diff options
41 files changed, 1385 insertions, 1043 deletions
diff --git a/.custom-format.py b/.custom-format.py index f493a2d9..e3779b68 100755 --- a/.custom-format.py +++ b/.custom-format.py @@ -29,27 +29,29 @@ CLANG_FORMAT_BIN = os.getenv("CLANG_FORMAT_BIN") if CLANG_FORMAT_BIN is None: o = 0 try: - p = subprocess.Popen(["clang-format", "--version"], stdout=subprocess.PIPE) + p = subprocess.Popen(["clang-format-8", "--version"], stdout=subprocess.PIPE) o, _ = p.communicate() o = str(o, "utf-8") o = o[len("clang-format version "):].strip() o = o[:o.find(".")] o = int(o) - except: pass - if o < 7: - if subprocess.call(['which', 'clang-format-7'], stdout=subprocess.PIPE) == 0: - CLANG_FORMAT_BIN = 'clang-format-7' - elif subprocess.call(['which', 'clang-format-8'], stdout=subprocess.PIPE) == 0: - CLANG_FORMAT_BIN = 'clang-format-8' - elif subprocess.call(['which', 'clang-format-9'], stdout=subprocess.PIPE) == 0: - CLANG_FORMAT_BIN = 'clang-format-9' - elif subprocess.call(['which', 'clang-format-10'], stdout=subprocess.PIPE) == 0: - CLANG_FORMAT_BIN = 'clang-format-10' - else: - print ("clang-format 7 or above is needed. Aborted.") - exit(1) + except: + print ("clang-format-8 is needed. Aborted.") + exit(1) + #if o < 7: + # if subprocess.call(['which', 'clang-format-7'], stdout=subprocess.PIPE) == 0: + # CLANG_FORMAT_BIN = 'clang-format-7' + # elif subprocess.call(['which', 'clang-format-8'], stdout=subprocess.PIPE) == 0: + # CLANG_FORMAT_BIN = 'clang-format-8' + # elif subprocess.call(['which', 'clang-format-9'], stdout=subprocess.PIPE) == 0: + # CLANG_FORMAT_BIN = 'clang-format-9' + # elif subprocess.call(['which', 'clang-format-10'], stdout=subprocess.PIPE) == 0: + # CLANG_FORMAT_BIN = 'clang-format-10' + # else: + # print ("clang-format 7 or above is needed. Aborted.") + # exit(1) else: - CLANG_FORMAT_BIN = 'clang-format' + CLANG_FORMAT_BIN = 'clang-format-8' COLUMN_LIMIT = 80 for line in fmt.split("\n"): diff --git a/Changelog b/Changelog deleted file mode 120000 index fef2ac30..00000000 --- a/Changelog +++ /dev/null @@ -1 +0,0 @@ -docs/ChangeLog \ No newline at end of file diff --git a/Dockerfile b/Dockerfile index 7bb60610..396954ab 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ FROM ubuntu:eoan MAINTAINER David Carlier <devnexen@gmail.com> LABEL "about"="AFLplusplus docker image" -RUN apt-get update && apt-get install -y \ +RUN apt-get update && apt-get -y install \ --no-install-suggests --no-install-recommends \ automake \ bison \ diff --git a/Makefile b/Makefile index 13be4ec9..5af8444a 100644 --- a/Makefile +++ b/Makefile @@ -51,13 +51,15 @@ endif ifneq "$(shell uname -m)" "x86_64" ifneq "$(shell uname -m)" "i386" ifneq "$(shell uname -m)" "amd64" + ifneq "$(shell uname -m)" "i86pc" AFL_NO_X86=1 + endif endif endif endif CFLAGS ?= -O3 -funroll-loops $(CFLAGS_OPT) -CFLAGS += -Wall -g -Wno-pointer-sign -I include/ \ +override CFLAGS += -Wall -g -Wno-pointer-sign -I include/ \ -DAFL_PATH=\"$(HELPER_PATH)\" -DBIN_PATH=\"$(BIN_PATH)\" \ -DDOC_PATH=\"$(DOC_PATH)\" -Wno-unused-function @@ -109,10 +111,12 @@ endif ifneq "$(findstring FreeBSD, $(shell uname))" "" CFLAGS += -pthread + LDFLAGS += -lpthread endif ifneq "$(findstring NetBSD, $(shell uname))" "" CFLAGS += -pthread + LDFLAGS += -lpthread endif ifeq "$(findstring clang, $(shell $(CC) --version 2>/dev/null))" "" @@ -423,7 +427,7 @@ endif install -m 755 afl-as $${DESTDIR}$(HELPER_PATH) ln -sf afl-as $${DESTDIR}$(HELPER_PATH)/as - install -m 644 docs/*.md docs/ChangeLog $${DESTDIR}$(DOC_PATH) + install -m 644 docs/*.md $${DESTDIR}$(DOC_PATH) cp -r testcases/ $${DESTDIR}$(MISC_PATH) cp -r dictionaries/ $${DESTDIR}$(MISC_PATH) diff --git a/PATCHES b/PATCHES deleted file mode 120000 index b34f8c1d..00000000 --- a/PATCHES +++ /dev/null @@ -1 +0,0 @@ -docs/PATCHES \ No newline at end of file diff --git a/README.md b/README.md index e7b216e7..939cfb92 100644 --- a/README.md +++ b/README.md @@ -59,13 +59,14 @@ A more thorough list is available in the PATCHES file. - | Feature/Instrumentation | afl-gcc | llvm_mode | gcc_plugin | qemu_mode | unicorn_mode | - | ----------------------- |:-------:|:---------:|:----------:|:---------:|:------------:| - | laf-intel / CompCov | | x | | x86/arm | x86/arm | - | NeverZero | x | x(1) | (2) | x | x | - | Persistent mode | | x | x | x86 | x | - | Whitelist | | x | x | | | - | InsTrim | | x | | | | + | Feature/Instrumentation | afl-gcc | llvm_mode | gcc_plugin | qemu_mode | unicorn_mode | + | ----------------------- |:-------:|:---------:|:----------:|:----------------:|:------------:| + | NeverZero | x | x(1) | (2) | x | x | + | Persistent mode | | x | x | x86[_64]/arm[64] | x | + | laf-intel / CompCov | | x | | x86[_64]/arm[64] | x86[_64]/arm | + | CmpLog | | x | | x86[_64]/arm[64] | | + | Whitelist | | x | x | (x)(3) | | + | InsTrim | | x | | | | neverZero: @@ -73,6 +74,8 @@ (2) gcc creates non-performant code, hence it is disabled in gcc_plugin + (3) partially via AFL_CODE_START/AFL_CODE_END + So all in all this is the best-of afl that is currently out there :-) For new versions and additional information, check out: diff --git a/TODO b/TODO.md index e935eafa..02850276 100644 --- a/TODO +++ b/TODO.md @@ -1,12 +1,13 @@ -Roadmap 2.61+: -============== +## Roadmap 2.61 Makefile: - -march=native -Ofast -flto=full afl-fuzz: - sync_fuzzers(): only masters sync from all, slaves only sync from master + (@andrea: be careful, often people run all slaves) + - ascii_only mode gcc_plugin: - laf-intel @@ -17,41 +18,53 @@ qemu_mode: - instrim for QEMU mode via static analysis (with r2pipe? or angr?) Idea: The static analyzer outputs a map in which each edge that must be skipped is marked with 1. QEMU loads it at startup in the parent process. + - rename qemu specific envs to AFL_QEMU (AFL_ENTRYPOINT, AFL_CODE_START/END, AFL_COMPCOV_LEVEL?) + - add AFL_QEMU_EXITPOINT (maybe multiple?) + - add/implement AFL_QEMU_INST_LIBLIST and AFL_QEMU_NOINST_PROGRAM custom_mutators: - rip what Superion is doing into custom mutators for js, php, etc. + - uniform python and custom mutators API -The far away future: -==================== +## The far away future: Problem: Average targets (tiff, jpeg, unrar) go through 1500 edges. At afl's default map that means ~16 collisions and ~3 wrappings. - Solution #1: increase map size. + + - Solution #1: increase map size. every +1 decreases fuzzing speed by ~10% and halfs the collisions birthday paradox predicts collisions at this # of edges: - mapsize => collisions - 2^16 = 302 - 2^17 = 427 - 2^18 = 603 - 2^19 = 853 - 2^20 = 1207 - 2^21 = 1706 - 2^22 = 2412 - 2^23 = 3411 - 2^24 = 4823 + + | mapsize | collisions | + | :-----: | :--------: | + | 2^16 | 302 | + | 2^17 | 427 | + | 2^18 | 603 | + | 2^19 | 853 | + | 2^20 | 1207 | + | 2^21 | 1706 | + | 2^22 | 2412 | + | 2^23 | 3411 | + | 2^24 | 4823 | + Increasing the map is an easy solution but also not a good one. - Solution #2: use dynamic map size and collision free basic block IDs + + - Solution #2: use dynamic map size and collision free basic block IDs This only works in llvm_mode and llvm >= 9 though A potential good future solution. Heiko/hexcoder follows this up - Solution #3: write instruction pointers to a big shared map + + - Solution #3: write instruction pointers to a big shared map 512kb/1MB shared map and the instrumented code writes the instruction pointer into the map. Map must be big enough but could be command line controlled. + Good: complete coverage information, nothing is lost. choice of analysis impacts speed, but this can be decided by user options + Neutral: a little bit slower but no loss of coverage + Bad: completely changes how afl uses the map and the scheduling. Overall another very good solution, Marc Heuse/vanHauser follows this up diff --git a/afl-cmin b/afl-cmin index 182376c9..0aa702ea 100755 --- a/afl-cmin +++ b/afl-cmin @@ -390,12 +390,8 @@ BEGIN { cur = 0; if (!stdin_file) { - while (cur < in_count) { - fn = infilesSmallToBig[cur] - ++cur; - printf "\r Processing file "cur"/"in_count - system( "AFL_CMIN_ALLOW_ANY=1 \""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"/"fn"\" -Z "extra_par" -- \""target_bin"\" "prog_args_string" <\""in_dir"/"fn"\"") - } + printf " Processing "in_count" files (forkserver mode)..." + system( "AFL_CMIN_ALLOW_ANY=1 \""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"\" -Z "extra_par" -i \""in_dir"\" -- \""target_bin"\" "prog_args_string) } else { printf " Processing "in_count" files (forkserver mode)..." system( "AFL_CMIN_ALLOW_ANY=1 \""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"\" -Z "extra_par" -i \""in_dir"\" -- \""target_bin"\" "prog_args_string" </dev/null") @@ -403,7 +399,6 @@ BEGIN { print "" - ####################################################### # STEP 2: register smallest input file for each tuple # # STEP 3: copy that file (at most once) # diff --git a/docs/ChangeLog b/docs/Changelog.md index f5430057..751b051a 100644 --- a/docs/ChangeLog +++ b/docs/Changelog.md @@ -1,21 +1,15 @@ -========= -ChangeLog -========= +# Changelog This is the list of all noteworthy changes made in every public release of the tool. See README for the general instruction manual. ----------------- -Staying informed ----------------- +## Staying informed Want to stay in the loop on major new features? Join our mailing list by sending a mail to <afl-users+subscribe@googlegroups.com>. --------------------------- -Version ++2.60d (develop): --------------------------- +### Version ++2.60d (develop): - use -march=native if available - afl-fuzz: @@ -24,13 +18,22 @@ Version ++2.60d (develop): - Android: prefer bigcores when selecting a CPU - CmpLog forkserver - Redqueen input-2-state mutator (cmp instructions only ATM) - - all python 2+3 versions supported now + - all Python 2+3 versions supported now + - changed execs_per_sec in fuzzer_stats from "current" execs per second + (which is pointless) to total execs per second - afl-clang-fast: - show in the help output for which llvm version it was compiled for - now does not need to be recompiled between trace-pc and pass instrumentation. compile normally and set AFL_LLVM_USE_TRACE_PC :) - - llvm 11 is supported - - CmpLog mode (see llvm_mode/README.cmplog) + - LLVM 11 is supported + - CmpLog instrumentation using SanCov (see llvm_mode/README.cmplog) + - qemu_mode: + - persistent mode is now also available for arm and aarch64 + - CmpLog instrumentation for QEMU (-c afl-fuzz command line option) + for x86, x86_64, arm and aarch64 + - AFL_PERSISTENT_HOOK callback module for persistent QEMU + (see examples/qemu_persistent_hook) + - added qemu_mode/README.persistent.md documentation - afl-cmin is now a sh script (invoking awk) instead of bash for portability the original script is still present as afl-cmin.bash - afl-showmap: -i dir option now allows processing multiple inputs using the @@ -40,9 +43,7 @@ Version ++2.60d (develop): - libdislocator: AFL_ALIGNED_ALLOC to force size alignment to max_align_t --------------------------- -Version ++2.60c (release): --------------------------- +### Version ++2.60c (release): - fixed a critical bug in afl-tmin that was introduced during ++2.53d - added test cases for afl-cmin and afl-tmin to test/test.sh @@ -54,9 +55,7 @@ Version ++2.60c (release): - we now set QEMU_SET_ENV from AFL_PRELOAD when qemu_mode is used --------------------------- -Version ++2.59c (release): --------------------------- +### Version ++2.59c (release): - qbdi_mode: fuzz android native libraries via QBDI framework - unicorn_mode: switched to the new unicornafl, thanks domenukk @@ -88,9 +87,7 @@ Version ++2.59c (release): - removed unnecessary warnings --------------------------- -Version ++2.58c (release): --------------------------- +### Version ++2.58c (release): - reverted patch to not unlink and recreate the input file, it resulted in performance loss of ~10% @@ -100,9 +97,7 @@ Version ++2.58c (release): - gcc_plugin tests added to testing framework --------------------------------- -Version ++2.54d-2.57c (release): --------------------------------- +### Version ++2.54d-2.57c (release): - we jump to 2.57 instead of 2.55 to catch up with Google's versioning - persistent mode for QEMU (see qemu_mode/README.md) @@ -132,9 +127,7 @@ Version ++2.54d-2.57c (release): - laf-intel in llvm_mode now also handles floating point comparisons --------------------------- -Version ++2.54c (release): --------------------------- +### Version ++2.54c (release): - big code refactoring: * all includes are now in include/ @@ -162,9 +155,7 @@ Version ++2.54c (release): - immediates-only instrumentation for CompareCoverage --------------------------- -Version ++2.53c (release): --------------------------- +### Version ++2.53c (release): - README is now README.md - imported the few minor changes from the 2.53b release @@ -206,9 +197,7 @@ Version ++2.53c (release): that is longer but in line with other llvm specific env vars ------------------------------ -Version ++2.52c (2019-06-05): ------------------------------ +### Version ++2.52c (2019-06-05): - Applied community patches. See docs/PATCHES for the full list. LLVM and Qemu modes are now faster. @@ -225,9 +214,7 @@ Version ++2.52c (2019-06-05): https://github.com/andreafioraldi/afl and with community patches added ---------------------------- -Version 2.52b (2017-11-04): ---------------------------- +### Version 2.52b (2017-11-04): - Upgraded QEMU patches from 2.3.0 to 2.10.0. Required troubleshooting several weird issues. All the legwork done by Andrew Griffiths. @@ -246,16 +233,12 @@ Version 2.52b (2017-11-04): - Added support for parameters in triage_crashes.sh. Patch by Adam of DC949. ---------------------------- -Version 2.51b (2017-08-30): ---------------------------- +### Version 2.51b (2017-08-30): - Made afl-tmin call setsid to prevent glibc traceback junk from showing up on the terminal in some distros. Suggested by Jakub Wilk. ---------------------------- -Version 2.50b (2017-08-19): ---------------------------- +### Version 2.50b (2017-08-19): - Fixed an interesting timing corner case spotted by Jakub Wilk. @@ -268,17 +251,13 @@ Version 2.50b (2017-08-19): - In-place resume now preserves .synced. Suggested by Jakub Wilk. ---------------------------- -Version 2.49b (2017-07-18): ---------------------------- +### Version 2.49b (2017-07-18): - Added AFL_TMIN_EXACT to allow path constraint for crash minimization. - Added dates for releases (retroactively for all of 2017). ---------------------------- -Version 2.48b (2017-07-17): ---------------------------- +### Version 2.48b (2017-07-17): - Added AFL_ALLOW_TMP to permit some scripts to run in /tmp. @@ -286,15 +265,11 @@ Version 2.48b (2017-07-17): - Made it possible to point -o and -f to the same file in afl-tmin. ---------------------------- -Version 2.47b (2017-07-14): ---------------------------- +### Version 2.47b (2017-07-14): - Fixed cwd handling in afl-tmin. Spotted by Jakub Wilk. ---------------------------- -Version 2.46b (2017-07-10): ---------------------------- +### Version 2.46b (2017-07-10): - libdislocator now supports AFL_LD_NO_CALLOC_OVER for folks who do not want to abort on calloc() overflows. @@ -303,9 +278,7 @@ Version 2.46b (2017-07-10): - Added a small JSON dictionary, inspired on a dictionary done by Jakub Wilk. ---------------------------- -Version 2.45b (2017-07-04): ---------------------------- +### Version 2.45b (2017-07-04): - Added strstr, strcasestr support to libtokencap. Contributed by Daniel Hodson. @@ -314,9 +287,7 @@ Version 2.45b (2017-07-04): - There are definitely no bugs in afl-showmap -c now. ---------------------------- -Version 2.44b (2017-06-28): ---------------------------- +### Version 2.44b (2017-06-28): - Added a visual indicator of ASAN / MSAN mode when compiling. Requested by Jakub Wilk. @@ -329,31 +300,23 @@ Version 2.44b (2017-06-28): - Added a note about allocator_may_return_null=1 not always working with ASAN. Spotted by Jakub Wilk. ---------------------------- -Version 2.43b (2017-06-16): ---------------------------- +### Version 2.43b (2017-06-16): - Added AFL_NO_ARITH to aid in the fuzzing of text-based formats. Requested by Jakub Wilk. ---------------------------- -Version 2.42b (2017-06-02): ---------------------------- +### Version 2.42b (2017-06-02): - Renamed the R() macro to avoid a problem with llvm_mode in the latest versions of LLVM. Fix suggested by Christian Holler. ---------------------------- -Version 2.41b (2017-04-12): ---------------------------- +### Version 2.41b (2017-04-12): - Addressed a major user complaint related to timeout detection. Timing out inputs are now binned as "hangs" only if they exceed a far more generous time limit than the one used to reject slow paths. ---------------------------- -Version 2.40b (2017-04-02): ---------------------------- +### Version 2.40b (2017-04-02): - Fixed a minor oversight in the insertion strategy for dictionary words. Spotted by Andrzej Jackowski. @@ -362,9 +325,7 @@ Version 2.40b (2017-04-02): - Adjusted color rules for "is it done yet?" indicators. ---------------------------- -Version 2.39b (2017-02-02): ---------------------------- +### Version 2.39b (2017-02-02): - Improved error reporting in afl-cmin. Suggested by floyd. @@ -372,16 +333,12 @@ Version 2.39b (2017-02-02): - Added a mention of afl-monitor. ---------------------------- -Version 2.38b (2017-01-22): ---------------------------- +### Version 2.38b (2017-01-22): - Added -mllvm -sanitizer-coverage-block-threshold=0 to trace-pc-guard mode, as suggested by Kostya Serebryany. ---------------------------- -Version 2.37b (2017-01-22): ---------------------------- +### Version 2.37b (2017-01-22): - Fixed a typo. Spotted by Jakub Wilk. @@ -395,9 +352,7 @@ Version 2.37b (2017-01-22): Note that for some reason, this mode doesn't perform as well as "vanilla" afl-clang-fast / afl-clang. ---------------------------- -Version 2.36b (2017-01-14): ---------------------------- +### Version 2.36b (2017-01-14): - Fixed a cosmetic bad free() bug when aborting -S sessions. Spotted by Johannes S. @@ -423,34 +378,26 @@ Version 2.36b (2017-01-14): Yep, I know I have a backlog on several other feature requests. Stay tuned! --------------- -Version 2.35b: --------------- +### Version 2.35b: - Fixed a minor cmdline reporting glitch, spotted by Leo Barnes. - Fixed a silly bug in libdislocator. Spotted by Johannes Schultz. --------------- -Version 2.34b: --------------- +### Version 2.34b: - Added a note about afl-tmin to technical_details.txt. - Added support for AFL_NO_UI, as suggested by Leo Barnes. --------------- -Version 2.33b: --------------- +### Version 2.33b: - Added code to strip -Wl,-z,defs and -Wl,--no-undefined for afl-clang-fast, since they interfere with -shared. Spotted and diagnosed by Toby Hutton. - Added some fuzzing tips for Android. --------------- -Version 2.32b: --------------- +### Version 2.32b: - Added a check for AFL_HARDEN combined with AFL_USE_*SAN. Suggested by Hanno Boeck. @@ -458,9 +405,7 @@ Version 2.32b: - Made several other cosmetic adjustments to cycle timing in the wake of the big tweak made in 2.31b. --------------- -Version 2.31b: --------------- +### Version 2.31b: - Changed havoc cycle counts for a marked performance boost, especially with -S / -d. See the discussion of FidgetyAFL in: @@ -472,9 +417,7 @@ Version 2.31b: more improvements may follow as I do more experiments and get more definitive data. --------------- -Version 2.30b: --------------- +### Version 2.30b: - Made minor improvements to persistent mode to avoid the remote possibility of "no instrumentation detected" issues with very low @@ -486,17 +429,13 @@ Version 2.30b: - Made persistent mode bitmaps a bit more consistent and adjusted the way this is shown in the UI, especially in persistent mode. --------------- -Version 2.29b: --------------- +### Version 2.29b: - Made a minor #include fix to llvm_mode. Suggested by Jonathan Metzman. - Made cosmetic updates to the docs. --------------- -Version 2.28b: --------------- +### Version 2.28b: - Added "life pro tips" to docs/. @@ -506,9 +445,7 @@ Version 2.28b: - Added an important safety tip. --------------- -Version 2.27b: --------------- +### Version 2.27b: - Added libtokencap, a simple feature to intercept strcmp / memcmp and generate dictionary entries that can help extend coverage. @@ -517,9 +454,7 @@ Version 2.27b: - The demo in examples/instrumented_cmp is no more. --------------- -Version 2.26b: --------------- +### Version 2.26b: - Made a fix for libdislocator.so to compile on MacOS X. @@ -527,24 +462,18 @@ Version 2.26b: - Renamed AFL_LD_PRELOAD to AFL_PRELOAD. --------------- -Version 2.25b: --------------- +### Version 2.25b: - Made some cosmetic updates to libdislocator.so, renamed one env variable. --------------- -Version 2.24b: --------------- +### Version 2.24b: - Added libdislocator.so, an experimental, abusive allocator. Try it out with AFL_LD_PRELOAD=/path/to/libdislocator.so when running afl-fuzz. --------------- -Version 2.23b: --------------- +### Version 2.23b: - Improved the stability metric for persistent mode binaries. Problem spotted by Kurt Roeckx. @@ -552,9 +481,7 @@ Version 2.23b: - Made a related improvement that may bring the metric to 100% for those targets. --------------- -Version 2.22b: --------------- +### Version 2.22b: - Mentioned the potential conflicts between MSAN / ASAN and FORTIFY_SOURCE. There is no automated check for this, since some distros may implicitly @@ -565,18 +492,14 @@ Version 2.22b: - Made a change to the handling of ./afl-clang-fast -v. Spotted by Jan Kneschke. --------------- -Version 2.21b: --------------- +### Version 2.21b: - Added some crash reporting notes for Solaris in docs/INSTALL, as investigated by Martin Carpenter. - Fixed a minor UI mix-up with havoc strategy stats. --------------- -Version 2.20b: --------------- +### Version 2.20b: - Revamped the handling of variable paths, replacing path count with a "stability" score to give users a much better signal. Based on the @@ -590,24 +513,18 @@ Version 2.20b: - Added experimental support for parallelizing -M. --------------- -Version 2.19b: --------------- +### Version 2.19b: - Made a fix to make sure that auto CPU binding happens at non-overlapping times. --------------- -Version 2.18b: --------------- +### Version 2.18b: - Made several performance improvements to has_new_bits() and classify_counts(). This should offer a robust performance bump with fast targets. --------------- -Version 2.17b: --------------- +### Version 2.17b: - Killed the error-prone and manual -Z option. On Linux, AFL will now automatically bind to the first free core (or complain if there are no @@ -615,9 +532,7 @@ Version 2.17b: - Made some doc updates along these lines. --------------- -Version 2.16b: --------------- +### Version 2.16b: - Improved support for older versions of clang (hopefully without breaking anything). @@ -625,43 +540,33 @@ Version 2.16b: - Moved version data from Makefile to config.h. Suggested by Jonathan Metzman. --------------- -Version 2.15b: --------------- +### Version 2.15b: - Added a README section on looking for non-crashing bugs. - Added license data to several boring files. Contributed by Jonathan Metzman. --------------- -Version 2.14b: --------------- +### Version 2.14b: - Added FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION as a macro defined when compiling with afl-gcc and friends. Suggested by Kostya Serebryany. - Refreshed some of the non-x86 docs. --------------- -Version 2.13b: --------------- +### Version 2.13b: - Fixed a spurious build test error with trace-pc and llvm_mode/Makefile. Spotted by Markus Teufelberger. - Fixed a cosmetic issue with afl-whatsup. Spotted by Brandon Perry. --------------- -Version 2.12b: --------------- +### Version 2.12b: - Fixed a minor issue in afl-tmin that can make alphabet minimization less efficient during passes > 1. Spotted by Daniel Binderman. --------------- -Version 2.11b: --------------- +### Version 2.11b: - Fixed a minor typo in instrumented_cmp, spotted by Hanno Eissfeldt. @@ -672,32 +577,24 @@ Version 2.11b: - Fixed a typo in post_library_png.so.c in examples/. Spotted by Kostya Serebryany. --------------- -Version 2.10b: --------------- +### Version 2.10b: - Fixed a minor core counting glitch, reported by Tyler Nighswander. --------------- -Version 2.09b: --------------- +### Version 2.09b: - Made several documentation updates. - Added some visual indicators to promote and simplify the use of -Z. --------------- -Version 2.08b: --------------- +### Version 2.08b: - Added explicit support for -m32 and -m64 for llvm_mode. Inspired by a request from Christian Holler. - Added a new benchmarking option, as requested by Kostya Serebryany. --------------- -Version 2.07b: --------------- +### Version 2.07b: - Added CPU affinity option (-Z) on Linux. With some caution, this can offer a significant (10%+) performance bump and reduce jitter. @@ -708,9 +605,7 @@ Version 2.07b: - Fixed confusing CPU_TARGET error messages with QEMU build. Spotted by Daniel Komaromy and others. --------------- -Version 2.06b: --------------- +### Version 2.06b: - Worked around LLVM persistent mode hiccups with -shared code. Contributed by Christian Holler. @@ -723,23 +618,17 @@ Version 2.06b: allow AFL to be built as a library. This is fairly use-specific and may have relatively little appeal to general audiences. --------------- -Version 2.05b: --------------- +### Version 2.05b: - Put __sanitizer_cov_module_init & co behind #ifdef to avoid problems with ASAN. Spotted by Christian Holler. --------------- -Version 2.04b: --------------- +### Version 2.04b: - Removed indirect-calls coverage from -fsanitize-coverage (since it's redundant). Spotted by Kostya Serebryany. --------------- -Version 2.03b: --------------- +### Version 2.03b: - Added experimental -fsanitize-coverage=trace-pc support that goes with some recent additions to LLVM, as implemented by Kostya Serebryany. @@ -761,16 +650,12 @@ Version 2.03b: - Added AFL_LD_PRELOAD to allow LD_PRELOAD to be set for targets without affecting AFL itself. Suggested by Daniel Godas-Lopez. --------------- -Version 2.02b: --------------- +### Version 2.02b: - Fixed a "lcamtuf can't count to 16" bug in the havoc stage. Reported by Guillaume Endignoux. --------------- -Version 2.01b: --------------- +### Version 2.01b: - Made an improvement to cycle counter color coding, based on feedback from Shai Sarfaty. @@ -779,18 +664,14 @@ Version 2.01b: - Fixed an installation issue with afl-as, as spotted by ilovezfs. --------------- -Version 2.00b: --------------- +### Version 2.00b: - Cleaned up color handling after a minor snafu in 1.99b (affecting some terminals). - Made minor updates to the documentation. --------------- -Version 1.99b: --------------- +### Version 1.99b: - Substantially revamped the output and the internal logic of afl-analyze. @@ -801,17 +682,13 @@ Version 1.99b: - Updated docs to better explain afl-analyze. --------------- -Version 1.98b: --------------- +### Version 1.98b: - Improved to "boring string" detection in afl-analyze. - Added technical_details.txt for afl-analyze. --------------- -Version 1.97b: --------------- +### Version 1.97b: - Added afl-analyze, a nifty tool to analyze the structure of a file based on the feedback from AFL instrumentation. This is kinda experimental, @@ -821,9 +698,7 @@ Version 1.97b: - Fixed a couple of typos, as reported by Jakub Wilk and others. --------------- -Version 1.96b: --------------- +### Version 1.96b: - Added -fpic to CFLAGS for the clang plugin, as suggested by Hanno Boeck. @@ -834,9 +709,7 @@ Version 1.96b: - Added support for AFL_SHUFFLE_QUEUE, based on discussions with Christian Holler. --------------- -Version 1.95b: --------------- +### Version 1.95b: - Fixed a harmless bug when handling -B. Spotted by Jacek Wielemborek. @@ -851,9 +724,7 @@ Version 1.95b: - Made a change to avoid spuriously setting __AFL_SHM_ID when AFL_DUMB_FORKSRV is set in conjunction with -n. Spotted by Jakub Wilk. --------------- -Version 1.94b: --------------- +### Version 1.94b: - Changed allocator alignment to improve support for non-x86 systems (now that llvm_mode makes this more feasible). @@ -863,29 +734,21 @@ Version 1.94b: - Fixed an obscure bug that would affect people trying to use afl-gcc with $TMP set but $TMPDIR absent. Spotted by Jeremy Barnes. --------------- -Version 1.93b: --------------- +### Version 1.93b: - Hopefully fixed a problem with MacOS X and persistent mode, spotted by Leo Barnes. --------------- -Version 1.92b: --------------- +### Version 1.92b: - Made yet another C++ fix (namespaces). Reported by Daniel Lockyer. --------------- -Version 1.91b: --------------- +### Version 1.91b: - Made another fix to make 1.90b actually work properly with C++ (d'oh). Problem spotted by Daniel Lockyer. --------------- -Version 1.90b: --------------- +### Version 1.90b: - Fixed a minor typo spotted by Kai Zhao; and made several other minor updates to docs. @@ -895,9 +758,7 @@ Version 1.90b: - Fixed a potential problem with deferred mode signatures getting optimized out by the linker (with --gc-sections). --------------- -Version 1.89b: --------------- +### Version 1.89b: - Revamped the support for persistent and deferred forkserver modes. Both now feature simpler syntax and do not require companion env @@ -905,16 +766,12 @@ Version 1.89b: - Added a bit more info about afl-showmap. Suggested by Jacek Wielemborek. --------------- -Version 1.88b: --------------- +### Version 1.88b: - Made AFL_EXIT_WHEN_DONE work in non-tty mode. Issue spotted by Jacek Wielemborek. --------------- -Version 1.87b: --------------- +### Version 1.87b: - Added QuickStartGuide.txt, a one-page quick start doc. @@ -922,9 +779,7 @@ Version 1.87b: - Revamped several parts of README. --------------- -Version 1.86b: --------------- +### Version 1.86b: - Added support for AFL_SKIP_CRASHES, which is a very hackish solution to the problem of resuming sessions with intermittently crashing inputs. @@ -934,17 +789,13 @@ Version 1.86b: - Fixed a minor typo in show_stats. Spotted by Dingbao Xie. --------------- -Version 1.85b: --------------- +### Version 1.85b: - Fixed a garbled sentence in notes on parallel fuzzing. Thanks to Jakub Wilk. - Fixed a minor glitch in afl-cmin. Spotted by Jonathan Foote. --------------- -Version 1.84b: --------------- +### Version 1.84b: - Made SIMPLE_FILES behave as expected when naming backup directories for crashes and hangs. @@ -958,9 +809,7 @@ Version 1.84b: - Made a fix for no lahf / sahf support on older versions of FreeBSD. Patch contributed by Alex Moneger. --------------- -Version 1.83b: --------------- +### Version 1.83b: - Fixed a problem with xargs -d on non-Linux systems in afl-cmin. Spotted by teor2345 and Ben Nagy. @@ -968,9 +817,7 @@ Version 1.83b: - Fixed an implicit declaration in LLVM mode on MacOS X. Reported by Kai Zhao. --------------- -Version 1.82b: --------------- +### Version 1.82b: - Fixed a harmless but annoying race condition in persistent mode - signal delivery is a bit more finicky than I thought. @@ -979,9 +826,7 @@ Version 1.82b: - Tweaked AFL_PERSISTENT to force AFL_NO_VAR_CHECK. --------------- -Version 1.81b: --------------- +### Version 1.81b: - Added persistent mode for in-process fuzzing. See llvm_mode/README.llvm. Inspired by Kostya Serebryany and Christian Holler. @@ -992,18 +837,14 @@ Version 1.81b: - Included a potential fix for LLVM mode issues on MacOS X, based on the investigation done by teor2345. --------------- -Version 1.80b: --------------- +### Version 1.80b: - Made afl-cmin tolerant of whitespaces in filenames. Suggested by Jonathan Neuschafer and Ketil Froyn. - Added support for AFL_EXIT_WHEN_DONE, as suggested by Michael Rash. --------------- -Version 1.79b: --------------- +### Version 1.79b: - Added support for dictionary levels, see testcases/README.testcases. @@ -1011,9 +852,7 @@ Version 1.79b: - Added a note about Preeny. --------------- -Version 1.78b: --------------- +### Version 1.78b: - Added a dictionary for PDF, contributed by Ben Nagy. @@ -1022,9 +861,7 @@ Version 1.78b: - Fixed a problem with crash reporter detection on MacOS X, as reported by Louis Dassy. --------------- -Version 1.77b: --------------- +### Version 1.77b: - Extended the -x option to support single-file dictionaries. @@ -1032,9 +869,7 @@ Version 1.77b: - Removed newlines from HTML keywords in testcases/_extras/html/. --------------- -Version 1.76b: --------------- +### Version 1.76b: - Very significantly reduced the number of duplicate execs during deterministic checks, chiefly in int16 and int32 stages. Confirmed @@ -1048,9 +883,7 @@ Version 1.76b: - Added a note about integrating afl-fuzz with third-party tools. --------------- -Version 1.75b: --------------- +### Version 1.75b: - Improved argv_fuzzing to allow it to emit empty args. Spotted by Jakub Wilk. @@ -1065,9 +898,7 @@ Version 1.75b: - Fixed a typo. Reported by Jakub Wilk. --------------- -Version 1.74b: --------------- +### Version 1.74b: - Added an example argv[] fuzzing wrapper in examples/argv_fuzzing. Reworked the bash example to be faster, too. @@ -1088,27 +919,21 @@ Version 1.74b: - Switched qemu_mode to use the newly-released QEMU 2.3.0, which contains a couple of minor bugfixes. --------------- -Version 1.73b: --------------- +### Version 1.73b: - Fixed a pretty stupid bug in effector maps that could sometimes cause AFL to fuzz slightly more than necessary; and in very rare circumstances, could lead to SEGV if eff_map is aligned with page boundary and followed by an unmapped page. Spotted by Jonathan Gray. --------------- -Version 1.72b: --------------- +### Version 1.72b: - Fixed a glitch in non-x86 install, spotted by Tobias Ospelt. - Added a minor safeguard to llvm_mode Makefile following a report from Kai Zhao. --------------- -Version 1.71b: --------------- +### Version 1.71b: - Fixed a bug with installed copies of AFL trying to use QEMU mode. Spotted by G.M. Lime. @@ -1118,9 +943,7 @@ Version 1.71b: - Fixed a typo, thanks to Jakub Wilk. --------------- -Version 1.70b: --------------- +### Version 1.70b: - Modified resumption code to reuse the original timeout value when resuming a session if -t is not given. This prevents timeout creep in continuous @@ -1136,16 +959,12 @@ Version 1.70b: - Added a more prominent note about the MacOS X trade-offs to Makefile. --------------- -Version 1.69b: --------------- +### Version 1.69b: - Added support for deferred initialization in LLVM mode. Suggested by Richard Godbee. --------------- -Version 1.68b: --------------- +### Version 1.68b: - Fixed a minor PRNG glitch that would make the first seconds of a fuzzing job deterministic. Thanks to Andreas Stieger. @@ -1155,15 +974,11 @@ Version 1.68b: - Clarified the footnote in README. --------------- -Version 1.67b: --------------- +### Version 1.67b: - Made one more correction to llvm_mode Makefile, spotted by Jakub Wilk. --------------- -Version 1.66b: --------------- +### Version 1.66b: - Added CC / CXX support to llvm_mode Makefile. Requested by Charlie Eriksen. @@ -1174,17 +989,13 @@ Version 1.66b: - Removed build date and time from banners to give people deterministic builds. Requested by Jakub Wilk. --------------- -Version 1.65b: --------------- +### Version 1.65b: - Fixed a snafu with some leftover code in afl-clang-fast. - Corrected even moar typos. --------------- -Version 1.64b: --------------- +### Version 1.64b: - Further simplified afl-clang-fast runtime by reverting .init_array to __attribute__((constructor(0)). This should improve compatibility with @@ -1197,18 +1008,14 @@ Version 1.64b: - Removed unnecessary instrumentation density adjustment for the LLVM mode. Reported by Jonathan Neuschafer. --------------- -Version 1.63b: --------------- +### Version 1.63b: - Updated cgroups_asan/ with a new version from Sam, made a couple changes to streamline it and keep parallel afl instances in separate groups. - Fixed typos, thanks to Jakub Wilk. --------------- -Version 1.62b: --------------- +### Version 1.62b: - Improved the handling of -x in afl-clang-fast, @@ -1217,9 +1024,7 @@ Version 1.62b: - Fixed the llvm-config bug for good (thanks to Tobias Ospelt). --------------- -Version 1.61b: --------------- +### Version 1.61b: - Fixed an obscure bug compiling OpenSSL with afl-clang-fast. Patch by Laszlo Szekeres. @@ -1230,9 +1035,7 @@ Version 1.61b: Tobias Ospelt. (There is another odd bug there that hasn't been fully fixed - TBD). --------------- -Version 1.60b: --------------- +### Version 1.60b: - Allowed examples/llvm_instrumentation/ to graduate to llvm_mode/. @@ -1254,9 +1057,7 @@ Version 1.60b: - Added MEM_BARRIER() to afl-showmap and afl-tmin, just to be safe. --------------- -Version 1.59b: --------------- +### Version 1.59b: - Imported Laszlo Szekeres' experimental LLVM instrumentation into examples/llvm_instrumentation. I'll work on including it in the @@ -1264,9 +1065,7 @@ Version 1.59b: - Fixed another typo, thanks to Jakub Wilk. --------------- -Version 1.58b: --------------- +### Version 1.58b: - Added a workaround for abort() behavior in -lpthread programs in QEMU mode. Spotted by Aidan Thornton. @@ -1274,9 +1073,7 @@ Version 1.58b: - Made several documentation updates, including links to the static instrumentation tool (sister_projects.txt). --------------- -Version 1.57b: --------------- +### Version 1.57b: - Fixed a problem with exception handling on some versions of MacOS X. Spotted by Samir Aguiar and Anders Wang Kristensen. @@ -1284,9 +1081,7 @@ Version 1.57b: - Tweaked afl-gcc to use BIN_PATH instead of a fixed string in help messages. --------------- -Version 1.56b: --------------- +### Version 1.56b: - Renamed related_work.txt to historical_notes.txt. @@ -1295,16 +1090,12 @@ Version 1.56b: - Added docs/sister_projects.txt with a list of inspired or closely related utilities. --------------- -Version 1.55b: --------------- +### Version 1.55b: - Fixed a glitch with afl-showmap opening /dev/null with O_RDONLY when running in quiet mode. Spotted by Tyler Nighswander. --------------- -Version 1.54b: --------------- +### Version 1.54b: - Added another postprocessor example for PNG. @@ -1313,24 +1104,18 @@ Version 1.54b: - Improved -ldl handling. Suggested by Jakub Wilk. --------------- -Version 1.53b: --------------- +### Version 1.53b: - Fixed an -l ordering issue that is apparently still a problem on Ubuntu. Spotted by William Robinet. --------------- -Version 1.52b: --------------- +### Version 1.52b: - Added support for file format postprocessors. Requested by Ben Nagy. This feature is intentionally buried, since it's fairly easy to misuse and useful only in some scenarios. See examples/post_library/. --------------- -Version 1.51b: --------------- +### Version 1.51b: - Made it possible to properly override LD_BIND_NOW after one very unusual report of trouble. @@ -1339,9 +1124,7 @@ Version 1.51b: - Fixed a bug in AFL_DUMB_FORKSRV. --------------- -Version 1.50b: --------------- +### Version 1.50b: - Fixed a flock() bug that would prevent dir reuse errors from kicking in every now and then. @@ -1353,26 +1136,20 @@ Version 1.50b: - Fixed a typo or two. --------------- -Version 1.49b: --------------- +### Version 1.49b: - Added code to save original command line in fuzzer_stats and crashes/README.txt. Also saves fuzzer version in fuzzer_stats. Requested by Ben Nagy. --------------- -Version 1.48b: --------------- +### Version 1.48b: - Fixed a bug with QEMU fork server crashes when translation is attempted after a jump to an invalid pointer in the child process (i.e., after bumping into a particularly nasty security bug in the tested binary). Reported by Tyler Nighswander. --------------- -Version 1.47b: --------------- +### Version 1.47b: - Fixed a bug with afl-cmin in -Q mode complaining about binary being not instrumented. Thanks to Jonathan Neuschafer for the bug report. @@ -1382,9 +1159,7 @@ Version 1.47b: - Improved the use of colors when showing crash counts in -C mode. --------------- -Version 1.46b: --------------- +### Version 1.46b: - Improved instrumentation performance on 32-bit systems by getting rid of xor-swap (oddly enough, xor-swap is still faster on 64-bit) and tweaking @@ -1392,9 +1167,7 @@ Version 1.46b: - Made path depth numbers more accurate with imported test cases. --------------- -Version 1.45b: --------------- +### Version 1.45b: - Added support for SIMPLE_FILES in config.h for folks who don't like descriptive file names. Generates very simple names without colons, @@ -1411,9 +1184,7 @@ Version 1.45b: - Made several minor updates to docs. --------------- -Version 1.44b: --------------- +### Version 1.44b: - Corrected two bungled attempts to get the -C mode work properly with afl-cmin (accounting for the short-lived releases tagged 1.42 and @@ -1423,9 +1194,7 @@ Version 1.44b: - Said goodbye to Hello Kitty, as requested by Padraig Brady. --------------- -Version 1.41b: --------------- +### Version 1.41b: - Added AFL_ALLOW_CRASHES=1 to afl-cmin. Allows crashing inputs in the output corpus. Changed the default behavior to disallow it. @@ -1445,9 +1214,7 @@ Version 1.41b: - Fixed typos and made improvements to several docs. --------------- -Version 1.40b: --------------- +### Version 1.40b: - Switched to smaller block op sizes during the first passes over the queue. Helps keep test cases small. @@ -1457,9 +1224,7 @@ Version 1.40b: - Updated a bunch of docs. --------------- -Version 1.39b: --------------- +### Version 1.39b: - Added the ability to skip inputs by sending SIGUSR1 to the fuzzer. @@ -1475,9 +1240,7 @@ Version 1.39b: versus 50 ms - ~40 execs/sec) and made several other cosmetic changes to the timeout code. --------------- -Version 1.38b: --------------- +### Version 1.38b: - Fixed a bug in the QEMU build script, spotted by William Robinet. @@ -1488,9 +1251,7 @@ Version 1.38b: - Fixed typos, thanks to Jakub Wilk. --------------- -Version 1.37b: --------------- +### Version 1.37b: - Added effector maps, which detect regions that do not seem to respond to bitflips and subsequently exclude them from more expensive steps @@ -1521,9 +1282,7 @@ Version 1.37b: - Moved afl-cmin back to bash, wasn't thinking straight. It has to stay on bash because other shells may have restrictive limits on array sizes. --------------- -Version 1.36b: --------------- +### Version 1.36b: - Switched afl-cmin over to /bin/sh. Thanks to Jonathan Gray. @@ -1539,23 +1298,17 @@ Version 1.36b: - Believe it or not, fixed some typos. Thanks to Jakub Wilk. --------------- -Version 1.35b: --------------- +### Version 1.35b: - Cleaned up regular expressions in some of the scripts to avoid errors on *BSD systems. Spotted by Jonathan Gray. --------------- -Version 1.34b: --------------- +### Version 1.34b: - Performed a substantial documentation and program output cleanup to better explain the QEMU feature. --------------- -Version 1.33b: --------------- +### Version 1.33b: - Added support for AFL_INST_RATIO and AFL_INST_LIBS in the QEMU mode. @@ -1570,17 +1323,13 @@ Version 1.33b: - Added a check for instrumented binaries when passing -Q to afl-fuzz. --------------- -Version 1.32b: --------------- +### Version 1.32b: - Fixed 'make install' following the QEMU changes. Spotted by Hanno Boeck. - Fixed EXTRA_PAR handling in afl-cmin. --------------- -Version 1.31b: --------------- +### Version 1.31b: - Hallelujah! Thanks to Andrew Griffiths, we now support very fast, black-box instrumentation of binary-only code. See qemu_mode/README.qemu. @@ -1588,9 +1337,7 @@ Version 1.31b: To use this feature, you need to follow the instructions in that directory and then run afl-fuzz with -Q. --------------- -Version 1.30b: --------------- +### Version 1.30b: - Added -s (summary) option to afl-whatsup. Suggested by Jodie Cunningham. @@ -1603,18 +1350,14 @@ Version 1.30b: - Fixed process crash messages with -m none. --------------- -Version 1.29b: --------------- +### Version 1.29b: - Improved the naming of test cases when orig: is already present in the file name. - Made substantial improvements to technical_details.txt. --------------- -Version 1.28b: --------------- +### Version 1.28b: - Made a minor tweak to the instrumentation to preserve the directionality of tuples (i.e., A -> B != B -> A) and to maintain the identity of tight @@ -1624,9 +1367,7 @@ Version 1.28b: - Added several sanity checks to afl-cmin. --------------- -Version 1.27b: --------------- +### Version 1.27b: - Made afl-tmin recursive. Thanks to Hanno Boeck for the tip. @@ -1637,9 +1378,7 @@ Version 1.27b: - Removed current_todo.txt and cleaned up the remaining docs. --------------- -Version 1.26b: --------------- +### Version 1.26b: - Added total execs/sec stat for afl-whatsup. @@ -1654,9 +1393,7 @@ Version 1.26b: - Fixed a memory limit issue during the build process on NetBSD-current. Reported by Thomas Klausner. --------------- -Version 1.25b: --------------- +### Version 1.25b: - Introduced afl-whatsup, a simple tool for querying the status of local synced instances of afl-fuzz. @@ -1669,22 +1406,16 @@ Version 1.25b: - Improved the checks for -m and -t values in afl-cmin. Bug report from Evan Huus. --------------- -Version 1.24b: --------------- +### Version 1.24b: - Introduced afl-getcpu, an experimental tool to empirically measure CPU preemption rates. Thanks to Jakub Wilk for the idea. --------------- -Version 1.23b: --------------- +### Version 1.23b: - Reverted one change to afl-cmin that actually made it slower. --------------- -Version 1.22b: --------------- +### Version 1.22b: - Reworked afl-showmap.c to support normal options, including -o, -q, -e. Also added support for timeouts and memory limits. @@ -1696,9 +1427,7 @@ Version 1.22b: - Fixed another typo in afl-tmin, courtesy of Jakub Wilk. --------------- -Version 1.21b: --------------- +### Version 1.21b: - Graduated minimize_corpus.sh to afl-cmin. It is now a first-class utility bundled with the fuzzer. @@ -1710,9 +1439,7 @@ Version 1.21b: - Made assorted changes to the doc to document afl-cmin and other stuff. --------------- -Version 1.20b: --------------- +### Version 1.20b: - Added AFL_DUMB_FORKSRV, as requested by Jakub Wilk. This works only in -n mode and allows afl-fuzz to run with "dummy" fork servers that @@ -1727,9 +1454,7 @@ Version 1.20b: - Fixed a typo (via Jakub Wilk). --------------- -Version 1.19b: --------------- +### Version 1.19b: - Improved exec failure detection in afl-fuzz and afl-showmap. @@ -1737,18 +1462,14 @@ Version 1.19b: - Added afl-tmin, a handy instrumentation-enabled minimizer. --------------- -Version 1.18b: --------------- +### Version 1.18b: - Fixed a serious but short-lived bug in the resumption behavior introduced in version 1.16b. - Added -t nn+ mode for soft-skipping timing-out paths. --------------- -Version 1.17b: --------------- +### Version 1.17b: - Fixed a compiler warning introduced in 1.16b for newer versions of GCC. Thanks to Jakub Wilk and Ilfak Guilfanov. @@ -1759,9 +1480,7 @@ Version 1.17b: - Made several noticeable performance improvements to deterministic arith and known int steps. --------------- -Version 1.16b: --------------- +### Version 1.16b: - Added a bit of code to make resumption pick up from the last known offset in the queue, rather than always rewinding to the start. Suggested @@ -1770,9 +1489,7 @@ Version 1.16b: - Switched to tighter timeout control for slow programs (3x rather than 5x average exec speed at init). --------------- -Version 1.15b: --------------- +### Version 1.15b: - Added support for AFL_NO_VAR_CHECK to speed up resumption and inhibit variable path warnings for some programs. @@ -1784,9 +1501,7 @@ Version 1.15b: - Made the UI a bit more descriptive by adding "n/a" instead of "0" in a couple of corner cases. --------------- -Version 1.14b: --------------- +### Version 1.14b: - Added a (partial) dictionary for JavaScript. @@ -1794,18 +1509,14 @@ Version 1.14b: - Tweaked the havoc scaling logic added in 1.12b. --------------- -Version 1.13b: --------------- +### Version 1.13b: - Improved the performance of minimize_corpus.sh by switching to a sort-based approach. - Made several minor revisions to the docs. --------------- -Version 1.12b: --------------- +### Version 1.12b: - Made an improvement to dictionary generation to avoid runs of identical bytes. @@ -1823,15 +1534,11 @@ Version 1.12b: - Fixed moar typos, as reported by Jakub Wilk. --------------- -Version 1.11b: --------------- +### Version 1.11b: - Added a bit more info about dictionary strategies to the status screen. --------------- -Version 1.10b: --------------- +### Version 1.10b: - Revised the dictionary behavior to use insertion and overwrite in deterministic steps, rather than just the latter. This improves coverage @@ -1839,9 +1546,7 @@ Version 1.10b: - Added a mention of "*" in status_screen.txt, as suggested by Jakub Wilk. --------------- -Version 1.09b: --------------- +### Version 1.09b: - Corrected a cosmetic problem with 'extras' stage count not always being accurate in the stage yields view. @@ -1849,15 +1554,11 @@ Version 1.09b: - Fixed a typo reported by Jakub Wilk and made some minor documentation improvements. --------------- -Version 1.08b: --------------- +### Version 1.08b: - Fixed a div-by-zero bug in the newly-added code when using a dictionary. --------------- -Version 1.07b: --------------- +### Version 1.07b: - Added code that automatically finds and extracts syntax tokens from the input corpus. @@ -1869,9 +1570,7 @@ Version 1.07b: - Added a couple of more exotic archive format samples. --------------- -Version 1.06b: --------------- +### Version 1.06b: - Switched to slightly more accurate (if still not very helpful) reporting of short read and short write errors. These theoretically shouldn't happen @@ -1884,18 +1583,14 @@ Version 1.06b: - Tweaked the odds of fuzzing non-favored test cases to make sure that baseline coverage of all inputs is reached sooner. --------------- -Version 1.05b: --------------- +### Version 1.05b: - Added a dictionary for WebP. - Made some additional performance improvements to minimize_corpus.sh, getting deeper into the bash woods. --------------- -Version 1.04b: --------------- +### Version 1.04b: - Made substantial performance improvements to minimize_corpus.sh with large datasets, albeit at the expense of having to switch back to bash @@ -1903,18 +1598,14 @@ Version 1.04b: - Tweaked afl-showmap to support the format used by the new script. --------------- -Version 1.03b: --------------- +### Version 1.03b: - Added code to skip README.txt in the input directory to make the crash exploration mode work better. Suggested by Jakub Wilk. - Added a dictionary for SQLite. --------------- -Version 1.02b: --------------- +### Version 1.02b: - Reverted the ./ search path in minimize_corpus.sh because people did not like it. @@ -1925,24 +1616,18 @@ Version 1.02b: - Added a check for /tmp binaries and -f locations in afl-fuzz. --------------- -Version 1.01b: --------------- +### Version 1.01b: - Added dictionaries for XML and GIF. --------------- -Version 1.00b: --------------- +### Version 1.00b: - Slightly improved the performance of minimize_corpus.sh, especially on Linux. - Made a couple of improvements to calibration timeouts for resumed scans. --------------- -Version 0.99b: --------------- +### Version 0.99b: - Fixed minimize_corpus.sh to work with dash, as suggested by Jakub Wilk. @@ -1952,9 +1637,7 @@ Version 0.99b: - Added support for afl-as --version, as required by one funky build script. Reported by William Robinet. --------------- -Version 0.98b: --------------- +### Version 0.98b: - Added a dictionary for TIFF. @@ -1965,9 +1648,7 @@ Version 0.98b: most notably including minimize_corpus.sh and triage_crashes.sh. Requested by Jonathan Gray. --------------- -Version 0.97b: --------------- +### Version 0.97b: - Fixed cosmetic issues around the naming of -x strategy files. @@ -1976,9 +1657,7 @@ Version 0.97b: - Fixed a very rare glitch when running instrumenting 64-bit code that makes heavy use of xmm registers that are also touched by glibc. --------------- -Version 0.96b: --------------- +### Version 0.96b: - Added support for extra dictionaries, provided testcases/_extras/png/ as a demo. @@ -1990,9 +1669,7 @@ Version 0.96b: - Fixed afl-plot syntax for gnuplot 5.x. Reported by David Necas. --------------- -Version 0.95b: --------------- +### Version 0.95b: - Cleaned up the OSX ReportCrash code. Thanks to Tobias Ospelt for help. @@ -2000,24 +1677,18 @@ Version 0.95b: - Refreshed the INSTALL file. --------------- -Version 0.94b: --------------- +### Version 0.94b: - Added in-place resume (-i-) to address a common user complaint. - Added an awful workaround for ReportCrash on MacOS X. Problem spotted by Joseph Gentle. --------------- -Version 0.93b: --------------- +### Version 0.93b: - Fixed the link() workaround, as reported by Jakub Wilk. --------------- -Version 0.92b: --------------- +### Version 0.92b: - Added support for reading test cases from another filesystem. Requested by Jakub Wilk. @@ -2026,9 +1697,7 @@ Version 0.92b: - Added a sample PDF document. --------------- -Version 0.91b: --------------- +### Version 0.91b: - Refactored minimize_corpus.sh to make it a bit more user-friendly and to select for smallest files, not largest bitmaps. Offers a modest corpus @@ -2036,9 +1705,7 @@ Version 0.91b: - Slightly improved the performance of splicing code. --------------- -Version 0.90b: --------------- +### Version 0.90b: - Moved to an algorithm where paths are marked as preferred primarily based on size and speed, rather than bitmap coverage. This should offer @@ -2061,9 +1728,7 @@ Version 0.90b: - Added a tty check for the colors warning in Makefile, to keep distro build logs tidy. Suggested by Jakub Wilk. --------------- -Version 0.89b: --------------- +### Version 0.89b: - Renamed afl-plot.sh to afl-plot, as requested by Padraig Brady. @@ -2071,9 +1736,7 @@ Version 0.89b: - Added banner information to fuzzer_stats, populated it to afl-plot. --------------- -Version 0.88b: --------------- +### Version 0.88b: - Added support for plotting, with design and implementation based on a prototype design proposed by Michael Rash. Huge thanks! @@ -2089,15 +1752,11 @@ Version 0.88b: - Added some detail to fuzzer_stats for parity with plot_file. --------------- -Version 0.87b: --------------- +### Version 0.87b: - Added support for MSAN, via AFL_USE_MSAN, same gotchas as for ASAN. --------------- -Version 0.86b: --------------- +### Version 0.86b: - Added AFL_NO_FORKSRV, allowing the forkserver to be bypassed. Suggested by Ryan Govostes. @@ -2106,9 +1765,7 @@ Version 0.86b: - Made minor improvements to crash_triage.sh, as suggested by Jakub Wilk. --------------- -Version 0.85b: --------------- +### Version 0.85b: - Fixed the CPU counting code - no sysctlbyname() on OpenBSD, d'oh. Bug reported by Daniel Dickman. @@ -2116,27 +1773,21 @@ Version 0.85b: - Made a slight correction to error messages - the advice on testing with ulimit was a tiny bit off by a factor of 1024. --------------- -Version 0.84b: --------------- +### Version 0.84b: - Added support for the CPU widget on some non-Linux platforms (I hope). Based on feedback from Ryan Govostes. - Cleaned up the changelog (very meta). --------------- -Version 0.83b: --------------- +### Version 0.83b: - Added examples/clang_asm_normalize/ and related notes in env_variables.txt and afl-as.c. Thanks to Ryan Govostes for the idea. - Added advice on hardware utilization in README. --------------- -Version 0.82b: --------------- +### Version 0.82b: - Made additional fixes for Xcode support, juggling -Q and -q flags. Thanks to Ryan Govostes. @@ -2144,9 +1795,7 @@ Version 0.82b: - Added a check for __asm__ blocks and switches to .intel_syntax in assembly. Based on feedback from Ryan Govostes. --------------- -Version 0.81b: --------------- +### Version 0.81b: - A workaround for Xcode 6 as -Q flag glitch. Spotted by Ryan Govostes. @@ -2154,9 +1803,7 @@ Version 0.81b: - Fix for a slightly busted path scoring conditional. Minor practical impact. --------------- -Version 0.80b: --------------- +### Version 0.80b: - Added a check for $PATH-induced loops. Problem noticed by Kartik Agaram. @@ -2165,18 +1812,14 @@ Version 0.80b: - Added an override for AFL_USE_ASAN if set at afl compile time. Requested by Hanno Boeck. --------------- -Version 0.79b: --------------- +### Version 0.79b: - Made minor adjustments to path skipping logic. - Made several documentation updates to reflect the path selection changes made in 0.78b. --------------- -Version 0.78b: --------------- +### Version 0.78b: - Added a CPU governor check. Bug report from Joe Zbiciak. @@ -2195,9 +1838,7 @@ Version 0.78b: 64k and added a warning to detect older binaries that rely on smaller bitmaps. --------------- -Version 0.77b: --------------- +### Version 0.77b: - Added AFL_SKIP_CHECKS to bypass binary checks when really warranted. Feature requested by Jakub Wilk. @@ -2206,25 +1847,19 @@ Version 0.77b: - Added a warning for runs that are aborted early on. --------------- -Version 0.76b: --------------- +### Version 0.76b: - Incorporated another signal handling fix for Solaris. Suggestion submitted by Martin Carpenter. --------------- -Version 0.75b: --------------- +### Version 0.75b: - Implemented a slightly more "elegant" kludge for the %llu glitch (see types.h). - Relaxed CPU load warnings to stay in sync with reality. --------------- -Version 0.74b: --------------- +### Version 0.74b: - Switched to more responsive exec speed averages and better UI speed scaling. @@ -2232,16 +1867,12 @@ Version 0.74b: - Fixed a bug with interrupted reads on Solaris. Issue spotted by Martin Carpenter. --------------- -Version 0.73b: --------------- +### Version 0.73b: - Fixed a stray memcpy() instead of memmove() on overlapping buffers. Mostly harmless but still dumb. Mistake spotted thanks to David Higgs. --------------- -Version 0.72b: --------------- +### Version 0.72b: - Bumped map size up to 32k. You may want to recompile instrumented binaries (but nothing horrible will happen if you don't). @@ -2256,25 +1887,19 @@ Version 0.72b: rhetorical question in the comments in afl-as.h has been answered. Tracked down by Mudge Zatko. --------------- -Version 0.71b: --------------- +### Version 0.71b: - Added a fix for the nonsensical MacOS ELF check. Spotted by Mudge Zatko. - Made some improvements to ASAN checks. --------------- -Version 0.70b: --------------- +### Version 0.70b: - Added explicit detection of ASANified binaries. - Fixed compilation issues on Solaris. Reported by Martin Carpenter. --------------- -Version 0.69b: --------------- +### Version 0.69b: - Improved the detection of non-instrumented binaries. @@ -2286,15 +1911,11 @@ Version 0.69b: - Fixed for a cosmetic SIGFPE when Ctrl-C is pressed while the fork server is spinning up. --------------- -Version 0.68b: --------------- +### Version 0.68b: - Added crash exploration mode! Woot! --------------- -Version 0.67b: --------------- +### Version 0.67b: - Fixed several more typos, the project is now cartified 100% typo-free. Thanks to Thomas Jarosch and Jakub Wilk. @@ -2306,9 +1927,7 @@ Version 0.67b: - Made it possible to override -O3 in Makefile. Suggested by Jakub Wilk. --------------- -Version 0.66b: --------------- +### Version 0.66b: - Fixed a very obscure issue with build systems that use gcc as an assembler for hand-written .s files; this would confuse afl-as. Affected nss, reported @@ -2317,24 +1936,18 @@ Version 0.66b: - Fixed a bug when cleaning up synchronized fuzzer output dirs. Issue reported by Thomas Jarosch. --------------- -Version 0.65b: --------------- +### Version 0.65b: - Cleaned up shell printf escape codes in Makefile. Reported by Jakub Wilk. - Added more color to fuzzer_stats, provided short documentation of the file format, and made several other stats-related improvements. --------------- -Version 0.64b: --------------- +### Version 0.64b: - Enabled GCC support on MacOS X. --------------- -Version 0.63b: --------------- +### Version 0.63b: - Provided a new, simplified way to pass data in files (@@). See README. @@ -2347,9 +1960,7 @@ Version 0.63b: - Added a build-time warning for inverse video terminals and better instructions in status_screen.txt. --------------- -Version 0.62b: --------------- +### Version 0.62b: - Made minor improvements to the allocator, as suggested by Tobias Ospelt. @@ -2359,9 +1970,7 @@ Version 0.62b: - Fixed typos in parallel_fuzzing.txt. Problems spotted by Thomas Jarosch. --------------- -Version 0.61b: --------------- +### Version 0.61b: - Fixed a minor issue with clang detection on systems with a clang cc wrapper, so that afl-gcc doesn't confuse it with GCC. @@ -2370,9 +1979,7 @@ Version 0.61b: - Fixed a glitch with crash removal (README.txt left behind, d'oh). --------------- -Version 0.60b: --------------- +### Version 0.60b: - Fixed problems with jump tables generated by exotic versions of GCC. This solves an outstanding problem on OpenBSD when using afl-gcc + PIE (not @@ -2385,9 +1992,7 @@ Version 0.60b: - Added docs/INSTALL. --------------- -Version 0.59b: --------------- +### Version 0.59b: - Modified 'make install' to also install test cases. @@ -2395,9 +2000,7 @@ Version 0.59b: - More work on RLIMIT_AS for OpenBSD. --------------- -Version 0.58b: --------------- +### Version 0.58b: - Added a core count check on Linux. @@ -2405,9 +2008,7 @@ Version 0.58b: - Added a rudimentary CPU utilization meter to help with optimal loading. --------------- -Version 0.57b: --------------- +### Version 0.57b: - Made fixes to support FreeBSD and OpenBSD: use_64bit is now inferred if not explicitly specified when calling afl-as, and RLIMIT_AS is behind an #ifdef. @@ -2419,18 +2020,14 @@ Version 0.57b: - Made a couple of Makefile improvements as proposed by Jakub Wilk. --------------- -Version 0.56b: --------------- +### Version 0.56b: - Added probabilistic instrumentation density reduction in ASAN mode. This compensates for ASAN-specific branches in a crude but workable way. - Updated notes_for_asan.txt. --------------- -Version 0.55b: --------------- +### Version 0.55b: - Implemented smarter out_dir behavior, automatically deleting directories that don't contain anything of special value. Requested by several folks, @@ -2444,16 +2041,12 @@ Version 0.55b: - Made it possible to resume by doing -i <out_dir>, without having to specify -i <out_dir>/queue/. --------------- -Version 0.54b: --------------- +### Version 0.54b: - Added a fix for -Wformat warning messages (oops, I thought this had been in place for a while). --------------- -Version 0.53b: --------------- +### Version 0.53b: - Redesigned the crash & hang duplicate detection code to better deal with fault conditions that can be reached in a multitude of ways. @@ -2474,9 +2067,7 @@ Version 0.53b: - Added a fix for harmless but absurd trim ratios shown if the first exec in the trimmer timed out. Spotted by @EspenGx. --------------- -Version 0.52b: --------------- +### Version 0.52b: - Added a quick summary of the contents in examples/. @@ -2489,9 +2080,7 @@ Version 0.52b: (To fix this, simply move <out_dir>/.state/* from an older run to <out_dir>/.state/deterministic_done/*.) --------------- -Version 0.51b: --------------- +### Version 0.51b: - Changed the search order for afl-as to avoid the problem with older copies installed system-wide; this also means that I can remove the Makefile check @@ -2503,9 +2092,7 @@ Version 0.51b: - Fixed the test_prev target in Makefile, as reported by Ozzy Johnson. --------------- -Version 0.50b: --------------- +### Version 0.50b: - Improved the 'make install' logic, as suggested by Padraig Brady. @@ -2525,9 +2112,7 @@ Version 0.50b: - Made a regression fix to afl-as to ignore .LBB labels in gcc mode. --------------- -Version 0.49b: --------------- +### Version 0.49b: - Fixed more typos, as found by Jakub Wilk. @@ -2542,9 +2127,7 @@ Version 0.49b: - Improved installation process to properly create symlinks, rather than copies of binaries. --------------- -Version 0.48b: --------------- +### Version 0.48b: - Improved afl-fuzz to force-set ASAN_OPTIONS=abort_on_error=1. Otherwise, ASAN crashes wouldn't be caught at all. Reported by Hanno Boeck. @@ -2557,9 +2140,7 @@ Version 0.48b: .o file has 5+ parameters. No impact on code running under afl-fuzz or afl-showmap. Issue spotted by Padraig Brady. --------------- -Version 0.47b: --------------- +### Version 0.47b: - Fixed another Makefile bug for parallel builds of afl. Problem identified by Richard W. M. Jones. @@ -2571,9 +2152,7 @@ Version 0.47b: - Moved the project to http://lcamtuf.coredump.cx/afl/. --------------- -Version 0.46b: --------------- +### Version 0.46b: - Cleaned up Makefile dependencies for parallel builds. Requested by Richard W. M. Jones. @@ -2588,9 +2167,7 @@ Version 0.46b: switch between .code32 and .code64. Addresses a glitch spotted by Hanno Boeck with compiling ToT gdb. --------------- -Version 0.45b: --------------- +### Version 0.45b: - Implemented a test case trimmer. Results in 20-30% size reduction for many types of work loads, with very pronounced improvements in path discovery @@ -2611,9 +2188,7 @@ Version 0.45b: - Switched to saner behavior with non-tty stdout (less output generated, no ANSI art). --------------- -Version 0.44b: --------------- +### Version 0.44b: - Added support for AFL_CC and AFL_CXX, based on a patch from Ben Laurie. @@ -2629,9 +2204,7 @@ Version 0.44b: - Made more consistent use of color reset codes, as suggested by Oliver Kunz. --------------- -Version 0.43b: --------------- +### Version 0.43b: - Fixed a bug with 64-bit gcc -shared relocs. @@ -2644,9 +2217,7 @@ Version 0.43b: - Made a minor change to the Makefile GCC check. Suggested by Hanno Boeck. --------------- -Version 0.42b: --------------- +### Version 0.42b: - Fixed a bug with red zone handling for 64-bit (oops!). Problem reported by Felix Groebert. @@ -2661,9 +2232,7 @@ Version 0.42b: - Improved check for 64-bit compilation, plus several sanity checks in Makefile. --------------- -Version 0.41b: --------------- +### Version 0.41b: - Fixed a fork served bug for processes that call execve(). @@ -2683,18 +2252,14 @@ Version 0.41b: - Added much better error messages for crashes when importing test cases or otherwise calibrating the binary. --------------- -Version 0.40b: --------------- +### Version 0.40b: - Added support for parallelized fuzzing. Inspired by earlier patch from Sebastian Roschke. - Added an example in examples/distributed_fuzzing/. --------------- -Version 0.39b: --------------- +### Version 0.39b: - Redesigned status screen, now 90% more spiffy. @@ -2713,9 +2278,7 @@ Version 0.39b: - Added performance_tips.txt. --------------- -Version 0.38b: --------------- +### Version 0.38b: - Fixed an fd leak and +cov tracking bug resulting from changes in 0.37b. @@ -2723,9 +2286,7 @@ Version 0.38b: - Added a visual indication when running in non-instrumented mode. --------------- -Version 0.37b: --------------- +### Version 0.37b: - Added fuzz state tracking for more seamless resumption of aborted fuzzing sessions. @@ -2742,9 +2303,7 @@ Version 0.37b: - Improved instrumentation to explicitly cover the other leg of every branch. --------------- -Version 0.36b: --------------- +### Version 0.36b: - Implemented fork server support to avoid the overhead of execve(). A nearly-verbatim design from Jann Horn; still pending part 2 that would @@ -2757,22 +2316,16 @@ Version 0.36b: - Fixed the way IGNORE_FINDS works (was a bit broken after adding splicing and path skip heuristics). --------------- -Version 0.35b: --------------- +### Version 0.35b: - Properly integrated 64-bit instrumentation into afl-as. --------------- -Version 0.34b: --------------- +### Version 0.34b: - Added a new exec count classifier (the working theory is that it gets meaningful coverage with fewer test cases spewed out). --------------- -Version 0.33b: --------------- +### Version 0.33b: - Switched to new, somewhat experimental instrumentation that tries to target only arcs, rather than every line. May be fragile, but is a lot @@ -2781,34 +2334,24 @@ Version 0.33b: - Made several other cosmetic fixes and typo corrections, thanks to Jakub Wilk. --------------- -Version 0.32b: --------------- +### Version 0.32b: - Another take at fixing the C++ exception thing. Reported by Jakub Wilk. --------------- -Version 0.31b: --------------- +### Version 0.31b: - Made another fix to afl-as to address a potential problem with newer versions of GCC (introduced in 0.28b). Thanks to Jann Horn. --------------- -Version 0.30b: --------------- +### Version 0.30b: - Added more detail about the underlying operations in file names. --------------- -Version 0.29b: --------------- +### Version 0.29b: - Made some general improvements to chunk operations. --------------- -Version 0.28b: --------------- +### Version 0.28b: - Fixed C++ exception handling in newer versions of GCC. Problem diagnosed by Eberhard Mattes. @@ -2816,9 +2359,7 @@ Version 0.28b: - Fixed the handling of the overflow flag. Once again, thanks to Eberhard Mattes. --------------- -Version 0.27b: --------------- +### Version 0.27b: - Added prioritization of new paths over the already-fuzzed ones. @@ -2831,9 +2372,7 @@ Version 0.27b: - Switched to better output file names, keeping track of stage and splicing sources. --------------- -Version 0.26b: --------------- +### Version 0.26b: - Revamped storage of testcases, -u option removed, @@ -2846,9 +2385,7 @@ Version 0.26b: - Fixed a bug in timeout detection. --------------- -Version 0.25b: --------------- +### Version 0.25b: - Improved count-based instrumentation. @@ -2863,16 +2400,12 @@ Version 0.25b: - Made various minor UI improvements and several other bugfixes. --------------- -Version 0.24b: --------------- +### Version 0.24b: - Added program name to the status screen, plus the -T parameter to go with it. --------------- -Version 0.23b: --------------- +### Version 0.23b: - Improved the detection of variable behaviors. @@ -2882,16 +2415,12 @@ Version 0.23b: - Switched to simplified (XOR-based) tuple instrumentation. --------------- -Version 0.22b: --------------- +### Version 0.22b: - Refactored the handling of long bitflips and some swaps. - Fixed the handling of gcc -pipe, thanks to anonymous reporter. ---------------------------- -Version 0.21b (2013-11-12): ---------------------------- +### Version 0.21b (2013-11-12): - Initial public release. diff --git a/docs/binaryonly_fuzzing.md b/docs/binaryonly_fuzzing.md index ff98ed00..e49c9b3e 100644 --- a/docs/binaryonly_fuzzing.md +++ b/docs/binaryonly_fuzzing.md @@ -8,10 +8,11 @@ The following is a description of how these binaries can be fuzzed with afl++ - !!!!! - TL;DR: try DYNINST with afl-dyninst. If it produces too many crashes then - use afl -Q qemu_mode, or better: use both in parallel. - !!!!! +## TL;DR: + + qemu_mode in persistent mode is the fastest - if the stability is + high enough. Otherwise try retrowrite, afl-dyninst and if these + fail too then standard qemu_mode with AFL_ENTRYPOINT to where you need it. ## QEMU @@ -19,11 +20,19 @@ Qemu is the "native" solution to the program. It is available in the ./qemu_mode/ directory and once compiled it can be accessed by the afl-fuzz -Q command line option. - The speed decrease is at about 50%. It is the easiest to use alternative and even works for cross-platform binaries. + The speed decrease is at about 50%. + However various options exist to increase the speed: + - using AFL_ENTRYPOINT to move the forkserver to a later basic block in + the binary (+5-10% speed) + - using persistent mode [qemu_mode/README.persistent.md](../qemu_mode/README.persistent.md) + this will result in 150-300% overall speed - so 3-8x the original + qemu_mode speed! + - using AFL_CODE_START/AFL_CODE_END to only instrument specific parts + Note that there is also honggfuzz: [https://github.com/google/honggfuzz](https://github.com/google/honggfuzz) - which now has a qemu_mode, but its performance is just 1.5%! + which now has a qemu_mode, but its performance is just 1.5% ... As it is included in afl++ this needs no URL. @@ -74,6 +83,27 @@ [https://github.com/vanhauser-thc/afl-dyninst](https://github.com/vanhauser-thc/afl-dyninst) +## RETROWRITE + + If you have an x86/x86_64 binary that still has it's symbols, is compiled + with position independant code (PIC/PIE) and does not use most of the C++ + features then the retrowrite solution might be for you. + It decompiles to ASM files which can then be instrumented with afl-gcc. + + It is at about 80-85% performance. + + [https://github.com/HexHive/retrowrite](https://github.com/HexHive/retrowrite) + + +## MCSEMA + + Theoretically you can also decompile to llvm IR with mcsema, and then + use llvm_mode to instrument the binary. + Good luck with that. + + [https://github.com/lifting-bits/mcsema](https://github.com/lifting-bits/mcsema) + + ## INTEL-PT If you have a newer Intel CPU, you can make use of Intels processor trace. @@ -117,6 +147,9 @@ There is a WIP fuzzer available at [https://github.com/andreafioraldi/frida-fuzzer](https://github.com/andreafioraldi/frida-fuzzer) + There is also an early implementation in an AFL++ test branch: + [https://github.com/vanhauser-thc/AFLplusplus/tree/frida](https://github.com/vanhauser-thc/AFLplusplus/tree/frida) + ## PIN & DYNAMORIO diff --git a/docs/ideas.md b/docs/ideas.md index 8ba59c17..10d97ca0 100644 --- a/docs/ideas.md +++ b/docs/ideas.md @@ -4,18 +4,18 @@ In the following, we describe a variety of ideas that could be implemented for f ## Flexible Grammar Mutator -Currently, AFL++'s mutation do not have deper knowledge about the fuzzed binary, apart from feedback, even though the developer may have insights about the target. A developer may chose to provide dictionaries and implement own mutations in python or c, but an easy mutator that behaves according to a given grammar, does not exist. +Currently, AFL++'s mutation does not have deeper knowledge about the fuzzed binary, apart from feedback, even though the developer may have insights about the target. A developer may choose to provide dictionaries and implement own mutations in python or c, but an easy mutator that behaves according to a given grammar, does not exist. ## LTO Based Non-Colliding Edge Coverage -An unsolved problem in fuzzing, right now, are hash collisions between paths. By iterating through all functions at link time, assigning unique values to each branch, therefore reducing or even eliminating collisions, should be possible. +An unsolved problem in our fuzzing, right now, are hash collisions between paths. By iterating through all functions at link time, assigning unique values to each branch, therefore reducing or even eliminating collisions, should be possible. ## QEMU 4-based Instrumentation First tests to use QEMU 4 for binary-only AFL++ showed that caching behavior changed, which vastly decreases fuzzing speeds. -This is the case why, right now, we cannot switch to QEMU 4.2. Understanding the current instumentation and fixing the current caching issues will be needed. +This is the cause why, right now, we cannot switch to QEMU 4.2. Understanding the current instrumentation and fixing the current caching issues will be needed. ## WASM Instrumentation Currently, AFL++ can be used for source code fuzzing and traditional binaries. -With the rise of WASM as compile target, however, a novel way of instrumentation needs to be implemented for binaries compiled to Webassembly. This can either be done by inserting instrumentation directly into the WASM AST, or by patching feeback into a WASM VMs of choice, similar to the current Unicorn instrumentation. +With the rise of WASM as compile target, however, a novel way of instrumentation needs to be implemented for binaries compiled to Webassembly. This can either be done by inserting instrumentation directly into the WASM AST, or by patching feedback into a WASM VMs of choice, similar to the current Unicorn instrumentation. diff --git a/docs/status_screen.md b/docs/status_screen.md index 1ea98415..066c2c07 100644 --- a/docs/status_screen.md +++ b/docs/status_screen.md @@ -377,7 +377,7 @@ directory. This includes: - `fuzzer_pid` - PID of the fuzzer process - `cycles_done` - queue cycles completed so far - `execs_done` - number of execve() calls attempted - - `execs_per_sec` - current number of execs per second + - `execs_per_sec` - overall number of execs per second - `paths_total` - total number of entries in the queue - `paths_found` - number of entries discovered through local fuzzing - `paths_imported` - number of entries imported from other instances diff --git a/examples/qemu_persistent_hook/README.md b/examples/qemu_persistent_hook/README.md new file mode 100644 index 00000000..3278b60c --- /dev/null +++ b/examples/qemu_persistent_hook/README.md @@ -0,0 +1,20 @@ +# QEMU persistent hook example + +Compile the test binary and the library: + +``` +gcc -no-pie test.c -o test +gcc -fPIC -shared read_into_rdi.c -o read_into_rdi.so +``` + +Fuzz with: + +``` +export AFL_QEMU_PERSISTENT_ADDR=0x$(nm test | grep "T target_func" | awk '{print $1}') +export AFL_QEMU_PERSISTENT_HOOK=./read_into_rdi.so + +mkdir in +echo 0000 > in/in + +../../afl-fuzz -Q -i in -o out -- ./test +``` diff --git a/examples/qemu_persistent_hook/read_into_rdi.c b/examples/qemu_persistent_hook/read_into_rdi.c new file mode 100644 index 00000000..3994e790 --- /dev/null +++ b/examples/qemu_persistent_hook/read_into_rdi.c @@ -0,0 +1,49 @@ +#include <stdint.h> +#include <stdio.h> +#include <unistd.h> + +#define g2h(x) ((void*)((unsigned long)(x) + guest_base)) +#define h2g(x) ((uint64_t)(x)-guest_base) + +enum { + + R_EAX = 0, + R_ECX = 1, + R_EDX = 2, + R_EBX = 3, + R_ESP = 4, + R_EBP = 5, + R_ESI = 6, + R_EDI = 7, + R_R8 = 8, + R_R9 = 9, + R_R10 = 10, + R_R11 = 11, + R_R12 = 12, + R_R13 = 13, + R_R14 = 14, + R_R15 = 15, + + R_AL = 0, + R_CL = 1, + R_DL = 2, + R_BL = 3, + R_AH = 4, + R_CH = 5, + R_DH = 6, + R_BH = 7, + +}; + +void afl_persistent_hook(uint64_t* regs, uint64_t guest_base) { + + // In this example the register RDI is pointing to the memory location + // of the target buffer, and the length of the input is in RAX. + + printf("reading into %p\n", regs[R_EDI]); + size_t r = read(0, g2h(regs[R_EDI]), 1024); + regs[R_EAX] = r; + printf("readed %ld bytes\n", r); + +} + diff --git a/examples/qemu_persistent_hook/test.c b/examples/qemu_persistent_hook/test.c new file mode 100644 index 00000000..83001545 --- /dev/null +++ b/examples/qemu_persistent_hook/test.c @@ -0,0 +1,34 @@ +#include <stdio.h> + +int target_func(char *buf, int size) { + + printf("buffer:%p, size:%p\n", buf, size); + switch (buf[0]) { + + case 1: + if (buf[1] == '\x44') { puts("a"); } + break; + case 0xff: + if (buf[2] == '\xff') { + + if (buf[1] == '\x44') { puts("b"); } + + } + + break; + default: break; + + } + + return 1; + +} + +char data[1024]; + +int main() { + + target_func(data, 1024); + +} + diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index 751bd93c..c62fcc84 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -455,7 +455,7 @@ u8* (*post_handler)(u8* buf, u32* len); /* CmpLog */ extern u8* cmplog_binary; -extern s32 cmplog_forksrv_pid; +extern s32 cmplog_child_pid, cmplog_forksrv_pid; /* hooks for the custom mutator function */ /** diff --git a/include/config.h b/include/config.h index 8b8924f5..d47908f6 100644 --- a/include/config.h +++ b/include/config.h @@ -26,7 +26,8 @@ /* Version string: */ -#define VERSION "++2.60d" // c = release, d = volatile github dev + // c = release, d = volatile github dev, e = experimental branch +#define VERSION "++2.60d" /****************************************************** * * diff --git a/libdislocator/libdislocator.so.c b/libdislocator/libdislocator.so.c index 21cd6f43..a0795c87 100644 --- a/libdislocator/libdislocator.so.c +++ b/libdislocator/libdislocator.so.c @@ -33,6 +33,10 @@ #include <mach/vm_statistics.h> #endif +#ifdef __FreeBSD__ +#include <sys/param.h> +#endif + #ifdef __linux__ #include <unistd.h> #include <sys/syscall.h> @@ -64,9 +68,16 @@ #include "config.h" #include "types.h" -#if __STDC_VERSION__ < 201112L +#if __STDC_VERSION__ < 201112L || \ + (defined(__FreeBSD__) && __FreeBSD_version < 1200000) // use this hack if not C11 -typedef struct { long long __ll; long double __ld; } max_align_t; +typedef struct { + + long long __ll; + long double __ld; + +} max_align_t; + #endif #define ALLOC_ALIGN_SIZE (_Alignof(max_align_t)) diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c index 3dd4acd3..348b5333 100644 --- a/llvm_mode/afl-clang-fast.c +++ b/llvm_mode/afl-clang-fast.c @@ -299,13 +299,13 @@ static void edit_params(u32 argc, char** argv) { cc_params[cc_par_cnt++] = "-fsanitize=memory"; } - + if (getenv("AFL_USE_UBSAN")) { - + cc_params[cc_par_cnt++] = "-fsanitize=undefined"; cc_params[cc_par_cnt++] = "-fsanitize-undefined-trap-on-error"; cc_params[cc_par_cnt++] = "-fno-sanitize-recover=all"; - + } } diff --git a/qemu_mode/README.md b/qemu_mode/README.md index ccfd50e3..4198af14 100644 --- a/qemu_mode/README.md +++ b/qemu_mode/README.md @@ -71,31 +71,12 @@ must be an address of a basic block. ## 4) Bonus feature #2: persistent mode -QEMU mode supports also persistent mode for x86 and x86_64 targets. -The environment variable to enable it is AFL_QEMU_PERSISTENT_ADDR=`start addr`. -In this variable you must specify the address of the function that -has to be the body of the persistent loop. -The code in this function must be stateless like in the LLVM persistent mode. -The return address on stack is patched like in WinAFL in order to repeat the -execution of such function. -Another modality to execute the persistent loop is to specify also the -AFL_QEMU_PERSISTENT_RET=`end addr` env variable. -With this variable assigned, instead of patching the return address, the -specified instruction is transformed to a jump towards `start addr`. -Note that the format of the addresses in such variables is hex. - -Note that the base address of PIE binaries in QEMU user mode is 0x4000000000. - -With the env variable AFL_QEMU_PERSISTENT_GPR you can tell QEMU to save the -original value of general purpose registers and restore them in each cycle. -This allows to use as persistent loop functions that make use of arguments on -x86_64. - -With AFL_QEMU_PERSISTENT_RETADDR_OFFSET you can specify the offset from the -stack pointer in which QEMU can find the return address when `start addr` is -hitted. - -Use this mode with caution, probably it will not work at the first shot. +AFL++'s QEMU mode now supports also persistent mode for x86, x86_64, arm +and aarch64 targets. +This increases the speed by several factors, however it is a bit of work to set +up - but worth the effort. + +Please see the extra documentation for it: [README.persistent.md](README.persistent.md) ## 5) Bonus feature #3: CompareCoverage @@ -105,6 +86,7 @@ The option that enables QEMU CompareCoverage is AFL_COMPCOV_LEVEL. There is also ./libcompcov/ which implements CompareCoverage for *cmp functions (splitting memcmp, strncmp, etc. to make these conditions easier solvable by afl-fuzz). + AFL_COMPCOV_LEVEL=1 is to instrument comparisons with only immediate values / read-only memory. AFL_COMPCOV_LEVEL=2 instruments all comparison instructions and memory comparison functions when libcompcov @@ -113,11 +95,23 @@ AFL_COMPCOV_LEVEL=3 has the same effects of AFL_COMPCOV_LEVEL=2 but enables also the instrumentation of the floating-point comparisons on x86 and x86_64 (experimental). Integer comparison instructions are currently instrumented only -on the x86, x86_64 and ARM targets. +on the x86, x86_64, arm and aarch64 targets. Highly recommended. -## 6) Bonus feature #4: Wine mode +## 6) CMPLOG mode + +Another new feature is CMPLOG, which is based on the redqueen project. +Here all immidiates in CMP instructions are learned and put into a dynamic +dictionary and applied to all locations in the input that reached that +CMP, trying to solve and pass it. +This is a very effective feature and it is available for x86, x86_64, arm +and aarch64. + +To enable it you must pass on the command line of afl-fuzz: + -c /path/to/your/target + +## 7) Bonus feature #4: Wine mode AFL++ QEMU can use Wine to fuzz WIn32 PE binaries. Use the -W flag of afl-fuzz. @@ -125,7 +119,7 @@ Note that some binaries require user interaction with the GUI and must be patche For examples look [here](https://github.com/andreafioraldi/WineAFLplusplusDEMO). -## 7) Notes on linking +## 8) Notes on linking The feature is supported only on Linux. Supporting BSD may amount to porting the changes made to linux-user/elfload.c and applying them to @@ -146,7 +140,7 @@ practice, this means two things: Setting AFL_INST_LIBS=1 can be used to circumvent the .text detection logic and instrument every basic block encountered. -## 8) Benchmarking +## 9) Benchmarking If you want to compare the performance of the QEMU instrumentation with that of afl-gcc compiled code against the same target, you need to build the @@ -161,7 +155,7 @@ Comparative measurements of execution speed or instrumentation coverage will be fairly meaningless if the optimization levels or instrumentation scopes don't match. -## 9) Gotchas, feedback, bugs +## 10) Gotchas, feedback, bugs If you need to fix up checksums or do other cleanup on mutated test cases, see examples/post_library/ for a viable solution. @@ -182,7 +176,7 @@ with -march=core2, can help. Beyond that, this is an early-stage mechanism, so fields reports are welcome. You can send them to <afl-users@googlegroups.com>. -## 10) Alternatives: static rewriting +## 11) Alternatives: static rewriting Statically rewriting binaries just once, instead of attempting to translate them at run time, can be a faster alternative. That said, static rewriting is @@ -196,4 +190,5 @@ The best implementation is this one: The issue however is Dyninst which is not rewriting the binaries so that they run stable. A lot of crashes happen, especially in C++ programs that use throw/catch. Try it first, and if it works for you be happy as it is -2-3x as fast as qemu_mode. +2-3x as fast as qemu_mode, however usually not as fast as QEMU persistent mode. + diff --git a/qemu_mode/README.persistent.md b/qemu_mode/README.persistent.md new file mode 100644 index 00000000..c96a451b --- /dev/null +++ b/qemu_mode/README.persistent.md @@ -0,0 +1,131 @@ +# How to use the persistent mode in AFL++'s QEMU mode + +## 1) Introduction + +Persistent mode let you fuzz your target persistently between two +addresses - without forking for every fuzzing attempt. +This increases the speed by a factor between x2 and x5, hence it is +very, very valuable. + +The persistent mode is currently only available for x86/x86_64, arm +and aarch64 targets. + +## 2) How use the persistent mode + +### 2.1) The START address + +The start of the persistent loop has to be set with AFL_QEMU_PERSISTENT_ADDR. + +This address can be the address of whatever instruction. +Setting this address to the start of a function makes the usage simple. +If the address is however within a function, either RET or OFFSET (see below +in 2.2 and 2.3) have to be set. +This address (as well as the RET address, see below) has to be defined in +hexadecimal with the 0x prefix or as a decimal value. + +If the target is compiled with position independant code (PIE/PIC), you must +add 0x4000000000 to that address, because qemu loads to this base address. +On strange setups the base address set by QEMU for PIE executable may change, +you can check it printing the process map using AFL_QEMU_DEBUG_MAPS=1. + +If this address is not valid, afl-fuzz will error during startup with the +message that the forkserver was not found. + +### 2.2) the RET address + +The RET address is the last instruction of the persistent loop. +The emulator will emit a jump to START when translating the instruction at RET. +It is optional, and only needed if the the return should not be +at the end of the function to which the START address points into, but earlier. + +If it is not set, QEMU will assume that START points to a function and will +patch the return address (on stack or in the link register) to return to START +(like WinAFL). + +It is defined by setting AFL_QEMU_PERSISTENT_RET, and too 0x4000000000 has to +be set if the target is position independant. + +### 2.3) the OFFSET + +This option is valid only for x86/x86_64 only, arm/aarch64 do not save the +return address on stack. + +If the START address is *not* the beginning of a function, and *no* RET has +been set (so the end of the loop will be at the end of the function but START +will not be at the beginning of it), we need an offset from the ESP pointer +to locate the return address to patch. + +The value by which the ESP pointer has to be corrected has to set in the +variable AFL_QEMU_PERSISTENT_RETADDR_OFFSET + +Now to get this value right here some help: +1. use gdb on the target +2. set a breakpoint to "main" (this is required for PIE/PIC binaries so the + addresses are set up) +3. "run" the target with a valid commandline +4. set a breakpoint to the function in which START is contained +5. set a breakpoint to your START address +6. "continue" to the function start breakpoint +6. print the ESP value with `print $esp` and take note of it +7. "continue" the target until the second breakpoint +8. again print the ESP value +9. calculate the difference between the two values - and this is the offset + +### 2.4) resetting the register state + +It is very, very likely you need to restore the general purpose registers state +when starting a new loop. Because of this you 99% of the time should set + +AFL_QEMU_PERSISTENT_GPR=1 + +An example, is when you want to use main() as persistent START: + +```c +int main(int argc, char **argv) { + + if (argc < 2) return 1; + + // do stuffs + +} +``` + +If you don't save and restore the registers in x86_64, the paramteter argc +will be lost at the second execution of the loop. + +## 3) Optional parameters + +### 3.1) Loop counter value + +The more stable your loop in the target, the longer you can run it, the more +unstable it is the lower the loop count should be. A low value would be 100, +the maximum value should be 10000. The default is 1000. +This value can be set with AFL_QEMU_PERSISTENT_CNT + +This is the same concept as in the llvm_mode persistent mode with __AFL_LOOP(). + +### 3.2) A hook for in-memory fuzzing + +You can increase the speed of the persistent mode even more by bypassing all +the reading of the fuzzing input via a file by reading directly into the +memory address space of the target process. + +All this needs is that the START address has a register that can reach the +memory buffer or that the memory buffer is at a know location. You probably need +the value of the size of the buffer (maybe it is in a register when START is +hitted). + +The persistent hook will execute a function on every persistent iteration +(at the start START) defined in a shared object specified with +AFL_QEMU_PERSISTENT_HOOK=/path/to/hook.so. + +The signature is: + +```c +void afl_persistent_hook(uint64_t* regs, uint64_t guest_base); +``` + +In this hook, you can inspect and change the saved GPR state at START. + +An example that you can use with little modification for your target can +be found here: [examples/qemu_persistent_hook](../examples/qemu_persistent_hook) diff --git a/qemu_mode/build_qemu_support.sh b/qemu_mode/build_qemu_support.sh index 6f2bc448..79993ce2 100755 --- a/qemu_mode/build_qemu_support.sh +++ b/qemu_mode/build_qemu_support.sh @@ -153,19 +153,22 @@ patch -p1 <../patches/translate-all.diff || exit 1 patch -p1 <../patches/tcg.diff || exit 1 patch -p1 <../patches/i386-translate.diff || exit 1 patch -p1 <../patches/arm-translate.diff || exit 1 +patch -p1 <../patches/arm-translate-a64.diff || exit 1 patch -p1 <../patches/i386-ops_sse.diff || exit 1 patch -p1 <../patches/i386-fpu_helper.diff || exit 1 patch -p1 <../patches/softfloat.diff || exit 1 +patch -p1 <../patches/configure.diff || exit 1 echo "[+] Patching done." if [ "$STATIC" = "1" ]; then - CFLAGS="-O3 -ggdb" ./configure --disable-bsd-user --disable-guest-agent --disable-strip --disable-werror \ + ./configure --extra-cflags="-O3 -ggdb -DAFL_QEMU_STATIC_BUILD=1" \ + --disable-bsd-user --disable-guest-agent --disable-strip --disable-werror \ --disable-gcrypt --disable-debug-info --disable-debug-tcg --disable-tcg-interpreter \ --enable-attr --disable-brlapi --disable-linux-aio --disable-bzip2 --disable-bluez --disable-cap-ng \ --disable-curl --disable-fdt --disable-glusterfs --disable-gnutls --disable-nettle --disable-gtk \ - --disable-rdma --disable-libiscsi --disable-vnc-jpeg --enable-kvm --disable-lzo --disable-curses \ + --disable-rdma --disable-libiscsi --disable-vnc-jpeg --disable-lzo --disable-curses \ --disable-libnfs --disable-numa --disable-opengl --disable-vnc-png --disable-rbd --disable-vnc-sasl \ --disable-sdl --disable-seccomp --disable-smartcard --disable-snappy --disable-spice --disable-libssh2 \ --disable-libusb --disable-usb-redir --disable-vde --disable-vhost-net --disable-virglrenderer \ @@ -178,9 +181,9 @@ else # --enable-pie seems to give a couple of exec's a second performance # improvement, much to my surprise. Not sure how universal this is.. - CFLAGS="-O3 -ggdb" ./configure --disable-system \ + ./configure --disable-system \ --enable-linux-user --disable-gtk --disable-sdl --disable-vnc \ - --target-list="${CPU_TARGET}-linux-user" --enable-pie --enable-kvm $CROSS_PREFIX || exit 1 + --target-list="${CPU_TARGET}-linux-user" --enable-pie $CROSS_PREFIX || exit 1 fi diff --git a/qemu_mode/patches/afl-qemu-common.h b/qemu_mode/patches/afl-qemu-common.h index 4d651385..4303a5e6 100644 --- a/qemu_mode/patches/afl-qemu-common.h +++ b/qemu_mode/patches/afl-qemu-common.h @@ -35,11 +35,18 @@ #define __AFL_QEMU_COMMON #include "../../config.h" +#include "../../include/cmplog.h" -#ifndef CPU_NB_REGS -#define AFL_REGS_NUM 1000 -#else +#define PERSISTENT_DEFAULT_MAX_CNT 1000 + +#ifdef CPU_NB_REGS #define AFL_REGS_NUM CPU_NB_REGS +#elif TARGET_ARM +#define AFL_REGS_NUM 32 +#elif TARGET_AARCH64 +#define AFL_REGS_NUM 32 +#else +#define AFL_REGS_NUM 100 #endif /* NeverZero */ @@ -56,6 +63,8 @@ #define INC_AFL_AREA(loc) afl_area_ptr[loc]++ #endif +typedef void (*afl_persistent_hook_fn)(uint64_t *regs, uint64_t guest_base); + /* Declared in afl-qemu-cpu-inl.h */ extern unsigned char *afl_area_ptr; @@ -69,11 +78,16 @@ extern unsigned char is_persistent; extern target_long persistent_stack_offset; extern unsigned char persistent_first_pass; extern unsigned char persistent_save_gpr; -extern target_ulong persistent_saved_gpr[AFL_REGS_NUM]; +extern uint64_t persistent_saved_gpr[AFL_REGS_NUM]; extern int persisent_retaddr_offset; +extern afl_persistent_hook_fn afl_persistent_hook_ptr; + extern __thread abi_ulong afl_prev_loc; +extern struct cmp_map *__afl_cmp_map; +extern __thread u32 __afl_cmp_counter; + void afl_debug_dump_saved_regs(); void afl_persistent_loop(); diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h index ac847371..5e155c74 100644 --- a/qemu_mode/patches/afl-qemu-cpu-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-inl.h @@ -32,10 +32,11 @@ */ #include <sys/shm.h> -#include "../../config.h" #include "afl-qemu-common.h" -#define PERSISTENT_DEFAULT_MAX_CNT 1000 +#ifndef AFL_QEMU_STATIC_BUILD +#include <dlfcn.h> +#endif /*************************** * VARIOUS AUXILIARY STUFF * @@ -81,6 +82,9 @@ u8 afl_compcov_level; __thread abi_ulong afl_prev_loc; +struct cmp_map *__afl_cmp_map; +__thread u32 __afl_cmp_counter; + /* Set in the child process in forkserver mode: */ static int forkserver_installed = 0; @@ -95,6 +99,8 @@ unsigned char persistent_save_gpr; target_ulong persistent_saved_gpr[AFL_REGS_NUM]; int persisent_retaddr_offset; +afl_persistent_hook_fn afl_persistent_hook_ptr; + /* Instrumentation ratio: */ unsigned int afl_inst_rms = MAP_SIZE; /* Exported for afl_gen_trace */ @@ -182,6 +188,22 @@ static void afl_setup(void) { } + if (getenv("___AFL_EINS_ZWEI_POLIZEI___")) { // CmpLog forkserver + + id_str = getenv(CMPLOG_SHM_ENV_VAR); + + if (id_str) { + + u32 shm_id = atoi(id_str); + + __afl_cmp_map = shmat(shm_id, NULL, 0); + + if (__afl_cmp_map == (void *)-1) exit(1); + + } + + } + if (getenv("AFL_INST_LIBS")) { afl_start_code = 0; @@ -224,6 +246,43 @@ static void afl_setup(void) { if (getenv("AFL_QEMU_PERSISTENT_GPR")) persistent_save_gpr = 1; + if (getenv("AFL_QEMU_PERSISTENT_HOOK")) { + +#ifdef AFL_QEMU_STATIC_BUILD + + fprintf(stderr, + "[AFL] ERROR: you cannot use AFL_QEMU_PERSISTENT_HOOK when " + "afl-qemu-trace is static\n"); + exit(1); + +#else + + persistent_save_gpr = 1; + + void *plib = dlopen(getenv("AFL_QEMU_PERSISTENT_HOOK"), RTLD_NOW); + if (!plib) { + + fprintf(stderr, "[AFL] ERROR: invalid AFL_QEMU_PERSISTENT_HOOK=%s\n", + getenv("AFL_QEMU_PERSISTENT_HOOK")); + exit(1); + + } + + afl_persistent_hook_ptr = dlsym(plib, "afl_persistent_hook"); + if (!afl_persistent_hook_ptr) { + + fprintf(stderr, + "[AFL] ERROR: failed to find the function " + "\"afl_persistent_hook\" in %s\n", + getenv("AFL_QEMU_PERSISTENT_HOOK")); + exit(1); + + } + +#endif + + } + if (getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET")) persisent_retaddr_offset = strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 0); @@ -352,8 +411,13 @@ static void afl_forkserver(CPUState *cpu) { if (WIFSTOPPED(status)) child_stopped = 1; - else if (unlikely(first_run && is_persistent)) + else if (unlikely(first_run && is_persistent)) { + + fprintf(stderr, "[AFL] ERROR: no persistent iteration executed\n"); exit(12); // Persistent is wrong + + } + first_run = 0; if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(7); diff --git a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h index 6d42bf3d..6f526d92 100644 --- a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h @@ -102,31 +102,101 @@ static void afl_compcov_log_64(target_ulong cur_loc, target_ulong arg1, } +static void afl_cmplog_16(target_ulong cur_loc, target_ulong arg1, + target_ulong arg2) { + + register uintptr_t k = (uintptr_t)cur_loc; + + u32 hits = __afl_cmp_map->headers[k].hits; + __afl_cmp_map->headers[k].hits = hits + 1; + // if (!__afl_cmp_map->headers[k].cnt) + // __afl_cmp_map->headers[k].cnt = __afl_cmp_counter++; + + __afl_cmp_map->headers[k].shape = 1; + //__afl_cmp_map->headers[k].type = CMP_TYPE_INS; + + hits &= CMP_MAP_H - 1; + __afl_cmp_map->log[k][hits].v0 = arg1; + __afl_cmp_map->log[k][hits].v1 = arg2; + +} + +static void afl_cmplog_32(target_ulong cur_loc, target_ulong arg1, + target_ulong arg2) { + + register uintptr_t k = (uintptr_t)cur_loc; + + u32 hits = __afl_cmp_map->headers[k].hits; + __afl_cmp_map->headers[k].hits = hits + 1; + + __afl_cmp_map->headers[k].shape = 3; + + hits &= CMP_MAP_H - 1; + __afl_cmp_map->log[k][hits].v0 = arg1; + __afl_cmp_map->log[k][hits].v1 = arg2; + +} + +static void afl_cmplog_64(target_ulong cur_loc, target_ulong arg1, + target_ulong arg2) { + + register uintptr_t k = (uintptr_t)cur_loc; + + u32 hits = __afl_cmp_map->headers[k].hits; + __afl_cmp_map->headers[k].hits = hits + 1; + + __afl_cmp_map->headers[k].shape = 7; + + hits &= CMP_MAP_H - 1; + __afl_cmp_map->log[k][hits].v0 = arg1; + __afl_cmp_map->log[k][hits].v1 = arg2; + +} + static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2, TCGMemOp ot, int is_imm) { void *func; - if (!afl_compcov_level || cur_loc > afl_end_code || cur_loc < afl_start_code) - return; + if (cur_loc > afl_end_code || cur_loc < afl_start_code) return; - if (!is_imm && afl_compcov_level < 2) return; + if (__afl_cmp_map) { - switch (ot) { + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= CMP_MAP_W - 1; - case MO_64: func = &afl_compcov_log_64; break; - case MO_32: func = &afl_compcov_log_32; break; - case MO_16: func = &afl_compcov_log_16; break; - default: return; + switch (ot) { - } + case MO_64: func = &afl_cmplog_64; break; + case MO_32: func = &afl_cmplog_32; break; + case MO_16: func = &afl_cmplog_16; break; + default: return; - cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); - cur_loc &= MAP_SIZE - 7; + } + + tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2); + + } else if (afl_compcov_level) { + + if (!is_imm && afl_compcov_level < 2) return; + + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 7; + + if (cur_loc >= afl_inst_rms) return; - if (cur_loc >= afl_inst_rms) return; + switch (ot) { - tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2); + case MO_64: func = &afl_compcov_log_64; break; + case MO_32: func = &afl_compcov_log_32; break; + case MO_16: func = &afl_compcov_log_16; break; + default: return; + + } + + tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2); + + } } @@ -182,62 +252,77 @@ static void log_x86_sp_content(void) { }*/ -#define I386_RESTORE_STATE_FOR_PERSISTENT \ - do { \ - \ - if (persistent_save_gpr) { \ - \ - int i; \ - TCGv_ptr gpr_sv; \ - \ - TCGv_ptr first_pass_ptr = tcg_const_ptr(&persistent_first_pass); \ - TCGv first_pass = tcg_temp_local_new(); \ - TCGv one = tcg_const_tl(1); \ - tcg_gen_ld8u_tl(first_pass, first_pass_ptr, 0); \ - \ - TCGLabel *lbl_save_gpr = gen_new_label(); \ - TCGLabel *lbl_finish_restore_gpr = gen_new_label(); \ - tcg_gen_brcond_tl(TCG_COND_EQ, first_pass, one, lbl_save_gpr); \ - \ - for (i = 0; i < CPU_NB_REGS; ++i) { \ - \ - gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); \ - tcg_gen_ld_tl(cpu_regs[i], gpr_sv, 0); \ - \ - } \ - \ - tcg_gen_br(lbl_finish_restore_gpr); \ - \ - gen_set_label(lbl_save_gpr); \ - \ - for (i = 0; i < CPU_NB_REGS; ++i) { \ - \ - gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); \ - tcg_gen_st_tl(cpu_regs[i], gpr_sv, 0); \ - \ - } \ - \ - gen_set_label(lbl_finish_restore_gpr); \ - tcg_temp_free(first_pass); \ - \ - } else if (afl_persistent_ret_addr == 0) { \ - \ - TCGv_ptr stack_off_ptr = tcg_const_ptr(&persistent_stack_offset); \ - TCGv stack_off = tcg_temp_new(); \ - tcg_gen_ld_tl(stack_off, stack_off_ptr, 0); \ - tcg_gen_sub_tl(cpu_regs[R_ESP], cpu_regs[R_ESP], stack_off); \ - tcg_temp_free(stack_off); \ - \ - } \ - \ - } while (0) - -#define AFL_QEMU_TARGET_i386_SNIPPET \ +static void callback_to_persistent_hook(void) { + + afl_persistent_hook_ptr(persistent_saved_gpr, guest_base); + +} + +static void gpr_saving(TCGv *cpu_regs, int regs_num) { + + int i; + TCGv_ptr gpr_sv; + + TCGv_ptr first_pass_ptr = tcg_const_ptr(&persistent_first_pass); + TCGv first_pass = tcg_temp_local_new(); + TCGv one = tcg_const_tl(1); + tcg_gen_ld8u_tl(first_pass, first_pass_ptr, 0); + + TCGLabel *lbl_restore_gpr = gen_new_label(); + tcg_gen_brcond_tl(TCG_COND_NE, first_pass, one, lbl_restore_gpr); + + // save GPR registers + for (i = 0; i < regs_num; ++i) { + + gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); + tcg_gen_st_tl(cpu_regs[i], gpr_sv, 0); + + } + + gen_set_label(lbl_restore_gpr); + + tcg_gen_afl_call0(&afl_persistent_loop); + + if (afl_persistent_hook_ptr) tcg_gen_afl_call0(callback_to_persistent_hook); + + // restore GPR registers + for (i = 0; i < regs_num; ++i) { + + gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); + tcg_gen_ld_tl(cpu_regs[i], gpr_sv, 0); + + } + + tcg_temp_free_ptr(first_pass_ptr); + tcg_temp_free(first_pass); + tcg_temp_free(one); + +} + +static void restore_state_for_persistent(TCGv *cpu_regs, int regs_num, int sp) { + + if (persistent_save_gpr) { + + gpr_saving(cpu_regs, regs_num); + + } else if (afl_persistent_ret_addr == 0) { + + TCGv_ptr stack_off_ptr = tcg_const_ptr(&persistent_stack_offset); + TCGv stack_off = tcg_temp_new(); + tcg_gen_ld_tl(stack_off, stack_off_ptr, 0); + tcg_gen_sub_tl(cpu_regs[sp], cpu_regs[sp], stack_off); + tcg_temp_free(stack_off); + + } + +} + +#define AFL_QEMU_TARGET_I386_SNIPPET \ if (is_persistent) { \ \ if (s->pc == afl_persistent_addr) { \ \ - I386_RESTORE_STATE_FOR_PERSISTENT; \ + restore_state_for_persistent(cpu_regs, AFL_REGS_NUM, R_ESP); \ /*tcg_gen_afl_call0(log_x86_saved_gpr); \ tcg_gen_afl_call0(log_x86_sp_content);*/ \ \ @@ -245,9 +330,11 @@ static void log_x86_sp_content(void) { \ TCGv_ptr paddr = tcg_const_ptr(afl_persistent_addr); \ tcg_gen_st_tl(paddr, cpu_regs[R_ESP], persisent_retaddr_offset); \ + tcg_temp_free_ptr(paddr); \ \ } \ - tcg_gen_afl_call0(&afl_persistent_loop); \ + \ + if (!persistent_save_gpr) tcg_gen_afl_call0(&afl_persistent_loop); \ /*tcg_gen_afl_call0(log_x86_sp_content);*/ \ \ } else if (afl_persistent_ret_addr && s->pc == afl_persistent_ret_addr) { \ @@ -259,3 +346,57 @@ static void log_x86_sp_content(void) { \ } +// SP = 13, LINK = 14 + +#define AFL_QEMU_TARGET_ARM_SNIPPET \ + if (is_persistent) { \ + \ + if (dc->pc == afl_persistent_addr) { \ + \ + if (persistent_save_gpr) gpr_saving(cpu_R, AFL_REGS_NUM); \ + \ + if (afl_persistent_ret_addr == 0) { \ + \ + TCGv_ptr paddr = tcg_const_ptr(afl_persistent_addr); \ + tcg_gen_mov_i32(cpu_R[14], paddr); \ + tcg_temp_free_ptr(paddr); \ + \ + } \ + \ + if (!persistent_save_gpr) tcg_gen_afl_call0(&afl_persistent_loop); \ + \ + } else if (afl_persistent_ret_addr && dc->pc == afl_persistent_ret_addr) { \ + \ + gen_bx_im(dc, afl_persistent_addr); \ + \ + } \ + \ + } + +// SP = 31, LINK = 30 + +#define AFL_QEMU_TARGET_ARM64_SNIPPET \ + if (is_persistent) { \ + \ + if (s->pc == afl_persistent_addr) { \ + \ + if (persistent_save_gpr) gpr_saving(cpu_X, AFL_REGS_NUM); \ + \ + if (afl_persistent_ret_addr == 0) { \ + \ + TCGv_ptr paddr = tcg_const_ptr(afl_persistent_addr); \ + tcg_gen_mov_i32(cpu_X[30], paddr); \ + tcg_temp_free_ptr(paddr); \ + \ + } \ + \ + if (!persistent_save_gpr) tcg_gen_afl_call0(&afl_persistent_loop); \ + \ + } else if (afl_persistent_ret_addr && s->pc == afl_persistent_ret_addr) { \ + \ + gen_goto_tb(s, 0, afl_persistent_addr); \ + \ + } \ + \ + } + diff --git a/qemu_mode/patches/arm-translate-a64.diff b/qemu_mode/patches/arm-translate-a64.diff new file mode 100644 index 00000000..83856217 --- /dev/null +++ b/qemu_mode/patches/arm-translate-a64.diff @@ -0,0 +1,64 @@ +diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c +index fd36425..992bf17 100644 +--- a/target/arm/translate-a64.c ++++ b/target/arm/translate-a64.c +@@ -39,6 +39,8 @@ + #include "translate-a64.h" + #include "qemu/atomic128.h" + ++#include "../patches/afl-qemu-cpu-translate-inl.h" ++ + static TCGv_i64 cpu_X[32]; + static TCGv_i64 cpu_pc; + +@@ -3365,6 +3367,12 @@ static void disas_add_sub_imm(DisasContext *s, uint32_t insn) + return; + } + ++ if (rd == 31 && sub_op) { // cmp xX, imm ++ TCGv_i64 tcg_imm = tcg_const_i64(imm); ++ afl_gen_compcov(s->pc, tcg_rn, tcg_imm, is_64bit ? MO_64 : MO_32, 1); ++ tcg_temp_free_i64(tcg_imm); ++ } ++ + tcg_result = tcg_temp_new_i64(); + if (!setflags) { + if (sub_op) { +@@ -3972,6 +3980,9 @@ static void disas_add_sub_ext_reg(DisasContext *s, uint32_t insn) + + tcg_rm = read_cpu_reg(s, rm, sf); + ext_and_shift_reg(tcg_rm, tcg_rm, option, imm3); ++ ++ if (rd == 31 && sub_op) // cmp xX, xY ++ afl_gen_compcov(s->pc, tcg_rn, tcg_rm, sf ? MO_64 : MO_32, 0); + + tcg_result = tcg_temp_new_i64(); + +@@ -4037,6 +4048,9 @@ static void disas_add_sub_reg(DisasContext *s, uint32_t insn) + + shift_reg_imm(tcg_rm, tcg_rm, sf, shift_type, imm6); + ++ if (rd == 31 && sub_op) // cmp xX, xY ++ afl_gen_compcov(s->pc, tcg_rn, tcg_rm, sf ? MO_64 : MO_32, 0); ++ + tcg_result = tcg_temp_new_i64(); + + if (!setflags) { +@@ -4246,6 +4260,8 @@ static void disas_cc(DisasContext *s, uint32_t insn) + tcg_y = cpu_reg(s, y); + } + tcg_rn = cpu_reg(s, rn); ++ ++ afl_gen_compcov(s->pc, tcg_rn, tcg_y, sf ? MO_64 : MO_32, is_imm); + + /* Set the flags for the new comparison. */ + tcg_tmp = tcg_temp_new_i64(); +@@ -13317,6 +13333,8 @@ static void disas_data_proc_simd_fp(DisasContext *s, uint32_t insn) + static void disas_a64_insn(CPUARMState *env, DisasContext *s) + { + uint32_t insn; ++ ++ AFL_QEMU_TARGET_ARM64_SNIPPET + + insn = arm_ldl_code(env, s->pc, s->sctlr_b); + s->insn = insn; diff --git a/qemu_mode/patches/arm-translate.diff b/qemu_mode/patches/arm-translate.diff index 58b4a873..daa5d43b 100644 --- a/qemu_mode/patches/arm-translate.diff +++ b/qemu_mode/patches/arm-translate.diff @@ -1,5 +1,5 @@ diff --git a/target/arm/translate.c b/target/arm/translate.c -index 7c4675ff..0f0928b6 100644 +index 7c4675f..e3d999a 100644 --- a/target/arm/translate.c +++ b/target/arm/translate.c @@ -59,6 +59,8 @@ @@ -132,3 +132,21 @@ index 7c4675ff..0f0928b6 100644 rd = 16; break; case 0xb: /* cmn */ +@@ -13233,6 +13247,8 @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu) + return; + } + ++ AFL_QEMU_TARGET_ARM_SNIPPET ++ + insn = arm_ldl_code(env, dc->pc, dc->sctlr_b); + dc->insn = insn; + dc->pc += 4; +@@ -13301,6 +13317,8 @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu) + return; + } + ++ AFL_QEMU_TARGET_ARM_SNIPPET ++ + insn = arm_lduw_code(env, dc->pc, dc->sctlr_b); + is_16bit = thumb_insn_is_16bit(dc, insn); + dc->pc += 2; diff --git a/qemu_mode/patches/configure.diff b/qemu_mode/patches/configure.diff new file mode 100644 index 00000000..acb96294 --- /dev/null +++ b/qemu_mode/patches/configure.diff @@ -0,0 +1,26 @@ +diff --git a/configure b/configure +index 1c9f609..3edc9a7 100755 +--- a/configure ++++ b/configure +@@ -4603,6 +4603,21 @@ if test "$darwin" != "yes" -a "$mingw32" != "yes" -a "$solaris" != yes -a \ + libs_softmmu="-lutil $libs_softmmu" + fi + ++########################################## ++cat > $TMPC << EOF ++#include <dlfcn.h> ++#include <stdlib.h> ++int main(int argc, char **argv) { return dlopen("libc.so", RTLD_NOW) != NULL; } ++EOF ++if compile_prog "" "" ; then ++ : ++elif compile_prog "" "-ldl" ; then ++ LIBS="-ldl $LIBS" ++ libs_qga="-ldl $libs_qga" ++else ++ error_exit "libdl check failed" ++fi ++ + ########################################## + # spice probe + if test "$spice" != "no" ; then diff --git a/qemu_mode/patches/i386-translate.diff b/qemu_mode/patches/i386-translate.diff index 00337e2c..8ccd6f4e 100644 --- a/qemu_mode/patches/i386-translate.diff +++ b/qemu_mode/patches/i386-translate.diff @@ -35,7 +35,7 @@ index 0dd5fbe4..a23da128 100644 rex_w = -1; rex_r = 0; -+ AFL_QEMU_TARGET_i386_SNIPPET ++ AFL_QEMU_TARGET_I386_SNIPPET + next_byte: b = x86_ldub_code(env, s); diff --git a/src/afl-common.c b/src/afl-common.c index 6cb97cdf..958b9b7d 100644 --- a/src/afl-common.c +++ b/src/afl-common.c @@ -72,23 +72,27 @@ void detect_file_args(char** argv, u8* prog_in) { if (!prog_in) FATAL("@@ syntax is not supported by this tool."); - /* Be sure that we're always using fully-qualified paths. */ + use_stdin = 0; - if (prog_in[0] == '/') - aa_subst = prog_in; - else - aa_subst = alloc_printf("%s/%s", cwd, prog_in); + if (prog_in[0] != 0) { // not afl-showmap special case - use_stdin = 0; + /* Be sure that we're always using fully-qualified paths. */ + + if (prog_in[0] == '/') + aa_subst = prog_in; + else + aa_subst = alloc_printf("%s/%s", cwd, prog_in); - /* Construct a replacement argv value. */ + /* Construct a replacement argv value. */ - *aa_loc = 0; - n_arg = alloc_printf("%s%s%s", argv[i], aa_subst, aa_loc + 2); - argv[i] = n_arg; - *aa_loc = '@'; + *aa_loc = 0; + n_arg = alloc_printf("%s%s%s", argv[i], aa_subst, aa_loc + 2); + argv[i] = n_arg; + *aa_loc = '@'; - if (prog_in[0] != '/') ck_free(aa_subst); + if (prog_in[0] != '/') ck_free(aa_subst); + + } } diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c index 92bac4ab..3d34bf71 100644 --- a/src/afl-fuzz-cmplog.c +++ b/src/afl-fuzz-cmplog.c @@ -27,7 +27,7 @@ #include "afl-fuzz.h" #include "cmplog.h" -static s32 cmplog_child_pid, cmplog_fsrv_ctl_fd, cmplog_fsrv_st_fd; +static s32 cmplog_fsrv_ctl_fd, cmplog_fsrv_st_fd; void init_cmplog_forkserver(char** argv) { @@ -150,8 +150,10 @@ void init_cmplog_forkserver(char** argv) { "msan_track_origins=0", 0); - argv[0] = cmplog_binary; - execv(cmplog_binary, argv); + setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1); + + if (!qemu_mode) argv[0] = cmplog_binary; + execv(argv[0], argv); /* Use a distinctive bitmap signature to tell the parent about execv() falling through. */ @@ -441,8 +443,10 @@ u8 run_cmplog_target(char** argv, u32 timeout) { "symbolize=0:" "msan_track_origins=0", 0); - argv[0] = cmplog_binary; - execv(cmplog_binary, argv); + setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1); + + if (!qemu_mode) argv[0] = cmplog_binary; + execv(argv[0], argv); /* Use a distinctive bitmap value to tell the parent about execv() falling through. */ diff --git a/src/afl-fuzz-globals.c b/src/afl-fuzz-globals.c index 154f281e..d5d70542 100644 --- a/src/afl-fuzz-globals.c +++ b/src/afl-fuzz-globals.c @@ -252,7 +252,7 @@ u32 a_extras_cnt; /* Total number of tokens available */ u8 *(*post_handler)(u8 *buf, u32 *len); u8 *cmplog_binary; -s32 cmplog_forksrv_pid; +s32 cmplog_child_pid, cmplog_forksrv_pid; /* hooks for the custom mutator function */ size_t (*custom_mutator)(u8 *data, size_t size, u8 *mutated_out, diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c index 9265e4a5..fc3e1140 100644 --- a/src/afl-fuzz-init.c +++ b/src/afl-fuzz-init.c @@ -1822,6 +1822,8 @@ static void handle_stop_sig(int sig) { if (child_pid > 0) kill(child_pid, SIGKILL); if (forksrv_pid > 0) kill(forksrv_pid, SIGKILL); + if (cmplog_child_pid > 0) kill(cmplog_child_pid, SIGKILL); + if (cmplog_forksrv_pid > 0) kill(cmplog_forksrv_pid, SIGKILL); } diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c index c21c973f..296fcd98 100644 --- a/src/afl-fuzz-redqueen.c +++ b/src/afl-fuzz-redqueen.c @@ -108,6 +108,8 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) { struct range* ranges = add_range(NULL, 0, len); u8* backup = ck_alloc_nozero(len); + u8 needs_write = 0; + u64 orig_hit_cnt, new_hit_cnt; orig_hit_cnt = queued_paths + unique_crashes; @@ -120,6 +122,8 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) { while ((rng = pop_biggest_range(&ranges)) != NULL && stage_cur) { u32 s = rng->end - rng->start; + if (s == 0) goto empty_range; + memcpy(backup, buf + rng->start, s); rand_replace(buf + rng->start, s); @@ -132,8 +136,11 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) { ranges = add_range(ranges, rng->start + s / 2 + 1, rng->end); memcpy(buf + rng->start, backup, s); - } + } else + needs_write = 1; + + empty_range: ck_free(rng); --stage_cur; @@ -151,6 +158,32 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) { } + // save the input with the high entropy + + if (needs_write) { + + s32 fd; + + if (no_unlink) { + + fd = open(queue_cur->fname, O_WRONLY | O_CREAT | O_TRUNC, 0600); + + } else { + + unlink(queue_cur->fname); /* ignore errors */ + fd = open(queue_cur->fname, O_WRONLY | O_CREAT | O_EXCL, 0600); + + } + + if (fd < 0) PFATAL("Unable to create '%s'", queue_cur->fname); + + ck_write(fd, buf, len, queue_cur->fname); + queue_cur->len = len; // no-op, just to be 100% safe + + close(fd); + + } + return 0; } @@ -270,6 +303,48 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx, } +void try_to_add_to_dict(u64 v, u8 shape) { + + u8* b = (u8*)&v; + + u32 k; + u8 cons_ff = 0, cons_0 = 0; + for (k = 0; k < shape; ++k) { + + if (b[k] == 0) + ++cons_0; + else if (b[k] == 0xff) + ++cons_0; + else + cons_0 = cons_ff = 0; + + if (cons_0 > 1 || cons_ff > 1) return; + + } + + maybe_add_auto((u8*)&v, shape); + + u64 rev; + switch (shape) { + + case 1: break; + case 2: + rev = SWAP16((u16)v); + maybe_add_auto((u8*)&rev, shape); + break; + case 4: + rev = SWAP32((u32)v); + maybe_add_auto((u8*)&rev, shape); + break; + case 8: + rev = SWAP64(v); + maybe_add_auto((u8*)&rev, shape); + break; + + } + +} + u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) { struct cmp_header* h = &cmp_map->headers[key]; @@ -311,6 +386,14 @@ u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) { } + // If failed, add to dictionary + if (fails == 8) { + + try_to_add_to_dict(o->v0, SHAPE_BYTES(h->shape)); + try_to_add_to_dict(o->v1, SHAPE_BYTES(h->shape)); + + } + cmp_fuzz_next_iter: stage_cur++; @@ -362,7 +445,7 @@ u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len, } - memcpy(buf, orig_buf, len); + memcpy(orig_buf, buf, len); new_hit_cnt = queued_paths + unique_crashes; stage_finds[STAGE_ITS] += new_hit_cnt - orig_hit_cnt; diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index 9dc4b917..344e0abf 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -65,59 +65,62 @@ void write_stats_file(double bitmap_cvg, double stability, double eps) { if (getrusage(RUSAGE_CHILDREN, &rus)) rus.ru_maxrss = 0; - fprintf(f, - "start_time : %llu\n" - "last_update : %llu\n" - "fuzzer_pid : %d\n" - "cycles_done : %llu\n" - "execs_done : %llu\n" - "execs_per_sec : %0.02f\n" - "paths_total : %u\n" - "paths_favored : %u\n" - "paths_found : %u\n" - "paths_imported : %u\n" - "max_depth : %u\n" - "cur_path : %u\n" /* Must match find_start_position() */ - "pending_favs : %u\n" - "pending_total : %u\n" - "variable_paths : %u\n" - "stability : %0.02f%%\n" - "bitmap_cvg : %0.02f%%\n" - "unique_crashes : %llu\n" - "unique_hangs : %llu\n" - "last_path : %llu\n" - "last_crash : %llu\n" - "last_hang : %llu\n" - "execs_since_crash : %llu\n" - "exec_timeout : %u\n" - "slowest_exec_ms : %llu\n" - "peak_rss_mb : %lu\n" - "afl_banner : %s\n" - "afl_version : " VERSION - "\n" - "target_mode : %s%s%s%s%s%s%s%s\n" - "command_line : %s\n", - start_time / 1000, get_cur_time() / 1000, getpid(), - queue_cycle ? (queue_cycle - 1) : 0, total_execs, eps, queued_paths, - queued_favored, queued_discovered, queued_imported, max_depth, - current_entry, pending_favored, pending_not_fuzzed, queued_variable, - stability, bitmap_cvg, unique_crashes, unique_hangs, - last_path_time / 1000, last_crash_time / 1000, last_hang_time / 1000, - total_execs - last_crash_execs, exec_tmout, slowest_exec_ms, + fprintf( + f, + "start_time : %llu\n" + "last_update : %llu\n" + "fuzzer_pid : %d\n" + "cycles_done : %llu\n" + "execs_done : %llu\n" + "execs_per_sec : %0.02f\n" + // "real_execs_per_sec: %0.02f\n" // damn the name is too long + "paths_total : %u\n" + "paths_favored : %u\n" + "paths_found : %u\n" + "paths_imported : %u\n" + "max_depth : %u\n" + "cur_path : %u\n" /* Must match find_start_position() */ + "pending_favs : %u\n" + "pending_total : %u\n" + "variable_paths : %u\n" + "stability : %0.02f%%\n" + "bitmap_cvg : %0.02f%%\n" + "unique_crashes : %llu\n" + "unique_hangs : %llu\n" + "last_path : %llu\n" + "last_crash : %llu\n" + "last_hang : %llu\n" + "execs_since_crash : %llu\n" + "exec_timeout : %u\n" + "slowest_exec_ms : %llu\n" + "peak_rss_mb : %lu\n" + "afl_banner : %s\n" + "afl_version : " VERSION + "\n" + "target_mode : %s%s%s%s%s%s%s%s\n" + "command_line : %s\n", + start_time / 1000, get_cur_time() / 1000, getpid(), + queue_cycle ? (queue_cycle - 1) : 0, total_execs, + /*eps,*/ total_execs / ((double)(get_cur_time() - start_time) / 1000), + queued_paths, queued_favored, queued_discovered, queued_imported, + max_depth, current_entry, pending_favored, pending_not_fuzzed, + queued_variable, stability, bitmap_cvg, unique_crashes, unique_hangs, + last_path_time / 1000, last_crash_time / 1000, last_hang_time / 1000, + total_execs - last_crash_execs, exec_tmout, slowest_exec_ms, #ifdef __APPLE__ - (unsigned long int)(rus.ru_maxrss >> 20), + (unsigned long int)(rus.ru_maxrss >> 20), #else - (unsigned long int)(rus.ru_maxrss >> 10), + (unsigned long int)(rus.ru_maxrss >> 10), #endif - use_banner, unicorn_mode ? "unicorn" : "", qemu_mode ? "qemu " : "", - dumb_mode ? " dumb " : "", no_forkserver ? "no_forksrv " : "", - crash_mode ? "crash " : "", persistent_mode ? "persistent " : "", - deferred_mode ? "deferred " : "", - (unicorn_mode || qemu_mode || dumb_mode || no_forkserver || - crash_mode || persistent_mode || deferred_mode) - ? "" - : "default", - orig_cmdline); + use_banner, unicorn_mode ? "unicorn" : "", qemu_mode ? "qemu " : "", + dumb_mode ? " dumb " : "", no_forkserver ? "no_forksrv " : "", + crash_mode ? "crash " : "", persistent_mode ? "persistent " : "", + deferred_mode ? "deferred " : "", + (unicorn_mode || qemu_mode || dumb_mode || no_forkserver || crash_mode || + persistent_mode || deferred_mode) + ? "" + : "default", + orig_cmdline); /* ignore errors */ fclose(f); @@ -765,8 +768,8 @@ void show_init_stats(void) { WARNF(cLRD "Some test cases are huge (%s) - see %s/perf_tips.md!", DMS(max_len), doc_path); else if (max_len > 10 * 1024) - WARNF("Some test cases are big (%s) - see %s/perf_tips.md.", - DMS(max_len), doc_path); + WARNF("Some test cases are big (%s) - see %s/perf_tips.md.", DMS(max_len), + doc_path); if (useless_at_start && !in_bitmap) WARNF(cLRD "Some test cases look useless. Consider using a smaller set."); diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 8833244d..8e4b22b1 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -100,7 +100,7 @@ static void usage(u8* argv0) { " -f file - location read by the fuzzed program (stdin)\n" " -t msec - timeout for each run (auto-scaled, 50-%d ms)\n" " -m megs - memory limit for child process (%d MB)\n" - " -c program - enable CmpLog specifying a binary compiled for it\n" + " -c program - enable CmpLog by specifying a binary compiled for it\n" " -Q - use binary-only instrumentation (QEMU mode)\n" " -U - use unicorn-based instrumentation (Unicorn mode)\n" " -W - use qemu-based instrumentation with Wine (Wine " @@ -1017,6 +1017,8 @@ int main(int argc, char** argv) { if (child_pid > 0) kill(child_pid, SIGKILL); if (forksrv_pid > 0) kill(forksrv_pid, SIGKILL); + if (cmplog_child_pid > 0) kill(cmplog_child_pid, SIGKILL); + if (cmplog_forksrv_pid > 0) kill(cmplog_forksrv_pid, SIGKILL); /* Now that we've killed the forkserver, we wait for it to be able to get * rusage stats. */ if (waitpid(forksrv_pid, NULL, 0) <= 0) { WARNF("error waitpid\n"); } diff --git a/src/afl-showmap.c b/src/afl-showmap.c index 5061ca31..1fd425a2 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -67,7 +67,7 @@ s32 forksrv_pid, /* PID of the fork server */ s32 fsrv_ctl_fd, /* Fork server control pipe (write) */ fsrv_st_fd; /* Fork server status pipe (read) */ -s32 out_fd; /* Persistent fd for out_file */ +s32 out_fd; /* Persistent fd for stdin_file */ s32 dev_null_fd = -1; /* FD to /dev/null */ s32 out_fd = -1, out_dir_fd = -1, dev_urandom_fd = -1; @@ -77,6 +77,7 @@ u8 uses_asan; u8* trace_bits; /* SHM with instrumentation bitmap */ u8 *out_file, /* Trace output file */ + *stdin_file, /* stdin file */ *in_dir, /* input folder */ *doc_path, /* Path to docs */ *at_file; /* Substitution string for @@ */ @@ -88,8 +89,7 @@ u32 exec_tmout; /* Exec timeout (ms) */ static u32 total, highest; /* tuple content information */ static u32 in_len, /* Input data length */ - arg_offset, - total_execs; /* Total number of execs */ + arg_offset, total_execs; /* Total number of execs */ u64 mem_limit = MEM_LIMIT; /* Memory limit (MB) */ @@ -158,9 +158,17 @@ static void classify_counts(u8* mem, const u8* map) { } +/* Get rid of temp files (atexit handler). */ + +static void at_exit_handler(void) { + + if (out_file) unlink(out_file); /* Ignore errors */ + +} + /* Write results. */ -static u32 write_results_to_file(u8 *out_file) { +static u32 write_results_to_file(u8* out_file) { s32 fd; u32 i, ret = 0; @@ -234,7 +242,7 @@ static u32 write_results_to_file(u8 *out_file) { static u32 write_results(void) { return write_results_to_file(out_file); - + } /* Write output file. */ @@ -263,16 +271,10 @@ static s32 write_to_file(u8* path, u8* mem, u32 len) { static void write_to_testcase(void* mem, u32 len) { - if (use_stdin) { - - lseek(0, 0, SEEK_SET); - - ck_write(0, mem, len, out_file); - - if (ftruncate(0, len)) PFATAL("ftruncate() failed"); - lseek(0, 0, SEEK_SET); - - } + lseek(out_fd, 0, SEEK_SET); + ck_write(out_fd, mem, len, out_file); + if (ftruncate(out_fd, len)) PFATAL("ftruncate() failed"); + lseek(out_fd, 0, SEEK_SET); } @@ -374,14 +376,15 @@ static u8 run_target_forkserver(char** argv, u8* mem, u32 len) { /* Read initial file. */ -u32 read_file(u8 *in_file) { +u32 read_file(u8* in_file) { struct stat st; s32 fd = open(in_file, O_RDONLY); if (fd < 0) WARNF("Unable to open '%s'", in_file); - if (fstat(fd, &st) || !st.st_size) WARNF("Zero-sized input file '%s'.", in_file); + if (fstat(fd, &st) || !st.st_size) + WARNF("Zero-sized input file '%s'.", in_file); in_len = st.st_size; in_data = ck_alloc_nozero(in_len); @@ -390,9 +393,10 @@ u32 read_file(u8 *in_file) { close(fd); - //OKF("Read %u byte%s from '%s'.", in_len, in_len == 1 ? "" : "s", in_file); + // OKF("Read %u byte%s from '%s'.", in_len, in_len == 1 ? "" : "s", in_file); return in_len; + } /* Execute target application. */ @@ -634,7 +638,8 @@ static void usage(u8* argv0) { "Other settings:\n\n" - " -i dir - process all files in this directory, -o must be a directory\n" + " -i dir - process all files in this directory, -o must be a " + "directory\n" " and each bitmap will be written there individually.\n" " -q - sink program's output and don't show messages\n" " -e - show edge coverage only, ignore hit counts\n" @@ -887,22 +892,21 @@ int main(int argc, char** argv) { if (!quiet_mode) { show_banner(); - ACTF("Executing '%s'...\n", target_path); + ACTF("Executing '%s'...", target_path); } - if (in_dir) { - + if (in_dir) { + if (at_file) PFATAL("Options -A and -i are mutually exclusive"); at_file = "@@"; - + } - detect_file_args(argv + optind, at_file); - + detect_file_args(argv + optind, ""); + for (i = optind; i < argc; i++) - if (strcmp(argv[i], "@@") == 0) - arg_offset = i; + if (strcmp(argv[i], "@@") == 0) arg_offset = i; if (qemu_mode) { @@ -917,10 +921,13 @@ int main(int argc, char** argv) { if (in_dir) { - DIR *dir_in, *dir_out; + DIR * dir_in, *dir_out; struct dirent* dir_ent; - int done = 0; - u8 infile[4096], outfile[4096]; + int done = 0; + u8 infile[4096], outfile[4096]; +#if !defined(DT_REG) + struct stat statbuf; +#endif dev_null_fd = open("/dev/null", O_RDWR); if (dev_null_fd < 0) PFATAL("Unable to open /dev/null"); @@ -931,26 +938,66 @@ int main(int argc, char** argv) { if (mkdir(out_file, 0700)) PFATAL("cannot create output directory %s", out_file); - if (arg_offset) argv[arg_offset] = infile; + u8* use_dir = "."; + + if (access(use_dir, R_OK | W_OK | X_OK)) { + + use_dir = getenv("TMPDIR"); + if (!use_dir) use_dir = "/tmp"; + + } + + stdin_file = alloc_printf("%s/.afl-tmin-temp-%u", use_dir, getpid()); + unlink(stdin_file); + atexit(at_exit_handler); + out_fd = open(stdin_file, O_RDWR | O_CREAT | O_EXCL, 0600); + if (out_fd < 0) PFATAL("Unable to create '%s'", out_file); + + if (arg_offset) argv[arg_offset] = stdin_file; + + if (getenv("AFL_DEBUG")) { + + int i = optind; + SAYF(cMGN "[D]" cRST " %s:", target_path); + while (argv[i] != NULL) + SAYF(" \"%s\"", argv[i++]); + SAYF("\n"); + SAYF(cMGN "[D]" cRST " %d - %d = %d, %s\n", arg_offset, optind, + arg_offset - optind, infile); + + } init_forkserver(use_argv); while (done == 0 && (dir_ent = readdir(dir_in))) { - if (dir_ent->d_name[0] == '.') continue; // skip anything that starts with '.' - if (dir_ent->d_type != DT_REG) continue; // only regular files + if (dir_ent->d_name[0] == '.') + continue; // skip anything that starts with '.' + +#if defined(DT_REG) /* Posix and Solaris do not know d_type and DT_REG */ + if (dir_ent->d_type != DT_REG) continue; // only regular files +#endif snprintf(infile, sizeof(infile), "%s/%s", in_dir, dir_ent->d_name); + +#if !defined(DT_REG) /* use stat() */ + if (-1 == stat(infile, &statbuf) || !S_ISREG(statbuf.st_mode)) continue; +#endif + snprintf(outfile, sizeof(outfile), "%s/%s", out_file, dir_ent->d_name); if (read_file(infile)) { + run_target_forkserver(use_argv, in_data, in_len); ck_free(in_data); tcnt = write_results_to_file(outfile); + } } + if (!quiet_mode) OKF("Processed %u input files.", total_execs); + } else { run_target(use_argv); @@ -969,3 +1016,4 @@ int main(int argc, char** argv) { exit(child_crashed * 2 + child_timed_out); } + diff --git a/src/third_party/libradamsa/libradamsa.c b/src/third_party/libradamsa/libradamsa.c index be3050b1..f3677fa7 100644 --- a/src/third_party/libradamsa/libradamsa.c +++ b/src/third_party/libradamsa/libradamsa.c @@ -2405,7 +2405,11 @@ static word prim_sys(word op, word a, word b, word c) { EOPNOTSUPP, EOVERFLOW, EOWNERDEAD, EPERM, EPIPE, EPROTO, EPROTONOSUPPORT, EPROTOTYPE, ERANGE, EROFS, ESPIPE, ESRCH, ESTALE, ETIME, ETIMEDOUT, ETXTBSY, EWOULDBLOCK, EXDEV, SEEK_SET, SEEK_CUR, SEEK_END, O_EXEC, O_RDONLY, O_RDWR, - O_SEARCH, O_WRONLY, O_APPEND, O_CLOEXEC, O_CREAT, O_DIRECTORY, O_DSYNC, O_EXCL, + O_SEARCH, O_WRONLY, O_APPEND, O_CLOEXEC, O_CREAT, +#if defined O_DIRECTORY + O_DIRECTORY, +#endif + O_DSYNC, O_EXCL, O_NOCTTY, O_NOFOLLOW, O_NONBLOCK, O_RSYNC, O_SYNC, O_TRUNC, O_TTY_INIT, O_ACCMODE, FD_CLOEXEC, F_DUPFD, F_DUPFD_CLOEXEC, F_GETFD, F_SETFD, F_GETFL, F_SETFL, F_GETOWN, F_SETOWN, F_GETLK, F_SETLK, F_SETLKW, F_RDLCK, F_UNLCK, F_WRLCK, CLOCK_MONOTONIC, diff --git a/test/test.sh b/test/test.sh index 69b89661..fde40736 100755 --- a/test/test.sh +++ b/test/test.sh @@ -1,18 +1,18 @@ #!/bin/sh # -# Ensure we have: test, type, diff -q, grep -aqE +# Ensure we have: test, type, diff, grep -qE # test -z "" 2> /dev/null || { echo Error: test command not found ; exit 1 ; } GREP=`type grep > /dev/null 2>&1 && echo OK` test "$GREP" = OK || { echo Error: grep command not found ; exit 1 ; } -echo foobar | grep -aqE 'asd|oob' 2> /dev/null || { echo Error: grep command does not support -q, -a and/or -E option ; exit 1 ; } +echo foobar | grep -qE 'asd|oob' 2> /dev/null || { echo Error: grep command does not support -q and/or -E option ; exit 1 ; } echo 1 > test.1 echo 1 > test.2 OK=OK -diff -q test.1 test.2 >/dev/null 2>&1 || OK= +diff test.1 test.2 >/dev/null 2>&1 || OK= rm -f test.1 test.2 -test -z "$OK" && { echo Error: diff -q is not working ; exit 1 ; } +test -z "$OK" && { echo Error: diff is not working ; exit 1 ; } test -z "$LLVM_CONFIG" && LLVM_CONFIG=llvm-config @@ -21,7 +21,7 @@ $ECHO \\101 2>&1 | grep -qE '^A' || { ECHO= test -e /bin/printf && { ECHO="/bin/printf %b\\n" - $ECHO '\\101' 2>&1 | grep -qE '^A' || ECHO= + $ECHO "\\101" 2>&1 | grep -qE '^A' || ECHO= } } test -z "$ECHO" && { printf Error: printf command does not support octal character codes ; exit 1 ; } @@ -45,6 +45,17 @@ unset AFL_LLVM_INSTRIM unset AFL_LLVM_LAF_SPLIT_SWITCHES unset AFL_LLVM_LAF_TRANSFORM_COMPARES unset AFL_LLVM_LAF_SPLIT_COMPARES +unset AFL_QEMU_PERSISTENT_ADDR +unset AFL_QEMU_PERSISTENT_RETADDR_OFFSET +unset AFL_QEMU_PERSISTENT_GPR +unset AFL_QEMU_PERSISTENT_RET +unset AFL_QEMU_PERSISTENT_HOOK +unset AFL_QEMU_PERSISTENT_CNT +unset AFL_POST_LIBRARY +unset AFL_CUSTOM_MUTATOR_LIBRARY +unset AFL_PYTHON_MODULE +unset AFL_PRELOAD +unset LD_PRELOAD # on OpenBSD we need to work with llvm from /usr/local/bin test -e /usr/local/bin/opt && { @@ -75,7 +86,7 @@ $ECHO "${RESET}${GREY}[*] starting afl++ test framework ..." test -z "$SYS" && $ECHO "$YELLOW[-] uname -m did not succeed" $ECHO "$BLUE[*] Testing: ${AFL_GCC}, afl-showmap, afl-fuzz, afl-cmin and afl-tmin" -test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" && { +test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc" && { test -e ../${AFL_GCC} -a -e ../afl-showmap -a -e ../afl-fuzz && { ../${AFL_GCC} -o test-instr.plain ../test-instr.c > /dev/null 2>&1 AFL_HARDEN=1 ../${AFL_GCC} -o test-compcov.harden test-compcov.c > /dev/null 2>&1 @@ -84,7 +95,7 @@ test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" && { echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 test -e test-instr.plain.0 -a -e test-instr.plain.1 && { - diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { + diff test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { $ECHO "$RED[!] ${AFL_GCC} instrumentation should be different on different input but is not" CODE=1 } || { @@ -111,7 +122,7 @@ test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" && { CODE=1 } test -e test-compcov.harden && { - grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && { + grep -Eq 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && { $ECHO "$GREEN[+] ${AFL_GCC} hardened mode succeeded and is working" } || { $ECHO "$RED[!] ${AFL_GCC} hardened mode is not hardened" @@ -149,12 +160,22 @@ test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" && { CODE=1 } echo 000000000000000000000000 > in/in2 + echo 111 > in/in3 mkdir -p in2 - ../afl-cmin -i in -o in2 -- ./test-instr.plain @@ >/dev/null - CNT=`ls in2/ | wc -l` + ../afl-cmin -i in -o in2 -- ./test-instr.plain >/dev/null 2>&1 # why is afl-forkserver writing to stderr? + CNT=`ls in2/* 2>/dev/null | wc -l` + case "$CNT" in + *2) $ECHO "$GREEN[+] afl-cmin correctly minimized the number of testcases" ;; + *) $ECHO "$RED[!] afl-cmin did not correctly minimize the number of testcases ($CNT)" + CODE=1 + ;; + esac + rm -f in2/in* + AFL_PATH=`pwd`/.. ../afl-cmin.bash -i in -o in2 -- ./test-instr.plain >/dev/null + CNT=`ls in2/* 2>/dev/null | wc -l` case "$CNT" in - *1) $ECHO "$GREEN[+] afl-cmin correctly minimized the number of testcases" ;; - *) $ECHO "$RED[!] afl-cmin did not correctly minimize the number of testcases" + *2) $ECHO "$GREEN[+] afl-cmin.bash correctly minimized the number of testcases" ;; + *) $ECHO "$RED[!] afl-cmin.bash did not correctly minimize the number of testcases ($CNT)" CODE=1 ;; esac @@ -193,7 +214,7 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && { echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 test -e test-instr.plain.0 -a -e test-instr.plain.1 && { - diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { + diff test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { $ECHO "$RED[!] llvm_mode instrumentation should be different on different input but is not" CODE=1 } || { @@ -216,7 +237,7 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && { CODE=1 } test -e test-compcov.harden && { - grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && { + grep -Eq 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && { $ECHO "$GREEN[+] llvm_mode hardened mode succeeded and is working" } || { $ECHO "$RED[!] llvm_mode hardened mode is not hardened" @@ -253,14 +274,24 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && { $ECHO "$RED[!] afl-fuzz is not working correctly with llvm_mode" CODE=1 } - test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" || { + test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc" || { echo 000000000000000000000000 > in/in2 + echo 111 > in/in3 mkdir -p in2 - ../afl-cmin -i in -o in2 -- ./test-instr.plain @@ >/dev/null - CNT=`ls in2/ | wc -l` + ../afl-cmin -i in -o in2 -- ./test-instr.plain >/dev/null 2>&1 # why is afl-forkserver writing to stderr? + CNT=`ls in2/* 2>/dev/null | wc -l` + case "$CNT" in + *2) $ECHO "$GREEN[+] afl-cmin correctly minimized the number of testcases" ;; + *) $ECHO "$RED[!] afl-cmin did not correctly minimize the number of testcases ($CNT)" + CODE=1 + ;; + esac + rm -f in2/in* + AFL_PATH=`pwd`/.. ../afl-cmin.bash -i in -o in2 -- ./test-instr.plain >/dev/null + CNT=`ls in2/* 2>/dev/null | wc -l` case "$CNT" in - *1) $ECHO "$GREEN[+] afl-cmin correctly minimized the number of testcases" ;; - *) $ECHO "$RED[!] afl-cmin did not correctly minimize the number of testcases" + *2) $ECHO "$GREEN[+] afl-cmin.bash correctly minimized the number of testcases" ;; + *) $ECHO "$RED[!] afl-cmin.bash did not correctly minimize the number of testcases ($CNT)" CODE=1 ;; esac @@ -346,7 +377,7 @@ test -e ../afl-gcc-fast -a -e ../afl-gcc-rt.o && { echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain.gccpi > /dev/null 2>&1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain.gccpi < /dev/null > /dev/null 2>&1 test -e test-instr.plain.0 -a -e test-instr.plain.1 && { - diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { + diff test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { $ECHO "$RED[!] gcc_plugin instrumentation should be different on different input but is not" CODE=1 } || { @@ -371,7 +402,7 @@ test -e ../afl-gcc-fast -a -e ../afl-gcc-rt.o && { } test -e test-compcov.harden.gccpi && { - grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden.gccpi > /dev/null 2>&1 && { + grep -Eq 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden.gccpi > /dev/null 2>&1 && { $ECHO "$GREEN[+] gcc_plugin hardened mode succeeded and is working" } || { $ECHO "$RED[!] gcc_plugin hardened mode is not hardened" @@ -563,7 +594,7 @@ test -e ../afl-qemu-trace && { } rm -f errors - test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" && { + test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc" && { $ECHO "$GREY[*] running afl-fuzz for persistent qemu_mode, this will take approx 10 seconds" { export AFL_QEMU_PERSISTENT_ADDR=`expr 0x4$(nm test-instr | grep "T main" | awk '{print $1}' | sed 's/^.......//')` diff --git a/unicorn_mode/README.md b/unicorn_mode/README.md index 07dca451..86683839 100644 --- a/unicorn_mode/README.md +++ b/unicorn_mode/README.md @@ -28,8 +28,10 @@ First, make afl++ as usual. Once that completes successfully you need to build and add in the Unicorn Mode features: - $ cd unicorn_mode - $ ./build_unicorn_support.sh +``` +$ cd unicorn_mode +$ ./build_unicorn_support.sh +``` NOTE: This script checks out a Unicorn Engine fork as submodule that has been tested and is stable-ish, based on the unicorn engine master. @@ -68,7 +70,9 @@ To really use unicorn-mode effectively you need to prepare the following: Once you have all those things ready to go you just need to run afl-fuzz in 'unicorn-mode' by passing in the '-U' flag: - $ afl-fuzz -U -m none -i /path/to/inputs -o /path/to/results -- ./test_harness @@ +``` +$ afl-fuzz -U -m none -i /path/to/inputs -o /path/to/results -- ./test_harness @@ +``` The normal afl-fuzz command line format applies to everything here. Refer to AFL's main documentation for more info about how to use afl-fuzz effectively. @@ -77,14 +81,14 @@ For a much clearer vision of what all of this looks like, please refer to the sample provided in the 'unicorn_mode/samples' directory. There is also a blog post that goes over the basics at: -https://medium.com/@njvoss299/afl-unicorn-fuzzing-arbitrary-binary-code-563ca28936bf +[https://medium.com/@njvoss299/afl-unicorn-fuzzing-arbitrary-binary-code-563ca28936bf](https://medium.com/@njvoss299/afl-unicorn-fuzzing-arbitrary-binary-code-563ca28936bf) The 'helper_scripts' directory also contains several helper scripts that allow you to dump context from a running process, load it, and hook heap allocations. For details on how to use this check out the follow-up blog post to the one linked above. A example use of AFL-Unicorn mode is discussed in the paper Unicorefuzz: -https://www.usenix.org/conference/woot19/presentation/maier +[https://www.usenix.org/conference/woot19/presentation/maier](https://www.usenix.org/conference/woot19/presentation/maier) ## 3) Options @@ -92,10 +96,11 @@ As for the QEMU-based instrumentation, the afl-unicorn twist of afl++ comes with a sub-instruction based instrumentation similar in purpose to laf-intel. The options that enable Unicorn CompareCoverage are the same used for QEMU. -AFL_COMPCOV_LEVEL=1 is to instrument comparisons with only immediate -values. AFL_COMPCOV_LEVEL=2 instruments all -comparison instructions. Comparison instructions are currently instrumented only -for the x86, x86_64 and ARM targets. +AFL_COMPCOV_LEVEL=1 is to instrument comparisons with only immediate values. + +AFL_COMPCOV_LEVEL=2 instruments all comparison instructions. + +Comparison instructions are currently instrumented only for the x86, x86_64 and ARM targets. ## 4) Gotchas, feedback, bugs @@ -114,6 +119,6 @@ unicornafl.monkeypatch() This will replace all unicorn imports with unicornafl inputs. -Refer to the unicorn_mode/samples/arm_example/arm_tester.c for an example +Refer to the [samples/arm_example/arm_tester.c](samples/arm_example/arm_tester.c) for an example of how to do this properly! If you don't get this right, AFL will not load any mutated inputs and your fuzzing will be useless! diff --git a/unicorn_mode/build_unicorn_support.sh b/unicorn_mode/build_unicorn_support.sh index 582e0669..ecd80d95 100755 --- a/unicorn_mode/build_unicorn_support.sh +++ b/unicorn_mode/build_unicorn_support.sh @@ -81,6 +81,7 @@ if [ "$PLT" = "FreeBSD" ]; then MAKECMD=gmake CORES=`sysctl -n hw.ncpu` TARCMD=gtar + PYTHONBIN=python3 fi if [ "$PLT" = "NetBSD" ] || [ "$PLT" = "OpenBSD" ]; then @@ -126,7 +127,14 @@ echo "[+] All checks passed!" echo "[*] Making sure unicornafl is checked out" rm -rf unicornafl # workaround for travis ... sadly ... #test -d unicorn && { cd unicorn && { git stash ; git pull ; cd .. ; } } -test -d unicornafl || git clone https://github.com/vanhauser-thc/unicornafl +test -d unicornafl || { + CNT=1 + while [ '!' -d unicornafl -a "$CNT" -lt 4 ]; do + echo "Trying to clone unicornafl (attempt $CNT/3)" + git clone https://github.com/vanhauser-thc/unicornafl + CNT=`expr "$CNT" + 1` + done +} test -d unicornafl || { echo "[-] not checked out, please install git or check your internet connection." ; exit 1 ; } echo "[+] Got unicornafl." |