Add AFL_NYX_LOG to redirect NYX hprintf messages to a file.

4 files changed, 22 insertions, 0 deletions

diff --git a/include/envs.h b/include/envs.h
index ff303387..963e1367 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -191,6 +191,7 @@ static char *afl_environment_variables[] = {
     "AFL_NOOPT",
     "AFL_NYX_AUX_SIZE",
     "AFL_NYX_DISABLE_SNAPSHOT_MODE",
+    "AFL_NYX_LOG",
     "AFL_NYX_REUSE_SNAPSHOT",
     "AFL_PASSTHROUGH",
     "AFL_PATH",
diff --git a/include/forkserver.h b/include/forkserver.h
index 1d41d83d..5e498c56 100644
--- a/include/forkserver.h
+++ b/include/forkserver.h
@@ -199,6 +199,7 @@ typedef struct afl_forkserver {
   char                 *nyx_aux_string;
   bool                  nyx_use_tmp_workdir;
   char                 *nyx_tmp_workdir_path;
+  s32                   nyx_log_fd;
 #endif
 
 } afl_forkserver_t;
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 717898d1..9da096f7 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -164,6 +164,8 @@ void afl_nyx_runner_kill(afl_forkserver_t *fsrv) {
 
     }
 
+    if (fsrv->nyx_log_fd >= 0) { close(fsrv->nyx_log_fd); }
+
   }
 
 }
@@ -218,6 +220,7 @@ void afl_fsrv_init(afl_forkserver_t *fsrv) {
   fsrv->nyx_bind_cpu_id = 0xFFFFFFFF;
   fsrv->nyx_use_tmp_workdir = false;
   fsrv->nyx_tmp_workdir_path = NULL;
+  fsrv->nyx_log_fd = -1;
 #endif
 
   // this structure needs default so we initialize it if this was not done
@@ -575,6 +578,22 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
     fsrv->nyx_handlers->nyx_config_set_input_buffer_write_protection(nyx_config,
                                                                      true);
 
+    char *nyx_log_path = getenv("AFL_NYX_LOG");
+    if (nyx_log_path) {
+
+      fsrv->nyx_log_fd =
+          open(nyx_log_path, O_CREAT | O_TRUNC | O_WRONLY, DEFAULT_PERMISSION);
+      if (fsrv->nyx_log_fd < 0) {
+
+        NYX_PRE_FATAL(fsrv, "AFL_NYX_LOG path could not be written");
+
+      }
+
+      fsrv->nyx_handlers->nyx_config_set_hprintf_fd(nyx_config,
+                                                    fsrv->nyx_log_fd);
+
+    }
+
     if (fsrv->nyx_standalone) {
 
       fsrv->nyx_handlers->nyx_config_set_process_role(nyx_config, StandAlone);
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 3d7adf41..e1f93f0d 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -303,6 +303,7 @@ static void usage(u8 *argv0, int more_help) {
       "                  Increase this value in case the crash reports are truncated.\n"
       "                  Default value is 4096.\n"
       "AFL_NYX_DISABLE_SNAPSHOT_MODE: disable snapshot mode (must be supported by the agent)\n"
+      "AFL_NYX_LOG: output NYX hprintf messages to another file\n"
       "AFL_NYX_REUSE_SNAPSHOT: reuse an existing Nyx root snapshot\n"
       DYN_COLOR