shm debug and fixes

3 files changed, 16 insertions, 7 deletions

diff --git a/examples/aflpp_driver/GNUmakefile b/examples/aflpp_driver/GNUmakefile
index 90844a4a..24f959e6 100644
--- a/examples/aflpp_driver/GNUmakefile
+++ b/examples/aflpp_driver/GNUmakefile
@@ -7,7 +7,7 @@ ifneq "" "$(LLVM_BINDIR)"
   LLVM_BINDIR := $(LLVM_BINDIR)/
 endif
 
-FLAGS=-O3 -funroll-loops
+FLAGS=-O2 -funroll-loops
 
 all:	libAFLDriver.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so
 
@@ -20,7 +20,6 @@ libAFLDriver.a:	aflpp_driver.o
 debug:
 	$(LLVM_BINDIR)clang++ -I../../include -D_DEBUG=\"1\" $(FLAGS) -stdlib=libc++ -funroll-loops -std=c++11 -c aflpp_driver.cpp
 	ar ru libAFLDriver.a aflpp_driver.o
-	
 
 aflpp_qemu_driver.o:	aflpp_qemu_driver.c
 	$(LLVM_BINDIR)clang $(FLAGS) -O0 -funroll-loops -c aflpp_qemu_driver.c
@@ -35,7 +34,7 @@ aflpp_qemu_driver_hook.o:	aflpp_qemu_driver_hook.c
 	$(LLVM_BINDIR)clang -fPIC $(FLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c
 
 test:	libAFLDriver.a aflpp_driver_test.cpp
-	afl-clang-fast++ -Wl,--allow-multiple-definition -stdlib=libc++ -funroll-loops -std=c++11 -o aflpp_driver_test aflpp_driver_test.cpp libAFLDriver.a
+	afl-clang-fast++ -I../../include -Wl,--allow-multiple-definition -stdlib=libc++ -funroll-loops -std=c++11 -o aflpp_driver_test aflpp_driver_test.cpp libAFLDriver.a
 
 clean:
 	rm -f *.o libAFLDriver*.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so *~ core aflpp_driver_test
diff --git a/examples/aflpp_driver/aflpp_driver.cpp b/examples/aflpp_driver/aflpp_driver.cpp
index 88354912..68a1783f 100644
--- a/examples/aflpp_driver/aflpp_driver.cpp
+++ b/examples/aflpp_driver/aflpp_driver.cpp
@@ -230,6 +230,8 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 }
 
 int main(int argc, char **argv) {
+  unsigned char in_buf[1024000];
+  size_t in_buf_len;
   Printf(
       "======================= INFO =========================\n"
       "This binary is built for AFL-fuzz.\n"
@@ -278,10 +280,16 @@ int main(int argc, char **argv) {
   while (__afl_persistent_loop(N)) {
 #ifdef _DEBUG
     fprintf(stderr, "CLIENT crc: %08x len: %u\n", hash32(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705), *__afl_fuzz_len);
+    fprintf(stderr, "RECV:");
+    for (int i = 0; i < *__afl_fuzz_len; i++)
+      fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
+    fprintf(stderr,"\n");
 #endif
     if (*__afl_fuzz_len) {
       num_runs++;
-      LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
+      in_buf_len = *__afl_fuzz_len;
+      memcpy(in_buf, __afl_fuzz_ptr, in_buf_len);
+      LLVMFuzzerTestOneInput(in_buf, in_buf_len);
     }
   }
   Printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);
diff --git a/examples/aflpp_driver/aflpp_driver_test.cpp b/examples/aflpp_driver/aflpp_driver_test.cpp
index 81aa9db4..799c743d 100644
--- a/examples/aflpp_driver/aflpp_driver_test.cpp
+++ b/examples/aflpp_driver/aflpp_driver_test.cpp
@@ -1,19 +1,21 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <stdint.h>
+#include "hash.h"
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 
-  fprintf(stderr, "Received size %lu\n", Size);
+  fprintf(stderr, "FUNC crc: %08x len: %lu\n", hash32(Data, Size, 0xa5b35705), Size);
   
-  if (Size < 4)
+  if (Size < 5)
     return 0;
 
   if (Data[0] == 'F')
     if (Data[1] == 'A')
       if (Data[2] == '$')
         if (Data[3] == '$')
-          abort();
+          if (Data[4] == '$')
+            abort();
           
   return 0;