Merge pull request #499 from AFLplusplus/dev

important push to stable

3 files changed, 13 insertions, 31 deletions

diff --git a/examples/aflpp_driver/GNUmakefile b/examples/aflpp_driver/GNUmakefile
index b118a8b5..57e74be7 100644
--- a/examples/aflpp_driver/GNUmakefile
+++ b/examples/aflpp_driver/GNUmakefile
@@ -16,6 +16,7 @@ aflpp_driver.o:	aflpp_driver.c
 
 libAFLDriver.a:	aflpp_driver.o
 	ar ru libAFLDriver.a aflpp_driver.o
+	cp -vf libAFLDriver.a ../../
 
 debug:
 	$(LLVM_BINDIR)clang -Wno-deprecated -I../../include $(CFLAGS) -D_DEBUG=\"1\" -c -o afl-performance.o ../../src/afl-performance.c
@@ -29,6 +30,7 @@ aflpp_qemu_driver.o:	aflpp_qemu_driver.c
 
 libAFLQemuDriver.a:	aflpp_qemu_driver.o
 	ar ru libAFLQemuDriver.a aflpp_qemu_driver.o
+	cp -vf libAFLQemuDriver.a ../../
 
 aflpp_qemu_driver_hook.so:	aflpp_qemu_driver_hook.o
 	$(LLVM_BINDIR)clang -shared aflpp_qemu_driver_hook.o -o aflpp_qemu_driver_hook.so
diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 7d388799..ff5446e9 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -109,8 +109,6 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
 int                   __afl_sharedmem_fuzzing = 1;
 extern unsigned int * __afl_fuzz_len;
 extern unsigned char *__afl_fuzz_ptr;
-extern unsigned char *__afl_area_ptr;
-// extern struct cmp_map *__afl_cmp_map;
 
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
@@ -248,28 +246,8 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 
 }
 
-__attribute__((constructor(1))) void __afl_protect(void) {
-
-  setenv("__AFL_DEFER_FORKSRV", "1", 1);
-  __afl_area_ptr = (unsigned char *)mmap(
-      (void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-      MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr = (unsigned char *)mmap((void *)0x10000, MAX_DUMMY_SIZE,
-                                           PROT_READ | PROT_WRITE,
-                                           MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr =
-        (unsigned char *)mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-                              MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  // __afl_cmp_map = (struct cmp_map *)__afl_area_ptr;
-
-}
-
 int main(int argc, char **argv) {
 
-  fprintf(stderr, "dummy map is at %p\n", __afl_area_ptr);
-
   printf(
       "======================= INFO =========================\n"
       "This binary is built for afl++.\n"
@@ -307,8 +285,6 @@ int main(int argc, char **argv) {
   else if (argc > 1) {
 
     __afl_sharedmem_fuzzing = 0;
-    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
-    __afl_area_ptr = NULL;
     __afl_manual_init();
     return ExecuteFilesOnyByOne(argc, argv);
 
@@ -317,8 +293,6 @@ int main(int argc, char **argv) {
   assert(N > 0);
 
   //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
-  munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
-  __afl_area_ptr = NULL;
   __afl_manual_init();
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
diff --git a/examples/aflpp_driver/aflpp_driver_test.c b/examples/aflpp_driver/aflpp_driver_test.c
index e4567bbf..ddc3effb 100644
--- a/examples/aflpp_driver/aflpp_driver_test.c
+++ b/examples/aflpp_driver/aflpp_driver_test.c
@@ -4,6 +4,16 @@
 
 #include "hash.h"
 
+void __attribute__((noinline)) crashme(const uint8_t *Data, size_t Size) {
+
+  if (Data[0] == 'F')
+    if (Data[1] == 'A')
+      if (Data[2] == '$')
+        if (Data[3] == '$')
+          if (Data[4] == '$') abort();
+
+}
+
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 
   fprintf(stderr, "FUNC crc: %016llx len: %lu\n",
@@ -13,11 +23,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 
   if (Size < 5) return 0;
 
-  if (Data[0] == 'F')
-    if (Data[1] == 'A')
-      if (Data[2] == '$')
-        if (Data[3] == '$')
-          if (Data[4] == '$') abort();
+  crashme(Data, Size);
 
   return 0;