diff options
| -rw-r--r-- | examples/custom_mutators/example.c | 7 | ||||
| -rw-r--r-- | include/afl-fuzz.h | 9 | ||||
| -rw-r--r-- | src/afl-fuzz-cmplog.c | 1 | ||||
| -rw-r--r-- | src/afl-fuzz-init.c | 42 | ||||
| -rw-r--r-- | src/afl-fuzz-mutators.c | 3 | ||||
| -rw-r--r-- | src/afl-fuzz-python.c | 9 | ||||
| -rw-r--r-- | src/afl-fuzz.c | 14 |
7 files changed, 46 insertions, 39 deletions
diff --git a/examples/custom_mutators/example.c b/examples/custom_mutators/example.c index c9be3e0c..23add128 100644 --- a/examples/custom_mutators/example.c +++ b/examples/custom_mutators/example.c @@ -139,10 +139,11 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size, * @return Size of the output buffer after processing or the needed amount. * A return of 0 indicates an error. */ -size_t afl_custom_post_process(my_mutator_t *data, uint8_t *buf, size_t buf_size, - uint8_t **out_buf) { +size_t afl_custom_post_process(my_mutator_t *data, uint8_t *buf, + size_t buf_size, uint8_t **out_buf) { - uint8_t *post_process_buf = maybe_grow(BUF_PARAMS(data, post_process), buf_size + 5); + uint8_t *post_process_buf = + maybe_grow(BUF_PARAMS(data, post_process), buf_size + 5); if (!post_process_buf) { perror("custom mutator realloc failed."); diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index cf8ef735..a1aa58d6 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -407,7 +407,9 @@ typedef struct afl_state { no_unlink, /* do not unlink cur_input */ debug, /* Debug mode */ custom_only, /* Custom mutator only mode */ - python_only; /* Python-only mode */ + python_only, /* Python-only mode */ + is_master, /* if this is a master */ + is_slave; /* if this is a slave */ u32 stats_update_freq; /* Stats update frequency (execs) */ @@ -418,7 +420,6 @@ typedef struct afl_state { size_t (*radamsa_mutate_ptr)(u8 *, size_t, u8 *, size_t, u32); u8 skip_deterministic, /* Skip deterministic stages? */ - force_deterministic, /* Force deterministic stages? */ use_splicing, /* Recombine input files? */ dumb_mode, /* Run in non-instrumented mode? */ score_changed, /* Scoring for favorites changed? */ @@ -547,7 +548,7 @@ typedef struct afl_state { /* afl_postprocess API - Now supported via custom mutators */ - struct custom_mutator * post_library_mutator; + struct custom_mutator *post_library_mutator; /* CmpLog */ @@ -674,7 +675,7 @@ struct custom_mutator { * @return Size of the output buffer. */ size_t (*afl_custom_post_process)(void *data, u8 *buf, size_t buf_size, - u8 **out_buf); + u8 **out_buf); /** * This method is called at the start of each trimming operation and receives diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c index 4be6a2c8..faf4dcb7 100644 --- a/src/afl-fuzz-cmplog.c +++ b/src/afl-fuzz-cmplog.c @@ -51,7 +51,6 @@ u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len) { u8 fault; - write_to_testcase(afl, out_buf, len); fault = fuzz_run_target(afl, &afl->cmplog_fsrv, afl->fsrv.exec_tmout); diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c index aea22f48..d468f2c8 100644 --- a/src/afl-fuzz-init.c +++ b/src/afl-fuzz-init.c @@ -297,14 +297,24 @@ void setup_post(afl_state_t *afl) { dh = dlopen(fn, RTLD_NOW); if (!dh) { FATAL("%s", dlerror()); } - struct custom_mutator * mutator; + struct custom_mutator *mutator; mutator = ck_alloc(sizeof(struct custom_mutator)); memset(mutator, 0, sizeof(struct custom_mutator)); mutator->afl_custom_post_process = dlsym(dh, "afl_postprocess"); - if (!mutator->afl_custom_post_process) { FATAL("Symbol 'afl_postprocess' not found."); } + if (!mutator->afl_custom_post_process) { + + FATAL("Symbol 'afl_postprocess' not found."); + + } + mutator->afl_custom_init = dlsym(dh, "afl_postprocess_init"); - if (!mutator->afl_custom_init) { FATAL("Symbol 'afl_postprocess_init' not found."); } + if (!mutator->afl_custom_init) { + + FATAL("Symbol 'afl_postprocess_init' not found."); + + } + mutator->afl_custom_deinit = dlsym(dh, "afl_postprocess_deinit"); if (!mutator->afl_custom_post_process) { @@ -1373,6 +1383,17 @@ void setup_dirs_fds(afl_state_t *afl) { } +/* + if (afl->is_master) { + + u8 *x = alloc_printf("%s/is_master", afl->sync_dir); + int fd = open(x, O_CREAT | O_RDWR, 0644); + if (fd < 0) FATAL("cannot create %s", x); + close(fd); + + } +*/ + if (mkdir(afl->out_dir, 0700)) { if (errno != EEXIST) { PFATAL("Unable to create '%s'", afl->out_dir); } @@ -1861,14 +1882,6 @@ void fix_up_sync(afl_state_t *afl) { if (afl->dumb_mode) { FATAL("-S / -M and -n are mutually exclusive"); } - if (afl->skip_deterministic) { - - if (afl->force_deterministic) { FATAL("use -S instead of -M -d"); } - // else - // FATAL("-S already implies -d"); - - } - while (*x) { if (!isalnum(*x) && *x != '_' && *x != '-') { @@ -1888,13 +1901,6 @@ void fix_up_sync(afl_state_t *afl) { afl->sync_dir = afl->out_dir; afl->out_dir = x; - if (!afl->force_deterministic) { - - afl->skip_deterministic = 1; - afl->use_splicing = 1; - - } - } /* Handle screen resize (SIGWINCH). */ diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c index acc1b12d..87cb86fa 100644 --- a/src/afl-fuzz-mutators.c +++ b/src/afl-fuzz-mutators.c @@ -108,7 +108,8 @@ void setup_custom_mutators(afl_state_t *afl) { #endif - if (afl->post_library_mutator) list_append(&afl->custom_mutator_list, afl->post_library_mutator); + if (afl->post_library_mutator) + list_append(&afl->custom_mutator_list, afl->post_library_mutator); } diff --git a/src/afl-fuzz-python.c b/src/afl-fuzz-python.c index 2569cdaf..2044c97d 100644 --- a/src/afl-fuzz-python.c +++ b/src/afl-fuzz-python.c @@ -384,7 +384,8 @@ struct custom_mutator *load_custom_mutator_py(afl_state_t *afl, } -size_t post_process_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) { +size_t post_process_py(void *py_mutator, u8 *buf, size_t buf_size, + u8 **out_buf) { size_t py_out_buf_size; PyObject * py_args, *py_value; @@ -402,7 +403,8 @@ size_t post_process_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) PyTuple_SetItem(py_args, 0, py_value); py_value = PyObject_CallObject( - ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_POST_PROCESS], py_args); + ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_POST_PROCESS], + py_args); Py_DECREF(py_args); @@ -412,7 +414,8 @@ size_t post_process_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) ck_maybe_grow(BUF_PARAMS(post_process), py_out_buf_size); - memcpy(py->post_process_buf, PyByteArray_AsString(py_value), py_out_buf_size); + memcpy(py->post_process_buf, PyByteArray_AsString(py_value), + py_out_buf_size); Py_DECREF(py_value); *out_buf = py->post_process_buf; diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 8075f03d..979ebfa3 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -390,7 +390,7 @@ int main(int argc, char **argv_orig, char **envp) { } - afl->force_deterministic = 1; + afl->is_master = 1; } @@ -400,6 +400,9 @@ int main(int argc, char **argv_orig, char **envp) { if (afl->sync_id) { FATAL("Multiple -S or -M options not supported"); } afl->sync_id = ck_strdup(optarg); + afl->is_slave = 1; + afl->skip_deterministic = 1; + afl->use_splicing = 1; break; case 'f': /* target file */ @@ -500,12 +503,6 @@ int main(int argc, char **argv_orig, char **envp) { case 'd': /* skip deterministic */ - if (afl->skip_deterministic) { - - FATAL("Multiple -d options not supported"); - - } - afl->skip_deterministic = 1; afl->use_splicing = 1; break; @@ -794,8 +791,7 @@ int main(int argc, char **argv_orig, char **envp) { OKF("afl-tmin fork server patch from github.com/nccgroup/TriforceAFL"); OKF("MOpt Mutator from github.com/puppet-meteor/MOpt-AFL"); - if (afl->sync_id && afl->force_deterministic && - afl->afl_env.afl_custom_mutator_only) { + if (afl->sync_id && afl->is_master && afl->afl_env.afl_custom_mutator_only) { WARNF( "Using -M master with the AFL_CUSTOM_MUTATOR_ONLY mutator options will " |