aboutsummaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
Diffstat (limited to 'include')
-rw-r--r--include/afl-fuzz.h20
-rw-r--r--include/alloc-inl.h18
-rw-r--r--include/config.h19
-rw-r--r--include/coverage-32.h112
-rw-r--r--include/coverage-64.h189
-rw-r--r--include/debug.h78
-rw-r--r--include/envs.h6
-rw-r--r--include/forkserver.h2
8 files changed, 422 insertions, 22 deletions
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 2f2d31d3..e2fb0344 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -134,6 +134,12 @@
// Little helper to access the ptr to afl->##name_buf - for use in afl_realloc.
#define AFL_BUF_PARAM(name) ((void **)&afl->name##_buf)
+#ifdef WORD_SIZE_64
+ #define AFL_RAND_RETURN u64
+#else
+ #define AFL_RAND_RETURN u32
+#endif
+
extern s8 interesting_8[INTERESTING_8_LEN];
extern s16 interesting_16[INTERESTING_8_LEN + INTERESTING_16_LEN];
extern s32
@@ -580,7 +586,7 @@ typedef struct afl_state {
u32 rand_cnt; /* Random number counter */
- u64 rand_seed[4];
+ u64 rand_seed[3];
s64 init_seed;
u64 total_cal_us, /* Total calibration time (us) */
@@ -1014,12 +1020,12 @@ void write_bitmap(afl_state_t *);
u32 count_bits(afl_state_t *, u8 *);
u32 count_bytes(afl_state_t *, u8 *);
u32 count_non_255_bytes(afl_state_t *, u8 *);
-#ifdef WORD_SIZE_64
-void simplify_trace(afl_state_t *, u64 *);
+void simplify_trace(afl_state_t *, u8 *);
void classify_counts(afl_forkserver_t *);
+#ifdef WORD_SIZE_64
+void discover_word(u8 *ret, u64 *current, u64 *virgin);
#else
-void simplify_trace(afl_state_t *, u32 *);
-void classify_counts(afl_forkserver_t *);
+void discover_word(u8 *ret, u32 *current, u32 *virgin);
#endif
void init_count_class16(void);
void minimize_bits(afl_state_t *, u8 *, u8 *);
@@ -1028,6 +1034,7 @@ u8 *describe_op(afl_state_t *, u8, size_t);
#endif
u8 save_if_interesting(afl_state_t *, void *, u32, u8);
u8 has_new_bits(afl_state_t *, u8 *);
+u8 has_new_bits_unclassified(afl_state_t *, u8 *);
/* Extras */
@@ -1111,8 +1118,7 @@ u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len);
u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
u64 exec_cksum);
-/* xoshiro256** */
-uint64_t rand_next(afl_state_t *afl);
+AFL_RAND_RETURN rand_next(afl_state_t *afl);
/* probability between 0.0 and 1.0 */
double rand_next_percent(afl_state_t *afl);
diff --git a/include/alloc-inl.h b/include/alloc-inl.h
index 3044b7a0..8a91d196 100644
--- a/include/alloc-inl.h
+++ b/include/alloc-inl.h
@@ -271,7 +271,7 @@ static inline void *DFL_ck_alloc_nozero(u32 size) {
ret = malloc(size + ALLOC_OFF_TOTAL);
ALLOC_CHECK_RESULT(ret, size);
- ret += ALLOC_OFF_HEAD;
+ ret = (char *)ret + ALLOC_OFF_HEAD;
ALLOC_C1(ret) = ALLOC_MAGIC_C1;
ALLOC_S(ret) = size;
@@ -311,7 +311,7 @@ static inline void DFL_ck_free(void *mem) {
ALLOC_C1(mem) = ALLOC_MAGIC_F;
- free(mem - ALLOC_OFF_HEAD);
+ free((char *)mem - ALLOC_OFF_HEAD);
}
@@ -340,7 +340,7 @@ static inline void *DFL_ck_realloc(void *orig, u32 size) {
#endif /* !DEBUG_BUILD */
old_size = ALLOC_S(orig);
- orig -= ALLOC_OFF_HEAD;
+ orig = (char *)orig - ALLOC_OFF_HEAD;
ALLOC_CHECK_SIZE(old_size);
@@ -363,10 +363,10 @@ static inline void *DFL_ck_realloc(void *orig, u32 size) {
if (orig) {
- memcpy(ret + ALLOC_OFF_HEAD, orig + ALLOC_OFF_HEAD, MIN(size, old_size));
- memset(orig + ALLOC_OFF_HEAD, 0xFF, old_size);
+ memcpy((char *)ret + ALLOC_OFF_HEAD, (char *)orig + ALLOC_OFF_HEAD, MIN(size, old_size));
+ memset((char *)orig + ALLOC_OFF_HEAD, 0xFF, old_size);
- ALLOC_C1(orig + ALLOC_OFF_HEAD) = ALLOC_MAGIC_F;
+ ALLOC_C1((char *)orig + ALLOC_OFF_HEAD) = ALLOC_MAGIC_F;
free(orig);
@@ -374,13 +374,13 @@ static inline void *DFL_ck_realloc(void *orig, u32 size) {
#endif /* ^!DEBUG_BUILD */
- ret += ALLOC_OFF_HEAD;
+ ret = (char *)ret + ALLOC_OFF_HEAD;
ALLOC_C1(ret) = ALLOC_MAGIC_C1;
ALLOC_S(ret) = size;
ALLOC_C2(ret) = ALLOC_MAGIC_C2;
- if (size > old_size) memset(ret + old_size, 0, size - old_size);
+ if (size > old_size) memset((char *)ret + old_size, 0, size - old_size);
return ret;
@@ -401,7 +401,7 @@ static inline u8 *DFL_ck_strdup(u8 *str) {
ret = malloc(size + ALLOC_OFF_TOTAL);
ALLOC_CHECK_RESULT(ret, size);
- ret += ALLOC_OFF_HEAD;
+ ret = (char *)ret + ALLOC_OFF_HEAD;
ALLOC_C1(ret) = ALLOC_MAGIC_C1;
ALLOC_S(ret) = size;
diff --git a/include/config.h b/include/config.h
index 93249ed9..e8a49270 100644
--- a/include/config.h
+++ b/include/config.h
@@ -28,7 +28,7 @@
/* Version string: */
// c = release, d = volatile github dev, e = experimental branch
-#define VERSION "++3.00c"
+#define VERSION "++3.01a"
/******************************************************
* *
@@ -36,11 +36,28 @@
* *
******************************************************/
+/* console output colors: There are three ways to configure its behavior
+ * 1. default: colored outputs fixed on: defined USE_COLOR && defined
+ * ALWAYS_COLORED The env var. AFL_NO_COLOR will have no effect
+ * 2. defined USE_COLOR && !defined ALWAYS_COLORED
+ * -> depending on env var AFL_NO_COLOR=1 colors can be switched off
+ * at run-time. Default is to use colors.
+ * 3. colored outputs fixed off: !defined USE_COLOR
+ * The env var. AFL_NO_COLOR will have no effect
+ */
+
/* Comment out to disable terminal colors (note that this makes afl-analyze
a lot less nice): */
#define USE_COLOR
+#ifdef USE_COLOR
+ /* Comment in to always enable terminal colors */
+ /* Comment out to enable runtime controlled terminal colors via AFL_NO_COLOR
+ */
+ #define ALWAYS_COLORED 1
+#endif
+
/* StatsD config
Config can be adjusted via AFL_STATSD_HOST and AFL_STATSD_PORT environment
variable.
diff --git a/include/coverage-32.h b/include/coverage-32.h
new file mode 100644
index 00000000..a5cc498c
--- /dev/null
+++ b/include/coverage-32.h
@@ -0,0 +1,112 @@
+#include "config.h"
+#include "types.h"
+
+u32 skim(const u32 *virgin, const u32 *current, const u32 *current_end);
+u32 classify_word(u32 word);
+
+inline u32 classify_word(u32 word) {
+
+ u16 mem16[2];
+ memcpy(mem16, &word, sizeof(mem16));
+
+ mem16[0] = count_class_lookup16[mem16[0]];
+ mem16[1] = count_class_lookup16[mem16[1]];
+
+ memcpy(&word, mem16, sizeof(mem16));
+ return word;
+
+}
+
+void simplify_trace(afl_state_t *afl, u8 *bytes) {
+
+ u32 *mem = (u32 *)bytes;
+ u32 i = (afl->fsrv.map_size >> 2);
+
+ while (i--) {
+
+ /* Optimize for sparse bitmaps. */
+
+ if (unlikely(*mem)) {
+
+ u8 *mem8 = (u8 *)mem;
+
+ mem8[0] = simplify_lookup[mem8[0]];
+ mem8[1] = simplify_lookup[mem8[1]];
+ mem8[2] = simplify_lookup[mem8[2]];
+ mem8[3] = simplify_lookup[mem8[3]];
+
+ } else
+
+ *mem = 0x01010101;
+
+ mem++;
+
+ }
+
+}
+
+inline void classify_counts(afl_forkserver_t *fsrv) {
+
+ u32 *mem = (u32 *)fsrv->trace_bits;
+ u32 i = (fsrv->map_size >> 2);
+
+ while (i--) {
+
+ /* Optimize for sparse bitmaps. */
+
+ if (unlikely(*mem)) { *mem = classify_word(*mem); }
+
+ mem++;
+
+ }
+
+}
+
+/* Updates the virgin bits, then reflects whether a new count or a new tuple is
+ * seen in ret. */
+inline void discover_word(u8 *ret, u32 *current, u32 *virgin) {
+
+ /* Optimize for (*current & *virgin) == 0 - i.e., no bits in current bitmap
+ that have not been already cleared from the virgin map - since this will
+ almost always be the case. */
+
+ if (*current & *virgin) {
+
+ if (likely(*ret < 2)) {
+
+ u8 *cur = (u8 *)current;
+ u8 *vir = (u8 *)virgin;
+
+ /* Looks like we have not found any new bytes yet; see if any non-zero
+ bytes in current[] are pristine in virgin[]. */
+
+ if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) ||
+ (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff))
+ *ret = 2;
+ else
+ *ret = 1;
+
+ }
+
+ *virgin &= ~*current;
+
+ }
+
+}
+
+#define PACK_SIZE 16
+inline u32 skim(const u32 *virgin, const u32 *current, const u32 *current_end) {
+
+ for (; current != current_end; virgin += 4, current += 4) {
+
+ if (current[0] && classify_word(current[0]) & virgin[0]) return 1;
+ if (current[1] && classify_word(current[1]) & virgin[1]) return 1;
+ if (current[2] && classify_word(current[2]) & virgin[2]) return 1;
+ if (current[3] && classify_word(current[3]) & virgin[3]) return 1;
+
+ }
+
+ return 0;
+
+}
+
diff --git a/include/coverage-64.h b/include/coverage-64.h
new file mode 100644
index 00000000..0ede5fa5
--- /dev/null
+++ b/include/coverage-64.h
@@ -0,0 +1,189 @@
+#include "config.h"
+#include "types.h"
+
+#if (defined(__AVX512F__) && defined(__AVX512DQ__)) || defined(__AVX2__)
+ #include <immintrin.h>
+#endif
+
+u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end);
+u64 classify_word(u64 word);
+
+inline u64 classify_word(u64 word) {
+
+ u16 mem16[4];
+ memcpy(mem16, &word, sizeof(mem16));
+
+ mem16[0] = count_class_lookup16[mem16[0]];
+ mem16[1] = count_class_lookup16[mem16[1]];
+ mem16[2] = count_class_lookup16[mem16[2]];
+ mem16[3] = count_class_lookup16[mem16[3]];
+
+ memcpy(&word, mem16, sizeof(mem16));
+ return word;
+
+}
+
+void simplify_trace(afl_state_t *afl, u8 *bytes) {
+
+ u64 *mem = (u64 *)bytes;
+ u32 i = (afl->fsrv.map_size >> 3);
+
+ while (i--) {
+
+ /* Optimize for sparse bitmaps. */
+
+ if (unlikely(*mem)) {
+
+ u8 *mem8 = (u8 *)mem;
+
+ mem8[0] = simplify_lookup[mem8[0]];
+ mem8[1] = simplify_lookup[mem8[1]];
+ mem8[2] = simplify_lookup[mem8[2]];
+ mem8[3] = simplify_lookup[mem8[3]];
+ mem8[4] = simplify_lookup[mem8[4]];
+ mem8[5] = simplify_lookup[mem8[5]];
+ mem8[6] = simplify_lookup[mem8[6]];
+ mem8[7] = simplify_lookup[mem8[7]];
+
+ } else
+
+ *mem = 0x0101010101010101ULL;
+
+ mem++;
+
+ }
+
+}
+
+inline void classify_counts(afl_forkserver_t *fsrv) {
+
+ u64 *mem = (u64 *)fsrv->trace_bits;
+ u32 i = (fsrv->map_size >> 3);
+
+ while (i--) {
+
+ /* Optimize for sparse bitmaps. */
+
+ if (unlikely(*mem)) { *mem = classify_word(*mem); }
+
+ mem++;
+
+ }
+
+}
+
+/* Updates the virgin bits, then reflects whether a new count or a new tuple is
+ * seen in ret. */
+inline void discover_word(u8 *ret, u64 *current, u64 *virgin) {
+
+ /* Optimize for (*current & *virgin) == 0 - i.e., no bits in current bitmap
+ that have not been already cleared from the virgin map - since this will
+ almost always be the case. */
+
+ if (*current & *virgin) {
+
+ if (likely(*ret < 2)) {
+
+ u8 *cur = (u8 *)current;
+ u8 *vir = (u8 *)virgin;
+
+ /* Looks like we have not found any new bytes yet; see if any non-zero
+ bytes in current[] are pristine in virgin[]. */
+
+ if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) ||
+ (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff) ||
+ (cur[4] && vir[4] == 0xff) || (cur[5] && vir[5] == 0xff) ||
+ (cur[6] && vir[6] == 0xff) || (cur[7] && vir[7] == 0xff))
+ *ret = 2;
+ else
+ *ret = 1;
+
+ }
+
+ *virgin &= ~*current;
+
+ }
+
+}
+
+#if defined(__AVX512F__) && defined(__AVX512DQ__)
+ #define PACK_SIZE 64
+inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
+
+ for (; current != current_end; virgin += 8, current += 8) {
+
+ __m512i value = *(__m512i *)current;
+ __mmask8 mask = _mm512_testn_epi64_mask(value, value);
+
+ /* All bytes are zero. */
+ if (mask == 0xff) continue;
+
+ /* Look for nonzero bytes and check for new bits. */
+ #define UNROLL(x) \
+ if (!(mask & (1 << x)) && classify_word(current[x]) & virgin[x]) return 1
+ UNROLL(0);
+ UNROLL(1);
+ UNROLL(2);
+ UNROLL(3);
+ UNROLL(4);
+ UNROLL(5);
+ UNROLL(6);
+ UNROLL(7);
+ #undef UNROLL
+
+ }
+
+ return 0;
+
+}
+
+#endif
+
+#if !defined(PACK_SIZE) && defined(__AVX2__)
+ #define PACK_SIZE 32
+inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
+
+ __m256i zeroes = _mm256_setzero_si256();
+
+ for (; current != current_end; virgin += 4, current += 4) {
+
+ __m256i value = *(__m256i *)current;
+ __m256i cmp = _mm256_cmpeq_epi64(value, zeroes);
+ u32 mask = _mm256_movemask_epi8(cmp);
+
+ /* All bytes are zero. */
+ if (mask == (u32)-1) continue;
+
+ /* Look for nonzero bytes and check for new bits. */
+ if (!(mask & 0xff) && classify_word(current[0]) & virgin[0]) return 1;
+ if (!(mask & 0xff00) && classify_word(current[1]) & virgin[1]) return 1;
+ if (!(mask & 0xff0000) && classify_word(current[2]) & virgin[2]) return 1;
+ if (!(mask & 0xff000000) && classify_word(current[3]) & virgin[3]) return 1;
+
+ }
+
+ return 0;
+
+}
+
+#endif
+
+#if !defined(PACK_SIZE)
+ #define PACK_SIZE 32
+inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
+
+ for (; current != current_end; virgin += 4, current += 4) {
+
+ if (current[0] && classify_word(current[0]) & virgin[0]) return 1;
+ if (current[1] && classify_word(current[1]) & virgin[1]) return 1;
+ if (current[2] && classify_word(current[2]) & virgin[2]) return 1;
+ if (current[3] && classify_word(current[3]) & virgin[3]) return 1;
+
+ }
+
+ return 0;
+
+}
+
+#endif
+
diff --git a/include/debug.h b/include/debug.h
index 5512023c..7f4a6be1 100644
--- a/include/debug.h
+++ b/include/debug.h
@@ -168,12 +168,84 @@
* Debug & error macros *
************************/
-/* Just print stuff to the appropriate stream. */
+#if defined USE_COLOR && !defined ALWAYS_COLORED
+ #include <unistd.h>
+ #pragma GCC diagnostic ignored "-Wformat-security"
+static inline const char *colorfilter(const char *x) {
+
+ static int once = 1;
+ static int disabled = 0;
+
+ if (once) {
+
+ /* when there is no tty -> we always want filtering
+ * when AFL_NO_UI is set filtering depends on AFL_NO_COLOR
+ * otherwise we want always colors
+ */
+ disabled =
+ isatty(2) && (!getenv("AFL_NO_UI") ||
+ (!getenv("AFL_NO_COLOR") && !getenv("AFL_NO_COLOUR")));
+ once = 0;
+
+ }
+
+ if (likely(disabled)) return x;
+
+ static char monochromestring[4096];
+ char * d = monochromestring;
+ int in_seq = 0;
+
+ while (*x) {
+
+ if (in_seq && *x == 'm') {
+
+ in_seq = 0;
+
+ } else {
+ if (!in_seq && *x == '\x1b') { in_seq = 1; }
+ if (!in_seq) { *d++ = *x; }
+
+ }
+
+ ++x;
+
+ }
+
+ *d = '\0';
+ return monochromestring;
+
+}
+
+#else
+ #define colorfilter(x) x /* no filtering necessary */
+#endif
+
+/* macro magic to transform the first parameter to SAYF
+ * through colorfilter which strips coloring */
+#define GET_MACRO(_1, _2, _3, _4, _5, _6, _7, _8, _9, _10, _11, _12, _13, _14, \
+ _15, _16, _17, _18, _19, _20, _21, _22, _23, _24, _25, _26, \
+ _27, _28, _29, _30, _31, _32, _33, _34, _35, _36, _37, _38, \
+ _39, _40, NAME, ...) \
+ NAME
+
+#define SAYF(...) \
+ GET_MACRO(__VA_ARGS__, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+ SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+ SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+ SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+ SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+ SAYF_N, SAYF_1) \
+ (__VA_ARGS__)
+
+#define SAYF_1(x) MY_SAYF(colorfilter(x))
+#define SAYF_N(x, ...) MY_SAYF(colorfilter(x), __VA_ARGS__)
+
+/* Just print stuff to the appropriate stream. */
#ifdef MESSAGES_TO_STDOUT
- #define SAYF(x...) printf(x)
+ #define MY_SAYF(x...) printf(x)
#else
- #define SAYF(x...) fprintf(stderr, x)
+ #define MY_SAYF(x...) fprintf(stderr, x)
#endif /* ^MESSAGES_TO_STDOUT */
/* Show a prefixed warning. */
diff --git a/include/envs.h b/include/envs.h
index c0f41ca5..e4e49c4d 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -78,8 +78,8 @@ static char *afl_environment_variables[] = {
"AFL_LLVM_CTX",
"AFL_LLVM_DICT2FILE",
"AFL_LLVM_DOCUMENT_IDS",
- "AFL_LLVM_INSTRUMENT",
"AFL_LLVM_INSTRIM_LOOPHEAD",
+ "AFL_LLVM_INSTRUMENT",
"AFL_LLVM_LTO_AUTODICTIONARY",
"AFL_LLVM_AUTODICTIONARY",
"AFL_LLVM_SKIPSINGLEBLOCK",
@@ -103,6 +103,10 @@ static char *afl_environment_variables[] = {
"AFL_NO_ARITH",
"AFL_NO_AUTODICT",
"AFL_NO_BUILTIN",
+#if defined USE_COLOR && !defined ALWAYS_COLORED
+ "AFL_NO_COLOR",
+ "AFL_NO_COLOUR",
+#endif
"AFL_NO_CPU_RED",
"AFL_NO_FORKSRV",
"AFL_NO_UI",
diff --git a/include/forkserver.h b/include/forkserver.h
index 5d5c728f..8e029266 100644
--- a/include/forkserver.h
+++ b/include/forkserver.h
@@ -64,7 +64,7 @@ typedef struct afl_forkserver {
FILE *plot_file; /* Gnuplot output file */
- /* Note: lat_run_timed_out is u32 to send it to the child as 4 byte array */
+ /* Note: last_run_timed_out is u32 to send it to the child as 4 byte array */
u32 last_run_timed_out; /* Traced process timed out? */
u8 last_kill_signal; /* Signal that killed the child */
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-19 18:54:28 +0000