diff options
| -rw-r--r-- | Makefile | 2 | ||||
| -rw-r--r-- | gcc_plugin/afl-gcc-pass.so.cc | 23 | ||||
| -rw-r--r-- | gcc_plugin/afl-gcc-rt.o.c | 12 | ||||
| -rw-r--r-- | include/afl-fuzz.h | 2 | ||||
| -rwxr-xr-x | include/android-ashmem.h | 6 | ||||
| -rw-r--r-- | include/config.h | 6 | ||||
| -rw-r--r-- | libdislocator/libdislocator.so.c | 113 | ||||
| -rw-r--r-- | llvm_mode/LLVMInsTrim.so.cc | 21 | ||||
| -rw-r--r-- | llvm_mode/afl-clang-fast.c | 12 | ||||
| -rw-r--r-- | llvm_mode/afl-llvm-pass.so.cc | 12 | ||||
| -rw-r--r-- | llvm_mode/split-compares-pass.so.cc | 12 | ||||
| -rw-r--r-- | qemu_mode/libcompcov/libcompcov.so.c | 1 | ||||
| -rw-r--r-- | qemu_mode/patches/afl-qemu-cpu-inl.h | 6 | ||||
| -rw-r--r-- | qemu_mode/patches/afl-qemu-floats.h | 40 | ||||
| -rw-r--r-- | src/afl-analyze.c | 3 | ||||
| -rw-r--r-- | src/afl-as.c | 2 | ||||
| -rw-r--r-- | src/afl-fuzz-bitmap.c | 12 | ||||
| -rw-r--r-- | src/afl-fuzz-globals.c | 4 | ||||
| -rw-r--r-- | src/afl-fuzz-init.c | 18 | ||||
| -rw-r--r-- | src/afl-fuzz-one.c | 39 | ||||
| -rw-r--r-- | src/afl-fuzz-run.c | 2 | ||||
| -rw-r--r-- | src/afl-fuzz-stats.c | 29 | ||||
| -rw-r--r-- | src/afl-fuzz.c | 54 | ||||
| -rw-r--r-- | src/afl-gotcpu.c | 11 | ||||
| -rw-r--r-- | unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h | 2 |
25 files changed, 254 insertions, 190 deletions
diff --git a/Makefile b/Makefile index b5ee6a71..58655cd8 100644 --- a/Makefile +++ b/Makefile @@ -236,7 +236,7 @@ code-format: ./.custom-format.py -i llvm_mode/*.h ./.custom-format.py -i llvm_mode/*.cc ./.custom-format.py -i gcc_plugin/*.c - ./.custom-format.py -i gcc_plugin/*.h + #./.custom-format.py -i gcc_plugin/*.h ./.custom-format.py -i gcc_plugin/*.cc ./.custom-format.py -i qemu_mode/patches/*.h ./.custom-format.py -i qemu_mode/libcompcov/*.c diff --git a/gcc_plugin/afl-gcc-pass.so.cc b/gcc_plugin/afl-gcc-pass.so.cc index 19e4dfba..ab7daebb 100644 --- a/gcc_plugin/afl-gcc-pass.so.cc +++ b/gcc_plugin/afl-gcc-pass.so.cc @@ -166,7 +166,7 @@ static unsigned int ext_call_instrument(function *fun) { fcall = gimple_build_call( fndecl, 1, cur_loc); /* generate the function _call_ to above built reference, with - *1* parameter -> the random const for the location */ + *1* parameter -> the random const for the location */ gimple_seq_add_stmt(&seq, fcall); /* and insert into a sequence */ /* Done - grab the entry to the block and insert sequence */ @@ -202,10 +202,9 @@ static unsigned int inline_instrument(function *fun) { basic_block bb; unsigned finst_blocks = 0; unsigned fcnt_blocks = 0; - tree one = build_int_cst(unsigned_char_type_node, 1); + tree one = build_int_cst(unsigned_char_type_node, 1); // tree zero = build_int_cst(unsigned_char_type_node, 0); - /* Set up global type declarations */ tree map_type = build_pointer_type(unsigned_char_type_node); tree map_ptr_g = @@ -417,8 +416,8 @@ class afl_pass : public gimple_opt_pass { if (!myWhitelist.empty()) { - bool instrumentBlock = false; - std::string instFilename; + bool instrumentBlock = false; + std::string instFilename; unsigned int instLine = 0; /* EXPR_FILENAME @@ -467,13 +466,17 @@ class afl_pass : public gimple_opt_pass { if (!instrumentBlock) { if (!be_quiet) { - if (!instFilename.empty()) - SAYF(cYEL "[!] " cBRI "Not in whitelist, skipping %s line %u...\n", - instFilename.c_str(), instLine); - else - SAYF(cYEL "[!] " cBRI "No filename information found, skipping it"); + + if (!instFilename.empty()) + SAYF(cYEL "[!] " cBRI "Not in whitelist, skipping %s line %u...\n", + instFilename.c_str(), instLine); + else + SAYF(cYEL "[!] " cBRI "No filename information found, skipping it"); + } + return 0; + } } diff --git a/gcc_plugin/afl-gcc-rt.o.c b/gcc_plugin/afl-gcc-rt.o.c index 1fb9e099..37cdbeb3 100644 --- a/gcc_plugin/afl-gcc-rt.o.c +++ b/gcc_plugin/afl-gcc-rt.o.c @@ -55,9 +55,9 @@ __thread u32 __afl_prev_loc; /* Trace a basic block with some ID */ void __afl_trace(const u32 x) { -#if 1 /* enable for neverZero feature. */ - __afl_area_ptr[__afl_prev_loc ^ x] += 1 - + ((u8)(1 + __afl_area_ptr[__afl_prev_loc ^ x]) == 0); +#if 1 /* enable for neverZero feature. */ + __afl_area_ptr[__afl_prev_loc ^ x] += + 1 + ((u8)(1 + __afl_area_ptr[__afl_prev_loc ^ x]) == 0); #else ++__afl_area_ptr[__afl_prev_loc ^ x]; #endif @@ -84,9 +84,9 @@ static void __afl_map_shm(void) { if (id_str) { #ifdef USEMMAP - const char* shm_file_path = id_str; + const char * shm_file_path = id_str; int shm_fd = -1; - unsigned char* shm_base = NULL; + unsigned char *shm_base = NULL; /* create the shared memory segment as if it was a file */ shm_fd = shm_open(shm_file_path, O_RDWR, 0600); @@ -265,7 +265,7 @@ int __afl_persistent_loop(unsigned int max_cnt) { } - return 0; + return 0; } diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index 8717519b..c85883dd 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -409,7 +409,7 @@ extern u32 rand_cnt; /* Random number counter */ #endif extern u32 rand_seed[2]; -extern s64 init_seed; +extern s64 init_seed; extern u64 total_cal_us, /* Total calibration time (us) */ total_cal_cycles; /* Total calibration cycles */ diff --git a/include/android-ashmem.h b/include/android-ashmem.h index 2d515cc5..2b9c811c 100755 --- a/include/android-ashmem.h +++ b/include/android-ashmem.h @@ -63,7 +63,8 @@ static inline int shmctl(int __shmid, int __cmd, struct shmid_ds *__buf) { } static inline int shmget(key_t __key, size_t __size, int __shmflg) { - (void) __shmflg; + + (void)__shmflg; int fd, ret; char ourkey[11]; @@ -86,7 +87,8 @@ error: } static inline void *shmat(int __shmid, const void *__shmaddr, int __shmflg) { - (void) __shmflg; + + (void)__shmflg; int size; void *ptr; diff --git a/include/config.h b/include/config.h index 5934d733..29bdf048 100644 --- a/include/config.h +++ b/include/config.h @@ -41,7 +41,7 @@ /* Comment out to disable fancy ANSI boxes and use poor man's 7-bit UI: */ -#ifndef ANDROID_DISABLE_FANCY // Fancy boxes are ugly from adb +#ifndef ANDROID_DISABLE_FANCY // Fancy boxes are ugly from adb #define FANCY_BOXES #endif @@ -55,7 +55,7 @@ #define EXEC_TM_ROUND 20 /* 64bit arch MACRO */ -#if (defined (__x86_64__) || defined (__arm64__) || defined (__aarch64__)) +#if (defined(__x86_64__) || defined(__arm64__) || defined(__aarch64__)) #define WORD_SIZE_64 1 #endif @@ -65,7 +65,7 @@ #define MEM_LIMIT 25 #else #define MEM_LIMIT 50 -#endif /* ^!WORD_SIZE_64 */ +#endif /* ^!WORD_SIZE_64 */ /* Default memory limit when running in QEMU mode (MB): */ diff --git a/libdislocator/libdislocator.so.c b/libdislocator/libdislocator.so.c index 31884545..72282834 100644 --- a/libdislocator/libdislocator.so.c +++ b/libdislocator/libdislocator.so.c @@ -34,10 +34,27 @@ #include <unistd.h> #include <sys/syscall.h> #ifdef __NR_getrandom -#define arc4random_buf(p, l) do { ssize_t rd = syscall(__NR_getrandom, p, l, 0); if (rd != l) DEBUGF("getrandom failed"); } while(0) +#define arc4random_buf(p, l) \ + do { \ + \ + ssize_t rd = syscall(__NR_getrandom, p, l, 0); \ + if (rd != l) DEBUGF("getrandom failed"); \ + \ + } while (0) + #else #include <time.h> -#define arc4random_buf(p, l) do { srand(time(NULL)); u32 i; u8 *ptr = (u8 *)p; for(i = 0; i < l; i++) ptr[i] = rand() % INT_MAX; } while(0) +#define arc4random_buf(p, l) \ + do { \ + \ + srand(time(NULL)); \ + u32 i; \ + u8* ptr = (u8*)p; \ + for (i = 0; i < l; i++) \ + ptr[i] = rand() % INT_MAX; \ + \ + } while (0) + #endif #endif @@ -52,7 +69,7 @@ #define MAP_ANONYMOUS MAP_ANON #endif /* !MAP_ANONYMOUS */ -#define SUPER_PAGE_SIZE 1<<21 +#define SUPER_PAGE_SIZE 1 << 21 /* Error / message handling: */ @@ -106,7 +123,7 @@ static u8 alloc_verbose, /* Additional debug messages */ hard_fail, /* abort() when max_mem exceeded? */ no_calloc_over; /* abort() on calloc() overflows? */ -#if defined __OpenBSD__ || defined __APPLE__ +#if defined __OpenBSD__ || defined __APPLE__ #define __thread #warning no thread support available #endif @@ -122,9 +139,9 @@ static __thread u32 alloc_canary; static void* __dislocator_alloc(size_t len) { - void* ret; + void* ret; size_t tlen; - int flags, fd, sp; + int flags, fd, sp; if (total_mem + len > max_mem || total_mem + len < total_mem) { @@ -156,21 +173,22 @@ static void* __dislocator_alloc(size_t len) { /* We will also store buffer length and a canary below the actual buffer, so let's add 8 bytes for that. */ - ret = mmap(NULL, tlen, PROT_READ | PROT_WRITE, - flags, fd, 0); + ret = mmap(NULL, tlen, PROT_READ | PROT_WRITE, flags, fd, 0); #if defined(USEHUGEPAGE) /* We try one more time with regular call */ if (ret == MAP_FAILED) { + #if defined(__APPLE__) - fd = -1; + fd = -1; #elif defined(__linux__) - flags &= -MAP_HUGETLB; + flags &= -MAP_HUGETLB; #elif defined(__FreeBSD__) - flags &= -MAP_ALIGNED_SUPER; + flags &= -MAP_ALIGNED_SUPER; #endif - ret = mmap(NULL, tlen, PROT_READ | PROT_WRITE, - flags, fd, 0); + ret = mmap(NULL, tlen, PROT_READ | PROT_WRITE, flags, fd, 0); + } + #endif if (ret == MAP_FAILED) { @@ -321,64 +339,75 @@ void* realloc(void* ptr, size_t len) { a normal request */ int posix_memalign(void** ptr, size_t align, size_t len) { - if (*ptr == NULL) - return EINVAL; - if ((align % 2) || (align % sizeof(void *))) - return EINVAL; - if (len == 0) { - *ptr = NULL; - return 0; - } - if (align >= 4 * sizeof(size_t)) len += align -1; - *ptr = malloc(len); + if (*ptr == NULL) return EINVAL; + if ((align % 2) || (align % sizeof(void*))) return EINVAL; + if (len == 0) { + + *ptr = NULL; + return 0; + + } + + if (align >= 4 * sizeof(size_t)) len += align - 1; + + *ptr = malloc(len); - DEBUGF("posix_memalign(%p %zu, %zu)", ptr, align, len); + DEBUGF("posix_memalign(%p %zu, %zu)", ptr, align, len); + + return 0; - return 0; } /* just the non-posix fashion */ -void *memalign(size_t align, size_t len) { - void* ret = NULL; +void* memalign(size_t align, size_t len) { + + void* ret = NULL; + + if (posix_memalign(&ret, align, len)) { + + DEBUGF("memalign(%zu, %zu) failed", align, len); - if (posix_memalign(&ret, align, len)) { - DEBUGF("memalign(%zu, %zu) failed", align, len); - } + } + + return ret; - return ret; } /* sort of C11 alias of memalign only more severe, alignment-wise */ -void *aligned_alloc(size_t align, size_t len) { - void *ret = NULL; +void* aligned_alloc(size_t align, size_t len) { - if ((len % align)) return NULL; + void* ret = NULL; - if (posix_memalign(&ret, align, len)) { - DEBUGF("aligned_alloc(%zu, %zu) failed", align, len); - } + if ((len % align)) return NULL; + + if (posix_memalign(&ret, align, len)) { + + DEBUGF("aligned_alloc(%zu, %zu) failed", align, len); + + } + + return ret; - return ret; } __attribute__((constructor)) void __dislocator_init(void) { - u8* tmp = (u8 *)getenv("AFL_LD_LIMIT_MB"); + u8* tmp = (u8*)getenv("AFL_LD_LIMIT_MB"); if (tmp) { - u8 *tok; - s32 mmem = (s32)strtol((char *)tmp, (char **)&tok, 10); + u8* tok; + s32 mmem = (s32)strtol((char*)tmp, (char**)&tok, 10); if (*tok != '\0' || errno == ERANGE) FATAL("Bad value for AFL_LD_LIMIT_MB"); max_mem = mmem * 1024 * 1024; } alloc_canary = ALLOC_CANARY; - tmp = (u8 *)getenv("AFL_RANDOM_ALLOC_CANARY"); + tmp = (u8*)getenv("AFL_RANDOM_ALLOC_CANARY"); if (tmp) arc4random_buf(&alloc_canary, sizeof(alloc_canary)); diff --git a/llvm_mode/LLVMInsTrim.so.cc b/llvm_mode/LLVMInsTrim.so.cc index f723a0fe..1fa361b5 100644 --- a/llvm_mode/LLVMInsTrim.so.cc +++ b/llvm_mode/LLVMInsTrim.so.cc @@ -158,9 +158,9 @@ struct InsTrim : public ModulePass { if (!myWhitelist.empty()) { - bool instrumentBlock = false; - DebugLoc Loc; - StringRef instFilename; + bool instrumentBlock = false; + DebugLoc Loc; + StringRef instFilename; unsigned int instLine = 0; for (auto &BB : F) { @@ -222,12 +222,17 @@ struct InsTrim : public ModulePass { if (!instrumentBlock) { if (!be_quiet) { - if (!instFilename.str().empty()) - SAYF(cYEL "[!] " cBRI "Not in whitelist, skipping %s line %u...\n", - instFilename.str().c_str(), instLine); - else - SAYF(cYEL "[!] " cBRI "No filename information found, skipping it"); + + if (!instFilename.str().empty()) + SAYF(cYEL "[!] " cBRI + "Not in whitelist, skipping %s line %u...\n", + instFilename.str().c_str(), instLine); + else + SAYF(cYEL "[!] " cBRI + "No filename information found, skipping it"); + } + continue; } diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c index b245cefa..e89b6183 100644 --- a/llvm_mode/afl-clang-fast.c +++ b/llvm_mode/afl-clang-fast.c @@ -122,15 +122,19 @@ static void edit_params(u32 argc, char** argv) { if (!strcmp(name, "afl-clang-fast++")) { u8* alt_cxx = getenv("AFL_CXX"); - if (has_llvm_config) snprintf(llvm_fullpath, sizeof(llvm_fullpath), "%s/clang++", LLVM_BINDIR); - else sprintf(llvm_fullpath, "clang++"); + if (has_llvm_config) + snprintf(llvm_fullpath, sizeof(llvm_fullpath), "%s/clang++", LLVM_BINDIR); + else + sprintf(llvm_fullpath, "clang++"); cc_params[0] = alt_cxx ? alt_cxx : (u8*)llvm_fullpath; } else { u8* alt_cc = getenv("AFL_CC"); - if (has_llvm_config) snprintf(llvm_fullpath, sizeof(llvm_fullpath), "%s/clang", LLVM_BINDIR); - else sprintf(llvm_fullpath, "clang"); + if (has_llvm_config) + snprintf(llvm_fullpath, sizeof(llvm_fullpath), "%s/clang", LLVM_BINDIR); + else + sprintf(llvm_fullpath, "clang"); cc_params[0] = alt_cc ? alt_cc : (u8*)llvm_fullpath; } diff --git a/llvm_mode/afl-llvm-pass.so.cc b/llvm_mode/afl-llvm-pass.so.cc index 4ce073a5..1601a4f8 100644 --- a/llvm_mode/afl-llvm-pass.so.cc +++ b/llvm_mode/afl-llvm-pass.so.cc @@ -94,12 +94,12 @@ bool AFLCoverage::runOnModule(Module &M) { LLVMContext &C = M.getContext(); - IntegerType *Int8Ty = IntegerType::getInt8Ty(C); - IntegerType *Int32Ty = IntegerType::getInt32Ty(C); - struct timeval tv; - struct timezone tz; - u32 rand_seed; - unsigned int cur_loc = 0; + IntegerType * Int8Ty = IntegerType::getInt8Ty(C); + IntegerType * Int32Ty = IntegerType::getInt32Ty(C); + struct timeval tv; + struct timezone tz; + u32 rand_seed; + unsigned int cur_loc = 0; /* Setup random() so we get Actually Random(TM) outputs from AFL_R() */ gettimeofday(&tv, &tz); diff --git a/llvm_mode/split-compares-pass.so.cc b/llvm_mode/split-compares-pass.so.cc index 60420f77..db884cde 100644 --- a/llvm_mode/split-compares-pass.so.cc +++ b/llvm_mode/split-compares-pass.so.cc @@ -103,11 +103,11 @@ bool SplitComparesTransform::simplifyCompares(Module &M) { } - if (enableFPSplit && ( - selectcmpInst->getPredicate() == CmpInst::FCMP_OGE || - selectcmpInst->getPredicate() == CmpInst::FCMP_UGE || - selectcmpInst->getPredicate() == CmpInst::FCMP_OLE || - selectcmpInst->getPredicate() == CmpInst::FCMP_ULE)) { + if (enableFPSplit && + (selectcmpInst->getPredicate() == CmpInst::FCMP_OGE || + selectcmpInst->getPredicate() == CmpInst::FCMP_UGE || + selectcmpInst->getPredicate() == CmpInst::FCMP_OLE || + selectcmpInst->getPredicate() == CmpInst::FCMP_ULE)) { auto op0 = selectcmpInst->getOperand(0); auto op1 = selectcmpInst->getOperand(1); @@ -1046,7 +1046,7 @@ bool SplitComparesTransform::runOnModule(Module &M) { char *bitw_env = getenv("LAF_SPLIT_COMPARES_BITW"); if (!bitw_env) bitw_env = getenv("AFL_LLVM_LAF_SPLIT_COMPARES_BITW"); if (bitw_env) { bitw = atoi(bitw_env); } - + enableFPSplit = getenv("AFL_LLVM_LAF_SPLIT_FLOATS") != NULL; simplifyCompares(M); diff --git a/qemu_mode/libcompcov/libcompcov.so.c b/qemu_mode/libcompcov/libcompcov.so.c index d58e45dd..dee8cfda 100644 --- a/qemu_mode/libcompcov/libcompcov.so.c +++ b/qemu_mode/libcompcov/libcompcov.so.c @@ -340,7 +340,6 @@ int memcmp(const void* mem1, const void* mem2, size_t len) { // TODO bcmp - /* Common libraries wrappers (from honggfuzz) */ /* diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h index 7c6d3341..70f5ef9d 100644 --- a/qemu_mode/patches/afl-qemu-cpu-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-inl.h @@ -83,8 +83,8 @@ __thread abi_ulong afl_prev_loc; /* Set in the child process in forkserver mode: */ -static int forkserver_installed = 0; -static int disable_caching = 0; +static int forkserver_installed = 0; +static int disable_caching = 0; unsigned char afl_fork_child; unsigned int afl_forksrv_pid; @@ -207,7 +207,7 @@ static void afl_setup(void) { behaviour, and seems to work alright? */ rcu_disable_atfork(); - + disable_caching = getenv("AFL_QEMU_DISABLE_CACHE") != NULL; is_persistent = getenv("AFL_QEMU_PERSISTENT_ADDR") != NULL; diff --git a/qemu_mode/patches/afl-qemu-floats.h b/qemu_mode/patches/afl-qemu-floats.h index 0b2ac2ae..7fea04e7 100644 --- a/qemu_mode/patches/afl-qemu-floats.h +++ b/qemu_mode/patches/afl-qemu-floats.h @@ -35,24 +35,30 @@ #include "afl-qemu-common.h" union afl_float32 { + float32 f; struct { - u64 sign : 1; - u64 exp : 7; + + u64 sign : 1; + u64 exp : 7; u64 frac : 24; + }; -}; +}; union afl_float64 { + float64 f; struct { - u64 sign : 1; - u64 exp : 11; + + u64 sign : 1; + u64 exp : 11; u64 frac : 52; + }; -}; +}; // TODO 16 and 128 bits floats // TODO figure out why float*_unpack_canonical does not work @@ -65,11 +71,11 @@ void afl_float_compcov_log_32(target_ulong cur_loc, float32 arg1, float32 arg2, if (cur_loc >= afl_inst_rms) return; - //float_status* s = (float_status*)status; - //FloatParts a = float32_unpack_canonical(arg1, s); - //FloatParts b = float32_unpack_canonical(arg2, s); - union afl_float32 a = { .f = arg1 }; - union afl_float32 b = { .f = arg2 }; + // float_status* s = (float_status*)status; + // FloatParts a = float32_unpack_canonical(arg1, s); + // FloatParts b = float32_unpack_canonical(arg2, s); + union afl_float32 a = {.f = arg1}; + union afl_float32 b = {.f = arg2}; // if (is_nan(a.cls) || is_nan(b.cls)) return; @@ -97,11 +103,11 @@ void afl_float_compcov_log_64(target_ulong cur_loc, float64 arg1, float64 arg2, if (cur_loc >= afl_inst_rms) return; - //float_status* s = (float_status*)status; - //FloatParts a = float64_unpack_canonical(arg1, s); - //FloatParts b = float64_unpack_canonical(arg2, s); - union afl_float64 a = { .f = arg1 }; - union afl_float64 b = { .f = arg2 }; + // float_status* s = (float_status*)status; + // FloatParts a = float64_unpack_canonical(arg1, s); + // FloatParts b = float64_unpack_canonical(arg2, s); + union afl_float64 a = {.f = arg1}; + union afl_float64 b = {.f = arg2}; // if (is_nan(a.cls) || is_nan(b.cls)) return; @@ -196,7 +202,7 @@ void afl_float_compcov_log_80(target_ulong cur_loc, floatx80 arg1, if ((arg1.low & 0xff00) == (arg2.low & 0xff00)) { INC_AFL_AREA(idx + 9); - //if ((arg1.low & 0xff) == (arg2.low & 0xff)) + // if ((arg1.low & 0xff) == (arg2.low & 0xff)) // INC_AFL_AREA(idx + 10); } diff --git a/src/afl-analyze.c b/src/afl-analyze.c index ee281af8..b82e124d 100644 --- a/src/afl-analyze.c +++ b/src/afl-analyze.c @@ -987,7 +987,8 @@ int main(int argc, char** argv) { if (child_timed_out) FATAL("Target binary times out (adjusting -t may help)."); - if (getenv("AFL_SKIP_BIN_CHECK") == NULL && !anything_set()) FATAL("No instrumentation detected."); + if (getenv("AFL_SKIP_BIN_CHECK") == NULL && !anything_set()) + FATAL("No instrumentation detected."); analyze(use_argv); diff --git a/src/afl-as.c b/src/afl-as.c index a0ebb2e0..9abe3fc2 100644 --- a/src/afl-as.c +++ b/src/afl-as.c @@ -83,7 +83,7 @@ static u8 use_64bit = 0; #error "Sorry, 32-bit Apple platforms are not supported." #endif /* __APPLE__ */ -#endif /* ^WORD_SIZE_64 */ +#endif /* ^WORD_SIZE_64 */ /* Examine and modify parameters to pass to 'as'. Note that the file name is always the last parameter passed by GCC, so we exploit this property diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c index 5d629cc0..0329421c 100644 --- a/src/afl-fuzz-bitmap.c +++ b/src/afl-fuzz-bitmap.c @@ -87,7 +87,7 @@ u8 has_new_bits(u8* virgin_map) { u32 i = (MAP_SIZE >> 2); -#endif /* ^WORD_SIZE_64 */ +#endif /* ^WORD_SIZE_64 */ u8 ret = 0; @@ -125,7 +125,7 @@ u8 has_new_bits(u8* virgin_map) { else ret = 1; -#endif /* ^WORD_SIZE_64 */ +#endif /* ^WORD_SIZE_64 */ } @@ -306,7 +306,7 @@ void simplify_trace(u32* mem) { } -#endif /* ^WORD_SIZE_64 */ +#endif /* ^WORD_SIZE_64 */ /* Destructively classify execution counts in a trace. This is used as a preprocessing step for any newly acquired traces. Called on every exec, @@ -391,7 +391,7 @@ void classify_counts(u32* mem) { } -#endif /* ^WORD_SIZE_64 */ +#endif /* ^WORD_SIZE_64 */ /* Compact trace bytes into a smaller bitmap. We effectively just drop the count information here. This is called only sporadically, for some @@ -599,7 +599,7 @@ u8 save_if_interesting(char** argv, void* mem, u32 len, u8 fault) { simplify_trace((u64*)trace_bits); #else simplify_trace((u32*)trace_bits); -#endif /* ^WORD_SIZE_64 */ +#endif /* ^WORD_SIZE_64 */ if (!has_new_bits(virgin_tmout)) return keeping; @@ -662,7 +662,7 @@ u8 save_if_interesting(char** argv, void* mem, u32 len, u8 fault) { simplify_trace((u64*)trace_bits); #else simplify_trace((u32*)trace_bits); -#endif /* ^WORD_SIZE_64 */ +#endif /* ^WORD_SIZE_64 */ if (!has_new_bits(virgin_crash)) return keeping; diff --git a/src/afl-fuzz-globals.c b/src/afl-fuzz-globals.c index 50b6b802..5c36eb0b 100644 --- a/src/afl-fuzz-globals.c +++ b/src/afl-fuzz-globals.c @@ -96,7 +96,7 @@ u8 schedule = EXPLORE; /* Power schedule (default: EXPLORE)*/ u8 havoc_max_mult = HAVOC_MAX_MULT; u8 use_radamsa; -size_t (*radamsa_mutate_ptr)(u8*, size_t, u8*, size_t, u32); +size_t (*radamsa_mutate_ptr)(u8 *, size_t, u8 *, size_t, u32); u8 skip_deterministic, /* Skip deterministic stages? */ force_deterministic, /* Force deterministic stages? */ @@ -215,7 +215,7 @@ u32 rand_cnt; /* Random number counter */ #endif u32 rand_seed[2]; -s64 init_seed; +s64 init_seed; u64 total_cal_us, /* Total calibration time (us) */ total_cal_cycles; /* Total calibration cycles */ diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c index d99f9bec..bdab41e7 100644 --- a/src/afl-fuzz-init.c +++ b/src/afl-fuzz-init.c @@ -142,7 +142,8 @@ void bind_to_free_cpu(void) { if (procs[i].ki_oncpu < sizeof(cpu_used) && procs[i].ki_pctcpu > 10) cpu_used[procs[i].ki_oncpu] = 1; #elif defined(__DragonFly__) - if (procs[i].kp_lwp.kl_cpuid < sizeof(cpu_used) && procs[i].kp_lwp.kl_pctcpu > 10) + if (procs[i].kp_lwp.kl_cpuid < sizeof(cpu_used) && + procs[i].kp_lwp.kl_pctcpu > 10) cpu_used[procs[i].kp_lwp.kl_cpuid] = 1; #endif @@ -734,7 +735,8 @@ void pivot_inputs(void) { use_name += 6; else use_name = rsl; - nfn = alloc_printf("%s/queue/id:%06u,time:0,orig:%s", out_dir, id, use_name); + nfn = alloc_printf("%s/queue/id:%06u,time:0,orig:%s", out_dir, id, + use_name); #else @@ -1563,8 +1565,10 @@ void check_cpu_governor(void) { " You can later go back to the original state by replacing " "'performance'\n" - " with 'ondemand' or 'powersave'. If you don't want to change the settings,\n" - " set AFL_SKIP_CPUFREQ to make afl-fuzz skip this check - but expect some\n" + " with 'ondemand' or 'powersave'. If you don't want to change the " + "settings,\n" + " set AFL_SKIP_CPUFREQ to make afl-fuzz skip this check - but expect " + "some\n" " performance drop.\n", min / 1024, max / 1024); FATAL("Suboptimal CPU scaling governor"); @@ -1609,7 +1613,8 @@ void check_cpu_governor(void) { void get_core_count(void) { -#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__DragonFly__) +#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || \ + defined(__DragonFly__) size_t s = sizeof(cpu_core_count); @@ -1655,7 +1660,8 @@ void get_core_count(void) { cur_runnable = (u32)get_runnable_processes(); -#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__DragonFly__) +#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || \ + defined(__DragonFly__) /* Add ourselves, since the 1-minute average doesn't include that yet. */ diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c index 6ab0266d..f7cfbbe1 100644 --- a/src/afl-fuzz-one.c +++ b/src/afl-fuzz-one.c @@ -480,8 +480,7 @@ u8 fuzz_one_original(char** argv) { if (perf_score == 0) goto abandon_entry; - if (use_radamsa > 1) - goto radamsa_stage; + if (use_radamsa > 1) goto radamsa_stage; if (custom_mutator) { @@ -541,6 +540,7 @@ u8 fuzz_one_original(char** argv) { ? queue_cur->depth * 30 : havoc_max_mult * 100)) || queue_cur->passed_det) { + if (use_radamsa > 1) goto radamsa_stage; else @@ -549,12 +549,14 @@ u8 fuzz_one_original(char** argv) { #else goto havoc_stage; #endif + } /* Skip deterministic fuzzing if exec path checksum puts this out of scope for this master instance. */ if (master_max && (queue_cur->exec_cksum % master_max) != master_id - 1) { + if (use_radamsa > 1) goto radamsa_stage; else @@ -563,6 +565,7 @@ u8 fuzz_one_original(char** argv) { #else goto havoc_stage; #endif + } doing_det = 1; @@ -2279,39 +2282,39 @@ retry_splicing: ret_val = 0; goto radamsa_stage; - radamsa_stage: - if (!use_radamsa || !radamsa_mutate_ptr) - goto abandon_entry; - + if (!use_radamsa || !radamsa_mutate_ptr) goto abandon_entry; + stage_name = "radamsa"; stage_short = "radamsa"; stage_max = (HAVOC_CYCLES * perf_score / havoc_div / 100) << use_radamsa; - + if (stage_max < HAVOC_MIN) stage_max = HAVOC_MIN; - + orig_hit_cnt = queued_paths + unique_crashes; - + /* Read the additional testcase into a new buffer. */ - u8 *save_buf = ck_alloc_nozero(len); + u8* save_buf = ck_alloc_nozero(len); memcpy(save_buf, out_buf, len); - + u32 max_len = len + choose_block_len(HAVOC_BLK_XL); u8* new_buf = ck_alloc_nozero(max_len); - u8 *tmp_buf; + u8* tmp_buf; for (stage_cur = 0; stage_cur < stage_max; ++stage_cur) { - u32 new_len = radamsa_mutate_ptr(save_buf, len, new_buf, max_len, get_rand_seed()); + + u32 new_len = + radamsa_mutate_ptr(save_buf, len, new_buf, max_len, get_rand_seed()); if (new_len) { - + temp_len = new_len; tmp_buf = new_buf; } else { - tmp_buf = save_buf; // nope but I dont care + tmp_buf = save_buf; // nope but I dont care temp_len = len; } @@ -2323,14 +2326,14 @@ radamsa_stage: goto abandon_entry; } - + } ck_free(save_buf); ck_free(new_buf); - + new_hit_cnt = queued_paths + unique_crashes; - + stage_finds[STAGE_RADAMSA] += new_hit_cnt - orig_hit_cnt; stage_cycles[STAGE_RADAMSA] += stage_max; diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c index c5035b63..8fa91afd 100644 --- a/src/afl-fuzz-run.c +++ b/src/afl-fuzz-run.c @@ -225,7 +225,7 @@ u8 run_target(char** argv, u32 timeout) { classify_counts((u64*)trace_bits); #else classify_counts((u32*)trace_bits); -#endif /* ^WORD_SIZE_64 */ +#endif /* ^WORD_SIZE_64 */ prev_timed_out = child_timed_out; diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index 851cfb1c..db2d7dc2 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -334,9 +334,9 @@ void show_stats(void) { /* Lord, forgive me this. */ - SAYF(SET_G1 bSTG bLT bH bSTOP cCYA + SAYF(SET_G1 bSTG bLT bH bSTOP cCYA " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA - " overall results " bSTG bH2 bH2 bRT "\n"); + " overall results " bSTG bH2 bH2 bRT "\n"); if (dumb_mode) { @@ -413,9 +413,9 @@ void show_stats(void) { " uniq hangs : " cRST "%-6s" bSTG bV "\n", DTD(cur_ms, last_hang_time), tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA - " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); + " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); /* This gets funny because we want to print several variable-length variables together, but then cram them into a fixed-width field - so we need to @@ -443,9 +443,9 @@ void show_stats(void) { SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA - " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); + " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); sprintf(tmp, "%s (%0.02f%%)", DI(queued_favored), ((double)queued_favored) * 100 / queued_paths); @@ -514,7 +514,7 @@ void show_stats(void) { /* Aaaalmost there... hold on! */ - SAYF(bVR bH cCYA bSTOP + SAYF(bVR bH cCYA bSTOP " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA " path geometry " bSTG bH5 bH2 bVL "\n"); @@ -576,11 +576,12 @@ void show_stats(void) { " imported : " cRST "%-10s" bSTG bV "\n", tmp, sync_id ? DI(queued_imported) : (u8*)"n/a"); - sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s, %s/%s", DI(stage_finds[STAGE_HAVOC]), - DI(stage_cycles[STAGE_HAVOC]), DI(stage_finds[STAGE_SPLICE]), - DI(stage_cycles[STAGE_SPLICE]), DI(stage_finds[STAGE_PYTHON]), - DI(stage_cycles[STAGE_PYTHON]), DI(stage_finds[STAGE_RADAMSA]), - DI(stage_cycles[STAGE_RADAMSA]), DI(stage_finds[STAGE_CUSTOM_MUTATOR]), + sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s, %s/%s", + DI(stage_finds[STAGE_HAVOC]), DI(stage_cycles[STAGE_HAVOC]), + DI(stage_finds[STAGE_SPLICE]), DI(stage_cycles[STAGE_SPLICE]), + DI(stage_finds[STAGE_PYTHON]), DI(stage_cycles[STAGE_PYTHON]), + DI(stage_finds[STAGE_RADAMSA]), DI(stage_cycles[STAGE_RADAMSA]), + DI(stage_finds[STAGE_CUSTOM_MUTATOR]), DI(stage_cycles[STAGE_CUSTOM_MUTATOR])); SAYF(bV bSTOP "havoc/custom : " cRST "%-36s " bSTG bV bSTOP, tmp); @@ -634,13 +635,13 @@ void show_stats(void) { sprintf(tmp, "%s/%s", DI(stage_finds[STAGE_CUSTOM_MUTATOR]), DI(stage_cycles[STAGE_CUSTOM_MUTATOR])); SAYF(bV bSTOP " custom mut. : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB - "\n" bLB bH30 bH20 bH2 bH bRB bSTOP cRST RESET_G1, + "\n" bLB bH30 bH20 bH2 bH bRB bSTOP cRST RESET_G1, tmp); } else { SAYF(bV bSTOP " trim : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB - "\n" bLB bH30 bH20 bH2 bRB bSTOP cRST RESET_G1, + "\n" bLB bH30 bH20 bH2 bRB bSTOP cRST RESET_G1, tmp); } diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 42bdaebd..bdbc48e0 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -28,7 +28,7 @@ static u8* get_libradamsa_path(u8* own_loc) { u8 *tmp, *cp, *rsl, *own_copy; - + tmp = getenv("AFL_PATH"); if (tmp) { @@ -51,8 +51,7 @@ static u8* get_libradamsa_path(u8* own_loc) { cp = alloc_printf("%s/libradamsa.so", own_copy); ck_free(own_copy); - if (!access(cp, X_OK)) - return cp; + if (!access(cp, X_OK)) return cp; } else @@ -70,11 +69,12 @@ static u8* get_libradamsa_path(u8* own_loc) { } - SAYF("\n" cLRD "[-] " cRST - "Oops, unable to find the 'libradamsa.so' binary. The binary must be " - "built\n" - " separately using 'make radamsa'. If you already have the binary " - "installed,\n you may need to specify AFL_PATH in the environment.\n"); + SAYF( + "\n" cLRD "[-] " cRST + "Oops, unable to find the 'libradamsa.so' binary. The binary must be " + "built\n" + " separately using 'make radamsa'. If you already have the binary " + "installed,\n you may need to specify AFL_PATH in the environment.\n"); FATAL("Failed to locate 'libradamsa.so'."); @@ -109,10 +109,12 @@ static void usage(u8* argv0) { " -m megs - memory limit for child process (%d MB)\n" " -Q - use binary-only instrumentation (QEMU mode)\n" " -U - use unicorn-based instrumentation (Unicorn mode)\n" - " -W - use qemu-based instrumentation with Wine (Wine mode)\n\n" + " -W - use qemu-based instrumentation with Wine (Wine " + "mode)\n\n" "Mutator settings:\n" - " -R[R] - add Radamsa as mutator, add another -R to exclusivly run it\n" + " -R[R] - add Radamsa as mutator, add another -R to exclusivly " + "run it\n" " -L minutes - use MOpt(imize) mode and set the limit time for " "entering the\n" " pacemaker mode (minutes of no new paths, 0 = " @@ -184,9 +186,8 @@ int main(int argc, char** argv) { struct timeval tv; struct timezone tz; - SAYF(cCYA - "afl-fuzz" VERSION cRST - " based on afl by Michal Zalewski and a big online community\n"); + SAYF(cCYA "afl-fuzz" VERSION cRST + " based on afl by Michal Zalewski and a big online community\n"); doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH; @@ -568,9 +569,9 @@ int main(int argc, char** argv) { usage(argv[0]); return -1; break; // not needed - + case 'R': - + if (use_radamsa) use_radamsa = 2; else @@ -595,28 +596,30 @@ int main(int argc, char** argv) { if (fixed_seed) OKF("Running with fixed seed: %u", (u32)init_seed); srandom((u32)init_seed); - + if (use_radamsa) { - + OKF("Using Radamsa add-on"); - - u8* libradamsa_path = get_libradamsa_path(argv[0]); + + u8* libradamsa_path = get_libradamsa_path(argv[0]); void* handle = dlopen(libradamsa_path, RTLD_NOW); ck_free(libradamsa_path); - + if (!handle) FATAL("Failed to dlopen() libradamsa"); void (*radamsa_init_ptr)(void) = dlsym(handle, "radamsa_init"); radamsa_mutate_ptr = dlsym(handle, "radamsa"); - if (!radamsa_init_ptr || !radamsa_mutate_ptr) FATAL("Failed to dlsym() libradamsa"); + if (!radamsa_init_ptr || !radamsa_mutate_ptr) + FATAL("Failed to dlsym() libradamsa"); - /* randamsa_init installs some signal hadlers, call it before setup_signal_handlers - so that AFL++ can then replace those signal handlers */ + /* randamsa_init installs some signal hadlers, call it before + setup_signal_handlers so that AFL++ can then replace those signal + handlers */ radamsa_init_ptr(); } - + setup_signal_handlers(); check_asan_opts(); @@ -648,8 +651,7 @@ int main(int argc, char** argv) { } - if (getenv("AFL_DISABLE_TRIM")) - disable_trim = 1; + if (getenv("AFL_DISABLE_TRIM")) disable_trim = 1; if (getenv("AFL_NO_UI") && getenv("AFL_FORCE_UI")) FATAL("AFL_NO_UI and AFL_FORCE_UI are mutually exclusive"); diff --git a/src/afl-gotcpu.c b/src/afl-gotcpu.c index e09f0980..c6d71bb2 100644 --- a/src/afl-gotcpu.c +++ b/src/afl-gotcpu.c @@ -52,7 +52,8 @@ #include "types.h" #include "debug.h" -#if defined(__linux__) || defined(__FreeBSD__) || defined(__NetBSD__) || defined(__APPLE__) || defined(__DragonFly__) +#if defined(__linux__) || defined(__FreeBSD__) || defined(__NetBSD__) || \ + defined(__APPLE__) || defined(__DragonFly__) #define HAVE_AFFINITY 1 #if defined(__FreeBSD__) || defined(__DragonFly__) #include <pthread.h> @@ -69,7 +70,7 @@ #include <mach/thread_act.h> #include <mach/thread_policy.h> #endif -#endif /* __linux__ || __FreeBSD__ || __NetBSD__ || __APPLE__ */ +#endif /* __linux__ || __FreeBSD__ || __NetBSD__ || __APPLE__ */ /* Get unix time in microseconds. */ @@ -183,11 +184,11 @@ int main(int argc, char** argv) { cpuset_set(i, c); #elif defined(__APPLE__) - thread_affinity_policy_data_t c = { i }; + thread_affinity_policy_data_t c = {i}; thread_port_t native_thread = pthread_mach_thread_np(pthread_self()); if (thread_policy_set(native_thread, THREAD_AFFINITY_POLICY, - (thread_policy_t)&c, 1) != KERN_SUCCESS) - PFATAL("thread_policy_set failed"); + (thread_policy_t)&c, 1) != KERN_SUCCESS) + PFATAL("thread_policy_set failed"); #endif #if defined(__FreeBSD__) || defined(__DragonFly__) diff --git a/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h b/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h index 3603fae0..0b7954d0 100644 --- a/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h +++ b/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h @@ -171,4 +171,6 @@ void HELPER(afl_compcov_log_64)(void* uc_ptr, uint64_t cur_loc, uint64_t arg1, } } + */ + |