGE=1
 endif
 
-IS_IOS:=$(findstring ios, $(shell $(CC) --version 2>/dev/null))
-ifdef IS_IOS
-  override CFLAGS += -DTARGET_OS_IPHONE -DTARGET_OS_IOS -isysroot $(IOS_SDK_PATH)
-endif
-
 ifeq "$(findstring android, $(shell $(CC) --version 2>/dev/null))" ""
-ifndef ASAN_BUILD
- ifeq "$(shell echo 'int main() {return 0; }' | $(CC) $(CFLAGS) -Werror -x c - -flto=full -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
+ifeq "$(shell echo 'int main() {return 0; }' | $(CC) $(CFLAGS) -Werror -x c - -flto=full -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
 	CFLAGS_FLTO ?= -flto=full
- else
-  ifeq "$(shell echo 'int main() {return 0; }' | $(CC) $(CFLAGS) -Werror -x c - -flto=thin -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
+else
+ ifeq "$(shell echo 'int main() {return 0; }' | $(CC) $(CFLAGS) -Werror -x c - -flto=thin -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
 	CFLAGS_FLTO ?= -flto=thin
-  else
-   ifeq "$(shell echo 'int main() {return 0; }' | $(CC) $(CFLAGS) -Werror -x c - -flto -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
+ else
+  ifeq "$(shell echo 'int main() {return 0; }' | $(CC) $(CFLAGS) -Werror -x c - -flto -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
 	CFLAGS_FLTO ?= -flto
-   endif
   endif
  endif
 endif
@@ -108,25 +101,23 @@ else
   SPECIAL_PERFORMANCE :=
 endif
 
-ifndef IS_IOS
-  ifneq "$(SYS)" "Darwin"
-   #ifeq "$(HAVE_MARCHNATIVE)" "1"
-   #  SPECIAL_PERFORMANCE += -march=native
-   #endif
-   #ifndef DEBUG
-   #  override CFLAGS_OPT += -D_FORTIFY_SOURCE=1
-   #endif
-  else
-    # On some odd MacOS system configurations, the Xcode sdk path is not set correctly
-    SDK_LD = -L$(shell xcrun --show-sdk-path)/usr/lib
-    override LDFLAGS += $(SDK_LD)
-  endif
+ifneq "$(SYS)" "Darwin"
+ #ifeq "$(HAVE_MARCHNATIVE)" "1"
+ #  SPECIAL_PERFORMANCE += -march=native
+ #endif
+ #ifndef DEBUG
+ #  override CFLAGS_OPT += -D_FORTIFY_SOURCE=1
+ #endif
+else
+  # On some odd MacOS system configurations, the Xcode sdk path is not set correctly
+  SDK_LD = -L$(shell xcrun --show-sdk-path)/usr/lib
+  override LDFLAGS += $(SDK_LD)
 endif
 
 COMPILER_TYPE=$(shell $(CC) --version|grep "Free Software Foundation")
 ifneq "$(COMPILER_TYPE)" ""
   #$(info gcc is being used)
-  override CFLAGS_OPT += -Wno-format-truncation
+  override CFLAGS_OPT += -Wno-error=format-truncation -Wno-format-truncation
 endif
 
 ifeq "$(SYS)" "SunOS"
@@ -291,7 +282,7 @@ ifneq "$(findstring OpenBSD, $(SYS))" ""
   override LDFLAGS += -lpthread -lm
 endif
 
-COMM_HDR    = include/alloc-inl.h include/config.h include/debug.h include/types.h include/afl-fuzz.h include/hash.h include/sharedmem.h include/forkserver.h include/common.h include/list.h
+COMM_HDR    = include/alloc-inl.h include/config.h include/debug.h include/types.h
 
 ifeq "$(shell echo '$(HASH)include <Python.h>@int main() {return 0; }' | tr @ '\n' | $(CC) $(CFLAGS) -x c - -o .test $(PYTHON_INCLUDE) $(LDFLAGS) $(PYTHON_LIB) 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
 	PYTHON_OK=1
@@ -315,8 +306,8 @@ ifeq "$(shell command -v svn >/dev/null && svn proplist . 2>/dev/null && echo 1
 endif
 
 ifeq "$(shell echo 'int main() { return 0;}' | $(CC) $(CFLAGS) -fsanitize=address -x c - -o .test2 2>/dev/null && echo 1 || echo 0 ; rm -f .test2 )" "1"
-	ASAN_CFLAGS=-fsanitize=address -fstack-protector-all -fno-omit-frame-pointer -DASAN_BUILD -fno-lto
-	ASAN_LDFLAGS=-fsanitize=address -fstack-protector-all -fno-omit-frame-pointer -fno-lto
+	ASAN_CFLAGS=-fsanitize=address -fstack-protector-all -fno-omit-frame-pointer -DASAN_BUILD
+	ASAN_LDFLAGS=-fsanitize=address -fstack-protector-all -fno-omit-frame-pointer
 endif
 
 ifeq "$(shell echo '$(HASH)include <sys/ipc.h>@$(HASH)include <sys/shm.h>@int main() { int _id = shmget(IPC_PRIVATE, 65536, IPC_CREAT | IPC_EXCL | 0600); shmctl(_id, IPC_RMID, 0); return 0;}' | tr @ '\n' | $(CC) $(CFLAGS) -x c - -o .test2 2>/dev/null && echo 1 || echo 0 ; rm -f .test2 )" "1"
@@ -334,12 +325,10 @@ ifdef TEST_MMAP
 endif
 
 .PHONY: all
-all:	test_x86 test_shm test_python ready $(PROGS) llvm gcc_plugin test_build all_done
+all:	test_x86 test_shm test_python ready $(PROGS) afl-as llvm gcc_plugin test_build all_done
 	-$(MAKE) -C utils/aflpp_driver
 	@echo
 	@echo
-	@echo
-	@echo
 	@echo Build Summary:
 	@test -e afl-fuzz && echo "[+] afl-fuzz and supporting tools successfully built" || echo "[-] afl-fuzz could not be built, please set CC to a working compiler"
 	@test -e afl-llvm-pass.so && echo "[+] LLVM basic mode successfully built" || echo "[-] LLVM mode could not be built, please install at least llvm-11 and clang-11 or newer, see docs/INSTALL.md"
@@ -348,7 +337,6 @@ all:	test_x86 test_shm test_python ready $(PROGS) llvm gcc_plugin test_build all
 ifneq "$(SYS)" "Darwin"
 	@test -e afl-gcc-pass.so && echo "[+] gcc_mode successfully built" || echo "[-] gcc_mode could not be built, it is optional, install gcc-VERSION-plugin-dev to enable this"
 endif
-	@test -e afl-cc || echo "[-] AFL++ instrumentation compilers could not be built! Install llvm-VERSION-dev or gcc-VERSION-plugin-dev, see docs/INSTALL.md!"
 	@echo
 
 .PHONY: llvm
@@ -417,6 +405,7 @@ help:
 	@echo PROFILING - compile afl-fuzz with profiling information
 	@echo INTROSPECTION - compile afl-fuzz with mutation introspection
 	@echo NO_PYTHON - disable python support
+	@echo NO_SPLICING - disables splicing mutation in afl-fuzz, not recommended for normal fuzzing
 	@echo "NO_UTF - do not use UTF-8 for line rendering in status screen (fallback to G1 box drawing, of vanilla AFL)"
 	@echo NO_NYX - disable building nyx mode dependencies
 	@echo "NO_CORESIGHT - disable building coresight (arm64 only)"
@@ -474,47 +463,36 @@ endif
 ready:
 	@echo "[+] Everything seems to be working, ready to compile. ($(shell $(CC) --version 2>&1|head -n 1))"
 
-src/afl-performance.o: $(COMM_HDR) src/afl-performance.c
-	$(CC) $(CFLAGS) $(CFLAGS_FLTO) $(CFLAGS_OPT) $(SPECIAL_PERFORMANCE) -Iinclude -c src/afl-performance.c -o src/afl-performance.o
+afl-as: src/afl-as.c include/afl-as.h $(COMM_HDR) | test_x86
+	$(CC) $(CFLAGS) src/$@.c -o $@ $(LDFLAGS)
+	@ln -sf afl-as as
 
-src/afl-common.o: $(COMM_HDR) src/afl-common.c include/envs.h
+src/afl-performance.o : $(COMM_HDR) src/afl-performance.c include/hash.h
+	$(CC) $(CFLAGS) $(CFLAGS_OPT) $(SPECIAL_PERFORMANCE) -Iinclude -c src/afl-performance.c -o src/afl-performance.o
+
+src/afl-common.o : $(COMM_HDR) src/afl-common.c include/common.h
 	$(CC) $(CFLAGS) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) -c src/afl-common.c -o src/afl-common.o
 
-src/afl-forkserver.o: $(COMM_HDR) src/afl-forkserver.c 
+src/afl-forkserver.o : $(COMM_HDR) src/afl-forkserver.c include/forkserver.h
 	$(CC) $(CFLAGS) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) -c src/afl-forkserver.c -o src/afl-forkserver.o
 
-src/afl-sharedmem.o: $(COMM_HDR) src/afl-sharedmem.c include/android-ashmem.h include/cmplog.h
+src/afl-sharedmem.o : $(COMM_HDR) src/afl-sharedmem.c include/sharedmem.h
 	$(CC) $(CFLAGS) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) -c src/afl-sharedmem.c -o src/afl-sharedmem.o
 
-afl-fuzz: $(COMM_HDR) include/afl-fuzz.h $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o include/cmplog.h include/envs.h | test_x86
+afl-fuzz: $(COMM_HDR) include/afl-fuzz.h $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o | test_x86
 	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o -o $@ $(PYFLAGS) $(LDFLAGS) -lm
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
-afl-showmap: src/afl-showmap.c src/afl-fuzz-mutators.c src/afl-fuzz-python.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o $(COMM_HDR) | test_x86
+afl-showmap: src/afl-showmap.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o $(COMM_HDR) | test_x86
 	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) src/$@.c src/afl-fuzz-mutators.c src/afl-fuzz-python.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o -o $@ $(PYFLAGS) $(LDFLAGS)
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
-afl-tmin: src/afl-tmin.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o src/afl-fuzz-python.o src/afl-fuzz-mutators.o $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) src/$@.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o src/afl-fuzz-python.o src/afl-fuzz-mutators.o -o $@ $(PYFLAGS) $(LDFLAGS)
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
+afl-tmin: src/afl-tmin.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o $(COMM_HDR) | test_x86
+	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) src/$@.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o -o $@ $(LDFLAGS)
 
 afl-analyze: src/afl-analyze.c src/afl-common.o src/afl-sharedmem.o src/afl-performance.o src/afl-forkserver.o $(COMM_HDR) | test_x86
 	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) src/$@.c src/afl-common.o src/afl-sharedmem.o src/afl-performance.o src/afl-forkserver.o -o $@ $(LDFLAGS)
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 afl-gotcpu: src/afl-gotcpu.c src/afl-common.o $(COMM_HDR) | test_x86
 	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) src/$@.c src/afl-common.o -o $@ $(LDFLAGS)
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 .PHONY: document
 document:	afl-fuzz-document
@@ -522,9 +500,6 @@ document:	afl-fuzz-document
 # document all mutations and only do one run (use with only one input file!)
 afl-fuzz-document: $(COMM_HDR) include/afl-fuzz.h $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-performance.o | test_x86
 	$(CC) -D_DEBUG=\"1\" -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS) $(CFLAGS_FLTO) $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.c src/afl-performance.o -o afl-fuzz-document $(PYFLAGS) $(LDFLAGS)
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 test/unittests/unit_maybe_alloc.o : $(COMM_HDR) include/alloc-inl.h test/unittests/unit_maybe_alloc.c $(AFL_FUZZ_FILES)
 	@$(CC) $(CFLAGS) $(ASAN_CFLAGS) -c test/unittests/unit_maybe_alloc.c -o test/unittests/unit_maybe_alloc.o
@@ -532,29 +507,20 @@ test/unittests/unit_maybe_alloc.o : $(COMM_HDR) include/alloc-inl.h test/unittes
 unit_maybe_alloc: test/unittests/unit_maybe_alloc.o
 	@$(CC) $(CFLAGS) -Wl,--wrap=exit -Wl,--wrap=printf test/unittests/unit_maybe_alloc.o -o test/unittests/unit_maybe_alloc $(LDFLAGS) $(ASAN_LDFLAGS) -lcmocka
 	./test/unittests/unit_maybe_alloc
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 test/unittests/unit_hash.o : $(COMM_HDR) include/alloc-inl.h test/unittests/unit_hash.c $(AFL_FUZZ_FILES) src/afl-performance.o
-	@$(CC) $(CFLAGS) $(CFLAGS_FLTO) $(ASAN_CFLAGS) $(SPECIAL_PERFORMANCE) -c test/unittests/unit_hash.c -o test/unittests/unit_hash.o
+	@$(CC) $(CFLAGS) $(ASAN_CFLAGS) $(SPECIAL_PERFORMANCE) -c test/unittests/unit_hash.c -o test/unittests/unit_hash.o
 
 unit_hash: test/unittests/unit_hash.o src/afl-performance.o
-	@$(CC) $(CFLAGS) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) -Wl,--wrap=exit -Wl,--wrap=printf $^ -o test/unittests/unit_hash $(LDFLAGS) $(ASAN_LDFLAGS) -lcmocka
+	@$(CC) $(CFLAGS) $(SPECIAL_PERFORMANCE) -Wl,--wrap=exit -Wl,--wrap=printf $^ -o test/unittests/unit_hash $(LDFLAGS) $(ASAN_LDFLAGS) -lcmocka
 	./test/unittests/unit_hash
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 test/unittests/unit_rand.o : $(COMM_HDR) include/alloc-inl.h test/unittests/unit_rand.c $(AFL_FUZZ_FILES) src/afl-performance.o
-	@$(CC) $(CFLAGS) $(CFLAGS_FLTO) $(ASAN_CFLAGS) $(SPECIAL_PERFORMANCE) -c test/unittests/unit_rand.c -o test/unittests/unit_rand.o
+	@$(CC) $(CFLAGS) $(ASAN_CFLAGS) $(SPECIAL_PERFORMANCE) -c test/unittests/unit_rand.c -o test/unittests/unit_rand.o
 
 unit_rand: test/unittests/unit_rand.o src/afl-common.o src/afl-performance.o
-	@$(CC) $(CFLAGS) $(CFLAGS_FLTO) $(ASAN_CFLAGS) $(SPECIAL_PERFORMANCE) -Wl,--wrap=exit -Wl,--wrap=printf $^ -o test/unittests/unit_rand  $(LDFLAGS) $(ASAN_LDFLAGS) -lcmocka
+	@$(CC) $(CFLAGS) $(ASAN_CFLAGS) $(SPECIAL_PERFORMANCE) -Wl,--wrap=exit -Wl,--wrap=printf $^ -o test/unittests/unit_rand  $(LDFLAGS) $(ASAN_LDFLAGS) -lcmocka
 	./test/unittests/unit_rand
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 test/unittests/unit_list.o : $(COMM_HDR) include/list.h test/unittests/unit_list.c $(AFL_FUZZ_FILES)
 	@$(CC) $(CFLAGS) $(ASAN_CFLAGS) -c test/unittests/unit_list.c -o test/unittests/unit_list.o
@@ -562,9 +528,6 @@ test/unittests/unit_list.o : $(COMM_HDR) include/list.h test/unittests/unit_list
 unit_list: test/unittests/unit_list.o
 	@$(CC) $(CFLAGS) $(ASAN_CFLAGS) -Wl,--wrap=exit -Wl,--wrap=printf test/unittests/unit_list.o -o test/unittests/unit_list  $(LDFLAGS) $(ASAN_LDFLAGS) -lcmocka
 	./test/unittests/unit_list
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 test/unittests/unit_preallocable.o : $(COMM_HDR) include/alloc-inl.h test/unittests/unit_preallocable.c $(AFL_FUZZ_FILES)
 	@$(CC) $(CFLAGS) $(ASAN_CFLAGS) -c test/unittests/unit_preallocable.c -o test/unittests/unit_preallocable.o
@@ -572,9 +535,6 @@ test/unittests/unit_preallocable.o : $(COMM_HDR) include/alloc-inl.h test/unitte
 unit_preallocable: test/unittests/unit_preallocable.o
 	@$(CC) $(CFLAGS) $(ASAN_CFLAGS) -Wl,--wrap=exit -Wl,--wrap=printf test/unittests/unit_preallocable.o -o test/unittests/unit_preallocable $(LDFLAGS) $(ASAN_LDFLAGS) -lcmocka
 	./test/unittests/unit_preallocable
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 .PHONY: unit_clean
 unit_clean:
@@ -614,27 +574,27 @@ code-format:
 
 .PHONY: test_build
 ifndef AFL_NO_X86
-test_build: afl-cc afl-showmap
+test_build: afl-cc afl-gcc afl-as afl-showmap
 	@echo "[*] Testing the CC wrapper afl-cc and its instrumentation output..."
-	@unset AFL_MAP_SIZE AFL_USE_UBSAN AFL_USE_CFISAN AFL_USE_LSAN AFL_USE_ASAN AFL_USE_MSAN AFL_LLVM_ALLOWLIST AFL_LLVM_DENYLIST; ASAN_OPTIONS=detect_leaks=0 AFL_INST_RATIO=100 AFL_PATH=. ./afl-cc test-instr.c $(LDFLAGS) -o test-instr 2>&1 || (echo "Oops, afl-cc failed"; exit 1 )
+	@unset AFL_MAP_SIZE AFL_USE_UBSAN AFL_USE_CFISAN AFL_USE_LSAN AFL_USE_ASAN AFL_USE_MSAN; ASAN_OPTIONS=detect_leaks=0 AFL_INST_RATIO=100 AFL_PATH=. ./afl-cc test-instr.c $(LDFLAGS) -o test-instr 2>&1 || (echo "Oops, afl-cc failed"; exit 1 )
 	-ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -q -m none -o .test-instr0 ./test-instr < /dev/null
 	-echo 1 | ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr1 ./test-instr
 	@rm -f test-instr
 	@cmp -s .test-instr0 .test-instr1; DR="$$?"; rm -f .test-instr0 .test-instr1; if [ "$$DR" = "0" ]; then echo; echo "Oops, the instrumentation of afl-cc does not seem to be behaving correctly!"; echo; echo "Please post to https://github.com/AFLplusplus/AFLplusplus/issues to troubleshoot the issue."; echo; exit 1; fi
 	@echo
 	@echo "[+] All right, the instrumentation of afl-cc seems to be working!"
-#	@echo "[*] Testing the CC wrapper and its instrumentation output..."
-#	@unset AFL_MAP_SIZE AFL_USE_UBSAN AFL_USE_CFISAN AFL_USE_LSAN AFL_USE_ASAN AFL_USE_MSAN; AFL_CC=$(CC) ASAN_OPTIONS=detect_leaks=0 AFL_INST_RATIO=100 AFL_PATH=. ./afl-clang-fast test-instr.c -o test-instr 2>&1 || (echo "Oops, afl-clang-fast failed"; exit 1 )
+#	@echo "[*] Testing the CC wrapper afl-gcc and its instrumentation output..."
+#	@unset AFL_MAP_SIZE AFL_USE_UBSAN AFL_USE_CFISAN AFL_USE_LSAN AFL_USE_ASAN AFL_USE_MSAN; AFL_CC=$(CC) ASAN_OPTIONS=detect_leaks=0 AFL_INST_RATIO=100 AFL_PATH=. ./afl-gcc test-instr.c -o test-instr 2>&1 || (echo "Oops, afl-gcc failed"; exit 1 )
 #	ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr0 ./test-instr < /dev/null
 #	echo 1 | ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr1 ./test-instr
 #	@rm -f test-instr
-#	@cmp -s .test-instr0 .test-instr1; DR="$$?"; rm -f .test-instr0 .test-instr1; if [ "$$DR" = "0" ]; then echo; echo "Oops, the instrumentation of afl-clang-fast does not seem to be behaving correctly!"; \
+#	@cmp -s .test-instr0 .test-instr1; DR="$$?"; rm -f .test-instr0 .test-instr1; if [ "$$DR" = "0" ]; then echo; echo "Oops, the instrumentation of afl-gcc does not seem to be behaving correctly!"; \
 #		gcc -v 2>&1 | grep -q -- --with-as= && ( echo; echo "Gcc is configured not to use an external assembler with the -B option." ) || \
 #		( echo; echo "Please post to https://github.com/AFLplusplus/AFLplusplus/issues to troubleshoot the issue." ); echo; exit 0; fi
 #	@echo
-#	@echo "[+] All right, the instrumentation of afl-clang-fast seems to be working!"
+#	@echo "[+] All right, the instrumentation of afl-gcc seems to be working!"
 else
-test_build: afl-cc afl-showmap
+test_build: afl-cc afl-as afl-showmap
 	@echo "[!] Note: skipping build tests (you may need to use LLVM or QEMU mode)."
 endif
 
@@ -644,8 +604,7 @@ all_done: test_build
 	@test -e cmplog-instructions-pass.so && echo "[+] LLVM mode for 'afl-cc' successfully built!" || echo "[-] LLVM mode for 'afl-cc'  failed to build, likely you either don't have llvm installed, or you need to set LLVM_CONFIG, to point to e.g. llvm-config-11. See instrumentation/README.llvm.md how to do this. Highly recommended!"
 	@test -e SanitizerCoverageLTO.so && echo "[+] LLVM LTO mode for 'afl-cc' successfully built!" || echo "[-] LLVM LTO mode for 'afl-cc'  failed to build, this would need LLVM 11+, see instrumentation/README.lto.md how to build it"
 	@test -e afl-gcc-pass.so && echo "[+] gcc_plugin for 'afl-cc' successfully built!" || echo "[-] gcc_plugin for 'afl-cc'  failed to build, unless you really need it that is fine - or read instrumentation/README.gcc_plugin.md how to build it"
-	@test -e afl-cc && echo "[+] All done! Be sure to review the README.md - it's pretty short and useful."
-	@test -e afl-cc || echo "[-] ERROR  - neither afl-clang-fast or afl-gcc-fast could be compiled - YOU ARE MISSING PACKAGES! Read docs/INSTALL.md!"
+	@echo "[+] All done! Be sure to review the README.md - it's pretty short and useful."
 	@if [ "$(SYS)" = "Darwin" ]; then printf "\nWARNING: Fuzzing on MacOS X is slow because of the unusually high overhead of\nfork() on this OS. Consider using Linux or *BSD for fuzzing software not\nspecifically for MacOS.\n\n"; fi
 	@! tty <&1 >/dev/null || printf "\033[0;30mNOTE: If you can read this, your terminal probably uses white background.\nThis will make the UI hard to read. See docs/status_screen.md for advice.\033[0m\n" 2>/dev/null
 
@@ -653,7 +612,7 @@ all_done: test_build
 
 .PHONY: clean
 clean:
-	rm -rf $(PROGS) afl-fuzz-document as afl-as afl-g++ afl-clang afl-clang++ *.o src/*.o *~ a.out core core.[1-9][0-9]* *.stackdump .test .test1 .test2 test-instr .test-instr0 .test-instr1 afl-cs-proxy afl-qemu-trace afl-gcc-fast afl-g++-fast ld *.so *.8 test/unittests/*.o test/unittests/unit_maybe_alloc test/unittests/preallocable .afl-* afl-gcc afl-g++ afl-clang afl-clang++ test/unittests/unit_hash test/unittests/unit_rand *.dSYM lib*.a
+	rm -rf $(PROGS) afl-fuzz-document afl-as as afl-g++ afl-clang afl-clang++ *.o src/*.o *~ a.out core core.[1-9][0-9]* *.stackdump .test .test1 .test2 test-instr .test-instr0 .test-instr1 afl-cs-proxy afl-qemu-trace afl-gcc-fast afl-g++-fast ld *.so *.8 test/unittests/*.o test/unittests/unit_maybe_alloc test/unittests/preallocable .afl-* afl-gcc afl-g++ afl-clang afl-clang++ test/unittests/unit_hash test/unittests/unit_rand *.dSYM lib*.a
 	-$(MAKE) -f GNUmakefile.llvm clean
 	-$(MAKE) -f GNUmakefile.gcc_plugin clean
 	-$(MAKE) -C utils/libdislocator clean
@@ -686,7 +645,6 @@ deepclean:	clean
 	rm -rf unicorn_mode/unicornafl
 	rm -rf qemu_mode/qemuafl
 	rm -rf nyx_mode/libnyx nyx_mode/packer nyx_mode/QEMU-Nyx
-	rm -rf .format-cache
 ifeq "$(IN_REPO)" "1"
 	git checkout coresight_mode/coresight-trace
 	git checkout unicorn_mode/unicornafl
@@ -867,10 +825,10 @@ endif
 	ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-g++
 	ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-clang
 	ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-clang++
-	@mkdir -m 755 -p $${DESTDIR}$(INCLUDE_PATH)
-	install -m 644 $(HEADERS) $${DESTDIR}$(INCLUDE_PATH)
 	@mkdir -m 0755 -p ${DESTDIR}$(MAN_PATH)
 	install -m0644 *.8 ${DESTDIR}$(MAN_PATH)
+	install -m 755 afl-as $${DESTDIR}$(HELPER_PATH)
+	ln -sf afl-as $${DESTDIR}$(HELPER_PATH)/as
 	install -m 644 docs/*.md $${DESTDIR}$(DOC_PATH)
 	cp -r testcases/ $${DESTDIR}$(MISC_PATH)
 	cp -r dictionaries/ $${DESTDIR}$(MISC_PATH)
@@ -878,14 +836,12 @@ endif
 
 .PHONY: uninstall
 uninstall:
-	-cd $${DESTDIR}$(BIN_PATH) && rm -f $(PROGS) $(SH_PROGS) afl-cs-proxy afl-qemu-trace afl-plot-ui afl-fuzz-document afl-network-client afl-network-server afl-g* afl-plot.sh afl-ld-lto afl-c* afl-lto*
-	-cd $${DESTDIR}$(INCLUDE_PATH) && rm -f $(HEADERS:include/%=%)
+	-cd $${DESTDIR}$(BIN_PATH) && rm -f $(PROGS) $(SH_PROGS) afl-cs-proxy afl-qemu-trace afl-plot-ui afl-fuzz-document afl-network-client afl-network-server afl-g* afl-plot.sh afl-as afl-ld-lto afl-c* afl-lto*
 	-cd $${DESTDIR}$(HELPER_PATH) && rm -f afl-g*.*o afl-llvm-*.*o afl-compiler-*.*o libdislocator.so libtokencap.so libcompcov.so libqasan.so afl-frida-trace.so libnyx.so socketfuzz*.so argvfuzz*.so libAFLDriver.a libAFLQemuDriver.a as afl-as SanitizerCoverage*.so compare-transform-pass.so cmplog-*-pass.so split-*-pass.so dynamic_list.txt injections.dic
 	-rm -rf $${DESTDIR}$(MISC_PATH)/testcases $${DESTDIR}$(MISC_PATH)/dictionaries
 	-sh -c "ls docs/*.md | sed 's|^docs/|$${DESTDIR}$(DOC_PATH)/|' | xargs rm -f"
 	-cd $${DESTDIR}$(MAN_PATH) && rm -f $(MANPAGES)
 	-rmdir $${DESTDIR}$(BIN_PATH) 2>/dev/null
-	-rmdir $${DESTDIR}$(INCLUDE_PATH) 2>/dev/null
 	-rmdir $${DESTDIR}$(HELPER_PATH) 2>/dev/null
 	-rmdir $${DESTDIR}$(MISC_PATH) 2>/dev/null
 	-rmdir $${DESTDIR}$(DOC_PATH) 2>/dev/null

GNUmakefile.gcc_plugin

@@ -148,7 +148,7 @@ afl-common.o: ./src/afl-common.c
 $(PASSES): instrumentation/afl-gcc-common.h
 
 ./afl-gcc-pass.so: instrumentation/afl-gcc-pass.so.cc | test_deps
-	$(CXX) $(CXXEFLAGS) $(PLUGIN_FLAGS) -shared $< -o $@ $(LDFLAGS)
+	$(CXX) $(CXXEFLAGS) $(PLUGIN_FLAGS) -shared $< -o $@
 	ln -sf afl-cc afl-gcc-fast
 	ln -sf afl-cc afl-g++-fast
 	ln -sf afl-cc.8 afl-gcc-fast.8
@@ -163,7 +163,7 @@ $(PASSES): instrumentation/afl-gcc-common.h
 .PHONY: test_build
 test_build: $(PROGS)
 	@echo "[*] Testing the CC wrapper and instrumentation output..."
-	unset AFL_USE_ASAN AFL_USE_MSAN AFL_LLVM_ALLOWLIST AFL_LLVM_DENYLIST; ASAN_OPTIONS=detect_leaks=0 AFL_QUIET=1 AFL_INST_RATIO=100 AFL_PATH=. AFL_CC=$(CC) ./afl-gcc-fast $(CFLAGS) $(CPPFLAGS) ./test-instr.c -o test-instr $(LDFLAGS)
+	unset AFL_USE_ASAN AFL_USE_MSAN; ASAN_OPTIONS=detect_leaks=0 AFL_QUIET=1 AFL_INST_RATIO=100 AFL_PATH=. AFL_CC=$(CC) ./afl-gcc-fast $(CFLAGS) $(CPPFLAGS) ./test-instr.c -o test-instr $(LDFLAGS)
 	ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr0 ./test-instr </dev/null
 	echo 1 | ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr1 ./test-instr
 	@rm -f test-instr

GNUmakefile.llvm

@@ -28,12 +28,12 @@ MAN_PATH    ?= $(PREFIX)/share/man/man8
 
 BUILD_DATE  ?= $(shell date -u -d "@$(SOURCE_DATE_EPOCH)" "+%Y-%m-%d" 2>/dev/null || date -u -r "$(SOURCE_DATE_EPOCH)" "+%Y-%m-%d" 2>/dev/null || date -u "+%Y-%m-%d")
 
-VERSION     = $(shell grep '^ *$(HASH)define VERSION ' ./config.h | cut -d '"' -f2)
+VERSION     = $(shell grep '^$(HASH)define VERSION ' ./config.h | cut -d '"' -f2)
 
 SYS = $(shell uname -s)
 
-override LLVM_TOO_NEW_DEFAULT := 21
-override LLVM_TOO_OLD_DEFAULT := 14
+override LLVM_TOO_NEW_DEFAULT := 18
+override LLVM_TOO_OLD_DEFAULT := 13
 
 ifeq "$(SYS)" "OpenBSD"
   LLVM_CONFIG ?= $(BIN_PATH)/llvm-config
@@ -48,37 +48,31 @@ else
   LLVM_CONFIG ?= $(call detect_newest,llvm-config)
 endif
 
-ifneq "$(LLVM_CONFIG)" ""
-  override LLVM_RAW_VER        := $(shell $(LLVM_CONFIG) --version 2>/dev/null)
-  LLVMVER                      := $(subst svn,,$(subst git,,$(LLVM_RAW_VER)))
-
-  LLVM_BINDIR                  := $(shell $(LLVM_CONFIG) --bindir 2>/dev/null)
-  LLVM_LIBDIR                  := $(shell $(LLVM_CONFIG) --libdir 2>/dev/null)
-endif
-
-ifneq "$(LLVMVER)" ""
-  LLVM_MAJOR                   := $(firstword $(subst ., ,$(LLVMVER)))
-  LLVM_MINOR                   := $(firstword $(subst ., ,$(subst $(LLVM_MAJOR).,,$(LLVMVER))))
-  LLVM_TOO_NEW                 := $(shell test $(LLVM_MAJOR) -gt $(LLVM_TOO_NEW_DEFAULT) && echo 1 || echo 0)
-  LLVM_TOO_OLD                 := $(shell test $(LLVM_MAJOR) -lt $(LLVM_TOO_OLD_DEFAULT) && echo 1 || echo 0)
-  LLVM_NEW_API                 := $(shell test $(LLVM_MAJOR) -ge 10 && echo 1 || echo 0)
-  LLVM_NEWER_API               := $(shell test $(LLVM_MAJOR) -ge 16 && echo 1 || echo 0)
-  LLVM_13_OK                   := $(shell test $(LLVM_MAJOR) -ge 13 && echo 1 || echo 0)
-  LLVM_HAVE_LTO                := $(shell test $(LLVM_MAJOR) -ge 12 && echo 1 || echo 0)
-endif
-
+override LLVM_RAW_VER        := $(shell $(LLVM_CONFIG) --version 2>/dev/null)
+LLVMVER                      := $(subst svn,,$(subst git,,$(LLVM_RAW_VER)))
+LLVM_MAJOR                   := $(firstword $(subst ., ,$(LLVMVER)))
+LLVM_MINOR                   := $(firstword $(subst ., ,$(subst $(LLVM_MAJOR).,,$(LLVMVER))))
+LLVM_TOO_NEW                 := $(shell test $(LLVM_MAJOR) -gt $(LLVM_TOO_NEW_DEFAULT) && echo 1 || echo 0)
+LLVM_TOO_OLD                 := $(shell test $(LLVM_MAJOR) -lt $(LLVM_TOO_OLD_DEFAULT) && echo 1 || echo 0)
+LLVM_NEW_API                 := $(shell test $(LLVM_MAJOR) -ge 10 && echo 1 || echo 0)
+LLVM_NEWER_API               := $(shell test $(LLVM_MAJOR) -ge 16 && echo 1 || echo 0)
+LLVM_13_OK                   := $(shell test $(LLVM_MAJOR) -ge 13 && echo 1 || echo 0)
+LLVM_HAVE_LTO                := $(shell test $(LLVM_MAJOR) -ge 12 && echo 1 || echo 0)
+LLVM_BINDIR                  := $(shell $(LLVM_CONFIG) --bindir 2>/dev/null)
+LLVM_LIBDIR                  := $(shell $(LLVM_CONFIG) --libdir 2>/dev/null)
 LLVM_STDCXX                  := gnu++11
+LLVM_APPLE_XCODE             := $(shell $(CC) -v 2>&1 | grep -q Apple && echo 1 || echo 0)
 LLVM_LTO                     := 0
-LLVM_UNSUPPORTED             := $(shell echo "$(LLVMVER)" | grep -E -q '^[0-2]\.|^3\.[0-7]\.|^2[2-9]\.' && echo 1 || echo 0)
+LLVM_UNSUPPORTED             := $(shell echo "$(LLVMVER)" | grep -E -q '^[0-2]\.|^3\.[0-8]\.' && echo 1 || echo 0)
 # Uncomment to see the values assigned above
-# $(foreach var,_CLANG_VERSIONS_TO_TEST LLVM_CONFIG LLVMVER LLVM_MAJOR LLVM_MINOR LLVM_TOO_NEW LLVM_TOO_OLD LLVM_TOO_NEW_DEFAULT LLVM_TOO_OLD_DEFAULT LLVM_NEW_API LLVM_NEWER_API LLVM_13_OK LLVM_HAVE_LTO LLVM_BINDIR LLVM_LIBDIR LLVM_STDCXX LLVM_APPLE_XCODE LLVM_LTO LLVM_UNSUPPORTED,$(warning $(var) = $($(var))))
+# $(foreach var,LLVM_CONFIG LLVMVER LLVM_MAJOR LLVM_MINOR LLVM_TOO_NEW LLVM_TOO_OLD LLVM_TOO_NEW_DEFAULT LLVM_TOO_OLD_DEFAULT LLVM_NEW_API LLVM_NEWER_API LLVM_13_OK LLVM_HAVE_LTO LLVM_BINDIR LLVM_LIBDIR LLVM_STDCXX LLVM_APPLE_XCODE LLVM_LTO LLVM_UNSUPPORTED,$(warning $(var) = $($(var))))
 
 ifeq "$(LLVMVER)" ""
   $(warning [!] llvm_mode needs llvm-config, which was not found. Set LLVM_CONFIG to its path and retry.)
 endif
 
 ifeq "$(LLVM_UNSUPPORTED)" "1"
-  $(error llvm_mode only supports llvm from version 3.8 onwards - or your version is too new. Upgrade AFL++ if possible or downgrade LLVM.)
+  $(error llvm_mode only supports llvm from version 3.8 onwards)
 endif
 
 ifeq "$(LLVM_TOO_NEW)" "1"
@@ -118,6 +112,10 @@ ifeq "$(LLVM_LTO)" "0"
   $(info [+] llvm_mode detected llvm < 12, afl-lto LTO will not be build.)
 endif
 
+ifeq "$(LLVM_APPLE_XCODE)" "1"
+  $(warning llvm_mode will not compile with Xcode clang...)
+endif
+
 # We were using llvm-config --bindir to get the location of clang, but
 # this seems to be busted on some distros, so using the one in $PATH is
 # probably better.
@@ -125,11 +123,6 @@ endif
 CC         = $(LLVM_BINDIR)/clang
 CXX        = $(LLVM_BINDIR)/clang++
 
-LLVM_APPLE_XCODE             := $(shell $(CC) -v 2>&1 | grep -q Apple && echo 1 || echo 0)
-ifeq "$(LLVM_APPLE_XCODE)" "1"
-  $(warning llvm_mode will not compile with Xcode clang...)
-endif
-
 # llvm-config --bindir may not providing a valid path, so ...
 ifeq "$(shell test -e $(CC) || echo 1 )" "1"
   # however we must ensure that this is not a "CC=gcc make"
@@ -163,7 +156,7 @@ endif
 
 # sanity check.
 # Are versions of clang --version and llvm-config --version equal?
-CLANGVER = $(shell $(CC) --version | sed -E -ne '/^.*version\ ([12]?[0-9]\.[0-9]\.[0-9]).*/s//\1/p')
+CLANGVER = $(shell $(CC) --version | sed -E -ne '/^.*version\ (1?[0-9]\.[0-9]\.[0-9]).*/s//\1/p')
 
 # I disable this because it does not make sense with what we did before (marc)
 # We did exactly set these 26 lines above with these values, and it would break
@@ -237,21 +230,20 @@ ifeq "$(LLVM_LTO)" "1"
     ifeq "$(AFL_REAL_LD)" ""
       ifneq "$(shell readlink $(LLVM_BINDIR)/ld.lld 2>&1)" ""
         AFL_REAL_LD = $(LLVM_BINDIR)/ld.lld
-      else
-        ifneq "$(shell command -v ld.lld 2>/dev/null)" ""
-          AFL_REAL_LD = $(shell command -v ld.lld)
-          TMP_LDLDD_VERSION = $(shell $(AFL_REAL_LD) --version | sed -E -ne '/^.*LLD\ ([12]?[0-9]\.[0-9]\.[0-9]).*/s//\1/p')
-          ifeq "$(LLVMVER)" "$(TMP_LDLDD_VERSION)"
-            $(warning ld.lld found in a weird location ($(AFL_REAL_LD)), but its the same version as LLVM so we will allow it)
-          else
-            $(warning ld.lld found in a weird location ($(AFL_REAL_LD)) and its of a different version than LLMV ($(TMP_LDLDD_VERSION) vs. $(LLVMVER)) - cannot enable LTO mode)
-            AFL_REAL_LD=
-            LLVM_LTO = 0
-          endif
+      else ifneq "$(shell command -v ld.lld 2>/dev/null)" ""
+        AFL_REAL_LD = $(shell command -v ld.lld)
+        TMP_LDLDD_VERSION = $(shell $(AFL_REAL_LD) --version | awk '{ print $$2 }')
+        ifeq "$(LLVMVER)" "$(TMP_LDLDD_VERSION)"
+          $(warning ld.lld found in a weird location ($(AFL_REAL_LD)), but its the same version as LLVM so we will allow it)
         else
-          $(warning ld.lld not found, cannot enable LTO mode)
+          $(warning ld.lld found in a weird location ($(AFL_REAL_LD)) and its of a different version than LLMV ($(TMP_LDLDD_VERSION) vs. $(LLVMVER)) - cannot enable LTO mode)
+          AFL_REAL_LD=
           LLVM_LTO = 0
         endif
+        undefine TMP_LDLDD_VERSION
+      else
+        $(warning ld.lld not found, cannot enable LTO mode)
+        LLVM_LTO = 0
       endif
     endif
   else
@@ -273,7 +265,11 @@ ifeq "$(LLVM_LTO)" "1"
   endif
 endif
 
-IS_IOS          := $(findstring ios, $(shell $(CC) --version 2>/dev/null))
+ifeq "$(shell echo 'int main() {return 0; }' | $(CLANG_BIN) -x c - -fdebug-prefix-map=$(CURDIR)=llvm_mode -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
+        AFL_CLANG_DEBUG_PREFIX = -fdebug-prefix-map="$(CURDIR)=llvm_mode"
+else
+        AFL_CLANG_DEBUG_PREFIX =
+endif
 
 CFLAGS          ?= -O3 -funroll-loops -fPIC
 # -D_FORTIFY_SOURCE=1
@@ -285,15 +281,11 @@ CFLAGS_SAFE     := -Wall -g -Wno-cast-qual -Wno-variadic-macros -Wno-pointer-sig
                    -DAFL_CLANG_FLTO=\"$(AFL_CLANG_FLTO)\" -DAFL_REAL_LD=\"$(AFL_REAL_LD)\" \
                    -DAFL_CLANG_LDPATH=\"$(AFL_CLANG_LDPATH)\" -DAFL_CLANG_FUSELD=\"$(AFL_CLANG_FUSELD)\" \
                    -DCLANG_BIN=\"$(CLANG_BIN)\" -DCLANGPP_BIN=\"$(CLANGPP_BIN)\" -DUSE_BINDIR=$(USE_BINDIR) \
-                   -Wno-unused-function
+                   -Wno-unused-function $(AFL_CLANG_DEBUG_PREFIX)
 ifndef LLVM_DEBUG
   CFLAGS_SAFE += -Wno-deprecated
 endif
 
-ifdef IOS_SDK_PATH
-  override CFLAGS_SAFE += -isysroot $(IOS_SDK_PATH)
-endif
-
 ifdef CODE_COVERAGE
   override CFLAGS_SAFE += -D__AFL_CODE_COVERAGE=1
   override LDFLAGS += -ldl
@@ -311,10 +303,6 @@ override CXXFLAGS += -Wall -g -I ./include/ \
                      -DVERSION=\"$(VERSION)\" -Wno-variadic-macros -Wno-deprecated-copy-with-dtor \
                      -DLLVM_MINOR=$(LLVM_MINOR) -DLLVM_MAJOR=$(LLVM_MAJOR)
 
-ifdef IOS_SDK_PATH
-  override CXXFLAGS += -isysroot $(IOS_SDK_PATH)
-endif
-
 ifneq "$(shell $(LLVM_CONFIG) --includedir) 2> /dev/null" ""
   CLANG_CFL  = -I$(shell $(LLVM_CONFIG) --includedir)
 endif
@@ -332,7 +320,7 @@ endif
 
 # User teor2345 reports that this is required to make things work on MacOS X.
 ifeq "$(SYS)" "Darwin"
-  CLANG_LFL += -Wl,-undefined,dynamic_lookup
+  CLANG_LFL += -Wl,-flat_namespace -Wl,-undefined,suppress
   override LLVM_HAVE_LTO := 0
   override LLVM_LTO := 0
 else
@@ -340,7 +328,7 @@ else
 endif
 
 ifeq "$(SYS)" "OpenBSD"
-  CLANG_LFL += $(LLVM_LIBDIR)/libLLVM.so
+  CLANG_LFL += $$($(LLVM_CONFIG) --libdir)/libLLVM.so
   CLANG_CPPFL += -mno-retpoline
   CFLAGS += -mno-retpoline
   # Needed for unwind symbols
@@ -361,7 +349,7 @@ ifeq "$(TEST_MMAP)" "1"
         LDFLAGS += -Wno-deprecated-declarations
 endif
 
-PROGS_ALWAYS = ./afl-cc ./afl-compiler-rt.o ./afl-compiler-rt-32.o ./afl-compiler-rt-64.o
+PROGS_ALWAYS = ./afl-cc ./afl-compiler-rt.o ./afl-compiler-rt-32.o ./afl-compiler-rt-64.o 
 PROGS        = $(PROGS_ALWAYS) ./afl-llvm-pass.so ./SanitizerCoveragePCGUARD.so ./split-compares-pass.so ./split-switches-pass.so ./cmplog-routines-pass.so ./cmplog-instructions-pass.so ./cmplog-switches-pass.so ./afl-llvm-dict2file.so ./compare-transform-pass.so ./afl-ld-lto ./afl-llvm-lto-instrumentlist.so ./SanitizerCoverageLTO.so ./injection-pass.so
 
 # If prerequisites are not given, warn, do not build anything, and exit with code 0
@@ -436,44 +424,29 @@ ifeq "$(LLVM_LTO)" "1"
 	@ln -sf afl-cc ./afl-lto++
 endif
 endif
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 instrumentation/afl-llvm-common.o: instrumentation/afl-llvm-common.cc instrumentation/afl-llvm-common.h
-	$(CXX) $(CFLAGS) $(CPPFLAGS) $$($(LLVM_CONFIG) --cxxflags) -fno-rtti -fPIC -std=$(LLVM_STDCXX) -c $< -o $@
+	$(CXX) $(CFLAGS) $(CPPFLAGS) $$($(LLVM_CONFIG) --cxxflags) -fno-rtti -fPIC -std=$(LLVM_STDCXX) -c $< -o $@ 
 
 ./afl-llvm-pass.so: instrumentation/afl-llvm-pass.so.cc instrumentation/afl-llvm-common.o | test_deps
 ifeq "$(LLVM_MIN_4_0_1)" "0"
 	$(info [!] N-gram branch coverage instrumentation is not available for llvm version $(LLVMVER))
 endif
 	$(CXX) $(CLANG_CPPFL) -Wdeprecated -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 ./SanitizerCoveragePCGUARD.so: instrumentation/SanitizerCoveragePCGUARD.so.cc instrumentation/afl-llvm-common.o | test_deps
 ifeq "$(LLVM_13_OK)" "1"
 	-$(CXX) $(CLANG_CPPFL) -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) -Wno-deprecated-copy-dtor -Wdeprecated instrumentation/afl-llvm-common.o
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 endif
 
 ./afl-llvm-lto-instrumentlist.so: instrumentation/afl-llvm-lto-instrumentlist.so.cc instrumentation/afl-llvm-common.o
 ifeq "$(LLVM_LTO)" "1"
 	$(CXX) $(CLANG_CPPFL) -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 endif
 
 ./afl-ld-lto: src/afl-ld-lto.c
 ifeq "$(LLVM_LTO)" "1"
-	$(CC) $(CFLAGS) $(CPPFLAGS) $< -o $@ $(LDFLAGS)
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
+	$(CC) $(CFLAGS) $(CPPFLAGS) $< -o $@
 endif
 
 ./SanitizerCoverageLTO.so: instrumentation/SanitizerCoverageLTO.so.cc instrumentation/afl-llvm-common.o
@@ -482,58 +455,31 @@ ifeq "$(LLVM_LTO)" "1"
 	$(CLANG_BIN) $(CFLAGS_SAFE) $(CPPFLAGS) -Wno-unused-result -O0 $(AFL_CLANG_FLTO) -fPIC -c instrumentation/afl-llvm-rt-lto.o.c -o ./afl-llvm-rt-lto.o
 	@$(CLANG_BIN) $(CFLAGS_SAFE) $(CPPFLAGS) -Wno-unused-result -O0 $(AFL_CLANG_FLTO) -m64 -fPIC -c instrumentation/afl-llvm-rt-lto.o.c -o ./afl-llvm-rt-lto-64.o 2>/dev/null; if [ "$$?" = "0" ]; then : ; fi
 	@$(CLANG_BIN) $(CFLAGS_SAFE) $(CPPFLAGS) -Wno-unused-result -O0 $(AFL_CLANG_FLTO) -m32 -fPIC -c instrumentation/afl-llvm-rt-lto.o.c -o ./afl-llvm-rt-lto-32.o 2>/dev/null; if [ "$$?" = "0" ]; then : ; fi
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 endif
 
 # laf
 ./split-switches-pass.so:	instrumentation/split-switches-pass.so.cc instrumentation/afl-llvm-common.o | test_deps
 	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 ./compare-transform-pass.so:	instrumentation/compare-transform-pass.so.cc instrumentation/afl-llvm-common.o | test_deps
 	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 ./split-compares-pass.so:	instrumentation/split-compares-pass.so.cc instrumentation/afl-llvm-common.o | test_deps
 	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 # /laf
 
 ./cmplog-routines-pass.so:	instrumentation/cmplog-routines-pass.cc instrumentation/afl-llvm-common.o | test_deps
 	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 ./cmplog-instructions-pass.so:	instrumentation/cmplog-instructions-pass.cc instrumentation/afl-llvm-common.o | test_deps
 	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 ./cmplog-switches-pass.so:	instrumentation/cmplog-switches-pass.cc instrumentation/afl-llvm-common.o | test_deps
 	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 afl-llvm-dict2file.so:	instrumentation/afl-llvm-dict2file.so.cc instrumentation/afl-llvm-common.o | test_deps
 	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 ./injection-pass.so:	instrumentation/injection-pass.cc instrumentation/afl-llvm-common.o | test_deps
 	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-ifdef IS_IOS
-	@ldid -Sentitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 .PHONY: document
 document:
@@ -555,10 +501,7 @@ document:
 .PHONY: test_build
 test_build: $(PROGS)
 	@echo "[*] Testing the CC wrapper and instrumentation output..."
-	unset AFL_USE_ASAN AFL_USE_MSAN AFL_INST_RATIO AFL_LLVM_ALLOWLIST AFL_LLVM_DENYLIST; ASAN_OPTIONS=detect_leaks=0 AFL_QUIET=1 AFL_PATH=. AFL_LLVM_LAF_ALL=1 ./afl-cc $(CFLAGS) $(CPPFLAGS) ./test-instr.c -o test-instr $(LDFLAGS)
-ifdef IS_IOS
-	@ldid -Sentitlements.plist test-instr && echo "[+] Signed test-instr" || echo "[-] Failed to sign test-instr"
-endif
+	unset AFL_USE_ASAN AFL_USE_MSAN AFL_INST_RATIO; ASAN_OPTIONS=detect_leaks=0 AFL_QUIET=1 AFL_PATH=. AFL_LLVM_LAF_ALL=1 ./afl-cc $(CFLAGS) $(CPPFLAGS) ./test-instr.c -o test-instr $(LDFLAGS)
 	ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr0 ./test-instr < /dev/null
 	echo 1 | ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr1 ./test-instr
 	@rm -f test-instr

README.md

@@ -1,10 +1,10 @@
 # American Fuzzy Lop plus plus (AFL++)
 
-<img align="right" src="https://raw.githubusercontent.com/AFLplusplus/Website/main/static/aflpp_bg.svg" alt="AFL++ logo" width="250" height="250">
+<img align="right" src="https://raw.githubusercontent.com/AFLplusplus/Website/main/static/aflpp_bg.svg" alt="AFL++ logo" width="250" heigh="250">
 
-Release version: [4.32c](https://github.com/AFLplusplus/AFLplusplus/releases)
+Release version: [4.21c](https://github.com/AFLplusplus/AFLplusplus/releases)
 
-GitHub version: 4.33a
+GitHub version: 4.22a
 
 Repository:
 [https://github.com/AFLplusplus/AFLplusplus](https://github.com/AFLplusplus/AFLplusplus)
@@ -16,6 +16,7 @@ AFL++ is maintained by:
 * Andrea Fioraldi <andreafioraldi@gmail.com>
 * Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de>
 * frida_mode is maintained by @Worksbutnottested
+* Documentation: Jana Aydinbas <jana.aydinbas@gmail.com>
 
 Originally developed by Michal "lcamtuf" Zalewski.
 
@@ -229,8 +230,6 @@ Thank you! (For people sending pull requests - please add yourself to this list
     Ruben ten Hove                        Joey Jiao
     fuzzah                                @intrigus-lgtm
     Yaakov Saxon                          Sergej Schumilo
-    Ziqiao Kong                           Ryan Berger
-    Sangjun Park                          Scott Guest
   ```
 
 </details>
@@ -259,5 +258,3 @@ presented at WOOT'20:
   ```
 
 </details>
-
-[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/AFLplusplus/AFLplusplus)

TODO.md

@@ -2,7 +2,6 @@
 
 ## Must
 
- - afl_fsrv_deinit cmplog
  - ijon support?
  - check for null ptr for xml/curl/g_ string transform functions
  - hardened_usercopy=0 page_alloc.shuffle=0

afl-cmin

@@ -1,19 +1,12 @@
 #!/usr/bin/env sh
-THISPATH=`dirname ${0}`
-
-# call afl-cmin.py if it can be executed successfully.
-if $THISPATH/afl-cmin.py --help > /dev/null 2>&1; then
-  exec $THISPATH/afl-cmin.py "$@"
-fi
-
 SYS=$(uname -s)
 test "$SYS" = "Darwin" && {
   echo Error: afl-cmin does not work on Apple currently. please use afl-cmin.bash instead.
   exit 1
 }
-
 export AFL_QUIET=1
 export ASAN_OPTIONS=detect_leaks=0
+THISPATH=`dirname ${0}`
 export PATH="${THISPATH}:$PATH"
 awk -f - -- ${@+"$@"} <<'EOF'
 #!/usr/bin/awk -f
@@ -338,7 +331,7 @@ BEGIN {
   }
 
   if (0 == system ( "grep -aq AFL_DUMP_MAP_SIZE " target_bin )) {
-    print "[!] Trying to obtain the map size of the target ..."
+    echo "[!] Trying to obtain the map size of the target ..."
     get_map_size = "AFL_DUMP_MAP_SIZE=1 " target_bin
     get_map_size | getline mapsize
     close(get_map_size)
@@ -439,7 +432,7 @@ BEGIN {
   } else {
     stat_format = "-f '%z %N'" # *BSD, MacOS
   }
-  cmdline = "(cd "in_dir" && find . \\( ! -name \".*\" -a -type d \\) -o \\( -type f -a ! -name \"cmdline\" -a ! -name \"fastresume.bin\" -a ! -name \"fuzz_bitmap\" -a ! -name \"fuzzer_setup\" -a ! -name \"fuzzer_stats\" -a ! -name \"plot_data\" -a ! -name \"target_hash\" \\) -exec stat "stat_format" \\{\\} + | sort -k1n -k2r) | grep -Ev '^0'"
+  cmdline = "(cd "in_dir" && find . \\( ! -name \".*\" -a -type d \\) -o -type f -exec stat "stat_format" \\{\\} + | sort -k1n -k2r) | grep -Ev '^0'"
   #cmdline = "ls "in_dir" | (cd "in_dir" && xargs stat "stat_format" 2>/dev/null) | sort -k1n -k2r"
   #cmdline = "(cd "in_dir" && stat "stat_format" *) | sort -k1n -k2r"
   #cmdline = "(cd "in_dir" && ls | xargs stat "stat_format" ) | sort -k1n -k2r"

afl-cmin.py

@@ -1,760 +0,0 @@
-#!/usr/bin/env python3
-# Copyright 2016-2025 Google Inc.
-# Copyright 2025 AFLplusplus Project. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-import argparse
-import array
-import base64
-import collections
-import glob
-import hashlib
-import itertools
-import logging
-import multiprocessing
-import os
-import shutil
-import subprocess
-import sys
-
-# https://more-itertools.readthedocs.io/en/stable/_modules/more_itertools/recipes.html#batched
-from sys import hexversion
-
-def _batched(iterable, n, *, strict=False):
-    """Batch data into tuples of length *n*. If the number of items in
-    *iterable* is not divisible by *n*:
-    * The last batch will be shorter if *strict* is ``False``.
-    * :exc:`ValueError` will be raised if *strict* is ``True``.
-
-    >>> list(batched('ABCDEFG', 3))
-    [('A', 'B', 'C'), ('D', 'E', 'F'), ('G',)]
-
-    On Python 3.13 and above, this is an alias for :func:`itertools.batched`.
-    """
-    if n < 1:
-        raise ValueError('n must be at least one')
-    iterator = iter(iterable)
-    while batch := tuple(itertools.islice(iterator, n)):
-        if strict and len(batch) != n:
-            raise ValueError('batched(): incomplete batch')
-        yield batch
-
-
-if hexversion >= 0x30D00A2:  # pragma: no cover
-    from itertools import batched as itertools_batched
-    def batched(iterable, n, *, strict=False):
-        return itertools_batched(iterable, n, strict=strict)
-else:
-    batched = _batched
-
-    batched.__doc__ = _batched.__doc__
-
-try:
-    from tqdm import tqdm
-except ImportError:
-    print('Hint: install python module "tqdm" to show progress bar')
-
-    class tqdm:
-
-        def __init__(self, data=None, *args, **argd):
-            self.data = data
-
-        def __iter__(self):
-            yield from self.data
-
-        def __enter__(self):
-            return self
-
-        def __exit__(self, exc_type, exc_value, traceback):
-            pass
-
-        def update(self, *args):
-            pass
-
-
-parser = argparse.ArgumentParser()
-
-cpu_count = multiprocessing.cpu_count()
-group = parser.add_argument_group("Required parameters")
-group.add_argument(
-    "-i",
-    dest="input",
-    action="append",
-    metavar="dir",
-    required=True,
-    help="input directory with the starting corpus",
-)
-group.add_argument(
-    "-o",
-    dest="output",
-    metavar="dir",
-    required=True,
-    help="output directory for minimized files",
-)
-
-group = parser.add_argument_group("Execution control settings")
-group.add_argument(
-    "-f",
-    dest="stdin_file",
-    metavar="file",
-    help="location read by the fuzzed program (stdin)",
-)
-group.add_argument(
-    "-m",
-    dest="memory_limit",
-    default="none",
-    metavar="megs",
-    type=lambda x: x if x == "none" else int(x),
-    help="memory limit for child process (default: %(default)s)",
-)
-group.add_argument(
-    "-t",
-    dest="time_limit",
-    default=5000,
-    metavar="msec",
-    type=lambda x: x if x == "none" else int(x),
-    help="timeout for each run (default: %(default)s)",
-)
-group.add_argument(
-    "-O",
-    dest="frida_mode",
-    action="store_true",
-    default=False,
-    help="use binary-only instrumentation (FRIDA mode)",
-)
-group.add_argument(
-    "-Q",
-    dest="qemu_mode",
-    action="store_true",
-    default=False,
-    help="use binary-only instrumentation (QEMU mode)",
-)
-group.add_argument(
-    "-U",
-    dest="unicorn_mode",
-    action="store_true",
-    default=False,
-    help="use unicorn-based instrumentation (Unicorn mode)",
-)
-group.add_argument(
-    "-X", dest="nyx_mode", action="store_true", default=False, help="use Nyx mode"
-)
-
-group = parser.add_argument_group("Minimization settings")
-group.add_argument(
-    "--crash-dir",
-    dest="crash_dir",
-    metavar="dir",
-    default=None,
-    help="move crashes to a separate dir, always deduplicated",
-)
-group.add_argument(
-    "-A",
-    dest="allow_any",
-    action="store_true",
-    help="allow crashes and timeouts (not recommended)",
-)
-group.add_argument(
-    "-C",
-    dest="crash_only",
-    action="store_true",
-    help="keep crashing inputs, reject everything else",
-)
-group.add_argument(
-    "-e",
-    dest="edge_mode",
-    action="store_true",
-    default=False,
-    help="solve for edge coverage only, ignore hit counts",
-)
-
-group = parser.add_argument_group("Misc")
-group.add_argument(
-    "-T",
-    dest="workers",
-    type=lambda x: cpu_count if x == "all" else int(x),
-    default=1,
-    help="number of concurrent worker (default: %(default)d)",
-)
-group.add_argument(
-    "--as_queue",
-    action="store_true",
-    help='output file name like "id:000000,hash:value"',
-)
-group.add_argument(
-    "--no-dedup", action="store_true", help="skip deduplication step for corpus files"
-)
-group.add_argument("--debug", action="store_true")
-
-parser.add_argument("exe", metavar="/path/to/target_app")
-parser.add_argument("args", nargs="*")
-
-args = parser.parse_args()
-logger = None
-afl_showmap_bin = None
-tuple_index_type_code = "I"
-file_index_type_code = None
-
-
-def init():
-    global logger
-    log_level = logging.DEBUG if args.debug else logging.INFO
-    logging.basicConfig(
-        level=log_level, format="%(asctime)s - %(levelname)s - %(message)s"
-    )
-    logger = logging.getLogger(__name__)
-
-    if args.stdin_file and args.workers > 1:
-        logger.error("-f is only supported with one worker (-T 1)")
-        sys.exit(1)
-
-    if args.memory_limit != "none" and args.memory_limit < 5:
-        logger.error("dangerously low memory limit")
-        sys.exit(1)
-
-    if args.time_limit != "none" and args.time_limit < 10:
-        logger.error("dangerously low timeout")
-        sys.exit(1)
-
-    if not os.path.isfile(args.exe):
-        logger.error('binary "%s" not found or not regular file', args.exe)
-        sys.exit(1)
-
-    if not os.environ.get("AFL_SKIP_BIN_CHECK") and not any(
-        [args.qemu_mode, args.frida_mode, args.unicorn_mode, args.nyx_mode]
-    ):
-        if b"__AFL_SHM_ID" not in open(args.exe, "rb").read():
-            logger.error("binary '%s' doesn't appear to be instrumented", args.exe)
-            sys.exit(1)
-
-    for dn in args.input:
-        if not os.path.isdir(dn) and not glob.glob(dn):
-            logger.error('directory "%s" not found', dn)
-            sys.exit(1)
-
-    global afl_showmap_bin
-    searches = [
-        None,
-        os.path.dirname(__file__),
-        os.getcwd(),
-    ]
-    if os.environ.get("AFL_PATH"):
-        searches.append(os.environ["AFL_PATH"])
-
-    for search in searches:
-        afl_showmap_bin = shutil.which("afl-showmap", path=search)
-        if afl_showmap_bin:
-            break
-    if not afl_showmap_bin:
-        logger.fatal("cannot find afl-showmap, please set AFL_PATH")
-        sys.exit(1)
-
-    trace_dir = os.path.join(args.output, ".traces")
-    shutil.rmtree(trace_dir, ignore_errors=True)
-    try:
-        os.rmdir(args.output)
-    except OSError:
-        pass
-    if os.path.exists(args.output):
-        logger.error(
-            'directory "%s" exists and is not empty - delete it first', args.output
-        )
-        sys.exit(1)
-    if args.crash_dir and not os.path.exists(args.crash_dir):
-        os.makedirs(args.crash_dir)
-    os.makedirs(trace_dir)
-
-    logger.info("use %d workers (-T)", args.workers)
-
-
-def detect_type_code(size):
-    for type_code in ["B", "H", "I", "L", "Q"]:
-        if 256 ** array.array(type_code).itemsize > size:
-            return type_code
-
-
-def afl_showmap(input_path=None, batch=None, afl_map_size=None, first=False):
-    assert input_path or batch
-    # yapf: disable
-    cmd = [
-        afl_showmap_bin,
-        '-m', str(args.memory_limit),
-        '-t', str(args.time_limit),
-        '-Z', # cmin mode
-    ]
-    # yapf: enable
-    found_atat = False
-    for arg in args.args:
-        if "@@" in arg:
-            found_atat = True
-
-    if args.stdin_file:
-        assert args.workers == 1
-        input_from_file = True
-        stdin_file = args.stdin_file
-        cmd += ["-H", stdin_file]
-    elif found_atat:
-        input_from_file = True
-        stdin_file = os.path.join(args.output, f".input.{os.getpid()}")
-        cmd += ["-H", stdin_file]
-    else:
-        input_from_file = False
-
-    if batch:
-        input_from_file = True
-        filelist = os.path.join(args.output, f".filelist.{os.getpid()}")
-        with open(filelist, "w") as f:
-            for _, path in batch:
-                f.write(path + "\n")
-        cmd += ["-I", filelist]
-        output_path = os.path.join(args.output, f".showmap.{os.getpid()}")
-        cmd += ["-o", output_path]
-    else:
-        if input_from_file:
-            shutil.copy(input_path, stdin_file)
-        cmd += ["-o", "-"]
-
-    if args.frida_mode:
-        cmd += ["-O"]
-    if args.qemu_mode:
-        cmd += ["-Q"]
-    if args.unicorn_mode:
-        cmd += ["-U"]
-    if args.nyx_mode:
-        cmd += ["-X"]
-    if args.edge_mode:
-        cmd += ["-e"]
-    cmd += ["--", args.exe] + args.args
-
-    env = os.environ.copy()
-    env["AFL_QUIET"] = "1"
-    env["ASAN_OPTIONS"] = "detect_leaks=0"
-    if first:
-        logger.debug("run command line: %s", subprocess.list2cmdline(cmd))
-        env["AFL_CMIN_ALLOW_ANY"] = "1"
-    if afl_map_size:
-        env["AFL_MAP_SIZE"] = str(afl_map_size)
-    if args.crash_only:
-        env["AFL_CMIN_CRASHES_ONLY"] = "1"
-    if args.allow_any:
-        env["AFL_CMIN_ALLOW_ANY"] = "1"
-
-    if input_from_file:
-        p = subprocess.Popen(cmd, stdout=subprocess.PIPE, env=env, bufsize=1048576)
-    else:
-        p = subprocess.Popen(
-            cmd,
-            stdin=open(input_path, "rb"),
-            stdout=subprocess.PIPE,
-            env=env,
-            bufsize=1048576,
-        )
-    out = p.stdout.read()
-    p.wait()
-
-    if batch:
-        result = []
-        for idx, input_path in batch:
-            basename = os.path.basename(input_path)
-            values = []
-            try:
-                trace_file = os.path.join(output_path, basename)
-                with open(trace_file, "r") as f:
-                    values = list(map(int, f))
-                crashed = len(values) == 0
-                os.unlink(trace_file)
-            except FileNotFoundError:
-                a = None
-                crashed = True
-            values = [(t // 1000) * 9 + t % 1000 for t in values]
-            a = array.array(tuple_index_type_code, values)
-            result.append((idx, a, crashed))
-        os.unlink(filelist)
-        os.rmdir(output_path)
-        return result
-    else:
-        values = []
-        for line in out.split():
-            if not line.isdigit():
-                continue
-            values.append(int(line))
-        values = [(t // 1000) * 9 + t % 1000 for t in values]
-        a = array.array(tuple_index_type_code, values)
-        crashed = p.returncode in [2, 3]
-        if input_from_file and stdin_file != args.stdin_file:
-            os.unlink(stdin_file)
-        return a, crashed
-
-
-class JobDispatcher(multiprocessing.Process):
-
-    def __init__(self, job_queue, jobs):
-        super().__init__()
-        self.job_queue = job_queue
-        self.jobs = jobs
-
-    def run(self):
-        for job in self.jobs:
-            self.job_queue.put(job)
-        self.job_queue.close()
-
-
-class Worker(multiprocessing.Process):
-
-    def __init__(self, idx, afl_map_size, q_in, p_out, r_out):
-        super().__init__()
-        self.idx = idx
-        self.afl_map_size = afl_map_size
-        self.q_in = q_in
-        self.p_out = p_out
-        self.r_out = r_out
-
-    def run(self):
-        map_size = self.afl_map_size or 65536
-        max_tuple = map_size * 9
-        max_file_index = 256 ** array.array(file_index_type_code).itemsize - 1
-        m = array.array(file_index_type_code, [max_file_index] * max_tuple)
-        counter = collections.Counter()
-        crashes = []
-
-        pack_name = os.path.join(args.output, ".traces", f"{self.idx}.pack")
-        pack_pos = 0
-        with open(pack_name, "wb") as trace_pack:
-            while True:
-                batch = self.q_in.get()
-                if batch is None:
-                    break
-
-                for idx, r, crash in afl_showmap(
-                    batch=batch, afl_map_size=self.afl_map_size
-                ):
-                    counter.update(r)
-
-                    used = False
-
-                    if crash:
-                        crashes.append(idx)
-
-                    # If we aren't saving crashes to a separate dir, handle them
-                    # the same as other inputs. However, unless AFL_CMIN_ALLOW_ANY=1,
-                    # afl_showmap will not return any coverage for crashes so they will
-                    # never be retained.
-                    if not crash or not args.crash_dir:
-                        for t in r:
-                            if idx < m[t]:
-                                m[t] = idx
-                                used = True
-
-                    if used:
-                        tuple_count = len(r)
-                        r.tofile(trace_pack)
-                        self.p_out.put((idx, self.idx, pack_pos, tuple_count))
-                        pack_pos += tuple_count * r.itemsize
-                    else:
-                        self.p_out.put(None)
-
-        self.r_out.put((self.idx, m, counter, crashes))
-
-
-class CombineTraceWorker(multiprocessing.Process):
-
-    def __init__(self, pack_name, jobs, r_out):
-        super().__init__()
-        self.pack_name = pack_name
-        self.jobs = jobs
-        self.r_out = r_out
-
-    def run(self):
-        already_have = set()
-        with open(self.pack_name, "rb") as f:
-            for pos, tuple_count in self.jobs:
-                f.seek(pos)
-                result = array.array(tuple_index_type_code)
-                result.fromfile(f, tuple_count)
-                already_have.update(result)
-        self.r_out.put(already_have)
-
-
-def hash_file(path):
-    m = hashlib.sha1()
-    with open(path, "rb") as f:
-        m.update(f.read())
-    return m.digest()
-
-
-def dedup(files):
-    with multiprocessing.Pool(args.workers) as pool:
-        seen_hash = set()
-        result = []
-        hash_list = []
-        # use large chunksize to reduce multiprocessing overhead
-        chunksize = max(1, min(256, len(files) // args.workers))
-        for i, h in enumerate(
-            tqdm(
-                pool.imap(hash_file, files, chunksize),
-                desc="dedup",
-                total=len(files),
-                ncols=0,
-                leave=(len(files) > 100000),
-            )
-        ):
-            if h in seen_hash:
-                continue
-            seen_hash.add(h)
-            result.append(files[i])
-            hash_list.append(h)
-        return result, hash_list
-
-
-def is_afl_dir(dirnames, filenames):
-    return (
-        "queue" in dirnames
-        and "hangs" in dirnames
-        and "crashes" in dirnames
-        and "fuzzer_setup" in filenames
-    )
-
-
-def collect_files(input_paths):
-    paths = []
-    for s in input_paths:
-        paths += glob.glob(s)
-
-    files = []
-    with tqdm(desc="search", unit=" files", ncols=0) as pbar:
-        for path in paths:
-            for root, dirnames, filenames in os.walk(path, followlinks=True):
-                for dirname in dirnames:
-                    if dirname.startswith("."):
-                        dirnames.remove(dirname)
-
-                if not args.crash_only and is_afl_dir(dirnames, filenames):
-                    continue
-
-                for filename in filenames:
-                    if filename.startswith("."):
-                        continue
-                    pbar.update(1)
-                    files.append(os.path.join(root, filename))
-    return files
-
-
-def main():
-    init()
-
-    files = collect_files(args.input)
-    if len(files) == 0:
-        logger.error("no inputs in the target directory - nothing to be done")
-        sys.exit(1)
-    logger.info("Found %d input files in %d directories", len(files), len(args.input))
-
-    if not args.no_dedup:
-        files, hash_list = dedup(files)
-        logger.info("Remain %d files after dedup", len(files))
-    else:
-        logger.info("Skipping file deduplication.")
-
-    global file_index_type_code
-    file_index_type_code = detect_type_code(len(files))
-
-    logger.info("Sorting files.")
-    with multiprocessing.Pool(args.workers) as pool:
-        chunksize = max(1, min(512, len(files) // args.workers))
-        size_list = list(pool.map(os.path.getsize, files, chunksize))
-    idxes = sorted(range(len(files)), key=lambda x: size_list[x])
-    files = [files[idx] for idx in idxes]
-    hash_list = [hash_list[idx] for idx in idxes]
-
-    afl_map_size = None
-    if b"AFL_DUMP_MAP_SIZE" in open(args.exe, "rb").read():
-        output = subprocess.run(
-            [args.exe], capture_output=True, env={"AFL_DUMP_MAP_SIZE": "1", "ASAN_OPTIONS": "detect_leaks=0"}
-        ).stdout
-        afl_map_size = int(output)
-        logger.info("Setting AFL_MAP_SIZE=%d", afl_map_size)
-
-        global tuple_index_type_code
-        tuple_index_type_code = detect_type_code(afl_map_size * 9)
-
-    logger.info("Testing the target binary")
-    tuples, _ = afl_showmap(files[0], afl_map_size=afl_map_size, first=True)
-    if tuples:
-        logger.info("ok, %d tuples recorded", len(tuples))
-    else:
-        logger.error("no instrumentation output detected")
-        sys.exit(1)
-
-    job_queue = multiprocessing.Queue()
-    progress_queue = multiprocessing.Queue()
-    result_queue = multiprocessing.Queue()
-
-    workers = []
-    for i in range(args.workers):
-        p = Worker(i, afl_map_size, job_queue, progress_queue, result_queue)
-        p.start()
-        workers.append(p)
-
-    chunk = max(1, min(128, len(files) // args.workers))
-    jobs = list(batched(enumerate(files), chunk))
-    jobs += [None] * args.workers  # sentinel
-
-    dispatcher = JobDispatcher(job_queue, jobs)
-    dispatcher.start()
-
-    logger.info("Processing traces")
-    effective = 0
-    trace_info = {}
-    for _ in tqdm(files, ncols=0, smoothing=0.01):
-        r = progress_queue.get()
-        if r is not None:
-            idx, worker_idx, pos, tuple_count = r
-            trace_info[idx] = worker_idx, pos, tuple_count
-            effective += 1
-    dispatcher.join()
-
-    logger.info("Obtaining trace results")
-    ms = []
-    crashes = []
-    counter = collections.Counter()
-    for _ in tqdm(range(args.workers), ncols=0):
-        idx, m, c, crs = result_queue.get()
-        ms.append(m)
-        counter.update(c)
-        crashes.extend(crs)
-        workers[idx].join()
-    best_idxes = list(map(min, zip(*ms)))
-
-    if not args.crash_dir:
-        logger.info(
-            "Found %d unique tuples across %d files (%d effective)",
-            len(counter),
-            len(files),
-            effective,
-        )
-    else:
-        logger.info(
-            "Found %d unique tuples across %d files (%d effective, %d crashes)",
-            len(counter),
-            len(files),
-            effective,
-            len(crashes),
-        )
-    all_unique = counter.most_common()
-
-    logger.info("Processing candidates and writing output")
-    already_have = set()
-    count = 0
-
-    def save_file(idx):
-        input_path = files[idx]
-        fn = (
-            base64.b16encode(hash_list[idx]).decode("utf8").lower()
-            if not args.no_dedup
-            else os.path.basename(input_path)
-        )
-        if args.as_queue:
-            if args.no_dedup:
-                fn = "id:%06d,orig:%s" % (count, fn)
-            else:
-                fn = "id:%06d,hash:%s" % (count, fn)
-        output_path = os.path.join(args.output, fn)
-        try:
-            os.link(input_path, output_path)
-        except OSError:
-            shutil.copy(input_path, output_path)
-
-    jobs = [[] for i in range(args.workers)]
-    saved = set()
-    for t, c in all_unique:
-        if c != 1:
-            continue
-        idx = best_idxes[t]
-        if idx in saved:
-            continue
-        save_file(idx)
-        saved.add(idx)
-        count += 1
-
-        worker_idx, pos, tuple_count = trace_info[idx]
-        job = (pos, tuple_count)
-        jobs[worker_idx].append(job)
-
-    trace_packs = []
-    workers = []
-    for i in range(args.workers):
-        pack_name = os.path.join(args.output, ".traces", f"{i}.pack")
-        trace_f = open(pack_name, "rb")
-        trace_packs.append(trace_f)
-
-        p = CombineTraceWorker(pack_name, jobs[i], result_queue)
-        p.start()
-        workers.append(p)
-
-    for _ in range(args.workers):
-        result = result_queue.get()
-        already_have.update(result)
-
-    for t, c in tqdm(list(reversed(all_unique)), ncols=0):
-        if t in already_have:
-            continue
-
-        idx = best_idxes[t]
-        save_file(idx)
-        count += 1
-
-        worker_idx, pos, tuple_count = trace_info[idx]
-        trace_pack = trace_packs[worker_idx]
-        trace_pack.seek(pos)
-        result = array.array(tuple_index_type_code)
-        result.fromfile(trace_pack, tuple_count)
-
-        already_have.update(result)
-
-    for f in trace_packs:
-        f.close()
-
-    if args.crash_dir:
-        logger.info("Saving crashes to %s", args.crash_dir)
-        crash_files = [files[c] for c in crashes]
-
-        if args.no_dedup:
-            # Unless we deduped previously, we have to dedup the crash files
-            # now.
-            crash_files, hash_list = dedup(crash_files)
-
-        for idx, crash_path in enumerate(crash_files):
-            fn = base64.b16encode(hash_list[idx]).decode("utf8").lower()
-            output_path = os.path.join(args.crash_dir, fn)
-            try:
-                os.link(crash_path, output_path)
-            except OSError:
-                try:
-                    shutil.copy(crash_path, output_path)
-                except shutil.Error:
-                    # This error happens when src and dest are hardlinks of the
-                    # same file. We have nothing to do in this case, but handle
-                    # it gracefully.
-                    pass
-
-    if count == 1:
-        logger.warning("all test cases had the same traces, check syntax!")
-    logger.info('narrowed down to %s files, saved in "%s"', count, args.output)
-    if not os.environ.get("AFL_KEEP_TRACES"):
-        logger.info("Deleting trace files")
-        trace_dir = os.path.join(args.output, ".traces")
-        shutil.rmtree(trace_dir, ignore_errors=True)
-
-
-if __name__ == "__main__":
-    main()

afl-persistent-config

@@ -121,7 +121,6 @@ kernel.sched_child_runs_first=1
 kernel.sched_autogroup_enabled=1
 kernel.sched_migration_cost_ns=50000000
 kernel.sched_latency_ns=250000000
-vm.swappiness=10
 EOF
   }
 
@@ -130,7 +129,7 @@ EOF
     if ! grep -E "^$KEY=" /etc/default/grub | grep -E -q 'noibrs pcid nopti'; then
       echo "Configuring performance boot options"
       LINE=`grep -E "^$KEY=" /etc/default/grub | sed "s/^$KEY=//" | tr -d '"'`
-      OPTIONS="$LINE ibpb=off ibrs=off kpti=off l1tf=off spec_rstack_overflow=off mds=off nokaslr no_stf_barrier noibpb noibrs pcid nopti nospec_store_bypass_disable nospectre_v1 nospectre_v2 pcid=on pti=off spec_store_bypass_disable=off spectre_v2=off stf_barrier=off srbds=off noexec=off noexec32=off tsx=on tsx=on tsx_async_abort=off mitigations=off audit=0 hardened_usercopy=off ssbd=force-off"
+      OPTIONS="$LINE ibpb=off ibrs=off kpti=off l1tf=off spec_rstack_overflow=off mds=off no_stf_barrier noibpb noibrs pcid nopti nospec_store_bypass_disable nospectre_v1 nospectre_v2 pcid=on pti=off spec_store_bypass_disable=off spectre_v2=off stf_barrier=off srbds=off noexec=off noexec32=off tsx=on tsx=on tsx_async_abort=off mitigations=off audit=0 hardened_usercopy=off ssbd=force-off"
       echo Setting boot options in /etc/default/grub to $KEY=\"$OPTIONS\"
       sed -i "s|^$KEY=.*|$KEY=\"$OPTIONS\"|" /etc/default/grub
     fi

afl-system-config

@@ -41,7 +41,6 @@ if [ "$PLATFORM" = "Linux" ] ; then
   sysctl -w kernel.sched_autogroup_enabled=1
   sysctl -w kernel.sched_migration_cost_ns=50000000 2>/dev/null
   sysctl -w kernel.sched_latency_ns=250000000 2>/dev/null
-  sysctl -w vm.swappiness=10 2>/dev/null
   echo never > /sys/kernel/mm/transparent_hugepage/enabled
   test -e /sys/devices/system/cpu/cpufreq/scaling_governor && echo performance | tee /sys/devices/system/cpu/cpufreq/scaling_governor
   test -e /sys/devices/system/cpu/cpufreq/policy0/scaling_governor && echo performance | tee /sys/devices/system/cpu/cpufreq/policy*/scaling_governor
@@ -55,7 +54,7 @@ if [ "$PLATFORM" = "Linux" ] ; then
   echo
   dmesg | grep -E -q 'noibrs pcid nopti' || {
     echo It is recommended to boot the kernel with lots of security off - if you are running a machine that is in a secured network - so set this:
-    echo '  /etc/default/grub:GRUB_CMDLINE_LINUX_DEFAULT="ibpb=off ibrs=off kpti=off l1tf=off spec_rstack_overflow=off mds=off nokaslr no_stf_barrier noibpb noibrs pcid nopti nospec_store_bypass_disable nospectre_v1 nospectre_v2 pcid=on pti=off spec_store_bypass_disable=off spectre_v2=off stf_barrier=off srbds=off noexec=off noexec32=off tsx=on tsx=on tsx_async_abort=off mitigations=off audit=0 hardened_usercopy=off ssbd=force-off"'
+    echo '  /etc/default/grub:GRUB_CMDLINE_LINUX_DEFAULT="ibpb=off ibrs=off kpti=0 l1tf=off mds=off mitigations=off no_stf_barrier noibpb noibrs pcid nopti nospec_store_bypass_disable nospectre_v1 nospectre_v2 pcid=on pti=off spec_store_bypass_disable=off spectre_v2=off stf_barrier=off srbds=off noexec=off noexec32=off tsx=on tsx_async_abort=off arm64.nopauth audit=0 hardened_usercopy=off ssbd=force-off"'
     echo
   }
   echo If you run fuzzing instances in docker, run them with \"--security-opt seccomp=unconfined\" for more speed.

afl-whatsup

@@ -112,12 +112,12 @@ if [ -z "$NO_COLOR" ]; then
 fi
 
 PLATFORM=`uname -s`
-#if [ "$PLATFORM" = "Linux" ] ; then
-#  CUR_TIME=`cat /proc/uptime | awk '{printf "%.0f\n", $1}'`
-#else
-  # This will lead to inaccurate results but will prevent the script from breaking on platforms other than Linux
+if [ "$PLATFORM" = "Linux" ] ; then
+  CUR_TIME=`cat /proc/uptime | awk '{printf "%.0f\n", $1}'`
+else
+  # This will lead to inacurate results but will prevent the script from breaking on platforms other than Linux
   CUR_TIME=`date +%s`
-#fi
+fi
 
 TMP=`mktemp -t .afl-whatsup-XXXXXXXX` || TMP=`mktemp -p /data/local/tmp .afl-whatsup-XXXXXXXX` || TMP=`mktemp -p /data/local/tmp .afl-whatsup-XXXXXXXX` || exit 1
 trap "rm -f $TMP" 1 2 3 13 15

benchmark/COMPARISON.md

@@ -11,4 +11,3 @@
 |AMD Ryzen 9 6900HS with Radeon Graphics             | 4745  | 16      | 135501     | 991133    | both         |
 |AMD Ryzen 9 7950X3D 16-Core Processor               | 5400  | 32      | 71566      | 1566279   | system       |
 |AMD Ryzen 9 7950X3D 16-Core Processor               | 5478  | 32      | 161960     | 2173959   | both         |
-|Ampere Altra Q80-30                                 | 0     | 80      | 54477      | 1604482   | system       |

custom_mutators/aflpp/README.md

@@ -1,4 +1,4 @@
-# custom mutator: AFL++
+# custum mutator: AFL++
 
 this is the AFL++ havoc mutator as a custom mutator module for AFL++.
 

custom_mutators/aflpp/standalone/Makefile

@@ -4,7 +4,7 @@ CFLAGS = -O3 -funroll-loops -fPIC
 all: aflpp-standalone
 
 aflpp-standalone:	aflpp-standalone.c
-	$(CC) $(CFLAGS) -w -DBIN_PATH=\"foo\" -I../../../include -I. -o aflpp-standalone aflpp-standalone.c ../../../src/afl-performance.c ../../../src/afl-fuzz-extras.c ../../../src/afl-common.c
+	$(CC) $(CFLAGS) -I../../../include -I. -o aflpp-standalone aflpp-standalone.c ../../../src/afl-performance.c
 
 clean:
 	rm -f *.o *~ aflpp-standalone core

custom_mutators/aflpp/standalone/README.md

@@ -5,6 +5,6 @@ this is the AFL++ havoc mutator as a standalone mutator
 just type `make` to build.
 
 ```
-aflpp-standalone -h # to see all parameteres
-cat file | aflpp-standalone -m 4 -x foo.dict - outputfile splicefile # example
+aflpp-standalone inputfile outputfile [splicefile]
 ```
+

custom_mutators/aflpp/standalone/aflpp-standalone.c

@@ -1,12 +1,6 @@
 #include "afl-fuzz.h"
 #include "afl-mutations.h"
 
-#include <unistd.h>
-#include <getopt.h>
-
-static int            max_havoc = 16, verbose;
-static unsigned char *dict;
-
 typedef struct my_mutator {
 
   afl_state_t *afl;
@@ -27,14 +21,14 @@ my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
 
   }
 
-  if ((data->buf = malloc(1024 * 1024)) == NULL) {
+  if ((data->buf = malloc(1024*1024)) == NULL) {
 
     perror("afl_custom_init alloc");
     return NULL;
 
   } else {
 
-    data->buf_size = 1024 * 1024;
+    data->buf_size = 1024*1024;
 
   }
 
@@ -42,23 +36,9 @@ my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
   data->afl = calloc(1, sizeof(afl_state_t));
   data->afl->queue_cycle = 1;
   data->afl->fsrv.dev_urandom_fd = open("/dev/urandom", O_RDONLY);
-  if (data->afl->fsrv.dev_urandom_fd < 0) {
-
-    PFATAL("Unable to open /dev/urandom");
-
-  }
-
+  if (data->afl->fsrv.dev_urandom_fd < 0) { PFATAL("Unable to open /dev/urandom"); }
   rand_set_seed(data->afl, getpid());
 
-  if (dict) {
-
-    load_extras(data->afl, dict);
-    if (verbose)
-      fprintf(stderr, "Loaded dictionary: %s (%u entries)\n", dict,
-              data->afl->extras_cnt);
-
-  }
-
   return data;
 
 }
@@ -86,20 +66,14 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
 
   }
 
-  u32 havoc_steps = 1 + rand_below(data->afl, max_havoc);
-  if (verbose) fprintf(stderr, "Havoc steps: %u\n", havoc_steps);
+  u32 havoc_steps = 1 + rand_below(data->afl, 16);
 
   /* set everything up, costly ... :( */
   memcpy(data->buf, buf, buf_size);
 
   /* the mutation */
-  u32 out_buf_len;
-  do {
-
-    out_buf_len = afl_mutate(data->afl, data->buf, buf_size, havoc_steps, false,
-                             true, add_buf, add_buf_size, max_size);
-
-  } while (out_buf_len == buf_size && memcmp(buf, data->buf, buf_size) == 0);
+  u32 out_buf_len = afl_mutate(data->afl, data->buf, buf_size, havoc_steps,
+                               false, true, add_buf, add_buf_size, max_size);
 
   /* return size of mutated data */
   *out_buf = data->buf;
@@ -110,143 +84,80 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
 int main(int argc, char *argv[]) {
 
   if (argc > 1 && strncmp(argv[1], "-h", 2) == 0) {
-
-    printf(
-        "Syntax: %s [-v] [-m maxmutations] [-x dict] [inputfile [outputfile "
-        "[splicefile]]]\n\n",
-        argv[0]);
-    printf(
-        "Reads a testcase from stdin when no input file (or '-') is "
-        "specified,\n");
-    printf(
-        "mutates according to AFL++'s mutation engine, and write to stdout "
-        "when '-' or\n");
-    printf(
-        "no output filename is given. As an optional third parameter you can "
-        "give a file\n");
+    printf("Syntax: %s [-v] [inputfile [outputfile [splicefile]]]\n\n", argv[0]);
+    printf("Reads a testcase from stdin when no input file (or '-') is specified,\n");
+    printf("mutates according to AFL++'s mutation engine, and write to stdout when '-' or\n");
+    printf("no output filename is given. As an optional third parameter you can give a file\n");
     printf("for splicing. Maximum input and output length is 1MB.\n");
-    printf("Options:\n");
-    printf("  -v      verbose debug output to stderr.\n");
-    printf("  -m val  max mutations (1-val, val default is 16)\n");
-    printf("  -x file dictionary file (AFL++ format)\n");
+    printf("The -v verbose option prints debug output to stderr.\n");
     return 0;
-
   }
 
-  FILE          *in = stdin, *out = stdout, *splice = NULL;
-  unsigned char *inbuf = malloc(1024 * 1024), *outbuf = NULL, *splicebuf = NULL;
-  int            splicelen = 0, opt;
-
-  while ((opt = getopt(argc, argv, "vm:x:")) > 0) {
-
-    switch (opt) {
-
-      case 'm':
-        max_havoc = atoi(optarg);
-        break;
-      case 'v':
-        verbose = 1;
-        break;
-      case 'x':
-        dict = optarg;
-        break;
-      default:
-        fprintf(stderr, "Error: unknown parameter -%c\n", opt);
-        exit(-1);
-
-    }
-
-  }
-
-  if (max_havoc < 1) {
-
-    fprintf(stderr, "Error: illegal -m value\n");
-    exit(-1);
+  FILE *in = stdin, *out = stdout, *splice = NULL;
+  unsigned char *inbuf = malloc(1024 * 1024), *outbuf, *splicebuf = NULL;
+  int verbose = 0, splicelen = 0;
 
+  if (argc > 1 && strcmp(argv[1], "-v") == 0) {
+    verbose = 1;
+    argc--;
+    argv++;
+    fprintf(stderr, "Verbose active\n");
   }
 
   my_mutator_t *data = afl_custom_init(NULL, 0);
 
-  if (argc > optind && strcmp(argv[optind], "-") != 0) {
-
-    if ((in = fopen(argv[optind], "r")) == NULL) {
-
+  if (argc > 1 && strcmp(argv[1], "-") != 0) {
+    if ((in = fopen(argv[1], "r")) == NULL) {
       perror(argv[1]);
       return -1;
-
     }
-
-    if (verbose) fprintf(stderr, "Input: %s\n", argv[optind]);
-
+    if (verbose) fprintf(stderr, "Input: %s\n", argv[1]);
   }
 
-  size_t inlen = fread(inbuf, 1, 1024 * 1024, in);
-
+  size_t inlen = fread(inbuf, 1, 1024*1024, in);
+  
   if (!inlen) {
-
-    fprintf(stderr, "Error: empty file %s\n",
-            argv[optind] ? argv[optind] : "stdin");
+    fprintf(stderr, "Error: empty file %s\n", argv[1] ? argv[1] : "stdin");
     return -1;
-
   }
 
-  if (argc > optind + 1 && strcmp(argv[optind + 1], "-") != 0) {
-
-    if ((out = fopen(argv[optind + 1], "w")) == NULL) {
-
-      perror(argv[optind + 1]);
+  if (argc > 2 && strcmp(argv[2], "-") != 0) {
+    if ((out = fopen(argv[2], "w")) == NULL) {
+      perror(argv[2]);
       return -1;
-
     }
-
-    if (verbose) fprintf(stderr, "Output: %s\n", argv[optind + 1]);
-
+    if (verbose) fprintf(stderr, "Output: %s\n", argv[2]);
   }
 
-  if (argc > optind + 2) {
-
-    if ((splice = fopen(argv[optind + 2], "r")) == NULL) {
-
-      perror(argv[optind + 2]);
+  if (argc > 3) {
+    if ((splice = fopen(argv[3], "r")) == NULL) {
+      perror(argv[3]);
       return -1;
-
     }
-
-    if (verbose) fprintf(stderr, "Splice: %s\n", argv[optind + 2]);
-    splicebuf = malloc(1024 * 1024);
-    size_t splicelen = fread(splicebuf, 1, 1024 * 1024, splice);
+    if (verbose) fprintf(stderr, "Splice: %s\n", argv[3]);
+    splicebuf = malloc(1024*1024);
+    size_t splicelen = fread(splicebuf, 1, 1024*1024, splice);
     if (!splicelen) {
-
-      fprintf(stderr, "Error: empty file %s\n", argv[optind + 2]);
+      fprintf(stderr, "Error: empty file %s\n", argv[3]);
       return -1;
-
     }
-
     if (verbose) fprintf(stderr, "Mutation splice length: %zu\n", splicelen);
-
   }
 
   if (verbose) fprintf(stderr, "Mutation input length: %zu\n", inlen);
-  unsigned int outlen = afl_custom_fuzz(data, inbuf, inlen, &outbuf, splicebuf,
-                                        splicelen, 1024 * 1024);
+  unsigned int outlen = afl_custom_fuzz(data, inbuf, inlen, &outbuf, splicebuf, splicelen, 1024*1024);
 
   if (outlen == 0 || !outbuf) {
-
     fprintf(stderr, "Error: no mutation data returned.\n");
     return -1;
-
   }
 
   if (verbose) fprintf(stderr, "Mutation output length: %u\n", outlen);
 
   if (fwrite(outbuf, 1, outlen, out) != outlen) {
-
     fprintf(stderr, "Warning: incomplete write.\n");
     return -1;
-
   }
-
+  
   return 0;
-
 }
-

custom_mutators/atnwalk/atnwalk.c

@@ -409,7 +409,7 @@ size_t afl_custom_fuzz(atnwalk_mutator_t *data, uint8_t *buf, size_t buf_size,
 
   } else {
 
-    // new_size fits into buf, so reuse it
+    // new_size fits into buf, so re-use it
     *out_buf = buf;
 
   }

custom_mutators/autotokens/autotokens.cpp

@@ -39,7 +39,6 @@ extern "C" {
 #ifndef AFL_TXT_MAX_LEN
   #define AFL_TXT_MAX_LEN 65535
 #endif
-#define AUTOTOKENS_TXT_MIN_LEN 1
 
 #if AUTOTOKENS_SPLICE_MIN >= AUTOTOKENS_SIZE_MIN
   #error SPLICE_MIN must be lower than SIZE_MIN
@@ -58,9 +57,8 @@ typedef struct my_mutator {
   if (unlikely(debug)) fprintf
 #define IFDEBUG if (unlikely(debug))
 
-int module_disabled = 0;
-
 static afl_state *afl_ptr;
+static int        module_disabled = 0;
 static int        auto_disable = AUTOTOKENS_AUTO_DISABLE;
 static int        debug = AUTOTOKENS_DEBUG;
 static int        only_fav = AUTOTOKENS_ONLY_FAV;
@@ -106,9 +104,9 @@ static void first_run(void *data) {
   if (afl_ptr->custom_only || !auto_disable) { return; }
 
   if (unlikely(afl_ptr->active_items == 1 &&
-               afl_ptr->queue_cur->len < AUTOTOKENS_TXT_MIN_LEN)) {
+               afl_ptr->queue_cur->len < AFL_TXT_MIN_LEN)) {
 
-    if (afl_ptr->extras_cnt) {
+    if (afl_ptr->extras_cnt > 8) {
 
       u32 valid = 0;
 
@@ -239,7 +237,7 @@ extern "C" u32 afl_custom_fuzz_count(void *data, const u8 *buf,
 
 }
 
-extern "C" size_t afl_custom_fuzz(void *data, u8 *buf, size_t buf_size,
+extern "C" size_t afl_custom_fuzz(my_mutator_t *data, u8 *buf, size_t buf_size,
                                   u8 **out_buf, u8 *add_buf,
                                   size_t add_buf_size, size_t max_size) {
 
@@ -657,7 +655,6 @@ extern "C" unsigned char afl_custom_queue_get(void                *data,
     if (current_id > whitespace_ids + 6 && afl_ptr->active_items == 1 &&
         afl_ptr->queue_cur->len < AFL_TXT_MIN_LEN) {
 
-    retry_thin_air:
       DEBUGF(stderr, "Creating an entry from thin air...\n");
       structure = new vector<u32>();
       u32 item, prev, cnt = current_id >> 1;
@@ -687,6 +684,8 @@ extern "C" unsigned char afl_custom_queue_get(void                *data,
 
     }
 
+    create_from_thin_air = 0;
+
   }
 
   if (entry == file_mapping.end()) {
@@ -694,7 +693,7 @@ extern "C" unsigned char afl_custom_queue_get(void                *data,
     // this input file was not analyzed for tokens yet, so let's do it!
     size_t len = afl_ptr->queue_cur->len;
 
-    if (len < AUTOTOKENS_TXT_MIN_LEN) {
+    if (len < AFL_TXT_MIN_LEN) {
 
       file_mapping[fn] = structure;  // NULL ptr so we don't read the file again
       s = NULL;
@@ -896,7 +895,6 @@ extern "C" unsigned char afl_custom_queue_get(void                *data,
 
     if (tokens.size() < AUTOTOKENS_SIZE_MIN) {
 
-      if (create_from_thin_air) { goto retry_thin_air; }
       file_mapping[fn] = NULL;
       s = NULL;
       DEBUGF(stderr, "too few tokens\n");
@@ -957,7 +955,7 @@ extern "C" unsigned char afl_custom_queue_get(void                *data,
 
 }
 
-extern "C" void *afl_custom_init(afl_state_t *afl, unsigned int seed) {
+extern "C" my_mutator_t *afl_custom_init(afl_state *afl, unsigned int seed) {
 
   (void)(seed);
   my_mutator_t *data = (my_mutator_t *)calloc(1, sizeof(my_mutator_t));
@@ -1072,7 +1070,7 @@ extern "C" void *afl_custom_init(afl_state_t *afl, unsigned int seed) {
   id_to_token[current_id] = "'";
   ++current_id;
 
-  return (void *)data;
+  return data;
 
 }
 

custom_mutators/autotokens/standalone/Makefile

@@ -1,20 +0,0 @@
-
-CFLAGS = -g -O3 -funroll-loops -fPIC -D_STANDALONE_MODULE=1 -Wno-pointer-sign
-CXXFLAGS= -g -O3 -funroll-loops -fPIC -D_STANDALONE_MODULE=1
-
-all: autotokens-standalone
-
-autotokens.o:	../autotokens.cpp
-	$(CXX) $(CXXFLAGS) -g -I../../../include -I. -I../.. -c ../autotokens.cpp
-
-autotokens-standalone:	autotokens-standalone.c	autotokens.o
-	$(CC) $(CFLAGS) -g -DBIN_PATH=\"foo\" -I../../../include -I. -c autotokens-standalone.c
-	$(CC) $(CFLAGS) -g -DBIN_PATH=\"foo\" -I../../../include -I. -c ../../../src/afl-performance.c
-	$(CC) $(CFLAGS) -g -DBIN_PATH=\"foo\" -I../../../include -I. -c ../../../src/afl-fuzz-extras.c
-	$(CC) $(CFLAGS) -g -DBIN_PATH=\"foo\" -I../../../include -I. -c ../../../src/afl-fuzz-queue.c
-	$(CC) $(CFLAGS) -g -DBIN_PATH=\"foo\" -I../../../include -I. -c ../../../src/afl-common.c
-	$(CXX) $(CFLAGS) -g -DBIN_PATH=\"foo\" -I../../../include -I. -o autotokens-standalone *.o
-	@rm -f ../../../src/afl-common.o ../../../src/afl-fuzz-queue.o ../../../src/afl-fuzz-extras.o ../../../src/afl-performance.o
-
-clean:
-	rm -f *.o *~ autotokens-standalone core

custom_mutators/autotokens/standalone/README.md

@@ -1,12 +0,0 @@
-# Autotokens standalone mutator
-
-this is a standalone version of the AFL++ autotokens custom mutator.
-
-just type `make` to build.
-
-You *MUST* use a dictionary file to have an effective grammarless grammar fuzzer!
-
-```
-autotokens-standalone -h # to see all parameters
-autotokens-standalone -x foo.dict inputfile outputfile # example
-```

custom_mutators/autotokens/standalone/autotokens-standalone.c

@@ -1,205 +0,0 @@
-#include "afl-fuzz.h"
-#include "afl-mutations.h"
-#include "forkserver.h"
-
-#include <unistd.h>
-#include <getopt.h>
-
-static int            max_havoc = 16, verbose;
-static char _mh[4] = "16";
-static char *dict, *mh = _mh;
-
-extern int module_disabled;
-
-void *afl_custom_init(afl_state_t *, unsigned int);
-u8 afl_custom_queue_get(void *data, const u8 *filename);
-size_t afl_custom_fuzz(void *data, u8 *buf, size_t buf_size, u8 **out_buf,
-                            u8 *add_buf, size_t add_buf_size, size_t max_size);
-
-u32 write_to_testcase(afl_state_t *afl, void **mem, u32 a, u32 b) {
-  return 0;
-}
-fsrv_run_result_t fuzz_run_target(afl_state_t *afl, afl_forkserver_t *fsrv,
-                                  u32 i) {
-return FSRV_RUN_OK;
-                                  }
-
-int main(int argc, char *argv[]) {
-
-  if (argc > 1 && strncmp(argv[1], "-h", 2) == 0) {
-
-    printf(
-        "Syntax: %s [-v] [-m maxmutations] [-x dict] [inputfile [outputfile "
-        "[splicefile]]]\n\n",
-        argv[0]);
-    printf("Reads a testcase from a file (not stdin!),\n");
-    printf("writes to stdout when '-' or\n");
-    printf(
-        "no output filename is given. As an optional third parameter you can "
-        "give a file\n");
-    printf("for splicing. Maximum input and output length is 1MB.\n");
-    printf("Options:\n");
-    printf("  -v      verbose debug output to stderr.\n");
-    printf("  -m val  max mutations (1-val, val default is 16)\n");
-    printf("  -x file dictionary file (AFL++ format)\n");
-    printf("You can set the following environment variable parameters:\n");
-    printf("AUTOTOKENS_COMMENT` - what character or string starts a comment which will be\n");
-    printf("                      removed. Default: \"/* ... */\"\n");
-    return 0;
-
-  }
-
-  FILE          *in = stdin, *out = stdout, *splice = NULL;
-  unsigned char *inbuf = malloc(1024 * 1024), *outbuf = NULL, *splicebuf = NULL;
-  int            splicelen = 0, opt;
-
-  while ((opt = getopt(argc, argv, "vm:x:")) > 0) {
-
-    switch (opt) {
-
-      case 'm':
-        max_havoc = atoi(optarg);
-        mh = optarg;
-        break;
-      case 'v':
-        verbose = 1;
-        break;
-      case 'x':
-        dict = optarg;
-        break;
-      default:
-        fprintf(stderr, "Error: unknown parameter -%c\n", opt);
-        exit(-1);
-
-    }
-
-  }
-
-  if (max_havoc < 1) {
-
-    fprintf(stderr, "Error: illegal -m value\n");
-    exit(-1);
-
-  }
-
-  if (argc > optind && strcmp(argv[optind], "-") != 0) {
-
-    if ((in = fopen(argv[optind], "r")) == NULL) {
-
-      perror(argv[1]);
-      return -1;
-
-    }
-
-    if (verbose) fprintf(stderr, "Input: %s\n", argv[optind]);
-
-  }
-
-  size_t inlen = fread(inbuf, 1, 1024 * 1024, in);
-
-  if (!inlen) {
-
-    fprintf(stderr, "Error: empty file %s\n",
-            argv[optind] ? argv[optind] : "stdin");
-    return -1;
-
-  }
-
-  if (argc > optind + 1 && strcmp(argv[optind + 1], "-") != 0) {
-
-    if ((out = fopen(argv[optind + 1], "w")) == NULL) {
-
-      perror(argv[optind + 1]);
-      return -1;
-
-    }
-
-    if (verbose) fprintf(stderr, "Output: %s\n", argv[optind + 1]);
-
-  }
-
-  if (argc > optind + 2) {
-
-    if ((splice = fopen(argv[optind + 2], "r")) == NULL) {
-
-      perror(argv[optind + 2]);
-      return -1;
-
-    }
-
-    if (verbose) fprintf(stderr, "Splice: %s\n", argv[optind + 2]);
-    splicebuf = malloc(1024 * 1024);
-    size_t splicelen = fread(splicebuf, 1, 1024 * 1024, splice);
-    if (!splicelen) {
-
-      fprintf(stderr, "Error: empty file %s\n", argv[optind + 2]);
-      return -1;
-
-    }
-
-    if (verbose) fprintf(stderr, "Mutation splice length: %zu\n", splicelen);
-
-  }
-
-  /* configure autotokens */
-  setenv("AUTOTOKENS_LEARN_DICT", "1", 0);
-  setenv("AUTOTOKENS_CREATE_FROM_THIN_AIR", "1", 0);
-  setenv("AUTOTOKENS_CHANGE_MAX", mh, 0);
-
-  /* fake AFL++ state */
-  afl_state_t *afl = (afl_state_t *)calloc(1, sizeof(afl_state_t));
-  afl->queue_cycle = afl->havoc_div = afl->active_items = afl->queued_items = 1;
-  afl->shm.cmplog_mode = 0;
-  afl->fsrv.dev_urandom_fd = open("/dev/urandom", O_RDONLY);
-  if (afl->fsrv.dev_urandom_fd < 0) { PFATAL("Unable to open /dev/urandom"); }
-
-  rand_set_seed(afl, getpid());
-
-  if (dict) {
-
-    load_extras(afl, (u8*)dict);
-    if (verbose)
-      fprintf(stderr, "Loaded dictionary: %s (%u entries)\n", dict,
-              afl->extras_cnt);
-
-  }
-
-  // setup a fake queue entry
-  afl->queue_buf = malloc(64);
-  afl->queue_buf[0] = afl->queue_cur =
-      (struct queue_entry *)malloc(sizeof(struct queue_entry));
-  afl->queue_cur->testcase_buf = inbuf;
-  afl->queue_cur->fname = (u8 *)argv[optind];
-  afl->queue_cur->len = inlen;
-  afl->queue_cur->perf_score = 100;
-  afl->queue_cur->favored = afl->queue_cur->is_ascii = 1;
-  // afl->custom_only = 1;
-
-  void *data = (void *)afl_custom_init(afl, (u32)0);
-
-  u8 res = afl_custom_queue_get(inbuf, (u8 *)argv[optind]);
-
-  if (verbose) fprintf(stderr, "Mutation input length: %zu\n", inlen);
-  unsigned int outlen = afl_custom_fuzz(data, inbuf, inlen, &outbuf, splicebuf,
-                                        splicelen, 1024 * 1024);
-
-  if (outlen == 0 || !outbuf) {
-
-    fprintf(stderr, "Error: no mutation data returned.\n");
-    return -1;
-
-  }
-
-  if (verbose) fprintf(stderr, "Mutation output length: %u\n", outlen);
-
-  if (fwrite(outbuf, 1, outlen, out) != outlen) {
-
-    fprintf(stderr, "Warning: incomplete write.\n");
-    return -1;
-
-  }
-
-  return 0;
-
-}
-

custom_mutators/examples/XmlMutatorMin.py

@@ -304,7 +304,7 @@ class XmlMutatorMin:
 
         # Log something
         if self.verbose:
-            print("Resetting tag #%i '%s'" % (rand_elem_id, rand_elem.tag))
+            print("Reseting tag #%i '%s'" % (rand_elem_id, rand_elem.tag))
 
         # Reset the node
         rand_elem.clear()

custom_mutators/examples/wrapper_afl_min.py

@@ -80,12 +80,12 @@ def fuzz(buf, add_buf, max_size):
             via_buffer = False
             log("fuzz(): Can't initialize mutator with AFL buffer")
 
-    # If init from AFL buffer wasn't successful
+    # If init from AFL buffer wasn't succesful
     if not via_buffer:
         log("fuzz(): Returning unmodified AFL buffer")
         return buf
 
-    # Successful initialization -> mutate
+    # Sucessful initialization -> mutate
     try:
         __mutator__.mutate(max=5)
         log("fuzz(): Input mutated")

custom_mutators/gramatron/build_gramatron_mutator.sh

@@ -143,7 +143,7 @@ test -e json-c/.libs/libjson-c.a || {
 echo
 echo
 echo "[+] Json-c successfully prepared!"
-echo "[+] Building gramatron now."
+echo "[+] Builing gramatron now."
 $CC -O3 -g -fPIC -Wno-unused-result -Wl,--allow-multiple-definition -I../../include -o gramatron.so -shared -I. -I/prg/dev/include gramfuzz.c gramfuzz-helpers.c gramfuzz-mutators.c gramfuzz-util.c hashmap.c ../../src/afl-performance.o json-c/.libs/libjson-c.a || exit 1
 echo
 echo "[+] gramatron successfully built!"

custom_mutators/honggfuzz/README.md

@@ -1,4 +1,4 @@
-# custom mutator: honggfuzz mangle
+# custum mutator: honggfuzz mangle
 
 this is the honggfuzz mutator in mangle.c as a custom mutator
 module for AFL++. It is the original mangle.c, mangle.h and honggfuzz.h

custom_mutators/honggfuzz/mangle.c

@@ -850,7 +850,7 @@ static void mangle_ASCIINumChange(run_t *run, bool printable) {
 
   size_t   len = 0;
   uint64_t val = 0;
-  /* 20 is maximum length of a string representing a 64-bit unsigned value */
+  /* 20 is maximum lenght of a string representing a 64-bit unsigned value */
   for (len = 0; (len < 20) && (len < left); len++) {
 
     char c = run->dynfile->data[off + len];

custom_mutators/libfuzzer/FuzzerDataFlowTrace.cpp

@@ -40,7 +40,7 @@ bool BlockCoverage::AppendCoverage(const std::string &S) {
 // Coverage lines have this form:
 // CN X Y Z T
 // where N is the number of the function, T is the total number of instrumented
-// BBs, and X,Y,Z, if present, are the indices of covered BB.
+// BBs, and X,Y,Z, if present, are the indecies of covered BB.
 // BB #0, which is the entry block, is not explicitly listed.
 bool BlockCoverage::AppendCoverage(std::istream &IN) {
 

custom_mutators/libfuzzer/FuzzerDictionary.h

@@ -106,7 +106,7 @@ private:
 };
 
 // Parses one dictionary entry.
-// If successful, write the entry to Unit and returns true,
+// If successful, write the enty to Unit and returns true,
 // otherwise returns false.
 bool ParseOneDictionaryEntry(const std::string &Str, Unit *U);
 // Parses the dictionary file, fills Units, returns true iff all lines

custom_mutators/libfuzzer/FuzzerFork.cpp

@@ -427,7 +427,7 @@ void FuzzWithFork(Random &Rand, const FuzzingOptions &Options,
 
     Env.RunOneMergeJob(Job.get());
 
-    // Continue if our crash is one of the ignored ones.
+    // Continue if our crash is one of the ignorred ones.
     if (Options.IgnoreTimeouts && ExitCode == Options.TimeoutExitCode)
       Env.NumTimeouts++;
     else if (Options.IgnoreOOMs && ExitCode == Options.OOMExitCode)

custom_mutators/libfuzzer/FuzzerMerge.cpp

@@ -452,7 +452,7 @@ void CrashResistantMerge(const Vector<std::string> &Args,
     auto ExitCode = ExecuteCommand(Cmd);
     if (!ExitCode) {
 
-      VPrintf(V, "MERGE-OUTER: succesful in %zd attempt(s)\n", Attempt);
+      VPrintf(V, "MERGE-OUTER: succesfull in %zd attempt(s)\n", Attempt);
       break;
 
     }

custom_mutators/libfuzzer/FuzzerMutate.cpp

@@ -498,9 +498,9 @@ size_t ChangeBinaryInteger(uint8_t *Data, size_t Size, Random &Rand) {
     T Add = Rand(21);
     Add -= 10;
     if (Rand.RandBool())
-      Val = Bswap(T(Bswap(Val) + Add));  // Add assuming different endianness.
+      Val = Bswap(T(Bswap(Val) + Add));  // Add assuming different endiannes.
     else
-      Val = Val + Add;                // Add assuming current endianness.
+      Val = Val + Add;                // Add assuming current endiannes.
     if (Add == 0 || Rand.RandBool())  // Maybe negate.
       Val = -Val;
 

custom_mutators/libfuzzer/FuzzerTracePC.cpp

@@ -460,7 +460,7 @@ static size_t InternalStrnlen(const char *S, size_t MaxLen) {
 }
 
 // Finds min of (strlen(S1), strlen(S2)).
-// Needed because one of these strings may actually be non-zero terminated.
+// Needed bacause one of these strings may actually be non-zero terminated.
 static size_t InternalStrnlen2(const char *S1, const char *S2) {
 
   size_t Len = 0;

custom_mutators/libfuzzer/README.md

@@ -1,4 +1,4 @@
-# custom mutator: libfuzzer LLVMFuzzerMutate()
+# custum mutator: libfuzzer LLVMFuzzerMutate()
 
 This uses the libfuzzer LLVMFuzzerMutate() function in llvm 12.
 

custom_mutators/radamsa/GNUmakefile

@@ -2,7 +2,7 @@ CUR_DIR := $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))
 
 all: radamsa-mutator.so
 
-# These can be overridden:
+# These can be overriden:
 CFLAGS	?= $(CFLAGS_FLTO)
 
 # These are required: (otherwise radamsa gets very very slooooow)

custom_mutators/radamsa/README.md

@@ -1,4 +1,4 @@
-# custom mutator: libradamsa
+# custum mutator: libradamsa
 
 Pretranslated radamsa library. This code belongs to the radamsa author.
 

custom_mutators/rust/Cargo.toml

@@ -5,5 +5,4 @@ members = [
     "example",
     # Lain needs a nightly toolchain
     # "example_lain",
-    # "example_lain_post_process",
-]
+]

custom_mutators/rust/README.md

@@ -5,15 +5,7 @@ Bindings to create custom mutators in Rust.
 These bindings are documented with rustdoc. To view the documentation run
 ```cargo doc -p custom_mutator --open```.
 
-A minimal example can be found in `example`. Build it using `cargo build --example example_mutator`.
+A minimal example can be found in `example`. Build it using `cargo build --example example_mutator`. 
 
 An example using [lain](https://github.com/microsoft/lain) for structured fuzzing can be found in `example_lain`.
 Since lain requires a nightly rust toolchain, you need to set one up before you can play with it.
-
-An example for the use of the post_process function, using [lain](https://github.com/microsoft/lain) with [serde](https://github.com/serde-rs/serde) and [bincode](https://github.com/bincode-org/bincode) can be found in `example_lain_post_process`.
-In order for it to work you need to:
-
-- disable input trimming with `AFL_DISABLE_TRIM=1`
-- provide an initial instance serialized with `bincode` or use the `AFL_NO_STARTUP_CALIBRATION=1` environment variable.
-
-Note that `bincode` can also be used to serialize/deserialize the lain-generated structure and mutate it rather than generating a new one at each iteration, but it requires some structure serialized with `bincode` as input seed.

custom_mutators/rust/custom_mutator/src/lib.rs

@@ -73,8 +73,6 @@ pub trait RawCustomMutator {
         None
     }
 
-    fn post_process<'b, 's: 'b>(&'s mut self, buffer: &'b mut [u8]) -> Option<&'b [u8]>;
-
     /*fn post_process(&self, buffer: &[u8], unsigned char **out_buf)-> usize;
     int afl_custom_init_trim(&self, buffer: &[u8]);
     size_t afl_custom_trim(&self, unsigned char **out_buf);
@@ -355,33 +353,6 @@ pub mod wrappers {
             Err(err) => panic_handler("afl_custom_queue_get", &err),
         }
     }
-
-    /// Internal function used in the macro
-    pub unsafe fn afl_custom_post_process<M: RawCustomMutator>(
-        data: *mut c_void,
-        buf: *mut u8,
-        buf_size: usize,
-        out_buf: *mut *const u8,
-    ) -> usize {
-        match catch_unwind(|| {
-            let mut context = FFIContext::<M>::from(data);
-
-            assert!(!buf.is_null(), "null buf passed to afl_custom_post_process");
-            assert!(
-                !out_buf.is_null(),
-                "null out_buf passed to afl_custom_post_process"
-            );
-            let buff_slice = slice::from_raw_parts_mut(buf, buf_size);
-            if let Some(buffer) = context.mutator.post_process(buff_slice) {
-                *out_buf = buffer.as_ptr();
-                return buffer.len();
-            }
-            0
-        }) {
-            Ok(ret) => ret,
-            Err(err) => panic_handler("afl_custom_post_process", &err),
-        }
-    }
 }
 
 /// An exported macro to defined afl_custom_init meant for insternal usage
@@ -509,16 +480,6 @@ macro_rules! export_mutator {
         pub unsafe extern "C" fn afl_custom_deinit(data: *mut ::std::os::raw::c_void) {
             $crate::wrappers::afl_custom_deinit_::<$mutator_type>(data)
         }
-
-        #[no_mangle]
-        pub unsafe extern "C" fn afl_custom_post_process(
-            data: *mut ::std::os::raw::c_void,
-            buf: *mut u8,
-            buf_size: usize,
-            out_buf: *mut *const u8,
-        ) -> usize {
-            $crate::wrappers::afl_custom_post_process::<$mutator_type>(data, buf, buf_size, out_buf)
-        }
     };
 }
 
@@ -551,10 +512,6 @@ mod sanity_test {
         ) -> Option<&'b [u8]> {
             unimplemented!()
         }
-
-        fn post_process<'b, 's: 'b>(&'s mut self, buffer: &'b mut [u8]) -> Option<&'b [u8]> {
-            unimplemented!()
-        }
     }
 
     export_mutator!(ExampleMutator);
@@ -622,13 +579,6 @@ pub trait CustomMutator {
     fn introspection(&mut self) -> Result<Option<&str>, Self::Error> {
         Ok(None)
     }
-
-    fn post_process<'b, 's: 'b>(
-        &'s mut self,
-        buffer: &'b mut [u8],
-    ) -> Result<Option<&'b [u8]>, Self::Error> {
-        Ok(Some(buffer))
-    }
 }
 
 impl<M> RawCustomMutator for M
@@ -732,16 +682,6 @@ where
             }
         }
     }
-
-    fn post_process<'b, 's: 'b>(&'s mut self, buffer: &'b mut [u8]) -> Option<&'b [u8]> {
-        match self.post_process(buffer) {
-            Ok(r) => r,
-            Err(e) => {
-                Self::handle_error(e);
-                None
-            }
-        }
-    }
 }
 
 /// the default value to return from [`CustomMutator::describe`].

custom_mutators/rust/example_lain/Cargo.toml

@@ -8,9 +8,9 @@ edition = "2021"
 
 [dependencies]
 custom_mutator = { path = "../custom_mutator" }
-lain = { git = "https://github.com/AFLplusplus/lain.git" }
+lain="0.5"
 
 [[example]]
 name = "example_lain"
 path = "./src/lain_mutator.rs"
-crate-type = ["cdylib"]
+crate-type = ["cdylib"]

custom_mutators/rust/example_lain_post_process/Cargo.toml

@@ -1,21 +0,0 @@
-[package]
-name = "example_lain_post_process"
-version = "0.1.0"
-authors = [
-    "Julius Hohnerlein <julihoh@users.noreply.github.com>",
-    "jma <94166787+jma-qb@users.noreply.github.com>",
-]
-edition = "2021"
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[dependencies]
-custom_mutator = { path = "../custom_mutator" }
-lain = { git = "https://github.com/AFLplusplus/lain.git" }
-bincode = "1.3.3"
-serde = { version = "1.0.214", features = ["derive"] }
-
-[[example]]
-name = "example_lain_post_process"
-path = "./src/lain_mutator.rs"
-crate-type = ["cdylib"]

custom_mutators/rust/example_lain_post_process/rust-toolchain

@@ -1 +0,0 @@
-nightly

custom_mutators/rust/example_lain_post_process/src/lain_mutator.rs

@@ -1,70 +0,0 @@
-#![cfg(unix)]
-
-use custom_mutator::{export_mutator, CustomMutator};
-use lain::{
-    mutator::Mutator,
-    prelude::*,
-    rand::{rngs::StdRng, SeedableRng},
-};
-use serde::{Deserialize, Serialize};
-
-#[derive(Debug, Deserialize, Serialize, Mutatable, NewFuzzed, BinarySerialize)]
-struct MyStruct {
-    tag: u8,
-    #[lain(ignore)]
-    length: u32,
-    #[lain(min = 0, max = 10)]
-    data: Vec<u8>,
-}
-
-struct LainMutator {
-    mutator: Mutator<StdRng>,
-    buffer: Vec<u8>,
-    post_buffer: Vec<u8>,
-}
-
-impl CustomMutator for LainMutator {
-    type Error = ();
-
-    fn init(seed: u32) -> Result<Self, ()> {
-        Ok(Self {
-            mutator: Mutator::new(StdRng::seed_from_u64(seed as u64)),
-            buffer: Vec::new(),
-            post_buffer: Vec::new(),
-        })
-    }
-
-    fn fuzz<'b, 's: 'b>(
-        &'s mut self,
-        _buffer: &'b mut [u8],
-        _add_buff: Option<&[u8]>,
-        max_size: usize,
-    ) -> Result<Option<&'b [u8]>, ()> {
-        // we just sample an instance of MyStruct, ignoring the current input
-        let instance = MyStruct::new_fuzzed(&mut self.mutator, None);
-        let serialized = bincode::serialize(&instance).unwrap();
-        let size = serialized.len();
-        if size > max_size {
-            return Err(());
-        }
-        self.buffer.clear();
-        self.buffer.reserve(size);
-        self.buffer.extend_from_slice(&serialized);
-        Ok(Some(self.buffer.as_slice()))
-    }
-
-    fn post_process<'b, 's: 'b>(
-        &'s mut self,
-        buffer: &'b mut [u8],
-    ) -> Result<Option<&'b [u8]>, Self::Error> {
-        let mut instance = bincode::deserialize::<MyStruct>(&buffer).unwrap();
-        instance.length = instance.data.len() as u32;
-        let size = instance.serialized_size();
-        self.post_buffer.clear();
-        self.post_buffer.reserve(size);
-        instance.binary_serialize::<_, BigEndian>(&mut self.post_buffer);
-        Ok(Some(&self.post_buffer))
-    }
-}
-
-export_mutator!(LainMutator);

custom_mutators/symcc/README.md

@@ -1,4 +1,4 @@
-# custom mutator: symcc
+# custum mutator: symcc
 
 This uses the symcc to find new paths into the target.
 

custom_mutators/symqemu/README.md

@@ -1,4 +1,4 @@
-# custom mutator: symqemu
+# custum mutator: symqemu
 
 This uses the symcc to find new paths into the target.
 

dictionaries/jsonschema.dict

@@ -1,120 +0,0 @@
-#
-# AFL dictionary for JSON Schema
-# https://json-schema.org/
-# -----------------------
-#
-
-"\"$schema\""
-"\"$id\""
-"\"$ref\""
-"\"$defs\""
-"\"definitions\""
-"\"enum\""
-"\"const\""
-"\"type\""
-
-# Annotations
-
-"\"title\""
-"\"description\""
-"\"default\""
-"\"examples\""
-"\"$comment\""
-"\"readOnly\""
-"\"writeOnly\""
-"\"deprecated\""
-
-# Types
-
-"\"string\""
-"\"integer\""
-"\"number\""
-"\"object\""
-"\"array\""
-"\"null\""
-"\"boolean\""
-
-# String
-
-"\"minLength\""
-"\"maxLength\""
-"\"pattern\""
-"\"format\""
-"\"contentMediaType\""
-"\"contentEncoding\""
-"\"contentSchema\""
-
-# Formats
-
-"\"date-time\""
-"\"time\""
-"\"date\""
-"\"duration\""
-"\"email\""
-"\"idn-email\""
-"\"hostname\""
-"\"idn-hostname\""
-"\"ipv4\""
-"\"ipv6\""
-"\"uuid\""
-"\"uri\""
-"\"uri-reference\""
-"\"iri\""
-"\"iri-reference\""
-"\"uri-template\""
-"\"json-pointer\""
-"\"relative-json-pointer\""
-"\"regex\""
-
-# Numeric
-
-"\"multipleOf\""
-"\"minimum\""
-"\"exclusiveMinimum\""
-"\"maximum\""
-"\"exclusiveMaximum\""
-
-# Object
-
-"\"properties\""
-"\"patternProperties\""
-"\"additionalProperties\""
-"\"unevaluatedProperties\""
-"\"required\""
-"\"propertyNames\""
-"\"minProperties\""
-"\"maxProperties\""
-"\"dependencies\""
-
-# Array
-
-"\"items\""
-"\"prefixItems\""
-"\"additionalItems\""
-"\"unevaluatedItems\""
-"\"contains\""
-"\"minContains\""
-"\"maxContains\""
-"\"minItems\""
-"\"maxItems\""
-"\"uniqueItems\""
-
-# Booleans
-
-"true"
-"false"
-
-# Composition
-
-"\"allOf\""
-"\"anyOf\""
-"\"oneOf\""
-"\"not\""
-
-# Conditions
-
-"\"dependentRequired\""
-"\"dependentSchemas\""
-"\"if\""
-"\"then\""
-"\"else\""

docs/Changelog.md

@@ -3,73 +3,7 @@
   This is the list of all noteworthy changes made in every public
   release of the tool. See README.md for the general instruction manual.
 
-
-### Version ++4.33a (dev)
-  - afl-fuzz:
-    - Use `AFL_PRELOAD_DISCRIMINATE_FORKSERVER_PARENT` if you use AFL_PRELOAD
-      to disable fork, see docs (thanks to @alexandredoyen29)
-    - Fix for FAST power schedules (introduced in 4.32c) (thanks to @kcwu)
-    - Colors for NO_UI output (thanks to @smoelius)
-    - Fix potential sync issues when resuming sessions and when instances in a
-      campaign are restarted and skip entries that were synced from itself
-      (thanks to @kcwu for raising the issues and providing support!)
-    - more 64 bit archicture support by @maribu
-  - afl-cc:
-    - Added instrumenting hidden edges (approx 5% edges were not instrumented,
-      LLVM sancov overall misses 8% of edges compared to our implementation)
-      Note that is is currently only implemented for our PCGUARD plugin, not
-      LTO, CLASSIC, etc.!
-    - Fix to make AFL_SAN_NO_INST work with gcc_plugin
-    - MacOS aflpp driver compilation fix (-fsanitize=fuzzer implementation)
-    - Make AFL_DUMP_MAP_SIZE work even if the target has sanitizer issues
-  - qemuafl:
-    - Better MIPS persistent mode support
-  - afl-cmin:
-    - New afl-cmin.py which is much faster, will be executed by default via
-      afl-cmin if it executes successfully (thanks to @kcwu!)
-  - New desocketing library: utils/libaflppdesock
-    - Likely works when all other desocketing options fail
-
-
-### Version ++4.32c (release)
-  - Fixed a bug where after a fast restart of a full fuzzed corpus afl-fuzz
-    terminates with "need at least one valid input seed that does not crash"
-  - Small improvements to afl-*-config
-  - afl-fuzz:
-    - memory leak fixes by @kcwu - thanks!
-    - many more nits and small memory saves thanks to @kcwu
-    - remove deprecated files from queue/.state
-    - fix bitmap update function if no current trace is present 
-    - fix for afl_custom_queue_get
-    - various small nits
-  - afl-cc:
-    - fix pass support for LLVM 20 (passes were run too early)
-    - dropped plugin support for LLVM 13
-    - fix AFL_OLD_FORKSERVER
-    - various minor fixes
-  - frida_mode:
-    - fixes for new MacOS + M4 hardware
-
-### Version ++4.31c (release)
-  - SAND mode added (docs/SAND.md) for more effecient fuzzing with sanitizers
-    (thanks to @wtdcode !)
-  - afl-fuzz:
-    - splicing phase is now DISABLED by default because research showed
-      it is counterproductive. New command line parameter `-u` to enable
-      it.
-    - Python 3.13+ support
-    - loose file and shared memory permissions on Android and iPhone
-  - afl-cc:
-    - LLVM 20 support (again - please don't change the API all the time ...)
-    - -fsanitize=fuzzer now inserts libAFLDriver.a addtionally early to help
-      compiling if LLVMFuzzerTestOneOnput is in an .a archive
-    - added __sanitizer_weak_hook_* functions (in case that is helpful in
-      weird setups)
-    - fix bug with large map sizes when multiple libraries are loaded after
-      the shared memory was obtained.
-
-### Version ++4.30c (release)
-  ! afl-gcc and afl-clang funcionality is now removed !
+### Version ++4.22a (dev)
   - afl-fuzz:
     - fastresume feature added. if you abort fuzzing and resume fuzzing
       with `-i -` or `AFL_AUTORESUME=1` and the target binary has not changed
@@ -79,11 +13,6 @@
     - improved seed selection algorithm
     - added `AFL_CUSTOM_MUTATOR_LATE_SEND=1` to call the custom send()
       function after the target has been restarted.
-    - because of bad math and undefined behaviour fixes we have to change
-      the CMPLOG map. **YOU NEED TO RECOMPILE CMPLOG TARGETS**
-    - fixed custom_post_process for calibration
-    - fixes for AFL_EXIT_ON_TIME and AFL_EXIT_WHEN_DONE, changed behaviour of
-      AFL_EXIT_WHEN_DONE to finish when really done :-)
   - frida_mode:
     - AFL_FRIDA_PERSISTENT_ADDR can now be be any reachable address not just
       a function entry
@@ -92,26 +21,13 @@
   - qemu_mode:
     - new hooks supported (optional), see qemu_mode/hooking_bridge - thanks to
       @CowBoy4mH3LL
-  - unicorn_mode:
-    - fix install and forkserver (thanks aarnav!)
-    - pin unicorn version
-  - nyx_mode:
-    - bugfixes
   - custom mutators:
     - custom_send_tcp custom mutator added, thanks to @dergoegge
   - afl-cc
-    - fix to support pointless changes in LLVM 20
     - new runtime (!) variable: `AFL_OLD_FORKSERVER` to use the old vanilla
       AFL type forkserver. Useful for symcc/symqemu/nautilus/etc. with
       AFL_LLVM_INSTRUMENT=CLASSIC
-    - new compile time variable: `AFL_OPT_LEVEL` to set a specific optimization
-      level, default is `3`
-    - correctly explain how to get the correct map size for large targets
-    - small fix for weird LLVM defines in redhat
-  - code formatting updated to llvm 18
-  - improved custom_mutators/aflpp/standalone/aflpp-standalone
-  - added custom_mutators/autotokens/standalone/autotokens-standalone
-  - AFL++ headers are now installed to $PREFIX/include/afl
+
 
 ### Version ++4.21c (release)
   * afl-fuzz

docs/FAQ.md

@@ -11,7 +11,7 @@ If you find an interesting or important question missing, submit it via
   AFL++ is a superior fork to Google's AFL - more speed, more and better
   mutations, more and better instrumentation, custom module support, etc.
 
-  American Fuzzy Lop (AFL) was developed by Michal "lcamtuf" Zalewski starting
+  American Fuzzy Lop (AFL) was developed by Michał "lcamtuf" Zalewski starting
   in 2013/2014, and when he left Google end of 2017 he stopped developing it.
 
   At the end of 2019, the Google fuzzing team took over maintenance of AFL,
@@ -106,7 +106,7 @@ If you find an interesting or important question missing, submit it via
 <details>
   <summary id="should-you-ever-stop-afl-fuzz-minimize-the-corpus-and-restart">Should you ever stop afl-fuzz, minimize the corpus and restart?</summary><p>
 
-  To stop afl-fuzz, minimize its corpus and restart you would usually do:
+  To stop afl-fuzz, minimize it's corpus and restart you would usually do:
 
   ```
   Control-C  # to terminate afl-fuzz
@@ -236,7 +236,7 @@ If you find an interesting or important question missing, submit it via
   [AFLFast](https://github.com/mboehme/aflfast), however, modified to be more
   effective and several more modes added.
 
-  The most effective modes are `-p explore` (default) and `-p fast`.
+  The most effective modes are `-p fast` (default) and `-p explore`.
 
   If you fuzz with several parallel afl-fuzz instances, then it is beneficial
   to assign a different schedule to each instance, however the majority should
@@ -274,7 +274,7 @@ If you find an interesting or important question missing, submit it via
   the existing map will be used also for the newly loaded libraries, which
   allows it to work, however, the efficiency of the fuzzing will be partially
   degraded. Note that there is additionally `AFL_IGNORE_PROBLEMS_COVERAGE` to
-  additionally tell AFL++ to ignore any coverage from the late loaded libraries.
+  additionally tell AFL++ to ignore any coverage from the late loaded libaries.
 </p></details>
 
 <details>
@@ -284,14 +284,14 @@ If you find an interesting or important question missing, submit it via
   afl-cc/afl-clang-fast/afl-clang-lto:
 
   ```
-  /prg/tmp/llvm-project/build/bin/clang-18: symbol lookup error: /usr/local/bin/../lib/afl//cmplog-instructions-pass.so: undefined symbol: _ZNK4llvm8TypeSizecvmEv
-  clang-18: error: unable to execute command: No such file or directory
-  clang-18: error: clang frontend command failed due to signal (use -v to see invocation)
-  clang version 18.0.0 (https://github.com/llvm/llvm-project 1d7cf550721c51030144f3cd295c5789d51c4aad)
+  /prg/tmp/llvm-project/build/bin/clang-13: symbol lookup error: /usr/local/bin/../lib/afl//cmplog-instructions-pass.so: undefined symbol: _ZNK4llvm8TypeSizecvmEv
+  clang-13: error: unable to execute command: No such file or directory
+  clang-13: error: clang frontend command failed due to signal (use -v to see invocation)
+  clang version 13.0.0 (https://github.com/llvm/llvm-project 1d7cf550721c51030144f3cd295c5789d51c4aad)
   Target: x86_64-unknown-linux-gnu
   Thread model: posix
   InstalledDir: /prg/tmp/llvm-project/build/bin
-  clang-18: note: diagnostic msg:
+  clang-13: note: diagnostic msg:
   ********************
   ```
 

docs/INSTALL.md

@@ -21,7 +21,7 @@ If you want to build AFL++ yourself, you have many options. The easiest choice
 is to build and install everything:
 
 NOTE: depending on your Debian/Ubuntu/Kali/... release, replace `-14` with
-whatever llvm version is available. We recommend llvm 14 or newer.
+whatever llvm version is available. We recommend llvm 13 or newer.
 
 ```shell
 sudo apt-get update
@@ -30,9 +30,6 @@ sudo apt-get install -y build-essential python3-dev automake cmake git flex biso
 sudo apt-get install -y lld-14 llvm-14 llvm-14-dev clang-14 || sudo apt-get install -y lld llvm llvm-dev clang
 sudo apt-get install -y gcc-$(gcc --version|head -n1|sed 's/\..*//'|sed 's/.* //')-plugin-dev libstdc++-$(gcc --version|head -n1|sed 's/\..*//'|sed 's/.* //')-dev
 sudo apt-get install -y ninja-build # for QEMU mode
-sudo apt-get install -y cpio libcapstone-dev # for Nyx mode
-sudo apt-get install -y wget curl # for Frida mode
-sudo apt-get install -y python3-pip # for Unicorn mode
 git clone https://github.com/AFLplusplus/AFLplusplus
 cd AFLplusplus
 make distrib
@@ -90,6 +87,7 @@ These build options exist:
 * PROFILING - compile afl-fuzz with profiling information
 * INTROSPECTION - compile afl-fuzz with mutation introspection
 * NO_PYTHON - disable python support
+* NO_SPLICING - disables splicing mutation in afl-fuzz, not recommended for normal fuzzing
 * NO_UTF - do not use UTF-8 for line rendering in status screen (fallback to G1 box drawing, of vanilla AFL)
 * NO_NYX - disable building nyx mode dependencies
 * NO_CORESIGHT - disable building coresight (arm64 only)
@@ -169,47 +167,3 @@ and definitely don't look POSIX-compliant. This means two things:
 User emulation mode of QEMU does not appear to be supported on macOS, so
 black-box instrumentation mode (`-Q`) will not work. However, FRIDA mode (`-O`)
 works on both x86 and arm64 macOS boxes.
-
-## iOS on arm64 and arm64e
-
-**Option 1: Compilation on jailbroken iOS (recommended)**
-
-To compile directly on a jailbroken iOS device, it is recommended to use a jailbreak that supports Procursus,
-as Procursus provides up-to-date pre-built packages for the required tools.
-
-Ensure `openssh` is installed on your iOS device, then SSH into it.
-Install the following packages:
-
-```shell
-sudo apt install wget git make cmake clang gawk llvm ldid coreutils build-essential xz-utils
-```
-
-Configure the environment for compilation:
-
-```shell
-export IOS_SDK_PATH="/usr/share/SDKs/iPhoneOS.sdk"
-export CC=clang
-export CXX=clang++
-```
-
-Then build following the general Linux instructions.
-
-**Option 2: Cross-Compilation on macOS for Jailbroken iOS**
-
-In addition to the packages required for a macOS build, install `ldid` for signing binaries:
-
-```shell
-brew install ldid-procursus
-```
-
-Configure the environment for compilation:
-
-```shell
-export IOS_SDK_PATH="$(xcrun --sdk iphoneos --show-sdk-path)"
-export CC="$(xcrun --sdk iphoneos -f clang) -target arm64-apple-ios14.0"
-export CXX="$(xcrun --sdk iphoneos -f clang++) -target arm64-apple-ios14.0"
-export HOST_CC=cc
-```
-
-Then build following the general Linux instructions.
-Finally, transfer the binaries to your iOS device.

docs/SAND.md

@@ -1,81 +0,0 @@
-# SAND: Decoupling Sanitization from Fuzzing for Low Overhead
-
-- Authors: Ziqiao Kong, Shaohua Li, Heqing Huang, Zhendong Su
-- Maintainer: [Ziqiao Kong](https://github.com/wtdcode)
-- Preprint: [arXiv](https://arxiv.org/abs/2402.16497), accepted by ICSE 2025
-- Main repo (for paper, reproduction, reference or cite): https://github.com/wtdcode/sand-aflpp
-
-## Motivation
-
-SAND introduces a new fuzzing workflow that can greatly reduce (or even eliminate) sanitizer overhead and combine different sanitizers in one fuzzing campaign.
-
-The key point of SAND is that: sanitizing all inputs is wasting fuzzing power, because bug-triggering inputs are extremely rare (~1%). Obviously, not all inputs worth going through sanitizers. Therefore, if we can somehow "predict" if an input could trigger bugs (defined as "execution pattern"), we could greatly save fuzzing power by only sanitizing a small proportion of all inputs. That's exactly how SAND works.
-
-## Usage
-
-For a normal fuzzing workflow, we have:
-
-1. Build target project with AFL_USE_ASAN=1 to get `target_asan`
-2. Fuzz the target with `afl-fuzz -i seeds -o out -- ./target_asan`
-
-For SAND fuzzing workflow, this is slightly different:
-
-1. Build target project _without_ any sanitizers to get `target_native`, which we will define as a "native binary". It is usually done by using `afl-clang-fast/lto(++)` to compile your project _without_ `AFL_USE_ASAN/UBSAN/MSAN`.
-2. Build target project with AFL_USE_ASAN=1 AFL_LLVM_ONLY_FSRV=1 to get `target_asan`. Do note this step can be repeated for multiple sanitizers, like MSAN, UBSAN etc. It is also possible to have ASAN and UBSAN to build together.
-3. Fuzz the target with `afl-fuzz -i seeds -o out -w ./target_asan -- ./target_native`. Note `-w` can be specified multiple times.
-
-Then you get:
-
-- almost the same performance as `afl-fuzz -i seeds -o out -- ./target_native`
-- and the same bug-finding capability as `afl-fuzz -i seeds -o out -- ./target_asan`
-
-## Example Workflow
-
-Take [test-instr.c](../test-instr.c) as an example.
-
-1. Build the native binary
-
-```bash
-afl-clang-fast test-instr.c -o ./native
-```
-
-Just like the normal building process, except using `afl-clang-fast`
-
-2. Build the sanitizers-enabled binaries.
-
-```bash
-AFL_LLVM_ONLY_FSRV=1 AFL_USE_UBSAN=1 AFL_USE_ASAN=1 afl-clang-fast test-instr.c -o ./asanubsan
-AFL_LLVM_ONLY_FSRV=1 AFL_USE_MSAN=1 afl-clang-fast test-instr.c -o ./msan
-```
-
-Do note `AFL_LLVM_ONLY_FSRV=1` is crucial, this enables forkservers but disables pc instrumentation. You are allowed to reuse sanitizers-enabled binaries, i.e. binaries built _without_ `AFL_LLVM_ONLY_FSRV=1`, at a cost of reduced speed. 
-
-3. Start fuzzing
-
-```bash
-mkdir /tmp/test
-echo "a" > /tmp/test/a
-AFL_NO_UI=1 AFL_SKIP_CPUFREQ=1 afl-fuzz -i /tmp/test -o /tmp/out -w ./asanubsan -w ./msan -- ./native @@
-```
-
-That's it!
-
-## Tips
-
-### Alternative execution patterns
-
-By default, SAND uses the hash value of the simplified coverage map as execution pattern, i.e. if an input has a unique simplefied coverage map, it will be sent to sanitizers for inspection. This shall work for most cases. However, if you are strongly worried about missing bugs, try `AFL_SAN_ABSTRACTION=unique_trace afl-fuzz ...`, which filters inputs having a _unique coverage map_. Do note this significantly increases the number of inputs by 4-10 times, leading to much lower throughput. Alternatively, SAND also supports `AFL_SAN_ABSTRACTION=coverage_increase`, which essentially equals to running sanitizers on the corpus and thus having almost zero overhead, but at a cost of missing ~15% bugs in our evaluation.
-
-### Run as many sanitizers as possible
-
-Though we just used ASAN as an example, SAND works best if you provide more sanitizers, for example, UBSAN and MSAN.
-
-You might do it via `afl-fuzz -i seeds -o out -w ./target_asan -w ./target_msan -w ./target_ubsan -- ./target_native`. Don't worry about the slow sanitizers like MSAN, SAND could still run very fast because only rather a few inputs are sanitized.
-
-### Bugs types
-
-The execution pattern evaluated in our papers is targeting the common bugs, as ASAN/MSAN/UBSAN catches. For other bug types, you probably need to define new execution patterns and re-evaluate.
-
-### My throughput is greatly impacted
-
-Generally, this is due to too many inputs going through sanitizers, for example, because of unstable targets. You could check stats from `plot_file` to confirm this. Try to switch execution patterns as stated above.

docs/afl-fuzz_approach.md

@@ -6,7 +6,7 @@ coverage to effortlessly pick up subtle, local-scale changes to program control
 flow.
 
 Note: If you are interested in a more current up-to-date deep dive how AFL++
-works then we recommend this blog post:
+works then we commend this blog post:
 [https://blog.ritsec.club/posts/afl-under-hood/](https://blog.ritsec.club/posts/afl-under-hood/)
 
 Simplifying a bit, the overall algorithm can be summed up as:
@@ -385,6 +385,10 @@ there are several things to look at:
   subsequent iterations (e.g., due to incomplete clean-up or reinitialization of
   the state) and that most of the fuzzing effort goes to waste.
 
+The paths where variable behavior is detected are marked with a matching entry
+in the `<out_dir>/queue/.state/variable_behavior/` directory, so you can look
+them up easily.
+
 ### CPU load
 
 ```

docs/best_practices.md

@@ -38,8 +38,9 @@ For PCGUARD instrumentation `abort()` is called if this is detected, for LTO
 there will either be no coverage for the instrumented dlopen()'ed libraries or
 you will see lots of crashes in the UI.
 
-Note that this is not an issue if you use the inferiour `afl-gcc-fast`, or
-`AFL_LLVM_INSTRUMENT=CLASSIC/NGRAM/CTX afl-clang-fast` instrumentation.
+Note that this is not an issue if you use the inferiour `afl-gcc-fast`,
+`afl-gcc` or`AFL_LLVM_INSTRUMENT=CLASSIC/NGRAM/CTX afl-clang-fast`
+instrumentation.
 
 ### Fuzzing a binary-only target
 

docs/custom_mutators.md

@@ -151,7 +151,7 @@ def deinit():  # optional for Python
     splicing - or anything else - and can also be ignored. If you are not
     using this additional data then define `splice_optout` (see above).
     This function is optional.
-    Returning a length of 0 is valid and is interpreted as skipping this
+    Returing a length of 0 is valid and is interpreted as skipping this
     one mutation result.
     For non-Python: the returned output buffer is under **your** memory
     management!

docs/env_variables.md

@@ -24,6 +24,7 @@ To select the different instrumentation modes, use one of the following options:
   - Use the `AFL_CC_COMPILER` environment variable with `MODE`. To select
     `MODE`, use one of the following values:
 
+    - `GCC` (afl-gcc/afl-g++)
     - `GCC_PLUGIN` (afl-g*-fast)
     - `LLVM` (afl-clang-fast*)
     - `LTO` (afl-clang-lto*).
@@ -44,10 +45,14 @@ fairly broad use of environment variables instead:
           make
     ```
 
-  - Setting `AFL_CC`, and `AFL_CXX` lets you use alternate downstream
-    compilation tools, rather than the default 'clang', or 'gcc' binaries
+  - Setting `AFL_AS`, `AFL_CC`, and `AFL_CXX` lets you use alternate downstream
+    compilation tools, rather than the default 'as', 'clang', or 'gcc' binaries
     in your `$PATH`.
 
+  - If you are a weird person that wants to compile and instrument asm text
+    files, then use the `AFL_AS_FORCE_INSTRUMENT` variable:
+    `AFL_AS_FORCE_INSTRUMENT=1 afl-gcc foo.s -o foo`
+
   - Most AFL tools do not print any output if stdout/stderr are redirected. If
     you want to get the output into a file, then set the `AFL_DEBUG` environment
     variable. This is sadly necessary for various build processes which fail
@@ -59,9 +64,6 @@ fairly broad use of environment variables instead:
     optimizations, set `AFL_DONT_OPTIMIZE`. However, if `-O...` and/or
     `-fno-unroll-loops` are set, these are not overridden.
 
-  - The optimization level can also be set with `AFL_OPT_LEVEL`, e.g.
-    `AFL_OPT_LEVEL=z` for `-Oz`, default is `3`
-
   - Setting `AFL_HARDEN` automatically adds code hardening options when invoking
     the downstream compiler. This currently includes `-D_FORTIFY_SOURCE=2` and
     `-fstack-protector-all`. The setting is useful for catching non-crashing
@@ -78,13 +80,17 @@ fairly broad use of environment variables instead:
     Setting `AFL_INST_RATIO` to 0 is a valid choice. This will instrument only
     the transitions between function entry points, but not individual branches.
 
-    Note that this is an outdated variable. Only LLVM CLASSIC pass can use this.
+    Note that this is an outdated variable. A few instances (e.g., afl-gcc)
+    still support these, but state-of-the-art (e.g., LLVM LTO and LLVM PCGUARD)
+    do not need this.
 
   - `AFL_NO_BUILTIN` causes the compiler to generate code suitable for use with
     libtokencap.so (but perhaps running a bit slower than without the flag).
 
-  - `AFL_PATH` can be used to point a directory that contains LLVM/GCC plugins
-    for AFL++, AFL++'s runtime objects and QEMU/Frida support files.
+  - `AFL_PATH` can be used to point afl-gcc to an alternate location of afl-as.
+    One possible use of this is utils/clang_asm_normalize/, which lets you
+    instrument hand-written assembly when compiling clang code by plugging a
+    normalizer into the chain. (There is no equivalent feature for GCC.)
 
   - Setting `AFL_QUIET` will prevent afl-as and afl-cc banners from being
     displayed during compilation, in case you find them distracting.
@@ -95,7 +101,6 @@ fairly broad use of environment variables instead:
       detection)
     - `AFL_USE_CFISAN=1` - activates the Control Flow Integrity sanitizer (e.g.
       type confusion vulnerabilities)
-    - `AFL_CFISAN_VERBOSE=1` - outputs detailed information when control flow integrity violations occur, instead of simply terminating with "Illegal Instruction"
     - `AFL_USE_LSAN` - activates the leak sanitizer. To perform a leak check
       within your program at a certain point (such as at the end of an
       `__AFL_LOOP()`), you can run the macro  `__AFL_LEAK_CHECK();` which will
@@ -106,14 +111,6 @@ fairly broad use of environment variables instead:
     - `AFL_USE_TSAN=1` - activates the thread sanitizer to find thread race
       conditions
     - `AFL_USE_UBSAN=1` - activates the undefined behavior sanitizer
-    - `AFL_UBSAN_VERBOSE=1` - outputs detailed diagnostic information when undefined behavior is detected, instead of simply terminating with "Illegal Instruction"
-    . `AFL_USE_RTSAN` . activates the realtime sanitizer (realtime violations in deterministic run time constraints). (clang 20 minimum)
-
-    - Note: both `AFL_CFISAN_VERBOSE=1` and `AFL_UBSAN_VERBOSE=1` are disabled by default as verbose output can significantly slow down fuzzing performance. Use these options only during debugging or when additional crash diagnostics are required
-
-  - `AFL_LLVM_ONLY_FSRV`/`AFL_GCC_ONLY_FSRV` will inject forkserver but not pc instrumentation. Please note this is different compared to `AFL_LLVM_DISABLE_INSTRUMENTATION`, which will totally disable forkserver implementation. This env is pretty useful in two cases:
-    - [SAND](./SAND.md). In this case, the binaries built in this way will serve as extra oracles. Check the corresponding documents for details.
-    - Compatible with LibAFL ForkserverExecutor implementation and thus faster to repeatedly run, compared to simple CommandExecutor.
 
   - `TMPDIR` is used by afl-as for temporary files; if this variable is not set,
     the tool defaults to /tmp.
@@ -252,7 +249,7 @@ used if several separated instrumentations are performed which are then later
 combined.
 
   - `AFL_LLVM_LTO_CALLER` activates collision free CALLER instrumentation
-  - `AFL_LLVM_LTO_CALLER` sets the maximum number of single block functions
+  - `AFL_LLVM_LTO_CALLER` sets the maximum mumber of single block functions
     to dig deeper into a real function. Default 0.
   - `AFL_LLVM_DOCUMENT_IDS=file` will document to a file which edge ID was given
     to which function. This helps to identify functions with variable bytes or
@@ -326,11 +323,6 @@ mode.
     [instrumentation/README.instrument_list.md](../instrumentation/README.instrument_list.md)
     for more information.
 
-    Setting `AFL_GCC_DISABLE_VERSION_CHECK=1` will disable the GCC plugin 
-    version check if the target GCC plugin differs from the system-installed
-    version, resolving issues caused by version mismatches between GCC and 
-    the plugin. 
-
     Setting `AFL_GCC_OUT_OF_LINE=1` will instruct afl-gcc-fast to instrument the
     code with calls to an injected subroutine instead of the much more efficient
     inline instrumentation.
@@ -432,8 +424,9 @@ checks or alter some of the more exotic semantics of the tool:
     types of automated jobs.
 
   - `AFL_EXIT_WHEN_DONE` causes afl-fuzz to terminate when all existing paths
-    have been fuzzed and there were no new finds for a while. This is basically
-    when the fuzzing state says `state: finished`
+    have been fuzzed and there were no new finds for a while. This would be
+    normally indicated by the cycle counter in the UI turning green. May be
+    convenient for some types of automated jobs.
 
   - Setting `AFL_EXPAND_HAVOC_NOW` will start in the extended havoc mode that
     includes costly mutations. afl-fuzz automatically enables this mode when
@@ -617,7 +610,7 @@ checks or alter some of the more exotic semantics of the tool:
     see [rpc_statsd.md](rpc_statsd.md).
 
   - `AFL_SYNC_TIME` allows you to specify a different minimal time (in minutes)
-    between fuzzing instances synchronization. Default sync time is 20 minutes,
+    between fuzzing instances synchronization. Default sync time is 30 minutes,
     note that time is halved for -M main nodes.
 
   - `AFL_NO_SYNC` disables any syncing whatsoever and takes priority on all
@@ -668,24 +661,6 @@ checks or alter some of the more exotic semantics of the tool:
     Note that will not be exact and with slow targets it can take seconds
     until there is a slice for the time test.
 
-  - When using `AFL_PRELOAD` with a preload that disable `fork()` calls in
-    the target, the forkserver becomes unable to fork.
-    To overcome this issue, the `AFL_PRELOAD_DISCRIMINATE_FORKSERVER_PARENT`
-    permits to be able to check in the preloaded library if the environment
-    variable `AFL_FORKSERVER_PARENT` is set, to be able to use vanilla
-    `fork()` in the forkserver, and the placeholder in the target.
-    Here is a POC :
-    ```C
-    // AFL_PRELOAD_DISCRIMINATE_FORKSERVER_PARENT=1 afl-fuzz ...
-    pid_t fork(void)
-    {
-        if (getenv("AFL_FORKSERVER_PARENT") == NULL)
-            return 0; // We are in the target
-        else
-            return real_fork(); // We are in the forkserver
-    }
-    ```
-
 ## 6) Settings for afl-qemu-trace
 
 The QEMU wrapper used to instrument binary-only code supports several settings:

docs/features.md

@@ -6,22 +6,20 @@ QEMU 5.1 with laf-intel and Redqueen, FRIDA mode, unicorn mode, gcc plugin, full
 
 ## Features and instrumentation
 
-Note that afl-gcc and afl-clang have been removed because their instrumentation is absolutely outdated.
-
-| Feature/Instrumentation       | llvm      | gcc_plugin | FRIDA mode(9)  | QEMU mode(10)    | unicorn_mode(10) | nyx_mode(12) | coresight_mode(11) |
-| ------------------------------|:---------:|:----------:|:--------------:|:----------------:|:----------------:|:------------:|:------------------:|
-| Threadsafe counters [A]       |    x(3)   |            |                |                  |                  |       x      |                    |
-| NeverZero           [B]       |    x(1)   |      x     |        x       |         x        |         x        |              |                    |
-| Persistent Mode     [C]       |     x     |      x     | x86[_64]/arm64 | x86[_64]/arm[64] |         x        |              |                    |
-| LAF-Intel / CompCov [D]       |     x     |            |                | x86[_64]/arm[64] | x86[_64]/arm[64] |   x86[_64]   |                    |
-| CmpLog              [E]       |     x     |      x     | x86[_64]/arm64 | x86[_64]/arm[64] |                  |              |                    |
-| Selective Instrumentation [F] |     x     |      x     |        x       |         x        |                  |              |                    |
-| Non-Colliding Coverage    [G] |    x(4)   |            |                |       (x)(5)     |                  |              |                    |
-| Ngram prev_loc Coverage   [H] |    x(6)   |            |                |                  |                  |              |                    |
-| Context Coverage    [I]       |    x(6)   |            |                |                  |                  |              |                    |
-| Auto Dictionary     [J]       |    x(7)   |            |                |                  |                  |              |                    |
-| Snapshot Support    [K]       |   (x)(8)  |   (x)(8)   |                |       (x)(5)     |                  |       x      |                    |
-| Shared Memory Test cases  [L] |     x     |      x     | x86[_64]/arm64 |         x        |         x        |       x      |                    |
+| Feature/Instrumentation       | afl-gcc  | llvm      | gcc_plugin | FRIDA mode(9)  | QEMU mode(10)    | unicorn_mode(10) | nyx_mode(12) | coresight_mode(11) |
+| ------------------------------|:--------:|:---------:|:----------:|:--------------:|:----------------:|:----------------:|:------------:|:------------------:|
+| Threadsafe counters [A]       |          |    x(3)   |            |                |                  |                  |       x      |                    |
+| NeverZero           [B]       | x86[_64] |    x(1)   |      x     |        x       |         x        |         x        |              |                    |
+| Persistent Mode     [C]       |          |     x     |      x     | x86[_64]/arm64 | x86[_64]/arm[64] |         x        |              |                    |
+| LAF-Intel / CompCov [D]       |          |     x     |            |                | x86[_64]/arm[64] | x86[_64]/arm[64] |   x86[_64]   |                    |
+| CmpLog              [E]       |          |     x     |      x     | x86[_64]/arm64 | x86[_64]/arm[64] |                  |              |                    |
+| Selective Instrumentation [F] |          |     x     |      x     |        x       |         x        |                  |              |                    |
+| Non-Colliding Coverage    [G] |          |    x(4)   |            |                |       (x)(5)     |                  |              |                    |
+| Ngram prev_loc Coverage   [H] |          |    x(6)   |            |                |                  |                  |              |                    |
+| Context Coverage    [I]       |          |    x(6)   |            |                |                  |                  |              |                    |
+| Auto Dictionary     [J]       |          |    x(7)   |            |                |                  |                  |              |                    |
+| Snapshot Support    [K]       |          |   (x)(8)  |   (x)(8)   |                |       (x)(5)     |                  |       x      |                    |
+| Shared Memory Test cases  [L] |          |     x     |      x     | x86[_64]/arm64 |         x        |         x        |       x      |                    |
 
 ## More information about features
 
@@ -45,7 +43,7 @@ E. CmpLog is our enhanced
    implementation, see
    [instrumentation/README.cmplog.md](../instrumentation/README.cmplog.md)
 
-F. Similar and compatible to clang 14+ sancov sanitize-coverage-allow/deny but
+F. Similar and compatible to clang 13+ sancov sanitize-coverage-allow/deny but
    for all llvm versions and all our compile modes, only instrument what should
    be instrumented, for more speed, directed fuzzing and less instability; see
    [instrumentation/README.instrument_list.md](../instrumentation/README.instrument_list.md)
@@ -96,7 +94,7 @@ L. Faster fuzzing and less kernel syscall overhead by in-memory fuzz testcase
 
 Among others, the following features and patches have been integrated:
 
-* NeverZero for llvm/gcc instrumentation, QEMU mode and unicorn_mode which
+* NeverZero patch for afl-gcc, instrumentation, QEMU mode and unicorn_mode which
   prevents a wrapping map value to zero, increases coverage
 * Persistent mode, deferred forkserver and in-memory fuzzing for QEMU mode
 * Unicorn mode which allows fuzzing of binaries from completely different
@@ -106,7 +104,6 @@ Among others, the following features and patches have been integrated:
 * Win32 PE binary-only fuzzing with QEMU and Wine
 * AFLfast's power schedules by Marcel Böhme:
   [https://github.com/mboehme/aflfast](https://github.com/mboehme/aflfast)
-* The fast deterministic stage by Han Zheng: [https://github.com/hexhive/mendelFuzz-Artifact/](https://github.com/hexhive/mendelFuzz-Artifact/)
 * The MOpt mutator:
   [https://github.com/puppet-meteor/MOpt-AFL](https://github.com/puppet-meteor/MOpt-AFL)
 * LLVM mode Ngram coverage by Adrian Herrera

docs/fuzzing_binary-only_targets.md

@@ -46,9 +46,10 @@ The following setup to use QEMU mode is recommended:
   `AFL_COMPCOV_LEVEL=2`), alternatively you can use FRIDA mode, just switch `-Q`
   with `-O` and remove the LAF instance
 
-Then run as many instances as you have cores left with either `-Q` mode or use
-a static binary rewriter like Dyninst, RetroWrite, ZAFL, etc.
-The binary rewriters all have their own advantages and caveats, but ZAFL is a good choice.
+Then run as many instances as you have cores left with either -Q mode or - even
+better - use a binary rewriter like Dyninst, RetroWrite, ZAFL, etc.
+The binary rewriters all have their own advantages and caveats.
+ZAFL is the best but cannot be used in a business/commercial context.
 
 If a binary rewriter works for your target then you can use afl-fuzz normally
 and it will have twice the speed compared to QEMU mode (but slower than QEMU
@@ -196,10 +197,9 @@ afl-clang-fast's.
 
 RetroWrite is a static binary rewriter that can be combined with AFL++. If you
 have an x86_64 or arm64 binary that does not contain C++ exceptions and - if
-x86_64 - still has its symbols and compiled with position independent code
+x86_64 - still has it's symbols and compiled with position independent code
 (PIC/PIE), then the RetroWrite solution might be for you.
 It decompiles to ASM files which can then be instrumented with afl-gcc.
-Note that afl-gcc is only present until AFL++ v4.21c and was subsequently removed as it is obsolete.
 
 Binaries that are statically instrumented for fuzzing using RetroWrite are close
 in performance to compiler-instrumented binaries and outperform the QEMU-based

docs/fuzzing_in_depth.md

@@ -61,8 +61,6 @@ evaluation flow will help you to select the best possible.
 It is highly recommended to have the newest llvm version possible installed,
 anything below 9 is not recommended.
 
-IMPORTANT NOTICE: afl-gcc/afl-clang have been removed from AFL++ as they are obsolete.
-
 ```
 +--------------------------------+
 | clang/clang++ 11+ is available | --> use LTO mode (afl-clang-lto/afl-clang-lto++)
@@ -86,7 +84,7 @@ IMPORTANT NOTICE: afl-gcc/afl-clang have been removed from AFL++ as they are obs
     | if not, or if you do not have a gcc with plugin support
     |
     v
-   GAME OVER! Install gcc-VERSION-plugin-dev or llvm-VERSION-dev
+   use GCC mode (afl-gcc/afl-g++) (or afl-clang/afl-clang++ for clang)
 ```
 
 Clickable README links for the chosen compiler:
@@ -94,12 +92,14 @@ Clickable README links for the chosen compiler:
 * [LTO mode - afl-clang-lto](../instrumentation/README.lto.md)
 * [LLVM mode - afl-clang-fast](../instrumentation/README.llvm.md)
 * [GCC_PLUGIN mode - afl-gcc-fast](../instrumentation/README.gcc_plugin.md)
+* GCC/CLANG modes (afl-gcc/afl-clang) have no README as they have no own
+  features
 
 You can select the mode for the afl-cc compiler by one of the following methods:
 
-* Using a symlink to afl-cc: 
+* Using a symlink to afl-cc: afl-gcc, afl-g++, afl-clang, afl-clang++,
    afl-clang-fast, afl-clang-fast++, afl-clang-lto, afl-clang-lto++,
-   afl-gcc-fast, afl-g++-fast.
+   afl-gcc-fast, afl-g++-fast (recommended!).
 * Using the environment variable `AFL_CC_COMPILER` with `MODE`.
 * Passing --afl-`MODE` command line options to the compiler via
    `CFLAGS`/`CXXFLAGS`/`CPPFLAGS`.
@@ -108,7 +108,8 @@ You can select the mode for the afl-cc compiler by one of the following methods:
 
 * LTO (afl-clang-lto*)
 * LLVM (afl-clang-fast*)
-* GCC_PLUGIN (afl-g*-fast)
+* GCC_PLUGIN (afl-g*-fast) or GCC (afl-gcc/afl-g++)
+* CLANG(afl-clang/afl-clang++)
 
 Because no AFL++ specific command-line options are accepted (beside the
 --afl-MODE command), the compile-time tools make fairly broad use of environment
@@ -132,15 +133,11 @@ options are available:
   locations. This technique is very fast and good - if the target does not
   transform input data before comparison. Therefore, this technique is called
   `input to state` or `redqueen`. If you want to use this technique, then you
-  have to compile the target with `AFL_LLVM_CMPLOG=1`.
-  You could use the resulting binary for both normal fuzzing and `-c` CMPLOG
-  mode (with `-c 0`), however this will result in a performance loss of about
-  20%.
-  It is therefore better to compile a specific CMPLOG target with
-  `AFL_LLVM_ONLY_FSRV=1 AFL_LLVM_CMPLOG=1` and pass this binary name via
-  `-c cmplog-fuzzing-target` and compile target again normally with `afl-cc`
-   and use this is the fuzzing target as usual.
-  You can read more about this in
+  have to compile the target twice, once specifically with/for this mode by
+  setting `AFL_LLVM_CMPLOG=1`, and pass this binary to afl-fuzz via the `-c`
+  parameter. Note that you can compile also just a cmplog binary and use that
+  for both, however, there will be a performance penalty. You can read more
+  about this in
   [instrumentation/README.cmplog.md](../instrumentation/README.cmplog.md).
 
 If you use LTO, LLVM, or GCC_PLUGIN mode
@@ -204,12 +201,6 @@ type. This is enough because e.g. a use-after-free bug will be picked up by ASAN
 (address sanitizer) anyway after syncing test cases from other fuzzing
 instances, so running more than one address sanitized target would be a waste.
 
-*IF* you are running a saturated corpus, then you can run up to half of the 
-instances with sanitizers.
-
-An alternative but more effective approach is to use [SAND](./SAND.md) which could
-combine different sanitizers at a much higher throughput.
-
 The following sanitizers have built-in support in AFL++:
 
 * ASAN = Address SANitizer, finds memory corruption vulnerabilities like
@@ -251,12 +242,6 @@ CFISAN. You might need to experiment which sanitizers you can combine in a
 target (which means more instances can be run without a sanitized target, which
 is more effective).
 
-Note that some sanitizers (MSAN and LSAN) exit with a particular exit code
-instead of aborting. afl-fuzz treats these exit codes as a crash when these
-sanitizers are enabled. If the target uses these exit codes there could be false
-positives among the saved crashes. LSAN uses exit code 23 and MSAN uses exit
-code 86.
-
 ### d) Modifying the target
 
 If the target has features that make fuzzing more difficult, e.g., checksums,
@@ -506,8 +491,6 @@ Note:
   protection against attacks! So set strong firewall rules and only expose SSH
   as a network service if you use these (which is highly recommended).
 
-If you execute afl-fuzz in a Docker container, it is recommended to pass [`--cpuset-cpus`](https://docs.docker.com/engine/containers/resource_constraints/#configure-the-default-cfs-scheduler) option with free CPU cores to docker daemon when starting the container, or pass `AFL_NO_AFFINITY` to afl-fuzz. This is due to the fact that AFL++ will bind to a free CPU core by default, while Docker container will prevent AFL++ instance from seeing processes in other containers or host, which leads to all AFL++ instances trying to bind the same CPU core.
-
 If you have an input corpus from [step 2](#2-preparing-the-fuzzing-campaign),
 then specify this directory with the `-i` option. Otherwise, create a new
 directory and create a file with any content as test data in there.
@@ -639,8 +622,8 @@ The other secondaries should be run like this:
 * 40% should run with `-P explore` and 20% with `-P exploit`
 * If you use `-a` then set 30% of the instances to not use `-a`; if you did
   not set `-a` (why??), then set 30% to `-a ascii` and 30% to `-a binary`.
-* run each with a different power schedule, recommended are: `explore` (default),
-  `fast`, `coe`, `lin`, `quad`, `exploit`, and `rare` which you can set with
+* run each with a different power schedule, recommended are: `fast` (default),
+  `explore`, `coe`, `lin`, `quad`, `exploit`, and `rare` which you can set with
   the `-p` option, e.g., `-p explore`. See the
   [FAQ](FAQ.md#what-are-power-schedules) for details.
 
@@ -649,7 +632,7 @@ crash or timeout during startup.
 
 Also, it is recommended to set `export AFL_IMPORT_FIRST=1` to load test cases
 from other fuzzers in the campaign first. But note that can slow down the start
-of the first fuzz by quite a lot if you have many fuzzers and/or many seeds.
+of the first fuzz by quite a lot of you have many fuzzers and/or many seeds.
 
 If you have a large corpus, a corpus from a previous run or are fuzzing in a CI,
 then also set `export AFL_CMPLOG_ONLY_NEW=1` and `export AFL_FAST_CAL=1`.
@@ -869,13 +852,10 @@ Here are some of the most important caveats for AFL++:
 
 - There is no direct support for fuzzing network services, background daemons,
   or interactive apps that require UI interaction to work. You may need to make
-  simple code changes to make them behave in a more traditional way. Preeny,
-  libdesock or desockmulti may offer a relatively simple option, too - see:
+  simple code changes to make them behave in a more traditional way. Preeny or
+  libdesock may offer a relatively simple option, too - see:
   [https://github.com/zardus/preeny](https://github.com/zardus/preeny) or
   [https://github.com/fkie-cad/libdesock](https://github.com/fkie-cad/libdesock)
-  [https://github.com/zyingp/desockmulti](https://github.com/zyingp/desockmulti)
-  If these fail then try our own which might be a bit slower but is more
-  reliable: [utils/libaflppdesock](../utils/libaflppdesock)
 
   Some useful tips for modifying network-based services can be also found at:
   [https://www.fastly.com/blog/how-to-fuzz-server-american-fuzzy-lop](https://www.fastly.com/blog/how-to-fuzz-server-american-fuzzy-lop)

entitlements.plist

@@ -1,29 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/ PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>research.com.apple.license-to-operate</key> <true/>
-	<key>application-identifier</key> <string>aflplusplus</string>
-	<key>com.apple.asl.access_as_root</key> <true/>
-	<key>com.apple.backboardd.launchapplications</key> <true/>
-	<key>com.apple.companionappd.connect.allow</key> <true/>
-	<key>com.apple.multitasking.termination</key> <true/>
-	<key>com.apple.private.security.container-required</key> <false/>
-	<key>com.apple.seld.cm</key> <true/>
-	<key>com.apple.sh</key> <true/>
-	<key>com.apple.private.thread-set-state</key> <true/>
-	<key>com.apple.private.cs.debugger</key> <true/>
-	<key>com.apple.springboard.debugapplications</key> <true/>
-	<key>com.apple.springboard.launchapplications</key> <true/>
-	<key>com.apple.springboard.opensensitiveurl</key> <true/>
-	<key>dynamic-codesigning</key> <true/>
-	<key>get-task-allow</key> <true/>
-	<key>platform-application</key> <true/>
-	<key>run-unsigned-code</key> <true/>
-	<key>task_for_pid-allow</key> <true/>
-	<key>com.apple.private.skip-library-validation</key> <true/>
-	<key>com.apple.private.amfi.can-load-cdhash</key> <true/>
-	<key>com.apple.private.amfi.can-execute-cdhash</key> <true/>
-	<key>com.apple.private.security.no-container</key> <true/>
-</dict>
-</plist>

frida_mode/DEBUGGING.md

@@ -39,7 +39,7 @@ is *VERY* important to carry out these basic steps first before taking on the
 additional complexity of debugging with FRIDA mode or `afl-fuzz`.
 
 - Run your harness outside of the fuzzer, passing it a representative seed as
-  its input `./harness <input>`.
+  it's input `./harness <input>`.
 - Pass your harness multiple seeds to check that it is stable when running
   multiple tests as it will when running in fork server mode `./harness <input1>
   <intput2>`.

frida_mode/GNUmakefile

@@ -15,20 +15,15 @@ JS_OBJ:=$(BUILD_DIR)api.o
 SOURCES:=$(wildcard $(SRC_DIR)**/*.c) $(wildcard $(SRC_DIR)*.c)
 OBJS:=$(foreach src,$(SOURCES),$(OBJ_DIR)$(notdir $(patsubst %.c, %.o, $(src))))
 
-XTOOLS_HOST?=x86_64-linux-gnu
 TARGET_CC?=$(CC)
 TARGET_CXX?=$(CXX)
 HOST_CC?=$(CC)
 HOST_CXX?=$(CXX)
-TARGET_CC_INFO=$(shell $(TARGET_CC) --version)
-IS_IOS:=$(findstring ios, $(TARGET_CC_INFO))
-IS_SIMULATOR:=$(findstring sim, $(TARGET_CC_INFO))
-IS_ANDROID:=$(findstring android, $(TARGET_CC_INFO))
-IS_x86:=$(findstring i686, $(TARGET_CC_INFO))
-IS_x86_64:=$(findstring x86_64, $(TARGET_CC_INFO))
-IS_ARM:=$(findstring arm, $(TARGET_CC_INFO))
-IS_ARM64E:=$(findstring arm64e, $(TARGET_CC_INFO))
-IS_ARM64 := $(or $(findstring aarch64,$(TARGET_CC_INFO)), $(findstring arm64,$(TARGET_CC_INFO)))
+IS_ANDROID:=$(findstring android, $(shell $(TARGET_CC) --version 2>/dev/null))
+IS_x86:=$(findstring i686, $(shell $(TARGET_CC) --version 2>/dev/null))
+IS_x86_64:=$(findstring x86_64, $(shell $(TARGET_CC) --version 2>/dev/null))
+IS_ARM:=$(findstring arm, $(shell $(TARGET_CC) --version 2>/dev/null))
+IS_ARM64:=$(findstring aarch64, $(shell $(TARGET_CC) --version 2>/dev/null))
 CFLAGS+=-fPIC \
 		-D_GNU_SOURCE \
 		-D_FORTIFY_SOURCE=2 \
@@ -100,24 +95,7 @@ endif
 
 GUM_ARCH="-$(ARCH)"
 
-ifdef IS_IOS
- OS:=ios
- ifdef IS_SIMULATOR
-  ifdef IS_x86_64
-   ARCH := x86_64-simulator
-  else ifdef IS_ARM64
-   ARCH := arm64-simulator
-  endif
- else
-  ifdef IS_ARM64E
-   ARCH := arm64e
-  else ifdef IS_ARM64
-   ARCH := arm64
-  endif
- endif
- override CFLAGS += -isysroot $(IOS_SDK_PATH)
- override LDFLAGS += -L$(IOS_SDK_PATH)/usr/lib
-else ifeq "$(shell uname)" "Darwin"
+ifeq "$(shell uname)" "Darwin"
  OS:=macos
  AFL_CFLAGS:=$(AFL_CFLAGS) -Wno-deprecated-declarations
  GUM_ARCH:=""
@@ -187,13 +165,17 @@ ifndef OS
  $(error "Operating system unsupported")
 endif
 
-GUM_DEVKIT_VERSION=17.0.7
+GUM_DEVKIT_VERSION=16.0.11
 GUM_DEVKIT_FILENAME=frida-gumjs-devkit-$(GUM_DEVKIT_VERSION)-$(OS)-$(ARCH).tar.xz
 GUM_DEVKIT_URL="https://github.com/frida/frida/releases/download/$(GUM_DEVKIT_VERSION)/$(GUM_DEVKIT_FILENAME)"
 
 GUM_DEVKIT_TARBALL:=$(FRIDA_BUILD_DIR)$(GUM_DEVKIT_FILENAME)
-GUM_DEVIT_HEADER=$(FRIDA_BUILD_DIR)frida-gumjs.h
+ifdef FRIDA_SOURCE
+GUM_DEVIT_LIBRARY=$(FRIDA_DIR)build/frida-$(OS)-$(ARCH)/lib/libfrida-gumjs-1.0.a
+else
 GUM_DEVIT_LIBRARY=$(FRIDA_BUILD_DIR)libfrida-gumjs.a
+endif
+GUM_DEVIT_HEADER=$(FRIDA_BUILD_DIR)frida-gumjs.h
 
 FRIDA_DIR:=$(PWD)build/frida-source/
 FRIDA_MAKEFILE:=$(FRIDA_DIR)Makefile
@@ -227,13 +209,13 @@ BIN2C_SRC:=$(PWD)util/bin2c.c
 all: $(FRIDA_TRACE) $(FRIDA_TRACE_LIB) $(AFLPP_FRIDA_DRIVER_HOOK_OBJ) $(AFLPP_QEMU_DRIVER_HOOK_OBJ) $(ADDR_BIN)
 
 32:
-	XTOOLS_HOST=i686-linux-gnu CFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
+	CFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
 
 arm:
-	XTOOLS_HOST=arm-linux-gnueabihf CFLAGS="-marm" LDFLAGS="-marm" ARCH="armhf" TARGET_CC=arm-linux-gnueabihf-gcc TARGET_CXX=arm-linux-gnueabihf-g++ make all
+	CFLAGS="-marm" LDFLAGS="-marm" ARCH="armhf" TARGET_CC=arm-linux-gnueabihf-gcc TARGET_CXX=arm-linux-gnueabihf-g++ make all
 
 arm64:
-	XTOOLS_HOST=aarch64-linux-gnu ARCH="arm64" TARGET_CC=aarch64-linux-gnu-gcc TARGET_CXX=aarch64-linux-gnu-g++ make all
+	ARCH="arm64" TARGET_CC=aarch64-linux-gnu-gcc TARGET_CXX=aarch64-linux-gnu-g++ make all
 
 $(BUILD_DIR):
 	mkdir -p $(BUILD_DIR)
@@ -246,29 +228,114 @@ $(OBJ_DIR): | $(BUILD_DIR)
 $(FRIDA_BUILD_DIR): | $(BUILD_DIR)
 	mkdir -p $@
 
-#TODO Set architecture
 ifdef FRIDA_SOURCE
 $(FRIDA_MAKEFILE): | $(BUILD_DIR)
-	git clone https://github.com/frida/frida-gum.git $(FRIDA_DIR)
-	cd $(FRIDA_DIR) && \
-	./configure \
-		--host=$(XTOOLS_HOST) \
-		--enable-tests \
-		--enable-gumpp \
-		--enable-gumjs \
-		--with-devkits=gum,gumjs
+	git clone --recursive https://github.com/frida/frida.git $(FRIDA_DIR)
 
 .PHONY: $(GUM_DEVIT_LIBRARY)
 
-$(GUM_DEVIT_LIBRARY): $(FRIDA_MAKEFILE) | $(FRIDA_BUILD_DIR)
-	echo $(GUM_DEVIT_LIBRARY) $(FRIDA_MAKEFILE) $(FRIDA_BUILD_DIR)
-	cd $(FRIDA_DIR) && make FRIDA_V8=disabled
-	cp $(FRIDA_DIR)build/bindings/gumjs/devkit/frida-gumjs.h $(GUM_DEVIT_HEADER)
-	cp $(FRIDA_DIR)build/bindings/gumjs/devkit/libfrida-gumjs.a $(GUM_DEVIT_LIBRARY)
+$(GUM_DEVIT_LIBRARY): $(FRIDA_MAKEFILE)
+	cd $(FRIDA_DIR) && make gum-$(OS)$(GUM_ARCH) FRIDA_V8=disabled
+
+$(GUM_DEVIT_HEADER): $(FRIDA_MAKEFILE) | $(FRIDA_BUILD_DIR)
+	echo "#include <stdio.h>" > $@
+	echo "#include <unistd.h>" >> $@
+	echo "#include <gum/gumreturnaddress.h>" >> $@
+	echo "#include <gum/gumbacktracer.h>" >> $@
+	echo "#include <gum/gumsymbolutil.h>" >> $@
+	echo "#include <gum/gumstalker.h>" >> $@
+	echo "#include <gum/gumlibc.h>" >> $@
+	echo "#include <gumjs/gumscriptbackend.h>" >> $@
+
+ifeq "$(OS)" "macos"
+
+CFLAGS+=-I $(FRIDA_DIR)build/frida-$(OS)-$(ARCH)/include/frida-1.0 \
+	    -I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/glib-2.0/ \
+		-I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/glib-2.0/include/ \
+		-I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/capstone/ \
+		-I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/json-glib-1.0/ \
+
+TRACE_LDFLAGS+=$(FRIDA_DIR)build/frida-$(OS)-$(ARCH)/lib/libfrida-gum-1.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libsoup-2.4.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libsqlite3.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libtcc.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libjson-glib-1.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libquickjs.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libcapstone.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libffi.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libgio-2.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libgobject-2.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libglib-2.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/liblzma.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libz.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libiconv.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libv8-8.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libgmodule-2.0.a \
+
+else ifeq "$(ARCH)" "arm64"
+
+CFLAGS+=-I $(FRIDA_DIR)build/$(OS)-$(ARCH)/include/frida-1.0 \
+	    -I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/glib-2.0/ \
+		-I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/glib-2.0/include/ \
+		-I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/capstone/ \
+		-I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/json-glib-1.0/ \
 
 ifeq "$(OS)" "android"
 CFLAGS += -static-libstdc++
 endif
+else
+CFLAGS+=-I $(FRIDA_DIR)build/$(OS)-$(ARCH)/include/frida-1.0 \
+	    -I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/glib-2.0/ \
+		-I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/glib-2.0/include/ \
+		-I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/capstone/ \
+		-I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/json-glib-1.0/ \
+
+endif
+
+TRACE_LDFLAGS+=$(FRIDA_DIR)build/frida-$(OS)-$(ARCH)/lib/libfrida-gum-1.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libsoup-2.4.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libsqlite3.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libtcc.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libjson-glib-1.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libquickjs.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libcapstone.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libunwind.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libffi.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libdwarf.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libelf.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libgio-2.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libgobject-2.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libglib-2.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/liblzma.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libz.a \
+
+CFLAGS+=-I $(FRIDA_DIR)build/frida-$(OS)-$(ARCH)/include/frida-1.0 \
+	    -I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/glib-2.0/ \
+		-I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/glib-2.0/include/ \
+		-I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/capstone/ \
+		-I $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/include/json-glib-1.0/
+
+ifeq "$(OS)" "android"
+ CFLAGS += -static-libstdc++
+endif
+
+TRACE_LDFLAGS+=$(FRIDA_DIR)build/frida-$(OS)-$(ARCH)/lib/libfrida-gum-1.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libsoup-2.4.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libsqlite3.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libtcc.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libjson-glib-1.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libquickjs.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libcapstone.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libunwind.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libffi.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libdwarf.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libelf.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libgio-2.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libgobject-2.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libglib-2.0.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/liblzma.a \
+			   $(FRIDA_DIR)build/sdk-$(OS)-$(ARCH)/lib/libz.a \
+
 
 else
 $(GUM_DEVKIT_TARBALL): | $(FRIDA_BUILD_DIR)
@@ -306,11 +373,6 @@ $(AFL_PERFORMANCE_OBJ): $(AFL_PERFORMANCE_SRC)
 
 $(BIN2C): $(BIN2C_SRC)
 	$(HOST_CC) -D_GNU_SOURCE -o $@ $<
-ifdef IS_IOS
-ifeq ($(HOST_CC),$(TARGET_CC))
-	@ldid -S../entitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
-endif
 
 $(JS_SRC): $(JS) $(BIN2C)| $(BUILD_DIR)
 	cd $(JS_DIR) && $(BIN2C) api_js $(JS) $@
@@ -351,10 +413,8 @@ $(FRIDA_TRACE): $(GUM_DEVIT_LIBRARY) $(GUM_DEVIT_HEADER) $(OBJS) $(JS_OBJ) $(AFL
 		$(TRACE_LDFLAGS) \
 		$(LDFLAGS) \
 		$(LDSCRIPT) \
-		-o $@
-ifdef IS_IOS
-	@ldid -S../entitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
+		-o $@ \
+
 	cp -v $(FRIDA_TRACE) $(ROOT)
 
 $(FRIDA_TRACE_LIB): $(GUM_DEVIT_LIBRARY) $(GUM_DEVIT_HEADER) $(OBJS) $(JS_OBJ) $(AFL_COMPILER_RT_OBJ) $(AFL_PERFORMANCE_OBJ) GNUmakefile | $(BUILD_DIR)
@@ -370,15 +430,9 @@ $(FRIDA_TRACE_LIB): $(GUM_DEVIT_LIBRARY) $(GUM_DEVIT_HEADER) $(OBJS) $(JS_OBJ) $
 
 $(AFLPP_FRIDA_DRIVER_HOOK_OBJ): $(AFLPP_FRIDA_DRIVER_HOOK_SRC) $(GUM_DEVIT_HEADER) | $(BUILD_DIR)
 	$(TARGET_CC) $(CFLAGS) $(LDFLAGS) -I $(FRIDA_BUILD_DIR) $< -o $@
-ifdef IS_IOS
-	@ldid -S../entitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 $(AFLPP_QEMU_DRIVER_HOOK_OBJ): $(AFLPP_QEMU_DRIVER_HOOK_SRC) | $(BUILD_DIR)
 	$(TARGET_CC) $(CFLAGS) $(LDFLAGS) $< -o $@
-ifdef IS_IOS
-	@ldid -S../entitlements.plist $@ && echo "[+] Signed $@" || { echo "[-] Failed to sign $@"; }
-endif
 
 hook: $(AFLPP_FRIDA_DRIVER_HOOK_OBJ) $(AFLPP_QEMU_DRIVER_HOOK_OBJ)
 

frida_mode/MapDensity.md

@@ -107,7 +107,7 @@ every block of code we execute, performance is critical.
 However, the design of the binary instrumentation modes of AFL++ has moved on.
 Both QEMU and FRIDA modes use a two stage process when executing a target
 application. Each block is first compiled or instrumented, and then it is
-executed. The compiled blocks can be reused each time the target executes them.
+executed. The compiled blocks can be re-used each time the target executes them.
 
 Since a blocks ID is based on its address, and this is known at compile time, we
 only need to generate this ID once per block and so this ID generation no longer

frida_mode/README.md

@@ -200,10 +200,10 @@ instrumented address block translations.
 * `AFL_FRIDA_INST_NO_SUPPRESS` - Disable deterministic branch suppression.
   Deterministic branch suppression skips the preamble which generates coverage
   information at the start of each block, if the block is reached by a
-  deterministic branch. This reduces map pollution, and may improve performance
+  deterministic branch. This reduces map polution, and may improve performance
   when all the executing blocks have been prefetched and backpatching applied.
   However, in the event that backpatching is incomplete, this may incur a
-  performance penalty as branch instructions are disassembled on each branch.
+  performance penatly as branch instructions are disassembled on each branch.
 * `AFL_FRIDA_INST_SEED` - Sets the initial seed for the hash function used to
   generate block (and hence edge) IDs. Setting this to a constant value may be
   useful for debugging purposes, e.g., investigating unstable edges.
@@ -215,7 +215,7 @@ instrumented address block translations.
   coverage information for unstable edges (e.g., to be loaded within IDA
   lighthouse).
 * `AFL_FRIDA_JS_SCRIPT` - Set the script to be loaded by the FRIDA scripting
-  engine. See [Scripting.md](Scripting.md) for details.
+  engine. See [Scipting.md](Scripting.md) for details.
 * `AFL_FRIDA_OUTPUT_STDOUT` - Redirect the standard output of the target
   application to the named file (supersedes the setting of `AFL_DEBUG_CHILD`).
 * `AFL_FRIDA_OUTPUT_STDERR` - Redirect the standard error of the target

frida_mode/Scripting.md

@@ -724,16 +724,16 @@ class Afl {
    * it takes as arguments a `NativePointer` and a `number`. It can be
    * called multiple times to exclude several ranges.
    */
-  static addExcludedRange(addresses, size) {
-      Afl.jsApiAddExcludeRange(addresses, size);
+  static addExcludedRange(addressess, size) {
+      Afl.jsApiAddExcludeRange(addressess, size);
   }
   /**
    * This is equivalent to setting a value in `AFL_FRIDA_INST_RANGES`,
    * it takes as arguments a `NativePointer` and a `number`. It can be
    * called multiple times to include several ranges.
    */
-  static addIncludedRange(addresses, size) {
-      Afl.jsApiAddIncludeRange(addresses, size);
+  static addIncludedRange(addressess, size) {
+      Afl.jsApiAddIncludeRange(addressess, size);
   }
   /**
    * This must always be called at the end of your script. This lets
@@ -771,7 +771,7 @@ class Afl {
   }
   /**
    * Print a message to the STDOUT. This should be preferred to
-   * FRIDA's `console.log` since FRIDA will queue its log messages.
+   * FRIDA's `console.log` since FRIDA will queue it's log messages.
    * If `console.log` is used in a callback in particular, then there
    * may no longer be a thread running to service this queue.
    */
@@ -893,14 +893,14 @@ class Afl {
   }
   /**
    * This is equivalent to setting `AFL_FRIDA_PERSISTENT_ADDR`, again a
-   * `NativePointer` should be provided as its argument.
+   * `NativePointer` should be provided as it's argument.
    */
   static setPersistentAddress(address) {
       Afl.jsApiSetPersistentAddress(address);
   }
   /**
    * This is equivalent to setting `AFL_FRIDA_PERSISTENT_CNT`, a
-   * `number` should be provided as its argument.
+   * `number` should be provided as it's argument.
    */
   static setPersistentCount(count) {
       Afl.jsApiSetPersistentCount(count);
@@ -920,7 +920,7 @@ class Afl {
   }
   /**
    * This is equivalent to setting `AFL_FRIDA_PERSISTENT_RET`, again a
-   * `NativePointer` should be provided as its argument.
+   * `NativePointer` should be provided as it's argument.
    */
   static setPersistentReturn(address) {
       Afl.jsApiSetPersistentReturn(address);

frida_mode/many-linux/README.md

@@ -4,6 +4,6 @@ This folder contains a Docker image to allow the building of
 `afl-frida-trace.so` using the `many-linux` docker image. This docker image is
 based on CentOS Linux 5. By building `afl-frida-trace.so` for such an old
 version of Linux, given the strong backward compatibility of Linux, this should
-work on the majority of Linux environments. This may be useful for targeting
+work on the majority of Linux environments. This may be useful for targetting
 Linux distributions other than your development environment. `many-local` builds
 `AFLplusplus` from the local working copy in the `many-linux` environment.

frida_mode/src/asan/asan.c

@@ -27,21 +27,25 @@ void asan_init(void) {
 
 }
 
-static gboolean asan_exclude_module(GumModule *module, gpointer user_data) {
+static gboolean asan_exclude_module(const GumModuleDetails *details,
+                                    gpointer                user_data) {
 
-  gchar                *symbol_name = (gchar *)user_data;
-  GumAddress            address;
-  const GumMemoryRange *range = gum_module_get_range(module);
+  gchar     *symbol_name = (gchar *)user_data;
+  GumAddress address;
 
-  address = gum_module_find_export_by_name(module, symbol_name);
+  address = gum_module_find_export_by_name(details->name, symbol_name);
   if (address == 0) { return TRUE; }
 
   /* If the reported address of the symbol is outside of the range of the module
    * then ignore it */
-  if (address < range->base_address) { return TRUE; }
-  if (address > (range->base_address + range->size)) { return TRUE; }
+  if (address < details->range->base_address) { return TRUE; }
+  if (address > (details->range->base_address + details->range->size)) {
 
-  ranges_add_exclude((GumMemoryRange *)range);
+    return TRUE;
+
+  }
+
+  ranges_add_exclude((GumMemoryRange *)details->range);
   return FALSE;
 
 }

frida_mode/src/asan/asan_arm64.c

@@ -39,18 +39,18 @@ static void asan_callout(GumCpuContext *ctx, gpointer user_data) {
 
   address = base + index + mem->disp;
 
-  if ((operand->access & CS_AC_WRITE) == CS_AC_WRITE) {
-
-    asan_storeN(address, asan_ctx->size);
-
-  }
-
   if ((operand->access & CS_AC_READ) == CS_AC_READ) {
 
     asan_loadN(address, asan_ctx->size);
 
   }
 
+  if ((operand->access & CS_AC_WRITE) == CS_AC_WRITE) {
+
+    asan_storeN(address, asan_ctx->size);
+
+  }
+
 }
 
 void asan_instrument(const cs_insn *instr, GumStalkerIterator *iterator) {

frida_mode/src/cmplog/cmplog.c

@@ -166,7 +166,7 @@ gboolean cmplog_is_readable(guint64 addr, size_t size) {
    */
   if (addr < DEFAULT_MMAP_MIN_ADDR) { return false; }
 
-  /* Check our address/length don't wrap around */
+  /* Check our addres/length don't wrap around */
   if (SIZE_MAX - addr < size) { return false; }
 
   GumAddress inner_base = addr;

frida_mode/src/instrument/instrument.c

@@ -186,7 +186,7 @@ static void instrument_basic_block(GumStalkerIterator *iterator,
      * execution), we instead ensure that we honour the additional
      * instrumentation requested (e.g. coverage, asan and complog) when a block
      * is compiled no matter where we are during initialization. We will end up
-     * reusing these blocks if the code under test calls a block which is also
+     * re-using these blocks if the code under test calls a block which is also
      * used during initialization.
      *
      * Coverage data generated during initialization isn't a problem since the

frida_mode/src/instrument/instrument_arm64.c

@@ -285,7 +285,7 @@ static void instrument_coverage_switch(GumStalkerObserver *self,
 
   /*
    * If the branch is deterministic, then we should start execution at the
-   * beginning of the block. From here, we will branch and skip the coverage
+   * begining of the block. From here, we will branch and skip the coverage
    * code and jump right to the target code of the instrumented block.
    * Otherwise, if the branch is non-deterministic, then we need to branch
    * part way into the block to where the coverage instrumentation starts.
@@ -516,7 +516,7 @@ void instrument_coverage_optimize(const cs_insn    *instr,
    * an instruction to load x16,x17 from beyond the red-zone on the stack. A
    * pair of registers are saved/restored because on AARCH64, the stack pointer
    * must be 16 byte aligned. This instruction is emitted into the block before
-   * the transformer (from which we are called) is executed. If is is possible
+   * the tranformer (from which we are called) is executed. If is is possible
    * for Stalker to make a direct branch (the target block is close enough), it
    * can forego pushing the registers and instead branch at an offset into the
    * block to skip this restoration prolog.

frida_mode/src/instrument/instrument_coverage.c

@@ -818,9 +818,6 @@ void instrument_coverage_unstable_find_output(void) {
 
   GDir *dir = g_dir_open(fds_name, 0, NULL);
 
-  gchar *path_tmp = getenv("AFL_CUSTOM_INFO_OUT");
-  gchar *instance_name = g_path_get_basename(path_tmp);
-
   FVERBOSE("Coverage Unstable - fds: %s", fds_name);
 
   for (const gchar *filename = g_dir_read_name(dir); filename != NULL;
@@ -832,7 +829,7 @@ void instrument_coverage_unstable_find_output(void) {
     if (link == NULL) { FFATAL("Failed to read link: %s", fullname); }
 
     gchar *basename = g_path_get_basename(link);
-    if (g_strcmp0(basename, instance_name) != 0) {
+    if (g_strcmp0(basename, "default") != 0) {
 
       g_free(basename);
       g_free(link);
@@ -877,7 +874,6 @@ void instrument_coverage_unstable_find_output(void) {
   }
 
   g_dir_close(dir);
-  g_free(instance_name);
   g_free(fds_name);
 
   if (unstable_coverage_fuzzer_stats == NULL) {

frida_mode/src/js/api.js

@@ -5,16 +5,16 @@ class Afl {
      * it takes as arguments a `NativePointer` and a `number`. It can be
      * called multiple times to exclude several ranges.
      */
-    static addExcludedRange(addresses, size) {
-        Afl.jsApiAddExcludeRange(addresses, size);
+    static addExcludedRange(addressess, size) {
+        Afl.jsApiAddExcludeRange(addressess, size);
     }
     /**
      * This is equivalent to setting a value in `AFL_FRIDA_INST_RANGES`,
      * it takes as arguments a `NativePointer` and a `number`. It can be
      * called multiple times to include several ranges.
      */
-    static addIncludedRange(addresses, size) {
-        Afl.jsApiAddIncludeRange(addresses, size);
+    static addIncludedRange(addressess, size) {
+        Afl.jsApiAddIncludeRange(addressess, size);
     }
     /**
      * This must always be called at the end of your script. This lets
@@ -52,7 +52,7 @@ class Afl {
     }
     /**
      * Print a message to the STDOUT. This should be preferred to
-     * FRIDA's `console.log` since FRIDA will queue its log messages.
+     * FRIDA's `console.log` since FRIDA will queue it's log messages.
      * If `console.log` is used in a callback in particular, then there
      * may no longer be a thread running to service this queue.
      */
@@ -205,14 +205,14 @@ class Afl {
     }
     /**
      * This is equivalent to setting `AFL_FRIDA_PERSISTENT_ADDR`, again a
-     * `NativePointer` should be provided as its argument.
+     * `NativePointer` should be provided as it's argument.
      */
     static setPersistentAddress(address) {
         Afl.jsApiSetPersistentAddress(address);
     }
     /**
      * This is equivalent to setting `AFL_FRIDA_PERSISTENT_CNT`, a
-     * `number` should be provided as its argument.
+     * `number` should be provided as it's argument.
      */
     static setPersistentCount(count) {
         Afl.jsApiSetPersistentCount(count);
@@ -232,7 +232,7 @@ class Afl {
     }
     /**
      * This is equivalent to setting `AFL_FRIDA_PERSISTENT_RET`, again a
-     * `NativePointer` should be provided as its argument.
+     * `NativePointer` should be provided as it's argument.
      */
     static setPersistentReturn(address) {
         Afl.jsApiSetPersistentReturn(address);
@@ -382,5 +382,5 @@ Afl.jsApiSetTraceable = Afl.jsApiGetFunction("js_api_set_traceable", "void", [])
 Afl.jsApiSetVerbose = Afl.jsApiGetFunction("js_api_set_verbose", "void", []);
 Afl.jsApiWrite = new NativeFunction(
 /* tslint:disable-next-line:no-null-keyword */
-Module.getGlobalExportByName("write"), "int", ["int", "pointer", "int"]);
+Module.getExportByName(null, "write"), "int", ["int", "pointer", "int"]);
 Afl.jsApiIjonSet = Afl.jsApiGetFunction("js_api_ijon_set", "void", ["uint32"]);

frida_mode/src/lib/lib.c

@@ -39,19 +39,17 @@ typedef struct {
 static guint64 text_base = 0;
 static guint64 text_limit = 0;
 
-static gboolean lib_find_exe(GumModule *module, gpointer user_data) {
+static gboolean lib_find_exe(const GumModuleDetails *details,
+                             gpointer                user_data) {
 
-  lib_details_t        *lib_details = (lib_details_t *)user_data;
-  const gchar          *name = gum_module_get_name(module);
-  const gchar          *path = gum_module_get_path(module);
-  const GumMemoryRange *range = gum_module_get_range(module);
+  lib_details_t *lib_details = (lib_details_t *)user_data;
 
-  strncpy(lib_details->name, name, PATH_MAX);
-  strncpy(lib_details->path, path, PATH_MAX);
+  strncpy(lib_details->name, details->name, PATH_MAX);
+  strncpy(lib_details->path, details->path, PATH_MAX);
   lib_details->name[PATH_MAX] = '\0';
   lib_details->path[PATH_MAX] = '\0';
-  lib_details->base_address = range->base_address;
-  lib_details->size = range->size;
+  lib_details->base_address = details->range->base_address;
+  lib_details->size = details->range->size;
   return FALSE;
 
 }

frida_mode/src/lib/lib_apple.c

@@ -12,18 +12,17 @@ extern void        gum_darwin_enumerate_modules(mach_port_t        task,
 static guint64 text_base = 0;
 static guint64 text_limit = 0;
 
-static gboolean lib_get_main_module(GumModule *module, gpointer user_data) {
+static gboolean lib_get_main_module(const GumModuleDetails *details,
+                                    gpointer                user_data) {
 
-  GumDarwinModule     **ret = (GumDarwinModule **)user_data;
-  const gchar          *path = gum_module_get_path(module);
-  const GumMemoryRange *range = gum_module_get_range(module);
-  GumDarwinModule      *darwin_module = gum_darwin_module_new_from_memory(
-      path, mach_task_self(), range->base_address, GUM_DARWIN_MODULE_FLAGS_NONE,
-      NULL);
+  GumDarwinModule **ret = (GumDarwinModule **)user_data;
+  GumDarwinModule  *module = gum_darwin_module_new_from_memory(
+      details->path, mach_task_self(), details->range->base_address,
+      GUM_DARWIN_MODULE_FLAGS_NONE, NULL);
 
-  FVERBOSE("Found main module: %s", darwin_module->name);
+  FVERBOSE("Found main module: %s", module->name);
 
-  *ret = darwin_module;
+  *ret = module;
 
   return FALSE;
 

frida_mode/src/module.c

@@ -46,7 +46,6 @@ gboolean found_range(const GumRangeDetails *details, gpointer user_data) {
 static int on_dlclose(void *handle) {
 
   GArray          *ranges = NULL;
-  GumModule       *module = NULL;
   struct link_map *lm = NULL;
   gum_range_t     *range = NULL;
   GumAddress       base;
@@ -62,12 +61,8 @@ static int on_dlclose(void *handle) {
   FVERBOSE("on_dlclose: %s", lm->l_name);
 
   ranges = g_array_new(FALSE, TRUE, sizeof(gum_range_t));
-
-  module = gum_process_find_module_by_name(lm->l_name);
-
-  if (module == NULL) { FATAL("Failed to find module: %s", lm->l_name); }
-
-  gum_module_enumerate_ranges(module, GUM_PAGE_EXECUTE, found_range, ranges);
+  gum_module_enumerate_ranges(lm->l_name, GUM_PAGE_EXECUTE, found_range,
+                              ranges);
 
   int ret = dlclose(handle);
   if (ret != 0) {

frida_mode/src/persistent/persistent_arm64.c

@@ -295,8 +295,6 @@ void persistent_prologue_arch(GumStalkerOutput *output) {
    *  CALL instrument_afl_persistent_loop
    *  CALL hook (optionally)
    *  RESTORE REGS
-   *  CALL INSTRUMENTED PERSISTENT FUNC
-   *  JMP loop
    *  INSTRUMENTED PERSISTENT FUNC
    */
 
@@ -304,25 +302,15 @@ void persistent_prologue_arch(GumStalkerOutput *output) {
 
   FVERBOSE("Persistent loop reached");
 
-  /* This is the location our epilogue should be written below */
   if (persistent_ret == 0) { instrument_persitent_save_lr(cw); }
 
   /* Save the current context */
   instrument_persitent_save_regs(cw, &saved_regs);
 
-  /*
-   * Store a pointer to where we should return for our next iteration.
-   * This is the location our epilogue should branch to
-   */
+  /* Store a pointer to where we should return for our next iteration */
   persistent_loop = gum_arm64_writer_cur(cw);
 
-  gconstpointer loop = cw->code + 1;
-  gum_arm64_writer_put_label(cw, loop);
-
-  /*
-   * call __afl_persistent_loop which will _exit if we have reached our
-   * loop count. Also reset our previous_pc
-   */
+  /* call __afl_persistent_loop and _exit if zero. Also reset our previous_pc */
   instrument_afl_persistent_loop(cw);
 
   /* Optionally call the persistent hook */
@@ -331,27 +319,6 @@ void persistent_prologue_arch(GumStalkerOutput *output) {
   /* Restore our CPU context before we continue execution */
   instrument_persitent_restore_regs(cw, &saved_regs);
 
-  gconstpointer original = cw->code + 1;
-
-  /*
-   * Call our original code, that way we regain control if our target
-   * function returns without reaching the epilogue as an additional
-   * safety net
-   */
-  gum_arm64_writer_put_bl_label(cw, original);
-
-  /*
-   * Return for our next iteration if our original function returns
-   * and control hasn't reached the epilogue for some reason
-   */
-  gum_arm64_writer_put_b_label(cw, loop);
-
-  /*
-   * The original code for our target function will be emitted
-   * immediately following this
-   */
-  gum_arm64_writer_put_label(cw, original);
-
   if (persistent_debug) { gum_arm64_writer_put_brk_imm(cw, 0); }
 
 }

frida_mode/src/prefetch.c

@@ -264,7 +264,7 @@ static int prefetch_on_fork(void) {
 static void prefetch_hook_fork(void) {
 
   void *fork_addr =
-      GSIZE_TO_POINTER(gum_module_find_global_export_by_name("fork"));
+      GSIZE_TO_POINTER(gum_module_find_export_by_name(NULL, "fork"));
   intercept_hook(fork_addr, prefetch_on_fork, NULL);
 
 }

frida_mode/src/ranges.c

@@ -37,7 +37,7 @@ static void convert_address_token(gchar *token, GumMemoryRange *range) {
 
   if (token_count != 2) {
 
-    FFATAL("Invalid range (should have two addresses separated by a '-'): %s\n",
+    FFATAL("Invalid range (should have two addresses seperated by a '-'): %s\n",
            token);
 
   }
@@ -116,22 +116,20 @@ static void convert_address_token(gchar *token, GumMemoryRange *range) {
 
 }
 
-static gboolean convert_name_token_for_module(GumModule *module,
-                                              gpointer   user_data) {
+static gboolean convert_name_token_for_module(const GumModuleDetails *details,
+                                              gpointer user_data) {
 
-  convert_name_ctx_t   *ctx = (convert_name_ctx_t *)user_data;
-  const GumMemoryRange *range = gum_module_get_range(module);
-  const gchar          *path = gum_module_get_path(module);
-  if (path == NULL) { return true; };
+  convert_name_ctx_t *ctx = (convert_name_ctx_t *)user_data;
+  if (details->path == NULL) { return true; };
 
-  if (!g_str_has_suffix(path, ctx->suffix)) { return true; };
+  if (!g_str_has_suffix(details->path, ctx->suffix)) { return true; };
 
   FVERBOSE("Found module - prefix: %s, 0x%016" G_GINT64_MODIFIER
            "x-0x%016" G_GINT64_MODIFIER "x %s",
-           ctx->suffix, range->base_address, range->base_address + range->size,
-           path);
+           ctx->suffix, details->range->base_address,
+           details->range->base_address + details->range->size, details->path);
 
-  *ctx->range = *range;
+  *ctx->range = *details->range;
   ctx->done = true;
   return false;
 

frida_mode/ts/lib/afl.ts

@@ -11,8 +11,8 @@ class Afl {
    * it takes as arguments a `NativePointer` and a `number`. It can be
    * called multiple times to exclude several ranges.
    */
-  public static addExcludedRange(addresses: NativePointer, size: number): void {
-    Afl.jsApiAddExcludeRange(addresses, size);
+  public static addExcludedRange(addressess: NativePointer, size: number): void {
+    Afl.jsApiAddExcludeRange(addressess, size);
   }
 
   /**
@@ -20,8 +20,8 @@ class Afl {
    * it takes as arguments a `NativePointer` and a `number`. It can be
    * called multiple times to include several ranges.
    */
-  public static addIncludedRange(addresses: NativePointer, size: number): void {
-    Afl.jsApiAddIncludeRange(addresses, size);
+  public static addIncludedRange(addressess: NativePointer, size: number): void {
+    Afl.jsApiAddIncludeRange(addressess, size);
   }
 
   /**
@@ -66,7 +66,7 @@ class Afl {
 
   /**
    * Print a message to the STDOUT. This should be preferred to
-   * FRIDA's `console.log` since FRIDA will queue its log messages.
+   * FRIDA's `console.log` since FRIDA will queue it's log messages.
    * If `console.log` is used in a callback in particular, then there
    * may no longer be a thread running to service this queue.
    */
@@ -241,7 +241,7 @@ class Afl {
 
   /**
    * This is equivalent to setting `AFL_FRIDA_PERSISTENT_ADDR`, again a
-   * `NativePointer` should be provided as its argument.
+   * `NativePointer` should be provided as it's argument.
    */
   public static setPersistentAddress(address: NativePointer): void {
     Afl.jsApiSetPersistentAddress(address);
@@ -249,7 +249,7 @@ class Afl {
 
   /**
    * This is equivalent to setting `AFL_FRIDA_PERSISTENT_CNT`, a
-   * `number` should be provided as its argument.
+   * `number` should be provided as it's argument.
    */
   public static setPersistentCount(count: number): void {
     Afl.jsApiSetPersistentCount(count);
@@ -272,7 +272,7 @@ class Afl {
 
   /**
    * This is equivalent to setting `AFL_FRIDA_PERSISTENT_RET`, again a
-   * `NativePointer` should be provided as its argument.
+   * `NativePointer` should be provided as it's argument.
    */
   public static setPersistentReturn(address: NativePointer): void {
     Afl.jsApiSetPersistentReturn(address);

frida_mode/update_frida_version.sh

@@ -9,11 +9,5 @@ echo Newest available version: $NEW
 
 test -z "$OLD" -o -z "$NEW" -o "$OLD" = "$NEW" && { echo Nothing to be done. ; exit 0 ; }
 
-# Determine the correct sed command
-case $(sed --help 2>&1) in
-  *GNU*) set sed -i;;
-  *) set sed -i '';;
-esac
-
-"$@" "s/=$OLD/=$NEW/" GNUmakefile || exit 1
+sed -i "s/=$OLD/=$NEW/" GNUmakefile || exit 1
 echo Successfully updated GNUmakefile

include/afl-as.h

@@ -0,0 +1,775 @@
+/*
+   american fuzzy lop++ - injectable parts
+   ---------------------------------------
+
+   Originally written by Michal Zalewski
+
+   Now maintained by Marc Heuse <mh@mh-sec.de>,
+                     Heiko Eissfeldt <heiko.eissfeldt@hexco.de>,
+                     Andrea Fioraldi <andreafioraldi@gmail.com>,
+                     Dominik Maier <mail@dmnk.co>
+
+   Copyright 2016, 2017 Google Inc. All rights reserved.
+   Copyright 2019-2024 AFLplusplus Project. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+     https://www.apache.org/licenses/LICENSE-2.0
+
+   This file houses the assembly-level instrumentation injected into fuzzed
+   programs. The instrumentation stores XORed pairs of data: identifiers of the
+   currently executing branch and the one that executed immediately before.
+
+   TL;DR: the instrumentation does shm_trace_map[cur_loc ^ prev_loc]++
+
+   The code is designed for 32-bit and 64-bit x86 systems. Both modes should
+   work everywhere except for Apple systems. Apple does relocations differently
+   from everybody else, so since their OSes have been 64-bit for a longer while,
+   I didn't go through the mental effort of porting the 32-bit code.
+
+   In principle, similar code should be easy to inject into any well-behaved
+   binary-only code (e.g., using DynamoRIO). Conditional jumps offer natural
+   targets for instrumentation, and should offer comparable probe density.
+
+ */
+
+#ifndef _HAVE_AFL_AS_H
+#define _HAVE_AFL_AS_H
+
+#include "config.h"
+#include "types.h"
+
+/*
+   ------------------
+   Performances notes
+   ------------------
+
+   Contributions to make this code faster are appreciated! Here are some
+   rough notes that may help with the task:
+
+   - Only the trampoline_fmt and the non-setup __afl_maybe_log code paths are
+     really worth optimizing; the setup / fork server stuff matters a lot less
+     and should be mostly just kept readable.
+
+   - We're aiming for modern CPUs with out-of-order execution and large
+     pipelines; the code is mostly follows intuitive, human-readable
+     instruction ordering, because "textbook" manual reorderings make no
+     substantial difference.
+
+   - Interestingly, instrumented execution isn't a lot faster if we store a
+     variable pointer to the setup, log, or return routine and then do a reg
+     call from within trampoline_fmt. It does speed up non-instrumented
+     execution quite a bit, though, since that path just becomes
+     push-call-ret-pop.
+
+   - There is also not a whole lot to be gained by doing SHM attach at a
+     fixed address instead of retrieving __afl_area_ptr. Although it allows us
+     to have a shorter log routine inserted for conditional jumps and jump
+     labels (for a ~10% perf gain), there is a risk of bumping into other
+     allocations created by the program or by tools such as ASAN.
+
+   - popf is *awfully* slow, which is why we're doing the lahf / sahf +
+     overflow test trick. Unfortunately, this forces us to taint eax / rax, but
+     this dependency on a commonly-used register still beats the alternative of
+     using pushf / popf.
+
+     One possible optimization is to avoid touching flags by using a circular
+     buffer that stores just a sequence of current locations, with the XOR stuff
+     happening offline. Alas, this doesn't seem to have a huge impact:
+
+     https://groups.google.com/d/msg/afl-users/MsajVf4fRLo/2u6t88ntUBIJ
+
+   - Preforking one child a bit sooner, and then waiting for the "go" command
+     from within the child, doesn't offer major performance gains; fork() seems
+     to be relatively inexpensive these days. Preforking multiple children does
+     help, but badly breaks the "~1 core per fuzzer" design, making it harder to
+     scale up. Maybe there is some middle ground.
+
+   Perhaps of note: in the 64-bit version for all platforms except for Apple,
+   the instrumentation is done slightly differently than on 32-bit, with
+   __afl_prev_loc and __afl_area_ptr being local to the object file (.lcomm),
+   rather than global (.comm). This is to avoid GOTRELPC lookups in the critical
+   code path, which AFAICT, are otherwise unavoidable if we want gcc -shared to
+   work; simple relocations between .bss and .text won't work on most 64-bit
+   platforms in such a case.
+
+   (Fun fact: on Apple systems, .lcomm can segfault the linker.)
+
+   The side effect is that state transitions are measured in a somewhat
+   different way, with previous tuple being recorded separately within the scope
+   of every .c file. This should have no impact in any practical sense.
+
+   Another side effect of this design is that getenv() will be called once per
+   every .o file when running in non-instrumented mode; and since getenv() tends
+   to be optimized in funny ways, we need to be very careful to save every
+   oddball register it may touch.
+
+ */
+
+static const u8 *trampoline_fmt_32 =
+
+    "\n"
+    "/* --- AFL TRAMPOLINE (32-BIT) --- */\n"
+    "\n"
+    ".align 4\n"
+    "\n"
+    "leal -16(%%esp), %%esp\n"
+    "movl %%edi,  0(%%esp)\n"
+    "movl %%edx,  4(%%esp)\n"
+    "movl %%ecx,  8(%%esp)\n"
+    "movl %%eax, 12(%%esp)\n"
+    "movl $0x%08x, %%ecx\n"
+    "call __afl_maybe_log\n"
+    "movl 12(%%esp), %%eax\n"
+    "movl  8(%%esp), %%ecx\n"
+    "movl  4(%%esp), %%edx\n"
+    "movl  0(%%esp), %%edi\n"
+    "leal 16(%%esp), %%esp\n"
+    "\n"
+    "/* --- END --- */\n"
+    "\n";
+
+static const u8 *trampoline_fmt_64 =
+
+    "\n"
+    "/* --- AFL TRAMPOLINE (64-BIT) --- */\n"
+    "\n"
+    ".align 4\n"
+    "\n"
+    "leaq -(128+24)(%%rsp), %%rsp\n"
+    "movq %%rdx,  0(%%rsp)\n"
+    "movq %%rcx,  8(%%rsp)\n"
+    "movq %%rax, 16(%%rsp)\n"
+    "movq $0x%08x, %%rcx\n"
+    "call __afl_maybe_log\n"
+    "movq 16(%%rsp), %%rax\n"
+    "movq  8(%%rsp), %%rcx\n"
+    "movq  0(%%rsp), %%rdx\n"
+    "leaq (128+24)(%%rsp), %%rsp\n"
+    "\n"
+    "/* --- END --- */\n"
+    "\n";
+
+static const u8 *main_payload_32 = 
+
+  "\n"
+  "/* --- AFL MAIN PAYLOAD (32-BIT) --- */\n"
+  "\n"
+  ".text\n"
+  ".att_syntax\n"
+  ".code32\n"
+  ".align 8\n"
+  "\n"
+
+  "__afl_maybe_log:\n"
+  "\n"
+  "  lahf\n"
+  "  seto %al\n"
+  "\n"
+  "  /* Check if SHM region is already mapped. */\n"
+  "\n"
+  "  movl  __afl_area_ptr, %edx\n"
+  "  testl %edx, %edx\n"
+  "  je    __afl_setup\n"
+  "\n"
+  "__afl_store:\n"
+  "\n"
+  "  /* Calculate and store hit for the code location specified in ecx. There\n"
+  "     is a double-XOR way of doing this without tainting another register,\n"
+  "     and we use it on 64-bit systems; but it's slower for 32-bit ones. */\n"
+  "\n"
+#ifndef COVERAGE_ONLY
+  "  movl __afl_prev_loc, %edi\n"
+  "  xorl %ecx, %edi\n"
+  "  shrl $1, %ecx\n"
+  "  movl %ecx, __afl_prev_loc\n"
+#else
+  "  movl %ecx, %edi\n"
+#endif                                                   /* ^!COVERAGE_ONLY */
+  "\n"
+#ifdef SKIP_COUNTS
+  "  orb  $1, (%edx, %edi, 1)\n"
+#else
+  "  addb $1, (%edx, %edi, 1)\n"
+  "  adcb $0, (%edx, %edi, 1)\n" // never zero counter implementation. slightly better path discovery and little performance impact
+#endif                                                      /* ^SKIP_COUNTS */
+  "\n"
+  "__afl_return:\n"
+  "\n"
+  "  addb $127, %al\n"
+  "  sahf\n"
+  "  ret\n"
+  "\n"
+  ".align 8\n"
+  "\n"
+  "__afl_setup:\n"
+  "\n"
+  "  /* Do not retry setup if we had previous failures. */\n"
+  "\n"
+  "  cmpb $0, __afl_setup_failure\n"
+  "  jne  __afl_return\n"
+  "\n"
+  "  /* Map SHM, jumping to __afl_setup_abort if something goes wrong.\n"
+  "     We do not save FPU/MMX/SSE registers here, but hopefully, nobody\n"
+  "     will notice this early in the game. */\n"
+  "\n"
+  "  pushl %eax\n"
+  "  pushl %ecx\n"
+  "\n"
+  "  pushl $.AFL_SHM_ENV\n"
+  "  call  getenv\n"
+  "  addl  $4, %esp\n"
+  "\n"
+  "  testl %eax, %eax\n"
+  "  je    __afl_setup_abort\n"
+  "\n"
+#ifdef USEMMAP
+  "  pushl $384        /* shm_open mode 0600 */\n"
+  "  pushl $2          /* flags O_RDWR   */\n"
+  "  pushl %eax        /* SHM file path  */\n"
+  "  call  shm_open\n"
+  "  addl  $12, %esp\n"
+  "\n"
+  "  cmpl $-1, %eax\n"
+  "  je   __afl_setup_abort\n"
+  "\n"
+  "  pushl $0          /* mmap off       */\n"
+  "  pushl %eax        /* shm fd         */\n"
+  "  pushl $1          /* mmap flags     */\n"
+  "  pushl $3          /* mmap prot      */\n"
+  "  pushl $"STRINGIFY(MAP_SIZE)"          /* mmap len       */\n"
+  "  pushl $0          /* mmap addr      */\n"
+  "  call  mmap\n"
+  "  addl  $12, %esp\n"
+  "\n"
+  "  cmpl $-1, %eax\n"
+  "  je   __afl_setup_abort\n"
+  "\n"
+#else
+  "  pushl %eax\n"
+  "  call  atoi\n"
+  "  addl  $4, %esp\n"
+  "\n"
+  "  pushl $0          /* shmat flags    */\n"
+  "  pushl $0          /* requested addr */\n"
+  "  pushl %eax        /* SHM ID         */\n"
+  "  call  shmat\n"
+  "  addl  $12, %esp\n"
+  "\n"
+  "  cmpl $-1, %eax\n"
+  "  je   __afl_setup_abort\n"
+  "\n"
+#endif
+  "  movb $1, (%eax)\n"
+  "  /* Store the address of the SHM region. */\n"
+  "\n"
+  "  movl %eax, __afl_area_ptr\n"
+  "  movl %eax, %edx\n"
+  "\n"
+  "  popl %ecx\n"
+  "  popl %eax\n"
+  "\n"
+  "__afl_forkserver:\n"
+  "\n"
+  "  /* Enter the fork server mode to avoid the overhead of execve() calls. */\n"
+  "\n"
+  "  pushl %eax\n"
+  "  pushl %ecx\n"
+  "  pushl %edx\n"
+  "\n"
+  "  /* Phone home and tell the parent that we're OK. (Note that signals with\n"
+  "     no SA_RESTART will mess it up). If this fails, assume that the fd is\n"
+  "     closed because we were execve()d from an instrumented binary, or because\n" 
+  "     the parent doesn't want to use the fork server. */\n"
+  "\n"
+  "  pushl $4          /* length    */\n"
+  "  pushl $__afl_temp /* data      */\n"
+  "  pushl $" STRINGIFY((FORKSRV_FD + 1)) "  /* file desc */\n"
+  "  call  write\n"
+  "  addl  $12, %esp\n"
+  "\n"
+  "  cmpl  $4, %eax\n"
+  "  jne   __afl_fork_resume\n"
+  "\n"
+  "__afl_fork_wait_loop:\n"
+  "\n"
+  "  /* Wait for parent by reading from the pipe. Abort if read fails. */\n"
+  "\n"
+  "  pushl $4          /* length    */\n"
+  "  pushl $__afl_temp /* data      */\n"
+  "  pushl $" STRINGIFY(FORKSRV_FD) "        /* file desc */\n"
+  "  call  read\n"
+  "  addl  $12, %esp\n"
+  "\n"
+  "  cmpl  $4, %eax\n"
+  "  jne   __afl_die\n"
+  "\n"
+  "  /* Once woken up, create a clone of our process. This is an excellent use\n"
+  "     case for syscall(__NR_clone, 0, CLONE_PARENT), but glibc boneheadedly\n"
+  "     caches getpid() results and offers no way to update the value, breaking\n"
+  "     abort(), raise(), and a bunch of other things :-( */\n"
+  "\n"
+  "  call fork\n"
+  "\n"
+  "  cmpl $0, %eax\n"
+  "  jl   __afl_die\n"
+  "  je   __afl_fork_resume\n"
+  "\n"
+  "  /* In parent process: write PID to pipe, then wait for child. */\n"
+  "\n"
+  "  movl  %eax, __afl_fork_pid\n"
+  "\n"
+  "  pushl $4              /* length    */\n"
+  "  pushl $__afl_fork_pid /* data      */\n"
+  "  pushl $" STRINGIFY((FORKSRV_FD + 1)) "      /* file desc */\n"
+  "  call  write\n"
+  "  addl  $12, %esp\n"
+  "\n"
+  "  pushl $0             /* no flags  */\n"
+  "  pushl $__afl_temp    /* status    */\n"
+  "  pushl __afl_fork_pid /* PID       */\n"
+  "  call  waitpid\n"
+  "  addl  $12, %esp\n"
+  "\n"
+  "  cmpl  $0, %eax\n"
+  "  jle   __afl_die\n"
+  "\n"
+  "  /* Relay wait status to pipe, then loop back. */\n"
+  "\n"
+  "  pushl $4          /* length    */\n"
+  "  pushl $__afl_temp /* data      */\n"
+  "  pushl $" STRINGIFY((FORKSRV_FD + 1)) "  /* file desc */\n"
+  "  call  write\n"
+  "  addl  $12, %esp\n"
+  "\n"
+  "  jmp __afl_fork_wait_loop\n"
+  "\n"
+  "__afl_fork_resume:\n"
+  "\n"
+  "  /* In child process: close fds, resume execution. */\n"
+  "\n"
+  "  pushl $" STRINGIFY(FORKSRV_FD) "\n"
+  "  call  close\n"
+  "\n"
+  "  pushl $" STRINGIFY((FORKSRV_FD + 1)) "\n"
+  "  call  close\n"
+  "\n"
+  "  addl  $8, %esp\n"
+  "\n"
+  "  popl %edx\n"
+  "  popl %ecx\n"
+  "  popl %eax\n"
+  "  jmp  __afl_store\n"
+  "\n"
+  "__afl_die:\n"
+  "\n"
+  "  xorl %eax, %eax\n"
+  "  call _exit\n"
+  "\n"
+  "__afl_setup_abort:\n"
+  "\n"
+  "  /* Record setup failure so that we don't keep calling\n"
+  "     shmget() / shmat() over and over again. */\n"
+  "\n"
+  "  incb __afl_setup_failure\n"
+  "  popl %ecx\n"
+  "  popl %eax\n"
+  "  jmp __afl_return\n"
+  "\n"
+  ".AFL_VARS:\n"
+  "\n"
+  "  .comm   __afl_area_ptr, 4, 32\n"
+  "  .comm   __afl_setup_failure, 1, 32\n"
+#ifndef COVERAGE_ONLY
+  "  .comm   __afl_prev_loc, 4, 32\n"
+#endif                                                    /* !COVERAGE_ONLY */
+  "  .comm   __afl_final_loc, 4, 32\n"
+  "  .comm   __afl_fork_pid, 4, 32\n"
+  "  .comm   __afl_temp, 4, 32\n"
+  "\n"
+  ".AFL_SHM_ENV:\n"
+  "  .asciz \"" SHM_ENV_VAR "\"\n"
+  "\n"
+  "/* --- END --- */\n"
+  "\n";
+
+/* The OpenBSD hack is due to lahf and sahf not being recognized by some
+   versions of binutils: https://marc.info/?l=openbsd-cvs&m=141636589924400
+
+   The Apple code is a bit different when calling libc functions because
+   they are doing relocations differently from everybody else. We also need
+   to work around the crash issue with .lcomm and the fact that they don't
+   recognize .string. */
+
+#ifdef __APPLE__
+  #define CALL_L64(str) "call _" str "\n"
+#else
+  #define CALL_L64(str) "call " str "@PLT\n"
+#endif                                                        /* ^__APPLE__ */
+
+static const u8 *main_payload_64 = 
+
+  "\n"
+  "/* --- AFL MAIN PAYLOAD (64-BIT) --- */\n"
+  "\n"
+  ".text\n"
+  ".att_syntax\n"
+  ".code64\n"
+  ".align 8\n"
+  "\n"
+  "__afl_maybe_log:\n"
+  "\n"
+#if defined(__OpenBSD__) || (defined(__FreeBSD__) && (__FreeBSD__ < 9))
+  "  .byte 0x9f /* lahf */\n"
+#else
+  "  lahf\n"
+#endif                                                 /* ^__OpenBSD__, etc */
+  "  seto  %al\n"
+  "\n"
+  "  /* Check if SHM region is already mapped. */\n"
+  "\n"
+  "  movq  __afl_area_ptr(%rip), %rdx\n"
+  "  testq %rdx, %rdx\n"
+  "  je    __afl_setup\n"
+  "\n"
+  "__afl_store:\n"
+  "\n"
+  "  /* Calculate and store hit for the code location specified in rcx. */\n"
+  "\n"
+#ifndef COVERAGE_ONLY
+  "  xorq __afl_prev_loc(%rip), %rcx\n"
+  "  xorq %rcx, __afl_prev_loc(%rip)\n"
+  "  shrq $1, __afl_prev_loc(%rip)\n"
+#endif                                                   /* ^!COVERAGE_ONLY */
+  "\n"
+#ifdef SKIP_COUNTS
+  "  orb  $1, (%rdx, %rcx, 1)\n"
+#else
+  "  addb $1, (%rdx, %rcx, 1)\n"
+  "  adcb $0, (%rdx, %rcx, 1)\n" // never zero counter implementation. slightly better path discovery and little performance impact
+#endif                                                      /* ^SKIP_COUNTS */
+  "\n"
+  "__afl_return:\n"
+  "\n"
+  "  addb $127, %al\n"
+#if defined(__OpenBSD__) || (defined(__FreeBSD__) && (__FreeBSD__ < 9))
+  "  .byte 0x9e /* sahf */\n"
+#else
+  "  sahf\n"
+#endif                                                 /* ^__OpenBSD__, etc */
+  "  ret\n"
+  "\n"
+  ".align 8\n"
+  "\n"
+  "__afl_setup:\n"
+  "\n"
+  "  /* Do not retry setup if we had previous failures. */\n"
+  "\n"
+  "  cmpb $0, __afl_setup_failure(%rip)\n"
+  "  jne __afl_return\n"
+  "\n"
+  "  /* Check out if we have a global pointer on file. */\n"
+  "\n"
+#ifndef __APPLE__
+  "  movq  __afl_global_area_ptr@GOTPCREL(%rip), %rdx\n"
+  "  movq  (%rdx), %rdx\n"
+#else
+  "  movq  __afl_global_area_ptr(%rip), %rdx\n"
+#endif                                                       /* !^__APPLE__ */
+  "  testq %rdx, %rdx\n"
+  "  je    __afl_setup_first\n"
+  "\n"
+  "  movq %rdx, __afl_area_ptr(%rip)\n"
+  "  jmp  __afl_store\n" 
+  "\n"
+  "__afl_setup_first:\n"
+  "\n"
+  "  /* Save everything that is not yet saved and that may be touched by\n"
+  "     getenv() and several other libcalls we'll be relying on. */\n"
+  "\n"
+  "  leaq -352(%rsp), %rsp\n"
+  "\n"
+  "  movq %rax,   0(%rsp)\n"
+  "  movq %rcx,   8(%rsp)\n"
+  "  movq %rdi,  16(%rsp)\n"
+  "  movq %rsi,  32(%rsp)\n"
+  "  movq %r8,   40(%rsp)\n"
+  "  movq %r9,   48(%rsp)\n"
+  "  movq %r10,  56(%rsp)\n"
+  "  movq %r11,  64(%rsp)\n"
+  "\n"
+  "  movq %xmm0,  96(%rsp)\n"
+  "  movq %xmm1,  112(%rsp)\n"
+  "  movq %xmm2,  128(%rsp)\n"
+  "  movq %xmm3,  144(%rsp)\n"
+  "  movq %xmm4,  160(%rsp)\n"
+  "  movq %xmm5,  176(%rsp)\n"
+  "  movq %xmm6,  192(%rsp)\n"
+  "  movq %xmm7,  208(%rsp)\n"
+  "  movq %xmm8,  224(%rsp)\n"
+  "  movq %xmm9,  240(%rsp)\n"
+  "  movq %xmm10, 256(%rsp)\n"
+  "  movq %xmm11, 272(%rsp)\n"
+  "  movq %xmm12, 288(%rsp)\n"
+  "  movq %xmm13, 304(%rsp)\n"
+  "  movq %xmm14, 320(%rsp)\n"
+  "  movq %xmm15, 336(%rsp)\n"
+  "\n"
+  "  /* Map SHM, jumping to __afl_setup_abort if something goes wrong. */\n"
+  "\n"
+  "  /* The 64-bit ABI requires 16-byte stack alignment. We'll keep the\n"
+  "     original stack ptr in the callee-saved r12. */\n"
+  "\n"
+  "  pushq %r12\n"
+  "  movq  %rsp, %r12\n"
+  "  subq  $16, %rsp\n"
+  "  andq  $0xfffffffffffffff0, %rsp\n"
+  "\n"
+  "  leaq .AFL_SHM_ENV(%rip), %rdi\n"
+  CALL_L64("getenv")
+  "\n"
+  "  testq %rax, %rax\n"
+  "  je    __afl_setup_abort\n"
+  "\n"
+#ifdef USEMMAP
+  "  movl $384, %edx   /* shm_open mode 0600 */\n"
+  "  movl $2,   %esi   /* flags O_RDWR   */\n"
+  "  movq %rax, %rdi   /* SHM file path  */\n"
+  CALL_L64("shm_open")
+  "\n"
+  "  cmpq $-1, %rax\n"
+  "  je   __afl_setup_abort\n"
+  "\n"
+  "  movl    $0, %r9d\n"
+  "  movl    %eax, %r8d\n"
+  "  movl    $1, %ecx\n"
+  "  movl    $3, %edx\n"
+  "  movl    $"STRINGIFY(MAP_SIZE)", %esi\n"
+  "  movl    $0, %edi\n"
+  CALL_L64("mmap")
+  "\n"
+  "  cmpq $-1, %rax\n"
+  "  je   __afl_setup_abort\n"
+  "\n"
+#else
+  "  movq  %rax, %rdi\n"
+  CALL_L64("atoi")
+  "\n"
+  "  xorq %rdx, %rdx   /* shmat flags    */\n"
+  "  xorq %rsi, %rsi   /* requested addr */\n"
+  "  movq %rax, %rdi   /* SHM ID         */\n"
+  CALL_L64("shmat")
+  "\n"
+  "  cmpq $-1, %rax\n"
+  "  je   __afl_setup_abort\n"
+  "\n"
+#endif
+  "  movb $1, (%rax)\n"
+  "  /* Store the address of the SHM region. */\n"
+  "\n"
+  "  movq %rax, %rdx\n"
+  "  movq %rax, __afl_area_ptr(%rip)\n"
+  "\n"
+#ifdef __APPLE__
+  "  movq %rax, __afl_global_area_ptr(%rip)\n"
+#else
+  "  movq __afl_global_area_ptr@GOTPCREL(%rip), %rdx\n"
+  "  movq %rax, (%rdx)\n"
+#endif                                                        /* ^__APPLE__ */
+  "  movq %rax, %rdx\n"
+  "\n"
+  "__afl_forkserver:\n"
+  "\n"
+  "  /* Enter the fork server mode to avoid the overhead of execve() calls. We\n"
+  "     push rdx (area ptr) twice to keep stack alignment neat. */\n"
+  "\n"
+  "  pushq %rdx\n"
+  "  pushq %rdx\n"
+  "\n"
+  "  /* Phone home and tell the parent that we're OK. (Note that signals with\n"
+  "     no SA_RESTART will mess it up). If this fails, assume that the fd is\n"
+  "     closed because we were execve()d from an instrumented binary, or because\n"
+  "     the parent doesn't want to use the fork server. */\n"
+  "\n"
+  "  movq $4, %rdx               /* length    */\n"
+  "  leaq __afl_temp(%rip), %rsi /* data      */\n"
+  "  movq $" STRINGIFY((FORKSRV_FD + 1)) ", %rdi       /* file desc */\n"
+  CALL_L64("write")
+  "\n"
+  "  cmpq $4, %rax\n"
+  "  jne  __afl_fork_resume\n"
+  "\n"
+  "__afl_fork_wait_loop:\n"
+  "\n"
+  "  /* Wait for parent by reading from the pipe. Abort if read fails. */\n"
+  "\n"
+  "  movq $4, %rdx               /* length    */\n"
+  "  leaq __afl_temp(%rip), %rsi /* data      */\n"
+  "  movq $" STRINGIFY(FORKSRV_FD) ", %rdi             /* file desc */\n"
+  CALL_L64("read")
+  "  cmpq $4, %rax\n"
+  "  jne  __afl_die\n"
+  "\n"
+  "  /* Once woken up, create a clone of our process. This is an excellent use\n"
+  "     case for syscall(__NR_clone, 0, CLONE_PARENT), but glibc boneheadedly\n"
+  "     caches getpid() results and offers no way to update the value, breaking\n"
+  "     abort(), raise(), and a bunch of other things :-( */\n"
+  "\n"
+  CALL_L64("fork")
+  "  cmpq $0, %rax\n"
+  "  jl   __afl_die\n"
+  "  je   __afl_fork_resume\n"
+  "\n"
+  "  /* In parent process: write PID to pipe, then wait for child. */\n"
+  "\n"
+  "  movl %eax, __afl_fork_pid(%rip)\n"
+  "\n"
+  "  movq $4, %rdx                   /* length    */\n"
+  "  leaq __afl_fork_pid(%rip), %rsi /* data      */\n"
+  "  movq $" STRINGIFY((FORKSRV_FD + 1)) ", %rdi             /* file desc */\n"
+  CALL_L64("write")
+  "\n"
+  "  movq $0, %rdx                   /* no flags  */\n"
+  "  leaq __afl_temp(%rip), %rsi     /* status    */\n"
+  "  movq __afl_fork_pid(%rip), %rdi /* PID       */\n"
+  CALL_L64("waitpid")
+  "  cmpq $0, %rax\n"
+  "  jle  __afl_die\n"
+  "\n"
+  "  /* Relay wait status to pipe, then loop back. */\n"
+  "\n"
+  "  movq $4, %rdx               /* length    */\n"
+  "  leaq __afl_temp(%rip), %rsi /* data      */\n"
+  "  movq $" STRINGIFY((FORKSRV_FD + 1)) ", %rdi         /* file desc */\n"
+  CALL_L64("write")
+  "\n"
+  "  jmp  __afl_fork_wait_loop\n"
+  "\n"
+  "__afl_fork_resume:\n"
+  "\n"
+  "  /* In child process: close fds, resume execution. */\n"
+  "\n"
+  "  movq $" STRINGIFY(FORKSRV_FD) ", %rdi\n"
+  CALL_L64("close")
+  "\n"
+  "  movq $" STRINGIFY((FORKSRV_FD + 1)) ", %rdi\n"
+  CALL_L64("close")
+  "\n"
+  "  popq %rdx\n"
+  "  popq %rdx\n"
+  "\n"
+  "  movq %r12, %rsp\n"
+  "  popq %r12\n"
+  "\n"
+  "  movq  0(%rsp), %rax\n"
+  "  movq  8(%rsp), %rcx\n"
+  "  movq 16(%rsp), %rdi\n"
+  "  movq 32(%rsp), %rsi\n"
+  "  movq 40(%rsp), %r8\n"
+  "  movq 48(%rsp), %r9\n"
+  "  movq 56(%rsp), %r10\n"
+  "  movq 64(%rsp), %r11\n"
+  "\n"
+  "  movq  96(%rsp), %xmm0\n"
+  "  movq 112(%rsp), %xmm1\n"
+  "  movq 128(%rsp), %xmm2\n"
+  "  movq 144(%rsp), %xmm3\n"
+  "  movq 160(%rsp), %xmm4\n"
+  "  movq 176(%rsp), %xmm5\n"
+  "  movq 192(%rsp), %xmm6\n"
+  "  movq 208(%rsp), %xmm7\n"
+  "  movq 224(%rsp), %xmm8\n"
+  "  movq 240(%rsp), %xmm9\n"
+  "  movq 256(%rsp), %xmm10\n"
+  "  movq 272(%rsp), %xmm11\n"
+  "  movq 288(%rsp), %xmm12\n"
+  "  movq 304(%rsp), %xmm13\n"
+  "  movq 320(%rsp), %xmm14\n"
+  "  movq 336(%rsp), %xmm15\n"
+  "\n"
+  "  leaq 352(%rsp), %rsp\n"
+  "\n"
+  "  jmp  __afl_store\n"
+  "\n"
+  "__afl_die:\n"
+  "\n"
+  "  xorq %rax, %rax\n"
+  CALL_L64("_exit")
+  "\n"
+  "__afl_setup_abort:\n"
+  "\n"
+  "  /* Record setup failure so that we don't keep calling\n"
+  "     shmget() / shmat() over and over again. */\n"
+  "\n"
+  "  incb __afl_setup_failure(%rip)\n"
+  "\n"
+  "  movq %r12, %rsp\n"
+  "  popq %r12\n"
+  "\n"
+  "  movq  0(%rsp), %rax\n"
+  "  movq  8(%rsp), %rcx\n"
+  "  movq 16(%rsp), %rdi\n"
+  "  movq 32(%rsp), %rsi\n"
+  "  movq 40(%rsp), %r8\n"
+  "  movq 48(%rsp), %r9\n"
+  "  movq 56(%rsp), %r10\n"
+  "  movq 64(%rsp), %r11\n"
+  "\n"
+  "  movq  96(%rsp), %xmm0\n"
+  "  movq 112(%rsp), %xmm1\n"
+  "  movq 128(%rsp), %xmm2\n"
+  "  movq 144(%rsp), %xmm3\n"
+  "  movq 160(%rsp), %xmm4\n"
+  "  movq 176(%rsp), %xmm5\n"
+  "  movq 192(%rsp), %xmm6\n"
+  "  movq 208(%rsp), %xmm7\n"
+  "  movq 224(%rsp), %xmm8\n"
+  "  movq 240(%rsp), %xmm9\n"
+  "  movq 256(%rsp), %xmm10\n"
+  "  movq 272(%rsp), %xmm11\n"
+  "  movq 288(%rsp), %xmm12\n"
+  "  movq 304(%rsp), %xmm13\n"
+  "  movq 320(%rsp), %xmm14\n"
+  "  movq 336(%rsp), %xmm15\n"
+  "\n"
+  "  leaq 352(%rsp), %rsp\n"
+  "\n"
+  "  jmp __afl_return\n"
+  "\n"
+  ".AFL_VARS:\n"
+  "\n"
+
+#ifdef __APPLE__
+
+  "  .comm   __afl_area_ptr, 8\n"
+  #ifndef COVERAGE_ONLY
+  "  .comm   __afl_prev_loc, 8\n"
+  #endif                                                  /* !COVERAGE_ONLY */
+  "  .comm   __afl_fork_pid, 4\n"
+  "  .comm   __afl_temp, 4\n"
+  "  .comm   __afl_setup_failure, 1\n"
+
+#else
+
+  "  .lcomm   __afl_area_ptr, 8\n"
+  #ifndef COVERAGE_ONLY
+  "  .lcomm   __afl_prev_loc, 8\n"
+  #endif                                                  /* !COVERAGE_ONLY */
+  "  .lcomm   __afl_fork_pid, 4\n"
+  "  .lcomm   __afl_temp, 4\n"
+  "  .lcomm   __afl_setup_failure, 1\n"
+
+#endif                                                        /* ^__APPLE__ */
+
+  "  .comm    __afl_global_area_ptr, 8, 8\n"
+  "\n"
+  ".AFL_SHM_ENV:\n"
+  "  .asciz \"" SHM_ENV_VAR "\"\n"
+  "\n"
+  "/* --- END --- */\n"
+  "\n";
+
+#endif                                                   /* !_HAVE_AFL_AS_H */
+

include/afl-fuzz.h

@@ -75,7 +75,6 @@
 #include <sys/ioctl.h>
 #include <sys/file.h>
 #include <sys/types.h>
-#include "asanfuzz.h"
 
 #if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || \
     defined(__NetBSD__) || defined(__DragonFly__)
@@ -339,22 +338,21 @@ enum {
 
 enum {
 
-  /* 00 */ EXPLORE, /* AFL default, Exploration-based constant schedule */
-  /* 01 */ MMOPT,   /* Modified MOPT schedule           */
-  /* 02 */ EXPLOIT, /* AFL's exploitation-based const.  */
-  /* 03 */ FAST,    /* Exponential schedule             */
-  /* 04 */ COE,     /* Cut-Off Exponential schedule     */
-  /* 05 */ LIN,     /* Linear schedule                  */
-  /* 06 */ QUAD,    /* Quadratic schedule               */
-  /* 07 */ RARE,    /* Rare edges                       */
-  /* 08 */ SEEK,    /* EXPLORE that ignores timings     */
+  /* 00 */ EXPLORE, /* AFL default, exploration-based constant schedule */
+  /* 01 */ EXPLOIT, /* AFL's exploitation-based const.   */
+  /* 02 */ WEIGHT,  /* Based on seed weighting algorithm */
+  /* 03 */ MMOPT,   /* Modified MOPT schedule            */
+  /* 04 */ FAST,    /* Exponential schedule              */
+  /* 05 */ COE,     /* Cut-Off Exponential schedule      */
+  /* 06 */ LIN,     /* Linear schedule                   */
+  /* 07 */ QUAD,    /* Quadratic schedule                */
+  /* 08 */ RARE,    /* Rare edges                        */
+  /* 09 */ SEEK,    /* EXPLORE that ignores timings      */
 
   POWER_SCHEDULES_NUM
 
 };
 
-#define FAST_RESUME_VERSION 0x01000000
-
 /* Python stuff */
 #ifdef USE_PYTHON
 
@@ -613,11 +611,7 @@ typedef struct afl_state {
   u8 *var_bytes;                        /* Bytes that appear to be variable */
 
 #define N_FUZZ_SIZE (1 << 21)
-#define N_FUZZ_SIZE_BITMAP (1 << 29)
   u32 *n_fuzz;
-  u8  *n_fuzz_dup;
-  u8  *classified_n_fuzz;
-  u8  *simplified_n_fuzz;
 
   volatile u8 stop_soon,                /* Ctrl-C pressed?                  */
       clear_screen;                     /* Window resized?                  */
@@ -721,8 +715,6 @@ typedef struct afl_state {
 
   struct queue_entry **top_rated;           /* Top entries for bitmap bytes */
 
-  u32 **top_rated_candidates;             /* Candidate IDs per bitmap index */
-
   struct extra_data *extras;            /* Extra tokens to fuzz with        */
   u32                extras_cnt;        /* Total number of tokens read      */
 
@@ -737,13 +729,6 @@ typedef struct afl_state {
   char            *cmplog_binary;
   afl_forkserver_t cmplog_fsrv;     /* cmplog has its own little forkserver */
 
-  /* ASAN Fuzing */
-  char            *san_binary[MAX_EXTRA_SAN_BINARY];
-  afl_forkserver_t san_fsrvs[MAX_EXTRA_SAN_BINARY];
-  u8               san_binary_length; /* 0 means extra san binaries not given */
-  u32              san_case_status;
-  enum SanitizerAbstraction san_abstraction;
-
   /* Custom mutators */
   struct custom_mutator *mutator;
 
@@ -763,14 +748,13 @@ typedef struct afl_state {
                                   up to 256 */
 
   unsigned long long int last_avg_exec_update;
-  u64                    last_avg_total_execs;
+  u32                    last_avg_execs;
   double                 last_avg_execs_saved;
 
 /* foreign sync */
 #define FOREIGN_SYNCS_MAX 32U
   u8                  foreign_sync_cnt;
   struct foreign_sync foreign_syncs[FOREIGN_SYNCS_MAX];
-  char               *foreign_file;
 
 #ifdef _AFL_DOCUMENT_MUTATIONS
   u8  do_document;
@@ -865,8 +849,6 @@ typedef struct afl_state {
 
   struct skipdet_global *skipdet_g;
 
-  s64 last_scored_idx;           /* Index of the last queue entry re-scored */
-
 #ifdef INTROSPECTION
   char  mutation[8072];
   char  m_tmp[4096];
@@ -927,7 +909,7 @@ struct custom_mutator {
   /**
    * Opt-out of a splicing input for the fuzz mutator
    *
-   * Empty dummy function. Its presence tells afl-fuzz not to pass a
+   * Empty dummy function. It's presence tells afl-fuzz not to pass a
    * splice data pointer and len.
    *
    * @param data pointer returned in afl_custom_init by this custom mutator
@@ -959,12 +941,12 @@ struct custom_mutator {
   /**
    * Describe the current testcase, generated by the last mutation.
    * This will be called, for example, to give the written testcase a name
-   * after a crash occurred. It can help to reproduce crashing mutations.
+   * after a crash ocurred. It can help to reproduce crashing mutations.
    *
    * (Optional)
    *
    * @param data pointer returned by afl_customm_init for this custom mutator
-   * @paramp[in] max_description_len maximum size available for the description.
+   * @paramp[in] max_description_len maximum size avaliable for the description.
    *             A longer return string is legal, but will be truncated.
    * @return A valid ptr to a 0-terminated string.
    *         An empty or NULL return will result in a default description
@@ -1140,9 +1122,8 @@ struct custom_mutator {
 
 void afl_state_init(afl_state_t *, uint32_t map_size);
 void afl_state_deinit(afl_state_t *);
-void afl_resize_map_buffers(afl_state_t *, u32 old_size, u32 new_size);
 
-/* Set stop_soon flag on all children, kill all children */
+/* Set stop_soon flag on all childs, kill all childs */
 void afl_states_stop(void);
 /* Set clear_screen flag on all states */
 void afl_states_clear_screen(void);
@@ -1182,7 +1163,7 @@ u8          havoc_mutation_probability_py(void *);
 u8          queue_get_py(void *, const u8 *);
 const char *introspection_py(void *);
 u8          queue_new_entry_py(void *, const u8 *, const u8 *);
-void        splice_optout_py(void *);
+void        splice_optout(void *);
 void        deinit_py(void *);
 
 #endif
@@ -1190,13 +1171,13 @@ void        deinit_py(void *);
 /* Queue */
 
 void mark_as_det_done(afl_state_t *, struct queue_entry *);
+void mark_as_variable(afl_state_t *, struct queue_entry *);
+void mark_as_redundant(afl_state_t *, struct queue_entry *, u8);
 void add_to_queue(afl_state_t *, u8 *, u32, u8);
 void destroy_queue(afl_state_t *);
-void update_bitmap_score(afl_state_t *, struct queue_entry *, bool);
+void update_bitmap_score(afl_state_t *, struct queue_entry *);
 void cull_queue(afl_state_t *);
 u32  calculate_score(afl_state_t *, struct queue_entry *);
-void recalculate_all_scores(afl_state_t *);
-void update_bitmap_rescore(afl_state_t *, struct queue_entry *, u32);
 
 /* Bitmap */
 
@@ -1217,6 +1198,7 @@ u8 *describe_op(afl_state_t *, u8, size_t);
 #endif
 u8 save_if_interesting(afl_state_t *, void *, u32, u8);
 u8 has_new_bits(afl_state_t *, u8 *);
+u8 has_new_bits_unclassified(afl_state_t *, u8 *);
 #ifndef AFL_SHOWMAP
 void classify_counts(afl_forkserver_t *);
 #endif
@@ -1259,7 +1241,6 @@ int  statsd_format_metric(afl_state_t *afl, char *buff, size_t bufflen);
 
 /* Run */
 
-void check_sync_fuzzers(afl_state_t *);
 void sync_fuzzers(afl_state_t *);
 u32  write_to_testcase(afl_state_t *, void **, u32, u32);
 u8   calibrate_case(afl_state_t *, struct queue_entry *, u8 *, u32, u8);
@@ -1280,6 +1261,7 @@ u8   fuzz_one(afl_state_t *);
 #ifdef HAVE_AFFINITY
 void bind_to_free_cpu(afl_state_t *);
 #endif
+void   setup_post(afl_state_t *);
 void   read_testcases(afl_state_t *, u8 *);
 void   perform_dry_run(afl_state_t *);
 void   pivot_inputs(afl_state_t *);
@@ -1345,6 +1327,7 @@ static inline u32 rand_below(afl_state_t *afl, u32 limit) {
 
     ck_read(afl->fsrv.dev_urandom_fd, &afl->rand_seed, sizeof(afl->rand_seed),
             "/dev/urandom");
+    // srandom(afl->rand_seed[0]);
     afl->rand_cnt = (RESEED_RNG / 2) + (afl->rand_seed[1] % RESEED_RNG);
 
   }
@@ -1458,18 +1441,6 @@ static inline int permissive_create(afl_state_t *afl, const char *fn) {
 
 }
 
-static inline void bitmap_set(u8 *map, u32 index) {
-
-  map[index / 8] |= (1u << (index % 8));
-
-}
-
-static inline u8 bitmap_read(u8 *map, u32 index) {
-
-  return (map[index / 8] >> (index % 8)) & 1;
-
-}
-
 #if TESTCASE_CACHE == 1
   #error define of TESTCASE_CACHE must be zero or larger than 1
 #endif

include/android-ashmem.h

@@ -31,8 +31,7 @@ int shmctl(int __shmid, int __cmd, struct shmid_ds *__buf) {
   if (__cmd == IPC_RMID) {
 
     int               length = ioctl(__shmid, ASHMEM_GET_SIZE, NULL);
-    unsigned int      safe_length = length >= 0 ? length : 0;
-    struct ashmem_pin pin = {0, safe_length};
+    struct ashmem_pin pin = {0, length};
     ret = ioctl(__shmid, ASHMEM_UNPIN, &pin);
     close(__shmid);
 

include/asanfuzz.h

@@ -1,55 +0,0 @@
-/*
-   american fuzzy lop++ - cmplog header
-   ------------------------------------
-
-   Originally written by Michal Zalewski
-
-   Forkserver design by Jann Horn <jannhorn@googlemail.com>
-
-   Now maintained by Marc Heuse <mh@mh-sec.de>,
-                     Dominik Maier <mail@dmnk.co>,
-                     Andrea Fioraldi <andreafioraldi@gmail.com>,
-                     Heiko Eissfeldt <heiko.eissfeldt@hexco.de>
-
-   Copyright 2016, 2017 Google Inc. All rights reserved.
-   Copyright 2019-2023 AFLplusplus Project. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     https://www.apache.org/licenses/LICENSE-2.0
-
-   Shared code to handle the shared memory. This is used by the fuzzer
-   as well the other components like afl-tmin, afl-showmap, etc...
-
- */
-
-#ifndef _AFL_ASAMFUZZ_H
-#define _AFL_ASAMFUZZ_H
-
-#include "config.h"
-
-// new_bits for describe_op
-// new_bits value 1, 2 and 0x80 are already used!
-#define SAN_CRASH_ONLY (1 << 4)
-#define NON_COV_INCREASE_BUG (1 << 5)
-
-enum SanitizerAbstraction {
-
-  SIMPLIFY_TRACE = 0,  // Feed all simplified trace to sanitizers, moderate
-                       // sensitive and default for SAND. Not missing bugs.
-  UNIQUE_TRACE,      // Feed all unique trace to sanitizers, the most sensitive
-                     // and not missing bugs.
-  COVERAGE_INCREASE  // Feed all coverage increasing cases to sanitizers, the
-                     // least sensitive at a risk of missing ~20% bugs.
-
-};
-
-/* Execs the child */
-
-struct afl_forkserver;
-void sanfuzz_exec_child(struct afl_forkserver *fsrv, char **argv);
-
-#endif
-

include/cmplog.h

@@ -53,24 +53,21 @@ struct cmp_header {  // 16 bit = 2 bytes
 struct cmp_operands {
 
   u64 v0;
-  u64 v0_128;
-  u64 v0_256_0;  // u256 is unsupported by any compiler for now, so future use
-  u64 v0_256_1;
   u64 v1;
+  u64 v0_128;
   u64 v1_128;
-  u64 v1_256_0;
-  u64 v1_256_1;
-  u8  unused[8];  // 2 bits could be used for "is constant operand"
+  u64 unused;
+  u8  unused1;
+  u8  unused2;
 
 } __attribute__((packed));
 
 struct cmpfn_operands {
 
   u8 v0[32];
-  u8 v1[32];
   u8 v0_len;
+  u8 v1[32];
   u8 v1_len;
-  u8 unused[6];  // 2 bits could be used for "is constant operand"
 
 } __attribute__((packed));
 

include/common.h

@@ -76,9 +76,8 @@ u8 *find_afl_binary(u8 *own_loc, u8 *fname);
 int parse_afl_kill_signal(u8 *numeric_signal_as_str, int default_signal);
 
 /* Configure the signals that are used to kill the forkserver
-   and the forked children. If `afl_kill_signal_env` or
-   `afl_fsrv_kill_signal_env` is NULL, the appropriate values are read from the
-   environment. */
+   and the forked childs. If `afl_kill_signal_env` or `afl_fsrv_kill_signal_env`
+   is NULL, the appropiate values are read from the environment. */
 void configure_afl_kill_signals(afl_forkserver_t *fsrv,
                                 char             *afl_kill_signal_env,
                                 char             *afl_fsrv_kill_signal_env,

include/config.h

@@ -26,7 +26,7 @@
 /* Version string: */
 
 // c = release, a = volatile github dev, e = experimental branch
-#define VERSION "++4.33a"
+#define VERSION "++4.22a"
 
 /******************************************************
  *                                                    *
@@ -39,7 +39,7 @@
    However if a target has problematic constructors and init arrays then
    this can fail. Hence afl-fuzz deploys a larger default map. The largest
    map seen so far is the xlsx fuzzer for libreoffice which is 5MB.
-   At runtime this value can be overridden via AFL_MAP_SIZE.
+   At runtime this value can be overriden via AFL_MAP_SIZE.
    Default: 8MB (defined in bytes) */
 #define DEFAULT_SHMEM_SIZE (8 * 1024 * 1024)
 
@@ -52,18 +52,6 @@
 /* Default file permission umode when creating files (default: 0600) */
 #define DEFAULT_PERMISSION 0600
 
-#ifdef __APPLE__
-  #include <TargetConditionals.h>
-  #if TARGET_OS_IOS
-    #undef DEFAULT_PERMISSION
-    #define DEFAULT_PERMISSION 0666
-  #endif
-#endif
-#ifdef __ANDROID__
-  #undef DEFAULT_PERMISSION
-  #define DEFAULT_PERMISSION 0666
-#endif
-
 /* SkipDet's global configuration */
 
 #define MINIMAL_BLOCK_SIZE 64
@@ -97,17 +85,11 @@
 /* Maximum allowed fails per CMP value. Default: 96 */
 #define CMPLOG_FAIL_MAX 96
 
-/*
- * Effective fuzzing with selective feeding inputs
- */
-
-#define MAX_EXTRA_SAN_BINARY 4
-
 /* -------------------------------------*/
 /* Now non-cmplog configuration options */
 /* -------------------------------------*/
 
-/* If a persistent target keeps state and found crashes are not reproducible
+/* If a persistent target keeps state and found crashes are not reproducable
    then enable this option and set the AFL_PERSISTENT_RECORD env variable
    to a number. These number of testcases prior and including the crash case
    will be kept and written to the crash/ directory as RECORD:... files.
@@ -171,9 +153,7 @@
 #define EXEC_TM_ROUND 20U
 
 /* 64bit arch MACRO */
-#if (defined(__x86_64__) || defined(__arm64__) || defined(__aarch64__) ||    \
-     (defined(__riscv) && __riscv_xlen == 64) || defined(__powerpc64le__) || \
-     defined(__s390x__) || defined(__loongarch64))
+#if (defined(__x86_64__) || defined(__arm64__) || defined(__aarch64__))
   #define WORD_SIZE_64 1
 #endif
 
@@ -202,8 +182,8 @@
 
 /* Maximum number of unique hangs or crashes to record: */
 
-#define KEEP_UNIQUE_HANG 512U
-#define KEEP_UNIQUE_CRASH 25600U
+#define KEEP_UNIQUE_HANG 500U
+#define KEEP_UNIQUE_CRASH 10000U
 
 /* Baseline number of random tweaks during a single 'havoc' stage: */
 
@@ -339,10 +319,6 @@
 
 #define AVG_SMOOTHING 16
 
-/* Max length of sync id (the id after -M and -S) */
-
-#define SYNC_ID_MAX_LEN 50
-
 /* Sync interval (every n havoc cycles): */
 
 #define SYNC_INTERVAL 8
@@ -428,15 +404,9 @@
 
 #define SHM_ENV_VAR "__AFL_SHM_ID"
 
-/* Environment variable used to pass shared memory fuzz map id
-and the mapping size to the called program. */
+/* Environment variable used to pass SHM FUZZ ID to the called program. */
 
 #define SHM_FUZZ_ENV_VAR "__AFL_SHM_FUZZ_ID"
-#define SHM_FUZZ_MAP_SIZE_ENV_VAR "__AFL_SHM_FUZZ_MAP_SIZE"
-
-/* Default size of the shared memory fuzz map.
-We add 4 byte for one u32 length field. */
-#define SHM_FUZZ_MAP_SIZE_DEFAULT (MAX_FILE + 4)
 
 /* Other less interesting, internal-only variables. */
 
@@ -522,9 +492,6 @@ We add 4 byte for one u32 length field. */
 
 #define CMPLOG_SHM_ENV_VAR "__AFL_CMPLOG_SHM_ID"
 
-/* ASAN SHM ID */
-#define AFL_ASAN_FUZZ_SHM_ENV_VAR "__AFL_ASAN_SHM_ID"
-
 /* CPU Affinity lockfile env var */
 
 #define CPU_AFFINITY_ENV_VAR "__AFL_LOCKFILE"
@@ -556,7 +523,7 @@ We add 4 byte for one u32 length field. */
 
 #define AFL_TXT_MAX_LEN 65535
 
-/* What is the minimum percentage of ascii characters present to be classified
+/* What is the minimum percentage of ascii characters present to be classifed
    as "is_ascii"? */
 
 #define AFL_TXT_MIN_PERCENT 99

include/coverage-32.h

@@ -1,12 +1,6 @@
-#ifndef _COVERAGE_H
-
-#define _COVERAGE_H
-
 #include "config.h"
 #include "types.h"
 
-#define _AFL_INTSIZEVAR u32
-
 u32 skim(const u32 *virgin, const u32 *current, const u32 *current_end);
 u32 classify_word(u32 word);
 
@@ -116,5 +110,3 @@ inline u32 skim(const u32 *virgin, const u32 *current, const u32 *current_end) {
 
 }
 
-#endif
-

include/coverage-64.h

@@ -1,12 +1,6 @@
-#ifndef _COVERAGE_H
-
-#define _COVERAGE_H
-
 #include "config.h"
 #include "types.h"
 
-#define _AFL_INTSIZEVAR u64
-
 #if (defined(__AVX512F__) && defined(__AVX512DQ__)) || defined(__AVX2__)
   #include <immintrin.h>
 #endif
@@ -124,7 +118,7 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
     /* All bytes are zero. */
     if (likely(mask == 0xff)) continue;
 
-        /* Look for nonzero bytes and check for new bits. */
+      /* Look for nonzero bytes and check for new bits. */
   #define UNROLL(x)                                                            \
     if (unlikely(!(mask & (1 << x)) && classify_word(current[x]) & virgin[x])) \
     return 1
@@ -198,5 +192,3 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
 
 #endif
 
-#endif
-

include/debug.h

@@ -314,8 +314,8 @@ static inline const char *colorfilter(const char *x) {
 #define FATAL(x...)                                                      \
   do {                                                                   \
                                                                          \
-    SAYF(bSTOP RESET_G1 CURSOR_SHOW    cRST cLRD                         \
-         "\n[-] PROGRAM ABORT : " cRST x);                               \
+    SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD                            \
+         "\n[-] PROGRAM ABORT : " cRST   x);                               \
     SAYF(cLRD "\n         Location : " cRST "%s(), %s:%u\n\n", __func__, \
          __FILE__, (u32)__LINE__);                                       \
     exit(1);                                                             \
@@ -327,11 +327,10 @@ static inline const char *colorfilter(const char *x) {
 #define ABORT(x...)                                                      \
   do {                                                                   \
                                                                          \
-    SAYF(bSTOP RESET_G1 CURSOR_SHOW    cRST cLRD                         \
-         "\n[-] PROGRAM ABORT : " cRST x);                               \
+    SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD                            \
+         "\n[-] PROGRAM ABORT : " cRST   x);                               \
     SAYF(cLRD "\n    Stop location : " cRST "%s(), %s:%u\n\n", __func__, \
          __FILE__, (u32)__LINE__);                                       \
-    fflush(stdout);                                                      \
     abort();                                                             \
                                                                          \
   } while (0)
@@ -342,8 +341,8 @@ static inline const char *colorfilter(const char *x) {
   do {                                                                 \
                                                                        \
     fflush(stdout);                                                    \
-    SAYF(bSTOP RESET_G1 CURSOR_SHOW    cRST cLRD                       \
-         "\n[-]  SYSTEM ERROR : " cRST x);                             \
+    SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD                          \
+         "\n[-]  SYSTEM ERROR : " cRST   x);                             \
     SAYF(cLRD "\n    Stop location : " cRST "%s(), %s:%u\n", __func__, \
          __FILE__, (u32)__LINE__);                                     \
     SAYF(cLRD "       OS message : " cRST "%s\n", strerror(errno));    \

include/envs.h

@@ -10,7 +10,6 @@ static char *afl_environment_deprecated[] = {
     "AFL_DEFER_FORKSRV",
     "AFL_POST_LIBRARY",
     "AFL_PERSISTENT",
-    "AFL_SAN_NO_INST",
     NULL
 
 };
@@ -21,21 +20,20 @@ static char *afl_environment_variables[] = {
     "AFL_AUTORESUME", "AFL_AS_FORCE_INSTRUMENT", "AFL_BENCH_JUST_ONE",
     "AFL_BENCH_UNTIL_CRASH", "AFL_CAL_FAST", "AFL_CC", "AFL_CC_COMPILER",
     "AFL_CMIN_ALLOW_ANY", "AFL_CMIN_CRASHES_ONLY", "AFL_CMPLOG_ONLY_NEW",
-    "AFL_CMPLOG_DEBUG", "AFL_CTX_K", "AFL_LLVM_DONTWRITEID", "AFL_PC_FILTER",
-    "AFL_PC_FILTER_FILE", "AFL_CODE_END", "AFL_CODE_START",
-    "AFL_COMPCOV_BINNAME", "AFL_DUMP_CYCLOMATIC_COMPLEXITY",
-    "AFL_CMPLOG_MAX_LEN", "AFL_COMPCOV_LEVEL", "AFL_CRASH_EXITCODE",
-    "AFL_CRASHING_SEEDS_AS_NEW_CRASH", "AFL_CUSTOM_MUTATOR_LIBRARY",
-    "AFL_CUSTOM_MUTATOR_ONLY", "AFL_CUSTOM_MUTATOR_LATE_SEND",
-    "AFL_CUSTOM_INFO_PROGRAM", "AFL_CUSTOM_INFO_PROGRAM_ARGV",
-    "AFL_CUSTOM_INFO_PROGRAM_INPUT", "AFL_CUSTOM_INFO_OUT", "AFL_CXX",
-    "AFL_CYCLE_SCHEDULES", "AFL_DEBUG", "AFL_DEBUG_CHILD", "AFL_DEBUG_GDB",
-    "AFL_DEBUG_UNICORN", "AFL_DISABLE_REDUNDANT", "AFL_NO_REDUNDANT",
-    "AFL_DISABLE_TRIM", "AFL_NO_TRIM", "AFL_DISABLE_LLVM_INSTRUMENTATION",
-    "AFL_DONT_OPTIMIZE", "AFL_DRIVER_STDERR_DUPLICATE_FILENAME",
-    "AFL_DUMB_FORKSRV", "AFL_EARLY_FORKSERVER", "AFL_ENTRYPOINT",
-    "AFL_EXIT_WHEN_DONE", "AFL_EXIT_ON_TIME", "AFL_EXIT_ON_SEED_ISSUES",
-    "AFL_FAST_CAL", "AFL_FINAL_SYNC", "AFL_FORCE_UI", "AFL_FRIDA_DEBUG_MAPS",
+    "AFL_CODE_END", "AFL_CODE_START", "AFL_COMPCOV_BINNAME",
+    "AFL_DUMP_CYCLOMATIC_COMPLEXITY", "AFL_CMPLOG_MAX_LEN", "AFL_COMPCOV_LEVEL",
+    "AFL_CRASH_EXITCODE", "AFL_CRASHING_SEEDS_AS_NEW_CRASH",
+    "AFL_CUSTOM_MUTATOR_LIBRARY", "AFL_CUSTOM_MUTATOR_ONLY",
+    "AFL_CUSTOM_MUTATOR_LATE_SEND", "AFL_CUSTOM_INFO_PROGRAM",
+    "AFL_CUSTOM_INFO_PROGRAM_ARGV", "AFL_CUSTOM_INFO_PROGRAM_INPUT",
+    "AFL_CUSTOM_INFO_OUT", "AFL_CXX", "AFL_CYCLE_SCHEDULES", "AFL_DEBUG",
+    "AFL_DEBUG_CHILD", "AFL_DEBUG_GDB", "AFL_DEBUG_UNICORN",
+    "AFL_DISABLE_REDUNDANT", "AFL_NO_REDUNDANT", "AFL_DISABLE_TRIM",
+    "AFL_NO_TRIM", "AFL_DISABLE_LLVM_INSTRUMENTATION", "AFL_DONT_OPTIMIZE",
+    "AFL_DRIVER_STDERR_DUPLICATE_FILENAME", "AFL_DUMB_FORKSRV",
+    "AFL_EARLY_FORKSERVER", "AFL_ENTRYPOINT", "AFL_EXIT_WHEN_DONE",
+    "AFL_EXIT_ON_TIME", "AFL_EXIT_ON_SEED_ISSUES", "AFL_FAST_CAL",
+    "AFL_FINAL_SYNC", "AFL_FORCE_UI", "AFL_FRIDA_DEBUG_MAPS",
     "AFL_FRIDA_DRIVER_NO_HOOK", "AFL_FRIDA_EXCLUDE_RANGES",
     "AFL_FRIDA_INST_CACHE_SIZE", "AFL_FRIDA_INST_COVERAGE_ABSOLUTE",
     "AFL_FRIDA_INST_COVERAGE_FILE", "AFL_FRIDA_INST_DEBUG_FILE",
@@ -51,12 +49,12 @@ static char *afl_environment_variables[] = {
     "AFL_FRIDA_PERSISTENT_RET", "AFL_FRIDA_STALKER_ADJACENT_BLOCKS",
     "AFL_FRIDA_STALKER_IC_ENTRIES", "AFL_FRIDA_STALKER_NO_BACKPATCH",
     "AFL_FRIDA_STATS_FILE", "AFL_FRIDA_STATS_INTERVAL", "AFL_FRIDA_TRACEABLE",
-    "AFL_FRIDA_VERBOSE", "AFL_OLD_FORKSERVER", "AFL_OPT_LEVEL",
+    "AFL_FRIDA_VERBOSE", "AFL_OLD_FORKSERVER",
     "AFL_FUZZER_ARGS",  // oss-fuzz
     "AFL_FUZZER_STATS_UPDATE_INTERVAL", "AFL_GDB", "AFL_GCC_ALLOWLIST",
-    "AFL_GCC_DENYLIST", "AFL_GCC_BLOCKLIST", "AFL_GCC_DISABLE_VERSION_CHECK",
-    "AFL_GCC_INSTRUMENT_FILE", "AFL_GCC_OUT_OF_LINE", "AFL_GCC_SKIP_NEVERZERO",
-    "AFL_GCJ", "AFL_HANG_TMOUT", "AFL_FORKSRV_INIT_TMOUT", "AFL_HARDEN",
+    "AFL_GCC_DENYLIST", "AFL_GCC_BLOCKLIST", "AFL_GCC_INSTRUMENT_FILE",
+    "AFL_GCC_OUT_OF_LINE", "AFL_GCC_SKIP_NEVERZERO", "AFL_GCJ",
+    "AFL_HANG_TMOUT", "AFL_FORKSRV_INIT_TMOUT", "AFL_HARDEN",
     "AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES", "AFL_IGNORE_PROBLEMS",
     "AFL_IGNORE_PROBLEMS_COVERAGE", "AFL_IGNORE_SEED_PROBLEMS",
     "AFL_IGNORE_TIMEOUTS", "AFL_IGNORE_UNKNOWN_ENVS", "AFL_IMPORT_FIRST",
@@ -115,12 +113,12 @@ static char *afl_environment_variables[] = {
     "AFL_STATSD_TAGS_FLAVOR", "AFL_SYNC_TIME", "AFL_TESTCACHE_SIZE",
     "AFL_TESTCACHE_ENTRIES", "AFL_TMIN_EXACT", "AFL_TMPDIR", "AFL_TOKEN_FILE",
     "AFL_TRACE_PC", "AFL_USE_ASAN", "AFL_USE_MSAN", "AFL_USE_TRACE_PC",
-    "AFL_USE_UBSAN", "AFL_UBSAN_VERBOSE", "AFL_USE_TSAN", "AFL_USE_CFISAN",
-    "AFL_CFISAN_VERBOSE", "AFL_USE_LSAN", "AFL_WINE_PATH", "AFL_NO_SNAPSHOT",
-    "AFL_EXPAND_HAVOC_NOW", "AFL_USE_FASAN", "AFL_USE_QASAN",
-    "AFL_PRINT_FILENAMES", "AFL_PIZZA_MODE", "AFL_NO_FASTRESUME",
-    "AFL_SAN_ABSTRACTION", "AFL_LLVM_ONLY_FSRV", "AFL_GCC_ONLY_FRSV",
-    "AFL_SAN_RECOVER", "AFL_PRELOAD_DISCRIMINATE_FORKSERVER_PARENT", NULL};
+    "AFL_USE_UBSAN", "AFL_USE_TSAN", "AFL_USE_CFISAN", "AFL_USE_LSAN",
+    "AFL_WINE_PATH", "AFL_NO_SNAPSHOT", "AFL_EXPAND_HAVOC_NOW", "AFL_USE_FASAN",
+    "AFL_USE_QASAN", "AFL_PRINT_FILENAMES", "AFL_PIZZA_MODE",
+    "AFL_NO_FASTRESUME", NULL
+
+};
 
 extern char *afl_environment_variables[];
 

include/forkserver.h

@@ -89,14 +89,11 @@ typedef struct {
   bool (*nyx_config_set_aux_buffer_size)(void    *config,
                                          uint32_t aux_buffer_size);
 
-  uint64_t (*nyx_get_target_hash64)(void *config);
-
-  void (*nyx_config_free)(void *config);
-
 } nyx_plugin_handler_t;
 
 /* Imports helper functions to enable Nyx mode (Linux only )*/
 nyx_plugin_handler_t *afl_load_libnyx_plugin(u8 *libnyx_binary);
+
 #endif
 
 typedef struct afl_forkserver {
@@ -137,8 +134,6 @@ typedef struct afl_forkserver {
 
   u8 last_kill_signal;                  /* Signal that killed the child     */
 
-  u8 last_exit_code;               /* Child exit code if counted as a crash */
-
   bool use_shmem_fuzz;                  /* use shared mem for test cases    */
 
   bool support_shmem_fuzz;              /* set by afl-fuzz                  */
@@ -157,15 +152,10 @@ typedef struct afl_forkserver {
 
   bool no_unlink;                       /* do not unlink cur_input          */
 
-  u8 uses_asan;     /* Target uses ASAN/LSAN/MSAN? (bit 0/1/2 respectively) */
-
-  bool setenv;                  /* setenv() to discriminate the forkserver? */
+  bool uses_asan;                       /* Target uses ASAN?                */
 
   bool debug;                           /* debug mode?                      */
 
-  u8 san_but_not_instrumented; /* Is it sanitizer enabled but not instrumented?
-                                */
-
   bool uses_crash_exitcode;             /* Custom crash exitcode specified? */
   u8   crash_exitcode;                  /* The crash exitcode specified     */
 
@@ -174,7 +164,6 @@ typedef struct afl_forkserver {
   u8 *shmem_fuzz;                       /* allocated memory for fuzzing     */
 
   char *cmplog_binary;                  /* the name of the cmplog binary    */
-  char *asanfuzz_binary;                /* the name of the ASAN binary      */
 
   /* persistent mode replay functionality */
   u32 persistent_record;                /* persistent replay setting        */
@@ -215,7 +204,6 @@ typedef struct afl_forkserver {
   bool                  nyx_use_tmp_workdir;
   char                 *nyx_tmp_workdir_path;
   s32                   nyx_log_fd;
-  u64                   nyx_target_hash64;
 #endif
 
 #ifdef __AFL_CODE_COVERAGE
@@ -242,7 +230,6 @@ typedef enum fsrv_run_result {
 
 void afl_fsrv_init(afl_forkserver_t *fsrv);
 void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from);
-void afl_fsrv_setup_preload(afl_forkserver_t *fsrv, char *argv0);
 void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
                     volatile u8 *stop_soon_p, u8 debug_child_output);
 u32  afl_fsrv_get_mapsize(afl_forkserver_t *fsrv, char **argv,
@@ -254,10 +241,6 @@ void              afl_fsrv_killall(void);
 void              afl_fsrv_deinit(afl_forkserver_t *fsrv);
 void              afl_fsrv_kill(afl_forkserver_t *fsrv);
 
-#ifdef __linux__
-void nyx_load_target_hash(afl_forkserver_t *fsrv);
-#endif
-
 #ifdef __APPLE__
   #define MSG_FORK_ON_APPLE                                                    \
     "    - On MacOS X, the semantics of fork() syscalls are non-standard and " \

include/hash.h

@@ -2,6 +2,18 @@
    american fuzzy lop++ - hashing function
    ---------------------------------------
 
+   The hash32() function is a variant of MurmurHash3, a good
+   non-cryptosafe hashing function developed by Austin Appleby.
+
+   For simplicity, this variant does *NOT* accept buffer lengths
+   that are not divisible by 8 bytes. The 32-bit version is otherwise
+   similar to the original; the 64-bit one is a custom hack with
+   mostly-unproven properties.
+
+   Austin's original code is public domain.
+
+   Other code written by Michal Zalewski
+
    Copyright 2016 Google Inc. All rights reserved.
    Copyright 2019-2024 AFLplusplus Project. All rights reserved.
 
@@ -21,5 +33,82 @@
 u32 hash32(u8 *key, u32 len, u32 seed);
 u64 hash64(u8 *key, u32 len, u64 seed);
 
+#if 0
+
+The following code is disabled because xxh3 is 30% faster
+
+  #ifdef __x86_64__
+
+    #define ROL64(_x, _r) ((((u64)(_x)) << (_r)) | (((u64)(_x)) >> (64 - (_r))))
+
+static inline u32 hash32(u8 *key, u32 len, u32 seed) {
+
+  const u64 *data = (u64 *)key;
+  u64        h1 = seed ^ len;
+
+  len >>= 3;
+
+  while (len--) {
+
+    u64 k1 = *data++;
+
+    k1 *= 0x87c37b91114253d5ULL;
+    k1 = ROL64(k1, 31);
+    k1 *= 0x4cf5ad432745937fULL;
+
+    h1 ^= k1;
+    h1 = ROL64(h1, 27);
+    h1 = h1 * 5 + 0x52dce729;
+
+  }
+
+  h1 ^= h1 >> 33;
+  h1 *= 0xff51afd7ed558ccdULL;
+  h1 ^= h1 >> 33;
+  h1 *= 0xc4ceb9fe1a85ec53ULL;
+  h1 ^= h1 >> 33;
+
+  return h1;
+
+}
+
+  #else
+
+    #define ROL32(_x, _r) ((((u32)(_x)) << (_r)) | (((u32)(_x)) >> (32 - (_r))))
+
+static inline u32 hash32(const void *key, u32 len, u32 seed) {
+
+  const u32 *data = (u32 *)key;
+  u32        h1 = seed ^ len;
+
+  len >>= 2;
+
+  while (len--) {
+
+    u32 k1 = *data++;
+
+    k1 *= 0xcc9e2d51;
+    k1 = ROL32(k1, 15);
+    k1 *= 0x1b873593;
+
+    h1 ^= k1;
+    h1 = ROL32(h1, 13);
+    h1 = h1 * 5 + 0xe6546b64;
+
+  }
+
+  h1 ^= h1 >> 16;
+  h1 *= 0x85ebca6b;
+  h1 ^= h1 >> 13;
+  h1 *= 0xc2b2ae35;
+  h1 ^= h1 >> 16;
+
+  return h1;
+
+}
+
+  #endif                                                     /* ^__x86_64__ */
+#endif
+
 #endif                                                     /* !_HAVE_HASH_H */
 

include/sharedmem.h

@@ -51,7 +51,6 @@ typedef struct sharedmem {
   size_t map_size;                                 /* actual allocated size */
 
   int             cmplog_mode;
-  int             sanfuzz_mode;
   int             shmemfuzz_mode;
   struct cmp_map *cmp_map;
 

include/t1ha.h

@@ -63,7 +63,7 @@
  *      // To enable unaligned access, but indicate that it significantly slow.
  *      #define T1HA_SYS_UNALIGNED_ACCESS 1
  *
- *      // To enable unaligned access, and indicate that it's efficient.
+ *      // To enable unaligned access, and indicate that it effecient.
  *      #define T1HA_SYS_UNALIGNED_ACCESS 2
  *
  *
@@ -512,7 +512,7 @@ T1HA_API uint64_t t1ha2_atonce128(uint64_t *__restrict extra_result,
                                   uint64_t seed);
 
 /* The init/update/final trinity for streaming.
- * Return 64 or 128-bit result dependently from `extra_result` argument. */
+ * Return 64 or 128-bit result depentently from `extra_result` argument. */
 T1HA_API void t1ha2_init(t1ha_context_t *ctx, uint64_t seed_x, uint64_t seed_y);
 T1HA_API void t1ha2_update(t1ha_context_t *__restrict ctx,
                            const void *__restrict data, size_t length);

include/t1ha_bits.h

@@ -455,10 +455,9 @@ typedef struct {
 
 } __attribute__((__packed__)) t1ha_unaligned_proxy;
 
-    #define read_unaligned(ptr, bits)                                 \
-      (((const t1ha_unaligned_proxy *)((const uint8_t *)(ptr) -       \
-                                       offsetof(t1ha_unaligned_proxy, \
-                                                unaligned_##bits)))   \
+    #define read_unaligned(ptr, bits)                                   \
+      (((const t1ha_unaligned_proxy *)((const uint8_t *)(ptr)-offsetof( \
+            t1ha_unaligned_proxy, unaligned_##bits)))                   \
            ->unaligned_##bits)
   #elif defined(_MSC_VER)
     #pragma warning(                                                 \
@@ -478,10 +477,9 @@ typedef struct {
 } t1ha_unaligned_proxy;
 
     #pragma pack(pop)
-    #define read_unaligned(ptr, bits)                                 \
-      (((const t1ha_unaligned_proxy *)((const uint8_t *)(ptr) -       \
-                                       offsetof(t1ha_unaligned_proxy, \
-                                                unaligned_##bits)))   \
+    #define read_unaligned(ptr, bits)                                   \
+      (((const t1ha_unaligned_proxy *)((const uint8_t *)(ptr)-offsetof( \
+            t1ha_unaligned_proxy, unaligned_##bits)))                   \
            ->unaligned_##bits)
   #endif
 #endif                                                    /* read_unaligned */
@@ -498,24 +496,21 @@ typedef struct {
   #elif __has_attribute(__assume_aligned__)
 
 static __always_inline const uint16_t *__attribute__((
-    __assume_aligned__(ALIGNMENT_16)))
-cast_aligned_16(const void *ptr) {
+    __assume_aligned__(ALIGNMENT_16))) cast_aligned_16(const void *ptr) {
 
   return (const uint16_t *)ptr;
 
 }
 
 static __always_inline const uint32_t *__attribute__((
-    __assume_aligned__(ALIGNMENT_32)))
-cast_aligned_32(const void *ptr) {
+    __assume_aligned__(ALIGNMENT_32))) cast_aligned_32(const void *ptr) {
 
   return (const uint32_t *)ptr;
 
 }
 
 static __always_inline const uint64_t *__attribute__((
-    __assume_aligned__(ALIGNMENT_64)))
-cast_aligned_64(const void *ptr) {
+    __assume_aligned__(ALIGNMENT_64))) cast_aligned_64(const void *ptr) {
 
   return (const uint64_t *)ptr;