aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorvanhauser-thc <vh@thc.org>2024-06-18 15:42:34 +0200
committervanhauser-thc <vh@thc.org>2024-06-18 15:42:34 +0200
commitb8568034f0c120ab8500c03ed4982d641eaa88fb (patch)
tree87340670ff6b3cf3c4f459b0c5b27360cd15070d
parent3ebf41ba34a6dc57f6a094987fc53b814fc25da5 (diff)
downloadafl++-b8568034f0c120ab8500c03ed4982d641eaa88fb.tar.gz
code format and changelog
-rw-r--r--docs/Changelog.md5
-rw-r--r--include/envs.h3
-rw-r--r--src/afl-fuzz-queue.c4
-rw-r--r--src/afl-fuzz.c90
4 files changed, 56 insertions, 46 deletions
diff --git a/docs/Changelog.md b/docs/Changelog.md
index 1590b2df..f146534f 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -4,6 +4,11 @@
release of the tool. See README.md for the general instruction manual.
### Version ++4.22a (dev)
+ - afl-fuzz:
+ - fastresume feature added. if you abort fuzzing and resume fuzzing
+ with `-i -` or `AFL_AUTORESUME=1` and the target binary has not changed
+ then a dump will be loaded and the calibration phase skipped.
+ to disable this feature set `AFL_NO_FASTRESUME=1`
- frida_mode:
- AFL_FRIDA_PERSISTENT_ADDR can now be be any reachable address not just
a function entry
diff --git a/include/envs.h b/include/envs.h
index 928f4185..ef522ab4 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -115,7 +115,8 @@ static char *afl_environment_variables[] = {
"AFL_TRACE_PC", "AFL_USE_ASAN", "AFL_USE_MSAN", "AFL_USE_TRACE_PC",
"AFL_USE_UBSAN", "AFL_USE_TSAN", "AFL_USE_CFISAN", "AFL_USE_LSAN",
"AFL_WINE_PATH", "AFL_NO_SNAPSHOT", "AFL_EXPAND_HAVOC_NOW", "AFL_USE_FASAN",
- "AFL_USE_QASAN", "AFL_PRINT_FILENAMES", "AFL_PIZZA_MODE", "AFL_NO_FASTRESUME", NULL
+ "AFL_USE_QASAN", "AFL_PRINT_FILENAMES", "AFL_PIZZA_MODE",
+ "AFL_NO_FASTRESUME", NULL
};
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index a28172f9..6069f5b9 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -401,7 +401,9 @@ void mark_as_redundant(afl_state_t *afl, struct queue_entry *q, u8 state) {
} else {
- if (unlink(fn)) { /*PFATAL("Unable to remove '%s'", fn);*/ }
+ if (unlink(fn)) { /*PFATAL("Unable to remove '%s'", fn);*/
+
+ }
}
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 2bfbee15..a09a53ec 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -3214,64 +3214,66 @@ stop_fuzzing:
#endif
if (!afl->afl_env.afl_no_fastresume) {
- /* create fastresume.bin */
- u8 fr[PATH_MAX];
- snprintf(fr, PATH_MAX, "%s/fastresume.bin", afl->out_dir);
- ACTF("Writing %s ...", fr);
- if ((fr_fd = open(fr, O_WRONLY | O_TRUNC | O_CREAT, DEFAULT_PERMISSION)) >=
- 0) {
-
- u8 ver_string[8];
- u32 w = 0;
- u64 *ver = (u64 *)ver_string;
- *ver = afl->shm.cmplog_mode + (sizeof(struct queue_entry) << 1);
-
- w += write(fr_fd, ver_string, sizeof(ver_string));
-
- w += write(fr_fd, afl->virgin_bits, afl->fsrv.map_size);
- w += write(fr_fd, afl->virgin_tmout, afl->fsrv.map_size);
- w += write(fr_fd, afl->virgin_crash, afl->fsrv.map_size);
- w += write(fr_fd, afl->var_bytes, afl->fsrv.map_size);
-
- u8 on[1] = {1}, off[1] = {0};
- u8 *o_start = (u8 *)&(afl->queue_buf[0]->colorized);
- u8 *o_end = (u8 *)&(afl->queue_buf[0]->mother);
- u32 q_len = o_end - o_start;
- u32 m_len = (afl->fsrv.map_size >> 3);
- struct queue_entry *q;
- afl->pending_not_fuzzed = afl->queued_items;
- afl->active_items = afl->queued_items;
+ /* create fastresume.bin */
+ u8 fr[PATH_MAX];
+ snprintf(fr, PATH_MAX, "%s/fastresume.bin", afl->out_dir);
+ ACTF("Writing %s ...", fr);
+ if ((fr_fd = open(fr, O_WRONLY | O_TRUNC | O_CREAT, DEFAULT_PERMISSION)) >=
+ 0) {
- for (u32 i = 0; i < afl->queued_items; i++) {
+ u8 ver_string[8];
+ u32 w = 0;
+ u64 *ver = (u64 *)ver_string;
+ *ver = afl->shm.cmplog_mode + (sizeof(struct queue_entry) << 1);
- q = afl->queue_buf[i];
- ck_write(fr_fd, (u8 *)&(q->colorized), q_len, "queue data");
- if (!q->trace_mini) {
+ w += write(fr_fd, ver_string, sizeof(ver_string));
- ck_write(fr_fd, off, 1, "no_mini");
- w += q_len + 1;
+ w += write(fr_fd, afl->virgin_bits, afl->fsrv.map_size);
+ w += write(fr_fd, afl->virgin_tmout, afl->fsrv.map_size);
+ w += write(fr_fd, afl->virgin_crash, afl->fsrv.map_size);
+ w += write(fr_fd, afl->var_bytes, afl->fsrv.map_size);
- } else {
+ u8 on[1] = {1}, off[1] = {0};
+ u8 *o_start = (u8 *)&(afl->queue_buf[0]->colorized);
+ u8 *o_end = (u8 *)&(afl->queue_buf[0]->mother);
+ u32 q_len = o_end - o_start;
+ u32 m_len = (afl->fsrv.map_size >> 3);
+ struct queue_entry *q;
+
+ afl->pending_not_fuzzed = afl->queued_items;
+ afl->active_items = afl->queued_items;
- ck_write(fr_fd, on, 1, "yes_mini");
- ck_write(fr_fd, q->trace_mini, m_len, "trace_mini");
- w += q_len + m_len + 1;
+ for (u32 i = 0; i < afl->queued_items; i++) {
+
+ q = afl->queue_buf[i];
+ ck_write(fr_fd, (u8 *)&(q->colorized), q_len, "queue data");
+ if (!q->trace_mini) {
+
+ ck_write(fr_fd, off, 1, "no_mini");
+ w += q_len + 1;
+
+ } else {
+
+ ck_write(fr_fd, on, 1, "yes_mini");
+ ck_write(fr_fd, q->trace_mini, m_len, "trace_mini");
+ w += q_len + m_len + 1;
+
+ }
}
- }
+ close(fr_fd);
+ afl->var_byte_count = count_bytes(afl, afl->var_bytes);
+ OKF("Written fastresume.bin with %u bytes!", w);
- close(fr_fd);
- afl->var_byte_count = count_bytes(afl, afl->var_bytes);
- OKF("Written fastresume.bin with %u bytes!", w);
+ } else {
- } else {
+ WARNF("Could not create fastresume.bin");
- WARNF("Could not create fastresume.bin");
+ }
}
- }
destroy_queue(afl);
destroy_extras(afl);