aboutsummaryrefslogtreecommitdiff
path: root/utils
diff options
context:
space:
mode:
authorvanhauser-thc <vh@thc.org>2021-07-19 10:58:19 +0200
committervanhauser-thc <vh@thc.org>2021-07-19 10:58:19 +0200
commit32a0d6ac31554a47dca591f8978982758fb87677 (patch)
treebe2ffd03f136dbecd408c73e4bc250ae249a4180 /utils
parent815161827689c339d335233b7b232ac9b120b79b (diff)
downloadafl++-32a0d6ac31554a47dca591f8978982758fb87677.tar.gz
Revert "Merge branch 'release' into stable"
This reverts commit 815161827689c339d335233b7b232ac9b120b79b, reversing changes made to 9321a24e682b5c8bf6278961bd014cb883b87295.
Diffstat (limited to 'utils')
-rw-r--r--utils/aflpp_driver/GNUmakefile8
-rw-r--r--utils/aflpp_driver/README.md7
-rw-r--r--utils/aflpp_driver/aflpp_driver.c32
3 files changed, 28 insertions, 19 deletions
diff --git a/utils/aflpp_driver/GNUmakefile b/utils/aflpp_driver/GNUmakefile
index a6abe08c..c282a9f3 100644
--- a/utils/aflpp_driver/GNUmakefile
+++ b/utils/aflpp_driver/GNUmakefile
@@ -29,14 +29,14 @@ aflpp_qemu_driver.o: aflpp_qemu_driver.c
-$(LLVM_BINDIR)clang $(CFLAGS) -O0 -funroll-loops -c aflpp_qemu_driver.c
libAFLQemuDriver.a: aflpp_qemu_driver.o
- -ar ru libAFLQemuDriver.a aflpp_qemu_driver.o
- -cp -vf libAFLQemuDriver.a ../../
+ @-ar rc libAFLQemuDriver.a aflpp_qemu_driver.o
+ @-cp -vf libAFLQemuDriver.a ../../
aflpp_qemu_driver_hook.so: aflpp_qemu_driver_hook.o
- -test -e aflpp_qemu_driver_hook.o && $(LLVM_BINDIR)clang -shared aflpp_qemu_driver_hook.o -o aflpp_qemu_driver_hook.so || echo "Note: Optional aflpp_qemu_driver_hook.so not built."
+ @-test -e aflpp_qemu_driver_hook.o && $(LLVM_BINDIR)clang -shared aflpp_qemu_driver_hook.o -o aflpp_qemu_driver_hook.so || echo "Note: Optional aflpp_qemu_driver_hook.so not built."
aflpp_qemu_driver_hook.o: aflpp_qemu_driver_hook.c
- -test -e ../../qemu_mode/qemuafl/qemuafl/api.h && $(LLVM_BINDIR)clang $(CFLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c || echo "Note: Optional aflpp_qemu_driver_hook.o not built."
+ @-test -e ../../qemu_mode/qemuafl/qemuafl/api.h && $(LLVM_BINDIR)clang $(CFLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c || echo "Note: Optional aflpp_qemu_driver_hook.o not built."
test: debug
#clang -S -emit-llvm -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -funroll-loops -o aflpp_driver_test.ll aflpp_driver_test.c
diff --git a/utils/aflpp_driver/README.md b/utils/aflpp_driver/README.md
index f03c2fe3..4ca59776 100644
--- a/utils/aflpp_driver/README.md
+++ b/utils/aflpp_driver/README.md
@@ -22,6 +22,8 @@ or `@@` as command line parameters.
## aflpp_qemu_driver
+Note that you can use the driver too for frida_mode (`-O`).
+
aflpp_qemu_driver is used for libfuzzer `LLVMFuzzerTestOneInput()` targets that
are to be fuzzed in qemu_mode. So we compile them with clang/clang++, without
-fsantize=fuzzer or afl-clang-fast, and link in libAFLQemuDriver.a:
@@ -34,3 +36,8 @@ Then just do (where the name of the binary is `fuzz`):
AFL_QEMU_PERSISTENT_ADDR=0x$(nm fuzz | grep "T LLVMFuzzerTestOneInput" | awk '{print $1}')
AFL_QEMU_PERSISTENT_HOOK=/path/to/aflpp_qemu_driver_hook.so afl-fuzz -Q ... -- ./fuzz`
```
+
+if you use afl-cmin or `afl-showmap -C` with the aflpp_qemu_driver you need to
+set the set same AFL_QEMU_... (or AFL_FRIDA_...) environment variables.
+If you want to use afl-showmap (without -C) or afl-cmin.bash then you may not
+set these environment variables and rather set `AFL_QEMU_DRIVER_NO_HOOK=1`.
diff --git a/utils/aflpp_driver/aflpp_driver.c b/utils/aflpp_driver/aflpp_driver.c
index c094c425..ff42f3b9 100644
--- a/utils/aflpp_driver/aflpp_driver.c
+++ b/utils/aflpp_driver/aflpp_driver.c
@@ -204,21 +204,23 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
int main(int argc, char **argv) {
- printf(
- "============================== INFO ================================\n"
- "This binary is built for afl++.\n"
- "To use with afl-cmin or afl-cmin.bash pass '-' as single command line "
- "option\n"
- "To run the target function on individual input(s) execute this:\n"
- " %s INPUT_FILE1 [INPUT_FILE2 ... ]\n"
- "To fuzz with afl-fuzz execute this:\n"
- " afl-fuzz [afl-flags] -- %s [-N]\n"
- "afl-fuzz will run N iterations before re-spawning the process (default: "
- "INT_MAX)\n"
- "For stdin input processing, pass '-' as single command line option.\n"
- "For file input processing, pass '@@' as single command line option.\n"
- "===================================================================\n",
- argv[0], argv[0]);
+ if (argc < 2 || strncmp(argv[1], "-h", 2) == 0)
+ printf(
+ "============================== INFO ================================\n"
+ "This binary is built for afl++.\n"
+ "To use with afl-cmin or afl-cmin.bash pass '-' as single command line "
+ "option\n"
+ "To run the target function on individual input(s) execute this:\n"
+ " %s INPUT_FILE1 [INPUT_FILE2 ... ]\n"
+ "To fuzz with afl-fuzz execute this:\n"
+ " afl-fuzz [afl-flags] -- %s [-N]\n"
+ "afl-fuzz will run N iterations before re-spawning the process "
+ "(default: "
+ "INT_MAX)\n"
+ "For stdin input processing, pass '-' as single command line option.\n"
+ "For file input processing, pass '@@' as single command line option.\n"
+ "===================================================================\n",
+ argv[0], argv[0]);
if (getenv("AFL_GDB")) {