diff options
| author | Rishi Ranjan <43873720+rish9101@users.noreply.github.com> | 2020-05-08 23:38:27 +0530 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-05-08 20:08:27 +0200 |
| commit | 190f3024dad3713a1b2d3a42b5b99c662dd2cf58 (patch) | |
| tree | 4c7bb683bbc62e81c52f68d656f583a94cdd014e /src/afl-fuzz-python.c | |
| parent | 768053b6f25d5abd1b25f104e0233421bd1f73f9 (diff) | |
| download | afl++-190f3024dad3713a1b2d3a42b5b99c662dd2cf58.tar.gz | |
Support multiple custom mutators (#282)
* Make a list of custom mutators using env variable
* Set up multiple custom mutators
* Add destroy custom mutator and changes to load_custom_mutator
* Use array instead of list, make changes to afl-fuzz-one for multiple mutators
* Make change to fuzz-one custom_queue_get to support multiple mutators
* Modify custom python mutator support
* Fix bug
* Fix missing afl->mutator->data
* Revert to list with max count
* Change custom_pre_save hook and code format
* Free custom_mutator struct in the list
* Add testcase for multiple custom mutators
* Resolve merge conflict
Diffstat (limited to 'src/afl-fuzz-python.c')
| -rw-r--r-- | src/afl-fuzz-python.c | 40 |
1 files changed, 23 insertions, 17 deletions
diff --git a/src/afl-fuzz-python.c b/src/afl-fuzz-python.c index 64cabcad..a65add55 100644 --- a/src/afl-fuzz-python.c +++ b/src/afl-fuzz-python.c @@ -295,88 +295,94 @@ void deinit_py(void *py_mutator) { } -void load_custom_mutator_py(afl_state_t *afl, char *module_name) { +struct custom_mutator * load_custom_mutator_py(afl_state_t *afl, char *module_name) { - afl->mutator = ck_alloc(sizeof(struct custom_mutator)); - afl->mutator->pre_save_buf = NULL; - afl->mutator->pre_save_size = 0; + struct custom_mutator * mutator; - afl->mutator->name = module_name; + mutator = ck_alloc(sizeof(struct custom_mutator)); + mutator->pre_save_buf = NULL; + mutator->pre_save_size = 0; + + mutator->name = module_name; ACTF("Loading Python mutator library from '%s'...", module_name); py_mutator_t *py_mutator; py_mutator = init_py_module(afl, module_name); - afl->mutator->data = py_mutator; + mutator->data = py_mutator; if (!py_mutator) { FATAL("Failed to load python mutator."); } PyObject **py_functions = py_mutator->py_functions; if (py_functions[PY_FUNC_INIT]) { - afl->mutator->afl_custom_init = unsupported; + mutator->afl_custom_init = unsupported; } if (py_functions[PY_FUNC_DEINIT]) { - afl->mutator->afl_custom_deinit = deinit_py; + mutator->afl_custom_deinit = deinit_py; } /* "afl_custom_fuzz" should not be NULL, but the interface of Python mutator is quite different from the custom mutator. */ - afl->mutator->afl_custom_fuzz = fuzz_py; + mutator->afl_custom_fuzz = fuzz_py; if (py_functions[PY_FUNC_PRE_SAVE]) { - afl->mutator->afl_custom_pre_save = pre_save_py; + mutator->afl_custom_pre_save = pre_save_py; } if (py_functions[PY_FUNC_INIT_TRIM]) { - afl->mutator->afl_custom_init_trim = init_trim_py; + mutator->afl_custom_init_trim = init_trim_py; } if (py_functions[PY_FUNC_POST_TRIM]) { - afl->mutator->afl_custom_post_trim = post_trim_py; + mutator->afl_custom_post_trim = post_trim_py; } - if (py_functions[PY_FUNC_TRIM]) { afl->mutator->afl_custom_trim = trim_py; } + if (py_functions[PY_FUNC_TRIM]) { mutator->afl_custom_trim = trim_py; } if (py_functions[PY_FUNC_HAVOC_MUTATION]) { - afl->mutator->afl_custom_havoc_mutation = havoc_mutation_py; + mutator->afl_custom_havoc_mutation = havoc_mutation_py; } if (py_functions[PY_FUNC_HAVOC_MUTATION_PROBABILITY]) { - afl->mutator->afl_custom_havoc_mutation_probability = + mutator->afl_custom_havoc_mutation_probability = havoc_mutation_probability_py; } if (py_functions[PY_FUNC_QUEUE_GET]) { - afl->mutator->afl_custom_queue_get = queue_get_py; + mutator->afl_custom_queue_get = queue_get_py; } if (py_functions[PY_FUNC_QUEUE_NEW_ENTRY]) { - afl->mutator->afl_custom_queue_new_entry = queue_new_entry_py; + mutator->afl_custom_queue_new_entry = queue_new_entry_py; } + + OKF("Python mutator '%s' installed successfully.", module_name); /* Initialize the custom mutator */ init_py(afl, py_mutator, rand_below(afl, 0xFFFFFFFF)); + return mutator; + } size_t pre_save_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) { |