fuzzer wotking with rtn cmplog

3 files changed, 69 insertions, 43 deletions

diff --git a/llvm_mode/afl-llvm-cmplog-rt.o.c b/llvm_mode/afl-llvm-cmplog-rt.o.c
index 65d1d9d5..3d9cfca1 100644
--- a/llvm_mode/afl-llvm-cmplog-rt.o.c
+++ b/llvm_mode/afl-llvm-cmplog-rt.o.c
@@ -322,6 +322,8 @@ void __sanitizer_cov_trace_cmp2(uint16_t Arg1, uint16_t Arg2) {
   uintptr_t k = (uintptr_t)__builtin_return_address(0);
   k = (k >> 4) ^ (k << 8);
   k &= CMP_MAP_W - 1;
+  
+  __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
 
   u32 hits = __afl_cmp_map->headers[k].hits;
   __afl_cmp_map->headers[k].hits = hits + 1;
@@ -344,6 +346,8 @@ void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) {
   uintptr_t k = (uintptr_t)__builtin_return_address(0);
   k = (k >> 4) ^ (k << 8);
   k &= CMP_MAP_W - 1;
+  
+  __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
 
   u32 hits = __afl_cmp_map->headers[k].hits;
   __afl_cmp_map->headers[k].hits = hits + 1;
@@ -363,6 +367,8 @@ void __sanitizer_cov_trace_cmp8(uint64_t Arg1, uint64_t Arg2) {
   uintptr_t k = (uintptr_t)__builtin_return_address(0);
   k = (k >> 4) ^ (k << 8);
   k &= CMP_MAP_W - 1;
+  
+  __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
 
   u32 hits = __afl_cmp_map->headers[k].hits;
   __afl_cmp_map->headers[k].hits = hits + 1;
diff --git a/llvm_mode/cmplog-routines-pass.cc b/llvm_mode/cmplog-routines-pass.cc
index 7e3acae2..e7125f9f 100644
--- a/llvm_mode/cmplog-routines-pass.cc
+++ b/llvm_mode/cmplog-routines-pass.cc
@@ -1,18 +1,19 @@
 /*
- * Copyright 2016 laf-intel
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
+   american fuzzy lop++ - LLVM CmpLog instrumentation
+   --------------------------------------------------
+
+   Written by Andrea Fioraldi <andreafioraldi@gmail.com>
+
+   Copyright 2015, 2016 Google Inc. All rights reserved.
+   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+*/
 
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index f070c196..b09a977f 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -207,7 +207,7 @@ checksum_fail:
 
 ///// Input to State replacement
 
-u8 its_fuzz(u32 idx, u32 size, u8* buf, u32 len, u8* status) {
+u8 its_fuzz(u8* buf, u32 len, u8* status) {
 
   u64 orig_hit_cnt, new_hit_cnt;
 
@@ -217,18 +217,11 @@ u8 its_fuzz(u32 idx, u32 size, u8* buf, u32 len, u8* status) {
 
   new_hit_cnt = queued_paths + unique_crashes;
 
-  if (unlikely(new_hit_cnt != orig_hit_cnt)) {
-
+  if (unlikely(new_hit_cnt != orig_hit_cnt))
     *status = 1;
-
-  } else {
-
-    if (size >= MIN_AUTO_EXTRA && size <= MAX_AUTO_EXTRA)
-      maybe_add_auto(&buf[idx], size);
+  else
     *status = 2;
 
-  }
-
   return 0;
 
 }
@@ -254,7 +247,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
     if (its_len >= 8 && *buf_64 == pattern && *o_buf_64 == pattern) {
 
       *buf_64 = repl;
-      if (unlikely(its_fuzz(idx, 8, buf, len, status))) return 1;
+      if (unlikely(its_fuzz(buf, len, status))) return 1;
       *buf_64 = pattern;
 
     }
@@ -272,7 +265,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
     if (its_len >= 4 && *buf_32 == (u32)pattern && *o_buf_32 == (u32)pattern) {
 
       *buf_32 = (u32)repl;
-      if (unlikely(its_fuzz(idx, 4, buf, len, status))) return 1;
+      if (unlikely(its_fuzz(buf, len, status))) return 1;
       *buf_32 = pattern;
 
     }
@@ -290,7 +283,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
     if (its_len >= 2 && *buf_16 == (u16)pattern && *o_buf_16 == (u16)pattern) {
 
       *buf_16 = (u16)repl;
-      if (unlikely(its_fuzz(idx, 2, buf, len, status))) return 1;
+      if (unlikely(its_fuzz(buf, len, status))) return 1;
       *buf_16 = (u16)pattern;
 
     }
@@ -308,7 +301,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
     if (its_len >= 2 && *buf_8 == (u8)pattern && *o_buf_8 == (u8)pattern) {
 
       *buf_8 = (u8)repl;
-      if (unlikely(its_fuzz(idx, 1, buf, len, status)))
+      if (unlikely(its_fuzz(buf, len, status)))
         return 1;
       *buf_16 = (u16)pattern;
 
@@ -423,7 +416,26 @@ u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
 u8 rtn_extend_encoding(struct cmp_header* h, u8* pattern, u8* repl, u32 idx,
                        u8* orig_buf, u8* buf, u32 len, u8* status) {
 
-  *status = 2;
+  u32 i;
+  u32 its_len = MIN(32, len - idx);
+  
+  u8 save[32];
+  memcpy(save, &buf[idx], its_len);
+
+  *status = 0;
+
+  for (i = 0; i < its_len; ++i) {
+  
+    if (pattern[idx + i] != orig_buf[idx + i] || *status == 1)
+      break;
+    
+    buf[idx +i] = repl[idx + i];
+    if (unlikely(its_fuzz(buf, len, status))) return 1;
+  
+  }
+  
+  memcpy(&buf[idx], save, i);
+  return 0;
 
 }
 
@@ -444,9 +456,9 @@ u8 rtn_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
     struct cmpfn_operands* o = &((struct cmpfn_operands*)cmp_map->log[key])[i];
 
     // opt not in the paper
-    //for (j = 0; j < i; ++j)
-    //  if (cmp_map->log[key][j].v0 == o->v0 && cmp_map->log[key][i].v1 == o->v1)
-    //    goto cmp_fuzz_next_iter;
+    for (j = 0; j < i; ++j)
+      if (!memcmp(&((struct cmpfn_operands*)cmp_map->log[key])[j], o, sizeof(struct cmpfn_operands)))
+        goto rtn_fuzz_next_iter;
 
     for (idx = 0; idx < len && fails < 8; ++idx) {
 
@@ -476,7 +488,7 @@ u8 rtn_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
 
     }
 
-  cmp_fuzz_next_iter:
+  rtn_fuzz_next_iter:
     stage_cur++;
 
   }
@@ -491,6 +503,7 @@ u8 rtn_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
 u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len,
                         u32 exec_cksum) {
 
+  u8 r = 1;
   its_argv = argv;
 
   if (unlikely(colorization(buf, len, exec_cksum))) return 1;
@@ -513,31 +526,37 @@ u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len,
   for (k = 0; k < CMP_MAP_W; ++k) {
 
     if (!cmp_map->headers[k].hits) continue;
-    if (cmp_map->headers[k].hits > CMP_MAP_H)
-      stage_max += CMP_MAP_H;
+    if (cmp_map->headers[k].type == CMP_TYPE_INS)
+      stage_max += MIN(cmp_map->headers[k].hits, CMP_MAP_H);
     else
-      stage_max += cmp_map->headers[k].hits;
+      stage_max += MIN(cmp_map->headers[k].hits, CMP_MAP_RTN_H);
 
   }
-
+  
   for (k = 0; k < CMP_MAP_W; ++k) {
 
     if (!cmp_map->headers[k].hits) continue;
     
-    if (cmp_map->headers[k].type == CMP_TYPE_INS)
-      cmp_fuzz(k, orig_buf, buf, len);
-    else
-      rtn_fuzz(k, orig_buf, buf, len);
+    if (cmp_map->headers[k].type == CMP_TYPE_INS) {
+      if (unlikely(cmp_fuzz(k, orig_buf, buf, len)))
+        goto exit_its;
+    } else {
+      if (unlikely(rtn_fuzz(k, orig_buf, buf, len)))
+        goto exit_its;
+    }
 
   }
 
-  memcpy(orig_buf, buf, len);
+  r = 0;
 
+exit_its:
+  memcpy(orig_buf, buf, len);
+  
   new_hit_cnt = queued_paths + unique_crashes;
   stage_finds[STAGE_ITS] += new_hit_cnt - orig_hit_cnt;
   stage_cycles[STAGE_ITS] += total_execs - orig_execs;
 
-  return 0;
+  return r;
 
 }