about summary refs log tree commit diff
diff options
context:
space:
mode:
authorvanhauser-thc <vh@thc.org>2024-06-18 15:42:34 +0200
committervanhauser-thc <vh@thc.org>2024-06-18 15:42:34 +0200
commitb8568034f0c120ab8500c03ed4982d641eaa88fb (patch)
tree87340670ff6b3cf3c4f459b0c5b27360cd15070d
parent3ebf41ba34a6dc57f6a094987fc53b814fc25da5 (diff)
downloadafl++-b8568034f0c120ab8500c03ed4982d641eaa88fb.tar.gz
code format and changelog
-rw-r--r--docs/Changelog.md5
-rw-r--r--include/envs.h3
-rw-r--r--src/afl-fuzz-queue.c4
-rw-r--r--src/afl-fuzz.c90
4 files changed, 56 insertions, 46 deletions
diff --git a/docs/Changelog.md b/docs/Changelog.md
index 1590b2df..f146534f 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -4,6 +4,11 @@
   release of the tool. See README.md for the general instruction manual.
 
 ### Version ++4.22a (dev)
+  - afl-fuzz:
+    - fastresume feature added. if you abort fuzzing and resume fuzzing
+      with `-i -` or `AFL_AUTORESUME=1` and the target binary has not changed
+      then a dump will be loaded and the calibration phase skipped.
+      to disable this feature set `AFL_NO_FASTRESUME=1`
   - frida_mode:
     - AFL_FRIDA_PERSISTENT_ADDR can now be be any reachable address not just
       a function entry
diff --git a/include/envs.h b/include/envs.h
index 928f4185..ef522ab4 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -115,7 +115,8 @@ static char *afl_environment_variables[] = {
     "AFL_TRACE_PC", "AFL_USE_ASAN", "AFL_USE_MSAN", "AFL_USE_TRACE_PC",
     "AFL_USE_UBSAN", "AFL_USE_TSAN", "AFL_USE_CFISAN", "AFL_USE_LSAN",
     "AFL_WINE_PATH", "AFL_NO_SNAPSHOT", "AFL_EXPAND_HAVOC_NOW", "AFL_USE_FASAN",
-    "AFL_USE_QASAN", "AFL_PRINT_FILENAMES", "AFL_PIZZA_MODE", "AFL_NO_FASTRESUME", NULL
+    "AFL_USE_QASAN", "AFL_PRINT_FILENAMES", "AFL_PIZZA_MODE",
+    "AFL_NO_FASTRESUME", NULL
 
 };
 
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index a28172f9..6069f5b9 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -401,7 +401,9 @@ void mark_as_redundant(afl_state_t *afl, struct queue_entry *q, u8 state) {
 
   } else {
 
-    if (unlink(fn)) { /*PFATAL("Unable to remove '%s'", fn);*/ }
+    if (unlink(fn)) {                 /*PFATAL("Unable to remove '%s'", fn);*/
+
+    }
 
   }
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 2bfbee15..a09a53ec 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -3214,64 +3214,66 @@ stop_fuzzing:
   #endif
 
   if (!afl->afl_env.afl_no_fastresume) {
-  /* create fastresume.bin */
-  u8 fr[PATH_MAX];
-  snprintf(fr, PATH_MAX, "%s/fastresume.bin", afl->out_dir);
-  ACTF("Writing %s ...", fr);
-  if ((fr_fd = open(fr, O_WRONLY | O_TRUNC | O_CREAT, DEFAULT_PERMISSION)) >=
-      0) {
-
-    u8   ver_string[8];
-    u32  w = 0;
-    u64 *ver = (u64 *)ver_string;
-    *ver = afl->shm.cmplog_mode + (sizeof(struct queue_entry) << 1);
-
-    w += write(fr_fd, ver_string, sizeof(ver_string));
-
-    w += write(fr_fd, afl->virgin_bits, afl->fsrv.map_size);
-    w += write(fr_fd, afl->virgin_tmout, afl->fsrv.map_size);
-    w += write(fr_fd, afl->virgin_crash, afl->fsrv.map_size);
-    w += write(fr_fd, afl->var_bytes, afl->fsrv.map_size);
-
-    u8                  on[1] = {1}, off[1] = {0};
-    u8                 *o_start = (u8 *)&(afl->queue_buf[0]->colorized);
-    u8                 *o_end = (u8 *)&(afl->queue_buf[0]->mother);
-    u32                 q_len = o_end - o_start;
-    u32                 m_len = (afl->fsrv.map_size >> 3);
-    struct queue_entry *q;
 
-    afl->pending_not_fuzzed = afl->queued_items;
-    afl->active_items = afl->queued_items;
+    /* create fastresume.bin */
+    u8 fr[PATH_MAX];
+    snprintf(fr, PATH_MAX, "%s/fastresume.bin", afl->out_dir);
+    ACTF("Writing %s ...", fr);
+    if ((fr_fd = open(fr, O_WRONLY | O_TRUNC | O_CREAT, DEFAULT_PERMISSION)) >=
+        0) {
 
-    for (u32 i = 0; i < afl->queued_items; i++) {
+      u8   ver_string[8];
+      u32  w = 0;
+      u64 *ver = (u64 *)ver_string;
+      *ver = afl->shm.cmplog_mode + (sizeof(struct queue_entry) << 1);
 
-      q = afl->queue_buf[i];
-      ck_write(fr_fd, (u8 *)&(q->colorized), q_len, "queue data");
-      if (!q->trace_mini) {
+      w += write(fr_fd, ver_string, sizeof(ver_string));
 
-        ck_write(fr_fd, off, 1, "no_mini");
-        w += q_len + 1;
+      w += write(fr_fd, afl->virgin_bits, afl->fsrv.map_size);
+      w += write(fr_fd, afl->virgin_tmout, afl->fsrv.map_size);
+      w += write(fr_fd, afl->virgin_crash, afl->fsrv.map_size);
+      w += write(fr_fd, afl->var_bytes, afl->fsrv.map_size);
 
-      } else {
+      u8                  on[1] = {1}, off[1] = {0};
+      u8                 *o_start = (u8 *)&(afl->queue_buf[0]->colorized);
+      u8                 *o_end = (u8 *)&(afl->queue_buf[0]->mother);
+      u32                 q_len = o_end - o_start;
+      u32                 m_len = (afl->fsrv.map_size >> 3);
+      struct queue_entry *q;
+
+      afl->pending_not_fuzzed = afl->queued_items;
+      afl->active_items = afl->queued_items;
 
-        ck_write(fr_fd, on, 1, "yes_mini");
-        ck_write(fr_fd, q->trace_mini, m_len, "trace_mini");
-        w += q_len + m_len + 1;
+      for (u32 i = 0; i < afl->queued_items; i++) {
+
+        q = afl->queue_buf[i];
+        ck_write(fr_fd, (u8 *)&(q->colorized), q_len, "queue data");
+        if (!q->trace_mini) {
+
+          ck_write(fr_fd, off, 1, "no_mini");
+          w += q_len + 1;
+
+        } else {
+
+          ck_write(fr_fd, on, 1, "yes_mini");
+          ck_write(fr_fd, q->trace_mini, m_len, "trace_mini");
+          w += q_len + m_len + 1;
+
+        }
 
       }
 
-    }
+      close(fr_fd);
+      afl->var_byte_count = count_bytes(afl, afl->var_bytes);
+      OKF("Written fastresume.bin with %u bytes!", w);
 
-    close(fr_fd);
-    afl->var_byte_count = count_bytes(afl, afl->var_bytes);
-    OKF("Written fastresume.bin with %u bytes!", w);
+    } else {
 
-  } else {
+      WARNF("Could not create fastresume.bin");
 
-    WARNF("Could not create fastresume.bin");
+    }
 
   }
-  }
 
   destroy_queue(afl);
   destroy_extras(afl);