aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--GNUmakefile4
-rw-r--r--include/afl-fuzz.h25
-rw-r--r--include/cmplog.h23
-rw-r--r--include/config.h2
-rw-r--r--include/debug.h24
-rw-r--r--include/types.h36
-rw-r--r--instrumentation/afl-compiler-rt.o.c281
-rw-r--r--instrumentation/cmplog-instructions-pass.cc590
-rw-r--r--instrumentation/llvm-ngram-coverage.h2
-rw-r--r--src/afl-cc.c51
-rw-r--r--src/afl-forkserver.c8
-rw-r--r--src/afl-fuzz-cmplog.c2
-rw-r--r--src/afl-fuzz-init.c38
-rw-r--r--src/afl-fuzz-one.c79
-rw-r--r--src/afl-fuzz-queue.c1
-rw-r--r--src/afl-fuzz-redqueen.c2209
-rw-r--r--src/afl-fuzz-state.c1
-rw-r--r--src/afl-fuzz.c61
-rw-r--r--src/afl-showmap.c25
-rwxr-xr-xtest/test-basic.sh8
-rwxr-xr-xtest/test-gcc-plugin.sh4
-rwxr-xr-xtest/test-llvm-lto.sh2
-rwxr-xr-xtest/test-llvm.sh6
-rwxr-xr-xunicorn_mode/build_unicorn_support.sh5
-rw-r--r--utils/aflpp_driver/aflpp_driver.c1
-rw-r--r--utils/defork/defork.c1
26 files changed, 3011 insertions, 478 deletions
diff --git a/GNUmakefile b/GNUmakefile
index 7b05a1d5..c71a7d47 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -428,8 +428,8 @@ src/afl-sharedmem.o : $(COMM_HDR) src/afl-sharedmem.c include/sharedmem.h
afl-fuzz: $(COMM_HDR) include/afl-fuzz.h $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o | test_x86
$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o -o $@ $(PYFLAGS) $(LDFLAGS) -lm
-afl-showmap: src/afl-showmap.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o $(COMM_HDR) | test_x86
- $(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) src/$@.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o -o $@ $(LDFLAGS)
+afl-showmap: src/afl-showmap.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o $(COMM_HDR) | test_x86
+ $(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) src/$@.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o -o $@ $(LDFLAGS)
afl-tmin: src/afl-tmin.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o $(COMM_HDR) | test_x86
$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) src/$@.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o -o $@ $(LDFLAGS)
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 6342c8b6..f46d7707 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -141,12 +141,22 @@ extern s16 interesting_16[INTERESTING_8_LEN + INTERESTING_16_LEN];
extern s32
interesting_32[INTERESTING_8_LEN + INTERESTING_16_LEN + INTERESTING_32_LEN];
+struct tainted {
+
+ u32 pos;
+ u32 len;
+ struct tainted *next;
+ struct tainted *prev;
+
+};
+
struct queue_entry {
u8 *fname; /* File name for the test case */
u32 len; /* Input length */
- u8 cal_failed; /* Calibration failed? */
+ u8 colorized, /* Do not run redqueen stage again */
+ cal_failed; /* Calibration failed? */
bool trim_done, /* Trimmed? */
was_fuzzed, /* historical, but needed for MOpt */
passed_det, /* Deterministic stages passed? */
@@ -154,7 +164,6 @@ struct queue_entry {
var_behavior, /* Variable behavior? */
favored, /* Currently favored? */
fs_redundant, /* Marked as redundant in the fs? */
- fully_colorized, /* Do not run redqueen stage again */
is_ascii, /* Is the input just ascii text? */
disabled; /* Is disabled from fuzz selection */
@@ -179,7 +188,11 @@ struct queue_entry {
u8 *testcase_buf; /* The testcase buffer, if loaded. */
- struct queue_entry *next; /* Next element, if any */
+ u8 * cmplog_colorinput; /* the result buf of colorization */
+ struct tainted *taint; /* Taint information from CmpLog */
+
+ struct queue_entry *mother, /* queue entry this based on */
+ *next; /* Next element, if any */
};
@@ -632,6 +645,8 @@ typedef struct afl_state {
/* cmplog forkserver ids */
s32 cmplog_fsrv_ctl_fd, cmplog_fsrv_st_fd;
u32 cmplog_prev_timed_out;
+ u32 cmplog_max_filesize;
+ u32 cmplog_lvl;
struct afl_pass_stat *pass_stats;
struct cmp_map * orig_cmp_map;
@@ -1117,9 +1132,9 @@ void read_foreign_testcases(afl_state_t *, int);
u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len);
/* RedQueen */
-u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
- u64 exec_cksum);
+u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len);
+/* our RNG wrapper */
AFL_RAND_RETURN rand_next(afl_state_t *afl);
/* probability between 0.0 and 1.0 */
diff --git a/include/cmplog.h b/include/cmplog.h
index bf557785..878ed60c 100644
--- a/include/cmplog.h
+++ b/include/cmplog.h
@@ -30,24 +30,25 @@
#include "config.h"
+#define CMPLOG_LVL_MAX 3
+
#define CMP_MAP_W 65536
-#define CMP_MAP_H 256
+#define CMP_MAP_H 32
#define CMP_MAP_RTN_H (CMP_MAP_H / 4)
#define SHAPE_BYTES(x) (x + 1)
-#define CMP_TYPE_INS 0
-#define CMP_TYPE_RTN 1
+#define CMP_TYPE_INS 1
+#define CMP_TYPE_RTN 2
struct cmp_header {
- unsigned hits : 20;
-
- unsigned cnt : 20;
- unsigned id : 16;
-
- unsigned shape : 5; // from 0 to 31
- unsigned type : 1;
+ unsigned hits : 24;
+ unsigned id : 24;
+ unsigned shape : 5;
+ unsigned type : 2;
+ unsigned attribute : 4;
+ unsigned reserved : 5;
} __attribute__((packed));
@@ -55,6 +56,8 @@ struct cmp_operands {
u64 v0;
u64 v1;
+ u64 v0_128;
+ u64 v1_128;
};
diff --git a/include/config.h b/include/config.h
index 973bbcbb..b5137553 100644
--- a/include/config.h
+++ b/include/config.h
@@ -23,8 +23,6 @@
#ifndef _HAVE_CONFIG_H
#define _HAVE_CONFIG_H
-#include "types.h"
-
/* Version string: */
// c = release, d = volatile github dev, e = experimental branch
diff --git a/include/debug.h b/include/debug.h
index ef5b195b..fc1f39cb 100644
--- a/include/debug.h
+++ b/include/debug.h
@@ -295,8 +295,8 @@ static inline const char *colorfilter(const char *x) {
\
SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD \
"\n[-] PROGRAM ABORT : " cRST x); \
- SAYF(cLRD "\n Location : " cRST "%s(), %s:%d\n\n", __func__, \
- __FILE__, __LINE__); \
+ SAYF(cLRD "\n Location : " cRST "%s(), %s:%u\n\n", __func__, \
+ __FILE__, (u32)__LINE__); \
exit(1); \
\
} while (0)
@@ -308,8 +308,8 @@ static inline const char *colorfilter(const char *x) {
\
SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD \
"\n[-] PROGRAM ABORT : " cRST x); \
- SAYF(cLRD "\n Stop location : " cRST "%s(), %s:%d\n\n", __func__, \
- __FILE__, __LINE__); \
+ SAYF(cLRD "\n Stop location : " cRST "%s(), %s:%u\n\n", __func__, \
+ __FILE__, (u32)__LINE__); \
abort(); \
\
} while (0)
@@ -322,8 +322,8 @@ static inline const char *colorfilter(const char *x) {
fflush(stdout); \
SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD \
"\n[-] SYSTEM ERROR : " cRST x); \
- SAYF(cLRD "\n Stop location : " cRST "%s(), %s:%d\n", __func__, \
- __FILE__, __LINE__); \
+ SAYF(cLRD "\n Stop location : " cRST "%s(), %s:%u\n", __func__, \
+ __FILE__, (u32)__LINE__); \
SAYF(cLRD " OS message : " cRST "%s\n", strerror(errno)); \
exit(1); \
\
@@ -344,12 +344,12 @@ static inline const char *colorfilter(const char *x) {
/* Show a prefixed debug output. */
-#define DEBUGF(x...) \
- do { \
- \
- SAYF(cMGN "[D] " cBRI "DEBUG: " cRST x); \
- SAYF(cRST ""); \
- \
+#define DEBUGF(x...) \
+ do { \
+ \
+ fprintf(stderr, cMGN "[D] " cBRI "DEBUG: " cRST x); \
+ fprintf(stderr, cRST ""); \
+ \
} while (0)
/* Error-checking versions of read() and write() that call RPFATAL() as
diff --git a/include/types.h b/include/types.h
index 3e3bc953..7b94fb83 100644
--- a/include/types.h
+++ b/include/types.h
@@ -25,10 +25,15 @@
#include <stdint.h>
#include <stdlib.h>
+#include "config.h"
typedef uint8_t u8;
typedef uint16_t u16;
typedef uint32_t u32;
+#ifdef WORD_SIZE_64
+typedef unsigned __int128 uint128_t;
+typedef uint128_t u128;
+#endif
/* Extended forkserver option values */
@@ -61,6 +66,10 @@ typedef int8_t s8;
typedef int16_t s16;
typedef int32_t s32;
typedef int64_t s64;
+#ifdef WORD_SIZE_64
+typedef __int128 int128_t;
+typedef int128_t s128;
+#endif
#ifndef MIN
#define MIN(a, b) \
@@ -114,6 +123,33 @@ typedef int64_t s64;
\
})
+// It is impossible to define 128 bit constants, so ...
+#ifdef WORD_SIZE_64
+ #define SWAPN(_x, _l) \
+ ({ \
+ \
+ u128 _res = (_x), _ret; \
+ char *d = (char *)&_ret, *s = (char *)&_res; \
+ int i; \
+ for (i = 0; i < 16; i++) \
+ d[15 - i] = s[i]; \
+ u32 sr = 128U - ((_l) << 3U); \
+ (_ret >>= sr); \
+ (u128) _ret; \
+ \
+ })
+#endif
+
+#define SWAPNN(_x, _y, _l) \
+ ({ \
+ \
+ char *d = (char *)(_x), *s = (char *)(_y); \
+ u32 i, l = (_l)-1; \
+ for (i = 0; i <= l; i++) \
+ d[l - i] = s[i]; \
+ \
+ })
+
#ifdef AFL_LLVM_PASS
#if defined(__linux__) || !defined(__ANDROID__)
#define AFL_SR(s) (srandom(s))
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index e31bff16..14da4caa 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -161,7 +161,7 @@ void send_forkserver_error(int error) {
u32 status;
if (!error || error > 0xffff) return;
status = (FS_OPT_ERROR | FS_OPT_SET_ERROR(error));
- if (write(FORKSRV_FD + 1, (char *)&status, 4) != 4) return;
+ if (write(FORKSRV_FD + 1, (char *)&status, 4) != 4) { return; }
}
@@ -544,11 +544,11 @@ static void __afl_start_snapshots(void) {
if (__afl_dictionary_len && __afl_dictionary) status |= FS_OPT_AUTODICT;
memcpy(tmp, &status, 4);
- if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
+ if (write(FORKSRV_FD + 1, tmp, 4) != 4) { return; }
if (__afl_sharedmem_fuzzing || (__afl_dictionary_len && __afl_dictionary)) {
- if (read(FORKSRV_FD, &was_killed, 4) != 4) _exit(1);
+ if (read(FORKSRV_FD, &was_killed, 4) != 4) { _exit(1); }
if (getenv("AFL_DEBUG")) {
@@ -1207,22 +1207,33 @@ void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) {
///// CmpLog instrumentation
-void __cmplog_ins_hook1(uint8_t arg1, uint8_t arg2) {
+void __cmplog_ins_hook1(uint8_t arg1, uint8_t arg2, uint8_t attr) {
- if (unlikely(!__afl_cmp_map)) return;
+ // fprintf(stderr, "hook1 arg0=%02x arg1=%02x attr=%u\n",
+ // (u8) arg1, (u8) arg2, attr);
+
+ if (unlikely(!__afl_cmp_map || arg1 == arg2)) return;
uintptr_t k = (uintptr_t)__builtin_return_address(0);
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
- __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+ u32 hits;
- u32 hits = __afl_cmp_map->headers[k].hits;
- __afl_cmp_map->headers[k].hits = hits + 1;
- // if (!__afl_cmp_map->headers[k].cnt)
- // __afl_cmp_map->headers[k].cnt = __afl_cmp_counter++;
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
- __afl_cmp_map->headers[k].shape = 0;
+ __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
+ __afl_cmp_map->headers[k].shape = 0;
+
+ } else {
+
+ hits = __afl_cmp_map->headers[k].hits++;
+
+ }
+
+ __afl_cmp_map->headers[k].attribute = attr;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = arg1;
@@ -1230,20 +1241,36 @@ void __cmplog_ins_hook1(uint8_t arg1, uint8_t arg2) {
}
-void __cmplog_ins_hook2(uint16_t arg1, uint16_t arg2) {
+void __cmplog_ins_hook2(uint16_t arg1, uint16_t arg2, uint8_t attr) {
- if (unlikely(!__afl_cmp_map)) return;
+ if (unlikely(!__afl_cmp_map || arg1 == arg2)) return;
uintptr_t k = (uintptr_t)__builtin_return_address(0);
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
- __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+ u32 hits;
+
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
+
+ __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
+ __afl_cmp_map->headers[k].shape = 1;
+
+ } else {
- u32 hits = __afl_cmp_map->headers[k].hits;
- __afl_cmp_map->headers[k].hits = hits + 1;
+ hits = __afl_cmp_map->headers[k].hits++;
- __afl_cmp_map->headers[k].shape = 1;
+ if (!__afl_cmp_map->headers[k].shape) {
+
+ __afl_cmp_map->headers[k].shape = 1;
+
+ }
+
+ }
+
+ __afl_cmp_map->headers[k].attribute = attr;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = arg1;
@@ -1251,20 +1278,38 @@ void __cmplog_ins_hook2(uint16_t arg1, uint16_t arg2) {
}
-void __cmplog_ins_hook4(uint32_t arg1, uint32_t arg2) {
+void __cmplog_ins_hook4(uint32_t arg1, uint32_t arg2, uint8_t attr) {
- if (unlikely(!__afl_cmp_map)) return;
+ // fprintf(stderr, "hook4 arg0=%x arg1=%x attr=%u\n", arg1, arg2, attr);
+
+ if (unlikely(!__afl_cmp_map || arg1 == arg2)) return;
uintptr_t k = (uintptr_t)__builtin_return_address(0);
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
- __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+ u32 hits;
+
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
+
+ __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
+ __afl_cmp_map->headers[k].shape = 3;
+
+ } else {
+
+ hits = __afl_cmp_map->headers[k].hits++;
+
+ if (__afl_cmp_map->headers[k].shape < 3) {
+
+ __afl_cmp_map->headers[k].shape = 3;
- u32 hits = __afl_cmp_map->headers[k].hits;
- __afl_cmp_map->headers[k].hits = hits + 1;
+ }
+
+ }
- __afl_cmp_map->headers[k].shape = 3;
+ __afl_cmp_map->headers[k].attribute = attr;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = arg1;
@@ -1272,20 +1317,38 @@ void __cmplog_ins_hook4(uint32_t arg1, uint32_t arg2) {
}
-void __cmplog_ins_hook8(uint64_t arg1, uint64_t arg2) {
+void __cmplog_ins_hook8(uint64_t arg1, uint64_t arg2, uint8_t attr) {
- if (unlikely(!__afl_cmp_map)) return;
+ // fprintf(stderr, "hook8 arg0=%lx arg1=%lx attr=%u\n", arg1, arg2, attr);
+
+ if (unlikely(!__afl_cmp_map || arg1 == arg2)) return;
uintptr_t k = (uintptr_t)__builtin_return_address(0);
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
- __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+ u32 hits;
+
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
+
+ __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
+ __afl_cmp_map->headers[k].shape = 7;
- u32 hits = __afl_cmp_map->headers[k].hits;
- __afl_cmp_map->headers[k].hits = hits + 1;
+ } else {
+
+ hits = __afl_cmp_map->headers[k].hits++;
+
+ if (__afl_cmp_map->headers[k].shape < 7) {
+
+ __afl_cmp_map->headers[k].shape = 7;
+
+ }
+
+ }
- __afl_cmp_map->headers[k].shape = 7;
+ __afl_cmp_map->headers[k].attribute = attr;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = arg1;
@@ -1293,16 +1356,110 @@ void __cmplog_ins_hook8(uint64_t arg1, uint64_t arg2) {
}
+#ifdef WORD_SIZE_64
+// support for u24 to u120 via llvm _ExitInt(). size is in bytes minus 1
+void __cmplog_ins_hookN(uint128_t arg1, uint128_t arg2, uint8_t attr,
+ uint8_t size) {
+
+ // fprintf(stderr, "hookN arg0=%llx:%llx arg1=%llx:%llx bytes=%u attr=%u\n",
+ // (u64)(arg1 >> 64), (u64)arg1, (u64)(arg2 >> 64), (u64)arg2, size + 1,
+ // attr);
+
+ if (unlikely(!__afl_cmp_map || arg1 == arg2)) return;
+
+ uintptr_t k = (uintptr_t)__builtin_return_address(0);
+ k = (k >> 4) ^ (k << 8);
+ k &= CMP_MAP_W - 1;
+
+ u32 hits;
+
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
+
+ __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
+ __afl_cmp_map->headers[k].shape = size;
+
+ } else {
+
+ hits = __afl_cmp_map->headers[k].hits++;
+
+ if (__afl_cmp_map->headers[k].shape < size) {
+
+ __afl_cmp_map->headers[k].shape = size;
+
+ }
+
+ }
+
+ __afl_cmp_map->headers[k].attribute = attr;
+
+ hits &= CMP_MAP_H - 1;
+ __afl_cmp_map->log[k][hits].v0 = (u64)arg1;
+ __afl_cmp_map->log[k][hits].v1 = (u64)arg2;
+
+ if (size > 7) {
+
+ __afl_cmp_map->log[k][hits].v0_128 = (u64)(arg1 >> 64);
+ __afl_cmp_map->log[k][hits].v1_128 = (u64)(arg2 >> 64);
+
+ }
+
+}
+
+void __cmplog_ins_hook16(uint128_t arg1, uint128_t arg2, uint8_t attr) {
+
+ if (unlikely(!__afl_cmp_map)) return;
+
+ uintptr_t k = (uintptr_t)__builtin_return_address(0);
+ k = (k >> 4) ^ (k << 8);
+ k &= CMP_MAP_W - 1;
+
+ u32 hits;
+
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
+
+ __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
+ __afl_cmp_map->headers[k].shape = 15;
+
+ } else {
+
+ hits = __afl_cmp_map->headers[k].hits++;
+
+ if (__afl_cmp_map->headers[k].shape < 15) {
+
+ __afl_cmp_map->headers[k].shape = 15;
+
+ }
+
+ }
+
+ __afl_cmp_map->headers[k].attribute = attr;
+
+ hits &= CMP_MAP_H - 1;
+ __afl_cmp_map->log[k][hits].v0 = (u64)arg1;
+ __afl_cmp_map->log[k][hits].v1 = (u64)arg2;
+ __afl_cmp_map->log[k][hits].v0_128 = (u64)(arg1 >> 64);
+ __afl_cmp_map->log[k][hits].v1_128 = (u64)(arg2 >> 64);
+
+}
+
+#endif
+
#if defined(__APPLE__)
#pragma weak __sanitizer_cov_trace_const_cmp1 = __cmplog_ins_hook1
#pragma weak __sanitizer_cov_trace_const_cmp2 = __cmplog_ins_hook2
#pragma weak __sanitizer_cov_trace_const_cmp4 = __cmplog_ins_hook4
#pragma weak __sanitizer_cov_trace_const_cmp8 = __cmplog_ins_hook8
+ #pragma weak __sanitizer_cov_trace_const_cmp16 = __cmplog_ins_hook16
#pragma weak __sanitizer_cov_trace_cmp1 = __cmplog_ins_hook1
#pragma weak __sanitizer_cov_trace_cmp2 = __cmplog_ins_hook2
#pragma weak __sanitizer_cov_trace_cmp4 = __cmplog_ins_hook4
#pragma weak __sanitizer_cov_trace_cmp8 = __cmplog_ins_hook8
+ #pragma weak __sanitizer_cov_trace_cmp16 = __cmplog_ins_hook16
#else
void __sanitizer_cov_trace_const_cmp1(uint8_t arg1, uint8_t arg2)
__attribute__((alias("__cmplog_ins_hook1")));
@@ -1312,6 +1469,10 @@ void __sanitizer_cov_trace_const_cmp4(uint32_t arg1, uint32_t arg2)
__attribute__((alias("__cmplog_ins_hook4")));
void __sanitizer_cov_trace_const_cmp8(uint64_t arg1, uint64_t arg2)
__attribute__((alias("__cmplog_ins_hook8")));
+ #ifdef WORD_SIZE_64
+void __sanitizer_cov_trace_const_cmp16(uint128_t arg1, uint128_t arg2)
+ __attribute__((alias("__cmplog_ins_hook16")));
+ #endif
void __sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2)
__attribute__((alias("__cmplog_ins_hook1")));
@@ -1321,6 +1482,10 @@ void __sanitizer_cov_trace_cmp4(uint32_t arg1, uint32_t arg2)
__attribute__((alias("__cmplog_ins_hook4")));
void __sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2)
__attribute__((alias("__cmplog_ins_hook8")));
+ #ifdef WORD_SIZE_64
+void __sanitizer_cov_trace_cmp16(uint128_t arg1, uint128_t arg2)
+ __attribute__((alias("__cmplog_ins_hook16")));
+ #endif
#endif /* defined(__APPLE__) */
void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
@@ -1333,12 +1498,28 @@ void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
- __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+ u32 hits;
- u32 hits = __afl_cmp_map->headers[k].hits;
- __afl_cmp_map->headers[k].hits = hits + 1;
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
- __afl_cmp_map->headers[k].shape = 7;
+ __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
+ __afl_cmp_map->headers[k].shape = 7;
+
+ } else {
+
+ hits = __afl_cmp_map->headers[k].hits++;
+
+ if (__afl_cmp_map->headers[k].shape < 7) {
+
+ __afl_cmp_map->headers[k].shape = 7;
+
+ }
+
+ }
+
+ __afl_cmp_map->headers[k].attribute = 1;
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = val;
@@ -1364,6 +1545,18 @@ static int area_is_mapped(void *ptr, size_t len) {
void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
+ /*
+ u32 i;
+ if (!area_is_mapped(ptr1, 32) || !area_is_mapped(ptr2, 32)) return;
+ fprintf(stderr, "rtn arg0=");
+ for (i = 0; i < 8; i++)
+ fprintf(stderr, "%02x", ptr1[i]);
+ fprintf(stderr, " arg1=");
+ for (i = 0; i < 8; i++)
+ fprintf(stderr, "%02x", ptr2[i]);
+ fprintf(stderr, "\n");
+ */
+
if (unlikely(!__afl_cmp_map)) return;
if (!area_is_mapped(ptr1, 32) || !area_is_mapped(ptr2, 32)) return;
@@ -1372,12 +1565,26 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
- __afl_cmp_map->headers[k].type = CMP_TYPE_RTN;
+ u32 hits;
+
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_RTN) {
- u32 hits = __afl_cmp_map->headers[k].hits;
- __afl_cmp_map->headers[k].hits = hits + 1;
+ __afl_cmp_map->headers[k].type = CMP_TYPE_RTN;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
+ __afl_cmp_map->headers[k].shape = 31;
- __afl_cmp_map->headers[k].shape = 31;
+ } else {
+
+ hits = __afl_cmp_map->headers[k].hits++;
+
+ if (__afl_cmp_map->headers[k].shape < 31) {
+
+ __afl_cmp_map->headers[k].shape = 31;
+
+ }
+
+ }
hits &= CMP_MAP_RTN_H - 1;
__builtin_memcpy(((struct cmpfn_operands *)__afl_cmp_map->log[k])[hits].v0,
diff --git a/instrumentation/cmplog-instructions-pass.cc b/instrumentation/cmplog-instructions-pass.cc
index 3499ccf0..6ce1832f 100644
--- a/instrumentation/cmplog-instructions-pass.cc
+++ b/instrumentation/cmplog-instructions-pass.cc
@@ -85,9 +85,25 @@ class CmpLogInstructions : public ModulePass {
char CmpLogInstructions::ID = 0;
+template <class Iterator>
+Iterator Unique(Iterator first, Iterator last) {
+
+ while (first != last) {
+
+ Iterator next(first);
+ last = std::remove(++next, last, *first);
+ first = next;
+
+ }
+
+ return last;
+
+}
+
bool CmpLogInstructions::hookInstrs(Module &M) {
std::vector<Instruction *> icomps;
+ std::vector<SwitchInst *> switches;
LLVMContext & C = M.getContext();
Type * VoidTy = Type::getVoidTy(C);
@@ -95,13 +111,15 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
IntegerType *Int16Ty = IntegerType::getInt16Ty(C);
IntegerType *Int32Ty = IntegerType::getInt32Ty(C);
IntegerType *Int64Ty = IntegerType::getInt64Ty(C);
+ IntegerType *Int128Ty = IntegerType::getInt128Ty(C);
#if LLVM_VERSION_MAJOR < 9
Constant *
#else
FunctionCallee
#endif
- c1 = M.getOrInsertFunction("__cmplog_ins_hook1", VoidTy, Int8Ty, Int8Ty
+ c1 = M.getOrInsertFunction("__cmplog_ins_hook1", VoidTy, Int8Ty, Int8Ty,
+ Int8Ty
#if LLVM_VERSION_MAJOR < 5
,
NULL
@@ -118,7 +136,8 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
#else
FunctionCallee
#endif
- c2 = M.getOrInsertFunction("__cmplog_ins_hook2", VoidTy, Int16Ty, Int16Ty
+ c2 = M.getOrInsertFunction("__cmplog_ins_hook2", VoidTy, Int16Ty, Int16Ty,
+ Int8Ty
#if LLVM_VERSION_MAJOR < 5
,
NULL
@@ -135,7 +154,8 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
#else
FunctionCallee
#endif
- c4 = M.getOrInsertFunction("__cmplog_ins_hook4", VoidTy, Int32Ty, Int32Ty
+ c4 = M.getOrInsertFunction("__cmplog_ins_hook4", VoidTy, Int32Ty, Int32Ty,
+ Int8Ty
#if LLVM_VERSION_MAJOR < 5
,
NULL
@@ -152,7 +172,8 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
#else
FunctionCallee
#endif
- c8 = M.getOrInsertFunction("__cmplog_ins_hook8", VoidTy, Int64Ty, Int64Ty
+ c8 = M.getOrInsertFunction("__cmplog_ins_hook8", VoidTy, Int64Ty, Int64Ty,
+ Int8Ty
#if LLVM_VERSION_MAJOR < 5
,
NULL
@@ -164,6 +185,42 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
FunctionCallee cmplogHookIns8 = c8;
#endif
+#if LLVM_VERSION_MAJOR < 9
+ Constant *
+#else
+ FunctionCallee
+#endif
+ c16 = M.getOrInsertFunction("__cmplog_ins_hook16", VoidTy, Int128Ty,
+ Int128Ty, Int8Ty
+#if LLVM_VERSION_MAJOR < 5
+ ,
+ NULL
+#endif
+ );
+#if LLVM_VERSION_MAJOR < 9
+ Function *cmplogHookIns16 = cast<Function>(c16);
+#else
+ FunctionCallee cmplogHookIns16 = c16;
+#endif
+
+#if LLVM_VERSION_MAJOR < 9
+ Constant *
+#else
+ FunctionCallee
+#endif
+ cN = M.getOrInsertFunction("__cmplog_ins_hookN", VoidTy, Int128Ty,
+ Int128Ty, Int8Ty, Int8Ty
+#if LLVM_VERSION_MAJOR < 5
+ ,
+ NULL
+#endif
+ );
+#if LLVM_VERSION_MAJOR < 9
+ Function *cmplogHookInsN = cast<Function>(cN);
+#else
+ FunctionCallee cmplogHookInsN = cN;
+#endif
+
/* iterate over all functions, bbs and instruction and add suitable calls */
for (auto &F : M) {
@@ -174,35 +231,16 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
for (auto &IN : BB) {
CmpInst *selectcmpInst = nullptr;
-
if ((selectcmpInst = dyn_cast<CmpInst>(&IN))) {
- if (selectcmpInst->getPredicate() == CmpInst::ICMP_EQ ||
- selectcmpInst->getPredicate() == CmpInst::ICMP_NE ||
- selectcmpInst->getPredicate() == CmpInst::ICMP_UGT ||
- selectcmpInst->getPredicate() == CmpInst::ICMP_SGT ||
- selectcmpInst->getPredicate() == CmpInst::ICMP_ULT ||
- selectcmpInst->getPredicate() == CmpInst::ICMP_SLT ||
- selectcmpInst->getPredicate() == CmpInst::ICMP_UGE ||
- selectcmpInst->getPredicate() == CmpInst::ICMP_SGE ||
- selectcmpInst->getPredicate() == CmpInst::ICMP_ULE ||
- selectcmpInst->getPredicate() == CmpInst::ICMP_SLE ||
- selectcmpInst->getPredicate() == CmpInst::FCMP_OGE ||
- selectcmpInst->getPredicate() == CmpInst::FCMP_UGE ||
- selectcmpInst->getPredicate() == CmpInst::FCMP_OLE ||
- selectcmpInst->getPredicate() == CmpInst::FCMP_ULE ||
- selectcmpInst->getPredicate() == CmpInst::FCMP_OGT ||
- selectcmpInst->getPredicate() == CmpInst::FCMP_UGT ||
- selectcmpInst->getPredicate() == CmpInst::FCMP_OLT ||
- selectcmpInst->getPredicate() == CmpInst::FCMP_ULT ||
- selectcmpInst->getPredicate() == CmpInst::FCMP_UEQ ||
- selectcmpInst->getPredicate() == CmpInst::FCMP_OEQ ||
- selectcmpInst->getPredicate() == CmpInst::FCMP_UNE ||
- selectcmpInst->getPredicate() == CmpInst::FCMP_ONE) {
-
- icomps.push_back(selectcmpInst);
+ icomps.push_back(selectcmpInst);
- }
+ }
+
+ SwitchInst *switchInst = nullptr;
+ if ((switchInst = dyn_cast<SwitchInst>(BB.getTerminator()))) {
+
+ if (switchInst->getNumCases() > 1) { switches.push_back(switchInst); }
}
@@ -212,101 +250,477 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
}
- if (!icomps.size()) return false;
- // if (!be_quiet) errs() << "Hooking " << icomps.size() << " cmp
- // instructions\n";
+ // unique the collected switches
+ switches.erase(Unique(switches.begin(), switches.end()), switches.end());
+
+ // Instrument switch values for cmplog
+ if (switches.size()) {
+
+ if (!be_quiet)
+ errs() << "Hooking " << switches.size() << " switch instructions\n";
+
+ for (auto &SI : switches) {
+
+ Value * Val = SI->getCondition();
+ unsigned int max_size = Val->getType()->getIntegerBitWidth(), cast_size;
+ unsigned char do_cast = 0;
+
+ if (!SI->getNumCases() || max_size <= 8) {
+
+ // if (!be_quiet) errs() << "skip trivial switch..\n";
+ continue;
+
+ }
+
+ IRBuilder<> IRB(SI->getParent());
+ IRB.SetInsertPoint(SI);
+
+ if (max_size % 8) {
+
+ max_size = (((max_size / 8) + 1) * 8);
+ do_cast = 1;
+
+ }
+
+ if (max_size > 128) {
+
+ if (!be_quiet) {
+
+ fprintf(stderr,
+ "Cannot handle this switch bit size: %u (truncating)\n",
+ max_size);
+
+ }
+
+ max_size = 128;
+ do_cast = 1;
+
+ }
+
+ // do we need to cast?
+ switch (max_size) {
+
+ case 8:
+ case 16:
+ case 32:
+ case 64:
+ case 128:
+ cast_size = max_size;
+ break;
+ default:
+ cast_size = 128;
+ do_cast = 1;
+
+ }
+
+ Value *CompareTo = Val;
+
+ if (do_cast) {
+
+ ConstantInt *cint = dyn_cast<ConstantInt>(Val);
+ if (cint) {
+
+ uint64_t val = cint->getZExtValue();
+ // fprintf(stderr, "ConstantInt: %lu\n", val);
+ switch (cast_size) {
+
+ case 8:
+ CompareTo = ConstantInt::get(Int8Ty, val);
+ break;
+ case 16:
+ CompareTo = ConstantInt::get(Int16Ty, val);
+ break;
+ case 32:
+ CompareTo = ConstantInt::get(Int32Ty, val);
+ break;
+ case 64:
+ CompareTo = ConstantInt::get(Int64Ty, val);
+ break;
+ case 128:
+ CompareTo = ConstantInt::get(Int128Ty, val);
+ break;
+
+ }
+
+ } else {
+
+ CompareTo = IRB.CreateBitCast(Val, IntegerType::get(C, cast_size));
+
+ }
+
+ }
+
+ for (SwitchInst::CaseIt i = SI->case_begin(), e = SI->case_end(); i != e;
+ ++i) {
+
+#if LLVM_VERSION_MAJOR < 5
+ ConstantInt *cint = i.getCaseValue();
+#else
+ ConstantInt *cint = i->getCaseValue();
+#endif
+
+ if (cint) {
+
+ std::vector<Value *> args;
+ args.push_back(CompareTo);
+
+ Value *new_param = cint;
- for (auto &selectcmpInst : icomps) {
+ if (do_cast) {
- IRBuilder<> IRB(selectcmpInst->getParent());
- IRB.SetInsertPoint(selectcmpInst);
+ uint64_t val = cint->getZExtValue();
+ // fprintf(stderr, "ConstantInt: %lu\n", val);
+ switch (cast_size) {
- auto op0 = selectcmpInst->getOperand(0);
- auto op1 = selectcmpInst->getOperand(1);
+ case 8:
+ new_param = ConstantInt::get(Int8Ty, val);
+ break;
+ case 16:
+ new_param = ConstantInt::get(Int16Ty, val);
+ break;
+ case 32:
+ new_param = ConstantInt::get(Int32Ty, val);
+ break;
+ case 64:
+ new_param = ConstantInt::get(Int64Ty, val);
+ break;
+ case 128:
+ new_param = ConstantInt::get(Int128Ty, val);
+ break;
- IntegerType * intTyOp0 = NULL;
- IntegerType * intTyOp1 = NULL;
- unsigned max_size = 0;
- std::vector<Value *> args;
+ }
- if (selectcmpInst->getOpcode() == Instruction::FCmp) {
+ }
+
+ if (new_param) {
+
+ args.push_back(new_param);
+ ConstantInt *attribute = ConstantInt::get(Int8Ty, 1);
+ args.push_back(attribute);
+ if (cast_size != max_size) {
+
+ ConstantInt *bitsize =
+ ConstantInt::get(Int8Ty, (max_size / 8) - 1);
+ args.push_back(bitsize);
+
+ }
+
+ switch (cast_size) {
+
+ case 8:
+ IRB.CreateCall(cmplogHookIns1, args);
+ break;
+ case 16:
+ IRB.CreateCall(cmplogHookIns2, args);
+ break;
+ case 32:
+ IRB.CreateCall(cmplogHookIns4, args);
+ break;
+ case 64:
+ IRB.CreateCall(cmplogHookIns8, args);
+ break;
+ case 128:
+#ifdef WORD_SIZE_64
+ if (max_size == 128) {
+
+ IRB.CreateCall(cmplogHookIns16, args);
+
+ } else {
+
+ IRB.CreateCall(cmplogHookInsN, args);
+
+ }
- auto ty0 = op0->getType();
- if (ty0->isHalfTy()
+#endif
+ break;
+ default:
+ break;
+
+ }
+
+ }
+
+ }
+
+ }
+
+ }
+
+ }
+
+ if (icomps.size()) {
+
+ // if (!be_quiet) errs() << "Hooking " << icomps.size() <<
+ // " cmp instructions\n";
+
+ for (auto &selectcmpInst : icomps) {
+
+ IRBuilder<> IRB(selectcmpInst->getParent());
+ IRB.SetInsertPoint(selectcmpInst);
+
+ Value *op0 = selectcmpInst->getOperand(0);
+ Value *op1 = selectcmpInst->getOperand(1);
+
+ IntegerType * intTyOp0 = NULL;
+ IntegerType * intTyOp1 = NULL;
+ unsigned max_size = 0, cast_size = 0;
+ unsigned char attr = 0, do_cast = 0;
+ std::vector<Value *> args;
+
+ CmpInst *cmpInst = dyn_cast<CmpInst>(selectcmpInst);
+
+ if (!cmpInst) { continue; }
+
+ switch (cmpInst->getPredicate()) {
+
+ case CmpInst::ICMP_NE:
+ case CmpInst::FCMP_UNE:
+ case CmpInst::FCMP_ONE:
+ break;
+ case CmpInst::ICMP_EQ:
+ case CmpInst::FCMP_UEQ:
+ case CmpInst::FCMP_OEQ:
+ attr += 1;
+ break;
+ case CmpInst::ICMP_UGT:
+ case CmpInst::ICMP_SGT:
+ case CmpInst::FCMP_OGT:
+ case CmpInst::FCMP_UGT:
+ attr += 2;
+ break;
+ case CmpInst::ICMP_UGE:
+ case CmpInst::ICMP_SGE:
+ case CmpInst::FCMP_OGE:
+ case CmpInst::FCMP_UGE:
+ attr += 3;
+ break;
+ case CmpInst::ICMP_ULT:
+ case CmpInst::ICMP_SLT:
+ case CmpInst::FCMP_OLT:
+ case CmpInst::FCMP_ULT:
+ attr += 4;
+ break;
+ case CmpInst::ICMP_ULE:
+ case CmpInst::ICMP_SLE:
+ case CmpInst::FCMP_OLE:
+ case CmpInst::FCMP_ULE:
+ attr += 5;
+ break;
+ default:
+ break;
+
+ }
+
+ if (selectcmpInst->getOpcode() == Instruction::FCmp) {
+
+ auto ty0 = op0->getType();
+ if (ty0->isHalfTy()
#if LLVM_VERSION_MAJOR >= 11
- || ty0->isBFloatTy()
+ || ty0->isBFloatTy()
#endif
- )
- max_size = 16;
- else if (ty0->isFloatTy())
- max_size = 32;
- else if (ty0->isDoubleTy())
- max_size = 64;
+ )
+ max_size = 16;
+ else if (ty0->isFloatTy())
+ max_size = 32;
+ else if (ty0->isDoubleTy())
+ max_size = 64;
+ else if (ty0->isX86_FP80Ty())
+ max_size = 80;
+ else if (ty0->isFP128Ty() || ty0->isPPC_FP128Ty())
+ max_size = 128;
+
+ attr += 8;
+ do_cast = 1;
- if (max_size) {
+ } else {
- Value *V0 = IRB.CreateBitCast(op0, IntegerType::get(C, max_size));
- intTyOp0 = dyn_cast<IntegerType>(V0->getType());
- Value *V1 = IRB.CreateBitCast(op1, IntegerType::get(C, max_size));
- intTyOp1 = dyn_cast<IntegerType>(V1->getType());
+ intTyOp0 = dyn_cast<IntegerType>(op0->getType());
+ intTyOp1 = dyn_cast<IntegerType>(op1->getType());
if (intTyOp0 && intTyOp1) {
max_size = intTyOp0->getBitWidth() > intTyOp1->getBitWidth()
? intTyOp0->getBitWidth()
: intTyOp1->getBitWidth();
- args.push_back(V0);
- args.push_back(V1);
- } else {
+ }
+
+ }
+
+ if (!max_size) { continue; }
+
+ // _ExtInt() with non-8th values
+ if (max_size % 8) {
+
+ max_size = (((max_size / 8) + 1) * 8);
+ do_cast = 1;
+
+ }
+
+ if (max_size > 128) {
- max_size = 0;
+ if (!be_quiet) {
+
+ fprintf(stderr,
+ "Cannot handle this compare bit size: %u (truncating)\n",
+ max_size);
}
+ max_size = 128;
+ do_cast = 1;
+
}
- } else {
+ // do we need to cast?
+ switch (max_size) {
+
+ case 8:
+ case 16:
+ case 32:
+ case 64:
+ case 128:
+ cast_size = max_size;
+ break;
+ default:
+ cast_size = 128;
+ do_cast = 1;
- intTyOp0 = dyn_cast<IntegerType>(op0->getType());
- intTyOp1 = dyn_cast<IntegerType>(op1->getType());
+ }
+
+ if (do_cast) {
+
+ // F*cking LLVM optimized out any kind of bitcasts of ConstantInt values
+ // creating illegal calls. WTF. So we have to work around this.
+
+ ConstantInt *cint = dyn_cast<ConstantInt>(op0);
+ if (cint) {
+
+ uint64_t val = cint->getZExtValue();
+ // fprintf(stderr, "ConstantInt: %lu\n", val);
+ ConstantInt *new_param = NULL;
+ switch (cast_size) {
+
+ case 8:
+ new_param = ConstantInt::get(Int8Ty, val);
+ break;
+ case 16:
+ new_param = ConstantInt::get(Int16Ty, val);
+ break;
+ case 32:
+ new_param = ConstantInt::get(Int32Ty, val);
+ break;
+ case 64:
+ new_param = ConstantInt::get(Int64Ty, val);
+ break;
+ case 128:
+ new_param = ConstantInt::get(Int128Ty, val);
+ break;
- if (intTyOp0 && intTyOp1) {
+ }
+
+ if (!new_param) { continue; }
+ args.push_back(new_param);
+
+ } else {
+
+ Value *V0 = IRB.CreateBitCast(op0, IntegerType::get(C, cast_size));
+ args.push_back(V0);
+
+ }
+
+ cint = dyn_cast<ConstantInt>(op1);
+ if (cint) {
+
+ uint64_t val = cint->getZExtValue();
+ ConstantInt *new_param = NULL;
+ switch (cast_size) {
+
+ case 8:
+ new_param = ConstantInt::get(Int8Ty, val);
+ break;
+ case 16:
+ new_param = ConstantInt::get(Int16Ty, val);
+ break;
+ case 32:
+ new_param = ConstantInt::get(Int32Ty, val);
+ break;
+ case 64:
+ new_param = ConstantInt::get(Int64Ty, val);
+ break;
+ case 128:
+ new_param = ConstantInt::get(Int128Ty, val);
+ break;
+
+ }
+
+ if (!new_param) { continue; }
+ args.push_back(new_param);
+
+ } else {
+
+ Value *V1 = IRB.CreateBitCast(op1, IntegerType::get(C, cast_size));
+ args.push_back(V1);
+
+ }
+
+ } else {
- max_size = intTyOp0->getBitWidth() > intTyOp1->getBitWidth()
- ? intTyOp0->getBitWidth()
- : intTyOp1->getBitWidth();
args.push_back(op0);
args.push_back(op1);
}
- }
+ ConstantInt *attribute = ConstantInt::get(Int8Ty, attr);
+ args.push_back(attribute);
+
+ if (cast_size != max_size) {
+
+ ConstantInt *bitsize = ConstantInt::get(Int8Ty, (max_size / 8) - 1);
+ args.push_back(bitsize);
+
+ }
+
+ // fprintf(stderr, "_ExtInt(%u) castTo %u with attr %u didcast %u\n",
+ // max_size, cast_size, attr, do_cast);
+
+ switch (cast_size) {
- if (max_size < 8 || max_size > 64 || !intTyOp0 || !intTyOp1) continue;
-
- switch (max_size) {
-
- case 8:
- IRB.CreateCall(cmplogHookIns1, args);
- break;
- case 16:
- IRB.CreateCall(cmplogHookIns2, args);
- break;
- case 32:
- IRB.CreateCall(cmplogHookIns4, args);
- break;
- case 64:
- IRB.CreateCall(cmplogHookIns8, args);
- break;
- default:
- break;
+ case 8:
+ IRB.CreateCall(cmplogHookIns1, args);
+ break;
+ case 16:
+ IRB.CreateCall(cmplogHookIns2, args);
+ break;
+ case 32:
+ IRB.CreateCall(cmplogHookIns4, args);
+ break;
+ case 64:
+ IRB.CreateCall(cmplogHookIns8, args);
+ break;
+ case 128:
+ if (max_size == 128) {
+
+ IRB.CreateCall(cmplogHookIns16, args);
+
+ } else {
+
+ IRB.CreateCall(cmplogHookInsN, args);
+
+ }
+
+ break;
+
+ }
}
}
- return true;
+ if (switches.size() || icomps.size())
+ return true;
+ else
+ return false;
}
diff --git a/instrumentation/llvm-ngram-coverage.h b/instrumentation/llvm-ngram-coverage.h
index 12b666e9..666839c8 100644
--- a/instrumentation/llvm-ngram-coverage.h
+++ b/instrumentation/llvm-ngram-coverage.h
@@ -1,7 +1,7 @@
#ifndef AFL_NGRAM_CONFIG_H
#define AFL_NGRAM_CONFIG_H
-#include "../config.h"
+#include "types.h"
#if (MAP_SIZE_POW2 <= 16)
typedef u16 PREV_LOC_T;
diff --git a/src/afl-cc.c b/src/afl-cc.c
index f3dfd49f..b0b11f48 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -529,9 +529,9 @@ static void edit_params(u32 argc, char **argv, char **envp) {
cc_params[cc_par_cnt++] = alloc_printf(
"-Wl,-mllvm=-load=%s/cmplog-routines-pass.so", obj_path);
cc_params[cc_par_cnt++] = alloc_printf(
- "-Wl,-mllvm=-load=%s/split-switches-pass.so", obj_path);
- cc_params[cc_par_cnt++] = alloc_printf(
"-Wl,-mllvm=-load=%s/cmplog-instructions-pass.so", obj_path);
+ cc_params[cc_par_cnt++] = alloc_printf(
+ "-Wl,-mllvm=-load=%s/split-switches-pass.so", obj_path);
} else {
@@ -541,18 +541,18 @@ static void edit_params(u32 argc, char **argv, char **envp) {
cc_params[cc_par_cnt++] =
alloc_printf("%s/cmplog-routines-pass.so", obj_path);
- // reuse split switches from laf
cc_params[cc_par_cnt++] = "-Xclang";
cc_params[cc_par_cnt++] = "-load";
cc_params[cc_par_cnt++] = "-Xclang";
cc_params[cc_par_cnt++] =
- alloc_printf("%s/split-switches-pass.so", obj_path);
+ alloc_printf("%s/cmplog-instructions-pass.so", obj_path);
+ // reuse split switches from laf
cc_params[cc_par_cnt++] = "-Xclang";
cc_params[cc_par_cnt++] = "-load";
cc_params[cc_par_cnt++] = "-Xclang";
cc_params[cc_par_cnt++] =
- alloc_printf("%s/cmplog-instructions-pass.so", obj_path);
+ alloc_printf("%s/split-switches-pass.so", obj_path);
}
@@ -687,6 +687,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
if (!strncmp(cur, "--afl", 5)) continue;
if (lto_mode && !strncmp(cur, "-fuse-ld=", 9)) continue;
if (lto_mode && !strncmp(cur, "--ld-path=", 10)) continue;
+ if (!strncmp(cur, "-fno-unroll", 11)) continue;
if (!strcmp(cur, "-Wl,-z,defs") || !strcmp(cur, "-Wl,--no-undefined"))
continue;
@@ -707,7 +708,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
if (!strcmp(cur, "-shared")) shared_linking = 1;
if (!strncmp(cur, "-O", 2)) have_o = 1;
- if (!strncmp(cur, "-f", 2) && strstr(cur, "unroll-loop")) have_unroll = 1;
+ if (!strncmp(cur, "-funroll-loop", 13)) have_unroll = 1;
cc_params[cc_par_cnt++] = cur;
@@ -796,10 +797,8 @@ static void edit_params(u32 argc, char **argv, char **envp) {
}
-#if defined(USEMMAP)
- #if !defined(__HAIKU__)
+#if defined(USEMMAP) && !defined(__HAIKU__)
cc_params[cc_par_cnt++] = "-lrt";
- #endif
#endif
cc_params[cc_par_cnt++] = "-D__AFL_HAVE_MANUAL_CONTROL=1";
@@ -971,10 +970,8 @@ static void edit_params(u32 argc, char **argv, char **envp) {
alloc_printf("-Wl,--dynamic-list=%s/dynamic_list.txt", obj_path);
#endif
- #if defined(USEMMAP)
- #if !defined(__HAIKU__)
+ #if defined(USEMMAP) && !defined(__HAIKU__)
cc_params[cc_par_cnt++] = "-lrt";
- #endif
#endif
}
@@ -1286,7 +1283,6 @@ int main(int argc, char **argv, char **envp) {
}
- // this is a hidden option
if (strncasecmp(ptr2, "llvmnative", strlen("llvmnative")) == 0 ||
strncasecmp(ptr2, "llvm-native", strlen("llvm-native")) == 0) {
@@ -1357,29 +1353,28 @@ int main(int argc, char **argv, char **envp) {
if (strncasecmp(ptr2, "ngram", strlen("ngram")) == 0) {
- ptr2 += strlen("ngram");
- while (*ptr2 && (*ptr2 < '0' || *ptr2 > '9'))
- ptr2++;
+ u8 *ptr3 = ptr2 + strlen("ngram");
+ while (*ptr3 && (*ptr3 < '0' || *ptr3 > '9'))
+ ptr3++;
- if (!*ptr2) {
+ if (!*ptr3) {
- if ((ptr2 = getenv("AFL_LLVM_NGRAM_SIZE")) == NULL)
+ if ((ptr3 = getenv("AFL_LLVM_NGRAM_SIZE")) == NULL)
FATAL(
"you must set the NGRAM size with (e.g. for value 2) "
"AFL_LLVM_INSTRUMENT=ngram-2");
}
- ngram_size = atoi(ptr2);
+ ngram_size = atoi(ptr3);
if (ngram_size < 2 || ngram_size > NGRAM_SIZE_MAX)
FATAL(
"NGRAM instrumentation option must be between 2 and "
- "NGRAM_SIZE_MAX "
- "(%u)",
+ "NGRAM_SIZE_MAX (%u)",
NGRAM_SIZE_MAX);
instrument_opt_mode |= (INSTRUMENT_OPT_NGRAM);
- ptr2 = alloc_printf("%u", ngram_size);
- setenv("AFL_LLVM_NGRAM_SIZE", ptr2, 1);
+ u8 *ptr4 = alloc_printf("%u", ngram_size);
+ setenv("AFL_LLVM_NGRAM_SIZE", ptr4, 1);
}
@@ -1515,6 +1510,7 @@ int main(int argc, char **argv, char **envp) {
"((instrumentation/README.ngram.md)\n"
" INSTRIM: Dominator tree (for LLVM <= 6.0) "
"(instrumentation/README.instrim.md)\n\n");
+
#undef NATIVE_MSG
SAYF(
@@ -1649,16 +1645,15 @@ int main(int argc, char **argv, char **envp) {
if (have_lto)
SAYF("afl-cc LTO with ld=%s %s\n", AFL_REAL_LD, AFL_CLANG_FLTO);
if (have_llvm)
- SAYF("afl-cc LLVM version %d using binary path \"%s\".\n", LLVM_MAJOR,
+ SAYF("afl-cc LLVM version %d using the binary path \"%s\".\n", LLVM_MAJOR,
LLVM_BINDIR);
#endif
-#if defined(USEMMAP)
+#ifdef USEMMAP
#if !defined(__HAIKU__)
- cc_params[cc_par_cnt++] = "-lrt";
- SAYF("Compiled with shm_open support (adds -lrt when linking).\n");
- #else
SAYF("Compiled with shm_open support.\n");
+ #else
+ SAYF("Compiled with shm_open support (adds -lrt when linking).\n");
#endif
#else
SAYF("Compiled with shmat support.\n");
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 39f044f2..50e4139b 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -58,7 +58,7 @@ static list_t fsrv_list = {.element_prealloc_count = 0};
static void fsrv_exec_child(afl_forkserver_t *fsrv, char **argv) {
- if (fsrv->qemu_mode) setenv("AFL_DISABLE_LLVM_INSTRUMENTATION", "1", 0);
+ if (fsrv->qemu_mode) { setenv("AFL_DISABLE_LLVM_INSTRUMENTATION", "1", 0); }
execv(fsrv->target_path, argv);
@@ -396,6 +396,12 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
struct rlimit r;
+ if (!fsrv->cmplog_binary && fsrv->qemu_mode == false) {
+
+ unsetenv(CMPLOG_SHM_ENV_VAR); // we do not want that in non-cmplog fsrv
+
+ }
+
/* Umpf. On OpenBSD, the default fd limit for root users is set to
soft 128. Let's try to fix that... */
if (!getrlimit(RLIMIT_NOFILE, &r) && r.rlim_cur < FORKSRV_FD + 2) {
diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c
index 8ffc6e1b..27c6c413 100644
--- a/src/afl-fuzz-cmplog.c
+++ b/src/afl-fuzz-cmplog.c
@@ -33,6 +33,8 @@ void cmplog_exec_child(afl_forkserver_t *fsrv, char **argv) {
setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1);
+ if (fsrv->qemu_mode) { setenv("AFL_DISABLE_LLVM_INSTRUMENTATION", "1", 0); }
+
if (!fsrv->qemu_mode && argv[0] != fsrv->cmplog_binary) {
argv[0] = fsrv->cmplog_binary;
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index dbffa4f9..cbff6d7e 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -729,6 +729,30 @@ void read_testcases(afl_state_t *afl, u8 *directory) {
add_to_queue(afl, fn2, st.st_size >= MAX_FILE ? MAX_FILE : st.st_size,
passed_det);
+ if (unlikely(afl->shm.cmplog_mode)) {
+
+ if (afl->cmplog_lvl == 1) {
+
+ if (!afl->cmplog_max_filesize ||
+ afl->cmplog_max_filesize < st.st_size) {
+
+ afl->cmplog_max_filesize = st.st_size;
+
+ }
+
+ } else if (afl->cmplog_lvl == 2) {
+
+ if (!afl->cmplog_max_filesize ||
+ afl->cmplog_max_filesize > st.st_size) {
+
+ afl->cmplog_max_filesize = st.st_size;
+
+ }
+
+ }
+
+ }
+
if (unlikely(afl->schedule >= FAST && afl->schedule <= RARE)) {
u64 cksum = hash64(afl->fsrv.trace_bits, afl->fsrv.map_size, HASH_CONST);
@@ -756,6 +780,20 @@ void read_testcases(afl_state_t *afl, u8 *directory) {
}
+ if (unlikely(afl->shm.cmplog_mode)) {
+
+ if (afl->cmplog_max_filesize < 1024) {
+
+ afl->cmplog_max_filesize = 1024;
+
+ } else {
+
+ afl->cmplog_max_filesize = (((afl->cmplog_max_filesize >> 10) + 1) << 10);
+
+ }
+
+ }
+
afl->last_path_time = 0;
afl->queued_at_start = afl->queued_paths;
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index f9509e86..4ce22c08 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -165,7 +165,7 @@ static u8 could_be_arith(u32 old_val, u32 new_val, u8 blen) {
/* See if one-byte adjustments to any byte could produce this result. */
- for (i = 0; i < blen; ++i) {
+ for (i = 0; (u8)i < blen; ++i) {
u8 a = old_val >> (8 * i), b = new_val >> (8 * i);
@@ -193,7 +193,7 @@ static u8 could_be_arith(u32 old_val, u32 new_val, u8 blen) {
diffs = 0;
- for (i = 0; i < blen / 2; ++i) {
+ for (i = 0; (u8)i < blen / 2; ++i) {
u16 a = old_val >> (16 * i), b = new_val >> (16 * i);
@@ -290,7 +290,7 @@ static u8 could_be_interest(u32 old_val, u32 new_val, u8 blen, u8 check_le) {
/* See if two-byte insertions over old_val could give us new_val. */
- for (i = 0; (s32)i < blen - 1; ++i) {
+ for (i = 0; (u8)i < blen - 1; ++i) {
for (j = 0; j < sizeof(interesting_16) / 2; ++j) {
@@ -545,14 +545,30 @@ u8 fuzz_one_original(afl_state_t *afl) {
else
orig_perf = perf_score = calculate_score(afl, afl->queue_cur);
- if (unlikely(perf_score == 0)) { goto abandon_entry; }
+ if (unlikely(perf_score <= 0)) { goto abandon_entry; }
- if (unlikely(afl->shm.cmplog_mode && !afl->queue_cur->fully_colorized)) {
+ if (unlikely(afl->shm.cmplog_mode &&
+ afl->queue_cur->colorized < afl->cmplog_lvl &&
+ (u32)len <= afl->cmplog_max_filesize)) {
- if (input_to_state_stage(afl, in_buf, out_buf, len,
- afl->queue_cur->exec_cksum)) {
+ if (unlikely(len < 4)) {
- goto abandon_entry;
+ afl->queue_cur->colorized = 0xff;
+
+ } else {
+
+ if (afl->cmplog_lvl == 3 ||
+ (afl->cmplog_lvl == 2 && afl->queue_cur->tc_ref) ||
+ !(afl->fsrv.total_execs % afl->queued_paths) ||
+ get_cur_time() - afl->last_path_time > 15000) {
+
+ if (input_to_state_stage(afl, in_buf, out_buf, len)) {
+
+ goto abandon_entry;
+
+ }
+
+ }
}
@@ -2796,7 +2812,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
}
- s32 len, temp_len;
+ u32 len, temp_len;
u32 i;
u32 j;
u8 *in_buf, *out_buf, *orig_in, *ex_tmp, *eff_map = 0;
@@ -2952,14 +2968,30 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
else
orig_perf = perf_score = calculate_score(afl, afl->queue_cur);
- if (unlikely(perf_score == 0)) { goto abandon_entry; }
+ if (unlikely(perf_score <= 0)) { goto abandon_entry; }
- if (unlikely(afl->shm.cmplog_mode && !afl->queue_cur->fully_colorized)) {
+ if (unlikely(afl->shm.cmplog_mode &&
+ afl->queue_cur->colorized < afl->cmplog_lvl &&
+ (u32)len <= afl->cmplog_max_filesize)) {
- if (input_to_state_stage(afl, in_buf, out_buf, len,
- afl->queue_cur->exec_cksum)) {
+ if (unlikely(len < 4)) {
- goto abandon_entry;
+ afl->queue_cur->colorized = 0xff;
+
+ } else {
+
+ if (afl->cmplog_lvl == 3 ||
+ (afl->cmplog_lvl == 2 && afl->queue_cur->tc_ref) ||
+ !(afl->fsrv.total_execs % afl->queued_paths) ||
+ get_cur_time() - afl->last_path_time > 15000) {
+
+ if (input_to_state_stage(afl, in_buf, out_buf, len)) {
+
+ goto abandon_entry;
+
+ }
+
+ }
}
@@ -3315,7 +3347,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
orig_hit_cnt = new_hit_cnt;
- for (i = 0; (s32)i < len - 1; ++i) {
+ for (i = 0; i < len - 1; ++i) {
/* Let's consult the effector map... */
@@ -3357,7 +3389,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
orig_hit_cnt = new_hit_cnt;
- for (i = 0; (s32)i < len - 3; ++i) {
+ for (i = 0; i < len - 3; ++i) {
/* Let's consult the effector map... */
if (!eff_map[EFF_APOS(i)] && !eff_map[EFF_APOS(i + 1)] &&
@@ -3489,7 +3521,7 @@ skip_bitflip:
orig_hit_cnt = new_hit_cnt;
- for (i = 0; (s32)i < len - 1; ++i) {
+ for (i = 0; i < len - 1; ++i) {
u16 orig = *(u16 *)(out_buf + i);
@@ -3615,7 +3647,7 @@ skip_bitflip:
orig_hit_cnt = new_hit_cnt;
- for (i = 0; (s32)i < len - 3; ++i) {
+ for (i = 0; i < len - 3; ++i) {
u32 orig = *(u32 *)(out_buf + i);
@@ -3805,7 +3837,7 @@ skip_arith:
orig_hit_cnt = new_hit_cnt;
- for (i = 0; (s32)i < len - 1; ++i) {
+ for (i = 0; i < len - 1; ++i) {
u16 orig = *(u16 *)(out_buf + i);
@@ -3891,7 +3923,7 @@ skip_arith:
orig_hit_cnt = new_hit_cnt;
- for (i = 0; (s32)i < len - 3; ++i) {
+ for (i = 0; i < len - 3; ++i) {
u32 orig = *(u32 *)(out_buf + i);
@@ -4120,7 +4152,7 @@ skip_user_extras:
/* See the comment in the earlier code; extras are sorted by size. */
- if ((s32)(afl->a_extras[j].len) > (s32)(len - i) ||
+ if ((afl->a_extras[j].len) > (len - i) ||
!memcmp(afl->a_extras[j].data, out_buf + i, afl->a_extras[j].len) ||
!memchr(eff_map + EFF_APOS(i), 1,
EFF_SPAN_ALEN(i, afl->a_extras[j].len))) {
@@ -4837,7 +4869,7 @@ pacemaker_fuzzing:
u32 copy_from, copy_to, copy_len;
copy_len = choose_block_len(afl, new_len - 1);
- if ((s32)copy_len > temp_len) copy_len = temp_len;
+ if (copy_len > temp_len) copy_len = temp_len;
copy_from = rand_below(afl, new_len - copy_len + 1);
copy_to = rand_below(afl, temp_len - copy_len + 1);
@@ -5033,8 +5065,7 @@ pacemaker_fuzzing:
the last differing byte. Bail out if the difference is just a single
byte or so. */
- locate_diffs(in_buf, new_buf, MIN(len, (s32)target->len), &f_diff,
- &l_diff);
+ locate_diffs(in_buf, new_buf, MIN(len, target->len), &f_diff, &l_diff);
if (f_diff < 0 || l_diff < 2 || f_diff == l_diff) {
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index 66938635..aec57a6e 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -433,6 +433,7 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
q->passed_det = passed_det;
q->trace_mini = NULL;
q->testcase_buf = NULL;
+ q->mother = afl->queue_cur;
#ifdef INTROSPECTION
q->bitsmap_size = afl->bitsmap_size;
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index 28585afe..d631332a 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -28,13 +28,43 @@
#include "afl-fuzz.h"
#include "cmplog.h"
-///// Colorization
+//#define _DEBUG
+//#define COMBINE
+//#define CMPLOG_INTROSPECTION
+//#define ARITHMETIC_LESSER_GREATER
+//#define TRANSFORM
+//#define TRANSFORM_BASE64
+
+// CMP attribute enum
+enum {
+
+ IS_EQUAL = 1, // arithemtic equal comparison
+ IS_GREATER = 2, // arithmetic greater comparison
+ IS_LESSER = 4, // arithmetic lesser comparison
+ IS_FP = 8, // is a floating point, not an integer
+ /* --- below are internal settings, not from target cmplog */
+ IS_FP_MOD = 16, // arithemtic changed floating point
+ IS_INT_MOD = 32, // arithmetic changed interger
+ IS_TRANSFORM = 64 // transformed integer
+
+};
+
+// CMPLOG LVL
+enum {
+
+ LVL1 = 1, // Integer solving
+ LVL2 = 2, // FP solving
+ LVL3 = 4 // expensive tranformations
+
+};
struct range {
u32 start;
u32 end;
struct range *next;
+ struct range *prev;
+ u8 ok;
};
@@ -44,6 +74,8 @@ static struct range *add_range(struct range *ranges, u32 start, u32 end) {
r->start = start;
r->end = end;
r->next = ranges;
+ r->ok = 0;
+ if (likely(ranges)) ranges->prev = r;
return r;
}
@@ -51,155 +83,357 @@ static struct range *add_range(struct range *ranges, u32 start, u32 end) {
static struct range *pop_biggest_range(struct range **ranges) {
struct range *r = *ranges;
- struct range *prev = NULL;
struct range *rmax = NULL;
- struct range *prev_rmax = NULL;
u32 max_size = 0;
while (r) {
- u32 s = r->end - r->start;
- if (s >= max_size) {
+ if (!r->ok) {
- max_size = s;
- prev_rmax = prev;
- rmax = r;
+ u32 s = 1 + r->end - r->start;
+
+ if (s >= max_size) {
+
+ max_size = s;
+ rmax = r;
+
+ }
}
- prev = r;
r = r->next;
}
- if (rmax) {
+ return rmax;
+
+}
- if (prev_rmax) {
+#ifdef _DEBUG
+// static int logging = 0;
+static void dump(char *txt, u8 *buf, u32 len) {
- prev_rmax->next = rmax->next;
+ u32 i;
+ fprintf(stderr, "DUMP %s %016llx ", txt, hash64(buf, len, HASH_CONST));
+ for (i = 0; i < len; i++)
+ fprintf(stderr, "%02x", buf[i]);
+ fprintf(stderr, "\n");
- } else {
+}
- *ranges = rmax->next;
+static void dump_file(char *path, char *name, u32 counter, u8 *buf, u32 len) {
- }
+ char fn[4096];
+ if (!path) path = ".";
+ snprintf(fn, sizeof(fn), "%s/%s%d", path, name, counter);
+ int fd = open(fn, O_RDWR | O_CREAT | O_TRUNC, 0644);
+ if (fd >= 0) {
- }
+ write(fd, buf, len);
+ close(fd);
- return rmax;
+ }
}
+#endif
+
static u8 get_exec_checksum(afl_state_t *afl, u8 *buf, u32 len, u64 *cksum) {
if (unlikely(common_fuzz_stuff(afl, buf, len))) { return 1; }
*cksum = hash64(afl->fsrv.trace_bits, afl->fsrv.map_size, HASH_CONST);
+
return 0;
}
-static void xor_replace(u8 *buf, u32 len) {
+/* replace everything with different values but stay in the same type */
+static void type_replace(afl_state_t *afl, u8 *buf, u32 len) {
u32 i;
+ u8 c;
for (i = 0; i < len; ++i) {
- buf[i] ^= 0xff;
+ // wont help for UTF or non-latin charsets
+ do {
+
+ switch (buf[i]) {
+
+ case 'A' ... 'F':
+ c = 'A' + rand_below(afl, 1 + 'F' - 'A');
+ break;
+ case 'a' ... 'f':
+ c = 'a' + rand_below(afl, 1 + 'f' - 'a');
+ break;
+ case '0':
+ c = '1';
+ break;
+ case '1':
+ c = '0';
+ break;
+ case '2' ... '9':
+ c = '2' + rand_below(afl, 1 + '9' - '2');
+ break;
+ case 'G' ... 'Z':
+ c = 'G' + rand_below(afl, 1 + 'Z' - 'G');
+ break;
+ case 'g' ... 'z':
+ c = 'g' + rand_below(afl, 1 + 'z' - 'g');
+ break;
+ case '!' ... '*':
+ c = '!' + rand_below(afl, 1 + '*' - '!');
+ break;
+ case ',' ... '.':
+ c = ',' + rand_below(afl, 1 + '.' - ',');
+ break;
+ case ':' ... '@':
+ c = ':' + rand_below(afl, 1 + '@' - ':');
+ break;
+ case '[' ... '`':
+ c = '[' + rand_below(afl, 1 + '`' - '[');
+ break;
+ case '{' ... '~':
+ c = '{' + rand_below(afl, 1 + '~' - '{');
+ break;
+ case '+':
+ c = '/';
+ break;
+ case '/':
+ c = '+';
+ break;
+ case ' ':
+ c = '\t';
+ break;
+ case '\t':
+ c = ' ';
+ break;
+ /*
+ case '\r':
+ case '\n':
+ // nothing ...
+ break;
+ */
+ default:
+ c = (buf[i] ^ 0xff);
+
+ }
+
+ } while (c == buf[i]);
+
+ buf[i] = c;
}
}
-static u8 colorization(afl_state_t *afl, u8 *buf, u32 len, u64 exec_cksum) {
+static u8 colorization(afl_state_t *afl, u8 *buf, u32 len,
+ struct tainted **taints) {
- struct range *ranges = add_range(NULL, 0, len);
- u8 * backup = ck_alloc_nozero(len);
+ struct range * ranges = add_range(NULL, 0, len - 1), *rng;
+ struct tainted *taint = NULL;
+ u8 * backup = ck_alloc_nozero(len);
+ u8 * changed = ck_alloc_nozero(len);
- u64 orig_hit_cnt, new_hit_cnt;
+#if defined(_DEBUG) || defined(CMPLOG_INTROSPECTION)
+ u64 start_time = get_cur_time();
+#endif
+
+ u32 screen_update = 1000000 / afl->queue_cur->exec_us;
+ u64 orig_hit_cnt, new_hit_cnt, exec_cksum;
orig_hit_cnt = afl->queued_paths + afl->unique_crashes;
afl->stage_name = "colorization";
afl->stage_short = "colorization";
- afl->stage_max = 1000;
-
- struct range *rng = NULL;
+ afl->stage_max = (len << 1);
afl->stage_cur = 0;
+
+ // in colorization we do not classify counts, hence we have to calculate
+ // the original checksum!
+ if (unlikely(get_exec_checksum(afl, buf, len, &exec_cksum))) {
+
+ goto checksum_fail;
+
+ }
+
+ memcpy(backup, buf, len);
+ memcpy(changed, buf, len);
+ type_replace(afl, changed, len);
+
while ((rng = pop_biggest_range(&ranges)) != NULL &&
afl->stage_cur < afl->stage_max) {
- u32 s = rng->end - rng->start;
+ u32 s = 1 + rng->end - rng->start;
- if (s != 0) {
+ memcpy(buf + rng->start, changed + rng->start, s);
- /* Range not empty */
+ u64 cksum = 0;
+ u64 start_us = get_cur_time_us();
+ if (unlikely(get_exec_checksum(afl, buf, len, &cksum))) {
- memcpy(backup, buf + rng->start, s);
- xor_replace(buf + rng->start, s);
+ goto checksum_fail;
- u64 cksum;
- u64 start_us = get_cur_time_us();
- if (unlikely(get_exec_checksum(afl, buf, len, &cksum))) {
+ }
- goto checksum_fail;
+ u64 stop_us = get_cur_time_us();
+
+ /* Discard if the mutations change the path or if it is too decremental
+ in speed - how could the same path have a much different speed
+ though ...*/
+ if (cksum != exec_cksum ||
+ (unlikely(stop_us - start_us > 3 * afl->queue_cur->exec_us) &&
+ likely(!afl->fixed_seed))) {
+
+ memcpy(buf + rng->start, backup + rng->start, s);
+
+ if (s > 1) { // to not add 0 size ranges
+
+ ranges = add_range(ranges, rng->start, rng->start - 1 + s / 2);
+ ranges = add_range(ranges, rng->start + s / 2, rng->end);
}
- u64 stop_us = get_cur_time_us();
+ if (ranges == rng) {
+
+ ranges = rng->next;
+ if (ranges) { ranges->prev = NULL; }
+
+ } else if (rng->next) {
- /* Discard if the mutations change the paths or if it is too decremental
- in speed */
- if (cksum != exec_cksum ||
- ((stop_us - start_us > 2 * afl->queue_cur->exec_us) &&
- likely(!afl->fixed_seed))) {
+ rng->prev->next = rng->next;
+ rng->next->prev = rng->prev;
- ranges = add_range(ranges, rng->start, rng->start + s / 2);
- ranges = add_range(ranges, rng->start + s / 2 + 1, rng->end);
- memcpy(buf + rng->start, backup, s);
+ } else {
+
+ if (rng->prev) { rng->prev->next = NULL; }
}
+ free(rng);
+
+ } else {
+
+ rng->ok = 1;
+
}
- ck_free(rng);
- rng = NULL;
- ++afl->stage_cur;
+ if (++afl->stage_cur % screen_update) { show_stats(afl); };
}
- if (afl->stage_cur < afl->stage_max) { afl->queue_cur->fully_colorized = 1; }
+ rng = ranges;
+ while (rng) {
- new_hit_cnt = afl->queued_paths + afl->unique_crashes;
- afl->stage_finds[STAGE_COLORIZATION] += new_hit_cnt - orig_hit_cnt;
- afl->stage_cycles[STAGE_COLORIZATION] += afl->stage_cur;
- ck_free(backup);
+ rng = rng->next;
- ck_free(rng);
- rng = NULL;
+ }
- while (ranges) {
+ u32 i = 1;
+ u32 positions = 0;
+ while (i) {
+ restart:
+ i = 0;
+ struct range *r = NULL;
+ u32 pos = (u32)-1;
rng = ranges;
- ranges = rng->next;
- ck_free(rng);
- rng = NULL;
- }
+ while (rng) {
- return 0;
+ if (rng->ok == 1 && rng->start < pos) {
-checksum_fail:
- if (rng) { ck_free(rng); }
- ck_free(backup);
+ if (taint && taint->pos + taint->len == rng->start) {
+
+ taint->len += (1 + rng->end - rng->start);
+ positions += (1 + rng->end - rng->start);
+ rng->ok = 2;
+ goto restart;
+
+ } else {
+
+ r = rng;
+ pos = rng->start;
+
+ }
+
+ }
+
+ rng = rng->next;
+
+ }
+
+ if (r) {
+
+ struct tainted *t = ck_alloc_nozero(sizeof(struct tainted));
+ t->pos = r->start;
+ t->len = 1 + r->end - r->start;
+ positions += (1 + r->end - r->start);
+ if (likely(taint)) { taint->prev = t; }
+ t->next = taint;
+ t->prev = NULL;
+ taint = t;
+ r->ok = 2;
+ i = 1;
+ }
+
+ }
+
+ *taints = taint;
+
+ /* temporary: clean ranges */
while (ranges) {
rng = ranges;
ranges = rng->next;
ck_free(rng);
- rng = NULL;
}
+ new_hit_cnt = afl->queued_paths + afl->unique_crashes;
+
+#if defined(_DEBUG) || defined(CMPLOG_INTROSPECTION)
+ FILE *f = stderr;
+ #ifndef _DEBUG
+ if (afl->not_on_tty) {
+
+ char fn[4096];
+ snprintf(fn, sizeof(fn), "%s/introspection_cmplog.txt", afl->out_dir);
+ f = fopen(fn, "a");
+
+ }
+
+ #endif
+
+ if (f) {
+
+ fprintf(
+ f,
+ "Colorization: fname=%s len=%u ms=%llu result=%u execs=%u found=%llu "
+ "taint=%u\n",
+ afl->queue_cur->fname, len, get_cur_time() - start_time,
+ afl->queue_cur->colorized, afl->stage_cur, new_hit_cnt - orig_hit_cnt,
+ positions);
+
+ #ifndef _DEBUG
+ if (afl->not_on_tty) { fclose(f); }
+ #endif
+
+ }
+
+#endif
+
+ afl->stage_finds[STAGE_COLORIZATION] += new_hit_cnt - orig_hit_cnt;
+ afl->stage_cycles[STAGE_COLORIZATION] += afl->stage_cur;
+ ck_free(backup);
+ ck_free(changed);
+
+ return 0;
+
+checksum_fail:
+ ck_free(backup);
+ ck_free(changed);
+
return 1;
}
@@ -212,12 +446,19 @@ static u8 its_fuzz(afl_state_t *afl, u8 *buf, u32 len, u8 *status) {
orig_hit_cnt = afl->queued_paths + afl->unique_crashes;
+#ifdef _DEBUG
+ dump("DATA", buf, len);
+#endif
+
if (unlikely(common_fuzz_stuff(afl, buf, len))) { return 1; }
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
if (unlikely(new_hit_cnt != orig_hit_cnt)) {
+#ifdef _DEBUG
+ fprintf(stderr, "NEW FIND\n");
+#endif
*status = 1;
} else {
@@ -230,6 +471,7 @@ static u8 its_fuzz(afl_state_t *afl, u8 *buf, u32 len, u8 *status) {
}
+#ifdef TRANSFORM
static int strntoll(const char *str, size_t sz, char **end, int base,
long long *out) {
@@ -277,12 +519,161 @@ static int strntoull(const char *str, size_t sz, char **end, int base,
}
-static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
- u64 pattern, u64 repl, u64 o_pattern, u32 idx,
- u8 *orig_buf, u8 *buf, u32 len, u8 do_reverse,
- u8 *status) {
+static u8 hex_table_up[16] = {'0', '1', '2', '3', '4', '5', '6', '7',
+ '8', '9', 'A', 'B', 'C', 'D', 'E', 'F'};
+static u8 hex_table_low[16] = {'0', '1', '2', '3', '4', '5', '6', '7',
+ '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'};
+static u8 hex_table[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 0, 0, 0,
+ 0, 0, 0, 10, 11, 12, 13, 14, 15, 0, 0, 0, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 10, 11, 12, 13, 14, 15};
+
+// tests 2 bytes at location
+static int is_hex(const char *str) {
+
+ u32 i;
+
+ for (i = 0; i < 2; i++) {
+
+ switch (str[i]) {
+
+ case '0' ... '9':
+ case 'A' ... 'F':
+ case 'a' ... 'f':
+ break;
+ default:
+ return 0;
+
+ }
+
+ }
+
+ return 1;
+
+}
+
+ #ifdef TRANSFORM_BASE64
+// tests 4 bytes at location
+static int is_base64(const char *str) {
+
+ u32 i;
+
+ for (i = 0; i < 4; i++) {
+
+ switch (str[i]) {
+
+ case '0' ... '9':
+ case 'A' ... 'Z':
+ case 'a' ... 'z':
+ case '+':
+ case '/':
+ case '=':
+ break;
+ default:
+ return 0;
+
+ }
+
+ }
+
+ return 1;
+
+}
+
+static u8 base64_encode_table[] =
+ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+static u8 base64_decode_table[] = {
+
+ 62, 0, 0, 0, 63, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 0,
+ 0, 0, 0, 0, 0, 0, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9,
+ 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25,
+ 0, 0, 0, 0, 0, 0, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35,
+ 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51};
+
+static u32 from_base64(u8 *src, u8 *dst, u32 dst_len) {
+
+ u32 i, j, v;
+ u32 len = ((dst_len / 3) << 2);
+ u32 ret = 0;
+
+ for (i = 0, j = 0; i < len; i += 4, j += 3) {
+
+ v = base64_decode_table[src[i] - 43];
+ v = (v << 6) | base64_decode_table[src[i + 1] - 43];
+ v = src[i + 2] == '=' ? v << 6
+ : (v << 6) | base64_decode_table[src[i + 2] - 43];
+ v = src[i + 3] == '=' ? v << 6
+ : (v << 6) | base64_decode_table[src[i + 3] - 43];
+
+ dst[j] = (v >> 16) & 0xFF;
+ ++ret;
+
+ if (src[i + 2] != '=') {
+
+ dst[j + 1] = (v >> 8) & 0xFF;
+ ++ret;
+
+ }
- if (!buf) { FATAL("BUG: buf was NULL. Please report this.\n"); }
+ if (src[i + 3] != '=') {
+
+ dst[j + 2] = v & 0xFF;
+ ++ret;
+
+ }
+
+ }
+
+ return ret;
+
+}
+
+static void to_base64(u8 *src, u8 *dst, u32 dst_len) {
+
+ u32 i, j, v;
+ u32 len = (dst_len >> 2) * 3;
+
+ for (i = 0, j = 0; i < len; i += 3, j += 4) {
+
+ v = src[i];
+ v = i + 1 < len ? v << 8 | src[i + 1] : v << 8;
+ v = i + 2 < len ? v << 8 | src[i + 2] : v << 8;
+
+ dst[j] = base64_encode_table[(v >> 18) & 0x3F];
+ dst[j + 1] = base64_encode_table[(v >> 12) & 0x3F];
+ if (i + 1 < len) {
+
+ dst[j + 2] = base64_encode_table[(v >> 6) & 0x3F];
+
+ } else {
+
+ dst[j + 2] = '=';
+
+ }
+
+ if (i + 2 < len) {
+
+ dst[j + 3] = base64_encode_table[v & 0x3F];
+
+ } else {
+
+ dst[j + 3] = '=';
+
+ }
+
+ }
+
+}
+
+ #endif
+
+#endif
+
+static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
+ u64 pattern, u64 repl, u64 o_pattern,
+ u64 changed_val, u8 attr, u32 idx, u32 taint_len,
+ u8 *orig_buf, u8 *buf, u8 *cbuf, u32 len,
+ u8 do_reverse, u8 lvl, u8 *status) {
u64 *buf_64 = (u64 *)&buf[idx];
u32 *buf_32 = (u32 *)&buf[idx];
@@ -293,102 +684,424 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
u16 *o_buf_16 = (u16 *)&orig_buf[idx];
u8 * o_buf_8 = &orig_buf[idx];
- u32 its_len = len - idx;
- // *status = 0;
+ u32 its_len = MIN(len - idx, taint_len);
- u8 * endptr;
- u8 use_num = 0, use_unum = 0;
- unsigned long long unum;
- long long num;
+ // fprintf(stderr,
+ // "Encode: %llx->%llx into %llx(<-%llx) at idx=%u "
+ // "taint_len=%u shape=%u attr=%u\n",
+ // o_pattern, pattern, repl, changed_val, idx, taint_len,
+ // h->shape + 1, attr);
- if (afl->queue_cur->is_ascii) {
+#ifdef TRANSFORM
+ // reverse atoi()/strnu?toll() is expensive, so we only to it in lvl 3
+ if (lvl & LVL3) {
- endptr = buf_8;
- if (strntoll(buf_8, len - idx, (char **)&endptr, 0, &num)) {
+ u8 * endptr;
+ u8 use_num = 0, use_unum = 0;
+ unsigned long long unum;
+ long long num;
- if (!strntoull(buf_8, len - idx, (char **)&endptr, 0, &unum))
- use_unum = 1;
+ if (afl->queue_cur->is_ascii) {
- } else
+ endptr = buf_8;
+ if (strntoll(buf_8, len - idx, (char **)&endptr, 0, &num)) {
- use_num = 1;
+ if (!strntoull(buf_8, len - idx, (char **)&endptr, 0, &unum))
+ use_unum = 1;
- }
+ } else
- if (use_num && (u64)num == pattern) {
+ use_num = 1;
- size_t old_len = endptr - buf_8;
- size_t num_len = snprintf(NULL, 0, "%lld", num);
+ }
- u8 *new_buf = afl_realloc((void **)&afl->out_scratch_buf, len + num_len);
- if (unlikely(!new_buf)) { PFATAL("alloc"); }
- memcpy(new_buf, buf, idx);
+ #ifdef _DEBUG
+ if (idx == 0)
+ fprintf(stderr, "ASCII is=%u use_num=%u use_unum=%u idx=%u %llx==%llx\n",
+ afl->queue_cur->is_ascii, use_num, use_unum, idx, num, pattern);
+ #endif
- snprintf(new_buf + idx, num_len, "%lld", num);
- memcpy(new_buf + idx + num_len, buf_8 + old_len, len - idx - old_len);
+ // num is likely not pattern as atoi("AAA") will be zero...
+ if (use_num && ((u64)num == pattern || !num)) {
- if (unlikely(its_fuzz(afl, new_buf, len, status))) { return 1; }
+ u8 tmp_buf[32];
+ size_t num_len = snprintf(tmp_buf, sizeof(tmp_buf), "%lld", repl);
+ size_t old_len = endptr - buf_8;
- } else if (use_unum && unum == pattern) {
+ u8 *new_buf = afl_realloc((void **)&afl->out_scratch_buf, len + num_len);
+ if (unlikely(!new_buf)) { PFATAL("alloc"); }
- size_t old_len = endptr - buf_8;
- size_t num_len = snprintf(NULL, 0, "%llu", unum);
+ memcpy(new_buf, buf, idx);
+ memcpy(new_buf + idx, tmp_buf, num_len);
+ memcpy(new_buf + idx + num_len, buf_8 + old_len, len - idx - old_len);
- u8 *new_buf = afl_realloc((void **)&afl->out_scratch_buf, len + num_len);
- if (unlikely(!new_buf)) { PFATAL("alloc"); }
- memcpy(new_buf, buf, idx);
+ if (new_buf[idx + num_len] >= '0' && new_buf[idx + num_len] <= '9') {
- snprintf(new_buf + idx, num_len, "%llu", unum);
- memcpy(new_buf + idx + num_len, buf_8 + old_len, len - idx - old_len);
+ new_buf[idx + num_len] = ' ';
- if (unlikely(its_fuzz(afl, new_buf, len, status))) { return 1; }
+ }
- }
+ if (unlikely(its_fuzz(afl, new_buf, len, status))) { return 1; }
- if (SHAPE_BYTES(h->shape) >= 8 && *status != 1) {
+ } else if (use_unum && (unum == pattern || !unum)) {
- if (its_len >= 8 && *buf_64 == pattern && *o_buf_64 == o_pattern) {
+ u8 tmp_buf[32];
+ size_t num_len = snprintf(tmp_buf, sizeof(tmp_buf), "%llu", repl);
+ size_t old_len = endptr - buf_8;
- *buf_64 = repl;
- if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
- *buf_64 = pattern;
+ u8 *new_buf = afl_realloc((void **)&afl->out_scratch_buf, len + num_len);
+ if (unlikely(!new_buf)) { PFATAL("alloc"); }
+
+ memcpy(new_buf, buf, idx);
+ memcpy(new_buf + idx, tmp_buf, num_len);
+ memcpy(new_buf + idx + num_len, buf_8 + old_len, len - idx - old_len);
+
+ if (new_buf[idx + num_len] >= '0' && new_buf[idx + num_len] <= '9') {
+
+ new_buf[idx + num_len] = ' ';
+
+ }
+
+ if (unlikely(its_fuzz(afl, new_buf, len, status))) { return 1; }
}
- // reverse encoding
- if (do_reverse && *status != 1) {
+ // Try to identify transform magic
+ if (pattern != o_pattern && repl == changed_val && attr <= IS_EQUAL) {
+
+ u64 *ptr = (u64 *)&buf[idx];
+ u64 *o_ptr = (u64 *)&orig_buf[idx];
+ u64 b_val, o_b_val, mask;
+
+ switch (SHAPE_BYTES(h->shape)) {
+
+ case 0:
+ case 1:
+ b_val = (u64)(*ptr % 0x100);
+ o_b_val = (u64)(*o_ptr % 0x100);
+ mask = 0xff;
+ break;
+ case 2:
+ case 3:
+ b_val = (u64)(*ptr % 0x10000);
+ o_b_val = (u64)(*o_ptr % 0x10000);
+ mask = 0xffff;
+ break;
+ case 4:
+ case 5:
+ case 6:
+ case 7:
+ b_val = (u64)(*ptr % 0x100000000);
+ o_b_val = (u64)(*o_ptr % 0x100000000);
+ mask = 0xffffffff;
+ break;
+ default:
+ b_val = *ptr;
+ o_b_val = *o_ptr;
+ mask = 0xffffffffffffffff;
- if (unlikely(cmp_extend_encoding(afl, h, SWAP64(pattern), SWAP64(repl),
- SWAP64(o_pattern), idx, orig_buf, buf,
- len, 0, status))) {
+ }
- return 1;
+ // test for arithmetic, eg. "if ((user_val - 0x1111) == 0x1234) ..."
+ s64 diff = pattern - b_val;
+ s64 o_diff = o_pattern - o_b_val;
+ /*
+ fprintf(stderr, "DIFF1 idx=%03u shape=%02u %llx-%llx=%lx\n", idx,
+ h->shape + 1, o_pattern, o_b_val, o_diff);
+ fprintf(stderr, "DIFF1 %016llx %llx-%llx=%lx\n", repl, pattern,
+ b_val, diff);*/
+ if (diff == o_diff && diff) {
+
+ // this could be an arithmetic transformation
+
+ u64 new_repl = (u64)((s64)repl - diff);
+ // fprintf(stderr, "SAME DIFF %llx->%llx\n", repl, new_repl);
+
+ if (unlikely(cmp_extend_encoding(
+ afl, h, pattern, new_repl, o_pattern, repl, IS_TRANSFORM, idx,
+ taint_len, orig_buf, buf, cbuf, len, 1, lvl, status))) {
+
+ return 1;
+
+ }
+
+ // if (*status == 1) { fprintf(stderr, "FOUND!\n"); }
+
+ }
+
+ // test for XOR, eg. "if ((user_val ^ 0xabcd) == 0x1234) ..."
+ if (*status != 1) {
+
+ diff = pattern ^ b_val;
+ s64 o_diff = o_pattern ^ o_b_val;
+
+ /* fprintf(stderr, "DIFF2 idx=%03u shape=%02u %llx-%llx=%lx\n",
+ idx, h->shape + 1, o_pattern, o_b_val, o_diff); fprintf(stderr,
+ "DIFF2 %016llx %llx-%llx=%lx\n", repl, pattern, b_val, diff);*/
+ if (diff == o_diff && diff) {
+
+ // this could be a XOR transformation
+
+ u64 new_repl = (u64)((s64)repl ^ diff);
+ // fprintf(stderr, "SAME DIFF %llx->%llx\n", repl, new_repl);
+
+ if (unlikely(cmp_extend_encoding(
+ afl, h, pattern, new_repl, o_pattern, repl, IS_TRANSFORM, idx,
+ taint_len, orig_buf, buf, cbuf, len, 1, lvl, status))) {
+
+ return 1;
+
+ }
+
+ // if (*status == 1) { fprintf(stderr, "FOUND!\n"); }
+
+ }
+
+ }
+
+ // test for to lowercase, eg. "new_val = (user_val | 0x2020) ..."
+ if (*status != 1) {
+
+ if ((b_val | (0x2020202020202020 & mask)) == (pattern & mask)) {
+
+ diff = 1;
+
+ } else {
+
+ diff = 0;
+
+ }
+
+ if ((o_b_val | (0x2020202020202020 & mask)) == (o_pattern & mask)) {
+
+ o_diff = 1;
+
+ } else {
+
+ diff = 0;
+
+ }
+
+ /* fprintf(stderr, "DIFF3 idx=%03u shape=%02u %llx-%llx=%lx\n",
+ idx, h->shape + 1, o_pattern, o_b_val, o_diff); fprintf(stderr,
+ "DIFF3 %016llx %llx-%llx=%lx\n", repl, pattern, b_val, diff);*/
+ if (o_diff && diff) {
+
+ // this could be a lower to upper
+
+ u64 new_repl = (repl & (0x5f5f5f5f5f5f5f5f & mask));
+ // fprintf(stderr, "SAME DIFF %llx->%llx\n", repl, new_repl);
+
+ if (unlikely(cmp_extend_encoding(
+ afl, h, pattern, new_repl, o_pattern, repl, IS_TRANSFORM, idx,
+ taint_len, orig_buf, buf, cbuf, len, 1, lvl, status))) {
+
+ return 1;
+
+ }
+
+ // if (*status == 1) { fprintf(stderr, "FOUND!\n"); }
+
+ }
+
+ }
+
+ // test for to uppercase, eg. "new_val = (user_val | 0x5f5f) ..."
+ if (*status != 1) {
+
+ if ((b_val & (0x5f5f5f5f5f5f5f5f & mask)) == (pattern & mask)) {
+
+ diff = 1;
+
+ } else {
+
+ diff = 0;
+
+ }
+
+ if ((o_b_val & (0x5f5f5f5f5f5f5f5f & mask)) == (o_pattern & mask)) {
+
+ o_diff = 1;
+
+ } else {
+
+ o_diff = 0;
+
+ }
+
+ /* fprintf(stderr, "DIFF4 idx=%03u shape=%02u %llx-%llx=%lx\n",
+ idx, h->shape + 1, o_pattern, o_b_val, o_diff); fprintf(stderr,
+ "DIFF4 %016llx %llx-%llx=%lx\n", repl, pattern, b_val, diff);*/
+ if (o_diff && diff) {
+
+ // this could be a lower to upper
+
+ u64 new_repl = (repl | (0x2020202020202020 & mask));
+ // fprintf(stderr, "SAME DIFF %llx->%llx\n", repl, new_repl);
+
+ if (unlikely(cmp_extend_encoding(
+ afl, h, pattern, new_repl, o_pattern, repl, IS_TRANSFORM, idx,
+ taint_len, orig_buf, buf, cbuf, len, 1, lvl, status))) {
+
+ return 1;
+
+ }
+
+ // if (*status == 1) { fprintf(stderr, "FOUND!\n"); }
+
+ }
}
+ *status = 0;
+
}
}
- if (SHAPE_BYTES(h->shape) >= 4 && *status != 1) {
+#endif
- if (its_len >= 4 && *buf_32 == (u32)pattern &&
- *o_buf_32 == (u32)o_pattern) {
+ // we only allow this for ascii2integer (above)
+ if (unlikely(pattern == o_pattern)) { return 0; }
- *buf_32 = (u32)repl;
- if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
- *buf_32 = pattern;
+ if ((lvl & LVL1) || ((lvl & LVL2) && (attr >= IS_FP && attr < IS_FP_MOD)) ||
+ attr >= IS_FP_MOD) {
+
+ if (SHAPE_BYTES(h->shape) >= 8 && *status != 1) {
+
+ // if (its_len >= 8)
+ // fprintf(stderr,
+ // "TestU64: %u>=8 (idx=%u attr=%u) %llx==%llx"
+ // " %llx==%llx <= %llx<-%llx\n",
+ // its_len, idx, attr, *buf_64, pattern, *o_buf_64, o_pattern,
+ // repl, changed_val);
+
+ // if this is an fcmp (attr & 8 == 8) then do not compare the patterns -
+ // due to a bug in llvm dynamic float bitcasts do not work :(
+ // the value 16 means this is a +- 1.0 test case
+ if (its_len >= 8 && ((*buf_64 == pattern && *o_buf_64 == o_pattern) ||
+ attr >= IS_FP_MOD)) {
+
+ u64 tmp_64 = *buf_64;
+ *buf_64 = repl;
+ if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
+#ifdef COMBINE
+ if (*status == 1) { memcpy(cbuf + idx, buf_64, 8); }
+#endif
+ *buf_64 = tmp_64;
+
+ // fprintf(stderr, "Status=%u\n", *status);
+
+ }
+
+ // reverse encoding
+ if (do_reverse && *status != 1) {
+
+ if (unlikely(cmp_extend_encoding(afl, h, SWAP64(pattern), SWAP64(repl),
+ SWAP64(o_pattern), SWAP64(changed_val),
+ attr, idx, taint_len, orig_buf, buf,
+ cbuf, len, 0, lvl, status))) {
+
+ return 1;
+
+ }
+
+ }
}
- // reverse encoding
- if (do_reverse && *status != 1) {
+ if (SHAPE_BYTES(h->shape) >= 4 && *status != 1) {
- if (unlikely(cmp_extend_encoding(afl, h, SWAP32(pattern), SWAP32(repl),
- SWAP32(o_pattern), idx, orig_buf, buf,
- len, 0, status))) {
+ // if (its_len >= 4 && (attr <= 1 || attr >= 8))
+ // fprintf(stderr,
+ // "TestU32: %u>=4 (idx=%u attr=%u) %x==%x"
+ // " %x==%x <= %x<-%x\n",
+ // its_len, idx, attr, *buf_32, (u32)pattern, *o_buf_32,
+ // (u32)o_pattern, (u32)repl, (u32)changed_val);
- return 1;
+ if (its_len >= 4 &&
+ ((*buf_32 == (u32)pattern && *o_buf_32 == (u32)o_pattern) ||
+ attr >= IS_FP_MOD)) {
+
+ u32 tmp_32 = *buf_32;
+ *buf_32 = (u32)repl;
+ if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
+#ifdef COMBINE
+ if (*status == 1) { memcpy(cbuf + idx, buf_32, 4); }
+#endif
+ *buf_32 = tmp_32;
+
+ // fprintf(stderr, "Status=%u\n", *status);
+
+ }
+
+ // reverse encoding
+ if (do_reverse && *status != 1) {
+
+ if (unlikely(cmp_extend_encoding(afl, h, SWAP32(pattern), SWAP32(repl),
+ SWAP32(o_pattern), SWAP32(changed_val),
+ attr, idx, taint_len, orig_buf, buf,
+ cbuf, len, 0, lvl, status))) {
+
+ return 1;
+
+ }
+
+ }
+
+ }
+
+ if (SHAPE_BYTES(h->shape) >= 2 && *status != 1) {
+
+ if (its_len >= 2 &&
+ ((*buf_16 == (u16)pattern && *o_buf_16 == (u16)o_pattern) ||
+ attr >= IS_FP_MOD)) {
+
+ u16 tmp_16 = *buf_16;
+ *buf_16 = (u16)repl;
+ if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
+#ifdef COMBINE
+ if (*status == 1) { memcpy(cbuf + idx, buf_16, 2); }
+#endif
+ *buf_16 = tmp_16;
+
+ }
+
+ // reverse encoding
+ if (do_reverse && *status != 1) {
+
+ if (unlikely(cmp_extend_encoding(afl, h, SWAP16(pattern), SWAP16(repl),
+ SWAP16(o_pattern), SWAP16(changed_val),
+ attr, idx, taint_len, orig_buf, buf,
+ cbuf, len, 0, lvl, status))) {
+
+ return 1;
+
+ }
+
+ }
+
+ }
+
+ if (*status != 1) { // u8
+
+ // if (its_len >= 1)
+ // fprintf(stderr,
+ // "TestU8: %u>=1 (idx=%u attr=%u) %x==%x %x==%x <= %x<-%x\n",
+ // its_len, idx, attr, *buf_8, (u8)pattern, *o_buf_8,
+ // (u8)o_pattern, (u8)repl, (u8)changed_val);
+
+ if (its_len >= 1 &&
+ ((*buf_8 == (u8)pattern && *o_buf_8 == (u8)o_pattern) ||
+ attr >= IS_FP_MOD)) {
+
+ u8 tmp_8 = *buf_8;
+ *buf_8 = (u8)repl;
+ if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
+#ifdef COMBINE
+ if (*status == 1) { cbuf[idx] = *buf_8; }
+#endif
+ *buf_8 = tmp_8;
}
@@ -396,40 +1109,228 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
}
- if (SHAPE_BYTES(h->shape) >= 2 && *status != 1) {
+ // here we add and subract 1 from the value, but only if it is not an
+ // == or != comparison
+ // Bits: 1 = Equal, 2 = Greater, 4 = Lesser, 8 = Float
+ // 16 = modified float, 32 = modified integer (modified = wont match
+ // in original buffer)
- if (its_len >= 2 && *buf_16 == (u16)pattern &&
- *o_buf_16 == (u16)o_pattern) {
+#ifdef ARITHMETIC_LESSER_GREATER
+ if (lvl < LVL3 || attr == IS_TRANSFORM) { return 0; }
- *buf_16 = (u16)repl;
- if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
- *buf_16 = (u16)pattern;
+ // lesser/greater FP comparison
+ if ((attr & (IS_LESSER + IS_GREATER)) &&
+ (attr >= IS_FP && attr < IS_FP_MOD)) {
+
+ u64 repl_new;
+ if (SHAPE_BYTES(h->shape) == 4 && its_len >= 4) {
+
+ float *f = (float *)&repl;
+ float g = *f;
+ g += 1.0;
+ u32 *r = (u32 *)&g;
+ repl_new = (u32)*r;
+
+ } else if (SHAPE_BYTES(h->shape) == 8 && its_len >= 8) {
+
+ double *f = (double *)&repl;
+ double g = *f;
+ g += 1.0;
+
+ u64 *r = (u64 *)&g;
+ repl_new = *r;
+
+ } else {
+
+ return 0;
}
- // reverse encoding
- if (do_reverse && *status != 1) {
+ changed_val = repl_new;
+
+ if (unlikely(cmp_extend_encoding(afl, h, pattern, repl_new, o_pattern,
+ changed_val, 16, idx, taint_len, orig_buf,
+ buf, cbuf, len, 1, lvl, status))) {
+
+ return 1;
+
+ }
+
+ if (SHAPE_BYTES(h->shape) == 4) {
+
+ float *f = (float *)&repl;
+ float g = *f;
+ g -= 1.0;
+ u32 *r = (u32 *)&g;
+ repl_new = (u32)*r;
+
+ } else if (SHAPE_BYTES(h->shape) == 8) {
+
+ double *f = (double *)&repl;
+ double g = *f;
+ g -= 1.0;
+ u64 *r = (u64 *)&g;
+ repl_new = *r;
+
+ } else {
+
+ return 0;
+
+ }
+
+ changed_val = repl_new;
+
+ if (unlikely(cmp_extend_encoding(afl, h, pattern, repl_new, o_pattern,
+ changed_val, 16, idx, taint_len, orig_buf,
+ buf, cbuf, len, 1, lvl, status))) {
+
+ return 1;
+
+ }
+
+ // transform double to float, llvm likes to do that internally ...
+ if (SHAPE_BYTES(h->shape) == 8 && its_len >= 4) {
+
+ double *f = (double *)&repl;
+ float g = (float)*f;
+ repl_new = 0;
+ #if (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
+ memcpy((char *)&repl_new, (char *)&g, 4);
+ #else
+ memcpy(((char *)&repl_new) + 4, (char *)&g, 4);
+ #endif
+ changed_val = repl_new;
+ h->shape = 3; // modify shape
+
+ // fprintf(stderr, "DOUBLE2FLOAT %llx\n", repl_new);
- if (unlikely(cmp_extend_encoding(afl, h, SWAP16(pattern), SWAP16(repl),
- SWAP16(o_pattern), idx, orig_buf, buf,
- len, 0, status))) {
+ if (unlikely(cmp_extend_encoding(
+ afl, h, pattern, repl_new, o_pattern, changed_val, 16, idx,
+ taint_len, orig_buf, buf, cbuf, len, 1, lvl, status))) {
+ h->shape = 7; // recover shape
return 1;
}
+ h->shape = 7; // recover shape
+
+ }
+
+ } else if ((attr & (IS_LESSER + IS_GREATER)) && attr < IS_FP) {
+
+ // lesser/greater integer comparison
+
+ u64 repl_new;
+
+ repl_new = repl + 1;
+ changed_val = repl_new;
+ if (unlikely(cmp_extend_encoding(afl, h, pattern, repl_new, o_pattern,
+ changed_val, 32, idx, taint_len, orig_buf,
+ buf, cbuf, len, 1, lvl, status))) {
+
+ return 1;
+
+ }
+
+ repl_new = repl - 1;
+ changed_val = repl_new;
+ if (unlikely(cmp_extend_encoding(afl, h, pattern, repl_new, o_pattern,
+ changed_val, 32, idx, taint_len, orig_buf,
+ buf, cbuf, len, 1, lvl, status))) {
+
+ return 1;
+
}
}
- /* avoid CodeQL warning on unsigned overflow */
- if (/* SHAPE_BYTES(h->shape) >= 1 && */ *status != 1) {
+#endif /* ARITHMETIC_LESSER_GREATER */
- if (its_len >= 1 && *buf_8 == (u8)pattern && *o_buf_8 == (u8)o_pattern) {
+ return 0;
+
+}
+
+#ifdef WORD_SIZE_64
+
+static u8 cmp_extend_encodingN(afl_state_t *afl, struct cmp_header *h,
+ u128 pattern, u128 repl, u128 o_pattern,
+ u128 changed_val, u8 attr, u32 idx,
+ u32 taint_len, u8 *orig_buf, u8 *buf, u8 *cbuf,
+ u32 len, u8 do_reverse, u8 lvl, u8 *status) {
+
+ u8 *ptr = (u8 *)&buf[idx];
+ u8 *o_ptr = (u8 *)&orig_buf[idx];
+ u8 *p = (u8 *)&pattern;
+ u8 *o_p = (u8 *)&o_pattern;
+ u8 *r = (u8 *)&repl;
+ u8 backup[16];
+ u32 its_len = MIN(len - idx, taint_len);
+ u32 shape = h->shape + 1;
+ #if (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
+ size_t off = 0;
+ #else
+ size_t off = 16 - shape;
+ #endif
+
+ if (its_len >= shape) {
+
+ #ifdef _DEBUG
+ fprintf(stderr, "TestUN: %u>=%u (len=%u idx=%u attr=%u off=%lu) (%u) ",
+ its_len, shape, len, idx, attr, off, do_reverse);
+ u32 i;
+ u8 *o_r = (u8 *)&changed_val;
+ for (i = 0; i < shape; i++)
+ fprintf(stderr, "%02x", ptr[i]);
+ fprintf(stderr, "==");
+ for (i = 0; i < shape; i++)
+ fprintf(stderr, "%02x", p[off + i]);
+ fprintf(stderr, " ");
+ for (i = 0; i < shape; i++)
+ fprintf(stderr, "%02x", o_ptr[i]);
+ fprintf(stderr, "==");
+ for (i = 0; i < shape; i++)
+ fprintf(stderr, "%02x", o_p[off + i]);
+ fprintf(stderr, " <= ");
+ for (i = 0; i < shape; i++)
+ fprintf(stderr, "%02x", r[off + i]);
+ fprintf(stderr, "<-");
+ for (i = 0; i < shape; i++)
+ fprintf(stderr, "%02x", o_r[off + i]);
+ fprintf(stderr, "\n");
+ #endif
+
+ if (!memcmp(ptr, p + off, shape) && !memcmp(o_ptr, o_p + off, shape)) {
+
+ memcpy(backup, ptr, shape);
+ memcpy(ptr, r + off, shape);
- *buf_8 = (u8)repl;
if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
- *buf_8 = (u8)pattern;
+
+ #ifdef COMBINE
+ if (*status == 1) { memcpy(cbuf + idx, r, shape); }
+ #endif
+
+ memcpy(ptr, backup, shape);
+
+ #ifdef _DEBUG
+ fprintf(stderr, "Status=%u\n", *status);
+ #endif
+
+ }
+
+ // reverse encoding
+ if (do_reverse && *status != 1) {
+
+ if (unlikely(cmp_extend_encodingN(
+ afl, h, SWAPN(pattern, (shape << 3)), SWAPN(repl, (shape << 3)),
+ SWAPN(o_pattern, (shape << 3)), SWAPN(changed_val, (shape << 3)),
+ attr, idx, taint_len, orig_buf, buf, cbuf, len, 0, lvl,
+ status))) {
+
+ return 1;
+
+ }
}
@@ -439,16 +1340,14 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
}
+#endif
+
static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
u8 *b = (u8 *)&v;
u32 k;
u8 cons_ff = 0, cons_0 = 0;
-
- if (shape > sizeof(v))
- FATAL("shape is greater than %zu, please report!", sizeof(v));
-
for (k = 0; k < shape; ++k) {
if (b[k] == 0) {
@@ -457,7 +1356,7 @@ static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
} else if (b[k] == 0xff) {
- ++cons_ff;
+ ++cons_0;
} else {
@@ -493,28 +1392,90 @@ static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
}
-static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
+#ifdef WORD_SIZE_64
+static void try_to_add_to_dictN(afl_state_t *afl, u128 v, u8 size) {
- struct cmp_header *h = &afl->shm.cmp_map->headers[key];
- u32 i, j, idx;
+ u8 *b = (u8 *)&v;
+
+ u32 k;
+ u8 cons_ff = 0, cons_0 = 0;
+ #if (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
+ u32 off = 0;
+ for (k = 0; k < size; ++k) {
+
+ #else
+ u32 off = 16 - size;
+ for (k = 16 - size; k < 16; ++k) {
+
+ #endif
+ if (b[k] == 0) {
+
+ ++cons_0;
+
+ } else if (b[k] == 0xff) {
+
+ ++cons_0;
+
+ } else {
+
+ cons_0 = cons_ff = 0;
+
+ }
+
+ }
+
+ maybe_add_auto(afl, (u8 *)&v + off, size);
+ u128 rev = SWAPN(v, size);
+ maybe_add_auto(afl, (u8 *)&rev + off, size);
+
+}
- u32 loggeds = h->hits;
- if (h->hits > CMP_MAP_H) { loggeds = CMP_MAP_H; }
+#endif
- u8 status = 0;
- // opt not in the paper
- u32 fails;
- u8 found_one = 0;
+static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
+ u32 len, u32 lvl, struct tainted *taint) {
+
+ struct cmp_header *h = &afl->shm.cmp_map->headers[key];
+ // FP handling only from lvl 2 onwards
+ if ((h->attribute & IS_FP) && lvl < LVL2) { return 0; }
+
+ struct tainted *t;
+ u32 i, j, idx, taint_len, loggeds;
+ u32 have_taint = 1, is_n = 0;
+ u8 status = 0, found_one = 0;
/* loop cmps are useless, detect and ignore them */
+#ifdef WORD_SIZE_64
+ u128 s128_v0 = 0, s128_v1 = 0, orig_s128_v0 = 0, orig_s128_v1 = 0;
+#endif
u64 s_v0, s_v1;
u8 s_v0_fixed = 1, s_v1_fixed = 1;
u8 s_v0_inc = 1, s_v1_inc = 1;
u8 s_v0_dec = 1, s_v1_dec = 1;
- for (i = 0; i < loggeds; ++i) {
+ if (h->hits > CMP_MAP_H) {
+
+ loggeds = CMP_MAP_H;
+
+ } else {
+
+ loggeds = h->hits;
+
+ }
- fails = 0;
+ switch (SHAPE_BYTES(h->shape)) {
+
+ case 1:
+ case 2:
+ case 4:
+ case 8:
+ break;
+ default:
+ is_n = 1;
+
+ }
+
+ for (i = 0; i < loggeds; ++i) {
struct cmp_operands *o = &afl->shm.cmp_map->log[key][i];
@@ -551,55 +1512,171 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
}
- for (idx = 0; idx < len && fails < 8; ++idx) {
+#ifdef _DEBUG
+ fprintf(stderr, "Handling: %llx->%llx vs %llx->%llx attr=%u shape=%u\n",
+ orig_o->v0, o->v0, orig_o->v1, o->v1, h->attribute,
+ SHAPE_BYTES(h->shape));
+#endif
+
+ t = taint;
+ while (t->next) {
+
+ t = t->next;
+
+ }
+
+#ifdef WORD_SIZE_64
+ if (unlikely(is_n)) {
+
+ s128_v0 = ((u128)o->v0) + (((u128)o->v0_128) << 64);
+ s128_v1 = ((u128)o->v1) + (((u128)o->v1_128) << 64);
+ orig_s128_v0 = ((u128)orig_o->v0) + (((u128)orig_o->v0_128) << 64);
+ orig_s128_v1 = ((u128)orig_o->v1) + (((u128)orig_o->v1_128) << 64);
+
+ }
+
+#endif
+
+ for (idx = 0; idx < len; ++idx) {
+
+ if (have_taint) {
+
+ if (!t || idx < t->pos) {
+
+ continue;
+
+ } else {
+
+ taint_len = t->pos + t->len - idx;
+
+ if (idx == t->pos + t->len - 1) { t = t->prev; }
+
+ }
+
+ } else {
+
+ taint_len = len - idx;
+
+ }
status = 0;
- if (unlikely(cmp_extend_encoding(afl, h, o->v0, o->v1, orig_o->v0, idx,
- orig_buf, buf, len, 1, &status))) {
- return 1;
+#ifdef WORD_SIZE_64
+ if (is_n) { // _ExtInt special case including u128
+
+ if (s128_v0 != orig_s128_v0 && orig_s128_v0 != orig_s128_v1) {
+
+ if (unlikely(cmp_extend_encodingN(
+ afl, h, s128_v0, s128_v1, orig_s128_v0, orig_s128_v1,
+ h->attribute, idx, taint_len, orig_buf, buf, cbuf, len, 1,
+ lvl, &status))) {
+
+ return 1;
+
+ }
+
+ }
+
+ if (status == 1) {
+
+ found_one = 1;
+ break;
+
+ }
+
+ if (s128_v1 != orig_s128_v1 && orig_s128_v1 != orig_s128_v0) {
+
+ if (unlikely(cmp_extend_encodingN(
+ afl, h, s128_v1, s128_v0, orig_s128_v1, orig_s128_v0,
+ h->attribute, idx, taint_len, orig_buf, buf, cbuf, len, 1,
+ lvl, &status))) {
+
+ return 1;
+
+ }
+
+ }
+
+ if (status == 1) {
+
+ found_one = 1;
+ break;
+
+ }
}
- if (status == 2) {
+#endif
+
+ // even for u128 and _ExtInt we do cmp_extend_encoding() because
+ // if we got here their own special trials failed and it might just be
+ // a cast from e.g. u64 to u128 from the input data.
- ++fails;
+ if ((o->v0 != orig_o->v0 || lvl >= LVL3) && orig_o->v0 != orig_o->v1) {
- } else if (status == 1) {
+ if (unlikely(cmp_extend_encoding(
+ afl, h, o->v0, o->v1, orig_o->v0, orig_o->v1, h->attribute, idx,
+ taint_len, orig_buf, buf, cbuf, len, 1, lvl, &status))) {
+ return 1;
+
+ }
+
+ }
+
+ if (status == 1) {
+
+ found_one = 1;
break;
}
status = 0;
- if (unlikely(cmp_extend_encoding(afl, h, o->v1, o->v0, orig_o->v1, idx,
- orig_buf, buf, len, 1, &status))) {
+ if ((o->v1 != orig_o->v1 || lvl >= LVL3) && orig_o->v0 != orig_o->v1) {
- return 1;
+ if (unlikely(cmp_extend_encoding(
+ afl, h, o->v1, o->v0, orig_o->v1, orig_o->v0, h->attribute, idx,
+ taint_len, orig_buf, buf, cbuf, len, 1, lvl, &status))) {
- }
+ return 1;
- if (status == 2) {
+ }
- ++fails;
+ }
- } else if (status == 1) {
+ if (status == 1) {
+ found_one = 1;
break;
}
}
- if (status == 1) { found_one = 1; }
+#ifdef _DEBUG
+ fprintf(stderr,
+ "END: %llx->%llx vs %llx->%llx attr=%u i=%u found=%u "
+ "isN=%u size=%u\n",
+ orig_o->v0, o->v0, orig_o->v1, o->v1, h->attribute, i, found_one,
+ is_n, SHAPE_BYTES(h->shape));
+#endif
// If failed, add to dictionary
- if (fails == 8) {
+ if (!found_one) {
if (afl->pass_stats[key].total == 0) {
- try_to_add_to_dict(afl, o->v0, SHAPE_BYTES(h->shape));
- try_to_add_to_dict(afl, o->v1, SHAPE_BYTES(h->shape));
+ if (unlikely(is_n)) {
+
+ try_to_add_to_dictN(afl, s128_v0, SHAPE_BYTES(h->shape));
+ try_to_add_to_dictN(afl, s128_v1, SHAPE_BYTES(h->shape));
+
+ } else {
+
+ try_to_add_to_dict(afl, o->v0, SHAPE_BYTES(h->shape));
+ try_to_add_to_dict(afl, o->v1, SHAPE_BYTES(h->shape));
+
+ }
}
@@ -630,53 +1707,454 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
}
static u8 rtn_extend_encoding(afl_state_t *afl, u8 *pattern, u8 *repl,
- u8 *o_pattern, u32 idx, u8 *orig_buf, u8 *buf,
- u32 len, u8 *status) {
-
- u32 i;
+ u8 *o_pattern, u8 *changed_val, u32 idx,
+ u32 taint_len, u8 *orig_buf, u8 *buf, u8 *cbuf,
+ u32 len, u8 lvl, u8 *status) {
+
+#ifndef COMBINE
+ (void)(cbuf);
+#endif
+#ifndef TRANSFORM
+ (void)(changed_val);
+#endif
+
+ u8 save[40];
+ u32 saved_idx = idx, pre, from = 0, to = 0, i, j;
u32 its_len = MIN((u32)32, len - idx);
+ its_len = MIN(its_len, taint_len);
+ u32 saved_its_len = its_len;
+
+ if (lvl & LVL3) {
- u8 save[32];
- memcpy(save, &buf[idx], its_len);
+ u32 max_to = MIN(4U, idx);
+ if (!(lvl & LVL1) && max_to) { from = 1; }
+ to = max_to;
- *status = 0;
+ }
- for (i = 0; i < its_len; ++i) {
+ memcpy(save, &buf[saved_idx - to], its_len + to);
+ (void)(j);
- if (pattern[i] != buf[idx + i] || o_pattern[i] != orig_buf[idx + i] ||
- *status == 1) {
+#ifdef _DEBUG
+ fprintf(stderr, "RTN T idx=%u lvl=%02x ", idx, lvl);
+ for (j = 0; j < 8; j++)
+ fprintf(stderr, "%02x", orig_buf[idx + j]);
+ fprintf(stderr, " -> ");
+ for (j = 0; j < 8; j++)
+ fprintf(stderr, "%02x", o_pattern[j]);
+ fprintf(stderr, " <= ");
+ for (j = 0; j < 8; j++)
+ fprintf(stderr, "%02x", repl[j]);
+ fprintf(stderr, "\n");
+ fprintf(stderr, " ");
+ for (j = 0; j < 8; j++)
+ fprintf(stderr, "%02x", buf[idx + j]);
+ fprintf(stderr, " -> ");
+ for (j = 0; j < 8; j++)
+ fprintf(stderr, "%02x", pattern[j]);
+ fprintf(stderr, " <= ");
+ for (j = 0; j < 8; j++)
+ fprintf(stderr, "%02x", changed_val[j]);
+ fprintf(stderr, "\n");
+#endif
- break;
+ // Try to match the replace value up to 4 bytes before the current idx.
+ // This allows matching of eg.:
+ // if (memcmp(user_val, "TEST") == 0)
+ // if (memcmp(user_val, "TEST-VALUE") == 0) ...
+ // We only do this in lvl 3, otherwise we only do direct matching
+
+ for (pre = from; pre <= to; pre++) {
+
+ if (*status != 1 && (!pre || !memcmp(buf + saved_idx - pre, repl, pre))) {
+
+ idx = saved_idx - pre;
+ its_len = saved_its_len + pre;
+
+ for (i = 0; i < its_len; ++i) {
+
+ if ((pattern[i] != buf[idx + i] && o_pattern[i] != orig_buf[idx + i]) ||
+ *status == 1) {
+
+ break;
+
+ }
+
+ buf[idx + i] = repl[i];
+
+ if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
+
+#ifdef COMBINE
+ if (*status == 1) { memcpy(cbuf + idx, &buf[idx], i); }
+#endif
+
+ }
+
+ memcpy(&buf[idx], save + to - pre, i);
}
- buf[idx + i] = repl[i];
+ }
+
+#ifdef TRANSFORM
+
+ if (*status == 1) return 0;
+
+ if (lvl & LVL3) {
+
+ u32 toupper = 0, tolower = 0, xor = 0, arith = 0, tohex = 0, fromhex = 0;
+ #ifdef TRANSFORM_BASE64
+ u32 tob64 = 0, fromb64 = 0;
+ #endif
+ u32 from_0 = 0, from_x = 0, from_X = 0, from_slash = 0, from_up = 0;
+ u32 to_0 = 0, to_x = 0, to_slash = 0, to_up = 0;
+ u8 xor_val[32], arith_val[32], tmp[48];
+
+ idx = saved_idx;
+ its_len = saved_its_len;
+
+ memcpy(save, &buf[idx], its_len);
+
+ for (i = 0; i < its_len; ++i) {
+
+ xor_val[i] = pattern[i] ^ buf[idx + i];
+ arith_val[i] = pattern[i] - buf[idx + i];
+
+ if (i == 0) {
+
+ if (orig_buf[idx] == '0') {
+
+ from_0 = 1;
+
+ } else if (orig_buf[idx] == '\\') {
+
+ from_slash = 1;
+
+ }
+
+ if (repl[0] == '0') {
+
+ to_0 = 1;
+
+ } else if (repl[0] == '\\') {
+
+ to_slash = 1;
+
+ }
+
+ } else if (i == 1) {
+
+ if (orig_buf[idx + 1] == 'x') {
+
+ from_x = 1;
+
+ } else if (orig_buf[idx + 1] == 'X') {
+
+ from_X = from_x = 1;
+
+ }
+
+ if (repl[1] == 'x' || repl[1] == 'X') { to_x = 1; }
+
+ }
+
+ if (i < 16 && is_hex(repl + (i << 1))) {
+
+ ++tohex;
+
+ if (!to_up) {
+
+ if (repl[i << 1] >= 'A' && repl[i << 1] <= 'F')
+ to_up = 1;
+ else if (repl[i << 1] >= 'a' && repl[i << 1] <= 'f')
+ to_up = 2;
+ if (repl[(i << 1) + 1] >= 'A' && repl[(i << 1) + 1] <= 'F')
+ to_up = 1;
+ else if (repl[(i << 1) + 1] >= 'a' && repl[(i << 1) + 1] <= 'f')
+ to_up = 2;
+
+ }
+
+ }
+
+ if ((i % 2)) {
+
+ if (len > idx + i && is_hex(orig_buf + idx + i)) {
+
+ fromhex += 2;
+
+ if (!from_up) {
- if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
+ if (orig_buf[idx + i] >= 'A' && orig_buf[idx + i] <= 'F')
+ from_up = 1;
+ else if (orig_buf[idx + i] >= 'a' && orig_buf[idx + i] <= 'f')
+ from_up = 2;
+ if (orig_buf[idx + i - 1] >= 'A' && orig_buf[idx + i - 1] <= 'F')
+ from_up = 1;
+ else if (orig_buf[idx + i - 1] >= 'a' &&
+ orig_buf[idx + i - 1] <= 'f')
+ from_up = 2;
+
+ }
+
+ }
+
+ }
+
+ #ifdef TRANSFORM_BASE64
+ if (i % 3 == 2 && i < 24) {
+
+ if (is_base64(repl + ((i / 3) << 2))) tob64 += 3;
+
+ }
+
+ if (i % 4 == 3 && i < 24) {
+
+ if (is_base64(orig_buf + idx + i - 3)) fromb64 += 4;
+
+ }
+
+ #endif
+
+ if ((o_pattern[i] ^ orig_buf[idx + i]) == xor_val[i] && xor_val[i]) {
+
+ ++xor;
+
+ }
+
+ if ((o_pattern[i] - orig_buf[idx + i]) == arith_val[i] && arith_val[i]) {
+
+ ++arith;
+
+ }
+
+ if ((buf[idx + i] | 0x20) == pattern[i] &&
+ (orig_buf[idx + i] | 0x20) == o_pattern[i]) {
+
+ ++tolower;
+
+ }
+
+ if ((buf[idx + i] & 0x5a) == pattern[i] &&
+ (orig_buf[idx + i] & 0x5a) == o_pattern[i]) {
+
+ ++toupper;
+
+ }
+
+ #ifdef _DEBUG
+ fprintf(stderr,
+ "RTN idx=%u loop=%u xor=%u arith=%u tolower=%u toupper=%u "
+ "tohex=%u fromhex=%u to_0=%u to_slash=%u to_x=%u "
+ "from_0=%u from_slash=%u from_x=%u\n",
+ idx, i, xor, arith, tolower, toupper, tohex, fromhex, to_0,
+ to_slash, to_x, from_0, from_slash, from_x);
+ #ifdef TRANSFORM_BASE64
+ fprintf(stderr, "RTN idx=%u loop=%u tob64=%u from64=%u\n", tob64,
+ fromb64);
+ #endif
+ #endif
+
+ #ifdef TRANSFORM_BASE64
+ // input is base64 and converted to binary? convert repl to base64!
+ if ((i % 4) == 3 && i < 24 && fromb64 > i) {
+
+ to_base64(repl, tmp, i + 1);
+ memcpy(buf + idx, tmp, i + 1);
+ if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
+ // fprintf(stderr, "RTN ATTEMPT fromb64 %u result %u\n", fromb64,
+ // *status);
+
+ }
+
+ // input is converted to base64? decode repl with base64!
+ if ((i % 3) == 2 && i < 24 && tob64 > i) {
+
+ u32 olen = from_base64(repl, tmp, i + 1);
+ memcpy(buf + idx, tmp, olen);
+ if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
+ // fprintf(stderr, "RTN ATTEMPT tob64 %u idx=%u result %u\n", tob64,
+ // idx, *status);
+
+ }
+
+ #endif
+
+ // input is converted to hex? convert repl to binary!
+ if (i < 16 && tohex > i) {
+
+ u32 off;
+ if (to_slash + to_x + to_0 == 2) {
+
+ off = 2;
+
+ } else {
+
+ off = 0;
+
+ }
+
+ for (j = 0; j <= i; j++)
+ tmp[j] = (hex_table[repl[off + (j << 1)] - '0'] << 4) +
+ hex_table[repl[off + (j << 1) + 1] - '0'];
+
+ memcpy(buf + idx, tmp, i + 1);
+ if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
+ // fprintf(stderr, "RTN ATTEMPT tohex %u result %u\n", tohex, *status);
+
+ }
+
+ // input is hex and converted to binary? convert repl to hex!
+ if (i && (i % 2) && i < 16 && fromhex &&
+ fromhex + from_slash + from_x + from_0 > i) {
+
+ u8 off = 0;
+ if (from_slash && from_x) {
+
+ tmp[0] = '\\';
+ if (from_X) {
+
+ tmp[1] = 'X';
+
+ } else {
+
+ tmp[1] = 'x';
+
+ }
+
+ off = 2;
+
+ } else if (from_0 && from_x) {
+
+ tmp[0] = '0';
+ if (from_X) {
+
+ tmp[1] = 'X';
+
+ } else {
+
+ tmp[1] = 'x';
+
+ }
+
+ off = 2;
+
+ }
+
+ if (to_up == 1) {
+
+ for (j = 0; j <= (i >> 1); j++) {
+
+ tmp[off + (j << 1)] = hex_table_up[repl[j] >> 4];
+ tmp[off + (j << 1) + 1] = hex_table_up[repl[j] % 16];
+
+ }
+
+ } else {
+
+ for (j = 0; j <= (i >> 1); j++) {
+
+ tmp[off + (j << 1)] = hex_table_low[repl[j] >> 4];
+ tmp[off + (j << 1) + 1] = hex_table_low[repl[j] % 16];
+
+ }
+
+ }
+
+ memcpy(buf + idx, tmp, i + 1 + off);
+ if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
+ // fprintf(stderr, "RTN ATTEMPT fromhex %u result %u\n", fromhex,
+ // *status);
+ memcpy(buf + idx + i, save + i, i + 1 + off);
+
+ }
+
+ if (xor > i) {
+
+ for (j = 0; j <= i; j++)
+ buf[idx + j] = repl[j] ^ xor_val[j];
+ if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
+ // fprintf(stderr, "RTN ATTEMPT xor %u result %u\n", xor, *status);
+
+ }
+
+ if (arith > i && *status != 1) {
+
+ for (j = 0; j <= i; j++)
+ buf[idx + j] = repl[j] - arith_val[j];
+ if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
+ // fprintf(stderr, "RTN ATTEMPT arith %u result %u\n", arith, *status);
+
+ }
+
+ if (toupper > i && *status != 1) {
+
+ for (j = 0; j <= i; j++)
+ buf[idx + j] = repl[j] | 0x20;
+ if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
+ // fprintf(stderr, "RTN ATTEMPT toupper %u result %u\n", toupper,
+ // *status);
+
+ }
+
+ if (tolower > i && *status != 1) {
+
+ for (j = 0; j <= i; j++)
+ buf[idx + j] = repl[j] & 0x5f;
+ if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
+ // fprintf(stderr, "RTN ATTEMPT tolower %u result %u\n", tolower,
+ // *status);
+
+ }
+
+ #ifdef COMBINE
+ if (*status == 1) { memcpy(cbuf + idx, &buf[idx], i + 1); }
+ #endif
+
+ if ((i >= 7 &&
+ (i >= xor&&i >= arith &&i >= tolower &&i >= toupper &&i > tohex &&i >
+ (fromhex + from_0 + from_x + from_slash + 1)
+ #ifdef TRANSFORM_BASE64
+ && i > tob64 + 3 && i > fromb64 + 4
+ #endif
+ )) ||
+ repl[i] != changed_val[i] || *status == 1) {
+
+ break;
+
+ }
+
+ }
+
+ memcpy(&buf[idx], save, i);
}
- memcpy(&buf[idx], save, i);
+#endif
+
return 0;
}
-static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
+static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
+ u32 len, u8 lvl, struct tainted *taint) {
+ struct tainted * t;
struct cmp_header *h = &afl->shm.cmp_map->headers[key];
- u32 i, j, idx;
+ u32 i, j, idx, have_taint = 1, taint_len, loggeds;
+ u8 status = 0, found_one = 0;
- u32 loggeds = h->hits;
- if (h->hits > CMP_MAP_RTN_H) { loggeds = CMP_MAP_RTN_H; }
+ if (h->hits > CMP_MAP_RTN_H) {
- u8 status = 0;
- // opt not in the paper
- // u32 fails = 0;
- u8 found_one = 0;
+ loggeds = CMP_MAP_RTN_H;
- for (i = 0; i < loggeds; ++i) {
+ } else {
+
+ loggeds = h->hits;
+
+ }
- u32 fails = 0;
+ for (i = 0; i < loggeds; ++i) {
struct cmpfn_operands *o =
&((struct cmpfn_operands *)afl->shm.cmp_map->log[key])[i];
@@ -696,50 +2174,89 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
}
- for (idx = 0; idx < len && fails < 8; ++idx) {
+ /*
+ struct cmp_header *hh = &afl->orig_cmp_map->headers[key];
+ fprintf(stderr, "RTN N hits=%u id=%u shape=%u attr=%u v0=", h->hits, h->id,
+ h->shape, h->attribute); for (j = 0; j < 8; j++) fprintf(stderr, "%02x",
+ o->v0[j]); fprintf(stderr, " v1="); for (j = 0; j < 8; j++) fprintf(stderr,
+ "%02x", o->v1[j]); fprintf(stderr, "\nRTN O hits=%u id=%u shape=%u attr=%u
+ o0=", hh->hits, hh->id, hh->shape, hh->attribute); for (j = 0; j < 8; j++)
+ fprintf(stderr, "%02x", orig_o->v0[j]);
+ fprintf(stderr, " o1=");
+ for (j = 0; j < 8; j++)
+ fprintf(stderr, "%02x", orig_o->v1[j]);
+ fprintf(stderr, "\n");
+ */
+
+ t = taint;
+ while (t->next) {
+
+ t = t->next;
- if (unlikely(rtn_extend_encoding(afl, o->v0, o->v1, orig_o->v0, idx,
- orig_buf, buf, len, &status))) {
+ }
- return 1;
+ for (idx = 0; idx < len; ++idx) {
- }
+ if (have_taint) {
- if (status == 2) {
+ if (!t || idx < t->pos) {
- ++fails;
+ continue;
- } else if (status == 1) {
+ } else {
- break;
+ taint_len = t->pos + t->len - idx;
+
+ if (idx == t->pos + t->len - 1) { t = t->prev; }
+
+ }
+
+ } else {
+
+ taint_len = len - idx;
}
- if (unlikely(rtn_extend_encoding(afl, o->v1, o->v0, orig_o->v1, idx,
- orig_buf, buf, len, &status))) {
+ status = 0;
+
+ if (unlikely(rtn_extend_encoding(afl, o->v0, o->v1, orig_o->v0,
+ orig_o->v1, idx, taint_len, orig_buf,
+ buf, cbuf, len, lvl, &status))) {
return 1;
}
- if (status == 2) {
+ if (status == 1) {
- ++fails;
+ found_one = 1;
+ break;
- } else if (status == 1) {
+ }
+
+ status = 0;
+
+ if (unlikely(rtn_extend_encoding(afl, o->v1, o->v0, orig_o->v1,
+ orig_o->v0, idx, taint_len, orig_buf,
+ buf, cbuf, len, lvl, &status))) {
+
+ return 1;
+ }
+
+ if (status == 1) {
+
+ found_one = 1;
break;
}
}
- if (status == 1) { found_one = 1; }
-
// If failed, add to dictionary
- if (fails == 8) {
+ if (!found_one && (lvl & LVL1)) {
- if (afl->pass_stats[key].total == 0) {
+ if (unlikely(!afl->pass_stats[key].total)) {
maybe_add_auto(afl, o->v0, SHAPE_BYTES(h->shape));
maybe_add_auto(afl, o->v1, SHAPE_BYTES(h->shape));
@@ -768,54 +2285,133 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
///// Input to State stage
// afl->queue_cur->exec_cksum
-u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
- u64 exec_cksum) {
+u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
u8 r = 1;
- if (unlikely(!afl->orig_cmp_map)) {
+ if (unlikely(!afl->pass_stats)) {
- afl->orig_cmp_map = ck_alloc_nozero(sizeof(struct cmp_map));
+ afl->pass_stats = ck_alloc(sizeof(struct afl_pass_stat) * CMP_MAP_W);
}
- if (unlikely(!afl->pass_stats)) {
+ struct tainted *taint = NULL;
- afl->pass_stats = ck_alloc(sizeof(struct afl_pass_stat) * CMP_MAP_W);
+ if (!afl->queue_cur->taint || !afl->queue_cur->cmplog_colorinput) {
+
+ if (unlikely(colorization(afl, buf, len, &taint))) { return 1; }
+
+ // no taint? still try, create a dummy to prevent again colorization
+ if (!taint) {
+
+#ifdef _DEBUG
+ fprintf(stderr, "TAINT FAILED\n");
+#endif
+ afl->queue_cur->colorized = CMPLOG_LVL_MAX;
+ return 0;
+
+ }
+
+#ifdef _DEBUG
+ else if (taint->pos == 0 && taint->len == len) {
+
+ fprintf(stderr, "TAINT FULL\n");
+
+ }
+
+#endif
+
+ } else {
+
+ buf = afl->queue_cur->cmplog_colorinput;
+ taint = afl->queue_cur->taint;
}
- // do it manually, forkserver clear only afl->fsrv.trace_bits
- memset(afl->shm.cmp_map->headers, 0, sizeof(afl->shm.cmp_map->headers));
+ struct tainted *t = taint;
- if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) { return 1; }
+ while (t) {
- memcpy(afl->orig_cmp_map, afl->shm.cmp_map, sizeof(struct cmp_map));
+#ifdef _DEBUG
+ fprintf(stderr, "T: idx=%u len=%u\n", t->pos, t->len);
+#endif
+ t = t->next;
+
+ }
+
+#if defined(_DEBUG) || defined(CMPLOG_INTROSPECTION)
+ u64 start_time = get_cur_time();
+ u32 cmp_locations = 0;
+#endif
- if (unlikely(colorization(afl, buf, len, exec_cksum))) { return 1; }
+ // Generate the cmplog data
- // do it manually, forkserver clear only afl->fsrv.trace_bits
- memset(afl->shm.cmp_map->headers, 0, sizeof(afl->shm.cmp_map->headers));
+ // manually clear the full cmp_map
+ memset(afl->shm.cmp_map, 0, sizeof(struct cmp_map));
+ if (unlikely(common_fuzz_cmplog_stuff(afl, orig_buf, len))) { return 1; }
+ if (unlikely(!afl->orig_cmp_map)) {
+
+ afl->orig_cmp_map = ck_alloc_nozero(sizeof(struct cmp_map));
+ }
+
+ memcpy(afl->orig_cmp_map, afl->shm.cmp_map, sizeof(struct cmp_map));
+ memset(afl->shm.cmp_map->headers, 0, sizeof(struct cmp_header) * CMP_MAP_W);
if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) { return 1; }
+#ifdef _DEBUG
+ dump("ORIG", orig_buf, len);
+ dump("NEW ", buf, len);
+#endif
+
+ // Start insertion loop
+
u64 orig_hit_cnt, new_hit_cnt;
u64 orig_execs = afl->fsrv.total_execs;
orig_hit_cnt = afl->queued_paths + afl->unique_crashes;
+ u64 screen_update = 1000000 / afl->queue_cur->exec_us,
+ execs = afl->fsrv.total_execs;
afl->stage_name = "input-to-state";
afl->stage_short = "its";
afl->stage_max = 0;
afl->stage_cur = 0;
+ u32 lvl;
+ u32 cmplog_done = afl->queue_cur->colorized;
+ u32 cmplog_lvl = afl->cmplog_lvl;
+ if (!cmplog_done) {
+
+ lvl = LVL1;
+
+ } else {
+
+ lvl = 0;
+
+ }
+
+ if (cmplog_lvl >= 2 && cmplog_done < 2) { lvl += LVL2; }
+ if (cmplog_lvl >= 3 && cmplog_done < 3) { lvl += LVL3; }
+
+#ifdef COMBINE
+ u8 *cbuf = afl_realloc((void **)&afl->in_scratch_buf, len + 128);
+ memcpy(cbuf, orig_buf, len);
+ u8 *virgin_backup = afl_realloc((void **)&afl->ex_buf, afl->shm.map_size);
+ memcpy(virgin_backup, afl->virgin_bits, afl->shm.map_size);
+#else
+ u8 *cbuf = NULL;
+#endif
+
u32 k;
for (k = 0; k < CMP_MAP_W; ++k) {
if (!afl->shm.cmp_map->headers[k].hits) { continue; }
- if (afl->pass_stats[k].total &&
- (rand_below(afl, afl->pass_stats[k].total) >=
- afl->pass_stats[k].faileds ||
- afl->pass_stats[k].total == 0xff)) {
+ if (afl->pass_stats[k].faileds == 0xff ||
+ afl->pass_stats[k].total == 0xff) {
+
+#ifdef _DEBUG
+ fprintf(stderr, "DISABLED %u\n", k);
+#endif
afl->shm.cmp_map->headers[k].hits = 0; // ignore this cmp
@@ -839,13 +2435,37 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
if (!afl->shm.cmp_map->headers[k].hits) { continue; }
+#if defined(_DEBUG) || defined(CMPLOG_INTROSPECTION)
+ ++cmp_locations;
+#endif
+
if (afl->shm.cmp_map->headers[k].type == CMP_TYPE_INS) {
- if (unlikely(cmp_fuzz(afl, k, orig_buf, buf, len))) { goto exit_its; }
+ if (unlikely(cmp_fuzz(afl, k, orig_buf, buf, cbuf, len, lvl, taint))) {
- } else {
+ goto exit_its;
+
+ }
+
+ } else if ((lvl & LVL1)
+
+#ifdef TRANSFORM
+ || (lvl & LVL3)
+#endif
+ ) {
- if (unlikely(rtn_fuzz(afl, k, orig_buf, buf, len))) { goto exit_its; }
+ if (unlikely(rtn_fuzz(afl, k, orig_buf, buf, cbuf, len, lvl, taint))) {
+
+ goto exit_its;
+
+ }
+
+ }
+
+ if (afl->fsrv.total_execs - execs > screen_update) {
+
+ execs = afl->fsrv.total_execs;
+ show_stats(afl);
}
@@ -854,13 +2474,126 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
r = 0;
exit_its:
+
+ afl->queue_cur->colorized = afl->cmplog_lvl;
+ if (afl->cmplog_lvl == CMPLOG_LVL_MAX) {
+
+ ck_free(afl->queue_cur->cmplog_colorinput);
+ t = taint;
+ while (taint) {
+
+ t = taint->next;
+ ck_free(taint);
+ taint = t;
+
+ }
+
+ afl->queue_cur->taint = NULL;
+
+ } else {
+
+ if (!afl->queue_cur->taint) { afl->queue_cur->taint = taint; }
+
+ if (!afl->queue_cur->cmplog_colorinput) {
+
+ afl->queue_cur->cmplog_colorinput = ck_alloc_nozero(len);
+ memcpy(afl->queue_cur->cmplog_colorinput, buf, len);
+ memcpy(buf, orig_buf, len);
+
+ }
+
+ }
+
+#ifdef COMBINE
+ if (afl->queued_paths + afl->unique_crashes > orig_hit_cnt + 1) {
+
+ // copy the current virgin bits so we can recover the information
+ u8 *virgin_save = afl_realloc((void **)&afl->eff_buf, afl->shm.map_size);
+ memcpy(virgin_save, afl->virgin_bits, afl->shm.map_size);
+ // reset virgin bits to the backup previous to redqueen
+ memcpy(afl->virgin_bits, virgin_backup, afl->shm.map_size);
+
+ u8 status = 0;
+ its_fuzz(afl, cbuf, len, &status);
+
+ // now combine with the saved virgin bits
+ #ifdef WORD_SIZE_64
+ u64 *v = (u64 *)afl->virgin_bits;
+ u64 *s = (u64 *)virgin_save;
+ u32 i;
+ for (i = 0; i < (afl->shm.map_size >> 3); i++) {
+
+ v[i] &= s[i];
+
+ }
+
+ #else
+ u32 *v = (u64 *)afl->virgin_bits;
+ u32 *s = (u64 *)virgin_save;
+ u32 i;
+ for (i = 0; i < (afl->shm.map_size >> 2); i++) {
+
+ v[i] &= s[i];
+
+ }
+
+ #endif
+
+ #ifdef _DEBUG
+ dump("COMB", cbuf, len);
+ if (status == 1) {
+
+ fprintf(stderr, "NEW COMBINED\n");
+
+ } else {
+
+ fprintf(stderr, "NO new combined\n");
+
+ }
+
+ #endif
+
+ }
+
+#endif
+
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
afl->stage_finds[STAGE_ITS] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_ITS] += afl->fsrv.total_execs - orig_execs;
- memcpy(buf, orig_buf, len);
+#if defined(_DEBUG) || defined(CMPLOG_INTROSPECTION)
+ FILE *f = stderr;
+ #ifndef _DEBUG
+ if (afl->not_on_tty) {
+
+ char fn[4096];
+ snprintf(fn, sizeof(fn), "%s/introspection_cmplog.txt", afl->out_dir);
+ f = fopen(fn, "a");
+
+ }
+
+ #endif
+
+ if (f) {
+
+ fprintf(f,
+ "Cmplog: fname=%s len=%u ms=%llu result=%u finds=%llu entries=%u\n",
+ afl->queue_cur->fname, len, get_cur_time() - start_time, r,
+ new_hit_cnt - orig_hit_cnt, cmp_locations);
+
+ #ifndef _DEBUG
+ if (afl->not_on_tty) { fclose(f); }
+ #endif
+
+ }
+
+#endif
return r;
}
+#ifdef COMBINE
+ #undef COMBINE
+#endif
+
diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c
index 60c9684c..8423a3d1 100644
--- a/src/afl-fuzz-state.c
+++ b/src/afl-fuzz-state.c
@@ -102,6 +102,7 @@ void afl_state_init(afl_state_t *afl, uint32_t map_size) {
afl->stats_update_freq = 1;
afl->stats_avg_exec = 0;
afl->skip_deterministic = 1;
+ afl->cmplog_lvl = 1;
#ifndef NO_SPLICING
afl->use_splicing = 1;
#endif
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 7facf261..95bc0694 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -77,13 +77,8 @@ static void at_exit() {
}
int kill_signal = SIGKILL;
-
/* AFL_KILL_SIGNAL should already be a valid int at this point */
- if (getenv("AFL_KILL_SIGNAL")) {
-
- kill_signal = atoi(getenv("AFL_KILL_SIGNAL"));
-
- }
+ if ((ptr = getenv("AFL_KILL_SIGNAL"))) { kill_signal = atoi(ptr); }
if (pid1 > 0) { kill(pid1, kill_signal); }
if (pid2 > 0) { kill(pid2, kill_signal); }
@@ -103,13 +98,14 @@ static void usage(u8 *argv0, int more_help) {
"Execution control settings:\n"
" -p schedule - power schedules compute a seed's performance score:\n"
- " <fast(default), rare, exploit, seek, mmopt, coe, "
- "explore,\n"
- " lin, quad> -- see docs/power_schedules.md\n"
+ " fast(default), explore, exploit, seek, rare, mmopt, "
+ "coe, lin\n"
+ " quad -- see docs/power_schedules.md\n"
" -f file - location read by the fuzzed program (default: stdin "
"or @@)\n"
" -t msec - timeout for each run (auto-scaled, 50-%u ms)\n"
- " -m megs - memory limit for child process (%u MB, 0 = no limit)\n"
+ " -m megs - memory limit for child process (%u MB, 0 = no limit "
+ "[default])\n"
" -Q - use binary-only instrumentation (QEMU mode)\n"
" -U - use unicorn-based instrumentation (Unicorn mode)\n"
" -W - use qemu-based instrumentation with Wine (Wine "
@@ -125,7 +121,9 @@ static void usage(u8 *argv0, int more_help) {
" See docs/README.MOpt.md\n"
" -c program - enable CmpLog by specifying a binary compiled for "
"it.\n"
- " if using QEMU, just use -c 0.\n\n"
+ " if using QEMU, just use -c 0.\n"
+ " -l cmplog_level - set the complexity/intensivity of CmpLog.\n"
+ " Values: 1 (default), 2 (intensive) and 3 (heavy)\n\n"
"Fuzzing behavior settings:\n"
" -Z - sequential queue selection instead of weighted "
@@ -357,7 +355,8 @@ int main(int argc, char **argv_orig, char **envp) {
while ((opt = getopt(
argc, argv,
- "+b:c:i:I:o:f:F:m:t:T:dDnCB:S:M:x:QNUWe:p:s:V:E:L:hRP:Z")) > 0) {
+ "+b:B:c:CdDe:E:hi:I:f:F:l:L:m:M:nNo:p:P:RQs:S:t:T:UV:Wx:Z")) >
+ 0) {
switch (opt) {
@@ -786,6 +785,26 @@ int main(int argc, char **argv_orig, char **envp) {
} break;
+ case 'l': {
+
+ afl->cmplog_lvl = atoi(optarg);
+ if (afl->cmplog_lvl < 1 || afl->cmplog_lvl > CMPLOG_LVL_MAX) {
+
+ FATAL(
+ "Bad complog level value, accepted values are 1 (default), 2 and "
+ "%u.",
+ CMPLOG_LVL_MAX);
+
+ }
+
+ if (afl->cmplog_lvl == CMPLOG_LVL_MAX) {
+
+ afl->cmplog_max_filesize = MAX_FILE;
+
+ }
+
+ } break;
+
case 'L': { /* MOpt mode */
if (afl->limit_time_sig) { FATAL("Multiple -L options not supported"); }
@@ -1075,6 +1094,8 @@ int main(int argc, char **argv_orig, char **envp) {
}
+ if (afl->shm.cmplog_mode) { OKF("CmpLog level: %u", afl->cmplog_lvl); }
+
/* Dynamically allocate memory for AFLFast schedules */
if (afl->schedule >= FAST && afl->schedule <= RARE) {
@@ -1634,6 +1655,14 @@ int main(int argc, char **argv_orig, char **envp) {
if (afl->use_splicing) {
++afl->cycles_wo_finds;
+
+ if (unlikely(afl->shm.cmplog_mode &&
+ afl->cmplog_max_filesize < MAX_FILE)) {
+
+ afl->cmplog_max_filesize <<= 4;
+
+ }
+
switch (afl->expand_havoc) {
case 0:
@@ -1651,6 +1680,7 @@ int main(int argc, char **argv_orig, char **envp) {
}
afl->expand_havoc = 2;
+ if (afl->cmplog_lvl < 2) afl->cmplog_lvl = 2;
break;
case 2:
// if (!have_p) afl->schedule = EXPLOIT;
@@ -1664,11 +1694,14 @@ int main(int argc, char **argv_orig, char **envp) {
afl->expand_havoc = 4;
break;
case 4:
- // if not in sync mode, enable deterministic mode?
- // if (!afl->sync_id) afl->skip_deterministic = 0;
afl->expand_havoc = 5;
+ if (afl->cmplog_lvl < 3) afl->cmplog_lvl = 3;
break;
case 5:
+ // if not in sync mode, enable deterministic mode?
+ if (!afl->sync_id) afl->skip_deterministic = 0;
+ afl->expand_havoc = 6;
+ case 6:
// nothing else currently
break;
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 6d95fc1d..ee6d6de9 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -39,6 +39,7 @@
#include "sharedmem.h"
#include "forkserver.h"
#include "common.h"
+#include "hash.h"
#include <stdio.h>
#include <unistd.h>
@@ -83,7 +84,8 @@ static u8 quiet_mode, /* Hide non-essential messages? */
binary_mode, /* Write output as a binary map */
keep_cores, /* Allow coredumps? */
remove_shm = 1, /* remove shmem? */
- collect_coverage; /* collect coverage */
+ collect_coverage, /* collect coverage */
+ no_classify; /* do not classify counts */
static volatile u8 stop_soon, /* Ctrl-C pressed? */
child_crashed; /* Child crashed? */
@@ -314,7 +316,9 @@ static void showmap_run_target_forkserver(afl_forkserver_t *fsrv, u8 *mem,
}
- classify_counts(fsrv);
+ if (fsrv->trace_bits[0] == 1) { fsrv->trace_bits[0] = 0; }
+
+ if (!no_classify) { classify_counts(fsrv); }
if (!quiet_mode) { SAYF(cRST "-- Program output ends --\n"); }
@@ -487,7 +491,9 @@ static void showmap_run_target(afl_forkserver_t *fsrv, char **argv) {
}
- classify_counts(fsrv);
+ if (fsrv->trace_bits[0] == 1) { fsrv->trace_bits[0] = 0; }
+
+ if (!no_classify) { classify_counts(fsrv); }
if (!quiet_mode) { SAYF(cRST "-- Program output ends --\n"); }
@@ -677,6 +683,7 @@ static void usage(u8 *argv0) {
" -q - sink program's output and don't show messages\n"
" -e - show edge coverage only, ignore hit counts\n"
" -r - show real tuple values instead of AFL filter values\n"
+ " -s - do not classify the map\n"
" -c - allow core dumps\n\n"
"This tool displays raw tuple data captured by AFL instrumentation.\n"
@@ -726,10 +733,14 @@ int main(int argc, char **argv_orig, char **envp) {
if (getenv("AFL_QUIET") != NULL) { be_quiet = 1; }
- while ((opt = getopt(argc, argv, "+i:o:f:m:t:A:eqCZQUWbcrh")) > 0) {
+ while ((opt = getopt(argc, argv, "+i:o:f:m:t:A:eqCZQUWbcrsh")) > 0) {
switch (opt) {
+ case 's':
+ no_classify = 1;
+ break;
+
case 'C':
collect_coverage = 1;
quiet_mode = 1;
@@ -1210,6 +1221,12 @@ int main(int argc, char **argv_orig, char **envp) {
showmap_run_target(fsrv, use_argv);
tcnt = write_results_to_file(fsrv, out_file);
+ if (!quiet_mode) {
+
+ OKF("Hash of coverage map: %llx",
+ hash64(fsrv->trace_bits, fsrv->map_size, HASH_CONST));
+
+ }
}
diff --git a/test/test-basic.sh b/test/test-basic.sh
index 8296b6cc..fcac8ca3 100755
--- a/test/test-basic.sh
+++ b/test/test-basic.sh
@@ -27,13 +27,13 @@ test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc
rm -f test-instr.plain.0 test-instr.plain.1
SKIP=
TUPLES=`echo 1|../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'`
- test "$TUPLES" -gt 2 -a "$TUPLES" -lt 12 && {
+ test "$TUPLES" -gt 1 -a "$TUPLES" -lt 12 && {
$ECHO "$GREEN[+] ${AFL_GCC} run reported $TUPLES instrumented locations which is fine"
} || {
$ECHO "$RED[!] ${AFL_GCC} instrumentation produces weird numbers: $TUPLES"
CODE=1
}
- test "$TUPLES" -lt 4 && SKIP=1
+ test "$TUPLES" -lt 3 && SKIP=1
true # this is needed because of the test above
} || {
$ECHO "$RED[!] ${AFL_GCC} failed"
@@ -147,13 +147,13 @@ test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc
}
rm -f test-instr.plain.0 test-instr.plain.1
TUPLES=`echo 1|../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'`
- test "$TUPLES" -gt 2 -a "$TUPLES" -lt 12 && {
+ test "$TUPLES" -gt 1 -a "$TUPLES" -lt 12 && {
$ECHO "$GREEN[+] ${AFL_GCC} run reported $TUPLES instrumented locations which is fine"
} || {
$ECHO "$RED[!] ${AFL_GCC} instrumentation produces weird numbers: $TUPLES"
CODE=1
}
- test "$TUPLES" -lt 4 && SKIP=1
+ test "$TUPLES" -lt 3 && SKIP=1
true # this is needed because of the test above
} || {
$ECHO "$RED[!] ${AFL_GCC} failed"
diff --git a/test/test-gcc-plugin.sh b/test/test-gcc-plugin.sh
index 9fe63ea3..0157d89f 100755
--- a/test/test-gcc-plugin.sh
+++ b/test/test-gcc-plugin.sh
@@ -19,14 +19,14 @@ test -e ../afl-gcc-fast -a -e ../afl-compiler-rt.o && {
} || {
$ECHO "$GREEN[+] gcc_plugin instrumentation present and working correctly"
TUPLES=`echo 0|../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain.gccpi 2>&1 | grep Captur | awk '{print$3}'`
- test "$TUPLES" -gt 3 -a "$TUPLES" -lt 9 && {
+ test "$TUPLES" -gt 2 -a "$TUPLES" -lt 9 && {
$ECHO "$GREEN[+] gcc_plugin run reported $TUPLES instrumented locations which is fine"
} || {
$ECHO "$RED[!] gcc_plugin instrumentation produces a weird numbers: $TUPLES"
$ECHO "$YELLOW[-] this is a known issue in gcc, not afl++. It is not flagged as an error because travis builds would all fail otherwise :-("
#CODE=1
}
- test "$TUPLES" -lt 4 && SKIP=1
+ test "$TUPLES" -lt 3 && SKIP=1
true
}
} || {
diff --git a/test/test-llvm-lto.sh b/test/test-llvm-lto.sh
index d0b8f8fc..a931afb7 100755
--- a/test/test-llvm-lto.sh
+++ b/test/test-llvm-lto.sh
@@ -25,7 +25,7 @@ test -e ../afl-clang-lto -a -e ../afl-llvm-lto-instrumentation.so && {
} || {
$ECHO "$GREEN[+] llvm_mode LTO instrumentation present and working correctly"
TUPLES=`echo 0|../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'`
- test "$TUPLES" -gt 3 -a "$TUPLES" -lt 7 && {
+ test "$TUPLES" -gt 2 -a "$TUPLES" -lt 7 && {
$ECHO "$GREEN[+] llvm_mode LTO run reported $TUPLES instrumented locations which is fine"
} || {
$ECHO "$RED[!] llvm_mode LTO instrumentation produces weird numbers: $TUPLES"
diff --git a/test/test-llvm.sh b/test/test-llvm.sh
index e5005d72..c968d5a9 100755
--- a/test/test-llvm.sh
+++ b/test/test-llvm.sh
@@ -25,13 +25,13 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && {
} || {
$ECHO "$GREEN[+] llvm_mode instrumentation present and working correctly"
TUPLES=`echo 0|../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'`
- test "$TUPLES" -gt 3 -a "$TUPLES" -lt 8 && {
+ test "$TUPLES" -gt 2 -a "$TUPLES" -lt 8 && {
$ECHO "$GREEN[+] llvm_mode run reported $TUPLES instrumented locations which is fine"
} || {
$ECHO "$RED[!] llvm_mode instrumentation produces weird numbers: $TUPLES"
CODE=1
}
- test "$TUPLES" -lt 4 && SKIP=1
+ test "$TUPLES" -lt 3 && SKIP=1
true
}
} || {
@@ -129,7 +129,7 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && {
AFL_LLVM_INSTRUMENT=CFG AFL_LLVM_INSTRIM_LOOPHEAD=1 ../afl-clang-fast -o test-instr.instrim ../test-instr.c > /dev/null 2>test.out
test -e test-instr.instrim && {
TUPLES=`echo 0|../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.instrim 2>&1 | grep Captur | awk '{print$3}'`
- test "$TUPLES" -gt 2 -a "$TUPLES" -lt 5 && {
+ test "$TUPLES" -gt 1 -a "$TUPLES" -lt 5 && {
$ECHO "$GREEN[+] llvm_mode InsTrim reported $TUPLES instrumented locations which is fine"
} || {
$ECHO "$RED[!] llvm_mode InsTrim instrumentation produces weird numbers: $TUPLES"
diff --git a/unicorn_mode/build_unicorn_support.sh b/unicorn_mode/build_unicorn_support.sh
index 8f6ceab7..c32eb3e1 100755
--- a/unicorn_mode/build_unicorn_support.sh
+++ b/unicorn_mode/build_unicorn_support.sh
@@ -177,8 +177,9 @@ echo "[*] Checking out $UNICORNAFL_VERSION"
sh -c 'git stash && git stash drop' 1>/dev/null 2>/dev/null
git checkout "$UNICORNAFL_VERSION" || exit 1
-echo "[*] making sure config.h matches"
-cp "../../config.h" "." || exit 1
+echo "[*] making sure afl++ header files match"
+cp "../../include/config.h" "." || exit 1
+cp "../../include/types.h" "." || exit 1
echo "[*] Configuring Unicorn build..."
diff --git a/utils/aflpp_driver/aflpp_driver.c b/utils/aflpp_driver/aflpp_driver.c
index 30e6ebb9..7bb929b2 100644
--- a/utils/aflpp_driver/aflpp_driver.c
+++ b/utils/aflpp_driver/aflpp_driver.c
@@ -47,6 +47,7 @@ $AFL_HOME/afl-fuzz -i IN -o OUT ./a.out
#include <sys/mman.h>
#include "config.h"
+#include "types.h"
#include "cmplog.h"
#ifdef _DEBUG
diff --git a/utils/defork/defork.c b/utils/defork/defork.c
index f50b9a4b..c9be3283 100644
--- a/utils/defork/defork.c
+++ b/utils/defork/defork.c
@@ -5,6 +5,7 @@
#include <stdbool.h>
#include "../../include/config.h"
+#include "../../include/types.h"
/* we want to fork once (for the afl++ forkserver),
then immediately return as child on subsequent forks. */
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-22 23:18:34 +0000