diff options
Diffstat (limited to 'qemu_mode')
| -rw-r--r-- | qemu_mode/README.md (renamed from qemu_mode/README.qemu) | 62 | ||||
| -rwxr-xr-x | qemu_mode/build_qemu_support.sh | 21 | ||||
| -rw-r--r-- | qemu_mode/libcompcov/Makefile | 8 | ||||
| -rw-r--r-- | qemu_mode/libcompcov/README.md (renamed from qemu_mode/libcompcov/README.compcov) | 16 | ||||
| -rw-r--r-- | qemu_mode/libcompcov/compcovtest.cc | 32 | ||||
| -rw-r--r-- | qemu_mode/libcompcov/libcompcov.so.c | 213 | ||||
| -rw-r--r-- | qemu_mode/libcompcov/pmparser.h | 434 | ||||
| -rw-r--r-- | qemu_mode/patches/afl-qemu-common.h | 49 | ||||
| -rw-r--r-- | qemu_mode/patches/afl-qemu-cpu-inl.h | 184 | ||||
| -rw-r--r-- | qemu_mode/patches/afl-qemu-cpu-translate-inl.h | 110 | ||||
| -rw-r--r-- | qemu_mode/patches/afl-qemu-tcg-inl.h | 545 | ||||
| -rw-r--r-- | qemu_mode/patches/afl-qemu-translate-inl.h | 37 | ||||
| -rw-r--r-- | qemu_mode/patches/i386-translate.diff | 6 | ||||
| -rw-r--r-- | qemu_mode/patches/syscall.diff | 5 |
14 files changed, 1013 insertions, 709 deletions
diff --git a/qemu_mode/README.qemu b/qemu_mode/README.md index 124fce12..610f6860 100644 --- a/qemu_mode/README.qemu +++ b/qemu_mode/README.md @@ -1,11 +1,8 @@ -========================================================= -High-performance binary-only instrumentation for afl-fuzz -========================================================= +# High-performance binary-only instrumentation for afl-fuzz (See ../docs/README for the general instruction manual.) -1) Introduction ---------------- +## 1) Introduction The code in this directory allows you to build a standalone feature that leverages the QEMU "user emulation" mode and allows callers to obtain @@ -16,14 +13,15 @@ with afl-gcc. The usual performance cost is 2-5x, which is considerably better than seen so far in experiments with tools such as DynamoRIO and PIN. -The idea and much of the implementation comes from Andrew Griffiths. +The idea and much of the initial implementation comes from Andrew Griffiths. +The actual implementation on QEMU 3 (shipped with afl++) is from +Andrea Fioraldi. Special thanks to abiondo that re-enabled TCG chaining. -2) How to use -------------- +## 2) How to use -The feature is implemented with a fairly simple patch to QEMU 2.10.0. The -simplest way to build it is to run ./build_qemu_support.sh. The script will -download, configure, and compile the QEMU binary for you. +The feature is implemented with a patch to QEMU 3.1.0. The simplest way +to build it is to run ./build_qemu_support.sh. The script will download, +configure, and compile the QEMU binary for you. QEMU is a big project, so this will take a while, and you may have to resolve a couple of dependencies (most notably, you will definitely need @@ -46,8 +44,26 @@ Note: if you want the QEMU helper to be installed on your system for all users, you need to build it before issuing 'make install' in the parent directory. -3) Notes on linking -------------------- +## 3) Options + +There is ./libcompcov/ which implements laf-intel (splitting memcmp, +strncmp, etc. to make these conditions easier solvable by afl-fuzz). +Highly recommended. + +The option that enables QEMU CompareCoverage is AFL_COMPCOV_LEVEL. +AFL_COMPCOV_LEVEL=1 is to instrument comparisons with only immediate +values / read-only memory. AFL_COMPCOV_LEVEL=2 instruments all +comparison instructions and memory comparison functions when libcompcov +is preloaded. Comparison instructions are currently instrumented only +on the x86 and x86_64 targets. + +Another option is the environment variable AFL_ENTRYPOINT which allows +move the forkserver to a different part, e.g. just before the file is +opened (e.g. way after command line parsing and config file loading, etc) +which can be a huge speed improvement. Note that the specified address +must be an address of a basic block. + +## 4) Notes on linking The feature is supported only on Linux. Supporting BSD may amount to porting the changes made to linux-user/elfload.c and applying them to @@ -68,8 +84,7 @@ practice, this means two things: Setting AFL_INST_LIBS=1 can be used to circumvent the .text detection logic and instrument every basic block encountered. -4) Benchmarking ---------------- +## 5) Benchmarking If you want to compare the performance of the QEMU instrumentation with that of afl-gcc compiled code against the same target, you need to build the @@ -84,8 +99,7 @@ Comparative measurements of execution speed or instrumentation coverage will be fairly meaningless if the optimization levels or instrumentation scopes don't match. -5) Gotchas, feedback, bugs --------------------------- +## 6) Gotchas, feedback, bugs If you need to fix up checksums or do other cleanup on mutated test cases, see experimental/post_library/ for a viable solution. @@ -106,20 +120,18 @@ with -march=core2, can help. Beyond that, this is an early-stage mechanism, so fields reports are welcome. You can send them to <afl-users@googlegroups.com>. -6) Alternatives: static rewriting ---------------------------------- +## 7) Alternatives: static rewriting Statically rewriting binaries just once, instead of attempting to translate them at run time, can be a faster alternative. That said, static rewriting is fraught with peril, because it depends on being able to properly and fully model program control flow without actually executing each and every code path. -If you want to experiment with this mode of operation, there is a module -contributed by Aleksandar Nikolich: +The best implementation is this one: https://github.com/vanhauser-thc/afl-dyninst - https://groups.google.com/forum/#!topic/afl-users/HlSQdbOTlpg -At this point, the author reports the possibility of hiccups with stripped -binaries. That said, if we can get it to be comparably reliable to QEMU, we may -decide to switch to this mode, but I had no time to play with it yet. +The issue however is Dyninst which is not rewriting the binaries so that +they run stable. a lot of crashes happen, especially in C++ programs that +use throw/catch. Try it first, and if it works for you be happy as it is +2-3x as fast as qemu_mode. diff --git a/qemu_mode/build_qemu_support.sh b/qemu_mode/build_qemu_support.sh index 78ad5680..88726be4 100755 --- a/qemu_mode/build_qemu_support.sh +++ b/qemu_mode/build_qemu_support.sh @@ -3,10 +3,17 @@ # american fuzzy lop - QEMU build script # -------------------------------------- # -# Written by Andrew Griffiths <agriffiths@google.com> and -# Michal Zalewski <lcamtuf@google.com> +# Originally written by Andrew Griffiths <agriffiths@google.com> and +# Michal Zalewski <lcamtuf@google.com> +# +# TCG instrumentation and block chaining support by Andrea Biondo +# <andrea.biondo965@gmail.com> +# +# QEMU 3.1.0 port, TCG thread-safety, CompareCoverage and NeverZero +# counters by Andrea Fioraldi <andreafioraldi@gmail.com> # # Copyright 2015, 2016, 2017 Google Inc. All rights reserved. +# Copyright 2019 AFLplusplus Project. All rights reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -105,7 +112,8 @@ if [ "$CKSUM" = "$QEMU_SHA384" ]; then else - echo "[-] Error: signature mismatch on $ARCHIVE (perhaps download error?)." + echo "[-] Error: signature mismatch on $ARCHIVE (perhaps download error?), removing archive ..." + rm -f "$ARCHIVE" exit 1 fi @@ -193,6 +201,8 @@ if [ "$ORIG_CPU_TARGET" = "" ]; then echo "[+] Instrumentation tests passed. " echo "[+] All set, you can now use the -Q mode in afl-fuzz!" + cd qemu_mode || exit 1 + else echo "[!] Note: can't test instrumentation when CPU_TARGET set." @@ -200,4 +210,9 @@ else fi +echo "[+] Building libcompcov ..." +make -C libcompcov +echo "[+] libcompcov ready" +echo "[+] All done for qemu_mode, enjoy!" + exit 0 diff --git a/qemu_mode/libcompcov/Makefile b/qemu_mode/libcompcov/Makefile index c984588b..d078ae06 100644 --- a/qemu_mode/libcompcov/Makefile +++ b/qemu_mode/libcompcov/Makefile @@ -18,25 +18,25 @@ HELPER_PATH = $(PREFIX)/lib/afl VERSION = $(shell grep '^\#define VERSION ' ../config.h | cut -d '"' -f2) -CFLAGS ?= -O3 -funroll-loops +CFLAGS ?= -O3 -funroll-loops -I ../../include/ CFLAGS += -Wall -Wno-unused-result -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign LDFLAGS += -ldl all: libcompcov.so compcovtest libcompcov.so: libcompcov.so.c ../../config.h - $(CC) $(CFLAGS) -shared -fPIC $< -o $@ $(LDFLAGS) + $(CC) $(CFLAGS) -shared -fPIC $< -o ../../$@ $(LDFLAGS) .NOTPARALLEL: clean clean: rm -f *.o *.so *~ a.out core core.[1-9][0-9]* - rm -f libcompcov.so compcovtest + rm -f ../../libcompcov.so compcovtest compcovtest: compcovtest.cc $(CXX) $< -o $@ install: all - install -m 755 libcompcov.so $${DESTDIR}$(HELPER_PATH) + install -m 755 ../../libcompcov.so $${DESTDIR}$(HELPER_PATH) install -m 644 README.compcov $${DESTDIR}$(HELPER_PATH) diff --git a/qemu_mode/libcompcov/README.compcov b/qemu_mode/libcompcov/README.md index 2a4a0ee5..5aaa3dd8 100644 --- a/qemu_mode/libcompcov/README.compcov +++ b/qemu_mode/libcompcov/README.md @@ -1,10 +1,8 @@ -================================================================ -strcmp() / memcmp() CompareCoverage library for AFLplusplus-QEMU -================================================================ +# strcmp() / memcmp() CompareCoverage library for afl++ QEMU Written by Andrea Fioraldi <andreafioraldi@gmail.com> -This Linux-only companion library allows you to instrument strcmp(), memcmp(), +This Linux-only companion library allows you to instrument `strcmp()`, `memcmp()`, and related functions to log the CompareCoverage of these libcalls. Use this with caution. While this can speedup a lot the bypass of hard @@ -18,14 +16,20 @@ For optimized binaries this is an issue, those functions are often inlined and this module is not capable to log the coverage in this case. If you have the source code of the fuzzing target you should nto use this -library and QEMU but build ot with afl-clang-fast and the laf-intel options. +library and QEMU but build it with afl-clang-fast and the laf-intel options. To use this library make sure to preload it with AFL_PRELOAD. +``` export AFL_PRELOAD=/path/to/libcompcov.so - export AFL_QEMU_COMPCOV=1 + export AFL_COMPCOV_LEVEL=1 afl-fuzz -Q -i input -o output <your options> -- <target args> +``` + +The AFL_COMPCOV_LEVEL tells to QEMU and libcompcov how to log comaprisons. +Level 1 logs just comparison with immediates / read-only memory and level 2 +logs all the comparisons. The library make use of https://github.com/ouadev/proc_maps_parser and so it is Linux specific. However this is not a strict dependency, other UNIX operating diff --git a/qemu_mode/libcompcov/compcovtest.cc b/qemu_mode/libcompcov/compcovtest.cc index fd1fda00..171e4526 100644 --- a/qemu_mode/libcompcov/compcovtest.cc +++ b/qemu_mode/libcompcov/compcovtest.cc @@ -3,13 +3,13 @@ // Author: Mateusz Jurczyk (mjurczyk@google.com) // // Copyright 2019 Google LLC -// +// // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at -// +// // https://www.apache.org/licenses/LICENSE-2.0 -// +// // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. @@ -17,7 +17,8 @@ // limitations under the License. // -// solution: echo -ne 'The quick brown fox jumps over the lazy dog\xbe\xba\xfe\xca\xbe\xba\xfe\xca\xde\xc0\xad\xde\xef\xbe' | ./compcovtest +// solution: echo -ne 'The quick brown fox jumps over the lazy +// dog\xbe\xba\xfe\xca\xbe\xba\xfe\xca\xde\xc0\xad\xde\xef\xbe' | ./compcovtest #include <cstdint> #include <cstdio> @@ -25,39 +26,40 @@ #include <cstring> int main() { - char buffer[44] = { /* zero padding */ }; + + char buffer[44] = {/* zero padding */}; fread(buffer, 1, sizeof(buffer) - 1, stdin); if (memcmp(&buffer[0], "The quick brown fox ", 20) != 0 || strncmp(&buffer[20], "jumps over ", 11) != 0 || strcmp(&buffer[31], "the lazy dog") != 0) { + return 1; + } uint64_t x = 0; fread(&x, sizeof(x), 1, stdin); - if (x != 0xCAFEBABECAFEBABE) { - return 2; - } + if (x != 0xCAFEBABECAFEBABE) { return 2; } uint32_t y = 0; fread(&y, sizeof(y), 1, stdin); - if (y != 0xDEADC0DE) { - return 3; - } + if (y != 0xDEADC0DE) { return 3; } uint16_t z = 0; fread(&z, sizeof(z), 1, stdin); switch (z) { - case 0xBEEF: - break; + + case 0xBEEF: break; - default: - return 4; + default: return 4; + } printf("Puzzle solved, congrats!\n"); abort(); return 0; + } + diff --git a/qemu_mode/libcompcov/libcompcov.so.c b/qemu_mode/libcompcov/libcompcov.so.c index 582230db..dd9e2773 100644 --- a/qemu_mode/libcompcov/libcompcov.so.c +++ b/qemu_mode/libcompcov/libcompcov.so.c @@ -5,7 +5,7 @@ Written and maintained by Andrea Fioraldi <andreafioraldi@gmail.com> - Copyright 2019 Andrea Fioraldi. All rights reserved. + Copyright 2019 AFLplusplus Project. All rights reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -27,23 +27,24 @@ #include <sys/types.h> #include <sys/shm.h> -#include "../../types.h" -#include "../../config.h" +#include "types.h" +#include "config.h" #include "pmparser.h" #ifndef __linux__ -# error "Sorry, this library is Linux-specific for now!" -#endif /* !__linux__ */ +#error "Sorry, this library is Linux-specific for now!" +#endif /* !__linux__ */ /* Change this value to tune the compare coverage */ #define MAX_CMP_LENGTH 32 -static void *__compcov_code_start, - *__compcov_code_end; +static void *__compcov_code_start, *__compcov_code_end; -static u8 *__compcov_afl_map; +static u8* __compcov_afl_map; + +static u32 __compcov_level; static int (*__libc_strcmp)(const char*, const char*); static int (*__libc_strncmp)(const char*, const char*, size_t); @@ -53,27 +54,54 @@ static int (*__libc_memcmp)(const void*, const void*, size_t); static int debug_fd = -1; +#define MAX_MAPPINGS 1024 + +static struct mapping { void *st, *en; } __compcov_ro[MAX_MAPPINGS]; + +static u32 __compcov_ro_cnt; + +/* Check an address against the list of read-only mappings. */ + +static u8 __compcov_is_ro(const void* ptr) { + + u32 i; + + for (i = 0; i < __compcov_ro_cnt; i++) + if (ptr >= __compcov_ro[i].st && ptr <= __compcov_ro[i].en) return 1; + + return 0; + +} + +static size_t __strlen2(const char* s1, const char* s2, size_t max_length) { -static size_t __strlen2(const char *s1, const char *s2, size_t max_length) { // from https://github.com/googleprojectzero/CompareCoverage - + size_t len = 0; - for (; len < max_length && s1[len] != '\0' && s2[len] != '\0'; len++) { } + for (; len < max_length && s1[len] != '\0' && s2[len] != '\0'; len++) {} return len; + } /* Identify the binary boundaries in the memory mapping */ static void __compcov_load(void) { - + __libc_strcmp = dlsym(RTLD_NEXT, "strcmp"); __libc_strncmp = dlsym(RTLD_NEXT, "strncmp"); __libc_strcasecmp = dlsym(RTLD_NEXT, "strcasecmp"); __libc_strncasecmp = dlsym(RTLD_NEXT, "strncasecmp"); __libc_memcmp = dlsym(RTLD_NEXT, "memcmp"); - - char *id_str = getenv(SHM_ENV_VAR); - int shm_id; + + if (getenv("AFL_QEMU_COMPCOV")) { __compcov_level = 1; } + if (getenv("AFL_COMPCOV_LEVEL")) { + + __compcov_level = atoi(getenv("AFL_COMPCOV_LEVEL")); + + } + + char* id_str = getenv(SHM_ENV_VAR); + int shm_id; if (id_str) { @@ -81,55 +109,72 @@ static void __compcov_load(void) { __compcov_afl_map = shmat(shm_id, NULL, 0); if (__compcov_afl_map == (void*)-1) exit(1); + } else { - + __compcov_afl_map = calloc(1, MAP_SIZE); + } if (getenv("AFL_INST_LIBS")) { - + __compcov_code_start = (void*)0; __compcov_code_end = (void*)-1; return; + } char* bin_name = getenv("AFL_COMPCOV_BINNAME"); procmaps_iterator* maps = pmparser_parse(-1); - procmaps_struct* maps_tmp = NULL; + procmaps_struct* maps_tmp = NULL; while ((maps_tmp = pmparser_next(maps)) != NULL) { - + /* If AFL_COMPCOV_BINNAME is not set pick the first executable segment */ if (!bin_name || strstr(maps_tmp->pathname, bin_name) != NULL) { - + if (maps_tmp->is_x) { - if (!__compcov_code_start) - __compcov_code_start = maps_tmp->addr_start; - if (!__compcov_code_end) - __compcov_code_end = maps_tmp->addr_end; + + if (!__compcov_code_start) __compcov_code_start = maps_tmp->addr_start; + if (!__compcov_code_end) __compcov_code_end = maps_tmp->addr_end; + } + } + + if ((maps_tmp->is_w && !maps_tmp->is_r) || __compcov_ro_cnt == MAX_MAPPINGS) + continue; + + __compcov_ro[__compcov_ro_cnt].st = maps_tmp->addr_start; + __compcov_ro[__compcov_ro_cnt].en = maps_tmp->addr_end; + } pmparser_free(maps); -} +} static void __compcov_trace(u64 cur_loc, const u8* v0, const u8* v1, size_t n) { size_t i; - + if (debug_fd != 1) { + char debugbuf[4096]; - snprintf(debugbuf, sizeof(debugbuf), "0x%llx %s %s %lu\n", cur_loc, v0 == NULL ? "(null)" : (char*)v0, v1 == NULL ? "(null)" : (char*)v1, n); + snprintf(debugbuf, sizeof(debugbuf), "0x%llx %s %s %lu\n", cur_loc, + v0 == NULL ? "(null)" : (char*)v0, + v1 == NULL ? "(null)" : (char*)v1, n); write(debug_fd, debugbuf, strlen(debugbuf)); + } - + for (i = 0; i < n && v0[i] == v1[i]; ++i) { - - __compcov_afl_map[cur_loc +i]++; + + __compcov_afl_map[cur_loc + i]++; + } + } /* Check an address against the list of read-only mappings. */ @@ -137,8 +182,8 @@ static void __compcov_trace(u64 cur_loc, const u8* v0, const u8* v1, size_t n) { static u8 __compcov_is_in_bound(const void* ptr) { return ptr >= __compcov_code_start && ptr < __compcov_code_end; -} +} /* Replacements for strcmp(), memcmp(), and so on. Note that these will be used only if the target is compiled with -fno-builtins and linked dynamically. */ @@ -148,122 +193,145 @@ static u8 __compcov_is_in_bound(const void* ptr) { int strcmp(const char* str1, const char* str2) { void* retaddr = __builtin_return_address(0); - - if (__compcov_is_in_bound(retaddr)) { - size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH +1); - + if (__compcov_is_in_bound(retaddr) && + !(__compcov_level < 2 && !__compcov_is_ro(str1) && + !__compcov_is_ro(str2))) { + + size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH + 1); + if (n <= MAX_CMP_LENGTH) { - + u64 cur_loc = (u64)retaddr; - cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); cur_loc &= MAP_SIZE - 1; - + __compcov_trace(cur_loc, str1, str2, n); + } + } return __libc_strcmp(str1, str2); -} +} #undef strncmp int strncmp(const char* str1, const char* str2, size_t len) { void* retaddr = __builtin_return_address(0); - - if (__compcov_is_in_bound(retaddr)) { - size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH +1); + if (__compcov_is_in_bound(retaddr) && + !(__compcov_level < 2 && !__compcov_is_ro(str1) && + !__compcov_is_ro(str2))) { + + size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH + 1); n = MIN(n, len); - + if (n <= MAX_CMP_LENGTH) { - + u64 cur_loc = (u64)retaddr; - cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); cur_loc &= MAP_SIZE - 1; - + __compcov_trace(cur_loc, str1, str2, n); + } + } - + return __libc_strncmp(str1, str2, len); -} +} #undef strcasecmp int strcasecmp(const char* str1, const char* str2) { void* retaddr = __builtin_return_address(0); - - if (__compcov_is_in_bound(retaddr)) { + + if (__compcov_is_in_bound(retaddr) && + !(__compcov_level < 2 && !__compcov_is_ro(str1) && + !__compcov_is_ro(str2))) { + /* Fallback to strcmp, maybe improve in future */ - size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH +1); - + size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH + 1); + if (n <= MAX_CMP_LENGTH) { - + u64 cur_loc = (u64)retaddr; - cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); cur_loc &= MAP_SIZE - 1; - + __compcov_trace(cur_loc, str1, str2, n); + } + } return __libc_strcasecmp(str1, str2); -} +} #undef strncasecmp int strncasecmp(const char* str1, const char* str2, size_t len) { void* retaddr = __builtin_return_address(0); - - if (__compcov_is_in_bound(retaddr)) { + + if (__compcov_is_in_bound(retaddr) && + !(__compcov_level < 2 && !__compcov_is_ro(str1) && + !__compcov_is_ro(str2))) { + /* Fallback to strncmp, maybe improve in future */ - size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH +1); + size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH + 1); n = MIN(n, len); - + if (n <= MAX_CMP_LENGTH) { - + u64 cur_loc = (u64)retaddr; - cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); cur_loc &= MAP_SIZE - 1; - + __compcov_trace(cur_loc, str1, str2, n); + } + } return __libc_strncasecmp(str1, str2, len); -} +} #undef memcmp int memcmp(const void* mem1, const void* mem2, size_t len) { void* retaddr = __builtin_return_address(0); - - if (__compcov_is_in_bound(retaddr)) { + + if (__compcov_is_in_bound(retaddr) && + !(__compcov_level < 2 && !__compcov_is_ro(mem1) && + !__compcov_is_ro(mem2))) { size_t n = len; - + if (n <= MAX_CMP_LENGTH) { - + u64 cur_loc = (u64)retaddr; - cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); cur_loc &= MAP_SIZE - 1; - + __compcov_trace(cur_loc, mem1, mem2, n); + } + } return __libc_memcmp(mem1, mem2, len); + } /* Init code to open init the library. */ @@ -271,9 +339,10 @@ int memcmp(const void* mem1, const void* mem2, size_t len) { __attribute__((constructor)) void __compcov_init(void) { if (getenv("AFL_QEMU_COMPCOV_DEBUG") != NULL) - debug_fd = open("compcov.debug", O_WRONLY | O_CREAT | O_TRUNC | O_SYNC, 0644); + debug_fd = + open("compcov.debug", O_WRONLY | O_CREAT | O_TRUNC | O_SYNC, 0644); __compcov_load(); -} +} diff --git a/qemu_mode/libcompcov/pmparser.h b/qemu_mode/libcompcov/pmparser.h index 34d0cd50..e7fcf187 100644 --- a/qemu_mode/libcompcov/pmparser.h +++ b/qemu_mode/libcompcov/pmparser.h @@ -24,43 +24,49 @@ implied warranty. #include <errno.h> #include <linux/limits.h> -//maximum line length in a procmaps file -#define PROCMAPS_LINE_MAX_LENGTH (PATH_MAX + 100) +// maximum line length in a procmaps file +#define PROCMAPS_LINE_MAX_LENGTH (PATH_MAX + 100) /** * procmaps_struct * @desc hold all the information about an area in the process's VM */ -typedef struct procmaps_struct{ - void* addr_start; //< start address of the area - void* addr_end; //< end address - unsigned long length; //< size of the range - - char perm[5]; //< permissions rwxp - short is_r; //< rewrote of perm with short flags - short is_w; - short is_x; - short is_p; - - long offset; //< offset - char dev[12]; //< dev major:minor - int inode; //< inode of the file that backs the area - - char pathname[600]; //< the path of the file that backs the area - //chained list - struct procmaps_struct* next; //<handler of the chinaed list +typedef struct procmaps_struct { + + void* addr_start; //< start address of the area + void* addr_end; //< end address + unsigned long length; //< size of the range + + char perm[5]; //< permissions rwxp + short is_r; //< rewrote of perm with short flags + short is_w; + short is_x; + short is_p; + + long offset; //< offset + char dev[12]; //< dev major:minor + int inode; //< inode of the file that backs the area + + char pathname[600]; //< the path of the file that backs the area + // chained list + struct procmaps_struct* next; //<handler of the chinaed list + } procmaps_struct; /** * procmaps_iterator * @desc holds iterating information */ -typedef struct procmaps_iterator{ - procmaps_struct* head; - procmaps_struct* current; +typedef struct procmaps_iterator { + + procmaps_struct* head; + procmaps_struct* current; + } procmaps_iterator; + /** * pmparser_parse - * @param pid the process id whose memory map to be parser. the current process if pid<0 + * @param pid the process id whose memory map to be parser. the current process + * if pid<0 * @return an iterator over all the nodes */ procmaps_iterator* pmparser_parse(int pid); @@ -83,198 +89,238 @@ void pmparser_free(procmaps_iterator* p_procmaps_it); * _pmparser_split_line * @description internal usage */ -void _pmparser_split_line(char*buf,char*addr1,char*addr2,char*perm, char* offset, char* device,char*inode,char* pathname); +void _pmparser_split_line(char* buf, char* addr1, char* addr2, char* perm, + char* offset, char* device, char* inode, + char* pathname); /** * pmparser_print * @param map the head of the list * @order the order of the area to print, -1 to print everything */ -void pmparser_print(procmaps_struct* map,int order); - +void pmparser_print(procmaps_struct* map, int order); /** * gobal variables */ -//procmaps_struct* g_last_head=NULL; -//procmaps_struct* g_current=NULL; - - -procmaps_iterator* pmparser_parse(int pid){ - procmaps_iterator* maps_it = malloc(sizeof(procmaps_iterator)); - char maps_path[500]; - if(pid>=0 ){ - sprintf(maps_path,"/proc/%d/maps",pid); - }else{ - sprintf(maps_path,"/proc/self/maps"); - } - FILE* file=fopen(maps_path,"r"); - if(!file){ - fprintf(stderr,"pmparser : cannot open the memory maps, %s\n",strerror(errno)); - return NULL; - } - int ind=0;char buf[PROCMAPS_LINE_MAX_LENGTH]; - //int c; - procmaps_struct* list_maps=NULL; - procmaps_struct* tmp; - procmaps_struct* current_node=list_maps; - char addr1[20],addr2[20], perm[8], offset[20], dev[10],inode[30],pathname[PATH_MAX]; - while( !feof(file) ){ - fgets(buf,PROCMAPS_LINE_MAX_LENGTH,file); - //allocate a node - tmp=(procmaps_struct*)malloc(sizeof(procmaps_struct)); - //fill the node - _pmparser_split_line(buf,addr1,addr2,perm,offset, dev,inode,pathname); - //printf("#%s",buf); - //printf("%s-%s %s %s %s %s\t%s\n",addr1,addr2,perm,offset,dev,inode,pathname); - //addr_start & addr_end - //unsigned long l_addr_start; - sscanf(addr1,"%lx",(long unsigned *)&tmp->addr_start ); - sscanf(addr2,"%lx",(long unsigned *)&tmp->addr_end ); - //size - tmp->length=(unsigned long)(tmp->addr_end-tmp->addr_start); - //perm - strcpy(tmp->perm,perm); - tmp->is_r=(perm[0]=='r'); - tmp->is_w=(perm[1]=='w'); - tmp->is_x=(perm[2]=='x'); - tmp->is_p=(perm[3]=='p'); - - //offset - sscanf(offset,"%lx",&tmp->offset ); - //device - strcpy(tmp->dev,dev); - //inode - tmp->inode=atoi(inode); - //pathname - strcpy(tmp->pathname,pathname); - tmp->next=NULL; - //attach the node - if(ind==0){ - list_maps=tmp; - list_maps->next=NULL; - current_node=list_maps; - } - current_node->next=tmp; - current_node=tmp; - ind++; - //printf("%s",buf); - } - - //close file - fclose(file); - - - //g_last_head=list_maps; - maps_it->head = list_maps; - maps_it->current = list_maps; - return maps_it; +// procmaps_struct* g_last_head=NULL; +// procmaps_struct* g_current=NULL; + +procmaps_iterator* pmparser_parse(int pid) { + + procmaps_iterator* maps_it = malloc(sizeof(procmaps_iterator)); + char maps_path[500]; + if (pid >= 0) { + + sprintf(maps_path, "/proc/%d/maps", pid); + + } else { + + sprintf(maps_path, "/proc/self/maps"); + + } + + FILE* file = fopen(maps_path, "r"); + if (!file) { + + fprintf(stderr, "pmparser : cannot open the memory maps, %s\n", + strerror(errno)); + return NULL; + + } + + int ind = 0; + char buf[PROCMAPS_LINE_MAX_LENGTH]; + // int c; + procmaps_struct* list_maps = NULL; + procmaps_struct* tmp; + procmaps_struct* current_node = list_maps; + char addr1[20], addr2[20], perm[8], offset[20], dev[10], inode[30], + pathname[PATH_MAX]; + while (!feof(file)) { + + fgets(buf, PROCMAPS_LINE_MAX_LENGTH, file); + // allocate a node + tmp = (procmaps_struct*)malloc(sizeof(procmaps_struct)); + // fill the node + _pmparser_split_line(buf, addr1, addr2, perm, offset, dev, inode, pathname); + // printf("#%s",buf); + // printf("%s-%s %s %s %s + // %s\t%s\n",addr1,addr2,perm,offset,dev,inode,pathname); addr_start & + // addr_end unsigned long l_addr_start; + sscanf(addr1, "%lx", (long unsigned*)&tmp->addr_start); + sscanf(addr2, "%lx", (long unsigned*)&tmp->addr_end); + // size + tmp->length = (unsigned long)(tmp->addr_end - tmp->addr_start); + // perm + strcpy(tmp->perm, perm); + tmp->is_r = (perm[0] == 'r'); + tmp->is_w = (perm[1] == 'w'); + tmp->is_x = (perm[2] == 'x'); + tmp->is_p = (perm[3] == 'p'); + + // offset + sscanf(offset, "%lx", &tmp->offset); + // device + strcpy(tmp->dev, dev); + // inode + tmp->inode = atoi(inode); + // pathname + strcpy(tmp->pathname, pathname); + tmp->next = NULL; + // attach the node + if (ind == 0) { + + list_maps = tmp; + list_maps->next = NULL; + current_node = list_maps; + + } + + current_node->next = tmp; + current_node = tmp; + ind++; + // printf("%s",buf); + + } + + // close file + fclose(file); + + // g_last_head=list_maps; + maps_it->head = list_maps; + maps_it->current = list_maps; + return maps_it; + } +procmaps_struct* pmparser_next(procmaps_iterator* p_procmaps_it) { -procmaps_struct* pmparser_next(procmaps_iterator* p_procmaps_it){ - if(p_procmaps_it->current == NULL) - return NULL; - procmaps_struct* p_current = p_procmaps_it->current; - p_procmaps_it->current = p_procmaps_it->current->next; - return p_current; - /* - if(g_current==NULL){ - g_current=g_last_head; - }else - g_current=g_current->next; - - return g_current; - */ -} + if (p_procmaps_it->current == NULL) return NULL; + procmaps_struct* p_current = p_procmaps_it->current; + p_procmaps_it->current = p_procmaps_it->current->next; + return p_current; + /* + if(g_current==NULL){ + + g_current=g_last_head; + }else + g_current=g_current->next; -void pmparser_free(procmaps_iterator* p_procmaps_it){ - procmaps_struct* maps_list = p_procmaps_it->head; - if(maps_list==NULL) return ; - procmaps_struct* act=maps_list; - procmaps_struct* nxt=act->next; - while(act!=NULL){ - free(act); - act=nxt; - if(nxt!=NULL) - nxt=nxt->next; - } + return g_current; + */ } +void pmparser_free(procmaps_iterator* p_procmaps_it) { + + procmaps_struct* maps_list = p_procmaps_it->head; + if (maps_list == NULL) return; + procmaps_struct* act = maps_list; + procmaps_struct* nxt = act->next; + while (act != NULL) { -void _pmparser_split_line( - char*buf,char*addr1,char*addr2, - char*perm,char* offset,char* device,char*inode, - char* pathname){ - // - int orig=0; - int i=0; - //addr1 - while(buf[i]!='-'){ - addr1[i-orig]=buf[i]; - i++; - } - addr1[i]='\0'; - i++; - //addr2 - orig=i; - while(buf[i]!='\t' && buf[i]!=' '){ - addr2[i-orig]=buf[i]; - i++; - } - addr2[i-orig]='\0'; - - //perm - while(buf[i]=='\t' || buf[i]==' ') - i++; - orig=i; - while(buf[i]!='\t' && buf[i]!=' '){ - perm[i-orig]=buf[i]; - i++; - } - perm[i-orig]='\0'; - //offset - while(buf[i]=='\t' || buf[i]==' ') - i++; - orig=i; - while(buf[i]!='\t' && buf[i]!=' '){ - offset[i-orig]=buf[i]; - i++; - } - offset[i-orig]='\0'; - //dev - while(buf[i]=='\t' || buf[i]==' ') - i++; - orig=i; - while(buf[i]!='\t' && buf[i]!=' '){ - device[i-orig]=buf[i]; - i++; - } - device[i-orig]='\0'; - //inode - while(buf[i]=='\t' || buf[i]==' ') - i++; - orig=i; - while(buf[i]!='\t' && buf[i]!=' '){ - inode[i-orig]=buf[i]; - i++; - } - inode[i-orig]='\0'; - //pathname - pathname[0]='\0'; - while(buf[i]=='\t' || buf[i]==' ') - i++; - orig=i; - while(buf[i]!='\t' && buf[i]!=' ' && buf[i]!='\n'){ - pathname[i-orig]=buf[i]; - i++; - } - pathname[i-orig]='\0'; + free(act); + act = nxt; + if (nxt != NULL) nxt = nxt->next; + + } } +void _pmparser_split_line(char* buf, char* addr1, char* addr2, char* perm, + char* offset, char* device, char* inode, + char* pathname) { + + // + int orig = 0; + int i = 0; + // addr1 + while (buf[i] != '-') { + + addr1[i - orig] = buf[i]; + i++; + + } + + addr1[i] = '\0'; + i++; + // addr2 + orig = i; + while (buf[i] != '\t' && buf[i] != ' ') { + + addr2[i - orig] = buf[i]; + i++; + + } + + addr2[i - orig] = '\0'; + + // perm + while (buf[i] == '\t' || buf[i] == ' ') + i++; + orig = i; + while (buf[i] != '\t' && buf[i] != ' ') { + + perm[i - orig] = buf[i]; + i++; + + } + + perm[i - orig] = '\0'; + // offset + while (buf[i] == '\t' || buf[i] == ' ') + i++; + orig = i; + while (buf[i] != '\t' && buf[i] != ' ') { + + offset[i - orig] = buf[i]; + i++; + + } + + offset[i - orig] = '\0'; + // dev + while (buf[i] == '\t' || buf[i] == ' ') + i++; + orig = i; + while (buf[i] != '\t' && buf[i] != ' ') { + + device[i - orig] = buf[i]; + i++; + + } + + device[i - orig] = '\0'; + // inode + while (buf[i] == '\t' || buf[i] == ' ') + i++; + orig = i; + while (buf[i] != '\t' && buf[i] != ' ') { + + inode[i - orig] = buf[i]; + i++; + + } + + inode[i - orig] = '\0'; + // pathname + pathname[0] = '\0'; + while (buf[i] == '\t' || buf[i] == ' ') + i++; + orig = i; + while (buf[i] != '\t' && buf[i] != ' ' && buf[i] != '\n') { + + pathname[i - orig] = buf[i]; + i++; + + } + + pathname[i - orig] = '\0'; + +} #endif + diff --git a/qemu_mode/patches/afl-qemu-common.h b/qemu_mode/patches/afl-qemu-common.h new file mode 100644 index 00000000..88c110b4 --- /dev/null +++ b/qemu_mode/patches/afl-qemu-common.h @@ -0,0 +1,49 @@ +/* + american fuzzy lop++ - high-performance binary-only instrumentation + ------------------------------------------------------------------- + + Originally written by Andrew Griffiths <agriffiths@google.com> and + Michal Zalewski <lcamtuf@google.com> + + TCG instrumentation and block chaining support by Andrea Biondo + <andrea.biondo965@gmail.com> + + QEMU 3.1.0 port, TCG thread-safety, CompareCoverage and NeverZero + counters by Andrea Fioraldi <andreafioraldi@gmail.com> + + Copyright 2015, 2016, 2017 Google Inc. All rights reserved. + Copyright 2019 AFLplusplus Project. All rights reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at: + + http://www.apache.org/licenses/LICENSE-2.0 + + This code is a shim patched into the separately-distributed source + code of QEMU 3.1.0. It leverages the built-in QEMU tracing functionality + to implement AFL-style instrumentation and to take care of the remaining + parts of the AFL fork server logic. + + The resulting QEMU binary is essentially a standalone instrumentation + tool; for an example of how to leverage it for other purposes, you can + have a look at afl-showmap.c. + + */ + +#include "../../config.h" + +/* NeverZero */ + +#if (defined(__x86_64__) || defined(__i386__)) && defined(AFL_QEMU_NOT_ZERO) +#define INC_AFL_AREA(loc) \ + asm volatile( \ + "incb (%0, %1, 1)\n" \ + "adcb $0, (%0, %1, 1)\n" \ + : /* no out */ \ + : "r"(afl_area_ptr), "r"(loc) \ + : "memory", "eax") +#else +#define INC_AFL_AREA(loc) afl_area_ptr[loc]++ +#endif + diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h index 86203a5b..2a1331cb 100644 --- a/qemu_mode/patches/afl-qemu-cpu-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-inl.h @@ -1,19 +1,18 @@ /* - american fuzzy lop - high-performance binary-only instrumentation - ----------------------------------------------------------------- + american fuzzy lop++ - high-performance binary-only instrumentation + ------------------------------------------------------------------- - Written by Andrew Griffiths <agriffiths@google.com> and - Michal Zalewski <lcamtuf@google.com> - - Idea & design very much by Andrew Griffiths. + Originally written by Andrew Griffiths <agriffiths@google.com> and + Michal Zalewski <lcamtuf@google.com> TCG instrumentation and block chaining support by Andrea Biondo <andrea.biondo965@gmail.com> - QEMU 3.1.0 port, TCG thread-safety and CompareCoverage by Andrea Fioraldi - <andreafioraldi@gmail.com> + QEMU 3.1.0 port, TCG thread-safety, CompareCoverage and NeverZero + counters by Andrea Fioraldi <andreafioraldi@gmail.com> Copyright 2015, 2016, 2017 Google Inc. All rights reserved. + Copyright 2019 AFLplusplus Project. All rights reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -43,11 +42,16 @@ _start and does the usual forkserver stuff, not very different from regular instrumentation injected via afl-as.h. */ -#define AFL_QEMU_CPU_SNIPPET2 do { \ - if(itb->pc == afl_entry_point) { \ - afl_setup(); \ - afl_forkserver(cpu); \ - } \ +#define AFL_QEMU_CPU_SNIPPET2 \ + do { \ + \ + if (itb->pc == afl_entry_point) { \ + \ + afl_setup(); \ + afl_forkserver(cpu); \ + \ + } \ + \ } while (0) /* We use one additional file descriptor to relay "needs translation" @@ -57,60 +61,71 @@ /* This is equivalent to afl-as.h: */ -static unsigned char dummy[MAP_SIZE]; /* costs MAP_SIZE but saves a few instructions */ -unsigned char *afl_area_ptr = dummy; /* Exported for afl_gen_trace */ +static unsigned char + dummy[MAP_SIZE]; /* costs MAP_SIZE but saves a few instructions */ +unsigned char *afl_area_ptr = dummy; /* Exported for afl_gen_trace */ /* Exported variables populated by the code patched into elfload.c: */ -abi_ulong afl_entry_point, /* ELF entry point (_start) */ - afl_start_code, /* .text start pointer */ - afl_end_code; /* .text end pointer */ +abi_ulong afl_entry_point, /* ELF entry point (_start) */ + afl_start_code, /* .text start pointer */ + afl_end_code; /* .text end pointer */ -u8 afl_enable_compcov; +u8 afl_compcov_level; /* Set in the child process in forkserver mode: */ -static int forkserver_installed = 0; +static int forkserver_installed = 0; static unsigned char afl_fork_child; -unsigned int afl_forksrv_pid; +unsigned int afl_forksrv_pid; /* Instrumentation ratio: */ -unsigned int afl_inst_rms = MAP_SIZE; /* Exported for afl_gen_trace */ +unsigned int afl_inst_rms = MAP_SIZE; /* Exported for afl_gen_trace */ /* Function declarations. */ static void afl_setup(void); -static void afl_forkserver(CPUState*); +static void afl_forkserver(CPUState *); -static void afl_wait_tsl(CPUState*, int); -static void afl_request_tsl(target_ulong, target_ulong, uint32_t, uint32_t, TranslationBlock*, int); +static void afl_wait_tsl(CPUState *, int); +static void afl_request_tsl(target_ulong, target_ulong, uint32_t, uint32_t, + TranslationBlock *, int); /* Data structures passed around by the translate handlers: */ struct afl_tb { + target_ulong pc; target_ulong cs_base; - uint32_t flags; - uint32_t cf_mask; + uint32_t flags; + uint32_t cf_mask; + }; struct afl_tsl { + struct afl_tb tb; - char is_chain; + char is_chain; + }; struct afl_chain { + struct afl_tb last_tb; - uint32_t cf_mask; - int tb_exit; + uint32_t cf_mask; + int tb_exit; + }; /* Some forward decls: */ -TranslationBlock *tb_htable_lookup(CPUState*, target_ulong, target_ulong, uint32_t, uint32_t); -static inline TranslationBlock *tb_find(CPUState*, TranslationBlock*, int, uint32_t); -static inline void tb_add_jump(TranslationBlock *tb, int n, TranslationBlock *tb_next); +TranslationBlock *tb_htable_lookup(CPUState *, target_ulong, target_ulong, + uint32_t, uint32_t); +static inline TranslationBlock *tb_find(CPUState *, TranslationBlock *, int, + uint32_t); +static inline void tb_add_jump(TranslationBlock *tb, int n, + TranslationBlock *tb_next); /************************* * ACTUAL IMPLEMENTATION * @@ -120,8 +135,7 @@ static inline void tb_add_jump(TranslationBlock *tb, int n, TranslationBlock *tb static void afl_setup(void) { - char *id_str = getenv(SHM_ENV_VAR), - *inst_r = getenv("AFL_INST_RATIO"); + char *id_str = getenv(SHM_ENV_VAR), *inst_r = getenv("AFL_INST_RATIO"); int shm_id; @@ -143,7 +157,7 @@ static void afl_setup(void) { shm_id = atoi(id_str); afl_area_ptr = shmat(shm_id, NULL, 0); - if (afl_area_ptr == (void*)-1) exit(1); + if (afl_area_ptr == (void *)-1) exit(1); /* With AFL_INST_RATIO set to a low value, we want to touch the bitmap so that the parent doesn't give up on us. */ @@ -155,13 +169,16 @@ static void afl_setup(void) { if (getenv("AFL_INST_LIBS")) { afl_start_code = 0; - afl_end_code = (abi_ulong)-1; + afl_end_code = (abi_ulong)-1; } - - if (getenv("AFL_QEMU_COMPCOV")) { - afl_enable_compcov = 1; + /* Maintain for compatibility */ + if (getenv("AFL_QEMU_COMPCOV")) { afl_compcov_level = 1; } + if (getenv("AFL_COMPCOV_LEVEL")) { + + afl_compcov_level = atoi(getenv("AFL_COMPCOV_LEVEL")); + } /* pthread_atfork() seems somewhat broken in util/rcu.c, and I'm @@ -172,17 +189,15 @@ static void afl_setup(void) { } - /* Fork server logic, invoked once we hit _start. */ static void afl_forkserver(CPUState *cpu) { static unsigned char tmp[4]; - if (forkserver_installed == 1) - return; + if (forkserver_installed == 1) return; forkserver_installed = 1; - //if (!afl_area_ptr) return; // not necessary because of fixed dummy buffer + // if (!afl_area_ptr) return; // not necessary because of fixed dummy buffer /* Tell the parent that we're alive. If the parent doesn't want to talk, assume that we're not running in forkserver mode. */ @@ -196,7 +211,7 @@ static void afl_forkserver(CPUState *cpu) { while (1) { pid_t child_pid; - int status, t_fd[2]; + int status, t_fd[2]; /* Whoops, parent dead? */ @@ -242,59 +257,60 @@ static void afl_forkserver(CPUState *cpu) { } - /* This code is invoked whenever QEMU decides that it doesn't have a translation of a particular block and needs to compute it, or when it decides to chain two TBs together. When this happens, we tell the parent to mirror the operation, so that the next fork() has a cached copy. */ -static void afl_request_tsl(target_ulong pc, target_ulong cb, uint32_t flags, uint32_t cf_mask, - TranslationBlock *last_tb, int tb_exit) { +static void afl_request_tsl(target_ulong pc, target_ulong cb, uint32_t flags, + uint32_t cf_mask, TranslationBlock *last_tb, + int tb_exit) { - struct afl_tsl t; + struct afl_tsl t; struct afl_chain c; if (!afl_fork_child) return; - t.tb.pc = pc; + t.tb.pc = pc; t.tb.cs_base = cb; - t.tb.flags = flags; + t.tb.flags = flags; t.tb.cf_mask = cf_mask; - t.is_chain = (last_tb != NULL); + t.is_chain = (last_tb != NULL); if (write(TSL_FD, &t, sizeof(struct afl_tsl)) != sizeof(struct afl_tsl)) return; if (t.is_chain) { - c.last_tb.pc = last_tb->pc; + + c.last_tb.pc = last_tb->pc; c.last_tb.cs_base = last_tb->cs_base; - c.last_tb.flags = last_tb->flags; - c.cf_mask = cf_mask; - c.tb_exit = tb_exit; + c.last_tb.flags = last_tb->flags; + c.cf_mask = cf_mask; + c.tb_exit = tb_exit; if (write(TSL_FD, &c, sizeof(struct afl_chain)) != sizeof(struct afl_chain)) return; + } } - /* Check if an address is valid in the current mapping */ static inline int is_valid_addr(target_ulong addr) { - int l, flags; - target_ulong page; - void * p; - - page = addr & TARGET_PAGE_MASK; - l = (page + TARGET_PAGE_SIZE) - addr; - - flags = page_get_flags(page); - if (!(flags & PAGE_VALID) || !(flags & PAGE_READ)) - return 0; - - return 1; + int l, flags; + target_ulong page; + void * p; + + page = addr & TARGET_PAGE_MASK; + l = (page + TARGET_PAGE_SIZE) - addr; + + flags = page_get_flags(page); + if (!(flags & PAGE_VALID) || !(flags & PAGE_READ)) return 0; + + return 1; + } /* This is the other side of the same channel. Since timeouts are handled by @@ -302,8 +318,8 @@ static inline int is_valid_addr(target_ulong addr) { static void afl_wait_tsl(CPUState *cpu, int fd) { - struct afl_tsl t; - struct afl_chain c; + struct afl_tsl t; + struct afl_chain c; TranslationBlock *tb, *last_tb; while (1) { @@ -312,30 +328,33 @@ static void afl_wait_tsl(CPUState *cpu, int fd) { /* Broken pipe means it's time to return to the fork server routine. */ - if (read(fd, &t, sizeof(struct afl_tsl)) != sizeof(struct afl_tsl)) - break; + if (read(fd, &t, sizeof(struct afl_tsl)) != sizeof(struct afl_tsl)) break; tb = tb_htable_lookup(cpu, t.tb.pc, t.tb.cs_base, t.tb.flags, t.tb.cf_mask); - if(!tb) { - + if (!tb) { + /* The child may request to transate a block of memory that is not mapped in the parent (e.g. jitted code or dlopened code). This causes a SIGSEV in gen_intermediate_code() and associated subroutines. We simply avoid caching of such blocks. */ if (is_valid_addr(t.tb.pc)) { - + mmap_lock(); - tb = tb_gen_code(cpu, t.tb.pc, t.tb.cs_base, t.tb.flags, 0); + tb = tb_gen_code(cpu, t.tb.pc, t.tb.cs_base, t.tb.flags, t.tb.cf_mask); mmap_unlock(); + } else { - - invalid_pc = 1; + + invalid_pc = 1; + } + } if (t.is_chain) { + if (read(fd, &c, sizeof(struct afl_chain)) != sizeof(struct afl_chain)) break; @@ -343,10 +362,10 @@ static void afl_wait_tsl(CPUState *cpu, int fd) { last_tb = tb_htable_lookup(cpu, c.last_tb.pc, c.last_tb.cs_base, c.last_tb.flags, c.cf_mask); - if (last_tb) { - tb_add_jump(last_tb, c.tb_exit, tb); - } + if (last_tb) { tb_add_jump(last_tb, c.tb_exit, tb); } + } + } } @@ -354,3 +373,4 @@ static void afl_wait_tsl(CPUState *cpu, int fd) { close(fd); } + diff --git a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h index 0ca89c98..3d3c1b6b 100644 --- a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h @@ -1,19 +1,18 @@ /* - american fuzzy lop - high-performance binary-only instrumentation - ----------------------------------------------------------------- + american fuzzy lop++ - high-performance binary-only instrumentation + ------------------------------------------------------------------- - Written by Andrew Griffiths <agriffiths@google.com> and - Michal Zalewski <lcamtuf@google.com> - - Idea & design very much by Andrew Griffiths. + Originally written by Andrew Griffiths <agriffiths@google.com> and + Michal Zalewski <lcamtuf@google.com> TCG instrumentation and block chaining support by Andrea Biondo <andrea.biondo965@gmail.com> - - QEMU 3.1.0 port, TCG thread-safety and CompareCoverage by Andrea Fioraldi - <andreafioraldi@gmail.com> + + QEMU 3.1.0 port, TCG thread-safety, CompareCoverage and NeverZero + counters by Andrea Fioraldi <andreafioraldi@gmail.com> Copyright 2015, 2016, 2017 Google Inc. All rights reserved. + Copyright 2019 AFLplusplus Project. All rights reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -32,15 +31,15 @@ */ -#include "../../config.h" +#include "afl-qemu-common.h" #include "tcg.h" #include "tcg-op.h" /* Declared in afl-qemu-cpu-inl.h */ extern unsigned char *afl_area_ptr; -extern unsigned int afl_inst_rms; -extern abi_ulong afl_start_code, afl_end_code; -extern u8 afl_enable_compcov; +extern unsigned int afl_inst_rms; +extern abi_ulong afl_start_code, afl_end_code; +extern u8 afl_compcov_level; void tcg_gen_afl_compcov_log_call(void *func, target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2); @@ -48,78 +47,93 @@ void tcg_gen_afl_compcov_log_call(void *func, target_ulong cur_loc, static void afl_compcov_log_16(target_ulong cur_loc, target_ulong arg1, target_ulong arg2) { - if ((arg1 & 0xff) == (arg2 & 0xff)) { - afl_area_ptr[cur_loc]++; - } + if ((arg1 & 0xff) == (arg2 & 0xff)) { INC_AFL_AREA(cur_loc); } + } static void afl_compcov_log_32(target_ulong cur_loc, target_ulong arg1, target_ulong arg2) { if ((arg1 & 0xff) == (arg2 & 0xff)) { - afl_area_ptr[cur_loc]++; + + INC_AFL_AREA(cur_loc); if ((arg1 & 0xffff) == (arg2 & 0xffff)) { - afl_area_ptr[cur_loc +1]++; - if ((arg1 & 0xffffff) == (arg2 & 0xffffff)) { - afl_area_ptr[cur_loc +2]++; - } + + INC_AFL_AREA(cur_loc + 1); + if ((arg1 & 0xffffff) == (arg2 & 0xffffff)) { INC_AFL_AREA(cur_loc + 2); } + } + } + } static void afl_compcov_log_64(target_ulong cur_loc, target_ulong arg1, target_ulong arg2) { if ((arg1 & 0xff) == (arg2 & 0xff)) { - afl_area_ptr[cur_loc]++; + + INC_AFL_AREA(cur_loc); if ((arg1 & 0xffff) == (arg2 & 0xffff)) { - afl_area_ptr[cur_loc +1]++; + + INC_AFL_AREA(cur_loc + 1); if ((arg1 & 0xffffff) == (arg2 & 0xffffff)) { - afl_area_ptr[cur_loc +2]++; + + INC_AFL_AREA(cur_loc + 2); if ((arg1 & 0xffffffff) == (arg2 & 0xffffffff)) { - afl_area_ptr[cur_loc +3]++; + + INC_AFL_AREA(cur_loc + 3); if ((arg1 & 0xffffffffff) == (arg2 & 0xffffffffff)) { - afl_area_ptr[cur_loc +4]++; + + INC_AFL_AREA(cur_loc + 4); if ((arg1 & 0xffffffffffff) == (arg2 & 0xffffffffffff)) { - afl_area_ptr[cur_loc +5]++; + + INC_AFL_AREA(cur_loc + 5); if ((arg1 & 0xffffffffffffff) == (arg2 & 0xffffffffffffff)) { - afl_area_ptr[cur_loc +6]++; + + INC_AFL_AREA(cur_loc + 6); + } + } + } + } + } + } + } -} +} static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2, - TCGMemOp ot) { + TCGMemOp ot, int is_imm) { void *func; - - if (!afl_enable_compcov || cur_loc > afl_end_code || cur_loc < afl_start_code) + + if (!afl_compcov_level || cur_loc > afl_end_code || cur_loc < afl_start_code) return; + if (!is_imm && afl_compcov_level < 2) return; + switch (ot) { - case MO_64: - func = &afl_compcov_log_64; - break; - case MO_32: - func = &afl_compcov_log_32; - break; - case MO_16: - func = &afl_compcov_log_16; - break; - default: - return; + + case MO_64: func = &afl_compcov_log_64; break; + case MO_32: func = &afl_compcov_log_32; break; + case MO_16: func = &afl_compcov_log_16; break; + default: return; + } - - cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); - cur_loc &= MAP_SIZE - 1; - + + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 7; + if (cur_loc >= afl_inst_rms) return; - + tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2); + } + diff --git a/qemu_mode/patches/afl-qemu-tcg-inl.h b/qemu_mode/patches/afl-qemu-tcg-inl.h index ff90d1b9..d45ffac9 100644 --- a/qemu_mode/patches/afl-qemu-tcg-inl.h +++ b/qemu_mode/patches/afl-qemu-tcg-inl.h @@ -1,19 +1,18 @@ /* - american fuzzy lop - high-performance binary-only instrumentation - ----------------------------------------------------------------- + american fuzzy lop++ - high-performance binary-only instrumentation + ------------------------------------------------------------------- - Written by Andrew Griffiths <agriffiths@google.com> and - Michal Zalewski <lcamtuf@google.com> - - Idea & design very much by Andrew Griffiths. + Originally written by Andrew Griffiths <agriffiths@google.com> and + Michal Zalewski <lcamtuf@google.com> TCG instrumentation and block chaining support by Andrea Biondo <andrea.biondo965@gmail.com> - QEMU 3.1.0 port, TCG thread-safety and CompareCoverage by Andrea Fioraldi - <andreafioraldi@gmail.com> + QEMU 3.1.0 port, TCG thread-safety, CompareCoverage and NeverZero + counters by Andrea Fioraldi <andreafioraldi@gmail.com> Copyright 2015, 2016, 2017 Google Inc. All rights reserved. + Copyright 2019 AFLplusplus Project. All rights reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -32,275 +31,343 @@ */ -void afl_maybe_log(void* cur_loc); +void afl_maybe_log(void *cur_loc); /* Note: we convert the 64 bit args to 32 bit and do some alignment and endian swap. Maybe it would be better to do the alignment and endian swap in tcg_reg_alloc_call(). */ -void tcg_gen_afl_maybe_log_call(target_ulong cur_loc) -{ - int real_args, pi; - unsigned sizemask, flags; - TCGOp *op; - - TCGTemp *arg = tcgv_i64_temp( tcg_const_tl(cur_loc) ); - - flags = 0; - sizemask = dh_sizemask(void, 0) | dh_sizemask(i64, 1); - -#if defined(__sparc__) && !defined(__arch64__) \ - && !defined(CONFIG_TCG_INTERPRETER) - /* We have 64-bit values in one register, but need to pass as two - separate parameters. Split them. */ - int orig_sizemask = sizemask; - TCGv_i64 retl, reth; - TCGTemp *split_args[MAX_OPC_PARAM]; - - retl = NULL; - reth = NULL; - if (sizemask != 0) { - real_args = 0; - int is_64bit = sizemask & (1 << 2); - if (is_64bit) { - TCGv_i64 orig = temp_tcgv_i64(arg); - TCGv_i32 h = tcg_temp_new_i32(); - TCGv_i32 l = tcg_temp_new_i32(); - tcg_gen_extr_i64_i32(l, h, orig); - split_args[real_args++] = tcgv_i32_temp(h); - split_args[real_args++] = tcgv_i32_temp(l); - } else { - split_args[real_args++] = arg; - } - nargs = real_args; - args = split_args; - sizemask = 0; +void tcg_gen_afl_maybe_log_call(target_ulong cur_loc) { + + int real_args, pi; + unsigned sizemask, flags; + TCGOp * op; + + TCGTemp *arg = tcgv_i64_temp(tcg_const_tl(cur_loc)); + + flags = 0; + sizemask = dh_sizemask(void, 0) | dh_sizemask(i64, 1); + +#if defined(__sparc__) && !defined(__arch64__) && \ + !defined(CONFIG_TCG_INTERPRETER) + /* We have 64-bit values in one register, but need to pass as two + separate parameters. Split them. */ + int orig_sizemask = sizemask; + TCGv_i64 retl, reth; + TCGTemp *split_args[MAX_OPC_PARAM]; + + retl = NULL; + reth = NULL; + if (sizemask != 0) { + + real_args = 0; + int is_64bit = sizemask & (1 << 2); + if (is_64bit) { + + TCGv_i64 orig = temp_tcgv_i64(arg); + TCGv_i32 h = tcg_temp_new_i32(); + TCGv_i32 l = tcg_temp_new_i32(); + tcg_gen_extr_i64_i32(l, h, orig); + split_args[real_args++] = tcgv_i32_temp(h); + split_args[real_args++] = tcgv_i32_temp(l); + + } else { + + split_args[real_args++] = arg; + } + + nargs = real_args; + args = split_args; + sizemask = 0; + + } + #elif defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64 - int is_64bit = sizemask & (1 << 2); - int is_signed = sizemask & (2 << 2); - if (!is_64bit) { - TCGv_i64 temp = tcg_temp_new_i64(); - TCGv_i64 orig = temp_tcgv_i64(arg); - if (is_signed) { - tcg_gen_ext32s_i64(temp, orig); - } else { - tcg_gen_ext32u_i64(temp, orig); - } - arg = tcgv_i64_temp(temp); + int is_64bit = sizemask & (1 << 2); + int is_signed = sizemask & (2 << 2); + if (!is_64bit) { + + TCGv_i64 temp = tcg_temp_new_i64(); + TCGv_i64 orig = temp_tcgv_i64(arg); + if (is_signed) { + + tcg_gen_ext32s_i64(temp, orig); + + } else { + + tcg_gen_ext32u_i64(temp, orig); + } -#endif /* TCG_TARGET_EXTEND_ARGS */ - op = tcg_emit_op(INDEX_op_call); + arg = tcgv_i64_temp(temp); - pi = 0; + } - TCGOP_CALLO(op) = 0; +#endif /* TCG_TARGET_EXTEND_ARGS */ + + op = tcg_emit_op(INDEX_op_call); + + pi = 0; + + TCGOP_CALLO(op) = 0; + + real_args = 0; + int is_64bit = sizemask & (1 << 2); + if (TCG_TARGET_REG_BITS < 64 && is_64bit) { - real_args = 0; - int is_64bit = sizemask & (1 << 2); - if (TCG_TARGET_REG_BITS < 64 && is_64bit) { #ifdef TCG_TARGET_CALL_ALIGN_ARGS - /* some targets want aligned 64 bit args */ - if (real_args & 1) { - op->args[pi++] = TCG_CALL_DUMMY_ARG; - real_args++; - } + /* some targets want aligned 64 bit args */ + if (real_args & 1) { + + op->args[pi++] = TCG_CALL_DUMMY_ARG; + real_args++; + + } + #endif - /* If stack grows up, then we will be placing successive - arguments at lower addresses, which means we need to - reverse the order compared to how we would normally - treat either big or little-endian. For those arguments - that will wind up in registers, this still works for - HPPA (the only current STACK_GROWSUP target) since the - argument registers are *also* allocated in decreasing - order. If another such target is added, this logic may - have to get more complicated to differentiate between - stack arguments and register arguments. */ + /* If stack grows up, then we will be placing successive + arguments at lower addresses, which means we need to + reverse the order compared to how we would normally + treat either big or little-endian. For those arguments + that will wind up in registers, this still works for + HPPA (the only current STACK_GROWSUP target) since the + argument registers are *also* allocated in decreasing + order. If another such target is added, this logic may + have to get more complicated to differentiate between + stack arguments and register arguments. */ #if defined(HOST_WORDS_BIGENDIAN) != defined(TCG_TARGET_STACK_GROWSUP) - op->args[pi++] = temp_arg(arg + 1); - op->args[pi++] = temp_arg(arg); + op->args[pi++] = temp_arg(arg + 1); + op->args[pi++] = temp_arg(arg); #else - op->args[pi++] = temp_arg(arg); - op->args[pi++] = temp_arg(arg + 1); + op->args[pi++] = temp_arg(arg); + op->args[pi++] = temp_arg(arg + 1); #endif - real_args += 2; - } + real_args += 2; + + } + + op->args[pi++] = temp_arg(arg); + real_args++; + + op->args[pi++] = (uintptr_t)&afl_maybe_log; + op->args[pi++] = flags; + TCGOP_CALLI(op) = real_args; + + /* Make sure the fields didn't overflow. */ + tcg_debug_assert(TCGOP_CALLI(op) == real_args); + tcg_debug_assert(pi <= ARRAY_SIZE(op->args)); + +#if defined(__sparc__) && !defined(__arch64__) && \ + !defined(CONFIG_TCG_INTERPRETER) + /* Free all of the parts we allocated above. */ + real_args = 0; + int is_64bit = orig_sizemask & (1 << 2); + if (is_64bit) { + + tcg_temp_free_internal(args[real_args++]); + tcg_temp_free_internal(args[real_args++]); + + } else { - op->args[pi++] = temp_arg(arg); real_args++; - op->args[pi++] = (uintptr_t)&afl_maybe_log; - op->args[pi++] = flags; - TCGOP_CALLI(op) = real_args; + } - /* Make sure the fields didn't overflow. */ - tcg_debug_assert(TCGOP_CALLI(op) == real_args); - tcg_debug_assert(pi <= ARRAY_SIZE(op->args)); + if (orig_sizemask & 1) { + + /* The 32-bit ABI returned two 32-bit pieces. Re-assemble them. + Note that describing these as TCGv_i64 eliminates an unnecessary + zero-extension that tcg_gen_concat_i32_i64 would create. */ + tcg_gen_concat32_i64(temp_tcgv_i64(NULL), retl, reth); + tcg_temp_free_i64(retl); + tcg_temp_free_i64(reth); + + } -#if defined(__sparc__) && !defined(__arch64__) \ - && !defined(CONFIG_TCG_INTERPRETER) - /* Free all of the parts we allocated above. */ - real_args = 0; - int is_64bit = orig_sizemask & (1 << 2); - if (is_64bit) { - tcg_temp_free_internal(args[real_args++]); - tcg_temp_free_internal(args[real_args++]); - } else { - real_args++; - } - if (orig_sizemask & 1) { - /* The 32-bit ABI returned two 32-bit pieces. Re-assemble them. - Note that describing these as TCGv_i64 eliminates an unnecessary - zero-extension that tcg_gen_concat_i32_i64 would create. */ - tcg_gen_concat32_i64(temp_tcgv_i64(NULL), retl, reth); - tcg_temp_free_i64(retl); - tcg_temp_free_i64(reth); - } #elif defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64 - int is_64bit = sizemask & (1 << 2); - if (!is_64bit) { - tcg_temp_free_internal(arg); - } -#endif /* TCG_TARGET_EXTEND_ARGS */ + int is_64bit = sizemask & (1 << 2); + if (!is_64bit) { tcg_temp_free_internal(arg); } +#endif /* TCG_TARGET_EXTEND_ARGS */ + } -void tcg_gen_afl_compcov_log_call(void *func, target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2) -{ - int i, real_args, nb_rets, pi; - unsigned sizemask, flags; - TCGOp *op; - - const int nargs = 3; - TCGTemp *args[3] = { tcgv_i64_temp( tcg_const_tl(cur_loc) ), - tcgv_i64_temp(arg1), - tcgv_i64_temp(arg2) }; - - flags = 0; - sizemask = dh_sizemask(void, 0) | dh_sizemask(i64, 1) | - dh_sizemask(i64, 2) | dh_sizemask(i64, 3); - -#if defined(__sparc__) && !defined(__arch64__) \ - && !defined(CONFIG_TCG_INTERPRETER) - /* We have 64-bit values in one register, but need to pass as two - separate parameters. Split them. */ - int orig_sizemask = sizemask; - int orig_nargs = nargs; - TCGv_i64 retl, reth; - TCGTemp *split_args[MAX_OPC_PARAM]; - - retl = NULL; - reth = NULL; - if (sizemask != 0) { - for (i = real_args = 0; i < nargs; ++i) { - int is_64bit = sizemask & (1 << (i+1)*2); - if (is_64bit) { - TCGv_i64 orig = temp_tcgv_i64(args[i]); - TCGv_i32 h = tcg_temp_new_i32(); - TCGv_i32 l = tcg_temp_new_i32(); - tcg_gen_extr_i64_i32(l, h, orig); - split_args[real_args++] = tcgv_i32_temp(h); - split_args[real_args++] = tcgv_i32_temp(l); - } else { - split_args[real_args++] = args[i]; - } - } - nargs = real_args; - args = split_args; - sizemask = 0; +void tcg_gen_afl_compcov_log_call(void *func, target_ulong cur_loc, + TCGv_i64 arg1, TCGv_i64 arg2) { + + int i, real_args, nb_rets, pi; + unsigned sizemask, flags; + TCGOp * op; + + const int nargs = 3; + TCGTemp *args[3] = {tcgv_i64_temp(tcg_const_tl(cur_loc)), tcgv_i64_temp(arg1), + tcgv_i64_temp(arg2)}; + + flags = 0; + sizemask = dh_sizemask(void, 0) | dh_sizemask(i64, 1) | dh_sizemask(i64, 2) | + dh_sizemask(i64, 3); + +#if defined(__sparc__) && !defined(__arch64__) && \ + !defined(CONFIG_TCG_INTERPRETER) + /* We have 64-bit values in one register, but need to pass as two + separate parameters. Split them. */ + int orig_sizemask = sizemask; + int orig_nargs = nargs; + TCGv_i64 retl, reth; + TCGTemp *split_args[MAX_OPC_PARAM]; + + retl = NULL; + reth = NULL; + if (sizemask != 0) { + + for (i = real_args = 0; i < nargs; ++i) { + + int is_64bit = sizemask & (1 << (i + 1) * 2); + if (is_64bit) { + + TCGv_i64 orig = temp_tcgv_i64(args[i]); + TCGv_i32 h = tcg_temp_new_i32(); + TCGv_i32 l = tcg_temp_new_i32(); + tcg_gen_extr_i64_i32(l, h, orig); + split_args[real_args++] = tcgv_i32_temp(h); + split_args[real_args++] = tcgv_i32_temp(l); + + } else { + + split_args[real_args++] = args[i]; + + } + } + + nargs = real_args; + args = split_args; + sizemask = 0; + + } + #elif defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64 - for (i = 0; i < nargs; ++i) { - int is_64bit = sizemask & (1 << (i+1)*2); - int is_signed = sizemask & (2 << (i+1)*2); - if (!is_64bit) { - TCGv_i64 temp = tcg_temp_new_i64(); - TCGv_i64 orig = temp_tcgv_i64(args[i]); - if (is_signed) { - tcg_gen_ext32s_i64(temp, orig); - } else { - tcg_gen_ext32u_i64(temp, orig); - } - args[i] = tcgv_i64_temp(temp); - } + for (i = 0; i < nargs; ++i) { + + int is_64bit = sizemask & (1 << (i + 1) * 2); + int is_signed = sizemask & (2 << (i + 1) * 2); + if (!is_64bit) { + + TCGv_i64 temp = tcg_temp_new_i64(); + TCGv_i64 orig = temp_tcgv_i64(args[i]); + if (is_signed) { + + tcg_gen_ext32s_i64(temp, orig); + + } else { + + tcg_gen_ext32u_i64(temp, orig); + + } + + args[i] = tcgv_i64_temp(temp); + } -#endif /* TCG_TARGET_EXTEND_ARGS */ - op = tcg_emit_op(INDEX_op_call); + } - pi = 0; - nb_rets = 0; - TCGOP_CALLO(op) = nb_rets; +#endif /* TCG_TARGET_EXTEND_ARGS */ + + op = tcg_emit_op(INDEX_op_call); + + pi = 0; + nb_rets = 0; + TCGOP_CALLO(op) = nb_rets; + + real_args = 0; + for (i = 0; i < nargs; i++) { + + int is_64bit = sizemask & (1 << (i + 1) * 2); + if (TCG_TARGET_REG_BITS < 64 && is_64bit) { - real_args = 0; - for (i = 0; i < nargs; i++) { - int is_64bit = sizemask & (1 << (i+1)*2); - if (TCG_TARGET_REG_BITS < 64 && is_64bit) { #ifdef TCG_TARGET_CALL_ALIGN_ARGS - /* some targets want aligned 64 bit args */ - if (real_args & 1) { - op->args[pi++] = TCG_CALL_DUMMY_ARG; - real_args++; - } + /* some targets want aligned 64 bit args */ + if (real_args & 1) { + + op->args[pi++] = TCG_CALL_DUMMY_ARG; + real_args++; + + } + #endif - /* If stack grows up, then we will be placing successive - arguments at lower addresses, which means we need to - reverse the order compared to how we would normally - treat either big or little-endian. For those arguments - that will wind up in registers, this still works for - HPPA (the only current STACK_GROWSUP target) since the - argument registers are *also* allocated in decreasing - order. If another such target is added, this logic may - have to get more complicated to differentiate between - stack arguments and register arguments. */ + /* If stack grows up, then we will be placing successive + arguments at lower addresses, which means we need to + reverse the order compared to how we would normally + treat either big or little-endian. For those arguments + that will wind up in registers, this still works for + HPPA (the only current STACK_GROWSUP target) since the + argument registers are *also* allocated in decreasing + order. If another such target is added, this logic may + have to get more complicated to differentiate between + stack arguments and register arguments. */ #if defined(HOST_WORDS_BIGENDIAN) != defined(TCG_TARGET_STACK_GROWSUP) - op->args[pi++] = temp_arg(args[i] + 1); - op->args[pi++] = temp_arg(args[i]); + op->args[pi++] = temp_arg(args[i] + 1); + op->args[pi++] = temp_arg(args[i]); #else - op->args[pi++] = temp_arg(args[i]); - op->args[pi++] = temp_arg(args[i] + 1); + op->args[pi++] = temp_arg(args[i]); + op->args[pi++] = temp_arg(args[i] + 1); #endif - real_args += 2; - continue; - } + real_args += 2; + continue; - op->args[pi++] = temp_arg(args[i]); - real_args++; - } - op->args[pi++] = (uintptr_t)func; - op->args[pi++] = flags; - TCGOP_CALLI(op) = real_args; - - /* Make sure the fields didn't overflow. */ - tcg_debug_assert(TCGOP_CALLI(op) == real_args); - tcg_debug_assert(pi <= ARRAY_SIZE(op->args)); - -#if defined(__sparc__) && !defined(__arch64__) \ - && !defined(CONFIG_TCG_INTERPRETER) - /* Free all of the parts we allocated above. */ - for (i = real_args = 0; i < orig_nargs; ++i) { - int is_64bit = orig_sizemask & (1 << (i+1)*2); - if (is_64bit) { - tcg_temp_free_internal(args[real_args++]); - tcg_temp_free_internal(args[real_args++]); - } else { - real_args++; - } } - if (orig_sizemask & 1) { - /* The 32-bit ABI returned two 32-bit pieces. Re-assemble them. - Note that describing these as TCGv_i64 eliminates an unnecessary - zero-extension that tcg_gen_concat_i32_i64 would create. */ - tcg_gen_concat32_i64(temp_tcgv_i64(NULL), retl, reth); - tcg_temp_free_i64(retl); - tcg_temp_free_i64(reth); + + op->args[pi++] = temp_arg(args[i]); + real_args++; + + } + + op->args[pi++] = (uintptr_t)func; + op->args[pi++] = flags; + TCGOP_CALLI(op) = real_args; + + /* Make sure the fields didn't overflow. */ + tcg_debug_assert(TCGOP_CALLI(op) == real_args); + tcg_debug_assert(pi <= ARRAY_SIZE(op->args)); + +#if defined(__sparc__) && !defined(__arch64__) && \ + !defined(CONFIG_TCG_INTERPRETER) + /* Free all of the parts we allocated above. */ + for (i = real_args = 0; i < orig_nargs; ++i) { + + int is_64bit = orig_sizemask & (1 << (i + 1) * 2); + if (is_64bit) { + + tcg_temp_free_internal(args[real_args++]); + tcg_temp_free_internal(args[real_args++]); + + } else { + + real_args++; + } + + } + + if (orig_sizemask & 1) { + + /* The 32-bit ABI returned two 32-bit pieces. Re-assemble them. + Note that describing these as TCGv_i64 eliminates an unnecessary + zero-extension that tcg_gen_concat_i32_i64 would create. */ + tcg_gen_concat32_i64(temp_tcgv_i64(NULL), retl, reth); + tcg_temp_free_i64(retl); + tcg_temp_free_i64(reth); + + } + #elif defined(TCG_TARGET_EXTEND_ARGS) && TCG_TARGET_REG_BITS == 64 - for (i = 0; i < nargs; ++i) { - int is_64bit = sizemask & (1 << (i+1)*2); - if (!is_64bit) { - tcg_temp_free_internal(args[i]); - } - } -#endif /* TCG_TARGET_EXTEND_ARGS */ + for (i = 0; i < nargs; ++i) { + + int is_64bit = sizemask & (1 << (i + 1) * 2); + if (!is_64bit) { tcg_temp_free_internal(args[i]); } + + } + +#endif /* TCG_TARGET_EXTEND_ARGS */ + } diff --git a/qemu_mode/patches/afl-qemu-translate-inl.h b/qemu_mode/patches/afl-qemu-translate-inl.h index bfb2897e..9abaa961 100644 --- a/qemu_mode/patches/afl-qemu-translate-inl.h +++ b/qemu_mode/patches/afl-qemu-translate-inl.h @@ -1,19 +1,18 @@ /* - american fuzzy lop - high-performance binary-only instrumentation - ----------------------------------------------------------------- + american fuzzy lop++ - high-performance binary-only instrumentation + ------------------------------------------------------------------- - Written by Andrew Griffiths <agriffiths@google.com> and - Michal Zalewski <lcamtuf@google.com> - - Idea & design very much by Andrew Griffiths. + Originally written by Andrew Griffiths <agriffiths@google.com> and + Michal Zalewski <lcamtuf@google.com> TCG instrumentation and block chaining support by Andrea Biondo <andrea.biondo965@gmail.com> - QEMU 3.1.0 port, TCG thread-safety and CompareCoverage by Andrea Fioraldi - <andreafioraldi@gmail.com> + QEMU 3.1.0 port, TCG thread-safety, CompareCoverage and NeverZero + counters by Andrea Fioraldi <andreafioraldi@gmail.com> Copyright 2015, 2016, 2017 Google Inc. All rights reserved. + Copyright 2019 AFLplusplus Project. All rights reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -32,21 +31,24 @@ */ -#include "../../config.h" +#include "afl-qemu-common.h" #include "tcg-op.h" /* Declared in afl-qemu-cpu-inl.h */ extern unsigned char *afl_area_ptr; -extern unsigned int afl_inst_rms; -extern abi_ulong afl_start_code, afl_end_code; +extern unsigned int afl_inst_rms; +extern abi_ulong afl_start_code, afl_end_code; void tcg_gen_afl_maybe_log_call(target_ulong cur_loc); -void afl_maybe_log(target_ulong cur_loc) { +void afl_maybe_log(target_ulong cur_loc) { static __thread abi_ulong prev_loc; - afl_area_ptr[cur_loc ^ prev_loc]++; + register uintptr_t afl_idx = cur_loc ^ prev_loc; + + INC_AFL_AREA(afl_idx); + prev_loc = cur_loc >> 1; } @@ -57,14 +59,16 @@ static void afl_gen_trace(target_ulong cur_loc) { /* Optimize for cur_loc > afl_end_code, which is the most likely case on Linux systems. */ - if (cur_loc > afl_end_code || cur_loc < afl_start_code /*|| !afl_area_ptr*/) // not needed because of static dummy buffer + if (cur_loc > afl_end_code || + cur_loc < afl_start_code /*|| !afl_area_ptr*/) // not needed because of + // static dummy buffer return; /* Looks like QEMU always maps to fixed locations, so ASLR is not a concern. Phew. But instruction addresses may be aligned. Let's mangle the value to get something quasi-uniform. */ - cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); cur_loc &= MAP_SIZE - 1; /* Implement probabilistic instrumentation by looking at scrambled block @@ -73,5 +77,6 @@ static void afl_gen_trace(target_ulong cur_loc) { if (cur_loc >= afl_inst_rms) return; tcg_gen_afl_maybe_log_call(cur_loc); - + } + diff --git a/qemu_mode/patches/i386-translate.diff b/qemu_mode/patches/i386-translate.diff index 0bc48828..239b2404 100644 --- a/qemu_mode/patches/i386-translate.diff +++ b/qemu_mode/patches/i386-translate.diff @@ -15,11 +15,11 @@ index 0dd5fbe4..b95d341e 100644 tcg_gen_atomic_fetch_add_tl(s1->cc_srcT, s1->A0, s1->T0, s1->mem_index, ot | MO_LE); tcg_gen_sub_tl(s1->T0, s1->cc_srcT, s1->T1); -+ afl_gen_compcov(s1->pc, s1->cc_srcT, s1->T1, ot); ++ afl_gen_compcov(s1->pc, s1->cc_srcT, s1->T1, ot, d == OR_EAX); } else { tcg_gen_mov_tl(s1->cc_srcT, s1->T0); tcg_gen_sub_tl(s1->T0, s1->T0, s1->T1); -+ afl_gen_compcov(s1->pc, s1->T0, s1->T1, ot); ++ afl_gen_compcov(s1->pc, s1->T0, s1->T1, ot, d == OR_EAX); gen_op_st_rm_T0_A0(s1, ot, d); } gen_op_update2_cc(s1); @@ -27,7 +27,7 @@ index 0dd5fbe4..b95d341e 100644 tcg_gen_mov_tl(cpu_cc_src, s1->T1); tcg_gen_mov_tl(s1->cc_srcT, s1->T0); tcg_gen_sub_tl(cpu_cc_dst, s1->T0, s1->T1); -+ afl_gen_compcov(s1->pc, s1->T0, s1->T1, ot); ++ afl_gen_compcov(s1->pc, s1->T0, s1->T1, ot, d == OR_EAX); set_cc_op(s1, CC_OP_SUBB + ot); break; } diff --git a/qemu_mode/patches/syscall.diff b/qemu_mode/patches/syscall.diff index cb2acfcd..60b5905e 100644 --- a/qemu_mode/patches/syscall.diff +++ b/qemu_mode/patches/syscall.diff @@ -2,9 +2,10 @@ diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 280137da..8c0e749f 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c -@@ -112,6 +112,8 @@ +@@ -112,6 +112,9 @@ #include "qemu.h" #include "fd-trans.h" ++#include <linux/sockios.h> +extern unsigned int afl_forksrv_pid; + @@ -32,4 +33,4 @@ index 280137da..8c0e749f 100644 + } #ifdef TARGET_NR_set_robust_list - case TARGET_NR_set_robust_list: + case TARGET_NR_set_robust_list: \ No newline at end of file |