5 files changed, 425 insertions, 0 deletions
diff --git a/custom_mutators/symcc/Makefile b/custom_mutators/symcc/Makefile
new file mode 100644
index 00000000..7e2f7b4d
--- /dev/null
+++ b/custom_mutators/symcc/Makefile
@@ -0,0 +1,14 @@
+
+ifdef DEBUG
+  CFLAGS += -DDEBUG
+endif
+
+all: symcc-mutator.so
+
+CFLAGS	+= -O3 -funroll-loops
+
+symcc-mutator.so: symcc.c
+	$(CC) $(CFLAGS) $(CPPFLAGS) -g -I../../include -shared -fPIC -o symcc-mutator.so symcc.c
+
+clean:
+	rm -f symcc-mutator.so *.o *~ core
diff --git a/custom_mutators/symcc/README.md b/custom_mutators/symcc/README.md
new file mode 100644
index 00000000..337362ae
--- /dev/null
+++ b/custom_mutators/symcc/README.md
@@ -0,0 +1,15 @@
+# custum mutator: symcc
+
+This uses the excellent symcc to find new paths into the target.
+
+To use this custom mutator follow the steps in the symcc repository 
+[https://github.com/eurecom-s3/symcc/](https://github.com/eurecom-s3/symcc/) 
+on how to build symcc and how to instrument a target binary (the same target
+that you are fuzzing).
+
+The target program compiled with symcc has to be pointed to with the
+`SYMCC_TARGET` environment variable.
+
+just type `make` to build this custom mutator.
+
+```SYMCC_TARGET=/prg/to/symcc/compiled/target AFL_CUSTOM_MUTATOR_LIBRARY=custom_mutators/symcc/symcc-mutator.so afl-fuzz ...```
diff --git a/custom_mutators/symcc/symcc.c b/custom_mutators/symcc/symcc.c
new file mode 100644
index 00000000..a609dafb
--- /dev/null
+++ b/custom_mutators/symcc/symcc.c
@@ -0,0 +1,332 @@
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include "config.h"
+#include "debug.h"
+#include "afl-fuzz.h"
+#include "common.h"
+
+afl_state_t *afl_struct;
+
+#ifdef DEBUG
+  #define DBG(x...) fprintf(stderr, x)
+#else
+  #define DBG(x...) \
+    {}
+#endif
+
+typedef struct my_mutator {
+
+  afl_state_t *afl;
+  u8 *         mutator_buf;
+  u8 *         out_dir;
+  u8 *         tmp_dir;
+  u8 *         target;
+  uint32_t     seed;
+
+} my_mutator_t;
+
+my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
+
+  if (getenv("AFL_CUSTOM_MUTATOR_ONLY"))
+    FATAL("the symcc module cannot be used with AFL_CUSTOM_MUTATOR_ONLY.");
+
+  my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
+  if (!data) {
+
+    perror("afl_custom_init alloc");
+    return NULL;
+
+  }
+
+  if ((data->mutator_buf = malloc(MAX_FILE)) == NULL) {
+
+    free(data);
+    perror("mutator_buf alloc");
+    return NULL;
+
+  }
+
+  if (!(data->target = getenv("SYMCC_TARGET")))
+    FATAL(
+        "SYMCC_TARGET not defined, this should point to the full path of the "
+        "symcc compiled binary.");
+
+  if (!(data->out_dir = getenv("SYMCC_OUTPUT_DIR"))) {
+
+    data->out_dir = alloc_printf("%s/symcc", afl->out_dir);
+
+  }
+
+  data->tmp_dir = alloc_printf("%s/tmp", data->out_dir);
+  setenv("SYMCC_OUTPUT_DIR", data->tmp_dir, 1);
+  int pid = fork();
+
+  if (pid == -1) return NULL;
+
+  if (pid) pid = waitpid(pid, NULL, 0);
+
+  if (pid == 0) {
+
+    char *args[4];
+    args[0] = "/bin/rm";
+    args[1] = "-rf";
+    args[2] = data->out_dir;
+    args[3] = NULL;
+    execvp(args[0], args);
+    DBG("exec:FAIL\n");
+    exit(-1);
+
+  }
+
+  data->afl = afl;
+  data->seed = seed;
+  afl_struct = afl;
+
+  if (mkdir(data->out_dir, 0755))
+    PFATAL("Could not create directory %s", data->out_dir);
+
+  if (mkdir(data->tmp_dir, 0755))
+    PFATAL("Could not create directory %s", data->tmp_dir);
+
+  DBG("out_dir=%s, target=%s\n", data->out_dir, data->target);
+
+  return data;
+
+}
+
+/* When a new queue entry is added we run this input with the symcc
+   instrumented binary */
+void afl_custom_queue_new_entry(my_mutator_t * data,
+                                const uint8_t *filename_new_queue,
+                                const uint8_t *filename_orig_queue) {
+
+  int         pipefd[2];
+  struct stat st;
+  ACTF("Queueing to symcc: %s", filename_new_queue);
+  u8 *fn = alloc_printf("%s", filename_new_queue);
+  if (!(stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size)) {
+
+    ck_free(fn);
+    PFATAL("Couldn't find enqueued file: %s", fn);
+
+  }
+
+  if (afl_struct->fsrv.use_stdin) {
+
+    if (pipe(pipefd) == -1) {
+
+      ck_free(fn);
+      PFATAL("Couldn't create a pipe for interacting with symcc child process");
+
+    }
+
+  }
+
+  int pid = fork();
+
+  if (pid == -1) return;
+
+  if (pid) {
+
+    if (afl_struct->fsrv.use_stdin) {
+
+      close(pipefd[0]);
+      int fd = open(fn, O_RDONLY);
+
+      if (fd >= 0) {
+
+        ssize_t r = read(fd, data->mutator_buf, MAX_FILE);
+        DBG("fn=%s, fd=%d, size=%ld\n", fn, fd, r);
+        ck_free(fn);
+        close(fd);
+        if (r <= 0) {
+
+          close(pipefd[1]);
+          return;
+
+        }
+
+        if (r > fcntl(pipefd[1], F_GETPIPE_SZ))
+          fcntl(pipefd[1], F_SETPIPE_SZ, MAX_FILE);
+        ck_write(pipefd[1], data->mutator_buf, r, filename_new_queue);
+
+      } else {
+
+        ck_free(fn);
+        close(pipefd[1]);
+        PFATAL(
+            "Something happened to the enqueued file before sending its "
+            "contents to symcc binary");
+
+      }
+
+      close(pipefd[1]);
+
+    }
+
+    pid = waitpid(pid, NULL, 0);
+
+    // At this point we need to transfer files to output dir, since their names
+    // collide and symcc will just overwrite them
+
+    struct dirent **nl;
+    int32_t         items = scandir(data->tmp_dir, &nl, NULL, NULL);
+    u8 *            origin_name = basename(filename_new_queue);
+    int32_t         i;
+    if (items > 0) {
+
+      for (i = 0; i < (u32)items; ++i) {
+
+        struct stat st;
+        u8 *source_name = alloc_printf("%s/%s", data->tmp_dir, nl[i]->d_name);
+        DBG("test=%s\n", fn);
+        if (stat(source_name, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
+
+          u8 *destination_name =
+              alloc_printf("%s/%s.%s", data->out_dir, origin_name, nl[i]->d_name);
+          rename(source_name, destination_name);
+          ck_free(destination_name);
+          DBG("found=%s\n", source_name);
+
+        }
+
+        ck_free(source_name);
+        free(nl[i]);
+
+      }
+
+      free(nl);
+
+    }
+
+  }
+
+  if (pid == 0) {
+
+    if (afl_struct->fsrv.use_stdin) {
+
+      unsetenv("SYMCC_INPUT_FILE");
+      close(pipefd[1]);
+      dup2(pipefd[0], 0);
+
+    } else {
+
+      setenv("SYMCC_INPUT_FILE", afl_struct->fsrv.out_file, 1);
+
+    }
+
+    DBG("exec=%s\n", data->target);
+    close(1);
+    close(2);
+    dup2(afl_struct->fsrv.dev_null_fd, 1);
+    dup2(afl_struct->fsrv.dev_null_fd, 2);
+
+    execvp(data->target, afl_struct->argv);
+    DBG("exec=FAIL\n");
+    exit(-1);
+
+  }
+
+}
+
+uint32_t afl_custom_fuzz_count(my_mutator_t *data, const u8 *buf,
+                               size_t buf_size) {
+
+  uint32_t        count = 0, i;
+  struct dirent **nl;
+  int32_t         items = scandir(data->out_dir, &nl, NULL, NULL);
+
+  if (items > 0) {
+
+    for (i = 0; i < (u32)items; ++i) {
+
+      struct stat st;
+      u8 *        fn = alloc_printf("%s/%s", data->out_dir, nl[i]->d_name);
+      DBG("test=%s\n", fn);
+      if (stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
+
+        DBG("found=%s\n", fn);
+        count++;
+
+      }
+
+      ck_free(fn);
+      free(nl[i]);
+
+    }
+
+    free(nl);
+
+  }
+
+  DBG("dir=%s, count=%u\n", data->out_dir, count);
+  return count;
+
+}
+
+/* here we actually just read the files generated from symcc */
+size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
+                       u8 **out_buf, uint8_t *add_buf, size_t add_buf_size,
+                       size_t max_size) {
+
+  struct dirent **nl;
+  int32_t         i, done = 0, items = scandir(data->out_dir, &nl, NULL, NULL);
+  ssize_t         size = 0;
+
+  if (items <= 0) return 0;
+
+  for (i = 0; i < (u32)items; ++i) {
+
+    struct stat st;
+    u8 *        fn = alloc_printf("%s/%s", data->out_dir, nl[i]->d_name);
+
+    if (done == 0) {
+
+      if (stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
+
+        int fd = open(fn, O_RDONLY);
+
+        if (fd >= 0) {
+
+          size = read(fd, data->mutator_buf, max_size);
+          *out_buf = data->mutator_buf;
+
+          close(fd);
+          done = 1;
+
+        }
+
+      }
+
+      unlink(fn);
+
+    }
+
+    ck_free(fn);
+    free(nl[i]);
+
+  }
+
+  free(nl);
+  DBG("FUZZ size=%lu\n", size);
+  return (uint32_t)size;
+
+}
+
+/**
+ * Deinitialize everything
+ *
+ * @param data The data ptr from afl_custom_init
+ */
+void afl_custom_deinit(my_mutator_t *data) {
+
+  free(data->mutator_buf);
+  free(data);
+
+}
+
diff --git a/custom_mutators/symcc/test_examples/file_test.c b/custom_mutators/symcc/test_examples/file_test.c
new file mode 100644
index 00000000..f2b92986
--- /dev/null
+++ b/custom_mutators/symcc/test_examples/file_test.c
@@ -0,0 +1,36 @@
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <fcntl.h>
+
+int main(int argc, char **argv) {
+
+  if (argc < 2) {
+
+    printf("Need a file argument\n");
+    return 1;
+
+  }
+
+  int fd = open(argv[1], O_RDONLY);
+  if (fd < 0) {
+
+    printf("Couldn't open file\n");
+    return 1;
+
+  }
+
+  uint32_t value = 0;
+
+  read(fd, &value, sizeof(value));
+  close(fd);
+
+  value = value ^ 0xffffffff;
+  if (value == 0x11223344) printf("Value one\n");
+  if (value == 0x44332211) printf("Value two\n");
+  if (value != 0x0) printf("Not zero\n");
+  return 0;
+
+}
+
diff --git a/custom_mutators/symcc/test_examples/stdin_test.c b/custom_mutators/symcc/test_examples/stdin_test.c
new file mode 100644
index 00000000..3acfc523
--- /dev/null
+++ b/custom_mutators/symcc/test_examples/stdin_test.c
@@ -0,0 +1,28 @@
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+int main(int argc, char **argv) {
+
+  char     input_buffer[16];
+  uint32_t comparisonValue;
+  size_t   bytesRead;
+  bytesRead = read(STDIN_FILENO, input_buffer, sizeof(input_buffer));
+  if (bytesRead < 0) exit(-1);
+  comparisonValue = *(uint32_t *)input_buffer;
+  comparisonValue = comparisonValue ^ 0xff112233;
+  if (comparisonValue == 0x66554493) {
+
+    printf("First value\n");
+
+  } else {
+
+    if (comparisonValue == 0x84444415) printf("Second value\n");
+
+  }
+
+  return 0;
+
+}
+