/* */ #define AFL_MAIN #include "config.h" #include "types.h" #include "debug.h" #include "alloc-inl.h" #include "hash.h" #include "sharedmem.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include extern unsigned char*trace_bits; #ifdef USEMMAP /* ================ Proteas ================ */ int g_shm_fd = -1; unsigned char *g_shm_base = NULL; char g_shm_file_path[L_tmpnam]; /* ========================================= */ #else static s32 shm_id; /* ID of the SHM region */ #endif /* Get rid of shared memory (atexit handler). */ void remove_shm(void) { #ifdef USEMMAP if (g_shm_base != NULL) { munmap(g_shm_base, MAP_SIZE); g_shm_base = NULL; } if (g_shm_fd != -1) { close(g_shm_fd); g_shm_fd = -1; } #else shmctl(shm_id, IPC_RMID, NULL); #endif } /* Configure shared memory. */ void setup_shm(unsigned char dumb_mode) { #ifdef USEMMAP /* generate random file name for multi instance */ memset(g_shm_file_path, 0x0, L_tmpnam); char *result = tmpnam(g_shm_file_path); if (result == 0) PFATAL("cannot generate filename for shared memory"); /* get rid of second slash in /tmp/blabla */ g_shm_file_path[4] = '_'; /* create the shared memory segment as if it was a file */ g_shm_fd = shm_open(g_shm_file_path, O_CREAT | O_RDWR | O_EXCL, 0600); if (g_shm_fd == -1) { PFATAL("shm_open() failed"); } /* configure the size of the shared memory segment */ if (ftruncate(g_shm_fd, MAP_SIZE)) { PFATAL("setup_shm(): ftruncate() failed"); } /* map the shared memory segment to the address space of the process */ g_shm_base = mmap(0, MAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, g_shm_fd, 0); if (g_shm_base == MAP_FAILED) { close(g_shm_fd); g_shm_fd = -1; PFATAL("mmap() failed"); } atexit(remove_shm); /* If somebody is asking us to fuzz instrumented binaries in dumb mode, we don't want them to detect instrumentation, since we won't be sending fork server commands. This should be replaced with better auto-detection later on, perhaps? */ if (!dumb_mode) setenv(SHM_ENV_VAR, g_shm_file_path, 1); trace_bits = g_shm_base; if (!trace_bits) PFATAL("mmap() failed"); #else u8* shm_str; shm_id = shmget(IPC_PRIVATE, MAP_SIZE, IPC_CREAT | IPC_EXCL | 0600); if (shm_id < 0) PFATAL("shmget() failed"); atexit(remove_shm); shm_str = alloc_printf("%d", shm_id); setenv(SHM_ENV_VAR, shm_str, 1); /* If somebody is asking us to fuzz instrumented binaries in dumb mode, we don't want them to detect instrumentation, since we won't be sending fork server commands. This should be replaced with better auto-detection later on, perhaps? */ if (!dumb_mode) setenv(SHM_ENV_VAR, shm_str, 1); ck_free(shm_str); trace_bits = shmat(shm_id, NULL, 0); if (!trace_bits) PFATAL("shmat() failed"); #endif }