aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorhexcoder- <heiko@hexco.de>2020-04-15 22:27:32 +0200
committerhexcoder- <heiko@hexco.de>2020-04-15 22:27:32 +0200
commit7e2c52f2b90c544981341248a13b64174b889b7a (patch)
treecd5f631c8a243e88837afba14b094e1077b394d8
parent21f696f02e2e17e66e8f275b2de333a4871e1863 (diff)
downloadafl++-7e2c52f2b90c544981341248a13b64174b889b7a.tar.gz
disable compare-transform-pass when lto_mode and autodictionary is used.
-rw-r--r--llvm_mode/README.lto.md16
-rw-r--r--llvm_mode/afl-clang-fast.c6
2 files changed, 12 insertions, 10 deletions
diff --git a/llvm_mode/README.lto.md b/llvm_mode/README.lto.md
index 51b50544..9af9ffff 100644
--- a/llvm_mode/README.lto.md
+++ b/llvm_mode/README.lto.md
@@ -17,17 +17,17 @@ This version requires a current llvm 11 compiled from the github master.
## Introduction and problem description
A big issue with how afl/afl++ works is that the basic block IDs that are
-set during compilation are random - and hence natually the larger the number
-of instrumented locations, the higher the number of edge collisions in the
+set during compilation are random - and hence naturally the larger the number
+of instrumented locations, the higher the number of edge collisions are in the
map. This can result in not discovering new paths and therefore degrade the
-efficiency of the fuzzing.
+efficiency of the fuzzing process.
-*This issue is understimated in the fuzzing community!*
+*This issue is underestimated in the fuzzing community!*
With a 2^16 = 64kb standard map at already 256 instrumented blocks there is
on average one collision. On average a target has 10.000 to 50.000
instrumented blocks hence the real collisions are between 750-18.000!
-To get to a solution that prevents any collision took several approaches
+To reach a solution that prevents any collisions took several approaches
and many dead ends until we got to this:
* We instrument at link time when we have all files pre-compiled
@@ -76,7 +76,7 @@ $ make install
## How to use afl-clang-lto
-Just use afl-clang-lto like you did afl-clang-fast or afl-gcc.
+Just use afl-clang-lto like you did with afl-clang-fast or afl-gcc.
Also whitelisting (AFL_LLVM_WHITELIST -> [README.whitelist.md](README.whitelist.md)) and
laf-intel/compcov (AFL_LLVM_LAF_* -> [README.laf-intel.md](README.laf-intel.md)) work.
@@ -120,7 +120,7 @@ Please report issues at:
## Upcoming Work
-1. Currently the LTO whitelist feature does not allow to not instrument main,
+1. Currently the LTO whitelist feature does not allow to instrument main,
start and init functions
## History
@@ -138,7 +138,7 @@ This was first implemented in January and work ... kinda.
The LTO time instrumentation worked, however the "how" the basic blocks were
instrumented was a problem, as reducing duplicates turned out to be very,
very difficult with a program that has so many paths and therefore so many
-dependencies. At lot of stratgies were implemented - and failed.
+dependencies. At lot of strategies were implemented - and failed.
And then sat solvers were tried, but with over 10.000 variables that turned
out to be a dead-end too.
diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c
index 57d7b89a..082e307a 100644
--- a/llvm_mode/afl-clang-fast.c
+++ b/llvm_mode/afl-clang-fast.c
@@ -223,8 +223,10 @@ static void edit_params(u32 argc, char **argv, char **envp) {
}
- if (getenv("LAF_TRANSFORM_COMPARES") ||
- getenv("AFL_LLVM_LAF_TRANSFORM_COMPARES")) {
+ if (!getenv("AFL_LLVM_LTO_AUTODICTIONARY") // disabled when autodictionary
+ && instrument_mode != INSTRUMENT_LTO // and lto_mode is used
+ && (getenv("LAF_TRANSFORM_COMPARES") ||
+ getenv("AFL_LLVM_LAF_TRANSFORM_COMPARES"))) {
cc_params[cc_par_cnt++] = "-Xclang";
cc_params[cc_par_cnt++] = "-load";