diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/afl-as.c | 2 | ||||
| -rw-r--r-- | src/afl-forkserver.c | 4 | ||||
| -rw-r--r-- | src/afl-fuzz-cmplog.c | 4 | ||||
| -rw-r--r-- | src/afl-fuzz-init.c | 4 | ||||
| -rw-r--r-- | src/afl-fuzz-stats.c | 6 | ||||
| -rw-r--r-- | src/afl-fuzz.c | 6 | ||||
| -rw-r--r-- | src/afl-gotcpu.c | 2 | ||||
| -rw-r--r-- | src/afl-showmap.c | 257 | ||||
| -rw-r--r-- | src/afl-tmin.c | 12 |
9 files changed, 264 insertions, 33 deletions
diff --git a/src/afl-as.c b/src/afl-as.c index 8d689385..5fa83569 100644 --- a/src/afl-as.c +++ b/src/afl-as.c @@ -27,7 +27,7 @@ utility has right now is to be able to skip them gracefully and allow the compilation process to continue. - That said, see experimental/clang_asm_normalize/ for a solution that may + That said, see examples/clang_asm_normalize/ for a solution that may allow clang users to make things work even with hand-crafted assembly. Just note that there is no equivalent for GCC. diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c index 77e1d648..b1943633 100644 --- a/src/afl-forkserver.c +++ b/src/afl-forkserver.c @@ -332,7 +332,7 @@ void init_forkserver(char **argv) { "have a\n" " restrictive memory limit configured, this is expected; please " "read\n" - " %s/notes_for_asan.txt for help.\n", + " %s/notes_for_asan.md for help.\n", doc_path); } else if (!mem_limit) { @@ -408,7 +408,7 @@ void init_forkserver(char **argv) { "with ASAN and\n" " you have a restrictive memory limit configured, this is " "expected; please\n" - " read %s/notes_for_asan.txt for help.\n", + " read %s/notes_for_asan.md for help.\n", doc_path); } else if (!mem_limit) { diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c index 5906756d..92bac4ab 100644 --- a/src/afl-fuzz-cmplog.c +++ b/src/afl-fuzz-cmplog.c @@ -217,7 +217,7 @@ void init_cmplog_forkserver(char** argv) { "have a\n" " restrictive memory limit configured, this is expected; please " "read\n" - " %s/notes_for_asan.txt for help.\n", + " %s/notes_for_asan.md for help.\n", doc_path); } else if (!mem_limit) { @@ -293,7 +293,7 @@ void init_cmplog_forkserver(char** argv) { "with ASAN and\n" " you have a restrictive memory limit configured, this is " "expected; please\n" - " read %s/notes_for_asan.txt for help.\n", + " read %s/notes_for_asan.md for help.\n", doc_path); } else if (!mem_limit) { diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c index c4a02698..9265e4a5 100644 --- a/src/afl-fuzz-init.c +++ b/src/afl-fuzz-init.c @@ -601,7 +601,7 @@ void perform_dry_run(char** argv) { "quickly\n" " estimate the required amount of virtual memory for the " "binary. Also,\n" - " if you are using ASAN, see %s/notes_for_asan.txt.\n\n" + " if you are using ASAN, see %s/notes_for_asan.md.\n\n" MSG_FORK_ON_APPLE @@ -1719,7 +1719,7 @@ void get_core_count(void) { } else if (cur_runnable + 1 <= cpu_core_count) { - OKF("Try parallel jobs - see %s/parallel_fuzzing.txt.", doc_path); + OKF("Try parallel jobs - see %s/parallel_fuzzing.md.", doc_path); } diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index be065647..9dc4b917 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -747,7 +747,7 @@ void show_init_stats(void) { SAYF("\n"); if (avg_us > ((qemu_mode || unicorn_mode) ? 50000 : 10000)) - WARNF(cLRD "The target binary is pretty slow! See %s/perf_tips.txt.", + WARNF(cLRD "The target binary is pretty slow! See %s/perf_tips.md.", doc_path); /* Let's keep things moving with slow binaries. */ @@ -762,10 +762,10 @@ void show_init_stats(void) { if (!resuming_fuzz) { if (max_len > 50 * 1024) - WARNF(cLRD "Some test cases are huge (%s) - see %s/perf_tips.txt!", + WARNF(cLRD "Some test cases are huge (%s) - see %s/perf_tips.md!", DMS(max_len), doc_path); else if (max_len > 10 * 1024) - WARNF("Some test cases are big (%s) - see %s/perf_tips.txt.", + WARNF("Some test cases are big (%s) - see %s/perf_tips.md.", DMS(max_len), doc_path); if (useless_at_start && !in_bitmap) diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index eae4ba1f..8833244d 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -96,7 +96,7 @@ static void usage(u8* argv0) { "score.\n" " <explore (default), fast, coe, lin, quad, or " "exploit>\n" - " see docs/power_schedules.txt\n" + " see docs/power_schedules.md\n" " -f file - location read by the fuzzed program (stdin)\n" " -t msec - timeout for each run (auto-scaled, 50-%d ms)\n" " -m megs - memory limit for child process (%d MB)\n" @@ -133,7 +133,7 @@ static void usage(u8* argv0) { "Other stuff:\n" " -T text - text banner to show on the screen\n" - " -M / -S id - distributed mode (see parallel_fuzzing.txt)\n" + " -M / -S id - distributed mode (see parallel_fuzzing.md)\n" " -I command - execute this command/script when a new crash is " "found\n" " -B bitmap.txt - mutate a specific test case, use the out/fuzz_bitmap " @@ -145,7 +145,7 @@ static void usage(u8* argv0) { argv0, EXEC_TIMEOUT, MEM_LIMIT); #ifdef USE_PYTHON - SAYF("Compiled with %s module support, see docs/python_mutators.txt\n", + SAYF("Compiled with %s module support, see docs/python_mutators.md\n", (char*)PYTHON_VERSION); #endif diff --git a/src/afl-gotcpu.c b/src/afl-gotcpu.c index 5be30238..214862a9 100644 --- a/src/afl-gotcpu.c +++ b/src/afl-gotcpu.c @@ -19,7 +19,7 @@ This tool provides a fairly accurate measurement of CPU preemption rate. It is meant to complement the quick-and-dirty load average widget shown - in the afl-fuzz UI. See docs/parallel_fuzzing.txt for more info. + in the afl-fuzz UI. See docs/parallel_fuzzing.md for more info. For some work loads, the tool may actually suggest running more instances than you have CPU cores. This can happen if the tested program is spending diff --git a/src/afl-showmap.c b/src/afl-showmap.c index b9da3208..0aa5c158 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -39,6 +39,7 @@ #include "alloc-inl.h" #include "hash.h" #include "sharedmem.h" +#include "forkserver.h" #include "common.h" #include <stdio.h> @@ -58,19 +59,39 @@ #include <sys/types.h> #include <sys/resource.h> -static s32 child_pid; /* PID of the tested program */ +u8* trace_bits; /* SHM with instrumentation bitmap */ + +s32 forksrv_pid, /* PID of the fork server */ + child_pid; /* PID of the tested program */ + +s32 fsrv_ctl_fd, /* Fork server control pipe (write) */ + fsrv_st_fd; /* Fork server status pipe (read) */ + +s32 out_fd; /* Persistent fd for out_file */ +s32 dev_null_fd = -1; /* FD to /dev/null */ + +s32 out_fd = -1, out_dir_fd = -1, dev_urandom_fd = -1; +FILE* plot_file; +u8 uses_asan; u8* trace_bits; /* SHM with instrumentation bitmap */ -static u8 *out_file, /* Trace output file */ +u8 *out_file, /* Trace output file */ + *in_dir, /* input folder */ *doc_path, /* Path to docs */ *at_file; /* Substitution string for @@ */ -static u32 exec_tmout; /* Exec timeout (ms) */ +static u8* in_data; /* Input data */ + +u32 exec_tmout; /* Exec timeout (ms) */ static u32 total, highest; /* tuple content information */ -static u64 mem_limit = MEM_LIMIT; /* Memory limit (MB) */ +static u32 in_len, /* Input data length */ + arg_offset, + total_execs; /* Total number of execs */ + +u64 mem_limit = MEM_LIMIT; /* Memory limit (MB) */ u8 quiet_mode, /* Hide non-essential messages? */ edges_only, /* Ignore hit counts? */ @@ -139,7 +160,7 @@ static void classify_counts(u8* mem, const u8* map) { /* Write results. */ -static u32 write_results(void) { +static u32 write_results_to_file(u8 *out_file) { s32 fd; u32 i, ret = 0; @@ -208,15 +229,172 @@ static u32 write_results(void) { } -/* Handle timeout signal. */ +/* Write results. */ -static void handle_timeout(int sig) { +static u32 write_results(void) { - child_timed_out = 1; - if (child_pid > 0) kill(child_pid, SIGKILL); + return write_results_to_file(out_file); + +} + +/* Write output file. */ + +static s32 write_to_file(u8* path, u8* mem, u32 len) { + + s32 ret; + + unlink(path); /* Ignore errors */ + + ret = open(path, O_RDWR | O_CREAT | O_EXCL, 0600); + + if (ret < 0) PFATAL("Unable to create '%s'", path); + + ck_write(ret, mem, len, path); + + lseek(ret, 0, SEEK_SET); + + return ret; + +} + +/* Write modified data to file for testing. If use_stdin is clear, the old file + is unlinked and a new one is created. Otherwise, out_fd is rewound and + truncated. */ + +static void write_to_testcase(void* mem, u32 len) { + + if (use_stdin) { + + lseek(0, 0, SEEK_SET); + + ck_write(0, mem, len, out_file); + + if (ftruncate(0, len)) PFATAL("ftruncate() failed"); + lseek(0, 0, SEEK_SET); + + } } +/* Execute target application. Returns 0 if the changes are a dud, or + 1 if they should be kept. */ + +static u8 run_target_forkserver(char** argv, u8* mem, u32 len) { + + static struct itimerval it; + static u32 prev_timed_out = 0; + int status = 0; + + memset(trace_bits, 0, MAP_SIZE); + MEM_BARRIER(); + + write_to_testcase(mem, len); + + s32 res; + + /* we have the fork server up and running, so simply + tell it to have at it, and then read back PID. */ + + if ((res = write(fsrv_ctl_fd, &prev_timed_out, 4)) != 4) { + + if (stop_soon) return 0; + RPFATAL(res, "Unable to request new process from fork server (OOM?)"); + + } + + if ((res = read(fsrv_st_fd, &child_pid, 4)) != 4) { + + if (stop_soon) return 0; + RPFATAL(res, "Unable to request new process from fork server (OOM?)"); + + } + + if (child_pid <= 0) FATAL("Fork server is misbehaving (OOM?)"); + + /* Configure timeout, wait for child, cancel timeout. */ + + if (exec_tmout) { + + it.it_value.tv_sec = (exec_tmout / 1000); + it.it_value.tv_usec = (exec_tmout % 1000) * 1000; + + } + + setitimer(ITIMER_REAL, &it, NULL); + + if ((res = read(fsrv_st_fd, &status, 4)) != 4) { + + if (stop_soon) return 0; + RPFATAL(res, "Unable to communicate with fork server (OOM?)"); + + } + + child_pid = 0; + it.it_value.tv_sec = 0; + it.it_value.tv_usec = 0; + + setitimer(ITIMER_REAL, &it, NULL); + + MEM_BARRIER(); + + /* Clean up bitmap, analyze exit condition, etc. */ + + if (*(u32*)trace_bits == EXEC_FAIL_SIG) + FATAL("Unable to execute '%s'", argv[0]); + + classify_counts(trace_bits, + binary_mode ? count_class_binary : count_class_human); + total_execs++; + + if (stop_soon) { + + SAYF(cRST cLRD "\n+++ afl-showmap folder mode aborted by user +++\n" cRST); + close(write_to_file(out_file, in_data, in_len)); + exit(1); + + } + + /* Always discard inputs that time out. */ + + if (child_timed_out) { return 0; } + + /* Handle crashing inputs depending on current mode. */ + + if (WIFSIGNALED(status) || + (WIFEXITED(status) && WEXITSTATUS(status) == MSAN_ERROR) || + (WIFEXITED(status) && WEXITSTATUS(status))) { + + return 0; + + } + + return 0; + +} + +/* Read initial file. */ + +u32 read_file(u8 *in_file) { + + struct stat st; + s32 fd = open(in_file, O_RDONLY); + + if (fd < 0) WARNF("Unable to open '%s'", in_file); + + if (fstat(fd, &st) || !st.st_size) WARNF("Zero-sized input file '%s'.", in_file); + + in_len = st.st_size; + in_data = ck_alloc_nozero(in_len); + + ck_read(fd, in_data, in_len, in_file); + + close(fd); + + //OKF("Read %u byte%s from '%s'.", in_len, in_len == 1 ? "" : "s", in_file); + + return in_len; +} + /* Execute target application. */ static void run_target(char** argv) { @@ -456,6 +634,8 @@ static void usage(u8* argv0) { "Other settings:\n\n" + " -i dir - process all files in this directory, -o most be a directory\n" + " and each bitmap will be written there individually.\n" " -q - sink program's output and don't show messages\n" " -e - show edge coverage only, ignore hit counts\n" " -r - show real tuple values instead of AFL filter values\n" @@ -529,17 +709,22 @@ static void find_binary(u8* fname) { int main(int argc, char** argv) { - s32 opt; + s32 opt, i; u8 mem_limit_given = 0, timeout_given = 0, unicorn_mode = 0, use_wine = 0; u32 tcnt = 0; char** use_argv; doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH; - while ((opt = getopt(argc, argv, "+o:f:m:t:A:eqZQUWbcrh")) > 0) + while ((opt = getopt(argc, argv, "+i:o:f:m:t:A:eqZQUWbcrh")) > 0) switch (opt) { + case 'i': + if (in_dir) FATAL("Multiple -i options not supported"); + in_dir = optarg; + break; + case 'o': if (out_file) FATAL("Multiple -o options not supported"); @@ -707,7 +892,13 @@ int main(int argc, char** argv) { } + if (in_dir) at_file = "@@"; + detect_file_args(argv + optind, at_file); + + for (i = optind; i < argc; i++) + if (strcmp(argv[i], "@@") == 0) + arg_offset = i; if (qemu_mode) { @@ -720,9 +911,48 @@ int main(int argc, char** argv) { use_argv = argv + optind; - run_target(use_argv); + if (in_dir) { + + DIR *dir_in, *dir_out; + struct dirent* dir_ent; + int done = 0; + u8 infile[4096], outfile[4096]; + + dev_null_fd = open("/dev/null", O_RDWR); + if (dev_null_fd < 0) PFATAL("Unable to open /dev/null"); - tcnt = write_results(); + if (!(dir_in = opendir(in_dir))) PFATAL("cannot open directory %s", in_dir); + + if (!(dir_out = opendir(out_file))) + if (mkdir(out_file, 0700)) + PFATAL("cannot create output directory %s", out_file); + + if (arg_offset) argv[arg_offset] = infile; + + init_forkserver(use_argv); + + while (done == 0 && (dir_ent = readdir(dir_in))) { + + if (dir_ent->d_name[0] == '.') continue; // skip anything that starts with '.' + if (dir_ent->d_type != DT_REG) continue; // only regular files + + snprintf(infile, sizeof(infile), "%s/%s", in_dir, dir_ent->d_name); + snprintf(outfile, sizeof(outfile), "%s/%s", out_file, dir_ent->d_name); + + if (read_file(infile)) { + run_target_forkserver(use_argv, in_data, in_len); + ck_free(in_data); + tcnt = write_results_to_file(outfile); + } + + } + + } else { + + run_target(use_argv); + tcnt = write_results(); + + } if (!quiet_mode) { @@ -735,4 +965,3 @@ int main(int argc, char** argv) { exit(child_crashed * 2 + child_timed_out); } - diff --git a/src/afl-tmin.c b/src/afl-tmin.c index 7ce0ccaa..e783b5f0 100644 --- a/src/afl-tmin.c +++ b/src/afl-tmin.c @@ -524,14 +524,16 @@ static u8 run_target(char** argv, u8* mem, u32 len, u8 first_run) { } - } else + } else { - /* Handle non-crashing inputs appropriately. */ + /* Handle non-crashing inputs appropriately. */ - if (crash_mode) { + if (crash_mode) { - missed_paths++; - return 0; + missed_paths++; + return 0; + + } } |