removed gcc_plugin from master

6 files changed, 0 insertions, 1145 deletions

diff --git a/gcc_plugin/CRASH b/gcc_plugin/CRASH
deleted file mode 100644
index 51930bb3..00000000
--- a/gcc_plugin/CRASH
+++ /dev/null
@@ -1,23 +0,0 @@
-to reproduce:
-=============
-tiff-4.0.4.tar.gz
-CC=afl-gcc-fast CXX=afl-g++-fast ./configure --disable-shared
-make
-
-result
-======
-[+] Instrumented 11 locations in TIFFInitJPEG
-during GIMPLE pass: evrp
-tif_jpeg.c: In function ‘JPEGFixupTagsSubsamplingSec’:
-tif_jpeg.c:2388:1: internal compiler error: Segmentation fault
- }
- ^
-0x7ffff758e83f ???
-	/build/glibc-vjB4T1/glibc-2.28/signal/../sysdeps/unix/sysv/linux/x86_64/sigaction.c:0
-0x7ffff757b09a __libc_start_main
-	../csu/libc-start.c:308
-Please submit a full bug report,
-with preprocessed source if appropriate.
-Please include the complete backtrace with any bug report.
-See <file:///usr/share/doc/gcc-8/README.Bugs> for instructions.
-make[2]: *** [Makefile:696: tif_jpeg.lo] Error 1
diff --git a/gcc_plugin/Makefile b/gcc_plugin/Makefile
deleted file mode 100644
index 2f4c5db0..00000000
--- a/gcc_plugin/Makefile
+++ /dev/null
@@ -1,75 +0,0 @@
-#
-# american fuzzy lop - GCC plugin instrumentation
-# -----------------------------------------------
-#
-# Written by Austin Seipp <aseipp@pobox.com> and
-#            Laszlo Szekeres <lszekeres@google.com> and
-#            Michal Zalewski <lcamtuf@google.com>
-#
-# GCC integration design is based on the LLVM design, which comes
-# from Laszlo Szekeres.
-#
-# Copyright 2015 Google Inc. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at:
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-
-PREFIX      ?= /usr/local
-HELPER_PATH  = $(PREFIX)/lib/afl
-BIN_PATH     = $(PREFIX)/bin
-
-CFLAGS      ?= -O3 -g -funroll-loops
-CFLAGS      += -Wall -D_FORTIFY_SOURCE=2 -Wno-pointer-sign \
-               -DAFL_PATH=\"$(HELPER_PATH)\" -DBIN_PATH=\"$(BIN_PATH)\" \
-
-CXXFLAGS	?= -O3 -g -funroll-loops
-CXXEFLAGS   := $(CXXFLAGS) -Wall -D_FORTIFY_SOURCE=2
-
-CC          ?= gcc
-CXX         ?= g++
-
-PLUGIN_FLAGS = -fPIC -fno-rtti -I"$(shell $(CC) -print-file-name=plugin)/include"
-
-PROGS        = ../afl-gcc-fast ../afl-gcc-pass.so ../afl-gcc-rt.o
-
-all: test_deps $(PROGS) test_build all_done
-
-test_deps:
-	@echo "[*] Checking for working '$(CC)'..."
-	@which $(CC) >/dev/null 2>&1 || ( echo "[-] Oops, can't find '$(CC)'. Make sure that it's in your \$$PATH (or set \$$CC and \$$CXX)."; exit 1 )
-	@echo "[*] Checking for '../afl-showmap'..."
-	@test -f ../afl-showmap || ( echo "[-] Oops, can't find '../afl-showmap'. Be sure to compile AFL first."; exit 1 )
-	@echo "[+] All set and ready to build."
-
-../afl-gcc-fast: afl-gcc-fast.c | test_deps
-	$(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
-	ln -sf afl-gcc-fast ../afl-g++-fast
-
-../afl-gcc-pass.so: afl-gcc-pass.so.cc | test_deps
-	$(CXX) $(CXXEFLAGS) $(PLUGIN_FLAGS) -shared $< -o $@
-
-../afl-gcc-rt.o: afl-gcc-rt.o.c | test_deps
-	$(CC) $(CFLAGS) -fPIC -c $< -o $@
-
-test_build: $(PROGS)
-	@echo "[*] Testing the CC wrapper and instrumentation output..."
-	unset AFL_USE_ASAN AFL_USE_MSAN; AFL_QUIET=1 AFL_INST_RATIO=100 AFL_PATH=. AFL_CC=$(CC) ../afl-gcc-fast $(CFLAGS) ../test-instr.c -o test-instr $(LDFLAGS)
-#	unset AFL_USE_ASAN AFL_USE_MSAN;             AFL_INST_RATIO=100 AFL_PATH=. AFL_CC=$(CC) ../afl-gcc-fast $(CFLAGS) ../test-instr.c -o test-instr $(LDFLAGS)
-	echo 0 | ../afl-showmap -m none -q -o .test-instr0 ./test-instr
-	echo 1 | ../afl-showmap -m none -q -o .test-instr1 ./test-instr
-	@rm -f test-instr
-	@cmp -s .test-instr0 .test-instr1; DR="$$?"; rm -f .test-instr0 .test-instr1; if [ "$$DR" = "0" ]; then echo; echo "Oops, the instrumentation does not seem to be behaving correctly!"; echo; echo "Please ping <lcamtuf@google.com> to troubleshoot the issue."; echo; exit 1; fi
-	@echo "[+] All right, the instrumentation seems to be working!"
-
-all_done: test_build
-	@echo "[+] All done! You can now use '../afl-gcc-fast' to compile programs."
-
-.NOTPARALLEL: clean
-
-clean:
-	rm -f *.o *.so *~ a.out core core.[1-9][0-9]* test-instr .test-instr0 .test-instr1
-	rm -f $(PROGS) ../afl-g++-fast
diff --git a/gcc_plugin/README.gcc b/gcc_plugin/README.gcc
deleted file mode 100644
index a002c741..00000000
--- a/gcc_plugin/README.gcc
+++ /dev/null
@@ -1,163 +0,0 @@
-===========================================
-Fast GCC-based instrumentation for afl-fuzz
-===========================================
-
-  (See ../docs/README for the general instruction manual.)
-  (See ../llvm_mode/README.llvm for the LLVM-based instrumentation.)
-
-
-!!!
-!!! gcc_plugin is not stable yet and can crash when compiling
-!!!
-
-
-1) Introduction
----------------
-
-The code in this directory allows you to instrument programs for AFL using
-true compiler-level instrumentation, instead of the more crude
-assembly-level rewriting approach taken by afl-gcc and afl-clang. This has
-several interesting properties:
-
-  - The compiler can make many optimizations that are hard to pull off when
-    manually inserting assembly. As a result, some slow, CPU-bound programs will
-    run up to around 2x faster.
-
-    The gains are less pronounced for fast binaries, where the speed is limited
-    chiefly by the cost of creating new processes. In such cases, the gain will
-    probably stay within 10%.
-
-  - The instrumentation is CPU-independent. At least in principle, you should
-    be able to rely on it to fuzz programs on non-x86 architectures (after
-    building afl-fuzz with AFL_NOX86=1).
-
-  - Because the feature relies on the internals of GCC, it is gcc-specific
-    and will *not* work with LLVM (see ../llvm_plugin for an alternative).
-
-Once this implementation is shown to be sufficiently robust and portable, it
-will probably replace afl-gcc. For now, it can be built separately and
-co-exists with the original code.
-
-The idea and much of the implementation comes from Laszlo Szekeres.
-
-2) How to use
--------------
-
-In order to leverage this mechanism, you need to have GCC and the plugin headers
-installed on your system. That should be all you need. On Debian machines, these
-headers can be acquired by installing the `gcc-<VERSION>-plugin-dev` packages.
-
-To build the instrumentation itself, type 'make'. This will generate binaries
-called afl-gcc-fast and afl-g++-fast in the parent directory. Once this
-is done, you can instrument third-party code in a way similar to the standard
-operating mode of AFL, e.g.:
-
-  CC=/path/to/afl/afl-gcc-fast ./configure [...options...]
-  make
-
-Be sure to also include CXX set to afl-g++-fast for C++ code.
-
-The tool honors roughly the same environmental variables as afl-gcc (see
-../docs/env_variables.txt). This includes AFL_INST_RATIO, AFL_USE_ASAN,
-AFL_HARDEN, and AFL_DONT_OPTIMIZE.
-
-Note: if you want the GCC plugin to be installed on your system for all
-users, you need to build it before issuing 'make install' in the parent
-directory.
-
-3) Gotchas, feedback, bugs
---------------------------
-
-This is an early-stage mechanism, so field reports are welcome. You can send bug
-reports to <aseipp@pobox.com>.
-
-4) Bonus feature #1: deferred initialization
---------------------------------------------
-
-AFL tries to optimize performance by executing the targeted binary just once,
-stopping it just before main(), and then cloning this "master" process to get
-a steady supply of targets to fuzz.
-
-Although this approach eliminates much of the OS-, linker- and libc-level
-costs of executing the program, it does not always help with binaries that
-perform other time-consuming initialization steps - say, parsing a large config
-file before getting to the fuzzed data.
-
-In such cases, it's beneficial to initialize the forkserver a bit later, once
-most of the initialization work is already done, but before the binary attempts
-to read the fuzzed input and parse it; in some cases, this can offer a 10x+
-performance gain. You can implement delayed initialization in LLVM mode in a
-fairly simple way.
-
-First, locate a suitable location in the code where the delayed cloning can
-take place. This needs to be done with *extreme* care to avoid breaking the
-binary. In particular, the program will probably malfunction if you select
-a location after:
-
-  - The creation of any vital threads or child processes - since the forkserver
-    can't clone them easily.
-
-  - The initialization of timers via setitimer() or equivalent calls.
-
-  - The creation of temporary files, network sockets, offset-sensitive file
-    descriptors, and similar shared-state resources - but only provided that
-    their state meaningfully influences the behavior of the program later on.
-
-  - Any access to the fuzzed input, including reading the metadata about its
-    size.
-
-With the location selected, add this code in the appropriate spot:
-
-#ifdef __AFL_HAVE_MANUAL_CONTROL
-  __AFL_INIT();
-#endif
-
-You don't need the #ifdef guards, but they will make the program still work as
-usual when compiled with a tool other than afl-gcc-fast/afl-clang-fast.
-
-Finally, recompile the program with afl-gcc-fast (afl-gcc or afl-clang will
-*not* generate a deferred-initialization binary) - and you should be all set!
-
-5) Bonus feature #2: persistent mode
-------------------------------------
-
-Some libraries provide APIs that are stateless, or whose state can be reset in
-between processing different input files. When such a reset is performed, a
-single long-lived process can be reused to try out multiple test cases,
-eliminating the need for repeated fork() calls and the associated OS overhead.
-
-The basic structure of the program that does this would be:
-
-  while (__AFL_LOOP(1000)) {
-
-    /* Read input data. */
-    /* Call library code to be fuzzed. */
-    /* Reset state. */
-
-  }
-
-  /* Exit normally */
-
-The numerical value specified within the loop controls the maximum number
-of iterations before AFL will restart the process from scratch. This minimizes
-the impact of memory leaks and similar glitches; 1000 is a good starting point.
-
-A more detailed template is shown in ../experimental/persistent_demo/.
-Similarly to the previous mode, the feature works only with afl-gcc-fast or
-afl-clang-fast; #ifdef guards can be used to suppress it when using other
-compilers.
-
-Note that as with the previous mode, the feature is easy to misuse; if you
-do not reset the critical state fully, you may end up with false positives or
-waste a whole lot of CPU power doing nothing useful at all. Be particularly
-wary of memory leaks and the state of file descriptors.
-
-When running in this mode, the execution paths will inherently vary a bit
-depending on whether the input loop is being entered for the first time or
-executed again. To avoid spurious warnings, the feature implies
-AFL_NO_VAR_CHECK and hides the "variable path" warnings in the UI.
-
-PS. Because there are task switches still involved, the mode isn't as fast as
-"pure" in-process fuzzing offered, say, by LLVM's LibFuzzer; but it is a lot
-faster than the normal fork() model, and compared to in-process fuzzing,
-should be a lot more robust.
diff --git a/gcc_plugin/afl-gcc-fast.c b/gcc_plugin/afl-gcc-fast.c
deleted file mode 100644
index 018b3f5f..00000000
--- a/gcc_plugin/afl-gcc-fast.c
+++ /dev/null
@@ -1,283 +0,0 @@
-/*
-   american fuzzy lop - GCC wrapper for GCC plugin
-   ------------------------------------------------
-
-   Written by Austin Seipp <aseipp@pobox.com> and
-              Laszlo Szekeres <lszekeres@google.com> and
-              Michal Zalewski <lcamtuf@google.com>
-
-   GCC integration design is based on the LLVM design, which comes
-   from Laszlo Szekeres.
-
-   Copyright 2015 Google Inc. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   This program is a drop-in replacement for gcc, similar in most
-   respects to ../afl-gcc, but with compiler instrumentation through a
-   plugin. It tries to figure out compilation mode, adds a bunch of
-   flags, and then calls the real compiler.
-
- */
-
-#define AFL_MAIN
-
-#include "../config.h"
-#include "../types.h"
-#include "../debug.h"
-#include "../alloc-inl.h"
-
-#include <stdio.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <string.h>
-
-static u8*  obj_path;               /* Path to runtime libraries         */
-static u8** cc_params;              /* Parameters passed to the real CC  */
-static u32  cc_par_cnt = 1;         /* Param count, including argv0      */
-
-
-/* Try to find the runtime libraries. If that fails, abort. */
-
-static void find_obj(u8* argv0) {
-
-  u8 *afl_path = getenv("AFL_PATH");
-  u8 *slash, *tmp;
-
-  if (afl_path) {
-
-    tmp = alloc_printf("%s/afl-gcc-rt.o", afl_path);
-
-    if (!access(tmp, R_OK)) {
-      obj_path = afl_path;
-      ck_free(tmp);
-      return;
-    }
-
-    ck_free(tmp);
-
-  }
-
-  slash = strrchr(argv0, '/');
-
-  if (slash) {
-
-    u8 *dir;
-
-    *slash = 0;
-    dir = ck_strdup(argv0);
-    *slash = '/';
-
-    tmp = alloc_printf("%s/afl-gcc-rt.o", dir);
-
-    if (!access(tmp, R_OK)) {
-      obj_path = dir;
-      ck_free(tmp);
-      return;
-    }
-
-    ck_free(tmp);
-    ck_free(dir);
-
-  }
-
-  if (!access(AFL_PATH "/afl-gcc-rt.o", R_OK)) {
-    obj_path = AFL_PATH;
-    return;
-  }
-
-  FATAL("Unable to find 'afl-gcc-rt.o' or 'afl-gcc-pass.so'. Please set AFL_PATH");
-}
-
-
-/* Copy argv to cc_params, making the necessary edits. */
-
-static void edit_params(u32 argc, char** argv) {
-
-  u8 fortify_set = 0, asan_set = 0, x_set = 0, maybe_linking = 1;
-  u8 *name;
-
-  cc_params = ck_alloc((argc + 64) * sizeof(u8*));
-
-  name = strrchr(argv[0], '/');
-  if (!name) name = argv[0]; else name++;
-
-  if (!strcmp(name, "afl-g++-fast")) {
-    u8* alt_cxx = getenv("AFL_CXX");
-    cc_params[0] = alt_cxx ? alt_cxx : (u8*)"g++";
-  } else {
-    u8* alt_cc = getenv("AFL_CC");
-    cc_params[0] = alt_cc ? alt_cc : (u8*)"gcc";
-  }
-
-  char* fplugin_arg = alloc_printf("-fplugin=%s/afl-gcc-pass.so", obj_path);
-  cc_params[cc_par_cnt++] = fplugin_arg;
-
-  while (--argc) {
-    u8* cur = *(++argv);
-
-#if defined(__x86_64__)
-    if (!strcmp(cur, "-m32")) FATAL("-m32 is not supported");
-#endif
-
-    if (!strcmp(cur, "-x")) x_set = 1;
-
-    if (!strcmp(cur, "-c") || !strcmp(cur, "-S") || !strcmp(cur, "-E") ||
-        !strcmp(cur, "-v")) maybe_linking = 0;
-
-    if (!strcmp(cur, "-fsanitize=address") ||
-        !strcmp(cur, "-fsanitize=memory")) asan_set = 1;
-
-    if (strstr(cur, "FORTIFY_SOURCE")) fortify_set = 1;
-
-    cc_params[cc_par_cnt++] = cur;
-
-  }
-
-  if (getenv("AFL_HARDEN")) {
-
-    cc_params[cc_par_cnt++] = "-fstack-protector-all";
-
-    if (!fortify_set)
-      cc_params[cc_par_cnt++] = "-D_FORTIFY_SOURCE=2";
-
-  }
-
-  if (!asan_set) {
-
-    if (getenv("AFL_USE_ASAN")) {
-
-      cc_params[cc_par_cnt++] = "-fsanitize=address";
-
-      if (getenv("AFL_USE_MSAN"))
-        FATAL("ASAN and MSAN are mutually exclusive");
-
-    } else if (getenv("AFL_USE_MSAN")) {
-
-      cc_params[cc_par_cnt++] = "-fsanitize=memory";
-
-      if (getenv("AFL_USE_ASAN"))
-        FATAL("ASAN and MSAN are mutually exclusive");
-
-    }
-
-  }
-
-  if (!getenv("AFL_DONT_OPTIMIZE")) {
-
-    cc_params[cc_par_cnt++] = "-g";
-    cc_params[cc_par_cnt++] = "-O3";
-    cc_params[cc_par_cnt++] = "-funroll-loops";
-
-  }
-
-  cc_params[cc_par_cnt++] = "-D__AFL_HAVE_MANUAL_CONTROL=1";
-
-  /* When the user tries to use persistent or deferred forkserver modes by
-     appending a single line to the program, we want to reliably inject a
-     signature into the binary (to be picked up by afl-fuzz) and we want
-     to call a function from the runtime .o file. This is unnecessarily
-     painful for three reasons:
-
-     1) We need to convince the compiler not to optimize out the signature.
-        This is done with __attribute__((used)).
-
-     2) We need to convince the linker, when called with -Wl,--gc-sections,
-        not to do the same. This is done by forcing an assignment to a
-        'volatile' pointer.
-
-     3) We need to declare __afl_persistent_loop() in the global namespace,
-        but doing this within a method in a class is hard - :: and extern "C"
-        are forbidden and __attribute__((alias(...))) doesn't work. Hence the
-        __asm__ aliasing trick.
-
-   */
-
-  cc_params[cc_par_cnt++] = "-D__AFL_LOOP(_A)="
-    "({ static volatile char *_B __attribute__((used)); "
-    " _B = (char*)\"" PERSIST_SIG "\"; "
-#ifdef __APPLE__
-    "int _L(unsigned int) __asm__(\"___afl_persistent_loop\"); "
-#else
-    "int _L(unsigned int) __asm__(\"__afl_persistent_loop\"); "
-#endif /* ^__APPLE__ */
-    "_L(_A); })";
-
-  cc_params[cc_par_cnt++] = "-D__AFL_INIT()="
-    "do { static volatile char *_A __attribute__((used)); "
-    " _A = (char*)\"" DEFER_SIG "\"; "
-#ifdef __APPLE__
-    "void _I(void) __asm__(\"___afl_manual_init\"); "
-#else
-    "void _I(void) __asm__(\"__afl_manual_init\"); "
-#endif /* ^__APPLE__ */
-    "_I(); } while (0)";
-
-  if (maybe_linking) {
-
-    if (x_set) {
-      cc_params[cc_par_cnt++] = "-x";
-      cc_params[cc_par_cnt++] = "none";
-    }
-
-    cc_params[cc_par_cnt++] = alloc_printf("%s/afl-gcc-rt.o", obj_path);
-
-  }
-
-  cc_params[cc_par_cnt] = NULL;
-
-}
-
-
-/* Main entry point */
-
-int main(int argc, char** argv) {
-
-  if (isatty(2) && !getenv("AFL_QUIET")) {
-
-    SAYF(cCYA "afl-gcc-fast" cRST " initial version 1.94 by <aseipp@pobox.com>, updated to " cBRI VERSION cRST " by <thorsten.schulz@uni-rostock.de>\n");
-
-  }
-
-  if (argc < 2) {
-
-    SAYF("\n"
-         "This is a helper application for afl-fuzz. It serves as a drop-in replacement\n"
-         "for gcc, letting you recompile third-party code with the required runtime\n"
-         "instrumentation. A common use pattern would be one of the following:\n\n"
-
-         "  CC=%s/afl-gcc-fast ./configure\n"
-         "  CXX=%s/afl-g++-fast ./configure\n\n"
-
-         "In contrast to the traditional afl-gcc tool, this version is implemented as\n"
-         "a GCC plugin and tends to offer improved performance with slow programs\n"
-         "(similarly to the LLVM plugin used by afl-clang-fast).\n\n"
-
-         "You can specify custom next-stage toolchain via AFL_CC and AFL_CXX. Setting\n"
-         "AFL_HARDEN enables hardening optimizations in the compiled code.\n\n",
-         BIN_PATH, BIN_PATH);
-
-    exit(1);
-
-  }
-
-
-  find_obj(argv[0]);
-
-  edit_params(argc, argv);
-/*if (isatty(2) && !getenv("AFL_QUIET")) {
-	  printf("Calling \"%s\" with:\n", cc_params[0]);
-	  for(int i=1; i<cc_par_cnt; i++) printf("%s\n", cc_params[i]);
-  }
-*/
-  execvp(cc_params[0], (char**)cc_params);
-
-  FATAL("Oops, failed to execute '%s' - check your PATH", cc_params[0]);
-
-  return 0;
-
-}
diff --git a/gcc_plugin/afl-gcc-pass.so.cc b/gcc_plugin/afl-gcc-pass.so.cc
deleted file mode 100644
index b1ca8325..00000000
--- a/gcc_plugin/afl-gcc-pass.so.cc
+++ /dev/null
@@ -1,377 +0,0 @@
-//
-// There are some TODOs in this file:
-//   - dont instrument blocks that are uninterested
-//   - implement whitelist feature
-//   - implement notZero
-//   - fix crash
-//
-
-/*
-   american fuzzy lop - GCC instrumentation pass
-   ---------------------------------------------
-
-   Written by Austin Seipp <aseipp@pobox.com> with bits from
-              Emese Revfy <re.emese@gmail.com>
-
-   Updated by Thorsten Schulz <thorsten.schulz@uni-rostock.de>
-
-   GCC integration design is based on the LLVM design, which comes
-   from Laszlo Szekeres. Some of the boilerplate code below for
-   afl_pass to adapt to different GCC versions was taken from Emese
-   Revfy's Size Overflow plugin for GCC, licensed under the GPLv2/v3.
-
-   (NOTE: this plugin code is under GPLv3, in order to comply with the
-   GCC runtime library exception, which states that you may distribute
-   "Target Code" from the compiler under a license of your choice, as
-   long as the "Compilation Process" is "Eligible", and contains no
-   GPL-incompatible software in GCC "during the process of
-   transforming high level code to target code". In this case, the
-   plugin will be used to generate "Target Code" during the
-   "Compilation Process", and thus it must be GPLv3 to be "eligible".)
-
-   Copyright (C) 2015 Austin Seipp
-
-   This program is free software: you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
- */
-
-//#define BUILD_INLINE_INST
-
-#include "../config.h"
-#include "../debug.h"
-
-/* clear helper AFL types pulls in, which intervene with gcc-plugin geaders from GCC-8 */
-#ifdef likely
-#undef likely
-#endif
-#ifdef unlikely
-#undef unlikely
-#endif
-
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-#include <gcc-plugin.h>
-#include <plugin-version.h>
-#include <diagnostic.h>
-#include <tree.h>
-#include <tree-ssa.h>
-#include <tree-pass.h>
-#include <tree-ssa-alias.h>
-#include <basic-block.h>
-#include <gimple-expr.h>
-#include <gimple.h>
-#include <gimple-iterator.h>
-#include <version.h>
-#include <toplev.h>
-#include <intl.h>
-#include <context.h>
-#include <stringpool.h>
-#include <cgraph.h>
-#include <cfgloop.h>
-
-/* -------------------------------------------------------------------------- */
-/* -- AFL instrumentation pass ---------------------------------------------- */
-
-static int be_quiet = 0;
-static unsigned int inst_ratio = 100;
-static bool inst_ext = true; /* I reckon inline is broken / unfunctional */
-
-
-static unsigned int ext_call_instrument(function *fun) {
-	/* Instrument all the things! */
-	basic_block bb;
-	unsigned finst_blocks = 0;
-	unsigned fcnt_blocks = 0;
-
-	FOR_ALL_BB_FN(bb, fun) {
-		gimple_seq fcall;
-		gimple_seq seq = NULL;
-		gimple_stmt_iterator bentry;
-
-		if (!fcnt_blocks++) continue; /* skip block 0 */
-		
-		// TODO: if the predecessor does not have ast least two destinations
-		// then skip this block :TODO
-
-		/* Bail on this block if we trip the specified ratio */
-		if (R(100) >= inst_ratio) continue;
-
-		/* Make up cur_loc */
-
-		unsigned int rand_loc = R(MAP_SIZE);
-		tree cur_loc = build_int_cst(uint64_type_node, rand_loc);
-
-		/* Update bitmap via external call */
-		/* to quote:
-		 * /+ Trace a basic block with some ID +/
-		 * void __afl_trace(u16 x);
-		 */
-
-		tree fntype = build_function_type_list(
-			void_type_node,   /* return */
-			uint16_type_node, /* args */
-			NULL_TREE);       /* done */
-		tree fndecl = build_fn_decl("__afl_trace", fntype);
-		TREE_STATIC(fndecl)     = 1; /* Defined elsewhere */
-		TREE_PUBLIC(fndecl)     = 1; /* Public */
-		DECL_EXTERNAL(fndecl)   = 1; /* External linkage */
-		DECL_ARTIFICIAL(fndecl) = 1; /* Injected by compiler */
-
-		fcall = gimple_build_call(fndecl, 1, cur_loc);  /* generate the function _call_ to above built reference, with *1* parameter -> the random const for the location */
-		gimple_seq_add_stmt(&seq, fcall); /* and insert into a sequence */
-
-		/* Done - grab the entry to the block and insert sequence */
-		bentry = gsi_start_bb(bb);
-		gsi_insert_seq_before(&bentry, seq, GSI_SAME_STMT);
-
-		finst_blocks++;
-	}
-	fcnt_blocks--; /* discard the first in the count */
-
-	/* Say something nice. */
-	if (!be_quiet) {
-		if (!finst_blocks)
-			WARNF(G_("No instrumentation targets found in " cBRI "%s" cRST ),
-					function_name(fun));
-		else if (finst_blocks < fcnt_blocks)
-			OKF(G_("Instrumented %2u /%2u locations in " cBRI "%s" cRST ),
-					finst_blocks, fcnt_blocks,
-					function_name(fun));
-		else
-			OKF(G_("Instrumented %2u locations in " cBRI "%s" cRST ),
-					finst_blocks,
-					function_name(fun));
-	}
-
-	return 0;
-}
-
-static unsigned int inline_instrument(function *fun) {
-#ifdef BUILD_INLINE_INST   /* ifdef inline away, so I don't have to refactor it */
-	/* Instrument all the things! */
-	basic_block bb;
-	unsigned finst_blocks = 0;
-	unsigned fcnt_blocks = 0;
-
-	/* Set up global type declarations */
-	tree map_type = build_pointer_type(unsigned_char_type_node);
-	tree map_ptr_g = build_decl(UNKNOWN_LOCATION, VAR_DECL, get_identifier_with_length("__afl_area_ptr",14), map_type);
-	TREE_USED(map_ptr_g) = 1;
-	TREE_STATIC(map_ptr_g) = 1; /* Defined elsewhere */
-	DECL_EXTERNAL(map_ptr_g) = 1; /* External linkage */
-	DECL_PRESERVE_P(map_ptr_g) = 1;
-	DECL_ARTIFICIAL(map_ptr_g) = 1;
-	rest_of_decl_compilation(map_ptr_g, 1, 0);
-
-	tree prev_loc_g = build_decl(UNKNOWN_LOCATION, VAR_DECL, get_identifier_with_length("__afl_prev_loc",14), uint16_type_node);
-	TREE_USED(prev_loc_g) = 1;
-	TREE_STATIC(prev_loc_g) = 1; /* Defined elsewhere */
-	DECL_EXTERNAL(prev_loc_g) = 1; /* External linkage */
-	DECL_PRESERVE_P(prev_loc_g) = 1;
-	DECL_ARTIFICIAL(prev_loc_g) = 1;
-	rest_of_decl_compilation(prev_loc_g, 1, 0);
-
-	FOR_ALL_BB_FN(bb, fun) {
-		gimple *g;
-		gimple_seq seq = NULL;
-		gimple_stmt_iterator bentry;
-
-		if (!fcnt_blocks++) continue; /* skip block 0 */
-
-		/* Bail on this block if we trip the specified ratio */
-		if (R(100) >= inst_ratio) continue;
-
-		/* Make up cur_loc */
-
-		unsigned int rand_loc = R(MAP_SIZE);
-		tree cur_loc = build_int_cst(uint64_type_node, rand_loc);
-
-		/* Load prev_loc, xor with cur_loc */
-
-		tree area_off = create_tmp_var(uint64_type_node, "area_off");
-		g = gimple_build_assign(area_off, BIT_XOR_EXPR, prev_loc_g, cur_loc);
-		gimple_seq_add_stmt(&seq, g); // area_off = prev_loc ^ cur_loc
-
-		/* Update bitmap */
-
-//		tree zero = build_int_cst(unsigned_char_type_node, 0);
-		tree one = build_int_cst(unsigned_char_type_node, 1);
-
-		tree tmp1 = create_tmp_var(map_type, "tmp1");
-		g = gimple_build_assign(tmp1, PLUS_EXPR, map_ptr_g, area_off);
-		gimple_seq_add_stmt(&seq, g); // tmp1 = __afl_area_ptr + area_off
-		SAYF(G_("%d,"), fcnt_blocks);
-
-		tree tmp2 = create_tmp_var(unsigned_char_type_node, "tmp2");
-		//tree tmp1_ptr = build_simple_mem_ref_loc(UNKNOWN_LOCATION, tmp1);
-		g = gimple_build_assign(tmp2, INDIRECT_REF, tmp1);
-		gimple_seq_add_stmt(&seq, g); // tmp2 = *tmp1
-
-		tree tmp3 = create_tmp_var(unsigned_char_type_node, "tmp3");
-		g = gimple_build_assign(tmp3, PLUS_EXPR, tmp2, one);
-		gimple_seq_add_stmt(&seq, g); // tmp3 = tmp2 + 1
-
-		// TODO: neverZero: here we have to check if tmp3 == 0
-		//                  and add 1 if so
-
-//		tree tmp4 = create_tmp_var(map_type, "tmp4");
-//		g = gimple_build_assign(tmp4, PLUS_EXPR, map_ptr_g, area_off);
-//		gimple_seq_add_stmt(&seq, g); // tmp4 = __afl_area_ptr + area_off
-
-//		tree deref2 = build2(MEM_REF, map_type, tmp4, zero);
-		tree deref2 = build4(ARRAY_REF, map_type, map_ptr_g, area_off, NULL, NULL);
-		g = gimple_build_assign(deref2, MODIFY_EXPR, tmp3);
-		gimple_seq_add_stmt(&seq, g); // *tmp4 = tmp3
-		SAYF(G_("+%d,"), fcnt_blocks);
-
-		/* Set prev_loc to cur_loc >> 1 */
-
-		tree shifted_loc = build_int_cst(TREE_TYPE(prev_loc_g), rand_loc >> 1);
-		g = gimple_build_assign(prev_loc_g, MODIFY_EXPR, shifted_loc);
-		gimple_seq_add_stmt(&seq, g); // __afl_pred_loc = cur_loc >> 1
-
-		/* Done - grab the entry to the block and insert sequence */
-
-		bentry = gsi_start_bb(bb);
-		gsi_insert_seq_before(&bentry, seq, GSI_SAME_STMT);
-
-		inst_blocks++;
-		finst_blocks++;
-	}
-
-	/* Say something nice. */
-	if (!be_quiet) {
-		if (!finst_blocks)
-			WARNF(G_("No instrumentation targets found in " cBRI "%s" cRST ),
-					function_name(fun));
-		else if (finst_blocks < fcnt_blocks)
-			OKF(G_("Instrumented %2u /%2u locations in " cBRI "%s" cRST ),
-					finst_blocks, fcnt_blocks,
-					function_name(fun));
-		else
-			OKF(G_("Instrumented   %2u   locations in " cBRI "%s" cRST ),
-					finst_blocks,
-					function_name(fun));
-	}
-
-#endif
-	return 0;
-}
-
-/* -------------------------------------------------------------------------- */
-/* -- Boilerplate and initialization ---------------------------------------- */
-
-static const struct pass_data afl_pass_data = {
-
-                .type                   = GIMPLE_PASS,
-                .name                   = "afl-inst",
-                .optinfo_flags          = OPTGROUP_NONE,
-
-                .tv_id                  = TV_NONE,
-                .properties_required    = 0,
-                .properties_provided    = 0,
-                .properties_destroyed   = 0,
-                .todo_flags_start       = 0,
-                // NOTE(aseipp): it's very, very important to include
-                // at least 'TODO_update_ssa' here so that GCC will
-                // properly update the resulting SSA form, e.g., to
-                // include new PHI nodes for newly added symbols or
-                // names. Do not remove this. Do not taunt Happy Fun
-                // Ball.
-                .todo_flags_finish      = TODO_update_ssa | TODO_verify_il | TODO_cleanup_cfg,
-};
-
-namespace {
-
-class afl_pass : public gimple_opt_pass {
-private:
-	bool do_ext_call;
-
-public:
-	afl_pass(bool ext_call, gcc::context *g) : gimple_opt_pass(afl_pass_data, g), do_ext_call(ext_call) {}
-
-	virtual unsigned int execute(function *fun) {
-		// TODO: implement whitelist feature here :TODO
-		return do_ext_call ? ext_call_instrument(fun) : inline_instrument(fun);
-	}
-}; /* class afl_pass */
-
-}  /* anon namespace */
-
-static struct opt_pass *make_afl_pass(bool ext_call, gcc::context *ctxt) {
-	return new afl_pass(ext_call, ctxt);
-}
-
-/* -------------------------------------------------------------------------- */
-/* -- Initialization -------------------------------------------------------- */
-
-int plugin_is_GPL_compatible = 1;
-
-static struct plugin_info afl_plugin_info = {
-  .version = "20181200",
-  .help    = "AFL gcc plugin\n",
-};
-
-int plugin_init(struct plugin_name_args *plugin_info,
-                struct plugin_gcc_version *version) {
-
-	struct register_pass_info afl_pass_info;
-	struct timeval tv;
-	struct timezone tz;
-	u32 rand_seed;
-
-	/* Setup random() so we get Actually Random(TM) outputs from R() */
-	gettimeofday(&tv, &tz);
-	rand_seed = tv.tv_sec ^ tv.tv_usec ^ getpid();
-	srandom(rand_seed);
-
-	/* Pass information */
-	afl_pass_info.pass = make_afl_pass(inst_ext, g);
-	afl_pass_info.reference_pass_name = "ssa";
-	afl_pass_info.ref_pass_instance_number = 1;
-	afl_pass_info.pos_op = PASS_POS_INSERT_AFTER;
-
-	if (!plugin_default_version_check(version, &gcc_version)) {
-		FATAL(G_("Incompatible gcc/plugin versions!"));
-	}
-
-	/* Show a banner */
-	if (isatty(2) && !getenv("AFL_QUIET")) {
-		SAYF(G_(cCYA "afl-gcc-pass" cRST " initial version 1.94 by <aseipp@pobox.com>, updated to " cBRI VERSION cRST " by <thorsten.schulz@uni-rostock.de>\n"));
-	} else
-		be_quiet = 1;
-
-	/* Decide instrumentation ratio */
-	char* inst_ratio_str = getenv("AFL_INST_RATIO");
-
-	if (inst_ratio_str) {
-		if (sscanf(inst_ratio_str, "%u", &inst_ratio) != 1 || !inst_ratio || inst_ratio > 100)
-			FATAL(G_("Bad value of AFL_INST_RATIO (must be between 1 and 100)"));
-		else {
-			if (!be_quiet)
-				ACTF(G_("%s instrumentation at ratio of %u%% in %s mode."),
-					inst_ext ? G_("Call-based") : G_("Inline"),
-					inst_ratio,
-					getenv("AFL_HARDEN") ? G_("hardened") : G_("non-hardened"));
-		}
-	}
-
-	/* Go go gadget */
-	register_callback(plugin_info->base_name, PLUGIN_INFO, NULL, &afl_plugin_info);
-	register_callback(plugin_info->base_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &afl_pass_info);
-	return 0;
-}
diff --git a/gcc_plugin/afl-gcc-rt.o.c b/gcc_plugin/afl-gcc-rt.o.c
deleted file mode 100644
index 4e238fa8..00000000
--- a/gcc_plugin/afl-gcc-rt.o.c
+++ /dev/null
@@ -1,224 +0,0 @@
-/*
-   american fuzzy lop - GCC plugin instrumentation bootstrap
-   ---------------------------------------------------------
-
-   Written by Austin Seipp <aseipp@pobox.com> and
-              Laszlo Szekeres <lszekeres@google.com> and
-              Michal Zalewski <lcamtuf@google.com>
-
-   GCC integration design is based on the LLVM design, which comes
-   from Laszlo Szekeres.
-
-   Copyright 2015 Google Inc. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   This code is the rewrite of afl-as.h's main_payload.
-
-*/
-
-#include "../config.h"
-#include "../types.h"
-
-#include <stdlib.h>
-#include <signal.h>
-#include <unistd.h>
-#include <assert.h>
-
-#include <sys/mman.h>
-#include <sys/shm.h>
-#include <sys/wait.h>
-#include <sys/types.h>
-
-
-/* Globals needed by the injected instrumentation. The __afl_area_initial region
-   is used for instrumentation output before __afl_map_shm() has a chance to run.
-   It will end up as .comm, so it shouldn't be too wasteful. */
-
-u8  __afl_area_initial[MAP_SIZE];
-u8* __afl_area_ptr = __afl_area_initial;
-u16 __afl_prev_loc;
-
-
-/* Running in persistent mode? */
-
-static u8 is_persistent;
-
-/* Trace a basic block with some ID */
-void __afl_trace(u16 x) {
-  u16 l = __afl_prev_loc;
-  u16 n = l ^ x;
-  *(__afl_area_ptr+n) += 1;
-  __afl_prev_loc = (x >> 1);
-  return;
-}
-
-/* SHM setup. */
-
-static void __afl_map_shm(void) {
-
-  u8 *id_str = getenv(SHM_ENV_VAR);
-
-  /* If we're running under AFL, attach to the appropriate region, replacing the
-     early-stage __afl_area_initial region that is needed to allow some really
-     hacky .init code to work correctly in projects such as OpenSSL. */
-
-  if (id_str) {
-
-    u32 shm_id = atoi(id_str);
-
-    __afl_area_ptr = shmat(shm_id, NULL, 0);
-
-    /* Whooooops. */
-
-    if (__afl_area_ptr == (void *)-1) exit(1);
-
-    /* Write something into the bitmap so that even with low AFL_INST_RATIO,
-       our parent doesn't give up on us. */
-
-    __afl_area_ptr[0] = 1;
-
-  }
-
-}
-
-
-/* Fork server logic. */
-
-static void __afl_start_forkserver(void) {
-
-  static u8 tmp[4];
-  s32 child_pid;
-
-  u8  child_stopped = 0;
-
-  /* Phone home and tell the parent that we're OK. If parent isn't there,
-     assume we're not running in forkserver mode and just execute program. */
-
-  if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
-
-  while (1) {
-
-    u32 was_killed;
-    int status;
-
-    /* Wait for parent by reading from the pipe. Abort if read fails. */
-
-    if (read(FORKSRV_FD, &was_killed, 4) != 4) exit(1);
-
-    /* If we stopped the child in persistent mode, but there was a race
-       condition and afl-fuzz already issued SIGKILL, write off the old
-       process. */
-
-    if (child_stopped && was_killed) {
-      child_stopped = 0;
-      if (waitpid(child_pid, &status, 0) < 0) exit(1);
-    }
-
-    if (!child_stopped) {
-
-      /* Once woken up, create a clone of our process. */
-
-      child_pid = fork();
-      if (child_pid < 0) exit(1);
-
-      /* In child process: close fds, resume execution. */
-
-      if (!child_pid) {
-
-        close(FORKSRV_FD);
-        close(FORKSRV_FD + 1);
-        return;
-
-      }
-
-    } else {
-
-      /* Special handling for persistent mode: if the child is alive but
-         currently stopped, simply restart it with SIGCONT. */
-
-      kill(child_pid, SIGCONT);
-      child_stopped = 0;
-
-    }
-
-    /* In parent process: write PID to pipe, then wait for child. */
-
-    if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) exit(1);
-
-    if (waitpid(child_pid, &status, is_persistent ? WUNTRACED : 0) < 0)
-      exit(1);
-
-    /* In persistent mode, the child stops itself with SIGSTOP to indicate
-       a successful run. In this case, we want to wake it up without forking
-       again. */
-
-    if (WIFSTOPPED(status)) child_stopped = 1;
-
-    /* Relay wait status to pipe, then loop back. */
-
-    if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(1);
-
-  }
-
-}
-
-
-/* A simplified persistent mode handler, used as explained in README.llvm. */
-
-int __afl_persistent_loop(unsigned int max_cnt) {
-
-  static u8  first_pass = 1;
-  static u32 cycle_cnt;
-
-  if (first_pass) {
-
-    cycle_cnt  = max_cnt;
-    first_pass = 0;
-    return 1;
-
-  }
-
-  if (is_persistent && --cycle_cnt) {
-
-    raise(SIGSTOP);
-    return 1;
-
-  } else return 0;
-
-}
-
-
-/* This one can be called from user code when deferred forkserver mode
-    is enabled. */
-
-void __afl_manual_init(void) {
-
-  static u8 init_done;
-
-  if (!init_done) {
-
-    __afl_map_shm();
-    __afl_start_forkserver();
-    init_done = 1;
-
-  }
-
-}
-
-
-/* Proper initialization routine. */
-
-__attribute__((constructor(101))) void __afl_auto_init(void) {
-
-  is_persistent = !!getenv(PERSIST_ENV_VAR);
-
-  if (getenv(DEFER_ENV_VAR)) return;
-
-  __afl_manual_init();
-
-}