aboutsummaryrefslogtreecommitdiff
path: root/utils/argv_fuzzing
diff options
context:
space:
mode:
authorMaciej Domanski <maciej.domanski@trailofbits.com>2022-12-27 16:54:36 +0100
committerMaciej Domanski <maciej.domanski@trailofbits.com>2022-12-27 16:54:36 +0100
commitb189640a927e9ed17347b26f6579b0e41dcdda38 (patch)
treeb9e090e9e2024559db5991bdb7f103d39300281c /utils/argv_fuzzing
parent3d031f93a6366ee157cfd9a27fbb6d485d328d8e (diff)
downloadafl++-b189640a927e9ed17347b26f6579b0e41dcdda38.tar.gz
cleanup
Diffstat (limited to 'utils/argv_fuzzing')
-rw-r--r--utils/argv_fuzzing/README.md4
-rw-r--r--utils/argv_fuzzing/argv-fuzz-inl.h31
-rw-r--r--utils/argv_fuzzing/argv_fuzz_demo.c13
-rw-r--r--utils/argv_fuzzing/argv_fuzz_persistent_demo.c11
4 files changed, 38 insertions, 21 deletions
diff --git a/utils/argv_fuzzing/README.md b/utils/argv_fuzzing/README.md
index e9224995..bcf388c7 100644
--- a/utils/argv_fuzzing/README.md
+++ b/utils/argv_fuzzing/README.md
@@ -1,4 +1,4 @@
-# argvfuzz
+#argvfuzz
AFL++ supports fuzzing file inputs or stdin. When source is available,
`argv-fuzz-inl.h` can be used to change `main()` to build argv from stdin.
@@ -13,4 +13,4 @@ A few conditions need to be fulfilled for this mechanism to work correctly:
2. If the target binary does not use the default libc's `_start` implementation
(crt1.o), the hook may not run.
3. The hook will replace argv with pointers to `.data` of `argvfuzz.so`. If the
- target binary expects argv to be living on the stack, things may go wrong. \ No newline at end of file
+ target binary expects argv to be living on the stack, things may go wrong.
diff --git a/utils/argv_fuzzing/argv-fuzz-inl.h b/utils/argv_fuzzing/argv-fuzz-inl.h
index d3440799..bb8f2813 100644
--- a/utils/argv_fuzzing/argv-fuzz-inl.h
+++ b/utils/argv_fuzzing/argv-fuzz-inl.h
@@ -57,18 +57,20 @@
\
} while (0)
-#define AFL_INIT_ARGV_PERSISTENT(persistent_buff) \
- do { \
- argv = afl_init_argv_persistent(&argc, persistent_buff); \
- } while (0)
-
-#define AFL_INIT_SET0_PERSISTENT(_p, persistent_buff) \
- do { \
- \
- argv = afl_init_argv_persistent(&argc, persistent_buff); \
- argv[0] = (_p); \
- if (!argc) argc = 1; \
- \
+#define AFL_INIT_ARGV_PERSISTENT(persistent_buff) \
+ do { \
+ \
+ argv = afl_init_argv_persistent(&argc, persistent_buff); \
+ \
+ } while (0)
+
+#define AFL_INIT_SET0_PERSISTENT(_p, persistent_buff) \
+ do { \
+ \
+ argv = afl_init_argv_persistent(&argc, persistent_buff); \
+ argv[0] = (_p); \
+ if (!argc) argc = 1; \
+ \
} while (0)
#define MAX_CMDLINE_LEN 100000
@@ -105,12 +107,13 @@ static char **afl_init_argv(int *argc) {
}
-static char **afl_init_argv_persistent(int *argc, unsigned char *persistent_buff) {
+static char **afl_init_argv_persistent(int *argc,
+ unsigned char *persistent_buff) {
static char *ret[MAX_CMDLINE_PAR];
unsigned char *ptr = persistent_buff;
- int rc = 0;
+ int rc = 0;
while (*ptr && rc < MAX_CMDLINE_PAR) {
diff --git a/utils/argv_fuzzing/argv_fuzz_demo.c b/utils/argv_fuzzing/argv_fuzz_demo.c
index 5fe4d704..6ab1e2e5 100644
--- a/utils/argv_fuzzing/argv_fuzz_demo.c
+++ b/utils/argv_fuzzing/argv_fuzz_demo.c
@@ -3,6 +3,7 @@
#include "argv-fuzz-inl.h"
int main(int argc, char **argv) {
+
// Initialize the argv array for use with the AFL (American Fuzzy Lop) tool
AFL_INIT_ARGV();
@@ -12,12 +13,16 @@ int main(int argc, char **argv) {
an error message is printed. If the values do match, the program
calls the abort() function. */
if (argc > 1 && strcmp(argv[1], "XYZ") == 0) {
- if (strcmp(argv[2], "TEST2") == 0) {
- abort();
- }
+
+ if (strcmp(argv[2], "TEST2") == 0) { abort(); }
+
} else {
+
printf("Bad number of arguments!\n");
+
}
return 0;
-} \ No newline at end of file
+
+}
+
diff --git a/utils/argv_fuzzing/argv_fuzz_persistent_demo.c b/utils/argv_fuzzing/argv_fuzz_persistent_demo.c
index a96cf1fe..08a62c62 100644
--- a/utils/argv_fuzzing/argv_fuzz_persistent_demo.c
+++ b/utils/argv_fuzzing/argv_fuzz_persistent_demo.c
@@ -16,6 +16,7 @@ __AFL_FUZZ_INIT();
one of the arguments.
*/
int main(int argc, char **argv) {
+
#ifdef __AFL_HAVE_MANUAL_CONTROL
__AFL_INIT();
#endif
@@ -25,6 +26,7 @@ int main(int argc, char **argv) {
the loop and allowing the program to terminate. It protects against
accidental memory leaks and similar issues. */
while (__AFL_LOOP(100000)) {
+
int len = __AFL_FUZZ_TESTCASE_LEN;
// Check that the length of the test case is at least 8 bytes
@@ -37,13 +39,20 @@ int main(int argc, char **argv) {
If so, call the "abort" function to terminate the program.
Otherwise, print an error message. */
if (argc > 1 && strcmp(argv[1], "XYZ") == 0) {
+
if (strcmp(argv[2], "TEST2") == 0) { abort(); }
+
} else {
+
printf("Bad number of arguments!\n");
+
}
+
}
+
/* Exiting the loop allows the program to terminate normally. AFL will restart
the process with a clean slate for allocated memory, file descriptors, etc.
*/
return 0;
-} \ No newline at end of file
+
+}