about summary refs log tree commit diff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.gitignore13
-rw-r--r--Makefile18
-rwxr-xr-xafl-system-config14
-rw-r--r--libtokencap/Makefile5
-rw-r--r--llvm_mode/Makefile8
-rw-r--r--qemu_mode/README.md2
-rw-r--r--src/afl-fuzz-init.c4
-rw-r--r--src/afl-gotcpu.c39
-rwxr-xr-xtest/test.sh160
9 files changed, 203 insertions, 60 deletions
diff --git a/.gitignore b/.gitignore
index 43b8ad4b..f7907c76 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,6 +17,19 @@ afl-gotcpu
 afl-qemu-trace
 afl-showmap
 afl-tmin
+afl-analyze.8
+afl-clang-fast++.8
+afl-clang-fast.8
+afl-cmin.8
+afl-fuzz.8
+afl-gcc.8
+afl-gotcpu.8
+afl-plot.8
+afl-showmap.8
+afl-system-config.8
+afl-tmin.8
+afl-whatsup.8
+qemu_mode/libcompcov/compcovtest
 as
 qemu_mode/qemu-*
 unicorn_mode/unicorn
diff --git a/Makefile b/Makefile
index 42c6d737..3a056a73 100644
--- a/Makefile
+++ b/Makefile
@@ -45,6 +45,14 @@ ifneq "$(filter Linux GNU%,$(shell uname))" ""
   LDFLAGS  += -ldl
 endif
 
+ifneq "$(findstring FreeBSD, $(shell uname))" ""
+  CFLAGS += -pthread
+endif
+
+ifneq "$(findstring NetBSD, $(shell uname))" ""
+  CFLAGS += -pthread
+endif
+
 ifeq "$(findstring clang, $(shell $(CC) --version 2>/dev/null))" ""
   TEST_CC   = afl-gcc
 else
@@ -80,6 +88,9 @@ endif
 
 all:	test_x86 test_shm test_python27 ready $(PROGS) afl-as test_build all_done
 
+man:    $(MANPAGES) 
+	-$(MAKE) -C llvm_mode
+
 tests:	source-only
 	@cd test ; ./test.sh
 
@@ -90,6 +101,7 @@ help:
 	@echo "binary-only: everything for binary-only fuzzing: qemu_mode, unicorn_mode, libdislocator, libtokencap"
 	@echo "source-only: everything for source code fuzzing: llvm_mode, libdislocator, libtokencap"
 	@echo "distrib: everything (for both binary-only and source code fuzzing)"
+	@echo "man: creates simple man pages from the help option of the programs"
 	@echo "install: installs everything you have compiled with the build option above"
 	@echo "clean: cleans everything. for qemu_mode and unicorn_mode it means it deletes all downloads as well"
 	@echo "tests: this runs the test framework. It is more catered for the developers, but if you run into problems this helps pinpointing the problem"
@@ -230,14 +242,14 @@ all_done: test_build
 clean:
 	rm -f $(PROGS) afl-as as afl-g++ afl-clang afl-clang++ *.o src/*.o *~ a.out core core.[1-9][0-9]* *.stackdump .test .test1 .test2 test-instr .test-instr0 .test-instr1 qemu_mode/qemu-3.1.1.tar.xz afl-qemu-trace afl-gcc-fast afl-gcc-pass.so afl-gcc-rt.o afl-g++-fast *.so unicorn_mode/24f55a7973278f20f0de21b904851d99d4716263.tar.gz *.8
 	rm -rf out_dir qemu_mode/qemu-3.1.1 unicorn_mode/unicorn
-	$(MAKE) -C llvm_mode clean
+	-$(MAKE) -C llvm_mode clean
 	$(MAKE) -C libdislocator clean
 	$(MAKE) -C libtokencap clean
 	$(MAKE) -C qemu_mode/unsigaction clean
 	$(MAKE) -C qemu_mode/libcompcov clean
 
 distrib: all
-	$(MAKE) -C llvm_mode
+	-$(MAKE) -C llvm_mode
 	$(MAKE) -C libdislocator
 	$(MAKE) -C libtokencap
 	cd qemu_mode && sh ./build_qemu_support.sh
@@ -250,7 +262,7 @@ binary-only: all
 	cd unicorn_mode && sh ./build_unicorn_support.sh
 
 source-only: all
-	$(MAKE) -C llvm_mode
+	-$(MAKE) -C llvm_mode
 	$(MAKE) -C libdislocator
 	$(MAKE) -C libtokencap
 
diff --git a/afl-system-config b/afl-system-config
index 6a495f0a..a6e0efa4 100755
--- a/afl-system-config
+++ b/afl-system-config
@@ -48,5 +48,19 @@ if [ "$PLATFORM" = "OpenBSD" ] ; then
 echo
 echo 'System security features cannot be disabled on OpenBSD.'
 fi
+if [ "$PLATFORM" = "FreeBSD" ] ; then
+echo
+echo It is recommended to enable unprivileged users to set cpu affinity
+to be able to use afl-gotcpu meaningfully.
+/sbin/sysctl -w security.models.extensions.user_set_cpu_affinity=1
+fi
+if [ "$PLATFORM" = "Darwin" ] ; then
+  if [ $(launchctl list 2>/dev/null | grep -q '\.ReportCrash$') ] ; then
+echo We unload the default crash reporter here
+SL=/System/Library; PL=com.apple.ReportCrash
+launchctl unload -w ${SL}/LaunchAgents/${PL}.plist
+sudo launchctl unload -w ${SL}/LaunchDaemons/${PL}.Root.plist
+  fi
+fi
 echo
 echo Also use AFL_TMPDIR to use a tmpfs for the input file
diff --git a/libtokencap/Makefile b/libtokencap/Makefile
index 0faad511..3fd01b2c 100644
--- a/libtokencap/Makefile
+++ b/libtokencap/Makefile
@@ -21,7 +21,10 @@ VERSION     = $(shell grep '^\#define VERSION ' ../config.h | cut -d '"' -f2)
 CFLAGS      ?= -O3 -funroll-loops -I ../include/
 CFLAGS      += -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign
 
-all: libtokencap.so
+ifeq "$(shell uname)" "Linux"
+  TARGETS = libtokencap.so
+endif
+all: $(TARGETS)
 
 libtokencap.so: libtokencap.so.c ../config.h
 	$(CC) $(CFLAGS) -shared -fPIC $< -o ../$@ $(LDFLAGS)
diff --git a/llvm_mode/Makefile b/llvm_mode/Makefile
index 96aba898..7f2cc870 100644
--- a/llvm_mode/Makefile
+++ b/llvm_mode/Makefile
@@ -46,7 +46,7 @@ endif
 
 # this is not visible yet:
 ifeq "$(LLVM_MAJOR)" "9"
-  $(info llvm_mode deteted llvm 9, enabling neverZero implementation)
+  $(info llvm_mode detected llvm 9, enabling neverZero implementation)
 endif
 
 CFLAGS      ?= -O3 -funroll-loops
@@ -208,16 +208,16 @@ all_done: test_build
 
 vpath  % ..
 %.8: %
-	@echo .TH $* 8 `date -I` "afl++" > ../$@
+	@echo .TH $* 8 `date "+%Y-%m-%d"` "afl++" > ../$@
 	@echo .SH NAME >> ../$@
 	@echo .B $* >> ../$@
 	@echo >> ../$@
 	@echo .SH SYNOPSIS >> ../$@
-	@./$* -h 2>&1 | head -n 3 | tail -n 1 | sed 's/^\.\///' >> ../$@
+	@../$* -h 2>&1 | head -n 3 | tail -n 1 | sed 's/^\.\///' >> ../$@
 	@echo >> ../$@
 	@echo .SH OPTIONS >> ../$@
 	@echo .nf >> ../$@
-	@./$* -h 2>&1 | tail -n +4 >> ../$@
+	@../$* -h 2>&1 | tail -n +4 >> ../$@
 	@echo >> ../$@
 	@echo .SH AUTHOR >> ../$@
 	@echo "afl++ was written by Michal \"lcamtuf\" Zalewski and is maintained by Marc \"van Hauser\" Heuse <mh@mh-sec.de>, Heiko \"hexc0der\" Eissfeldt <heiko.eissfeldt@hexco.de> and Andrea Fioraldi <andreafioraldi@gmail.com>" >> ../$@
diff --git a/qemu_mode/README.md b/qemu_mode/README.md
index 5406371e..81e91854 100644
--- a/qemu_mode/README.md
+++ b/qemu_mode/README.md
@@ -99,7 +99,7 @@ on the x86 and x86_64 targets.
 
 Highly recommended.
 
-## 6) Bonus feature #3: Wine mode
+## 6) Bonus feature #4: Wine mode
 
 AFL++ QEMU can use Wine to fuzz WIn32 PE binaries. Use the -W flag of afl-fuzz.
 
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index fab82e2d..aa413e2e 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -786,7 +786,7 @@ double get_runnable_processes(void) {
 
   static double res;
 
-#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__)
+#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__)
 
   /* I don't see any portable sysctl or so that would quickly give us the
      number of runnable processes; the 1-minute load average can be a
@@ -827,7 +827,7 @@ double get_runnable_processes(void) {
 
   }
 
-#endif                        /* ^(__APPLE__ || __FreeBSD__ || __OpenBSD__) */
+#endif                        /* ^(__APPLE__ || __FreeBSD__ || __OpenBSD__ || __NetBSD__) */
 
   return res;
 
diff --git a/src/afl-gotcpu.c b/src/afl-gotcpu.c
index de41177c..ece5a850 100644
--- a/src/afl-gotcpu.c
+++ b/src/afl-gotcpu.c
@@ -52,9 +52,18 @@
 #include "types.h"
 #include "debug.h"
 
-#ifdef __linux__
+#if defined(__linux__) || defined(__FreeBSD__) || defined(__NetBSD__)
 #define HAVE_AFFINITY 1
-#endif                                                         /* __linux__ */
+# if defined(__FreeBSD__)
+#   include <pthread.h>
+#   include <pthread_np.h>
+#   include <sys/cpuset.h>
+#   define cpu_set_t cpuset_t
+# elif defined(__NetBSD__)
+#   include <pthread.h>
+#   include <sched.h>
+# endif
+#endif                                      /* __linux__ || __FreeBSD__ || __NetBSD__ */
 
 /* Get unix time in microseconds. */
 
@@ -154,14 +163,38 @@ int main(int argc, char** argv) {
 
     if (!fr) {
 
-      cpu_set_t c;
       u32       util_perc;
+#if defined(__linux__) || defined(__FreeBSD__)
+      cpu_set_t c;
 
       CPU_ZERO(&c);
       CPU_SET(i, &c);
+#elif defined(__NetBSD__)
+      cpuset_t *c;
+
+      c = cpuset_create();
+      if (c == NULL)
+        PFATAL("cpuset_create failed");
 
+      cpuset_set(i, c);
+#endif
+
+#if defined(__FreeBSD__)
+      if (pthread_setaffinity_np(pthread_self(), sizeof(c), &c))
+        PFATAL("pthread_setaffinity_np failed");
+#endif
+
+#if defined(__NetBSD__)
+      if (pthread_setaffinity_np(pthread_self(), cpuset_size(c), c))
+        PFATAL("pthread_setaffinity_np failed");
+
+      cpuset_destroy(c);
+#endif
+
+#if defined(__linux__)
       if (sched_setaffinity(0, sizeof(c), &c))
         PFATAL("sched_setaffinity failed");
+#endif
 
       util_perc = measure_preemption(CTEST_CORE_TRG_MS);
 
diff --git a/test/test.sh b/test/test.sh
index d230cf71..0aa37c87 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -1,11 +1,10 @@
-#!/bin/bash
+#!/bin/sh
 
 #
-# Ensure we have: test, type, diff -q, echo -e, grep -aqE, timeout
+# Ensure we have: test, type, diff -q, grep -aqE
 #
 test -z "" 2> /dev/null || { echo Error: test command not found ; exit 1 ; }
 GREP=`type grep > /dev/null 2>&1 && echo OK`
-TIMEOUT=`type timeout > /dev/null 2>&1 && echo OK`
 test "$GREP" = OK || { echo Error: grep command not found ; exit 1 ; }
 echo foobar | grep -aqE 'asd|oob' 2> /dev/null || { echo Error: grep command does not support -q, -a and/or -E option ; exit 1 ; }
 echo 1 > test.1
@@ -15,15 +14,15 @@ diff -q test.1 test.2 >/dev/null 2>&1 || OK=
 rm -f test.1 test.2
 test -z "$OK" && { echo Error: diff -q is not working ; exit 1 ; }
 
-ECHO="echo -e"
-$ECHO '\x41' 2>&1 | grep -qE '^A' || {
+ECHO="printf %b\\n"
+$ECHO \\101 2>&1 | grep -qE '^A' || {
   ECHO=
-  test -e /bin/echo && {
-    ECHO="/bin/echo -e"
-    $ECHO '\x41' 2>&1 | grep -qE '^A' || ECHO=
+  test -e /bin/printf && {
+    ECHO="/bin/printf %b\\n"
+    $ECHO '\\101' 2>&1 | grep -qE '^A' || ECHO=
   }
 }
-test -z "$ECHO" && { echo Error: echo command does not support -e option ; exit 1 ; }
+test -z "$ECHO" && { printf Error: printf command does not support octal character codes ; exit 1 ; }
 
 export AFL_EXIT_WHEN_DONE=1
 export AFL_SKIP_CPUFREQ=1
@@ -40,60 +39,84 @@ unset AFL_LLVM_LAF_SPLIT_SWITCHES
 unset AFL_LLVM_LAF_TRANSFORM_COMPARES
 unset AFL_LLVM_LAF_SPLIT_COMPARES
 
-GREY="\\x1b[1;90m"
-BLUE="\\x1b[1;94m"
-GREEN="\\x1b[0;32m"
-RED="\\x1b[0;31m"
-YELLOW="\\x1b[1;93m"
-RESET="\\x1b[0m"
+# on OpenBSD we need to work with llvm from /usr/local/bin
+test -e /usr/local/bin/opt && {
+  export PATH=/usr/local/bin:${PATH}
+} 
+# on MacOS X we prefer afl-clang over afl-gcc, because
+# afl-gcc does not work there
+test `uname -s` = 'Darwin' -o `uname -s` = 'FreeBSD' && {
+AFL_GCC=afl-clang
+} || {
+AFL_GCC=afl-gcc
+}
+GREY="\\033[1;90m"
+BLUE="\\033[1;94m"
+GREEN="\\033[0;32m"
+RED="\\033[0;31m"
+YELLOW="\\033[1;93m"
+RESET="\\033[0m"
+
+MEM_LIMIT=150
 
 $ECHO "${RESET}${GREY}[*] starting afl++ test framework ..."
 
-$ECHO "$BLUE[*] Testing: afl-gcc, afl-showmap and afl-fuzz"
-test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && {
-  ../afl-gcc -o test-instr.plain ../test-instr.c > /dev/null 2>&1
-  AFL_HARDEN=1 ../afl-gcc -o test-instr.harden ../test-instr.c > /dev/null 2>&1
+$ECHO "$BLUE[*] Testing: ${AFL_GCC}, afl-showmap and afl-fuzz"
+test -e ../${AFL_GCC} -a -e ../afl-showmap -a -e ../afl-fuzz && {
+  ../${AFL_GCC} -o test-instr.plain ../test-instr.c > /dev/null 2>&1
+  AFL_HARDEN=1 ../${AFL_GCC} -o test-instr.harden ../test-instr.c > /dev/null 2>&1
   test -e test-instr.plain && {
-    $ECHO "$GREEN[+] afl-gcc compilation succeeded"
-    echo 0 | ../afl-showmap -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
-    ../afl-showmap -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
+    $ECHO "$GREEN[+] ${AFL_GCC} compilation succeeded"
+    echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
+    ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
     test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
       diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
-        $ECHO "$RED[!] afl-gcc instrumentation should be different on different input but is not"
-      } || $ECHO "$GREEN[+] afl-gcc instrumentation present and working correctly"
-    } || $ECHO "$RED[!] afl-gcc instrumentation failed"
+        $ECHO "$RED[!] ${AFL_GCC} instrumentation should be different on different input but is not"
+      } || $ECHO "$GREEN[+] ${AFL_GCC} instrumentation present and working correctly"
+    } || $ECHO "$RED[!] ${AFL_GCC} instrumentation failed"
     rm -f test-instr.plain.0 test-instr.plain.1
-  } || $ECHO "$RED[!] afl-gcc failed"
+  } || $ECHO "$RED[!] ${AFL_GCC} failed"
   test -e test-instr.harden && {
     grep -qa fstack-protector-all test-instr.harden > /dev/null 2>&1 && {
-      $ECHO "$GREEN[+] afl-gcc hardened mode succeeded and is working"
-    } || $ECHO "$RED[!] afl-gcc hardened mode is not hardened"
+      $ECHO "$GREEN[+] ${AFL_GCC} hardened mode succeeded and is working"
+    } || $ECHO "$RED[!] ${AFL_GCC} hardened mode is not hardened"
     rm -f test-instr.harden
-  } || $ECHO "$RED[!] afl-gcc hardened mode compilation failed"
+  } || $ECHO "$RED[!] ${AFL_GCC} hardened mode compilation failed"
   # now we want to be sure that afl-fuzz is working  
-  test -n "$TIMEOUT" && {
+  # make sure core_pattern is set to core on linux
+  (test "$(uname -s)" = "Linux" && test "$(sysctl kernel.core_pattern)" != "kernel.core_pattern = core" && {
+    $ECHO "$RED[!] we cannot run afl-fuzz with enabled core dumps. Run 'sudo sh afl-system-config'.$RESET"
+    true
+  }) ||
+  # make sure crash reporter is disabled on Mac OS X
+  (test "$(uname -s)" = "Darwin" && test $(launchctl list 2>/dev/null | grep -q '\.ReportCrash$') && {
+    $ECHO "$RED[!] we cannot run afl-fuzz with enabled crash reporter. Run 'sudo sh afl-system-config'.$RESET"
+    true
+  }) || {
     mkdir -p in
     echo 0 > in/in
-    $ECHO "$GREY[*] running afl-fuzz for afl-gcc, this will take approx 10 seconds"
+    $ECHO "$GREY[*] running afl-fuzz for ${AFL_GCC}, this will take approx 10 seconds"
     {
-      timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1
+      ../afl-fuzz -V10 -m ${MEM_LIMIT} -i in -o out -- ./test-instr.plain > /dev/null 2>&1
     } > /dev/null 2>&1
     test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
-      $ECHO "$GREEN[+] afl-fuzz is working correctly with afl-gcc"
-    } || $ECHO "$RED[!] afl-fuzz is not working correctly with afl-gcc"
+      $ECHO "$GREEN[+] afl-fuzz is working correctly with ${AFL_GCC}"
+    } || $ECHO "$RED[!] afl-fuzz is not working correctly with ${AFL_GCC}"
     rm -rf in out
-  } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command"
+  }
   rm -f test-instr.plain
 } || $ECHO "$YELLOW[-] afl is not compiled, cannot test"
 
 $ECHO "$BLUE[*] Testing: llvm_mode"
 test -e ../afl-clang-fast && {
+  # on FreeBSD need to set AFL_CC
+  export AFL_CC=`llvm-config --bindir`/clang
   ../afl-clang-fast -o test-instr.plain ../test-instr.c > /dev/null 2>&1
   AFL_HARDEN=1 ../afl-clang-fast -o test-compcov.harden test-compcov.c > /dev/null 2>&1
   test -e test-instr.plain && {
     $ECHO "$GREEN[+] llvm_mode compilation succeeded"
-    echo 0 | ../afl-showmap -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
-    ../afl-showmap -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
+    echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
+    ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
     test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
       diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
         $ECHO "$RED[!] llvm_mode instrumentation should be different on different input but is not"
@@ -108,18 +131,26 @@ test -e ../afl-clang-fast && {
     rm -f test-compcov.harden
   } || $ECHO "$RED[!] llvm_mode hardened mode compilation failed"
   # now we want to be sure that afl-fuzz is working  
-  test -n "$TIMEOUT" && {
+  (test "$(uname -s)" = "Linux" && test "$(sysctl kernel.core_pattern)" != "kernel.core_pattern = core" && {
+    $ECHO "$RED[!] we cannot run afl-fuzz with enabled core dumps. Run 'sudo sh afl-system-config'.$RESET"
+    true
+  }) ||
+  # make sure crash reporter is disabled on Mac OS X
+  (test "$(uname -s)" = "Darwin" && test $(launchctl list 2>/dev/null | grep -q '\.ReportCrash$') && {
+    $ECHO "$RED[!] we cannot run afl-fuzz with enabled crash reporter. Run 'sudo sh afl-system-config'.$RESET"
+    true
+  }) || {
     mkdir -p in
     echo 0 > in/in
     $ECHO "$GREY[*] running afl-fuzz for llvm_mode, this will take approx 10 seconds"
     {
-      timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1
+      ../afl-fuzz -V10 -m ${MEM_LIMIT} -i in -o out -- ./test-instr.plain > /dev/null 2>&1
     } > /dev/null 2>&1
     test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
       $ECHO "$GREEN[+] afl-fuzz is working correctly with llvm_mode"
     } || $ECHO "$RED[!] afl-fuzz is not working correctly with llvm_mode"
     rm -rf in out
-  } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command"
+  }
   rm -f test-instr.plain
 
   # now for the special llvm_mode things
@@ -177,15 +208,15 @@ rm -f test-compcov
 
 $ECHO "$BLUE[*] Testing: qemu_mode"
 test -e ../afl-qemu-trace && {
-  gcc -o test-instr ../test-instr.c
+  gcc -no-pie -o test-instr ../test-instr.c
   gcc -o test-compcov test-compcov.c
   test -e test-instr -a -e test-compcov && {
-    test -n "$TIMEOUT" && {
+    {
       mkdir -p in
       echo 0 > in/in
       $ECHO "$GREY[*] running afl-fuzz for qemu_mode, this will take approx 10 seconds"
       {
-        timeout -s KILL 10 ../afl-fuzz -Q -i in -o out -- ./test-instr > /dev/null 2>&1
+        ../afl-fuzz -V10 -Q -i in -o out -- ./test-instr > /dev/null 2>&1
       } > /dev/null 2>&1
       test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
         $ECHO "$GREEN[+] afl-fuzz is working correctly with qemu_mode"
@@ -196,21 +227,58 @@ test -e ../afl-qemu-trace && {
         {
           export AFL_PRELOAD=../libcompcov.so 
           export AFL_COMPCOV_LEVEL=2
-          timeout -s KILL 10 ../afl-fuzz -Q -i in -o out -- ./test-compcov > /dev/null 2>&1
+          ../afl-fuzz -V10 -Q -i in -o out -- ./test-compcov > /dev/null 2>&1
         } > /dev/null 2>&1
         test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
           $ECHO "$GREEN[+] afl-fuzz is working correctly with qemu_mode libcompcov"
         } || $ECHO "$RED[!] afl-fuzz is not working correctly with qemu_mode libcompcov"
       } || $ECHO "$YELLOW[-] we cannot test qemu_mode libcompcov because it is not present"
       rm -rf in out
-    } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command"
+    }
   } || $ECHO "$RED[-] gcc compilation of test targets failed - what is going on??"
   
   $ECHO "$YELLOW[?] we need a test case for qemu_mode persistent mode"
+  # This works but there are already problems with persistent (e.g. stability)
+  #$ECHO "$GREY[*] running afl-fuzz for persistent qemu_mode, this will take approx 10 seconds"
+  #{
+  #  export AFL_QEMU_PERSISTENT_ADDR=0x$(nm test-instr | grep "T main" | awk '{ print $1 }')
+  #  export AFL_QEMU_PERSISTENT_GPR=1
+  #  ../afl-fuzz -V10 -Q -i in -o out -- ./test-instr > /dev/null 2>&1
+  #} > /dev/null 2>&1
+  #test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
+  #  $ECHO "$GREEN[+] afl-fuzz is working correctly with persistent qemu_mode"
+  #} || $ECHO "$RED[!] afl-fuzz is not working correctly with persistent qemu_mode"
 
   rm -f test-instr test-compcov
 } || $ECHO "$YELLOW[-] qemu_mode is not compiled, cannot test"
 
+$ECHO "$BLUE[*] Testing: unicorn_mode"
+test -d ../unicorn_mode/unicorn && {
+  test -e ../unicorn_mode/samples/simple/simple_target.bin -a -e ../unicorn_mode/samples/compcov_x64/compcov_target.bin && {
+    {
+      mkdir -p in
+      echo 0 > in/in
+      $ECHO "$GREY[*] running afl-fuzz for unicorn_mode, this will take approx 15 seconds"
+      {
+        ../afl-fuzz -V15 -U -i in -o out -d -- python ../unicorn_mode/samples/simple/simple_test_harness.py @@ > /dev/null 2>&1
+      } > /dev/null 2>&1
+      test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
+        $ECHO "$GREEN[+] afl-fuzz is working correctly with unicorn_mode"
+      } || $ECHO "$RED[!] afl-fuzz is not working correctly with unicorn_mode"
+
+      $ECHO "$GREY[*] running afl-fuzz for unicorn_mode compcov, this will take approx 15 seconds"
+      {
+        export AFL_COMPCOV_LEVEL=2
+        ../afl-fuzz -V15 -U -i in -o out -d -- python ../unicorn_mode/samples/compcov_x64/compcov_test_harness.py @@ > /dev/null 2>&1
+      } > /dev/null 2>&1
+      test -n "$( ls out/queue/id:000001* 2> /dev/null )" && {
+        $ECHO "$GREEN[+] afl-fuzz is working correctly with unicorn_mode compcov"
+      } || $ECHO "$RED[!] afl-fuzz is not working correctly with unicorn_mode compcov"
+      rm -rf in out
+    }
+  } || $ECHO "$RED[-] missing sample binaries in unicorn_mode/samples/ - what is going on??"
+  
+} || $ECHO "$YELLOW[-] unicorn_mode is not compiled, cannot test"
+
 $ECHO "$GREY[*] all test cases completed.$RESET"
 
-# unicorn_mode ?
generated by cgit-pink 1.4.1 (git 2.36.1) at 2025-05-30 01:29:28 +0000