diff options
Diffstat (limited to 'src/afl-fuzz-globals.c')
| -rw-r--r-- | src/afl-fuzz-globals.c | 376 |
1 files changed, 175 insertions, 201 deletions
diff --git a/src/afl-fuzz-globals.c b/src/afl-fuzz-globals.c index e28c3099..8fded173 100644 --- a/src/afl-fuzz-globals.c +++ b/src/afl-fuzz-globals.c @@ -25,27 +25,13 @@ /* MOpt: Lots of globals, but mostly for the status UI and other things where it really makes no sense to haul them around as function parameters. */ -u64 limit_time_puppet, - orig_hit_cnt_puppet, - last_limit_time_start, - tmp_pilot_time, - total_pacemaker_time, - total_puppet_find, - temp_puppet_find, - most_time_key, - most_time, - most_execs_key, - most_execs, - old_hit_count; - -s32 SPLICE_CYCLES_puppet, - limit_time_sig, - key_puppet, - key_module; - -double w_init = 0.9, - w_end = 0.3, - w_now; +u64 limit_time_puppet, orig_hit_cnt_puppet, last_limit_time_start, + tmp_pilot_time, total_pacemaker_time, total_puppet_find, temp_puppet_find, + most_time_key, most_time, most_execs_key, most_execs, old_hit_count; + +s32 SPLICE_CYCLES_puppet, limit_time_sig, key_puppet, key_module; + +double w_init = 0.9, w_end = 0.3, w_now; s32 g_now; s32 g_max = 5000; @@ -53,15 +39,13 @@ s32 g_max = 5000; u64 tmp_core_time; s32 swarm_now; -double x_now[swarm_num][operator_num], - L_best[swarm_num][operator_num], - eff_best[swarm_num][operator_num], - G_best[operator_num], - v_now[swarm_num][operator_num], - probability_now[swarm_num][operator_num], - swarm_fitness[swarm_num]; +double x_now[swarm_num][operator_num], L_best[swarm_num][operator_num], + eff_best[swarm_num][operator_num], G_best[operator_num], + v_now[swarm_num][operator_num], probability_now[swarm_num][operator_num], + swarm_fitness[swarm_num]; -u64 stage_finds_puppet[swarm_num][operator_num], /* Patterns found per fuzz stage */ +u64 stage_finds_puppet[swarm_num] + [operator_num], /* Patterns found per fuzz stage */ stage_finds_puppet_v2[swarm_num][operator_num], stage_cycles_puppet_v2[swarm_num][operator_num], stage_cycles_puppet_v3[swarm_num][operator_num], @@ -71,207 +55,197 @@ u64 stage_finds_puppet[swarm_num][operator_num], /* Patterns found per core_operator_finds_puppet_v2[operator_num], core_operator_cycles_puppet[operator_num], core_operator_cycles_puppet_v2[operator_num], - core_operator_cycles_puppet_v3[operator_num]; /* Execs per fuzz stage */ + core_operator_cycles_puppet_v3[operator_num]; /* Execs per fuzz stage */ double period_pilot_tmp = 5000.0; -s32 key_lv; - -u8 *in_dir, /* Input directory with test cases */ - *out_dir, /* Working & output directory */ - *tmp_dir , /* Temporary directory for input */ - *sync_dir, /* Synchronization directory */ - *sync_id, /* Fuzzer ID */ - *power_name, /* Power schedule name */ - *use_banner, /* Display banner */ - *in_bitmap, /* Input bitmap */ - *file_extension, /* File extension */ - *orig_cmdline; /* Original command line */ -u8 *doc_path, /* Path to documentation dir */ - *target_path, /* Path to target binary */ - *out_file; /* File to fuzz, if any */ - -u32 exec_tmout = EXEC_TIMEOUT; /* Configurable exec timeout (ms) */ -u32 hang_tmout = EXEC_TIMEOUT; /* Timeout used for hang det (ms) */ - -u64 mem_limit = MEM_LIMIT; /* Memory cap for child (MB) */ - -u8 cal_cycles = CAL_CYCLES, /* Calibration cycles defaults */ - cal_cycles_long = CAL_CYCLES_LONG, - debug, /* Debug mode */ - python_only; /* Python-only mode */ - -u32 stats_update_freq = 1; /* Stats update frequency (execs) */ - -char *power_names[POWER_SCHEDULES_NUM] = { - "explore", - "fast", - "coe", - "lin", - "quad", - "exploit" -}; - -u8 schedule = EXPLORE; /* Power schedule (default: EXPLORE)*/ +s32 key_lv; + +u8 *in_dir, /* Input directory with test cases */ + *out_dir, /* Working & output directory */ + *tmp_dir, /* Temporary directory for input */ + *sync_dir, /* Synchronization directory */ + *sync_id, /* Fuzzer ID */ + *power_name, /* Power schedule name */ + *use_banner, /* Display banner */ + *in_bitmap, /* Input bitmap */ + *file_extension, /* File extension */ + *orig_cmdline; /* Original command line */ +u8 *doc_path, /* Path to documentation dir */ + *target_path, /* Path to target binary */ + *out_file; /* File to fuzz, if any */ + +u32 exec_tmout = EXEC_TIMEOUT; /* Configurable exec timeout (ms) */ +u32 hang_tmout = EXEC_TIMEOUT; /* Timeout used for hang det (ms) */ + +u64 mem_limit = MEM_LIMIT; /* Memory cap for child (MB) */ + +u8 cal_cycles = CAL_CYCLES, /* Calibration cycles defaults */ + cal_cycles_long = CAL_CYCLES_LONG, debug, /* Debug mode */ + python_only; /* Python-only mode */ + +u32 stats_update_freq = 1; /* Stats update frequency (execs) */ + +char *power_names[POWER_SCHEDULES_NUM] = {"explore", "fast", "coe", + "lin", "quad", "exploit"}; + +u8 schedule = EXPLORE; /* Power schedule (default: EXPLORE)*/ u8 havoc_max_mult = HAVOC_MAX_MULT; -u8 skip_deterministic, /* Skip deterministic stages? */ - force_deterministic, /* Force deterministic stages? */ - use_splicing, /* Recombine input files? */ - dumb_mode, /* Run in non-instrumented mode? */ - score_changed, /* Scoring for favorites changed? */ - kill_signal, /* Signal that killed the child */ - resuming_fuzz, /* Resuming an older fuzzing job? */ - timeout_given, /* Specific timeout given? */ - not_on_tty, /* stdout is not a tty */ - term_too_small, /* terminal dimensions too small */ - no_forkserver, /* Disable forkserver? */ - crash_mode, /* Crash mode! Yeah! */ - in_place_resume, /* Attempt in-place resume? */ - auto_changed, /* Auto-generated tokens changed? */ - no_cpu_meter_red, /* Feng shui on the status screen */ - no_arith, /* Skip most arithmetic ops */ - shuffle_queue, /* Shuffle input queue? */ - bitmap_changed = 1, /* Time to update bitmap? */ - qemu_mode, /* Running in QEMU mode? */ - unicorn_mode, /* Running in Unicorn mode? */ - skip_requested, /* Skip request, via SIGUSR1 */ - run_over10m, /* Run time over 10 minutes? */ - persistent_mode, /* Running in persistent mode? */ - deferred_mode, /* Deferred forkserver mode? */ - fixed_seed, /* do not reseed */ - fast_cal, /* Try to calibrate faster? */ - uses_asan; /* Target uses ASAN? */ - -s32 out_fd, /* Persistent fd for out_file */ +u8 skip_deterministic, /* Skip deterministic stages? */ + force_deterministic, /* Force deterministic stages? */ + use_splicing, /* Recombine input files? */ + dumb_mode, /* Run in non-instrumented mode? */ + score_changed, /* Scoring for favorites changed? */ + kill_signal, /* Signal that killed the child */ + resuming_fuzz, /* Resuming an older fuzzing job? */ + timeout_given, /* Specific timeout given? */ + not_on_tty, /* stdout is not a tty */ + term_too_small, /* terminal dimensions too small */ + no_forkserver, /* Disable forkserver? */ + crash_mode, /* Crash mode! Yeah! */ + in_place_resume, /* Attempt in-place resume? */ + auto_changed, /* Auto-generated tokens changed? */ + no_cpu_meter_red, /* Feng shui on the status screen */ + no_arith, /* Skip most arithmetic ops */ + shuffle_queue, /* Shuffle input queue? */ + bitmap_changed = 1, /* Time to update bitmap? */ + qemu_mode, /* Running in QEMU mode? */ + unicorn_mode, /* Running in Unicorn mode? */ + skip_requested, /* Skip request, via SIGUSR1 */ + run_over10m, /* Run time over 10 minutes? */ + persistent_mode, /* Running in persistent mode? */ + deferred_mode, /* Deferred forkserver mode? */ + fixed_seed, /* do not reseed */ + fast_cal, /* Try to calibrate faster? */ + uses_asan; /* Target uses ASAN? */ + +s32 out_fd, /* Persistent fd for out_file */ #ifndef HAVE_ARC4RANDOM - dev_urandom_fd = -1, /* Persistent fd for /dev/urandom */ + dev_urandom_fd = -1, /* Persistent fd for /dev/urandom */ #endif - dev_null_fd = -1, /* Persistent fd for /dev/null */ - fsrv_ctl_fd, /* Fork server control pipe (write) */ - fsrv_st_fd; /* Fork server status pipe (read) */ - - s32 forksrv_pid, /* PID of the fork server */ - child_pid = -1, /* PID of the fuzzed program */ - out_dir_fd = -1; /* FD of the lock file */ - - u8* trace_bits; /* SHM with instrumentation bitmap */ - -u8 virgin_bits[MAP_SIZE], /* Regions yet untouched by fuzzing */ - virgin_tmout[MAP_SIZE], /* Bits we haven't seen in tmouts */ - virgin_crash[MAP_SIZE]; /* Bits we haven't seen in crashes */ - -u8 var_bytes[MAP_SIZE]; /* Bytes that appear to be variable */ - -volatile u8 stop_soon, /* Ctrl-C pressed? */ - clear_screen = 1, /* Window resized? */ - child_timed_out; /* Traced process timed out? */ - -u32 queued_paths, /* Total number of queued testcases */ - queued_variable, /* Testcases with variable behavior */ - queued_at_start, /* Total number of initial inputs */ - queued_discovered, /* Items discovered during this run */ - queued_imported, /* Items imported via -S */ - queued_favored, /* Paths deemed favorable */ - queued_with_cov, /* Paths with new coverage bytes */ - pending_not_fuzzed, /* Queued but not done yet */ - pending_favored, /* Pending favored paths */ - cur_skipped_paths, /* Abandoned inputs in cur cycle */ - cur_depth, /* Current path depth */ - max_depth, /* Max path depth */ - useless_at_start, /* Number of useless starting paths */ - var_byte_count, /* Bitmap bytes with var behavior */ - current_entry, /* Current queue entry ID */ - havoc_div = 1; /* Cycle count divisor for havoc */ - -u64 total_crashes, /* Total number of crashes */ - unique_crashes, /* Crashes with unique signatures */ - total_tmouts, /* Total number of timeouts */ - unique_tmouts, /* Timeouts with unique signatures */ - unique_hangs, /* Hangs with unique signatures */ - total_execs, /* Total execve() calls */ - slowest_exec_ms, /* Slowest testcase non hang in ms */ - start_time, /* Unix start time (ms) */ - last_path_time, /* Time for most recent path (ms) */ - last_crash_time, /* Time for most recent crash (ms) */ - last_hang_time, /* Time for most recent hang (ms) */ - last_crash_execs, /* Exec counter at last crash */ - queue_cycle, /* Queue round counter */ - cycles_wo_finds, /* Cycles without any new paths */ - trim_execs, /* Execs done to trim input files */ - bytes_trim_in, /* Bytes coming into the trimmer */ - bytes_trim_out, /* Bytes coming outa the trimmer */ - blocks_eff_total, /* Blocks subject to effector maps */ - blocks_eff_select; /* Blocks selected as fuzzable */ - -u32 subseq_tmouts; /* Number of timeouts in a row */ - -u8 *stage_name = "init", /* Name of the current fuzz stage */ - *stage_short, /* Short stage name */ - *syncing_party; /* Currently syncing with... */ - -s32 stage_cur, stage_max; /* Stage progression */ -s32 splicing_with = -1; /* Splicing with which test case? */ - -u32 master_id, master_max; /* Master instance job splitting */ - -u32 syncing_case; /* Syncing with case #... */ - -s32 stage_cur_byte, /* Byte offset of current stage op */ - stage_cur_val; /* Value used for stage op */ - -u8 stage_val_type; /* Value type (STAGE_VAL_*) */ - -u64 stage_finds[32], /* Patterns found per fuzz stage */ - stage_cycles[32]; /* Execs per fuzz stage */ + dev_null_fd = -1, /* Persistent fd for /dev/null */ + fsrv_ctl_fd, /* Fork server control pipe (write) */ + fsrv_st_fd; /* Fork server status pipe (read) */ + +s32 forksrv_pid, /* PID of the fork server */ + child_pid = -1, /* PID of the fuzzed program */ + out_dir_fd = -1; /* FD of the lock file */ + +u8 *trace_bits; /* SHM with instrumentation bitmap */ + +u8 virgin_bits[MAP_SIZE], /* Regions yet untouched by fuzzing */ + virgin_tmout[MAP_SIZE], /* Bits we haven't seen in tmouts */ + virgin_crash[MAP_SIZE]; /* Bits we haven't seen in crashes */ + +u8 var_bytes[MAP_SIZE]; /* Bytes that appear to be variable */ + +volatile u8 stop_soon, /* Ctrl-C pressed? */ + clear_screen = 1, /* Window resized? */ + child_timed_out; /* Traced process timed out? */ + +u32 queued_paths, /* Total number of queued testcases */ + queued_variable, /* Testcases with variable behavior */ + queued_at_start, /* Total number of initial inputs */ + queued_discovered, /* Items discovered during this run */ + queued_imported, /* Items imported via -S */ + queued_favored, /* Paths deemed favorable */ + queued_with_cov, /* Paths with new coverage bytes */ + pending_not_fuzzed, /* Queued but not done yet */ + pending_favored, /* Pending favored paths */ + cur_skipped_paths, /* Abandoned inputs in cur cycle */ + cur_depth, /* Current path depth */ + max_depth, /* Max path depth */ + useless_at_start, /* Number of useless starting paths */ + var_byte_count, /* Bitmap bytes with var behavior */ + current_entry, /* Current queue entry ID */ + havoc_div = 1; /* Cycle count divisor for havoc */ + +u64 total_crashes, /* Total number of crashes */ + unique_crashes, /* Crashes with unique signatures */ + total_tmouts, /* Total number of timeouts */ + unique_tmouts, /* Timeouts with unique signatures */ + unique_hangs, /* Hangs with unique signatures */ + total_execs, /* Total execve() calls */ + slowest_exec_ms, /* Slowest testcase non hang in ms */ + start_time, /* Unix start time (ms) */ + last_path_time, /* Time for most recent path (ms) */ + last_crash_time, /* Time for most recent crash (ms) */ + last_hang_time, /* Time for most recent hang (ms) */ + last_crash_execs, /* Exec counter at last crash */ + queue_cycle, /* Queue round counter */ + cycles_wo_finds, /* Cycles without any new paths */ + trim_execs, /* Execs done to trim input files */ + bytes_trim_in, /* Bytes coming into the trimmer */ + bytes_trim_out, /* Bytes coming outa the trimmer */ + blocks_eff_total, /* Blocks subject to effector maps */ + blocks_eff_select; /* Blocks selected as fuzzable */ + +u32 subseq_tmouts; /* Number of timeouts in a row */ + +u8 *stage_name = "init", /* Name of the current fuzz stage */ + *stage_short, /* Short stage name */ + *syncing_party; /* Currently syncing with... */ + +s32 stage_cur, stage_max; /* Stage progression */ +s32 splicing_with = -1; /* Splicing with which test case? */ + +u32 master_id, master_max; /* Master instance job splitting */ + +u32 syncing_case; /* Syncing with case #... */ + +s32 stage_cur_byte, /* Byte offset of current stage op */ + stage_cur_val; /* Value used for stage op */ + +u8 stage_val_type; /* Value type (STAGE_VAL_*) */ + +u64 stage_finds[32], /* Patterns found per fuzz stage */ + stage_cycles[32]; /* Execs per fuzz stage */ #ifndef HAVE_ARC4RANDOM -u32 rand_cnt; /* Random number counter */ +u32 rand_cnt; /* Random number counter */ #endif -u64 total_cal_us, /* Total calibration time (us) */ - total_cal_cycles; /* Total calibration cycles */ +u64 total_cal_us, /* Total calibration time (us) */ + total_cal_cycles; /* Total calibration cycles */ -u64 total_bitmap_size, /* Total bit count for all bitmaps */ - total_bitmap_entries; /* Number of bitmaps counted */ +u64 total_bitmap_size, /* Total bit count for all bitmaps */ + total_bitmap_entries; /* Number of bitmaps counted */ -s32 cpu_core_count; /* CPU core count */ +s32 cpu_core_count; /* CPU core count */ #ifdef HAVE_AFFINITY -s32 cpu_aff = -1; /* Selected CPU core */ +s32 cpu_aff = -1; /* Selected CPU core */ #endif /* HAVE_AFFINITY */ -FILE* plot_file; /* Gnuplot output file */ +FILE *plot_file; /* Gnuplot output file */ +struct queue_entry *queue, /* Fuzzing queue (linked list) */ + *queue_cur, /* Current offset within the queue */ + *queue_top, /* Top of the list */ + *q_prev100; /* Previous 100 marker */ +struct queue_entry *top_rated[MAP_SIZE]; /* Top entries for bitmap bytes */ -struct queue_entry *queue, /* Fuzzing queue (linked list) */ - *queue_cur, /* Current offset within the queue */ - *queue_top, /* Top of the list */ - *q_prev100; /* Previous 100 marker */ +struct extra_data *extras; /* Extra tokens to fuzz with */ +u32 extras_cnt; /* Total number of tokens read */ -struct queue_entry* - top_rated[MAP_SIZE]; /* Top entries for bitmap bytes */ +struct extra_data *a_extras; /* Automatically selected extras */ +u32 a_extras_cnt; /* Total number of tokens available */ -struct extra_data* extras; /* Extra tokens to fuzz with */ -u32 extras_cnt; /* Total number of tokens read */ - -struct extra_data* a_extras; /* Automatically selected extras */ -u32 a_extras_cnt; /* Total number of tokens available */ - -u8* (*post_handler)(u8* buf, u32* len); +u8 *(*post_handler)(u8 *buf, u32 *len); /* hooks for the custom mutator function */ -size_t (*custom_mutator)(u8 *data, size_t size, u8* mutated_out, size_t max_size, unsigned int seed); +size_t (*custom_mutator)(u8 *data, size_t size, u8 *mutated_out, + size_t max_size, unsigned int seed); size_t (*pre_save_handler)(u8 *data, size_t size, u8 **new_data); - /* Interesting values, as per config.h */ -s8 interesting_8[] = { INTERESTING_8 }; -s16 interesting_16[] = { INTERESTING_8, INTERESTING_16 }; -s32 interesting_32[] = { INTERESTING_8, INTERESTING_16, INTERESTING_32 }; +s8 interesting_8[] = {INTERESTING_8}; +s16 interesting_16[] = {INTERESTING_8, INTERESTING_16}; +s32 interesting_32[] = {INTERESTING_8, INTERESTING_16, INTERESTING_32}; /* Python stuff */ #ifdef USE_PYTHON |