diff options
Diffstat (limited to 'qemu_mode/libcompcov')
| -rw-r--r-- | qemu_mode/libcompcov/README.md | 12 | ||||
| -rw-r--r-- | qemu_mode/libcompcov/libcompcov.so.c | 27 |
2 files changed, 33 insertions, 6 deletions
diff --git a/qemu_mode/libcompcov/README.md b/qemu_mode/libcompcov/README.md index fca20a69..bb010d8f 100644 --- a/qemu_mode/libcompcov/README.md +++ b/qemu_mode/libcompcov/README.md @@ -18,12 +18,12 @@ and this module is not capable to log the coverage in this case. If you have the source code of the fuzzing target you should nto use this library and QEMU but build it with afl-clang-fast and the laf-intel options. -To use this library make sure to preload it with AFL_PRELOAD. +To use this library, make sure to preload it with AFL_PRELOAD. ``` export AFL_PRELOAD=/path/to/libcompcov.so export AFL_COMPCOV_LEVEL=1 - + afl-fuzz -Q -i input -o output <your options> -- <target args> ``` @@ -31,7 +31,7 @@ The AFL_COMPCOV_LEVEL tells to QEMU and libcompcov how to log comaprisons. Level 1 logs just comparison with immediates / read-only memory and level 2 logs all the comparisons. -The library make use of https://github.com/ouadev/proc_maps_parser and so it is -Linux specific. However this is not a strict dependency, other UNIX operating -systems can be supported simply replacing the code related to the -/proc/self/maps parsing. +The library makes use of https://github.com/ouadev/proc_maps_parser and so it is +Linux specific. However, this is not a strict dependency, other UNIX operating +systems can be supported by replacing the code related to the /proc/self/maps +parsing. \ No newline at end of file diff --git a/qemu_mode/libcompcov/libcompcov.so.c b/qemu_mode/libcompcov/libcompcov.so.c index 4fc84e62..eba3d80a 100644 --- a/qemu_mode/libcompcov/libcompcov.so.c +++ b/qemu_mode/libcompcov/libcompcov.so.c @@ -41,6 +41,13 @@ #error "Sorry, this library is Linux-specific for now!" #endif /* !__linux__ */ +#ifndef likely + #define likely(x) __builtin_expect((!!(x)), 1) +#endif +#ifndef unlikely + #define unlikely(x) __builtin_expect((!!(x)), 0) +#endif + /* Change this value to tune the compare coverage */ #define MAX_CMP_LENGTH 32 @@ -199,6 +206,7 @@ static u8 __compcov_is_in_bound(const void *ptr) { int strcmp(const char *str1, const char *str2) { + if (unlikely(!__libc_strcmp)) { __libc_strcmp = dlsym(RTLD_NEXT, "strcmp"); } void *retaddr = __builtin_return_address(0); if (__compcov_is_in_bound(retaddr) && @@ -227,6 +235,12 @@ int strcmp(const char *str1, const char *str2) { int strncmp(const char *str1, const char *str2, size_t len) { + if (unlikely(!__libc_strncmp)) { + + __libc_strncmp = dlsym(RTLD_NEXT, "strncmp"); + + } + void *retaddr = __builtin_return_address(0); if (__compcov_is_in_bound(retaddr) && @@ -256,6 +270,12 @@ int strncmp(const char *str1, const char *str2, size_t len) { int strcasecmp(const char *str1, const char *str2) { + if (unlikely(!__libc_strcasecmp)) { + + __libc_strncasecmp = dlsym(RTLD_NEXT, "strcasecmp"); + + } + void *retaddr = __builtin_return_address(0); if (__compcov_is_in_bound(retaddr) && @@ -286,6 +306,12 @@ int strcasecmp(const char *str1, const char *str2) { int strncasecmp(const char *str1, const char *str2, size_t len) { + if (unlikely(!__libc_strncasecmp)) { + + __libc_strncasecmp = dlsym(RTLD_NEXT, "strncasecmp"); + + } + void *retaddr = __builtin_return_address(0); if (__compcov_is_in_bound(retaddr) && @@ -317,6 +343,7 @@ int strncasecmp(const char *str1, const char *str2, size_t len) { int memcmp(const void *mem1, const void *mem2, size_t len) { + if (unlikely(!__libc_memcmp)) { __libc_memcmp = dlsym(RTLD_NEXT, "memcmp"); } void *retaddr = __builtin_return_address(0); if (__compcov_is_in_bound(retaddr) && |