aboutsummaryrefslogtreecommitdiff
path: root/examples/aflpp_driver
diff options
context:
space:
mode:
Diffstat (limited to 'examples/aflpp_driver')
-rw-r--r--examples/aflpp_driver/GNUmakefile22
-rw-r--r--examples/aflpp_driver/aflpp_driver.c (renamed from examples/aflpp_driver/aflpp_driver.cpp)226
-rw-r--r--examples/aflpp_driver/aflpp_driver_test.c25
-rw-r--r--examples/aflpp_driver/aflpp_driver_test.cpp22
4 files changed, 162 insertions, 133 deletions
diff --git a/examples/aflpp_driver/GNUmakefile b/examples/aflpp_driver/GNUmakefile
index a993c8a9..b118a8b5 100644
--- a/examples/aflpp_driver/GNUmakefile
+++ b/examples/aflpp_driver/GNUmakefile
@@ -7,25 +7,25 @@ ifneq "" "$(LLVM_BINDIR)"
LLVM_BINDIR := $(LLVM_BINDIR)/
endif
-FLAGS=-O3 -funroll-loops -g
+CFLAGS := -O3 -funroll-loops -g
all: libAFLDriver.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so
-aflpp_driver.o: aflpp_driver.cpp
- $(LLVM_BINDIR)clang++ $(FLAGS) -stdlib=libc++ -std=c++11 -c aflpp_driver.cpp
+aflpp_driver.o: aflpp_driver.c
+ $(LLVM_BINDIR)clang -I. -I../../include $(CFLAGS) -c aflpp_driver.c
libAFLDriver.a: aflpp_driver.o
ar ru libAFLDriver.a aflpp_driver.o
debug:
- $(LLVM_BINDIR)clang++ -Wno-deprecated -I../../include $(FLAGS) -D_DEBUG=\"1\" -c -o afl-performance.o ../../src/afl-performance.c
- $(LLVM_BINDIR)clang++ -I../../include -D_DEBUG=\"1\" -g -stdlib=libc++ -funroll-loops -std=c++11 -c aflpp_driver.cpp
- #$(LLVM_BINDIR)clang++ -S -emit-llvm -Wno-deprecated -I../../include $(FLAGS) -D_DEBUG=\"1\" -c -o afl-performance.ll ../../src/afl-performance.c
- #$(LLVM_BINDIR)clang++ -S -emit-llvm -I../../include -D_DEBUG=\"1\" -g -stdlib=libc++ -funroll-loops -std=c++11 -c aflpp_driver.cpp
+ $(LLVM_BINDIR)clang -Wno-deprecated -I../../include $(CFLAGS) -D_DEBUG=\"1\" -c -o afl-performance.o ../../src/afl-performance.c
+ $(LLVM_BINDIR)clang -I../../include -D_DEBUG=\"1\" -g -funroll-loops -c aflpp_driver.c
+ #$(LLVM_BINDIR)clang -S -emit-llvm -Wno-deprecated -I../../include $(CFLAGS) -D_DEBUG=\"1\" -c -o afl-performance.ll ../../src/afl-performance.c
+ #$(LLVM_BINDIR)clang -S -emit-llvm -I../../include -D_DEBUG=\"1\" -g -funroll-loops -c aflpp_driver.c
ar ru libAFLDriver.a afl-performance.o aflpp_driver.o
aflpp_qemu_driver.o: aflpp_qemu_driver.c
- $(LLVM_BINDIR)clang $(FLAGS) -O0 -funroll-loops -c aflpp_qemu_driver.c
+ $(LLVM_BINDIR)clang $(CFLAGS) -O0 -funroll-loops -c aflpp_qemu_driver.c
libAFLQemuDriver.a: aflpp_qemu_driver.o
ar ru libAFLQemuDriver.a aflpp_qemu_driver.o
@@ -34,11 +34,11 @@ aflpp_qemu_driver_hook.so: aflpp_qemu_driver_hook.o
$(LLVM_BINDIR)clang -shared aflpp_qemu_driver_hook.o -o aflpp_qemu_driver_hook.so
aflpp_qemu_driver_hook.o: aflpp_qemu_driver_hook.c
- $(LLVM_BINDIR)clang -fPIC $(FLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c
+ $(LLVM_BINDIR)clang -fPIC $(CFLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c
test: debug
- #clang++ -S -emit-llvm -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -stdlib=libc++ -funroll-loops -std=c++11 -o aflpp_driver_test.ll aflpp_driver_test.cpp
- afl-clang-fast++ -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -stdlib=libc++ -funroll-loops -std=c++11 -o aflpp_driver_test aflpp_driver_test.cpp libAFLDriver.a
+ #clang -S -emit-llvm -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -funroll-loops -o aflpp_driver_test.ll aflpp_driver_test.c
+ afl-clang-fast -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -funroll-loops -o aflpp_driver_test aflpp_driver_test.c libAFLDriver.a afl-performance.o
clean:
rm -f *.o libAFLDriver*.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so *~ core aflpp_driver_test
diff --git a/examples/aflpp_driver/aflpp_driver.cpp b/examples/aflpp_driver/aflpp_driver.c
index d6163bdf..86c7a69f 100644
--- a/examples/aflpp_driver/aflpp_driver.cpp
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -14,12 +14,15 @@ cat << EOF > test_fuzzer.cc
#include <stddef.h>
#include <stdint.h>
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+
if (size > 0 && data[0] == 'H')
if (size > 1 && data[1] == 'I')
if (size > 2 && data[2] == '!')
__builtin_trap();
return 0;
+
}
+
EOF
# Build your target with -fsanitize-coverage=trace-pc-guard using fresh clang.
clang -g -fsanitize-coverage=trace-pc-guard test_fuzzer.cc -c
@@ -49,188 +52,195 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
+#include <limits.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
-#include <fstream>
-#include <iostream>
-#include <vector>
+#include "config.h"
#ifdef _DEBUG
-#include "hash.h"
+ #include "hash.h"
#endif
// Platform detection. Copied from FuzzerInternal.h
#ifdef __linux__
-#define LIBFUZZER_LINUX 1
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
+ #define LIBFUZZER_LINUX 1
+ #define LIBFUZZER_APPLE 0
+ #define LIBFUZZER_NETBSD 0
+ #define LIBFUZZER_FREEBSD 0
+ #define LIBFUZZER_OPENBSD 0
#elif __APPLE__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 1
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
+ #define LIBFUZZER_LINUX 0
+ #define LIBFUZZER_APPLE 1
+ #define LIBFUZZER_NETBSD 0
+ #define LIBFUZZER_FREEBSD 0
+ #define LIBFUZZER_OPENBSD 0
#elif __NetBSD__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 1
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
+ #define LIBFUZZER_LINUX 0
+ #define LIBFUZZER_APPLE 0
+ #define LIBFUZZER_NETBSD 1
+ #define LIBFUZZER_FREEBSD 0
+ #define LIBFUZZER_OPENBSD 0
#elif __FreeBSD__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 1
-#define LIBFUZZER_OPENBSD 0
+ #define LIBFUZZER_LINUX 0
+ #define LIBFUZZER_APPLE 0
+ #define LIBFUZZER_NETBSD 0
+ #define LIBFUZZER_FREEBSD 1
+ #define LIBFUZZER_OPENBSD 0
#elif __OpenBSD__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 1
+ #define LIBFUZZER_LINUX 0
+ #define LIBFUZZER_APPLE 0
+ #define LIBFUZZER_NETBSD 0
+ #define LIBFUZZER_FREEBSD 0
+ #define LIBFUZZER_OPENBSD 1
#else
-#error "Support for your platform has not been implemented"
+ #error "Support for your platform has not been implemented"
#endif
-int __afl_sharedmem_fuzzing = 1;
-extern unsigned int *__afl_fuzz_len;
+int __afl_sharedmem_fuzzing = 1;
+extern unsigned int * __afl_fuzz_len;
extern unsigned char *__afl_fuzz_ptr;
// libFuzzer interface is thin, so we don't include any libFuzzer headers.
-extern "C" {
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
__attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
-}
// Notify AFL about persistent mode.
static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##";
-extern "C" int __afl_persistent_loop(unsigned int);
-static volatile char suppress_warning2 = AFL_PERSISTENT[0];
+int __afl_persistent_loop(unsigned int);
// Notify AFL about deferred forkserver.
static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
-extern "C" void __afl_manual_init();
-static volatile char suppress_warning1 = AFL_DEFER_FORKSVR[0];
-
-// Input buffer.
-static const size_t kMaxAflInputSize = 1 << 20;
-static uint8_t AflInputBuf[kMaxAflInputSize];
+void __afl_manual_init();
// Use this optionally defined function to output sanitizer messages even if
// user asks to close stderr.
-__attribute__((weak)) extern "C" void __sanitizer_set_report_fd(void *);
+__attribute__((weak)) void __sanitizer_set_report_fd(void *);
// Keep track of where stderr content is being written to, so that
// dup_and_close_stderr can use the correct one.
-static FILE *output_file = stderr;
+static FILE *output_file;
// Experimental feature to use afl_driver without AFL's deferred mode.
// Needs to run before __afl_auto_init.
__attribute__((constructor(0))) static void __decide_deferred_forkserver(void) {
+
if (getenv("AFL_DRIVER_DONT_DEFER")) {
+
if (unsetenv("__AFL_DEFER_FORKSRV")) {
+
perror("Failed to unset __AFL_DEFER_FORKSRV");
abort();
+
}
+
}
+
}
// If the user asks us to duplicate stderr, then do it.
static void maybe_duplicate_stderr() {
+
char *stderr_duplicate_filename =
getenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
- if (!stderr_duplicate_filename)
- return;
+ if (!stderr_duplicate_filename) return;
FILE *stderr_duplicate_stream =
freopen(stderr_duplicate_filename, "a+", stderr);
if (!stderr_duplicate_stream) {
+
fprintf(
stderr,
"Failed to duplicate stderr to AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
abort();
+
}
+
output_file = stderr_duplicate_stream;
+
}
// Most of these I/O functions were inspired by/copied from libFuzzer's code.
static void discard_output(int fd) {
+
FILE *temp = fopen("/dev/null", "w");
- if (!temp)
- abort();
+ if (!temp) abort();
dup2(fileno(temp), fd);
fclose(temp);
+
}
-static void close_stdout() { discard_output(STDOUT_FILENO); }
+static void close_stdout() {
+
+ discard_output(STDOUT_FILENO);
+
+}
// Prevent the targeted code from writing to "stderr" but allow sanitizers and
// this driver to do so.
static void dup_and_close_stderr() {
+
int output_fileno = fileno(output_file);
int output_fd = dup(output_fileno);
- if (output_fd <= 0)
- abort();
+ if (output_fd <= 0) abort();
FILE *new_output_file = fdopen(output_fd, "w");
- if (!new_output_file)
- abort();
- if (!__sanitizer_set_report_fd)
- return;
- __sanitizer_set_report_fd(reinterpret_cast<void *>(output_fd));
+ if (!new_output_file) abort();
+ if (!__sanitizer_set_report_fd) return;
+ __sanitizer_set_report_fd((void *)output_fd);
discard_output(output_fileno);
-}
-static void Printf(const char *Fmt, ...) {
- va_list ap;
- va_start(ap, Fmt);
- vfprintf(output_file, Fmt, ap);
- va_end(ap);
- fflush(output_file);
}
// Close stdout and/or stderr if user asks for it.
static void maybe_close_fd_mask() {
+
char *fd_mask_str = getenv("AFL_DRIVER_CLOSE_FD_MASK");
- if (!fd_mask_str)
- return;
+ if (!fd_mask_str) return;
int fd_mask = atoi(fd_mask_str);
- if (fd_mask & 2)
- dup_and_close_stderr();
- if (fd_mask & 1)
- close_stdout();
+ if (fd_mask & 2) dup_and_close_stderr();
+ if (fd_mask & 1) close_stdout();
+
}
// Define LLVMFuzzerMutate to avoid link failures for targets that use it
// with libFuzzer's LLVMFuzzerCustomMutator.
-extern "C" size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
- assert(false && "LLVMFuzzerMutate should not be called from afl_driver");
+size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
+
+ // assert(false && "LLVMFuzzerMutate should not be called from afl_driver");
return 0;
+
}
// Execute any files provided as parameters.
static int ExecuteFilesOnyByOne(int argc, char **argv) {
+
+ unsigned char *buf = malloc(MAX_FILE);
for (int i = 1; i < argc; i++) {
- std::ifstream in(argv[i], std::ios::binary);
- in.seekg(0, in.end);
- size_t length = in.tellg();
- in.seekg (0, in.beg);
- std::cout << "Reading " << length << " bytes from " << argv[i] << std::endl;
- // Allocate exactly length bytes so that we reliably catch buffer overflows.
- std::vector<char> bytes(length);
- in.read(bytes.data(), bytes.size());
- assert(in);
- LLVMFuzzerTestOneInput(reinterpret_cast<const uint8_t *>(bytes.data()),
- bytes.size());
- std::cout << "Execution successful" << std::endl;
+
+ int fd = open(argv[i], O_RDONLY);
+ if (fd == -1) continue;
+ ssize_t length = read(fd, buf, MAX_FILE);
+ if (length > 0) {
+
+ printf("Reading %zu bytes from %s\n", length, argv[i]);
+ LLVMFuzzerTestOneInput(buf, length);
+ printf("Execution successful.\n");
+
+ }
+
}
+
+ free(buf);
return 0;
+
}
int main(int argc, char **argv) {
- Printf(
+
+ printf(
"======================= INFO =========================\n"
"This binary is built for AFL-fuzz.\n"
"To run the target function on individual input(s) execute this:\n"
@@ -242,32 +252,39 @@ int main(int argc, char **argv) {
"afl-fuzz will run N iterations before "
"re-spawning the process (default: 1000)\n"
"======================================================\n",
- argv[0], argv[0], argv[0]);
+ argv[0], argv[0], argv[0]);
+ output_file = stderr;
maybe_duplicate_stderr();
maybe_close_fd_mask();
- if (LLVMFuzzerInitialize)
- LLVMFuzzerInitialize(&argc, &argv);
+ if (LLVMFuzzerInitialize) LLVMFuzzerInitialize(&argc, &argv);
+
// Do any other expensive one-time initialization here.
- uint8_t dummy_input[1] = {0};
- int N = 100000;
+ uint8_t dummy_input[64] = {0};
+ memcpy(dummy_input, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
+ memcpy(dummy_input + 32, (void *)AFL_DEFER_FORKSVR,
+ sizeof(AFL_DEFER_FORKSVR));
+ int N = INT_MAX;
if (argc == 2 && argv[1][0] == '-')
- N = atoi(argv[1] + 1);
- else if(argc == 2 && (N = atoi(argv[1])) > 0)
- Printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
+ N = atoi(argv[1] + 1);
+ else if (argc == 2 && (N = atoi(argv[1])) > 0)
+ printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
else if (argc > 1) {
-// if (!getenv("AFL_DRIVER_DONT_DEFER")) {
- __afl_sharedmem_fuzzing = 0;
- __afl_manual_init();
-// }
+
+ // if (!getenv("AFL_DRIVER_DONT_DEFER")) {
+
+ __afl_sharedmem_fuzzing = 0;
+ __afl_manual_init();
+ // }
return ExecuteFilesOnyByOne(argc, argv);
exit(0);
+
}
assert(N > 0);
-// if (!getenv("AFL_DRIVER_DONT_DEFER"))
+ // if (!getenv("AFL_DRIVER_DONT_DEFER"))
__afl_manual_init();
// Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
@@ -276,17 +293,26 @@ int main(int argc, char **argv) {
int num_runs = 0;
while (__afl_persistent_loop(N)) {
+
#ifdef _DEBUG
- fprintf(stderr, "CLIENT crc: %016llx len: %u\n", hash64(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705), *__afl_fuzz_len);
+ fprintf(stderr, "CLIENT crc: %016llx len: %u\n",
+ hash64(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705),
+ *__afl_fuzz_len);
fprintf(stderr, "RECV:");
for (int i = 0; i < *__afl_fuzz_len; i++)
fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
- fprintf(stderr,"\n");
+ fprintf(stderr, "\n");
#endif
if (*__afl_fuzz_len) {
+
num_runs++;
LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
+
}
+
}
- Printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);
+
+ printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);
+
}
+
diff --git a/examples/aflpp_driver/aflpp_driver_test.c b/examples/aflpp_driver/aflpp_driver_test.c
new file mode 100644
index 00000000..e4567bbf
--- /dev/null
+++ b/examples/aflpp_driver/aflpp_driver_test.c
@@ -0,0 +1,25 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+
+#include "hash.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+
+ fprintf(stderr, "FUNC crc: %016llx len: %lu\n",
+ hash64((u8 *)Data, (unsigned int)Size,
+ (unsigned long long int)0xa5b35705),
+ Size);
+
+ if (Size < 5) return 0;
+
+ if (Data[0] == 'F')
+ if (Data[1] == 'A')
+ if (Data[2] == '$')
+ if (Data[3] == '$')
+ if (Data[4] == '$') abort();
+
+ return 0;
+
+}
+
diff --git a/examples/aflpp_driver/aflpp_driver_test.cpp b/examples/aflpp_driver/aflpp_driver_test.cpp
deleted file mode 100644
index 13dc09b9..00000000
--- a/examples/aflpp_driver/aflpp_driver_test.cpp
+++ /dev/null
@@ -1,22 +0,0 @@
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdint.h>
-#include "hash.h"
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
-
- fprintf(stderr, "FUNC crc: %016llx len: %lu\n", hash64((u8*)Data, (unsigned int) Size, (unsigned long long int) 0xa5b35705), Size);
-
- if (Size < 5)
- return 0;
-
- if (Data[0] == 'F')
- if (Data[1] == 'A')
- if (Data[2] == '$')
- if (Data[3] == '$')
- if (Data[4] == '$')
- abort();
-
- return 0;
-
-}
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-20 09:11:36 +0000