aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrea Fioraldi <andreafioraldi@gmail.com>2019-12-02 14:34:21 +0100
committerAndrea Fioraldi <andreafioraldi@gmail.com>2019-12-02 14:34:21 +0100
commit124ec8d297269b6b3066123782a7e92c802d2248 (patch)
treef18a4a42111ea2faa08ef2183d995aa254146e7b
parente9ed056913b4ce711ae47699c1937779036259e7 (diff)
downloadafl++-124ec8d297269b6b3066123782a7e92c802d2248.tar.gz
code format (contributors, do it!)
-rw-r--r--Makefile2
-rw-r--r--gcc_plugin/afl-gcc-pass.so.cc23
-rw-r--r--gcc_plugin/afl-gcc-rt.o.c12
-rw-r--r--include/afl-fuzz.h2
-rwxr-xr-xinclude/android-ashmem.h6
-rw-r--r--include/config.h6
-rw-r--r--libdislocator/libdislocator.so.c113
-rw-r--r--llvm_mode/LLVMInsTrim.so.cc21
-rw-r--r--llvm_mode/afl-clang-fast.c12
-rw-r--r--llvm_mode/afl-llvm-pass.so.cc12
-rw-r--r--llvm_mode/split-compares-pass.so.cc12
-rw-r--r--qemu_mode/libcompcov/libcompcov.so.c1
-rw-r--r--qemu_mode/patches/afl-qemu-cpu-inl.h6
-rw-r--r--qemu_mode/patches/afl-qemu-floats.h40
-rw-r--r--src/afl-analyze.c3
-rw-r--r--src/afl-as.c2
-rw-r--r--src/afl-fuzz-bitmap.c12
-rw-r--r--src/afl-fuzz-globals.c4
-rw-r--r--src/afl-fuzz-init.c18
-rw-r--r--src/afl-fuzz-one.c39
-rw-r--r--src/afl-fuzz-run.c2
-rw-r--r--src/afl-fuzz-stats.c29
-rw-r--r--src/afl-fuzz.c54
-rw-r--r--src/afl-gotcpu.c11
-rw-r--r--unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h2
25 files changed, 254 insertions, 190 deletions
diff --git a/Makefile b/Makefile
index b5ee6a71..58655cd8 100644
--- a/Makefile
+++ b/Makefile
@@ -236,7 +236,7 @@ code-format:
./.custom-format.py -i llvm_mode/*.h
./.custom-format.py -i llvm_mode/*.cc
./.custom-format.py -i gcc_plugin/*.c
- ./.custom-format.py -i gcc_plugin/*.h
+ #./.custom-format.py -i gcc_plugin/*.h
./.custom-format.py -i gcc_plugin/*.cc
./.custom-format.py -i qemu_mode/patches/*.h
./.custom-format.py -i qemu_mode/libcompcov/*.c
diff --git a/gcc_plugin/afl-gcc-pass.so.cc b/gcc_plugin/afl-gcc-pass.so.cc
index 19e4dfba..ab7daebb 100644
--- a/gcc_plugin/afl-gcc-pass.so.cc
+++ b/gcc_plugin/afl-gcc-pass.so.cc
@@ -166,7 +166,7 @@ static unsigned int ext_call_instrument(function *fun) {
fcall = gimple_build_call(
fndecl, 1,
cur_loc); /* generate the function _call_ to above built reference, with
- *1* parameter -> the random const for the location */
+ *1* parameter -> the random const for the location */
gimple_seq_add_stmt(&seq, fcall); /* and insert into a sequence */
/* Done - grab the entry to the block and insert sequence */
@@ -202,10 +202,9 @@ static unsigned int inline_instrument(function *fun) {
basic_block bb;
unsigned finst_blocks = 0;
unsigned fcnt_blocks = 0;
- tree one = build_int_cst(unsigned_char_type_node, 1);
+ tree one = build_int_cst(unsigned_char_type_node, 1);
// tree zero = build_int_cst(unsigned_char_type_node, 0);
-
/* Set up global type declarations */
tree map_type = build_pointer_type(unsigned_char_type_node);
tree map_ptr_g =
@@ -417,8 +416,8 @@ class afl_pass : public gimple_opt_pass {
if (!myWhitelist.empty()) {
- bool instrumentBlock = false;
- std::string instFilename;
+ bool instrumentBlock = false;
+ std::string instFilename;
unsigned int instLine = 0;
/* EXPR_FILENAME
@@ -467,13 +466,17 @@ class afl_pass : public gimple_opt_pass {
if (!instrumentBlock) {
if (!be_quiet) {
- if (!instFilename.empty())
- SAYF(cYEL "[!] " cBRI "Not in whitelist, skipping %s line %u...\n",
- instFilename.c_str(), instLine);
- else
- SAYF(cYEL "[!] " cBRI "No filename information found, skipping it");
+
+ if (!instFilename.empty())
+ SAYF(cYEL "[!] " cBRI "Not in whitelist, skipping %s line %u...\n",
+ instFilename.c_str(), instLine);
+ else
+ SAYF(cYEL "[!] " cBRI "No filename information found, skipping it");
+
}
+
return 0;
+
}
}
diff --git a/gcc_plugin/afl-gcc-rt.o.c b/gcc_plugin/afl-gcc-rt.o.c
index 1fb9e099..37cdbeb3 100644
--- a/gcc_plugin/afl-gcc-rt.o.c
+++ b/gcc_plugin/afl-gcc-rt.o.c
@@ -55,9 +55,9 @@ __thread u32 __afl_prev_loc;
/* Trace a basic block with some ID */
void __afl_trace(const u32 x) {
-#if 1 /* enable for neverZero feature. */
- __afl_area_ptr[__afl_prev_loc ^ x] += 1
- + ((u8)(1 + __afl_area_ptr[__afl_prev_loc ^ x]) == 0);
+#if 1 /* enable for neverZero feature. */
+ __afl_area_ptr[__afl_prev_loc ^ x] +=
+ 1 + ((u8)(1 + __afl_area_ptr[__afl_prev_loc ^ x]) == 0);
#else
++__afl_area_ptr[__afl_prev_loc ^ x];
#endif
@@ -84,9 +84,9 @@ static void __afl_map_shm(void) {
if (id_str) {
#ifdef USEMMAP
- const char* shm_file_path = id_str;
+ const char * shm_file_path = id_str;
int shm_fd = -1;
- unsigned char* shm_base = NULL;
+ unsigned char *shm_base = NULL;
/* create the shared memory segment as if it was a file */
shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
@@ -265,7 +265,7 @@ int __afl_persistent_loop(unsigned int max_cnt) {
}
- return 0;
+ return 0;
}
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 8717519b..c85883dd 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -409,7 +409,7 @@ extern u32 rand_cnt; /* Random number counter */
#endif
extern u32 rand_seed[2];
-extern s64 init_seed;
+extern s64 init_seed;
extern u64 total_cal_us, /* Total calibration time (us) */
total_cal_cycles; /* Total calibration cycles */
diff --git a/include/android-ashmem.h b/include/android-ashmem.h
index 2d515cc5..2b9c811c 100755
--- a/include/android-ashmem.h
+++ b/include/android-ashmem.h
@@ -63,7 +63,8 @@ static inline int shmctl(int __shmid, int __cmd, struct shmid_ds *__buf) {
}
static inline int shmget(key_t __key, size_t __size, int __shmflg) {
- (void) __shmflg;
+
+ (void)__shmflg;
int fd, ret;
char ourkey[11];
@@ -86,7 +87,8 @@ error:
}
static inline void *shmat(int __shmid, const void *__shmaddr, int __shmflg) {
- (void) __shmflg;
+
+ (void)__shmflg;
int size;
void *ptr;
diff --git a/include/config.h b/include/config.h
index 5934d733..29bdf048 100644
--- a/include/config.h
+++ b/include/config.h
@@ -41,7 +41,7 @@
/* Comment out to disable fancy ANSI boxes and use poor man's 7-bit UI: */
-#ifndef ANDROID_DISABLE_FANCY // Fancy boxes are ugly from adb
+#ifndef ANDROID_DISABLE_FANCY // Fancy boxes are ugly from adb
#define FANCY_BOXES
#endif
@@ -55,7 +55,7 @@
#define EXEC_TM_ROUND 20
/* 64bit arch MACRO */
-#if (defined (__x86_64__) || defined (__arm64__) || defined (__aarch64__))
+#if (defined(__x86_64__) || defined(__arm64__) || defined(__aarch64__))
#define WORD_SIZE_64 1
#endif
@@ -65,7 +65,7 @@
#define MEM_LIMIT 25
#else
#define MEM_LIMIT 50
-#endif /* ^!WORD_SIZE_64 */
+#endif /* ^!WORD_SIZE_64 */
/* Default memory limit when running in QEMU mode (MB): */
diff --git a/libdislocator/libdislocator.so.c b/libdislocator/libdislocator.so.c
index 31884545..72282834 100644
--- a/libdislocator/libdislocator.so.c
+++ b/libdislocator/libdislocator.so.c
@@ -34,10 +34,27 @@
#include <unistd.h>
#include <sys/syscall.h>
#ifdef __NR_getrandom
-#define arc4random_buf(p, l) do { ssize_t rd = syscall(__NR_getrandom, p, l, 0); if (rd != l) DEBUGF("getrandom failed"); } while(0)
+#define arc4random_buf(p, l) \
+ do { \
+ \
+ ssize_t rd = syscall(__NR_getrandom, p, l, 0); \
+ if (rd != l) DEBUGF("getrandom failed"); \
+ \
+ } while (0)
+
#else
#include <time.h>
-#define arc4random_buf(p, l) do { srand(time(NULL)); u32 i; u8 *ptr = (u8 *)p; for(i = 0; i < l; i++) ptr[i] = rand() % INT_MAX; } while(0)
+#define arc4random_buf(p, l) \
+ do { \
+ \
+ srand(time(NULL)); \
+ u32 i; \
+ u8* ptr = (u8*)p; \
+ for (i = 0; i < l; i++) \
+ ptr[i] = rand() % INT_MAX; \
+ \
+ } while (0)
+
#endif
#endif
@@ -52,7 +69,7 @@
#define MAP_ANONYMOUS MAP_ANON
#endif /* !MAP_ANONYMOUS */
-#define SUPER_PAGE_SIZE 1<<21
+#define SUPER_PAGE_SIZE 1 << 21
/* Error / message handling: */
@@ -106,7 +123,7 @@ static u8 alloc_verbose, /* Additional debug messages */
hard_fail, /* abort() when max_mem exceeded? */
no_calloc_over; /* abort() on calloc() overflows? */
-#if defined __OpenBSD__ || defined __APPLE__
+#if defined __OpenBSD__ || defined __APPLE__
#define __thread
#warning no thread support available
#endif
@@ -122,9 +139,9 @@ static __thread u32 alloc_canary;
static void* __dislocator_alloc(size_t len) {
- void* ret;
+ void* ret;
size_t tlen;
- int flags, fd, sp;
+ int flags, fd, sp;
if (total_mem + len > max_mem || total_mem + len < total_mem) {
@@ -156,21 +173,22 @@ static void* __dislocator_alloc(size_t len) {
/* We will also store buffer length and a canary below the actual buffer, so
let's add 8 bytes for that. */
- ret = mmap(NULL, tlen, PROT_READ | PROT_WRITE,
- flags, fd, 0);
+ ret = mmap(NULL, tlen, PROT_READ | PROT_WRITE, flags, fd, 0);
#if defined(USEHUGEPAGE)
/* We try one more time with regular call */
if (ret == MAP_FAILED) {
+
#if defined(__APPLE__)
- fd = -1;
+ fd = -1;
#elif defined(__linux__)
- flags &= -MAP_HUGETLB;
+ flags &= -MAP_HUGETLB;
#elif defined(__FreeBSD__)
- flags &= -MAP_ALIGNED_SUPER;
+ flags &= -MAP_ALIGNED_SUPER;
#endif
- ret = mmap(NULL, tlen, PROT_READ | PROT_WRITE,
- flags, fd, 0);
+ ret = mmap(NULL, tlen, PROT_READ | PROT_WRITE, flags, fd, 0);
+
}
+
#endif
if (ret == MAP_FAILED) {
@@ -321,64 +339,75 @@ void* realloc(void* ptr, size_t len) {
a normal request */
int posix_memalign(void** ptr, size_t align, size_t len) {
- if (*ptr == NULL)
- return EINVAL;
- if ((align % 2) || (align % sizeof(void *)))
- return EINVAL;
- if (len == 0) {
- *ptr = NULL;
- return 0;
- }
- if (align >= 4 * sizeof(size_t)) len += align -1;
- *ptr = malloc(len);
+ if (*ptr == NULL) return EINVAL;
+ if ((align % 2) || (align % sizeof(void*))) return EINVAL;
+ if (len == 0) {
+
+ *ptr = NULL;
+ return 0;
+
+ }
+
+ if (align >= 4 * sizeof(size_t)) len += align - 1;
+
+ *ptr = malloc(len);
- DEBUGF("posix_memalign(%p %zu, %zu)", ptr, align, len);
+ DEBUGF("posix_memalign(%p %zu, %zu)", ptr, align, len);
+
+ return 0;
- return 0;
}
/* just the non-posix fashion */
-void *memalign(size_t align, size_t len) {
- void* ret = NULL;
+void* memalign(size_t align, size_t len) {
+
+ void* ret = NULL;
+
+ if (posix_memalign(&ret, align, len)) {
+
+ DEBUGF("memalign(%zu, %zu) failed", align, len);
- if (posix_memalign(&ret, align, len)) {
- DEBUGF("memalign(%zu, %zu) failed", align, len);
- }
+ }
+
+ return ret;
- return ret;
}
/* sort of C11 alias of memalign only more severe, alignment-wise */
-void *aligned_alloc(size_t align, size_t len) {
- void *ret = NULL;
+void* aligned_alloc(size_t align, size_t len) {
- if ((len % align)) return NULL;
+ void* ret = NULL;
- if (posix_memalign(&ret, align, len)) {
- DEBUGF("aligned_alloc(%zu, %zu) failed", align, len);
- }
+ if ((len % align)) return NULL;
+
+ if (posix_memalign(&ret, align, len)) {
+
+ DEBUGF("aligned_alloc(%zu, %zu) failed", align, len);
+
+ }
+
+ return ret;
- return ret;
}
__attribute__((constructor)) void __dislocator_init(void) {
- u8* tmp = (u8 *)getenv("AFL_LD_LIMIT_MB");
+ u8* tmp = (u8*)getenv("AFL_LD_LIMIT_MB");
if (tmp) {
- u8 *tok;
- s32 mmem = (s32)strtol((char *)tmp, (char **)&tok, 10);
+ u8* tok;
+ s32 mmem = (s32)strtol((char*)tmp, (char**)&tok, 10);
if (*tok != '\0' || errno == ERANGE) FATAL("Bad value for AFL_LD_LIMIT_MB");
max_mem = mmem * 1024 * 1024;
}
alloc_canary = ALLOC_CANARY;
- tmp = (u8 *)getenv("AFL_RANDOM_ALLOC_CANARY");
+ tmp = (u8*)getenv("AFL_RANDOM_ALLOC_CANARY");
if (tmp) arc4random_buf(&alloc_canary, sizeof(alloc_canary));
diff --git a/llvm_mode/LLVMInsTrim.so.cc b/llvm_mode/LLVMInsTrim.so.cc
index f723a0fe..1fa361b5 100644
--- a/llvm_mode/LLVMInsTrim.so.cc
+++ b/llvm_mode/LLVMInsTrim.so.cc
@@ -158,9 +158,9 @@ struct InsTrim : public ModulePass {
if (!myWhitelist.empty()) {
- bool instrumentBlock = false;
- DebugLoc Loc;
- StringRef instFilename;
+ bool instrumentBlock = false;
+ DebugLoc Loc;
+ StringRef instFilename;
unsigned int instLine = 0;
for (auto &BB : F) {
@@ -222,12 +222,17 @@ struct InsTrim : public ModulePass {
if (!instrumentBlock) {
if (!be_quiet) {
- if (!instFilename.str().empty())
- SAYF(cYEL "[!] " cBRI "Not in whitelist, skipping %s line %u...\n",
- instFilename.str().c_str(), instLine);
- else
- SAYF(cYEL "[!] " cBRI "No filename information found, skipping it");
+
+ if (!instFilename.str().empty())
+ SAYF(cYEL "[!] " cBRI
+ "Not in whitelist, skipping %s line %u...\n",
+ instFilename.str().c_str(), instLine);
+ else
+ SAYF(cYEL "[!] " cBRI
+ "No filename information found, skipping it");
+
}
+
continue;
}
diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c
index b245cefa..e89b6183 100644
--- a/llvm_mode/afl-clang-fast.c
+++ b/llvm_mode/afl-clang-fast.c
@@ -122,15 +122,19 @@ static void edit_params(u32 argc, char** argv) {
if (!strcmp(name, "afl-clang-fast++")) {
u8* alt_cxx = getenv("AFL_CXX");
- if (has_llvm_config) snprintf(llvm_fullpath, sizeof(llvm_fullpath), "%s/clang++", LLVM_BINDIR);
- else sprintf(llvm_fullpath, "clang++");
+ if (has_llvm_config)
+ snprintf(llvm_fullpath, sizeof(llvm_fullpath), "%s/clang++", LLVM_BINDIR);
+ else
+ sprintf(llvm_fullpath, "clang++");
cc_params[0] = alt_cxx ? alt_cxx : (u8*)llvm_fullpath;
} else {
u8* alt_cc = getenv("AFL_CC");
- if (has_llvm_config) snprintf(llvm_fullpath, sizeof(llvm_fullpath), "%s/clang", LLVM_BINDIR);
- else sprintf(llvm_fullpath, "clang");
+ if (has_llvm_config)
+ snprintf(llvm_fullpath, sizeof(llvm_fullpath), "%s/clang", LLVM_BINDIR);
+ else
+ sprintf(llvm_fullpath, "clang");
cc_params[0] = alt_cc ? alt_cc : (u8*)llvm_fullpath;
}
diff --git a/llvm_mode/afl-llvm-pass.so.cc b/llvm_mode/afl-llvm-pass.so.cc
index 4ce073a5..1601a4f8 100644
--- a/llvm_mode/afl-llvm-pass.so.cc
+++ b/llvm_mode/afl-llvm-pass.so.cc
@@ -94,12 +94,12 @@ bool AFLCoverage::runOnModule(Module &M) {
LLVMContext &C = M.getContext();
- IntegerType *Int8Ty = IntegerType::getInt8Ty(C);
- IntegerType *Int32Ty = IntegerType::getInt32Ty(C);
- struct timeval tv;
- struct timezone tz;
- u32 rand_seed;
- unsigned int cur_loc = 0;
+ IntegerType * Int8Ty = IntegerType::getInt8Ty(C);
+ IntegerType * Int32Ty = IntegerType::getInt32Ty(C);
+ struct timeval tv;
+ struct timezone tz;
+ u32 rand_seed;
+ unsigned int cur_loc = 0;
/* Setup random() so we get Actually Random(TM) outputs from AFL_R() */
gettimeofday(&tv, &tz);
diff --git a/llvm_mode/split-compares-pass.so.cc b/llvm_mode/split-compares-pass.so.cc
index 60420f77..db884cde 100644
--- a/llvm_mode/split-compares-pass.so.cc
+++ b/llvm_mode/split-compares-pass.so.cc
@@ -103,11 +103,11 @@ bool SplitComparesTransform::simplifyCompares(Module &M) {
}
- if (enableFPSplit && (
- selectcmpInst->getPredicate() == CmpInst::FCMP_OGE ||
- selectcmpInst->getPredicate() == CmpInst::FCMP_UGE ||
- selectcmpInst->getPredicate() == CmpInst::FCMP_OLE ||
- selectcmpInst->getPredicate() == CmpInst::FCMP_ULE)) {
+ if (enableFPSplit &&
+ (selectcmpInst->getPredicate() == CmpInst::FCMP_OGE ||
+ selectcmpInst->getPredicate() == CmpInst::FCMP_UGE ||
+ selectcmpInst->getPredicate() == CmpInst::FCMP_OLE ||
+ selectcmpInst->getPredicate() == CmpInst::FCMP_ULE)) {
auto op0 = selectcmpInst->getOperand(0);
auto op1 = selectcmpInst->getOperand(1);
@@ -1046,7 +1046,7 @@ bool SplitComparesTransform::runOnModule(Module &M) {
char *bitw_env = getenv("LAF_SPLIT_COMPARES_BITW");
if (!bitw_env) bitw_env = getenv("AFL_LLVM_LAF_SPLIT_COMPARES_BITW");
if (bitw_env) { bitw = atoi(bitw_env); }
-
+
enableFPSplit = getenv("AFL_LLVM_LAF_SPLIT_FLOATS") != NULL;
simplifyCompares(M);
diff --git a/qemu_mode/libcompcov/libcompcov.so.c b/qemu_mode/libcompcov/libcompcov.so.c
index d58e45dd..dee8cfda 100644
--- a/qemu_mode/libcompcov/libcompcov.so.c
+++ b/qemu_mode/libcompcov/libcompcov.so.c
@@ -340,7 +340,6 @@ int memcmp(const void* mem1, const void* mem2, size_t len) {
// TODO bcmp
-
/* Common libraries wrappers (from honggfuzz) */
/*
diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h
index 7c6d3341..70f5ef9d 100644
--- a/qemu_mode/patches/afl-qemu-cpu-inl.h
+++ b/qemu_mode/patches/afl-qemu-cpu-inl.h
@@ -83,8 +83,8 @@ __thread abi_ulong afl_prev_loc;
/* Set in the child process in forkserver mode: */
-static int forkserver_installed = 0;
-static int disable_caching = 0;
+static int forkserver_installed = 0;
+static int disable_caching = 0;
unsigned char afl_fork_child;
unsigned int afl_forksrv_pid;
@@ -207,7 +207,7 @@ static void afl_setup(void) {
behaviour, and seems to work alright? */
rcu_disable_atfork();
-
+
disable_caching = getenv("AFL_QEMU_DISABLE_CACHE") != NULL;
is_persistent = getenv("AFL_QEMU_PERSISTENT_ADDR") != NULL;
diff --git a/qemu_mode/patches/afl-qemu-floats.h b/qemu_mode/patches/afl-qemu-floats.h
index 0b2ac2ae..7fea04e7 100644
--- a/qemu_mode/patches/afl-qemu-floats.h
+++ b/qemu_mode/patches/afl-qemu-floats.h
@@ -35,24 +35,30 @@
#include "afl-qemu-common.h"
union afl_float32 {
+
float32 f;
struct {
- u64 sign : 1;
- u64 exp : 7;
+
+ u64 sign : 1;
+ u64 exp : 7;
u64 frac : 24;
+
};
-};
+};
union afl_float64 {
+
float64 f;
struct {
- u64 sign : 1;
- u64 exp : 11;
+
+ u64 sign : 1;
+ u64 exp : 11;
u64 frac : 52;
+
};
-};
+};
// TODO 16 and 128 bits floats
// TODO figure out why float*_unpack_canonical does not work
@@ -65,11 +71,11 @@ void afl_float_compcov_log_32(target_ulong cur_loc, float32 arg1, float32 arg2,
if (cur_loc >= afl_inst_rms) return;
- //float_status* s = (float_status*)status;
- //FloatParts a = float32_unpack_canonical(arg1, s);
- //FloatParts b = float32_unpack_canonical(arg2, s);
- union afl_float32 a = { .f = arg1 };
- union afl_float32 b = { .f = arg2 };
+ // float_status* s = (float_status*)status;
+ // FloatParts a = float32_unpack_canonical(arg1, s);
+ // FloatParts b = float32_unpack_canonical(arg2, s);
+ union afl_float32 a = {.f = arg1};
+ union afl_float32 b = {.f = arg2};
// if (is_nan(a.cls) || is_nan(b.cls)) return;
@@ -97,11 +103,11 @@ void afl_float_compcov_log_64(target_ulong cur_loc, float64 arg1, float64 arg2,
if (cur_loc >= afl_inst_rms) return;
- //float_status* s = (float_status*)status;
- //FloatParts a = float64_unpack_canonical(arg1, s);
- //FloatParts b = float64_unpack_canonical(arg2, s);
- union afl_float64 a = { .f = arg1 };
- union afl_float64 b = { .f = arg2 };
+ // float_status* s = (float_status*)status;
+ // FloatParts a = float64_unpack_canonical(arg1, s);
+ // FloatParts b = float64_unpack_canonical(arg2, s);
+ union afl_float64 a = {.f = arg1};
+ union afl_float64 b = {.f = arg2};
// if (is_nan(a.cls) || is_nan(b.cls)) return;
@@ -196,7 +202,7 @@ void afl_float_compcov_log_80(target_ulong cur_loc, floatx80 arg1,
if ((arg1.low & 0xff00) == (arg2.low & 0xff00)) {
INC_AFL_AREA(idx + 9);
- //if ((arg1.low & 0xff) == (arg2.low & 0xff))
+ // if ((arg1.low & 0xff) == (arg2.low & 0xff))
// INC_AFL_AREA(idx + 10);
}
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index ee281af8..b82e124d 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -987,7 +987,8 @@ int main(int argc, char** argv) {
if (child_timed_out)
FATAL("Target binary times out (adjusting -t may help).");
- if (getenv("AFL_SKIP_BIN_CHECK") == NULL && !anything_set()) FATAL("No instrumentation detected.");
+ if (getenv("AFL_SKIP_BIN_CHECK") == NULL && !anything_set())
+ FATAL("No instrumentation detected.");
analyze(use_argv);
diff --git a/src/afl-as.c b/src/afl-as.c
index a0ebb2e0..9abe3fc2 100644
--- a/src/afl-as.c
+++ b/src/afl-as.c
@@ -83,7 +83,7 @@ static u8 use_64bit = 0;
#error "Sorry, 32-bit Apple platforms are not supported."
#endif /* __APPLE__ */
-#endif /* ^WORD_SIZE_64 */
+#endif /* ^WORD_SIZE_64 */
/* Examine and modify parameters to pass to 'as'. Note that the file name
is always the last parameter passed by GCC, so we exploit this property
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index 5d629cc0..0329421c 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -87,7 +87,7 @@ u8 has_new_bits(u8* virgin_map) {
u32 i = (MAP_SIZE >> 2);
-#endif /* ^WORD_SIZE_64 */
+#endif /* ^WORD_SIZE_64 */
u8 ret = 0;
@@ -125,7 +125,7 @@ u8 has_new_bits(u8* virgin_map) {
else
ret = 1;
-#endif /* ^WORD_SIZE_64 */
+#endif /* ^WORD_SIZE_64 */
}
@@ -306,7 +306,7 @@ void simplify_trace(u32* mem) {
}
-#endif /* ^WORD_SIZE_64 */
+#endif /* ^WORD_SIZE_64 */
/* Destructively classify execution counts in a trace. This is used as a
preprocessing step for any newly acquired traces. Called on every exec,
@@ -391,7 +391,7 @@ void classify_counts(u32* mem) {
}
-#endif /* ^WORD_SIZE_64 */
+#endif /* ^WORD_SIZE_64 */
/* Compact trace bytes into a smaller bitmap. We effectively just drop the
count information here. This is called only sporadically, for some
@@ -599,7 +599,7 @@ u8 save_if_interesting(char** argv, void* mem, u32 len, u8 fault) {
simplify_trace((u64*)trace_bits);
#else
simplify_trace((u32*)trace_bits);
-#endif /* ^WORD_SIZE_64 */
+#endif /* ^WORD_SIZE_64 */
if (!has_new_bits(virgin_tmout)) return keeping;
@@ -662,7 +662,7 @@ u8 save_if_interesting(char** argv, void* mem, u32 len, u8 fault) {
simplify_trace((u64*)trace_bits);
#else
simplify_trace((u32*)trace_bits);
-#endif /* ^WORD_SIZE_64 */
+#endif /* ^WORD_SIZE_64 */
if (!has_new_bits(virgin_crash)) return keeping;
diff --git a/src/afl-fuzz-globals.c b/src/afl-fuzz-globals.c
index 50b6b802..5c36eb0b 100644
--- a/src/afl-fuzz-globals.c
+++ b/src/afl-fuzz-globals.c
@@ -96,7 +96,7 @@ u8 schedule = EXPLORE; /* Power schedule (default: EXPLORE)*/
u8 havoc_max_mult = HAVOC_MAX_MULT;
u8 use_radamsa;
-size_t (*radamsa_mutate_ptr)(u8*, size_t, u8*, size_t, u32);
+size_t (*radamsa_mutate_ptr)(u8 *, size_t, u8 *, size_t, u32);
u8 skip_deterministic, /* Skip deterministic stages? */
force_deterministic, /* Force deterministic stages? */
@@ -215,7 +215,7 @@ u32 rand_cnt; /* Random number counter */
#endif
u32 rand_seed[2];
-s64 init_seed;
+s64 init_seed;
u64 total_cal_us, /* Total calibration time (us) */
total_cal_cycles; /* Total calibration cycles */
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index d99f9bec..bdab41e7 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -142,7 +142,8 @@ void bind_to_free_cpu(void) {
if (procs[i].ki_oncpu < sizeof(cpu_used) && procs[i].ki_pctcpu > 10)
cpu_used[procs[i].ki_oncpu] = 1;
#elif defined(__DragonFly__)
- if (procs[i].kp_lwp.kl_cpuid < sizeof(cpu_used) && procs[i].kp_lwp.kl_pctcpu > 10)
+ if (procs[i].kp_lwp.kl_cpuid < sizeof(cpu_used) &&
+ procs[i].kp_lwp.kl_pctcpu > 10)
cpu_used[procs[i].kp_lwp.kl_cpuid] = 1;
#endif
@@ -734,7 +735,8 @@ void pivot_inputs(void) {
use_name += 6;
else
use_name = rsl;
- nfn = alloc_printf("%s/queue/id:%06u,time:0,orig:%s", out_dir, id, use_name);
+ nfn = alloc_printf("%s/queue/id:%06u,time:0,orig:%s", out_dir, id,
+ use_name);
#else
@@ -1563,8 +1565,10 @@ void check_cpu_governor(void) {
" You can later go back to the original state by replacing "
"'performance'\n"
- " with 'ondemand' or 'powersave'. If you don't want to change the settings,\n"
- " set AFL_SKIP_CPUFREQ to make afl-fuzz skip this check - but expect some\n"
+ " with 'ondemand' or 'powersave'. If you don't want to change the "
+ "settings,\n"
+ " set AFL_SKIP_CPUFREQ to make afl-fuzz skip this check - but expect "
+ "some\n"
" performance drop.\n",
min / 1024, max / 1024);
FATAL("Suboptimal CPU scaling governor");
@@ -1609,7 +1613,8 @@ void check_cpu_governor(void) {
void get_core_count(void) {
-#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__DragonFly__)
+#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || \
+ defined(__DragonFly__)
size_t s = sizeof(cpu_core_count);
@@ -1655,7 +1660,8 @@ void get_core_count(void) {
cur_runnable = (u32)get_runnable_processes();
-#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__DragonFly__)
+#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || \
+ defined(__DragonFly__)
/* Add ourselves, since the 1-minute average doesn't include that yet. */
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 6ab0266d..f7cfbbe1 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -480,8 +480,7 @@ u8 fuzz_one_original(char** argv) {
if (perf_score == 0) goto abandon_entry;
- if (use_radamsa > 1)
- goto radamsa_stage;
+ if (use_radamsa > 1) goto radamsa_stage;
if (custom_mutator) {
@@ -541,6 +540,7 @@ u8 fuzz_one_original(char** argv) {
? queue_cur->depth * 30
: havoc_max_mult * 100)) ||
queue_cur->passed_det) {
+
if (use_radamsa > 1)
goto radamsa_stage;
else
@@ -549,12 +549,14 @@ u8 fuzz_one_original(char** argv) {
#else
goto havoc_stage;
#endif
+
}
/* Skip deterministic fuzzing if exec path checksum puts this out of scope
for this master instance. */
if (master_max && (queue_cur->exec_cksum % master_max) != master_id - 1) {
+
if (use_radamsa > 1)
goto radamsa_stage;
else
@@ -563,6 +565,7 @@ u8 fuzz_one_original(char** argv) {
#else
goto havoc_stage;
#endif
+
}
doing_det = 1;
@@ -2279,39 +2282,39 @@ retry_splicing:
ret_val = 0;
goto radamsa_stage;
-
radamsa_stage:
- if (!use_radamsa || !radamsa_mutate_ptr)
- goto abandon_entry;
-
+ if (!use_radamsa || !radamsa_mutate_ptr) goto abandon_entry;
+
stage_name = "radamsa";
stage_short = "radamsa";
stage_max = (HAVOC_CYCLES * perf_score / havoc_div / 100) << use_radamsa;
-
+
if (stage_max < HAVOC_MIN) stage_max = HAVOC_MIN;
-
+
orig_hit_cnt = queued_paths + unique_crashes;
-
+
/* Read the additional testcase into a new buffer. */
- u8 *save_buf = ck_alloc_nozero(len);
+ u8* save_buf = ck_alloc_nozero(len);
memcpy(save_buf, out_buf, len);
-
+
u32 max_len = len + choose_block_len(HAVOC_BLK_XL);
u8* new_buf = ck_alloc_nozero(max_len);
- u8 *tmp_buf;
+ u8* tmp_buf;
for (stage_cur = 0; stage_cur < stage_max; ++stage_cur) {
- u32 new_len = radamsa_mutate_ptr(save_buf, len, new_buf, max_len, get_rand_seed());
+
+ u32 new_len =
+ radamsa_mutate_ptr(save_buf, len, new_buf, max_len, get_rand_seed());
if (new_len) {
-
+
temp_len = new_len;
tmp_buf = new_buf;
} else {
- tmp_buf = save_buf; // nope but I dont care
+ tmp_buf = save_buf; // nope but I dont care
temp_len = len;
}
@@ -2323,14 +2326,14 @@ radamsa_stage:
goto abandon_entry;
}
-
+
}
ck_free(save_buf);
ck_free(new_buf);
-
+
new_hit_cnt = queued_paths + unique_crashes;
-
+
stage_finds[STAGE_RADAMSA] += new_hit_cnt - orig_hit_cnt;
stage_cycles[STAGE_RADAMSA] += stage_max;
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index c5035b63..8fa91afd 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -225,7 +225,7 @@ u8 run_target(char** argv, u32 timeout) {
classify_counts((u64*)trace_bits);
#else
classify_counts((u32*)trace_bits);
-#endif /* ^WORD_SIZE_64 */
+#endif /* ^WORD_SIZE_64 */
prev_timed_out = child_timed_out;
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index 851cfb1c..db2d7dc2 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -334,9 +334,9 @@ void show_stats(void) {
/* Lord, forgive me this. */
- SAYF(SET_G1 bSTG bLT bH bSTOP cCYA
+ SAYF(SET_G1 bSTG bLT bH bSTOP cCYA
" process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA
- " overall results " bSTG bH2 bH2 bRT "\n");
+ " overall results " bSTG bH2 bH2 bRT "\n");
if (dumb_mode) {
@@ -413,9 +413,9 @@ void show_stats(void) {
" uniq hangs : " cRST "%-6s" bSTG bV "\n",
DTD(cur_ms, last_hang_time), tmp);
- SAYF(bVR bH bSTOP cCYA
+ SAYF(bVR bH bSTOP cCYA
" cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA
- " map coverage " bSTG bH bHT bH20 bH2 bVL "\n");
+ " map coverage " bSTG bH bHT bH20 bH2 bVL "\n");
/* This gets funny because we want to print several variable-length variables
together, but then cram them into a fixed-width field - so we need to
@@ -443,9 +443,9 @@ void show_stats(void) {
SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp);
- SAYF(bVR bH bSTOP cCYA
+ SAYF(bVR bH bSTOP cCYA
" stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA
- " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
+ " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
sprintf(tmp, "%s (%0.02f%%)", DI(queued_favored),
((double)queued_favored) * 100 / queued_paths);
@@ -514,7 +514,7 @@ void show_stats(void) {
/* Aaaalmost there... hold on! */
- SAYF(bVR bH cCYA bSTOP
+ SAYF(bVR bH cCYA bSTOP
" fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA
" path geometry " bSTG bH5 bH2 bVL "\n");
@@ -576,11 +576,12 @@ void show_stats(void) {
" imported : " cRST "%-10s" bSTG bV "\n",
tmp, sync_id ? DI(queued_imported) : (u8*)"n/a");
- sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s, %s/%s", DI(stage_finds[STAGE_HAVOC]),
- DI(stage_cycles[STAGE_HAVOC]), DI(stage_finds[STAGE_SPLICE]),
- DI(stage_cycles[STAGE_SPLICE]), DI(stage_finds[STAGE_PYTHON]),
- DI(stage_cycles[STAGE_PYTHON]), DI(stage_finds[STAGE_RADAMSA]),
- DI(stage_cycles[STAGE_RADAMSA]), DI(stage_finds[STAGE_CUSTOM_MUTATOR]),
+ sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s, %s/%s",
+ DI(stage_finds[STAGE_HAVOC]), DI(stage_cycles[STAGE_HAVOC]),
+ DI(stage_finds[STAGE_SPLICE]), DI(stage_cycles[STAGE_SPLICE]),
+ DI(stage_finds[STAGE_PYTHON]), DI(stage_cycles[STAGE_PYTHON]),
+ DI(stage_finds[STAGE_RADAMSA]), DI(stage_cycles[STAGE_RADAMSA]),
+ DI(stage_finds[STAGE_CUSTOM_MUTATOR]),
DI(stage_cycles[STAGE_CUSTOM_MUTATOR]));
SAYF(bV bSTOP "havoc/custom : " cRST "%-36s " bSTG bV bSTOP, tmp);
@@ -634,13 +635,13 @@ void show_stats(void) {
sprintf(tmp, "%s/%s", DI(stage_finds[STAGE_CUSTOM_MUTATOR]),
DI(stage_cycles[STAGE_CUSTOM_MUTATOR]));
SAYF(bV bSTOP " custom mut. : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB
- "\n" bLB bH30 bH20 bH2 bH bRB bSTOP cRST RESET_G1,
+ "\n" bLB bH30 bH20 bH2 bH bRB bSTOP cRST RESET_G1,
tmp);
} else {
SAYF(bV bSTOP " trim : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB
- "\n" bLB bH30 bH20 bH2 bRB bSTOP cRST RESET_G1,
+ "\n" bLB bH30 bH20 bH2 bRB bSTOP cRST RESET_G1,
tmp);
}
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 42bdaebd..bdbc48e0 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -28,7 +28,7 @@
static u8* get_libradamsa_path(u8* own_loc) {
u8 *tmp, *cp, *rsl, *own_copy;
-
+
tmp = getenv("AFL_PATH");
if (tmp) {
@@ -51,8 +51,7 @@ static u8* get_libradamsa_path(u8* own_loc) {
cp = alloc_printf("%s/libradamsa.so", own_copy);
ck_free(own_copy);
- if (!access(cp, X_OK))
- return cp;
+ if (!access(cp, X_OK)) return cp;
} else
@@ -70,11 +69,12 @@ static u8* get_libradamsa_path(u8* own_loc) {
}
- SAYF("\n" cLRD "[-] " cRST
- "Oops, unable to find the 'libradamsa.so' binary. The binary must be "
- "built\n"
- " separately using 'make radamsa'. If you already have the binary "
- "installed,\n you may need to specify AFL_PATH in the environment.\n");
+ SAYF(
+ "\n" cLRD "[-] " cRST
+ "Oops, unable to find the 'libradamsa.so' binary. The binary must be "
+ "built\n"
+ " separately using 'make radamsa'. If you already have the binary "
+ "installed,\n you may need to specify AFL_PATH in the environment.\n");
FATAL("Failed to locate 'libradamsa.so'.");
@@ -109,10 +109,12 @@ static void usage(u8* argv0) {
" -m megs - memory limit for child process (%d MB)\n"
" -Q - use binary-only instrumentation (QEMU mode)\n"
" -U - use unicorn-based instrumentation (Unicorn mode)\n"
- " -W - use qemu-based instrumentation with Wine (Wine mode)\n\n"
+ " -W - use qemu-based instrumentation with Wine (Wine "
+ "mode)\n\n"
"Mutator settings:\n"
- " -R[R] - add Radamsa as mutator, add another -R to exclusivly run it\n"
+ " -R[R] - add Radamsa as mutator, add another -R to exclusivly "
+ "run it\n"
" -L minutes - use MOpt(imize) mode and set the limit time for "
"entering the\n"
" pacemaker mode (minutes of no new paths, 0 = "
@@ -184,9 +186,8 @@ int main(int argc, char** argv) {
struct timeval tv;
struct timezone tz;
- SAYF(cCYA
- "afl-fuzz" VERSION cRST
- " based on afl by Michal Zalewski and a big online community\n");
+ SAYF(cCYA "afl-fuzz" VERSION cRST
+ " based on afl by Michal Zalewski and a big online community\n");
doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH;
@@ -568,9 +569,9 @@ int main(int argc, char** argv) {
usage(argv[0]);
return -1;
break; // not needed
-
+
case 'R':
-
+
if (use_radamsa)
use_radamsa = 2;
else
@@ -595,28 +596,30 @@ int main(int argc, char** argv) {
if (fixed_seed) OKF("Running with fixed seed: %u", (u32)init_seed);
srandom((u32)init_seed);
-
+
if (use_radamsa) {
-
+
OKF("Using Radamsa add-on");
-
- u8* libradamsa_path = get_libradamsa_path(argv[0]);
+
+ u8* libradamsa_path = get_libradamsa_path(argv[0]);
void* handle = dlopen(libradamsa_path, RTLD_NOW);
ck_free(libradamsa_path);
-
+
if (!handle) FATAL("Failed to dlopen() libradamsa");
void (*radamsa_init_ptr)(void) = dlsym(handle, "radamsa_init");
radamsa_mutate_ptr = dlsym(handle, "radamsa");
- if (!radamsa_init_ptr || !radamsa_mutate_ptr) FATAL("Failed to dlsym() libradamsa");
+ if (!radamsa_init_ptr || !radamsa_mutate_ptr)
+ FATAL("Failed to dlsym() libradamsa");
- /* randamsa_init installs some signal hadlers, call it before setup_signal_handlers
- so that AFL++ can then replace those signal handlers */
+ /* randamsa_init installs some signal hadlers, call it before
+ setup_signal_handlers so that AFL++ can then replace those signal
+ handlers */
radamsa_init_ptr();
}
-
+
setup_signal_handlers();
check_asan_opts();
@@ -648,8 +651,7 @@ int main(int argc, char** argv) {
}
- if (getenv("AFL_DISABLE_TRIM"))
- disable_trim = 1;
+ if (getenv("AFL_DISABLE_TRIM")) disable_trim = 1;
if (getenv("AFL_NO_UI") && getenv("AFL_FORCE_UI"))
FATAL("AFL_NO_UI and AFL_FORCE_UI are mutually exclusive");
diff --git a/src/afl-gotcpu.c b/src/afl-gotcpu.c
index e09f0980..c6d71bb2 100644
--- a/src/afl-gotcpu.c
+++ b/src/afl-gotcpu.c
@@ -52,7 +52,8 @@
#include "types.h"
#include "debug.h"
-#if defined(__linux__) || defined(__FreeBSD__) || defined(__NetBSD__) || defined(__APPLE__) || defined(__DragonFly__)
+#if defined(__linux__) || defined(__FreeBSD__) || defined(__NetBSD__) || \
+ defined(__APPLE__) || defined(__DragonFly__)
#define HAVE_AFFINITY 1
#if defined(__FreeBSD__) || defined(__DragonFly__)
#include <pthread.h>
@@ -69,7 +70,7 @@
#include <mach/thread_act.h>
#include <mach/thread_policy.h>
#endif
-#endif /* __linux__ || __FreeBSD__ || __NetBSD__ || __APPLE__ */
+#endif /* __linux__ || __FreeBSD__ || __NetBSD__ || __APPLE__ */
/* Get unix time in microseconds. */
@@ -183,11 +184,11 @@ int main(int argc, char** argv) {
cpuset_set(i, c);
#elif defined(__APPLE__)
- thread_affinity_policy_data_t c = { i };
+ thread_affinity_policy_data_t c = {i};
thread_port_t native_thread = pthread_mach_thread_np(pthread_self());
if (thread_policy_set(native_thread, THREAD_AFFINITY_POLICY,
- (thread_policy_t)&c, 1) != KERN_SUCCESS)
- PFATAL("thread_policy_set failed");
+ (thread_policy_t)&c, 1) != KERN_SUCCESS)
+ PFATAL("thread_policy_set failed");
#endif
#if defined(__FreeBSD__) || defined(__DragonFly__)
diff --git a/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h b/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h
index 3603fae0..0b7954d0 100644
--- a/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h
+++ b/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h
@@ -171,4 +171,6 @@ void HELPER(afl_compcov_log_64)(void* uc_ptr, uint64_t cur_loc, uint64_t arg1,
}
}
+
*/
+