diff options
| -rw-r--r-- | .gitignore | 1 | ||||
| -rw-r--r-- | qemu_mode/libcompcov/Makefile | 38 | ||||
| -rw-r--r-- | qemu_mode/libcompcov/README.compcov | 33 | ||||
| -rw-r--r-- | qemu_mode/libcompcov/libcompcov.so.c | 307 | ||||
| -rw-r--r-- | qemu_mode/libcompcov/pmparser.h | 280 |
5 files changed, 659 insertions, 0 deletions
diff --git a/.gitignore b/.gitignore index b3498329..0b8b2513 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,5 @@ *.o +*.so .gitignore afl-analyze afl-as diff --git a/qemu_mode/libcompcov/Makefile b/qemu_mode/libcompcov/Makefile new file mode 100644 index 00000000..02266bd2 --- /dev/null +++ b/qemu_mode/libcompcov/Makefile @@ -0,0 +1,38 @@ +# +# american fuzzy lop - libcompcov +# -------------------------------- +# +# Written by Andrea Fioraldi <andreafioraldi@gmail.com> +# +# Copyright 2019 Andrea Fioraldi. All rights reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at: +# +# http://www.apache.org/licenses/LICENSE-2.0 +# + +PREFIX ?= /usr/local +HELPER_PATH = $(PREFIX)/lib/afl + +VERSION = $(shell grep '^\#define VERSION ' ../config.h | cut -d '"' -f2) + +CFLAGS ?= -O3 -funroll-loops +CFLAGS += -Wall -Wno-unused-result -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign + +all: libcompcov.so + +libcompcov.so: libcompcov.so.c ../../config.h + $(CC) $(CFLAGS) -shared -fPIC $< -o $@ $(LDFLAGS) + +.NOTPARALLEL: clean + +clean: + rm -f *.o *.so *~ a.out core core.[1-9][0-9]* + rm -f libcompcov.so + +install: all + install -m 755 libcompcov.so $${DESTDIR}$(HELPER_PATH) + install -m 644 README.compcov $${DESTDIR}$(HELPER_PATH) + diff --git a/qemu_mode/libcompcov/README.compcov b/qemu_mode/libcompcov/README.compcov new file mode 100644 index 00000000..2a4a0ee5 --- /dev/null +++ b/qemu_mode/libcompcov/README.compcov @@ -0,0 +1,33 @@ +================================================================ +strcmp() / memcmp() CompareCoverage library for AFLplusplus-QEMU +================================================================ + + Written by Andrea Fioraldi <andreafioraldi@gmail.com> + +This Linux-only companion library allows you to instrument strcmp(), memcmp(), +and related functions to log the CompareCoverage of these libcalls. + +Use this with caution. While this can speedup a lot the bypass of hard +branch conditions it can also waste a lot of time and take up unnecessary space +in the shared memory when logging the coverage related to functions that +doesn't process input-related data. + +To use the library, you *need* to make sure that your fuzzing target is linked +dynamically and make use of strcmp(), memcmp(), and related functions. +For optimized binaries this is an issue, those functions are often inlined +and this module is not capable to log the coverage in this case. + +If you have the source code of the fuzzing target you should nto use this +library and QEMU but build ot with afl-clang-fast and the laf-intel options. + +To use this library make sure to preload it with AFL_PRELOAD. + + export AFL_PRELOAD=/path/to/libcompcov.so + export AFL_QEMU_COMPCOV=1 + + afl-fuzz -Q -i input -o output <your options> -- <target args> + +The library make use of https://github.com/ouadev/proc_maps_parser and so it is +Linux specific. However this is not a strict dependency, other UNIX operating +systems can be supported simply replacing the code related to the +/proc/self/maps parsing. diff --git a/qemu_mode/libcompcov/libcompcov.so.c b/qemu_mode/libcompcov/libcompcov.so.c new file mode 100644 index 00000000..3f6a1d0e --- /dev/null +++ b/qemu_mode/libcompcov/libcompcov.so.c @@ -0,0 +1,307 @@ +/* + + american fuzzy lop++ - strcmp() / memcmp() CompareCoverage library + ------------------------------------------------------------------ + + Written and maintained by Andrea Fioraldi <andreafioraldi@gmail.com> + + Copyright 2019 Andrea Fioraldi. All rights reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at: + + http://www.apache.org/licenses/LICENSE-2.0 + + This Linux-only companion library allows you to instrument strcmp(), + memcmp(), and related functions to get compare coverage. + See README.compcov for more info. + + */ + +#include <stdio.h> +#include <string.h> +#include <ctype.h> +#include <sys/types.h> +#include <sys/shm.h> + +#include "../../types.h" +#include "../../config.h" + +#include "pmparser.h" + +#ifndef __linux__ +# error "Sorry, this library is Linux-specific for now!" +#endif /* !__linux__ */ + +/* Change this value to tune the compare coverage */ + +#define MAX_CMP_LENGTH 32 + +static u8 __compcov_loaded; + +static void *__compcov_code_start, + *__compcov_code_end; + +static u8 *__compcov_afl_map; + + +static size_t __strlen2(const char *s1, const char *s2, size_t max_length) { + // from https://github.com/googleprojectzero/CompareCoverage + + size_t len = 0; + for (; len < max_length && s1[len] != '\0' && s2[len] != '\0'; len++) { } + return len; +} + +/* Identify the binary boundaries in the memory mapping */ + +static void __compcov_load(void) { + + __compcov_loaded = 1; + + char *id_str = getenv(SHM_ENV_VAR); + int shm_id; + + if (id_str) { + + shm_id = atoi(id_str); + __compcov_afl_map = shmat(shm_id, NULL, 0); + + if (__compcov_afl_map == (void*)-1) exit(1); + } else { + + __compcov_afl_map = calloc(1, MAP_SIZE); + } + + if (getenv("AFL_INST_LIBS")) { + + __compcov_code_start = (void*)0; + __compcov_code_end = (void*)-1; + return; + } + + char* bin_name = getenv("AFL_COMPCOV_BINNAME"); + + procmaps_iterator* maps = pmparser_parse(-1); + procmaps_struct* maps_tmp = NULL; + + while ((maps_tmp = pmparser_next(maps)) != NULL) { + + /* If AFL_COMPCOV_BINNAME is not set pick the first executable segment */ + if (!bin_name || strstr(maps_tmp->pathname, bin_name) != NULL) { + + if (maps_tmp->is_x) { + if (!__compcov_code_start) + __compcov_code_start = maps_tmp->addr_start; + if (!__compcov_code_end) + __compcov_code_end = maps_tmp->addr_end; + } + } + } + + pmparser_free(maps); +} + + +static void __compcov_trace(u64 cur_loc, const u8* v0, const u8* v1, size_t n) { + + size_t i; + + for (i = 0; i < n && v0[i] == v1[i]; ++i) { + + __compcov_afl_map[cur_loc +i]++; + } +} + +/* Check an address against the list of read-only mappings. */ + +static u8 __compcov_is_in_bound(const void* ptr) { + + return ptr >= __compcov_code_start && ptr < __compcov_code_end; +} + + +/* Replacements for strcmp(), memcmp(), and so on. Note that these will be used + only if the target is compiled with -fno-builtins and linked dynamically. */ + +#undef strcmp + +int strcmp(const char* str1, const char* str2) { + + void* retaddr = __builtin_return_address(0); + + if (__compcov_is_in_bound(retaddr)) { + + size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH +1); + + if (n <= MAX_CMP_LENGTH) { + + u64 cur_loc = (u64)retaddr; + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 1; + + __compcov_trace(cur_loc, str1, str2, n); + } + } + + while (1) { + + unsigned char c1 = *str1, c2 = *str2; + + if (c1 != c2) return (c1 > c2) ? 1 : -1; + if (!c1) return 0; + str1++; str2++; + + } + +} + + +#undef strncmp + +int strncmp(const char* str1, const char* str2, size_t len) { + + void* retaddr = __builtin_return_address(0); + + if (__compcov_is_in_bound(retaddr)) { + + size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH +1); + n = MIN(n, len); + + if (n <= MAX_CMP_LENGTH) { + + u64 cur_loc = (u64)retaddr; + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 1; + + __compcov_trace(cur_loc, str1, str2, n); + } + } + + while (len--) { + + unsigned char c1 = *str1, c2 = *str2; + + if (!c1) return 0; + if (c1 != c2) return (c1 > c2) ? 1 : -1; + str1++; str2++; + + } + + return 0; + +} + + +#undef strcasecmp + +int strcasecmp(const char* str1, const char* str2) { + + void* retaddr = __builtin_return_address(0); + + if (__compcov_is_in_bound(retaddr)) { + /* Fallback to strcmp, maybe improve in future */ + + size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH +1); + + if (n <= MAX_CMP_LENGTH) { + + u64 cur_loc = (u64)retaddr; + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 1; + + __compcov_trace(cur_loc, str1, str2, n); + } + } + + while (1) { + + unsigned char c1 = tolower(*str1), c2 = tolower(*str2); + + if (c1 != c2) return (c1 > c2) ? 1 : -1; + if (!c1) return 0; + str1++; str2++; + + } + +} + + +#undef strncasecmp + +int strncasecmp(const char* str1, const char* str2, size_t len) { + + void* retaddr = __builtin_return_address(0); + + if (__compcov_is_in_bound(retaddr)) { + /* Fallback to strncmp, maybe improve in future */ + + size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH +1); + n = MIN(n, len); + + if (n <= MAX_CMP_LENGTH) { + + u64 cur_loc = (u64)retaddr; + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 1; + + __compcov_trace(cur_loc, str1, str2, n); + } + } + + while (len--) { + + unsigned char c1 = tolower(*str1), c2 = tolower(*str2); + + if (!c1) return 0; + if (c1 != c2) return (c1 > c2) ? 1 : -1; + str1++; str2++; + + } + + return 0; + +} + + +#undef memcmp + +int memcmp(const void* mem1, const void* mem2, size_t len) { + + void* retaddr = __builtin_return_address(0); + + if (__compcov_is_in_bound(retaddr)) { + + size_t n = len; + + if (n <= MAX_CMP_LENGTH) { + + u64 cur_loc = (u64)retaddr; + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 1; + + __compcov_trace(cur_loc, mem1, mem2, n); + } + } + + while (len--) { + + unsigned char c1 = *(const char*)mem1, c2 = *(const char*)mem2; + if (c1 != c2) return (c1 > c2) ? 1 : -1; + mem1++; mem2++; + + } + + return 0; + +} + +/* Init code to open init the library. */ + +__attribute__((constructor)) void __compcov_init(void) { + + __compcov_load(); +} + + diff --git a/qemu_mode/libcompcov/pmparser.h b/qemu_mode/libcompcov/pmparser.h new file mode 100644 index 00000000..34d0cd50 --- /dev/null +++ b/qemu_mode/libcompcov/pmparser.h @@ -0,0 +1,280 @@ +/* + @Author : ouadimjamal@gmail.com + @date : December 2015 + +Permission to use, copy, modify, distribute, and sell this software and its +documentation for any purpose is hereby granted without fee, provided that +the above copyright notice appear in all copies and that both that +copyright notice and this permission notice appear in supporting +documentation. No representations are made about the suitability of this +software for any purpose. It is provided "as is" without express or +implied warranty. + + */ + +#ifndef H_PMPARSER +#define H_PMPARSER +#include <stdio.h> +#include <stdlib.h> +#include <unistd.h> +#include <string.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <fcntl.h> +#include <errno.h> +#include <linux/limits.h> + +//maximum line length in a procmaps file +#define PROCMAPS_LINE_MAX_LENGTH (PATH_MAX + 100) +/** + * procmaps_struct + * @desc hold all the information about an area in the process's VM + */ +typedef struct procmaps_struct{ + void* addr_start; //< start address of the area + void* addr_end; //< end address + unsigned long length; //< size of the range + + char perm[5]; //< permissions rwxp + short is_r; //< rewrote of perm with short flags + short is_w; + short is_x; + short is_p; + + long offset; //< offset + char dev[12]; //< dev major:minor + int inode; //< inode of the file that backs the area + + char pathname[600]; //< the path of the file that backs the area + //chained list + struct procmaps_struct* next; //<handler of the chinaed list +} procmaps_struct; + +/** + * procmaps_iterator + * @desc holds iterating information + */ +typedef struct procmaps_iterator{ + procmaps_struct* head; + procmaps_struct* current; +} procmaps_iterator; +/** + * pmparser_parse + * @param pid the process id whose memory map to be parser. the current process if pid<0 + * @return an iterator over all the nodes + */ +procmaps_iterator* pmparser_parse(int pid); + +/** + * pmparser_next + * @description move between areas + * @param p_procmaps_it the iterator to move on step in the chained list + * @return a procmaps structure filled with information about this VM area + */ +procmaps_struct* pmparser_next(procmaps_iterator* p_procmaps_it); +/** + * pmparser_free + * @description should be called at the end to free the resources + * @param p_procmaps_it the iterator structure returned by pmparser_parse + */ +void pmparser_free(procmaps_iterator* p_procmaps_it); + +/** + * _pmparser_split_line + * @description internal usage + */ +void _pmparser_split_line(char*buf,char*addr1,char*addr2,char*perm, char* offset, char* device,char*inode,char* pathname); + +/** + * pmparser_print + * @param map the head of the list + * @order the order of the area to print, -1 to print everything + */ +void pmparser_print(procmaps_struct* map,int order); + + +/** + * gobal variables + */ +//procmaps_struct* g_last_head=NULL; +//procmaps_struct* g_current=NULL; + + +procmaps_iterator* pmparser_parse(int pid){ + procmaps_iterator* maps_it = malloc(sizeof(procmaps_iterator)); + char maps_path[500]; + if(pid>=0 ){ + sprintf(maps_path,"/proc/%d/maps",pid); + }else{ + sprintf(maps_path,"/proc/self/maps"); + } + FILE* file=fopen(maps_path,"r"); + if(!file){ + fprintf(stderr,"pmparser : cannot open the memory maps, %s\n",strerror(errno)); + return NULL; + } + int ind=0;char buf[PROCMAPS_LINE_MAX_LENGTH]; + //int c; + procmaps_struct* list_maps=NULL; + procmaps_struct* tmp; + procmaps_struct* current_node=list_maps; + char addr1[20],addr2[20], perm[8], offset[20], dev[10],inode[30],pathname[PATH_MAX]; + while( !feof(file) ){ + fgets(buf,PROCMAPS_LINE_MAX_LENGTH,file); + //allocate a node + tmp=(procmaps_struct*)malloc(sizeof(procmaps_struct)); + //fill the node + _pmparser_split_line(buf,addr1,addr2,perm,offset, dev,inode,pathname); + //printf("#%s",buf); + //printf("%s-%s %s %s %s %s\t%s\n",addr1,addr2,perm,offset,dev,inode,pathname); + //addr_start & addr_end + //unsigned long l_addr_start; + sscanf(addr1,"%lx",(long unsigned *)&tmp->addr_start ); + sscanf(addr2,"%lx",(long unsigned *)&tmp->addr_end ); + //size + tmp->length=(unsigned long)(tmp->addr_end-tmp->addr_start); + //perm + strcpy(tmp->perm,perm); + tmp->is_r=(perm[0]=='r'); + tmp->is_w=(perm[1]=='w'); + tmp->is_x=(perm[2]=='x'); + tmp->is_p=(perm[3]=='p'); + + //offset + sscanf(offset,"%lx",&tmp->offset ); + //device + strcpy(tmp->dev,dev); + //inode + tmp->inode=atoi(inode); + //pathname + strcpy(tmp->pathname,pathname); + tmp->next=NULL; + //attach the node + if(ind==0){ + list_maps=tmp; + list_maps->next=NULL; + current_node=list_maps; + } + current_node->next=tmp; + current_node=tmp; + ind++; + //printf("%s",buf); + } + + //close file + fclose(file); + + + //g_last_head=list_maps; + maps_it->head = list_maps; + maps_it->current = list_maps; + return maps_it; +} + + +procmaps_struct* pmparser_next(procmaps_iterator* p_procmaps_it){ + if(p_procmaps_it->current == NULL) + return NULL; + procmaps_struct* p_current = p_procmaps_it->current; + p_procmaps_it->current = p_procmaps_it->current->next; + return p_current; + /* + if(g_current==NULL){ + g_current=g_last_head; + }else + g_current=g_current->next; + + return g_current; + */ +} + + + +void pmparser_free(procmaps_iterator* p_procmaps_it){ + procmaps_struct* maps_list = p_procmaps_it->head; + if(maps_list==NULL) return ; + procmaps_struct* act=maps_list; + procmaps_struct* nxt=act->next; + while(act!=NULL){ + free(act); + act=nxt; + if(nxt!=NULL) + nxt=nxt->next; + } + +} + + +void _pmparser_split_line( + char*buf,char*addr1,char*addr2, + char*perm,char* offset,char* device,char*inode, + char* pathname){ + // + int orig=0; + int i=0; + //addr1 + while(buf[i]!='-'){ + addr1[i-orig]=buf[i]; + i++; + } + addr1[i]='\0'; + i++; + //addr2 + orig=i; + while(buf[i]!='\t' && buf[i]!=' '){ + addr2[i-orig]=buf[i]; + i++; + } + addr2[i-orig]='\0'; + + //perm + while(buf[i]=='\t' || buf[i]==' ') + i++; + orig=i; + while(buf[i]!='\t' && buf[i]!=' '){ + perm[i-orig]=buf[i]; + i++; + } + perm[i-orig]='\0'; + //offset + while(buf[i]=='\t' || buf[i]==' ') + i++; + orig=i; + while(buf[i]!='\t' && buf[i]!=' '){ + offset[i-orig]=buf[i]; + i++; + } + offset[i-orig]='\0'; + //dev + while(buf[i]=='\t' || buf[i]==' ') + i++; + orig=i; + while(buf[i]!='\t' && buf[i]!=' '){ + device[i-orig]=buf[i]; + i++; + } + device[i-orig]='\0'; + //inode + while(buf[i]=='\t' || buf[i]==' ') + i++; + orig=i; + while(buf[i]!='\t' && buf[i]!=' '){ + inode[i-orig]=buf[i]; + i++; + } + inode[i-orig]='\0'; + //pathname + pathname[0]='\0'; + while(buf[i]=='\t' || buf[i]==' ') + i++; + orig=i; + while(buf[i]!='\t' && buf[i]!=' ' && buf[i]!='\n'){ + pathname[i-orig]=buf[i]; + i++; + } + pathname[i-orig]='\0'; + +} + + +#endif |