Merge pull request #50 from vanhauser-thc/uc_compcov

Unicorn CompareCoverage + Neverzero counters

18 files changed, 700 insertions, 53 deletions

diff --git a/.gitignore b/.gitignore
index bb3c82eb..2ee40f62 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,3 +21,4 @@ qemu_mode/qemu-3.1.0
 qemu_mode/qemu-3.1.0.tar.xz
 unicorn_mode/unicorn
 unicorn_mode/unicorn-*
+unicorn_mode/*.tar.gz
diff --git a/config.h b/config.h
index 37a2a794..29c33d46 100644
--- a/config.h
+++ b/config.h
@@ -339,6 +339,10 @@
 #define  CTEST_CORE_TRG_MS  1000
 #define  CTEST_BUSY_CYCLES  (10 * 1000 * 1000)
 
+/* Enable NeverZero counters in QEMU mode */
+
+#define AFL_QEMU_NOT_ZERO
+
 /* Uncomment this to use inferior block-coverage-based instrumentation. Note
    that you need to recompile the target binary for this to have any effect: */
 
diff --git a/qemu_mode/patches/afl-qemu-common.h b/qemu_mode/patches/afl-qemu-common.h
new file mode 100644
index 00000000..8013800d
--- /dev/null
+++ b/qemu_mode/patches/afl-qemu-common.h
@@ -0,0 +1,52 @@
+/*
+   american fuzzy lop - high-performance binary-only instrumentation
+   -----------------------------------------------------------------
+
+   Written by Andrew Griffiths <agriffiths@google.com> and
+              Michal Zalewski <lcamtuf@google.com>
+
+   Idea & design very much by Andrew Griffiths.
+
+   TCG instrumentation and block chaining support by Andrea Biondo
+                                      <andrea.biondo965@gmail.com>
+
+   QEMU 3.1.0 port, TCG thread-safety and CompareCoverage by Andrea Fioraldi
+                                      <andreafioraldi@gmail.com>
+
+   Copyright 2015, 2016, 2017 Google Inc. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+   This code is a shim patched into the separately-distributed source
+   code of QEMU 3.1.0. It leverages the built-in QEMU tracing functionality
+   to implement AFL-style instrumentation and to take care of the remaining
+   parts of the AFL fork server logic.
+
+   The resulting QEMU binary is essentially a standalone instrumentation
+   tool; for an example of how to leverage it for other purposes, you can
+   have a look at afl-showmap.c.
+
+ */
+
+#include "../../config.h"
+
+/* NeverZero */ 
+
+#if (defined(__x86_64__) || defined(__i386__)) && defined(AFL_QEMU_NOT_ZERO)
+#  define INC_AFL_AREA(loc) \
+    asm volatile ( \
+      "incb (%0, %1, 1)\n" \
+      "adcb $0, (%0, %1, 1)\n" \
+      : /* no out */ \
+      : "r" (afl_area_ptr), "r" (loc) \
+      : "memory", "eax" \
+    )
+#else
+#  define INC_AFL_AREA(loc) \
+  afl_area_ptr[loc]++
+#endif
+
diff --git a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h
index 4716c2ac..fc78e652 100644
--- a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h
+++ b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h
@@ -32,7 +32,7 @@
 
  */
 
-#include "../../config.h"
+#include "afl-qemu-common.h"
 #include "tcg.h"
 #include "tcg-op.h"
 
@@ -49,7 +49,7 @@ static void afl_compcov_log_16(target_ulong cur_loc, target_ulong arg1,
                                target_ulong arg2) {
 
   if ((arg1 & 0xff) == (arg2 & 0xff)) {
-    afl_area_ptr[cur_loc]++;
+    INC_AFL_AREA(cur_loc);
   }
 }
 
@@ -57,11 +57,11 @@ static void afl_compcov_log_32(target_ulong cur_loc, target_ulong arg1,
                                target_ulong arg2) {
 
   if ((arg1 & 0xff) == (arg2 & 0xff)) {
-    afl_area_ptr[cur_loc]++;
+    INC_AFL_AREA(cur_loc);
     if ((arg1 & 0xffff) == (arg2 & 0xffff)) {
-      afl_area_ptr[cur_loc +1]++;
+      INC_AFL_AREA(cur_loc +1);
       if ((arg1 & 0xffffff) == (arg2 & 0xffffff)) {
-        afl_area_ptr[cur_loc +2]++;
+        INC_AFL_AREA(cur_loc +2);
       }
     }
   }
@@ -71,19 +71,19 @@ static void afl_compcov_log_64(target_ulong cur_loc, target_ulong arg1,
                                target_ulong arg2) {
 
   if ((arg1 & 0xff) == (arg2 & 0xff)) {
-    afl_area_ptr[cur_loc]++;
+    INC_AFL_AREA(cur_loc);
     if ((arg1 & 0xffff) == (arg2 & 0xffff)) {
-      afl_area_ptr[cur_loc +1]++;
+      INC_AFL_AREA(cur_loc +1);
       if ((arg1 & 0xffffff) == (arg2 & 0xffffff)) {
-        afl_area_ptr[cur_loc +2]++;
+        INC_AFL_AREA(cur_loc +2);
         if ((arg1 & 0xffffffff) == (arg2 & 0xffffffff)) {
-          afl_area_ptr[cur_loc +3]++;
+          INC_AFL_AREA(cur_loc +3);
           if ((arg1 & 0xffffffffff) == (arg2 & 0xffffffffff)) {
-            afl_area_ptr[cur_loc +4]++;
+            INC_AFL_AREA(cur_loc +4);
             if ((arg1 & 0xffffffffffff) == (arg2 & 0xffffffffffff)) {
-              afl_area_ptr[cur_loc +5]++;
+              INC_AFL_AREA(cur_loc +5);
               if ((arg1 & 0xffffffffffffff) == (arg2 & 0xffffffffffffff)) {
-                afl_area_ptr[cur_loc +6]++;
+                INC_AFL_AREA(cur_loc +6);
               }
             }
           }
@@ -120,7 +120,7 @@ static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2,
   }
   
   cur_loc  = (cur_loc >> 4) ^ (cur_loc << 8);
-  cur_loc &= MAP_SIZE - 1;
+  cur_loc &= MAP_SIZE - 7;
   
   if (cur_loc >= afl_inst_rms) return;
   
diff --git a/qemu_mode/patches/afl-qemu-translate-inl.h b/qemu_mode/patches/afl-qemu-translate-inl.h
index bfb2897e..d63c5167 100644
--- a/qemu_mode/patches/afl-qemu-translate-inl.h
+++ b/qemu_mode/patches/afl-qemu-translate-inl.h
@@ -32,7 +32,7 @@
 
  */
 
-#include "../../config.h"
+#include "afl-qemu-common.h"
 #include "tcg-op.h"
 
 /* Declared in afl-qemu-cpu-inl.h */
@@ -42,11 +42,14 @@ extern abi_ulong afl_start_code, afl_end_code;
 
 void tcg_gen_afl_maybe_log_call(target_ulong cur_loc);
 
-void afl_maybe_log(target_ulong cur_loc) { 
+void afl_maybe_log(target_ulong cur_loc) {
 
   static __thread abi_ulong prev_loc;
 
-  afl_area_ptr[cur_loc ^ prev_loc]++;
+  register uintptr_t afl_idx = cur_loc ^ prev_loc;
+
+  INC_AFL_AREA(afl_idx);
+
   prev_loc = cur_loc >> 1;
 
 }
diff --git a/unicorn_mode/build_unicorn_support.sh b/unicorn_mode/build_unicorn_support.sh
index 9dcf6773..2c0fe4b1 100755
--- a/unicorn_mode/build_unicorn_support.sh
+++ b/unicorn_mode/build_unicorn_support.sh
@@ -127,12 +127,13 @@ tar xzf "$ARCHIVE" -C ./unicorn --strip-components=1 || exit 1
 
 echo "[+] Unpacking successful."
 
-rm -rf "$ARCHIVE" || exit 1
+#rm -rf "$ARCHIVE" || exit 1
 
 echo "[*] Applying patches..."
 
-cp patches/afl-unicorn-cpu-inl.h unicorn || exit 1
-patch -p1 --directory unicorn <patches/patches.diff || exit 1
+cp patches/*.h unicorn || exit 1
+patch -p1 --directory unicorn < patches/patches.diff || exit 1
+patch -p1 --directory unicorn < patches/compcov.diff || exit 1
 
 echo "[+] Patching done."
 
@@ -144,7 +145,7 @@ echo "[+] Configuration complete."
 
 echo "[*] Attempting to build Unicorn (fingers crossed!)..."
 
-UNICORN_QEMU_FLAGS='--python=python2' make || exit 1
+UNICORN_QEMU_FLAGS='--python=python2' make -j `nproc` || exit 1
 
 echo "[+] Build process successful!"
 
diff --git a/unicorn_mode/patches/afl-unicorn-common.h b/unicorn_mode/patches/afl-unicorn-common.h
new file mode 100644
index 00000000..9a1b2a6c
--- /dev/null
+++ b/unicorn_mode/patches/afl-unicorn-common.h
@@ -0,0 +1,50 @@
+/*
+   american fuzzy lop - high-performance binary-only instrumentation
+   -----------------------------------------------------------------
+
+   Written by Andrew Griffiths <agriffiths@google.com> and
+              Michal Zalewski <lcamtuf@google.com>
+
+   TCG instrumentation and block chaining support by Andrea Biondo
+                                      <andrea.biondo965@gmail.com>
+   Adapted for afl-unicorn by Dominik Maier <mail@dmnk.co>
+
+   Idea & design very much by Andrew Griffiths.
+
+   Copyright 2015, 2016 Google Inc. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+   This code is a shim patched into the separately-distributed source
+   code of Unicorn 1.0.1. It leverages the built-in QEMU tracing functionality
+   to implement AFL-style instrumentation and to take care of the remaining
+   parts of the AFL fork server logic.
+
+   The resulting QEMU binary is essentially a standalone instrumentation
+   tool; for an example of how to leverage it for other purposes, you can
+   have a look at afl-showmap.c.
+
+ */
+
+#include "../../config.h"
+
+/* NeverZero */ 
+
+#if (defined(__x86_64__) || defined(__i386__)) && defined(AFL_QEMU_NOT_ZERO)
+#  define INC_AFL_AREA(loc) \
+    asm volatile ( \
+      "incb (%0, %1, 1)\n" \
+      "adcb $0, (%0, %1, 1)\n" \
+      : /* no out */ \
+      : "r" (afl_area_ptr), "r" (loc) \
+      : "memory", "eax" \
+    )
+#else
+#  define INC_AFL_AREA(loc) \
+  afl_area_ptr[loc]++
+#endif
+
diff --git a/unicorn_mode/patches/afl-unicorn-cpu-inl.h b/unicorn_mode/patches/afl-unicorn-cpu-inl.h
index 892c3f72..90937a17 100644
--- a/unicorn_mode/patches/afl-unicorn-cpu-inl.h
+++ b/unicorn_mode/patches/afl-unicorn-cpu-inl.h
@@ -33,7 +33,7 @@
 #include <sys/shm.h>
 #include <sys/types.h>
 #include <sys/wait.h>
-#include "../../config.h"
+#include "afl-unicorn-common.h"
 
 /***************************
  * VARIOUS AUXILIARY STUFF *
@@ -54,11 +54,11 @@
 
 #define AFL_UNICORN_CPU_SNIPPET2 do { \
     if(unlikely(afl_first_instr == 0)) { \
-      afl_setup(); \
+      afl_setup(env->uc); \
       afl_forkserver(env); \
       afl_first_instr = 1; \
     } \
-    afl_maybe_log(tb->pc); \
+    afl_maybe_log(env->uc, tb->pc); \
   } while (0)
 
 /* We use one additional file descriptor to relay "needs translation"
@@ -66,24 +66,16 @@
 
 #define TSL_FD (FORKSRV_FD - 1)
 
-/* This is equivalent to afl-as.h: */
-
-static unsigned char *afl_area_ptr;
-
 /* Set in the child process in forkserver mode: */
 
 static unsigned char afl_fork_child;
 static unsigned int afl_forksrv_pid;
 
-/* Instrumentation ratio: */
-
-static unsigned int afl_inst_rms = MAP_SIZE;
-
 /* Function declarations. */
 
-static void afl_setup(void);
+static void afl_setup(struct uc_struct* uc);
 static void afl_forkserver(CPUArchState*);
-static inline void afl_maybe_log(unsigned long);
+static inline void afl_maybe_log(struct uc_struct* uc, unsigned long);
 
 static void afl_wait_tsl(CPUArchState*, int);
 static void afl_request_tsl(target_ulong, target_ulong, uint64_t);
@@ -105,7 +97,7 @@ struct afl_tsl {
 
 /* Set up SHM region and initialize other stuff. */
 
-static void afl_setup(void) {
+static void afl_setup(struct uc_struct* uc) {
 
   char *id_str = getenv(SHM_ENV_VAR),
        *inst_r = getenv("AFL_INST_RATIO");
@@ -121,21 +113,35 @@ static void afl_setup(void) {
     if (r > 100) r = 100;
     if (!r) r = 1;
 
-    afl_inst_rms = MAP_SIZE * r / 100;
+    uc->afl_inst_rms = MAP_SIZE * r / 100;
 
+  } else {
+  
+    uc->afl_inst_rms = MAP_SIZE;
+    
   }
 
   if (id_str) {
 
     shm_id = atoi(id_str);
-    afl_area_ptr = shmat(shm_id, NULL, 0);
+    uc->afl_area_ptr = shmat(shm_id, NULL, 0);
 
-    if (afl_area_ptr == (void*)-1) exit(1);
+    if (uc->afl_area_ptr == (void*)-1) exit(1);
 
     /* With AFL_INST_RATIO set to a low value, we want to touch the bitmap
        so that the parent doesn't give up on us. */
 
-    if (inst_r) afl_area_ptr[0] = 1;
+    if (inst_r) uc->afl_area_ptr[0] = 1;
+  }
+  
+  /* Maintain for compatibility */
+  if (getenv("AFL_QEMU_COMPCOV")) {
+
+    uc->afl_compcov_level = 1;
+  }
+  if (getenv("AFL_COMPCOV_LEVEL")) {
+
+    uc->afl_compcov_level = atoi(getenv("AFL_COMPCOV_LEVEL"));
   }
 }
 
@@ -145,7 +151,7 @@ static void afl_forkserver(CPUArchState *env) {
 
   static unsigned char tmp[4];
 
-  if (!afl_area_ptr) return;
+  if (!env->uc->afl_area_ptr) return;
 
   /* Tell the parent that we're alive. If the parent doesn't want
      to talk, assume that we're not running in forkserver mode. */
@@ -208,21 +214,15 @@ static void afl_forkserver(CPUArchState *env) {
 
 /* The equivalent of the tuple logging routine from afl-as.h. */
 
-static inline void afl_maybe_log(unsigned long cur_loc) {
+static inline void afl_maybe_log(struct uc_struct* uc, unsigned long cur_loc) {
 
   static __thread unsigned long prev_loc;
 
-  // DEBUG
-  //printf("IN AFL_MAYBE_LOG 0x%lx\n", cur_loc);
+  u8* afl_area_ptr = uc->afl_area_ptr;
 
-  // MODIFIED FOR UNICORN MODE -> We want to log all addresses,
-  // so the checks for 'start < addr < end' are removed
   if(!afl_area_ptr)
     return;
 
-  // DEBUG
-  //printf("afl_area_ptr = %p\n", afl_area_ptr);
-
   /* Looks like QEMU always maps to fixed locations, so ASAN is not a
      concern. Phew. But instruction addresses may be aligned. Let's mangle
      the value to get something quasi-uniform. */
@@ -233,15 +233,12 @@ static inline void afl_maybe_log(unsigned long cur_loc) {
   /* Implement probabilistic instrumentation by looking at scrambled block
      address. This keeps the instrumented locations stable across runs. */
 
-  // DEBUG
-  //printf("afl_inst_rms = 0x%lx\n", afl_inst_rms);
+  if (cur_loc >= uc->afl_inst_rms) return;
 
-  if (cur_loc >= afl_inst_rms) return;
+  register uintptr_t afl_idx = cur_loc ^ prev_loc;
 
-  // DEBUG
-  //printf("cur_loc = 0x%lx\n", cur_loc);  
+  INC_AFL_AREA(afl_idx);
 
-  afl_area_ptr[cur_loc ^ prev_loc]++;
   prev_loc = cur_loc >> 1;
 
 }
diff --git a/unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h b/unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h
new file mode 100644
index 00000000..7e8f47c9
--- /dev/null
+++ b/unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h
@@ -0,0 +1,62 @@
+/*
+   american fuzzy lop - high-performance binary-only instrumentation
+   -----------------------------------------------------------------
+
+   Written by Andrew Griffiths <agriffiths@google.com> and
+              Michal Zalewski <lcamtuf@google.com>
+
+   TCG instrumentation and block chaining support by Andrea Biondo
+                                      <andrea.biondo965@gmail.com>
+   Adapted for afl-unicorn by Dominik Maier <mail@dmnk.co>
+
+   Idea & design very much by Andrew Griffiths.
+
+   Copyright 2015, 2016 Google Inc. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+   This code is a shim patched into the separately-distributed source
+   code of Unicorn 1.0.1. It leverages the built-in QEMU tracing functionality
+   to implement AFL-style instrumentation and to take care of the remaining
+   parts of the AFL fork server logic.
+
+   The resulting QEMU binary is essentially a standalone instrumentation
+   tool; for an example of how to leverage it for other purposes, you can
+   have a look at afl-showmap.c.
+
+ */
+
+#include "../../config.h"
+
+static void afl_gen_compcov(TCGContext *s, uint64_t cur_loc, TCGv_i64 arg1,
+                            TCGv_i64 arg2, TCGMemOp ot, int is_imm) {
+
+  if (!s->uc->afl_compcov_level || !s->uc->afl_area_ptr)
+    return;
+  
+  if (!is_imm && s->uc->afl_compcov_level < 2)
+    return;
+
+  cur_loc  = (cur_loc >> 4) ^ (cur_loc << 8);
+  cur_loc &= MAP_SIZE - 7;
+  
+  if (cur_loc >= s->uc->afl_inst_rms) return;
+
+  switch (ot) {
+    case MO_64:
+      gen_afl_compcov_log_64(s, cur_loc, arg1, arg2);
+      break;
+    case MO_32: 
+      gen_afl_compcov_log_32(s, cur_loc, arg1, arg2);
+      break;
+    case MO_16:
+      gen_afl_compcov_log_16(s, cur_loc, arg1, arg2);
+      break;
+    default:
+      return;
+  }
+}
diff --git a/unicorn_mode/patches/afl-unicorn-tcg-op-inl.h b/unicorn_mode/patches/afl-unicorn-tcg-op-inl.h
new file mode 100644
index 00000000..d5a29cce
--- /dev/null
+++ b/unicorn_mode/patches/afl-unicorn-tcg-op-inl.h
@@ -0,0 +1,56 @@
+/*
+   american fuzzy lop - high-performance binary-only instrumentation
+   -----------------------------------------------------------------
+
+   Written by Andrew Griffiths <agriffiths@google.com> and
+              Michal Zalewski <lcamtuf@google.com>
+
+   TCG instrumentation and block chaining support by Andrea Biondo
+                                      <andrea.biondo965@gmail.com>
+   Adapted for afl-unicorn by Dominik Maier <mail@dmnk.co>
+
+   Idea & design very much by Andrew Griffiths.
+
+   Copyright 2015, 2016 Google Inc. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+   This code is a shim patched into the separately-distributed source
+   code of Unicorn 1.0.1. It leverages the built-in QEMU tracing functionality
+   to implement AFL-style instrumentation and to take care of the remaining
+   parts of the AFL fork server logic.
+
+   The resulting QEMU binary is essentially a standalone instrumentation
+   tool; for an example of how to leverage it for other purposes, you can
+   have a look at afl-showmap.c.
+
+ */
+
+static inline void gen_afl_compcov_log_16(TCGContext *tcg_ctx, uint64_t cur_loc,
+                                          TCGv_i64 arg1, TCGv_i64 arg2)
+{
+    TCGv_ptr tuc = tcg_const_ptr(tcg_ctx, tcg_ctx->uc);
+    TCGv_i64 tcur_loc = tcg_const_i64(tcg_ctx, cur_loc);
+    gen_helper_afl_compcov_log_16(tcg_ctx, tuc, tcur_loc, arg1, arg2);
+}
+
+static inline void gen_afl_compcov_log_32(TCGContext *tcg_ctx, uint64_t cur_loc,
+                                          TCGv_i64 arg1, TCGv_i64 arg2)
+{
+    TCGv_ptr tuc = tcg_const_ptr(tcg_ctx, tcg_ctx->uc);
+    TCGv_i64 tcur_loc = tcg_const_i64(tcg_ctx, cur_loc);
+    gen_helper_afl_compcov_log_32(tcg_ctx, tuc, tcur_loc, arg1, arg2);
+}
+
+static inline void gen_afl_compcov_log_64(TCGContext *tcg_ctx, uint64_t cur_loc,
+                                          TCGv_i64 arg1, TCGv_i64 arg2)
+{
+    TCGv_ptr tuc = tcg_const_ptr(tcg_ctx, tcg_ctx->uc);
+    TCGv_i64 tcur_loc = tcg_const_i64(tcg_ctx, cur_loc);
+    gen_helper_afl_compcov_log_64(tcg_ctx, tuc, tcur_loc, arg1, arg2);
+}
+
diff --git a/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h b/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h
new file mode 100644
index 00000000..0019bbfa
--- /dev/null
+++ b/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h
@@ -0,0 +1,89 @@
+/*
+   american fuzzy lop - high-performance binary-only instrumentation
+   -----------------------------------------------------------------
+
+   Written by Andrew Griffiths <agriffiths@google.com> and
+              Michal Zalewski <lcamtuf@google.com>
+
+   TCG instrumentation and block chaining support by Andrea Biondo
+                                      <andrea.biondo965@gmail.com>
+   Adapted for afl-unicorn by Dominik Maier <mail@dmnk.co>
+
+   Idea & design very much by Andrew Griffiths.
+
+   Copyright 2015, 2016 Google Inc. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+   This code is a shim patched into the separately-distributed source
+   code of Unicorn 1.0.1. It leverages the built-in QEMU tracing functionality
+   to implement AFL-style instrumentation and to take care of the remaining
+   parts of the AFL fork server logic.
+
+   The resulting QEMU binary is essentially a standalone instrumentation
+   tool; for an example of how to leverage it for other purposes, you can
+   have a look at afl-showmap.c.
+
+ */
+
+#include "uc_priv.h"
+#include "afl-unicorn-common.h"
+
+void HELPER(afl_compcov_log_16)(void* uc_ptr, uint64_t cur_loc, uint64_t arg1,
+                                uint64_t arg2) {
+
+  u8* afl_area_ptr = ((struct uc_struct*)uc_ptr)->afl_area_ptr;
+
+  if ((arg1 & 0xff) == (arg2 & 0xff)) {
+    INC_AFL_AREA(cur_loc);
+  }
+}
+
+void HELPER(afl_compcov_log_32)(void* uc_ptr, uint64_t cur_loc, uint64_t arg1,
+                                uint64_t arg2) {
+
+  u8* afl_area_ptr = ((struct uc_struct*)uc_ptr)->afl_area_ptr;
+
+  if ((arg1 & 0xff) == (arg2 & 0xff)) {
+    INC_AFL_AREA(cur_loc);
+    if ((arg1 & 0xffff) == (arg2 & 0xffff)) {
+      INC_AFL_AREA(cur_loc +1);
+      if ((arg1 & 0xffffff) == (arg2 & 0xffffff)) {
+        INC_AFL_AREA(cur_loc +2);
+      }
+    }
+  }
+}
+
+void HELPER(afl_compcov_log_64)(void* uc_ptr, uint64_t cur_loc, uint64_t arg1,
+                                uint64_t arg2) {
+
+  u8* afl_area_ptr = ((struct uc_struct*)uc_ptr)->afl_area_ptr;
+
+  if ((arg1 & 0xff) == (arg2 & 0xff)) {
+    INC_AFL_AREA(cur_loc);
+    if ((arg1 & 0xffff) == (arg2 & 0xffff)) {
+      INC_AFL_AREA(cur_loc +1);
+      if ((arg1 & 0xffffff) == (arg2 & 0xffffff)) {
+        INC_AFL_AREA(cur_loc +2);
+        if ((arg1 & 0xffffffff) == (arg2 & 0xffffffff)) {
+          INC_AFL_AREA(cur_loc +3);
+          if ((arg1 & 0xffffffffff) == (arg2 & 0xffffffffff)) {
+            INC_AFL_AREA(cur_loc +4);
+            if ((arg1 & 0xffffffffffff) == (arg2 & 0xffffffffffff)) {
+              INC_AFL_AREA(cur_loc +5);
+              if ((arg1 & 0xffffffffffffff) == (arg2 & 0xffffffffffffff)) {
+                INC_AFL_AREA(cur_loc +6);
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
diff --git a/unicorn_mode/patches/compcov.diff b/unicorn_mode/patches/compcov.diff
new file mode 100644
index 00000000..8ec867d1
--- /dev/null
+++ b/unicorn_mode/patches/compcov.diff
@@ -0,0 +1,113 @@
+diff --git a/include/uc_priv.h b/include/uc_priv.h
+index 22f494e..1aa7b3a 100644
+--- a/include/uc_priv.h
++++ b/include/uc_priv.h
+@@ -245,6 +245,12 @@ struct uc_struct {
+     uint32_t target_page_align;
+     uint64_t next_pc;   // save next PC for some special cases
+     bool hook_insert;	// insert new hook at begin of the hook list (append by default)
++    
++#ifdef UNICORN_AFL
++    unsigned char *afl_area_ptr;
++    int afl_compcov_level;
++    unsigned int afl_inst_rms;
++#endif
+ };
+ 
+ // Metadata stub for the variable-size cpu context used with uc_context_*()
+diff --git a/qemu/target-i386/translate.c b/qemu/target-i386/translate.c
+index 36fae09..196d346 100644
+--- a/qemu/target-i386/translate.c
++++ b/qemu/target-i386/translate.c
+@@ -33,6 +33,12 @@
+ 
+ #include "uc_priv.h"
+ 
++#if defined(UNICORN_AFL)
++#include "../../afl-unicorn-cpu-translate-inl.h"
++#else
++#define afl_gen_compcov(a,b,c,d,e,f) do {} while (0)
++#endif
++
+ #define PREFIX_REPZ   0x01
+ #define PREFIX_REPNZ  0x02
+ #define PREFIX_LOCK   0x04
+@@ -1555,6 +1561,7 @@ static void gen_op(DisasContext *s, int op, TCGMemOp ot, int d)
+     case OP_SUBL:
+         tcg_gen_mov_tl(tcg_ctx, cpu_cc_srcT, *cpu_T[0]);
+         tcg_gen_sub_tl(tcg_ctx, *cpu_T[0], *cpu_T[0], *cpu_T[1]);
++        afl_gen_compcov(tcg_ctx, s->pc, *cpu_T[0], *cpu_T[1], ot, d == OR_EAX);
+         gen_op_st_rm_T0_A0(s, ot, d);
+         gen_op_update2_cc(tcg_ctx);
+         set_cc_op(s, CC_OP_SUBB + ot);
+@@ -1582,6 +1589,7 @@ static void gen_op(DisasContext *s, int op, TCGMemOp ot, int d)
+         tcg_gen_mov_tl(tcg_ctx, cpu_cc_src, *cpu_T[1]);
+         tcg_gen_mov_tl(tcg_ctx, cpu_cc_srcT, *cpu_T[0]);
+         tcg_gen_sub_tl(tcg_ctx, cpu_cc_dst, *cpu_T[0], *cpu_T[1]);
++        afl_gen_compcov(tcg_ctx, s->pc, *cpu_T[0], *cpu_T[1], ot, d == OR_EAX);
+         set_cc_op(s, CC_OP_SUBB + ot);
+         break;
+     }
+diff --git a/qemu/tcg-runtime.c b/qemu/tcg-runtime.c
+index 21b022a..14d7891 100644
+--- a/qemu/tcg-runtime.c
++++ b/qemu/tcg-runtime.c
+@@ -31,9 +31,14 @@
+ 
+ #define DEF_HELPER_FLAGS_2(name, flags, ret, t1, t2) \
+   dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2));
++#define DEF_HELPER_FLAGS_4(name, flags, ret, t1, t2, t3, t4) \
++  dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), dh_ctype(t4));
+ 
+ #include "tcg-runtime.h"
+ 
++#ifdef UNICORN_AFL
++#include "../afl-unicorn-tcg-runtime-inl.h"
++#endif
+ 
+ /* 32-bit helpers */
+ 
+diff --git a/qemu/tcg/tcg-op.h b/qemu/tcg/tcg-op.h
+index 38b7dd9..c5a9af9 100644
+--- a/qemu/tcg/tcg-op.h
++++ b/qemu/tcg/tcg-op.h
+@@ -27,6 +27,10 @@
+ 
+ int gen_new_label(TCGContext *);
+ 
++#ifdef UNICORN_AFL
++#include "../../afl-unicorn-tcg-op-inl.h"
++#endif
++
+ static inline void gen_uc_tracecode(TCGContext *tcg_ctx, int32_t size, int32_t type, void *uc, uint64_t pc)
+ {
+     TCGv_i32 tsize = tcg_const_i32(tcg_ctx, size);
+diff --git a/qemu/tcg/tcg-runtime.h b/qemu/tcg/tcg-runtime.h
+index 23a0c37..90b993c 100644
+--- a/qemu/tcg/tcg-runtime.h
++++ b/qemu/tcg/tcg-runtime.h
+@@ -14,3 +14,9 @@ DEF_HELPER_FLAGS_2(sar_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
+ 
+ DEF_HELPER_FLAGS_2(mulsh_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
+ DEF_HELPER_FLAGS_2(muluh_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
++
++#ifdef UNICORN_AFL
++DEF_HELPER_FLAGS_4(afl_compcov_log_16, 0, void, ptr, i64, i64, i64)
++DEF_HELPER_FLAGS_4(afl_compcov_log_32, 0, void, ptr, i64, i64, i64)
++DEF_HELPER_FLAGS_4(afl_compcov_log_64, 0, void, ptr, i64, i64, i64)
++#endif
+diff --git a/qemu/unicorn_common.h b/qemu/unicorn_common.h
+index 8dcbb3e..11e18b4 100644
+--- a/qemu/unicorn_common.h
++++ b/qemu/unicorn_common.h
+@@ -84,6 +84,10 @@ static inline void uc_common_init(struct uc_struct* uc)
+ 
+     if (!uc->release)
+         uc->release = release_common;
++
++#ifdef UNICORN_AFL
++    uc->afl_area_ptr = 0;
++#endif
+ }
+ 
+ #endif
diff --git a/unicorn_mode/samples/compcov_x64/COMPILE.md b/unicorn_mode/samples/compcov_x64/COMPILE.md
new file mode 100644
index 00000000..db488d30
--- /dev/null
+++ b/unicorn_mode/samples/compcov_x64/COMPILE.md
@@ -0,0 +1,20 @@
+Compiling compcov_target.c
+==========================
+
+compcov_target.c was compiled without optimization, position-independent,
+and without standard libraries using the following command line:
+
+```
+gcc -o compcov_target.elf compcov_target.c -fPIC -O0 -nostdlib
+```
+
+The .text section from the resulting ELF binary was then extracted to create
+the raw binary blob that is loaded and emulated by compcov_test_harness.py:
+
+```
+objcopy -O binary --only-section=.text compcov_target.elf compcov_target.bin 
+```
+
+Note that the output of this is padded with nulls for 16-byte alignment. This is 
+important when emulating it, as NOPs will be added after the return of main()
+as necessary.
diff --git a/unicorn_mode/samples/compcov_x64/compcov_target.bin b/unicorn_mode/samples/compcov_x64/compcov_target.bin
new file mode 100644
index 00000000..091bf1db
--- /dev/null
+++ b/unicorn_mode/samples/compcov_x64/compcov_target.bin
Binary files differdiff --git a/unicorn_mode/samples/compcov_x64/compcov_target.c b/unicorn_mode/samples/compcov_x64/compcov_target.c
new file mode 100644
index 00000000..71b4cb0e
--- /dev/null
+++ b/unicorn_mode/samples/compcov_x64/compcov_target.c
@@ -0,0 +1,28 @@
+/*
+ * Sample target file to test afl-unicorn fuzzing capabilities.
+ * This is a very trivial example that will crash pretty easily
+ * in several different exciting ways. 
+ *
+ * Input is assumed to come from a buffer located at DATA_ADDRESS 
+ * (0x00300000), so make sure that your Unicorn emulation of this 
+ * puts user data there.
+ *
+ * Written by Nathan Voss <njvoss99@gmail.com>
+ */
+
+// Magic address where mutated data will be placed
+#define DATA_ADDRESS 	0x00300000
+
+int main(void) {
+  unsigned int *data_buf = (unsigned int *) DATA_ADDRESS;
+
+  if (data_buf[0] == 0xabadcafe) {
+    // Cause an 'invalid read' crash if data[0..3] == '\x01\x02\x03\x04'
+    unsigned char invalid_read = *(unsigned char *) 0x00000000;
+  } else if (data_buf[1] == data_buf[2] + 0x4141) {
+    // Cause an 'invalid read' crash if (0x10 < data[0] < 0x20) and data[1] > data[2]
+    unsigned char invalid_read = *(unsigned char *) 0x00000000;
+  }
+
+  return 0;
+}
diff --git a/unicorn_mode/samples/compcov_x64/compcov_target.elf b/unicorn_mode/samples/compcov_x64/compcov_target.elf
new file mode 100755
index 00000000..7015fb46
--- /dev/null
+++ b/unicorn_mode/samples/compcov_x64/compcov_target.elf
Binary files differdiff --git a/unicorn_mode/samples/compcov_x64/compcov_test_harness.py b/unicorn_mode/samples/compcov_x64/compcov_test_harness.py
new file mode 100644
index 00000000..5698cbc8
--- /dev/null
+++ b/unicorn_mode/samples/compcov_x64/compcov_test_harness.py
@@ -0,0 +1,170 @@
+""" 
+   Simple test harness for AFL's Unicorn Mode.
+
+   This loads the compcov_target.bin binary (precompiled as MIPS code) into
+   Unicorn's memory map for emulation, places the specified input into
+   compcov_target's buffer (hardcoded to be at 0x300000), and executes 'main()'.
+   If any crashes occur during emulation, this script throws a matching signal
+   to tell AFL that a crash occurred.
+
+   Run under AFL as follows:
+
+   $ cd <afl_path>/unicorn_mode/samples/simple/
+   $ ../../../afl-fuzz -U -m none -i ./sample_inputs -o ./output -- python compcov_test_harness.py @@ 
+"""
+
+import argparse
+import os
+import signal
+
+from unicorn import *
+from unicorn.x86_const import *
+
+# Path to the file containing the binary to emulate
+BINARY_FILE = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'compcov_target.bin')
+
+# Memory map for the code to be tested
+CODE_ADDRESS  = 0x00100000  # Arbitrary address where code to test will be loaded
+CODE_SIZE_MAX = 0x00010000  # Max size for the code (64kb)
+STACK_ADDRESS = 0x00200000  # Address of the stack (arbitrarily chosen)
+STACK_SIZE	  = 0x00010000  # Size of the stack (arbitrarily chosen)
+DATA_ADDRESS  = 0x00300000  # Address where mutated data will be placed
+DATA_SIZE_MAX = 0x00010000  # Maximum allowable size of mutated data
+
+try:
+    # If Capstone is installed then we'll dump disassembly, otherwise just dump the binary.
+    from capstone import *
+    cs = Cs(CS_ARCH_X86, CS_MODE_64)
+    def unicorn_debug_instruction(uc, address, size, user_data):
+        mem = uc.mem_read(address, size)
+        for (cs_address, cs_size, cs_mnemonic, cs_opstr) in cs.disasm_lite(bytes(mem), size):
+            print("    Instr: {:#016x}:\t{}\t{}".format(address, cs_mnemonic, cs_opstr))
+except ImportError:
+    def unicorn_debug_instruction(uc, address, size, user_data):
+        print("    Instr: addr=0x{0:016x}, size=0x{1:016x}".format(address, size))    
+
+def unicorn_debug_block(uc, address, size, user_data):
+    print("Basic Block: addr=0x{0:016x}, size=0x{1:016x}".format(address, size))
+    
+def unicorn_debug_mem_access(uc, access, address, size, value, user_data):
+    if access == UC_MEM_WRITE:
+        print("        >>> Write: addr=0x{0:016x} size={1} data=0x{2:016x}".format(address, size, value))
+    else:
+        print("        >>> Read: addr=0x{0:016x} size={1}".format(address, size))    
+
+def unicorn_debug_mem_invalid_access(uc, access, address, size, value, user_data):
+    if access == UC_MEM_WRITE_UNMAPPED:
+        print("        >>> INVALID Write: addr=0x{0:016x} size={1} data=0x{2:016x}".format(address, size, value))
+    else:
+        print("        >>> INVALID Read: addr=0x{0:016x} size={1}".format(address, size))   
+
+def force_crash(uc_error):
+    # This function should be called to indicate to AFL that a crash occurred during emulation.
+    # Pass in the exception received from Uc.emu_start()
+    mem_errors = [
+        UC_ERR_READ_UNMAPPED, UC_ERR_READ_PROT, UC_ERR_READ_UNALIGNED,
+        UC_ERR_WRITE_UNMAPPED, UC_ERR_WRITE_PROT, UC_ERR_WRITE_UNALIGNED,
+        UC_ERR_FETCH_UNMAPPED, UC_ERR_FETCH_PROT, UC_ERR_FETCH_UNALIGNED,
+    ]
+    if uc_error.errno in mem_errors:
+        # Memory error - throw SIGSEGV
+        os.kill(os.getpid(), signal.SIGSEGV)
+    elif uc_error.errno == UC_ERR_INSN_INVALID:
+        # Invalid instruction - throw SIGILL
+        os.kill(os.getpid(), signal.SIGILL)
+    else:
+        # Not sure what happened - throw SIGABRT
+        os.kill(os.getpid(), signal.SIGABRT)
+
+def main():
+
+    parser = argparse.ArgumentParser(description="Test harness for compcov_target.bin")
+    parser.add_argument('input_file', type=str, help="Path to the file containing the mutated input to load")
+    parser.add_argument('-d', '--debug', default=False, action="store_true", help="Enables debug tracing")
+    args = parser.parse_args()
+
+    # Instantiate a MIPS32 big endian Unicorn Engine instance
+    uc = Uc(UC_ARCH_X86, UC_MODE_64)
+
+    if args.debug:
+        uc.hook_add(UC_HOOK_BLOCK, unicorn_debug_block)
+        uc.hook_add(UC_HOOK_CODE, unicorn_debug_instruction)
+        uc.hook_add(UC_HOOK_MEM_WRITE | UC_HOOK_MEM_READ, unicorn_debug_mem_access)
+        uc.hook_add(UC_HOOK_MEM_WRITE_UNMAPPED | UC_HOOK_MEM_READ_INVALID, unicorn_debug_mem_invalid_access)
+
+    #---------------------------------------------------
+    # Load the binary to emulate and map it into memory
+
+    print("Loading data input from {}".format(args.input_file))
+    binary_file = open(BINARY_FILE, 'rb')
+    binary_code = binary_file.read()
+    binary_file.close()
+
+    # Apply constraints to the mutated input
+    if len(binary_code) > CODE_SIZE_MAX:
+        print("Binary code is too large (> {} bytes)".format(CODE_SIZE_MAX))
+        return
+
+    # Write the mutated command into the data buffer
+    uc.mem_map(CODE_ADDRESS, CODE_SIZE_MAX)
+    uc.mem_write(CODE_ADDRESS, binary_code)
+
+    # Set the program counter to the start of the code
+    start_address = CODE_ADDRESS          # Address of entry point of main()
+    end_address   = CODE_ADDRESS + 0x55   # Address of last instruction in main()
+    uc.reg_write(UC_X86_REG_RIP, start_address)
+
+    #-----------------
+    # Setup the stack
+
+    uc.mem_map(STACK_ADDRESS, STACK_SIZE)
+    uc.reg_write(UC_X86_REG_RSP, STACK_ADDRESS + STACK_SIZE)
+
+    #-----------------------------------------------------
+    # Emulate 1 instruction to kick off AFL's fork server
+    #   THIS MUST BE DONE BEFORE LOADING USER DATA! 
+    #   If this isn't done every single run, the AFL fork server 
+    #   will not be started appropriately and you'll get erratic results!
+    #   It doesn't matter what this returns with, it just has to execute at
+    #   least one instruction in order to get the fork server started.
+
+    # Execute 1 instruction just to startup the forkserver
+    print("Starting the AFL forkserver by executing 1 instruction")
+    try:
+        uc.emu_start(uc.reg_read(UC_X86_REG_RIP), 0, 0, count=1)
+    except UcError as e:
+        print("ERROR: Failed to execute a single instruction (error: {})!".format(e))
+        return
+
+    #-----------------------------------------------
+    # Load the mutated input and map it into memory
+
+    # Load the mutated input from disk
+    print("Loading data input from {}".format(args.input_file))
+    input_file = open(args.input_file, 'rb')
+    input = input_file.read()
+    input_file.close()
+
+    # Apply constraints to the mutated input
+    if len(input) > DATA_SIZE_MAX:
+        print("Test input is too long (> {} bytes)".format(DATA_SIZE_MAX))
+        return
+
+    # Write the mutated command into the data buffer
+    uc.mem_map(DATA_ADDRESS, DATA_SIZE_MAX)
+    uc.mem_write(DATA_ADDRESS, input)
+
+    #------------------------------------------------------------
+    # Emulate the code, allowing it to process the mutated input
+
+    print("Executing until a crash or execution reaches 0x{0:016x}".format(end_address))
+    try:
+        result = uc.emu_start(uc.reg_read(UC_X86_REG_RIP), end_address, timeout=0, count=0)
+    except UcError as e:
+        print("Execution failed with error: {}".format(e))
+        force_crash(e)
+
+    print("Done.")
+
+if __name__ == "__main__":
+    main()
diff --git a/unicorn_mode/samples/compcov_x64/sample_inputs/sample1.bin b/unicorn_mode/samples/compcov_x64/sample_inputs/sample1.bin
new file mode 100644
index 00000000..445c7245
--- /dev/null
+++ b/unicorn_mode/samples/compcov_x64/sample_inputs/sample1.bin
@@ -0,0 +1 @@
+00000000000000000000000000000000
\ No newline at end of file