surgical_havoc_mutate() in custom mutator helpers

4 files changed, 279 insertions, 6 deletions

diff --git a/examples/custom_mutators/Makefile b/examples/custom_mutators/Makefile
new file mode 100644
index 00000000..a83e87fe
--- /dev/null
+++ b/examples/custom_mutators/Makefile
@@ -0,0 +1,2 @@
+all:
+	$(CC) $(CFLAGS) -fPIC -shared -g -I ../../include example.c -o libexamplemutator.so
diff --git a/examples/custom_mutators/README.md b/examples/custom_mutators/README.md
index ce49436e..93f824cd 100644
--- a/examples/custom_mutators/README.md
+++ b/examples/custom_mutators/README.md
@@ -7,7 +7,7 @@ Note that if you compile with python3.7 you must use python3 scripts, and if
 you use pyton2.7 to compile python2 scripts!
 
 example.c - this is a simple example written in C and should be compiled to a
-          shared library
+          shared library. Use make to compile it and produce libexamplemutator.so
 
 example.py - this is the template you can use, the functions are there but they
            are empty
diff --git a/examples/custom_mutators/custom_mutator_helpers.h b/examples/custom_mutators/custom_mutator_helpers.h
new file mode 100644
index 00000000..53ecf960
--- /dev/null
+++ b/examples/custom_mutators/custom_mutator_helpers.h
@@ -0,0 +1,266 @@
+#ifndef CUSTOM_MUTATOR_HELPERS
+#define CUSTOM_MUTATOR_HELPERS
+
+#include "config.h"
+#include "types.h"
+#include <stdlib.h>
+
+#define LIMIT_RAND(limit) (rand() % (limit))
+
+static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
+
+  static s8  interesting_8[]  = {INTERESTING_8};
+  static s16 interesting_16[] = {INTERESTING_8, INTERESTING_16};
+  static s32 interesting_32[] = {INTERESTING_8, INTERESTING_16, INTERESTING_32};
+
+  switch (LIMIT_RAND(12)) {
+
+    case 0: {
+
+      /* Flip a single bit somewhere. Spooky! */
+
+      s32 bit_idx = ((LIMIT_RAND(end - begin) + begin) << 3) + LIMIT_RAND(8);
+
+      out_buf[bit_idx >> 3] ^= 128 >> (bit_idx & 7);
+
+      break;
+
+    }
+
+    case 1: {
+
+      /* Set byte to interesting value. */
+
+      u8 val = interesting_8[LIMIT_RAND(sizeof(interesting_8))];
+      out_buf[(LIMIT_RAND(end - begin) + begin)] = val;
+
+      break;
+
+    }
+
+    case 2: {
+
+      /* Set word to interesting value, randomly choosing endian. */
+
+      if (end - begin < 2) break;
+
+      s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
+
+      if (byte_idx >= end - 1) break;
+
+      switch (LIMIT_RAND(2)) {
+
+        case 0:
+          *(u16 *)(out_buf + byte_idx) =
+              interesting_16[LIMIT_RAND(sizeof(interesting_16) >> 1)];
+          break;
+        case 1:
+          *(u16 *)(out_buf + byte_idx) =
+              SWAP16(interesting_16[LIMIT_RAND(sizeof(interesting_16) >> 1)]);
+          break;
+
+      }
+
+      break;
+
+    }
+
+    case 3: {
+
+      /* Set dword to interesting value, randomly choosing endian. */
+
+      if (end - begin < 4) break;
+
+      s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
+
+      if (byte_idx >= end - 3) break;
+
+      switch (LIMIT_RAND(2)) {
+
+        case 0:
+          *(u32 *)(out_buf + byte_idx) =
+              interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)];
+          break;
+        case 1:
+          *(u32 *)(out_buf + byte_idx) =
+              SWAP32(interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)]);
+          break;
+
+      }
+
+      break;
+
+    }
+
+    case 4: {
+
+      /* Set qword to interesting value, randomly choosing endian. */
+
+      if (end - begin < 8) break;
+
+      s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
+
+      if (byte_idx >= end - 7) break;
+
+      switch (LIMIT_RAND(2)) {
+
+        case 0:
+          *(u64 *)(out_buf + byte_idx) =
+              (s64)interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)];
+          break;
+        case 1:
+          *(u64 *)(out_buf + byte_idx) =
+              SWAP64((s64)interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)]);
+          break;
+
+      }
+
+      break;
+
+    }
+
+    case 5: {
+
+      /* Randomly subtract from byte. */
+
+      out_buf[(LIMIT_RAND(end - begin) + begin)] -= 1 + LIMIT_RAND(ARITH_MAX);
+
+      break;
+
+    }
+
+    case 6: {
+
+      /* Randomly add to byte. */
+
+      out_buf[(LIMIT_RAND(end - begin) + begin)] += 1 + LIMIT_RAND(ARITH_MAX);
+
+      break;
+
+    }
+
+    case 7: {
+
+      /* Randomly subtract from word, random endian. */
+
+      if (end - begin < 2) break;
+
+      s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
+
+      if (byte_idx >= end - 1) break;
+
+      if (LIMIT_RAND(2)) {
+
+        *(u16 *)(out_buf + byte_idx) -= 1 + LIMIT_RAND(ARITH_MAX);
+
+      } else {
+
+        u16 num = 1 + LIMIT_RAND(ARITH_MAX);
+
+        *(u16 *)(out_buf + byte_idx) =
+            SWAP16(SWAP16(*(u16 *)(out_buf + byte_idx)) - num);
+
+      }
+
+      break;
+
+    }
+
+    case 8: {
+
+      /* Randomly add to word, random endian. */
+
+      if (end - begin < 2) break;
+
+      s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
+
+      if (byte_idx >= end - 1) break;
+
+      if (LIMIT_RAND(2)) {
+
+        *(u16 *)(out_buf + byte_idx) += 1 + LIMIT_RAND(ARITH_MAX);
+
+      } else {
+
+        u16 num = 1 + LIMIT_RAND(ARITH_MAX);
+
+        *(u16 *)(out_buf + byte_idx) =
+            SWAP16(SWAP16(*(u16 *)(out_buf + byte_idx)) + num);
+
+      }
+
+      break;
+
+    }
+
+    case 9: {
+
+      /* Randomly subtract from dword, random endian. */
+
+      if (end - begin < 4) break;
+
+      s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
+
+      if (byte_idx >= end - 3) break;
+
+      if (LIMIT_RAND(2)) {
+
+        *(u32 *)(out_buf + byte_idx) -= 1 + LIMIT_RAND(ARITH_MAX);
+
+      } else {
+
+        u32 num = 1 + LIMIT_RAND(ARITH_MAX);
+
+        *(u32 *)(out_buf + byte_idx) =
+            SWAP32(SWAP32(*(u32 *)(out_buf + byte_idx)) - num);
+
+      }
+
+      break;
+
+    }
+
+    case 10: {
+
+      /* Randomly add to dword, random endian. */
+
+      if (end - begin < 4) break;
+
+      s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
+
+      if (byte_idx >= end - 3) break;
+
+      if (LIMIT_RAND(2)) {
+
+        *(u32 *)(out_buf + byte_idx) += 1 + LIMIT_RAND(ARITH_MAX);
+
+      } else {
+
+        u32 num = 1 + LIMIT_RAND(ARITH_MAX);
+
+        *(u32 *)(out_buf + byte_idx) =
+            SWAP32(SWAP32(*(u32 *)(out_buf + byte_idx)) + num);
+
+      }
+
+      break;
+
+    }
+
+    case 11: {
+
+      /* Just set a random byte to a random value. Because,
+         why not. We use XOR with 1-255 to eliminate the
+         possibility of a no-op. */
+
+      out_buf[(LIMIT_RAND(end - begin) + begin)] ^= 1 + LIMIT_RAND(255);
+
+      break;
+
+    }
+
+  }
+
+}
+
+#endif
diff --git a/examples/custom_mutators/example.c b/examples/custom_mutators/example.c
index 127f971e..2787e218 100644
--- a/examples/custom_mutators/example.c
+++ b/examples/custom_mutators/example.c
@@ -5,6 +5,9 @@
              Shengtuo Hu <h1994st@gmail.com>
 */
 
+// You need to use -I /path/to/AFLplusplus/include
+#include "custom_mutator_helpers.h"
+
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
@@ -21,7 +24,7 @@ static size_t data_size = 100;
 
 void afl_custom_init(unsigned int seed) {
 
-  srand(seed);
+  srand(seed); // needed also by surgical_havoc_mutate()
 
 }
 
@@ -54,10 +57,12 @@ size_t afl_custom_fuzz(uint8_t **buf, size_t buf_size, uint8_t *add_buf,
   memcpy(mutated_out, commands[rand() % 3], 3);
 
   // Mutate the payload of the packet
-  for (int i = 3; i < mutated_size; i++) {
-
-    mutated_out[i] = (mutated_out[i] + rand() % 10) & 0xff;
-
+  int i;
+  for (i = 0; i < 8; ++i) {
+  
+    // Randomly perform one of the (no len modification) havoc mutations
+    surgical_havoc_mutate(mutated_out, 3, mutated_size);
+  
   }
 
   return mutated_size;