diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/afl-fuzz-one.c | 532 | ||||
| -rw-r--r-- | src/afl-fuzz-stats.c | 134 |
2 files changed, 68 insertions, 598 deletions
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c index f8680100..a42bb0fc 100644 --- a/src/afl-fuzz-one.c +++ b/src/afl-fuzz-one.c @@ -27,10 +27,6 @@ #include <string.h> #include <limits.h> -/* static u8 *strnstr(const u8 *s, const u8 *find, size_t slen); -static u32 string_replace(u8 **out_buf, s32 *temp_len, u32 pos, u8 *from, - u8 *to); */ - /* MOpt */ static int select_algorithm(afl_state_t *afl) { @@ -370,524 +366,6 @@ static void locate_diffs(u8 *ptr1, u8 *ptr2, u32 len, s32 *first, s32 *last) { #define BUF_PARAMS(name) (void **)&afl->name##_buf, &afl->name##_size -#if 0 -/* search a string */ - -static u8 *strnstr(const u8 *s, const u8 *find, size_t slen) { - - char c, sc; - size_t len; - - if ((c = *find++) != '\0') { - - len = strlen(find); - do { - - do { - - if (slen-- < 1 || (sc = *s++) == '\0') return (NULL); - - } while (sc != c); - - if (len > slen) return (NULL); - - } while (strncmp(s, find, len) != 0); - - s--; - - } - - return ((u8 *)s); - -} - -/* replace between deliminators, if rep == NULL, then we will duplicate the - * target */ - -static u32 delim_replace(u8 **out_buf, s32 *temp_len, size_t pos, - const u8 *ldelim, const u8 *rdelim, u8 *rep) { - - u8 *end_buf = *out_buf + *temp_len; - u8 *ldelim_start = strnstr(*out_buf + pos, ldelim, *temp_len - pos); - - if (ldelim_start != NULL) { - - u32 max = (end_buf - ldelim_start - 1 > AFL_TXT_STRING_MAX_LEN - ? AFL_TXT_STRING_MAX_LEN - : end_buf - ldelim_start - 1); - - if (max > 0) { - - u8 *rdelim_end = strnstr(ldelim_start + 1, rdelim, max); - - if (rdelim_end != NULL) { - - u32 rep_len, delim_space_len = rdelim_end - ldelim_start - 1, xtra = 0; - - if (rep != NULL) { - - rep_len = (u32)strlen(rep); - - } else { // NULL? then we copy the value in between the delimiters - - rep_len = delim_space_len; - delim_space_len = 0; - rep = ldelim_start + 1; - xtra = rep_len; - - } - - if (rep_len != delim_space_len) { - - memmove(ldelim_start + rep_len + xtra + 1, rdelim_end, - *temp_len - (rdelim_end - *out_buf)); - - } - - memcpy(ldelim_start + 1, rep, rep_len); - *temp_len = (*temp_len - delim_space_len + rep_len); - - return 1; - - } - - } - - } - - return 0; - -} - -static u32 delim_swap(u8 **out_buf, s32 *temp_len, size_t pos, const u8 *ldelim, - const u8 *mdelim, const u8 *rdelim) { - - u8 *out_buf_end = *out_buf + *temp_len; - u32 max = (*temp_len - pos > AFL_TXT_STRING_MAX_LEN ? AFL_TXT_STRING_MAX_LEN - : *temp_len - pos); - u8 *ldelim_start = strnstr(*out_buf + pos, ldelim, max); - - if (ldelim_start != NULL) { - - max = (out_buf_end - ldelim_start - 1 > AFL_TXT_STRING_MAX_LEN - ? AFL_TXT_STRING_MAX_LEN - : out_buf_end - ldelim_start - 1); - if (max > 1) { - - u8 *mdelim_pos = strnstr(ldelim_start + 1, mdelim, max); - - if (mdelim_pos != NULL) { - - max = (out_buf_end - mdelim_pos - 1 > AFL_TXT_STRING_MAX_LEN - ? AFL_TXT_STRING_MAX_LEN - : out_buf_end - mdelim_pos - 1); - if (max > 0) { - - u8 *rdelim_end = strnstr(mdelim + 1, rdelim, max); - - if (rdelim_end != NULL) { - - u32 first_len = mdelim_pos - ldelim_start - 1; - u32 second_len = rdelim_end - mdelim_pos - 1; - u8 scratch[AFL_TXT_STRING_MAX_LEN]; - - memcpy(scratch, ldelim_start + 1, first_len); - - if (first_len != second_len) { - - memmove(ldelim_start + second_len + 1, mdelim_pos, - out_buf_end - mdelim_pos); - - } - - memcpy(ldelim_start + 1, mdelim_pos + 1, second_len); - - if (first_len != second_len) { - - memmove(mdelim_pos + first_len + 1, rdelim_end, - out_buf_end - rdelim_end); - - } - - memcpy(mdelim_pos + 1, scratch, first_len); - - return 1; - - } - - } - - } - - } - - } - - return 0; - -} - -/* replace a string */ - -static u32 string_replace(u8 **out_buf, s32 *temp_len, u32 pos, u8 *from, - u8 *to) { - - u8 *start = strnstr(*out_buf + pos, from, *temp_len - pos); - - if (start) { - - u32 from_len = strlen(from); - u32 to_len = strlen(to); - - if (from_len != to_len) { - - memmove(start + to_len, start + from_len, - *temp_len - from_len - (start - *out_buf)); - - } - - memcpy(start, to, to_len); - *temp_len = (*temp_len - from_len + to_len); - - return 1; - - } - - return 0; - -} - -/* Returns 1 if a mutant was generated and placed in out_buf, 0 if none - * generated. */ - -static const uint8_t text_mutation_special_chars[] = { - - '\t', '\n', '\r', ' ', '!', '"', '$', '%', '&', '\'', '(', ')', '*', - '+', ',', '-', '.', '/', ':', ';', '<', '=', '>', '?', '@', '[', - '\\', ']', '^', '_', '`', '{', '|', '}', '~', ' ' // space is here twice - -}; - -static int text_mutation(afl_state_t *afl, u8 **out_buf, s32 *orig_temp_len) { - - if (*orig_temp_len < AFL_TXT_MIN_LEN) { return 0; } - - s32 temp_len; - u32 pos, yes = 0, - mutations = rand_below(afl, AFL_TXT_STRING_MAX_MUTATIONS) + 16; - u8 *new_buf = - ck_maybe_grow(BUF_PARAMS(out_scratch), - *orig_temp_len + AFL_TXT_STRING_MAX_MUTATIONS + 16); - u8 fromc[2] = {0, 0}, toc[2] = {0, 0}; - temp_len = *orig_temp_len; - memcpy(new_buf, *out_buf, temp_len); - new_buf[temp_len] = 0; - - for (u32 i = 0; i < mutations; i++) { - - if (temp_len < AFL_TXT_MIN_LEN) { return 0; } - - pos = rand_below(afl, temp_len - 1); - int choice = rand_below(afl, 100); - - switch (choice) { - - /* 50% -> fixed replacements */ - - case 0: /* Semantic statement deletion */ - yes += string_replace(&new_buf, &temp_len, pos, "\n", "#"); - break; - case 1: - yes += string_replace(&new_buf, &temp_len, pos, "(", "(!"); - break; - case 2: - yes += string_replace(&new_buf, &temp_len, pos, "==", "!="); - break; - case 3: - yes += string_replace(&new_buf, &temp_len, pos, "!=", "=="); - break; - case 4: - yes += string_replace(&new_buf, &temp_len, pos, "==", "<"); - break; - case 5: - yes += string_replace(&new_buf, &temp_len, pos, "<", "=="); - break; - case 6: - yes += string_replace(&new_buf, &temp_len, pos, "==", ">"); - break; - case 7: - yes += string_replace(&new_buf, &temp_len, pos, ">", "=="); - break; - case 8: - yes += string_replace(&new_buf, &temp_len, pos, "=", "<"); - break; - case 9: - yes += string_replace(&new_buf, &temp_len, pos, "=", ">"); - break; - case 10: - yes += string_replace(&new_buf, &temp_len, pos, "<", ">"); - break; - case 11: - yes += string_replace(&new_buf, &temp_len, pos, ">", "<"); - break; - case 12: - yes += string_replace(&new_buf, &temp_len, pos, "++", "--"); - break; - case 13: - yes += string_replace(&new_buf, &temp_len, pos, "--", "++"); - break; - case 14: - yes += string_replace(&new_buf, &temp_len, pos, "+", "-"); - break; - case 15: - yes += string_replace(&new_buf, &temp_len, pos, "-", "+"); - break; - case 16: - yes += string_replace(&new_buf, &temp_len, pos, "0", "1"); - break; - case 17: - yes += string_replace(&new_buf, &temp_len, pos, "1", "0"); - break; - case 18: - yes += string_replace(&new_buf, &temp_len, pos, "&&", "||"); - break; - case 19: - yes += string_replace(&new_buf, &temp_len, pos, "||", "&&"); - break; - case 20: - yes += string_replace(&new_buf, &temp_len, pos, "!", ""); - break; - case 21: - yes += string_replace(&new_buf, &temp_len, pos, "==", "="); - break; - case 22: - yes += string_replace(&new_buf, &temp_len, pos, "=", "=="); - break; - case 23: - yes += string_replace(&new_buf, &temp_len, pos, "--", ""); - break; - case 24: - yes += string_replace(&new_buf, &temp_len, pos, "<<", "<"); - break; - case 25: - yes += string_replace(&new_buf, &temp_len, pos, ">>", ">"); - break; - case 26: - yes += string_replace(&new_buf, &temp_len, pos, "<", "<<"); - break; - case 27: - yes += string_replace(&new_buf, &temp_len, pos, ">", ">>"); - break; - case 28: - yes += string_replace(&new_buf, &temp_len, pos, "'", "\""); - break; - case 29: - yes += string_replace(&new_buf, &temp_len, pos, "\"", "'"); - break; - case 30: /* Remove a semicolon delimited statement after a semicolon */ - yes += delim_replace(&new_buf, &temp_len, pos, ";", ";", ";"); - break; - case 31: /* Remove a semicolon delimited statement after a left curly - brace */ - yes += delim_replace(&new_buf, &temp_len, pos, "}", ";", "}"); - break; - case 32: /* Remove a curly brace construct */ - yes += delim_replace(&new_buf, &temp_len, pos, "{", "}", ""); - break; - case 33: /* Replace a curly brace construct with an empty one */ - yes += delim_replace(&new_buf, &temp_len, pos, "{", "}", "{}"); - break; - case 34: - yes += delim_swap(&new_buf, &temp_len, pos, ";", ";", ";"); - break; - case 35: - yes += delim_swap(&new_buf, &temp_len, pos, "}", ";", ";"); - break; - case 36: /* Swap comma delimited things case 1 */ - yes += delim_swap(&new_buf, &temp_len, pos, "(", ",", ")"); - break; - case 37: /* Swap comma delimited things case 2 */ - yes += delim_swap(&new_buf, &temp_len, pos, "(", ",", ","); - break; - case 38: /* Swap comma delimited things case 3 */ - yes += delim_swap(&new_buf, &temp_len, pos, ",", ",", ","); - break; - case 39: /* Swap comma delimited things case 4 */ - yes += delim_swap(&new_buf, &temp_len, pos, ",", ",", ")"); - break; - case 40: /* Just delete a line */ - yes += delim_replace(&new_buf, &temp_len, pos, "\n", "\n", ""); - break; - case 41: /* Delete something like "const" case 1 */ - yes += delim_replace(&new_buf, &temp_len, pos, " ", " ", ""); - break; - case 42: /* Delete something like "const" case 2 */ - yes += delim_replace(&new_buf, &temp_len, pos, "\n", " ", ""); - break; - case 43: /* Delete something like "const" case 3 */ - yes += delim_replace(&new_buf, &temp_len, pos, "(", " ", ""); - break; - case 44: /* Swap space delimited things case 1 */ - yes += delim_swap(&new_buf, &temp_len, pos, " ", " ", " "); - break; - case 45: /* Swap space delimited things case 2 */ - yes += delim_swap(&new_buf, &temp_len, pos, " ", " ", ")"); - break; - case 46: /* Swap space delimited things case 3 */ - yes += delim_swap(&new_buf, &temp_len, pos, "(", " ", " "); - break; - case 47: /* Swap space delimited things case 4 */ - yes += delim_swap(&new_buf, &temp_len, pos, "(", " ", ")"); - break; - case 48: /* Duplicate a single line of code */ - yes += delim_replace(&new_buf, &temp_len, pos, "\n", "\n", NULL); - break; - case 49: /* Duplicate a construct (most often, a non-nested for loop */ - yes += delim_replace(&new_buf, &temp_len, pos, "\n", "}", NULL); - break; - default: { - - /* 5% is transforming ascii numbers */ - - if (choice < 55) { - - for (u32 j = pos; j < temp_len; ++j) { - - if (isdigit(new_buf[j])) { - - new_buf[temp_len] = - 0; // should be safe thanks to the initial grow - - u8 * endptr; - unsigned long long num = - strtoull(new_buf + j, (char **)&endptr, 0); - - switch (rand_below(afl, 8)) { - - case 0: - num = rand_below(afl, INT_MAX); - break; - case 1: - num = rand_next(afl); - break; - case 2: - num += 1 + rand_below(afl, 255); - break; - case 3: - num -= 1 + rand_below(afl, 255); - break; - case 4: - num *= 1 + rand_below(afl, 255); - break; - case 5: - num /= 1 + rand_below(afl, 255); - break; - case 6: - num /= 1 + rand_below(afl, 255); - break; - case 7: - num = ~num; - break; - - } - - const char *fmt = "%llu"; - if (rand_below(afl, 5) == 0) // add - sign with 1/5 probability - fmt = "-%llu"; - - size_t num_len = snprintf(NULL, 0, fmt, num); - size_t old_len = endptr - (new_buf + j); - if (num_len < old_len) { - - memmove(new_buf + j + num_len, new_buf + j + old_len, - temp_len - (j + old_len)); - snprintf(new_buf + j, num_len, fmt, num); - temp_len -= old_len - num_len; - - } else if (num_len == old_len) { - - snprintf(new_buf + j, num_len, fmt, num); - - } else { - - new_buf = ck_maybe_grow(BUF_PARAMS(out_scratch), - temp_len + (num_len - old_len) + - AFL_TXT_STRING_MAX_MUTATIONS + 1); - memmove(new_buf + j + num_len, new_buf + j + old_len, - temp_len - (j + old_len)); - snprintf(new_buf + j, num_len, fmt, num); - temp_len += num_len - old_len; - - } - - yes += 1; - break; - - } - - } - - } else if (choice < 85) { - - /* 30% is special character transform */ - - fromc[0] = text_mutation_special_chars[rand_below( - afl, sizeof(text_mutation_special_chars))]; - - do { - - toc[0] = text_mutation_special_chars[rand_below( - afl, sizeof(text_mutation_special_chars))]; - - } while (toc[0] == fromc[0]); - - yes += string_replace(&new_buf, &temp_len, pos, fromc, toc); - break; - - } else { - - /* 15% is random text character transform */ - - u32 iter, cnt, loc, prev_loc = temp_len; - if (temp_len > 32) { - - cnt = 1 + rand_below(afl, 5); - - } else { - - cnt = rand_below(afl, 2); - - } - - for (iter = 0; iter <= cnt; iter++) { - - while ((loc = rand_below(afl, temp_len)) == prev_loc) - ; - new_buf[loc] = 32 + rand_below(afl, 'z' - ' ' + 1); - prev_loc = loc; - - } - - } - - } - - } - - } - - if (yes == 0 || temp_len <= 0) { return 0; } - - swap_bufs(BUF_PARAMS(out), BUF_PARAMS(out_scratch)); - *out_buf = new_buf; - *orig_temp_len = temp_len; - - return 1; - -} - -#endif /* if 0 */ - /* Take the current entry from the queue, fuzz it for a while. This function is a tad too long... returns 0 if fuzzed successfully, 1 if skipped or bailed out. */ @@ -2926,15 +2404,7 @@ havoc_stage: } - /* default: - - // perform ascii mutations - if (text_mutation(afl, &out_buf, &temp_len) == 0) - goto retry_havoc; - - } // end default: switch(r) - - */ + // end of default: } diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index 9b16c226..7b30b5ea 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -82,60 +82,59 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability, if (getrusage(RUSAGE_CHILDREN, &rus)) { rus.ru_maxrss = 0; } #endif - fprintf( - f, - "start_time : %llu\n" - "last_update : %llu\n" - "run_time : %llu\n" - "fuzzer_pid : %u\n" - "cycles_done : %llu\n" - "cycles_wo_finds : %llu\n" - "execs_done : %llu\n" - "execs_per_sec : %0.02f\n" - "execs_ps_last_min : %0.02f\n" - "paths_total : %u\n" - "paths_favored : %u\n" - "paths_found : %u\n" - "paths_imported : %u\n" - "max_depth : %u\n" - "cur_path : %u\n" /* Must match find_start_position() */ - "pending_favs : %u\n" - "pending_total : %u\n" - "variable_paths : %u\n" - "stability : %0.02f%%\n" - "bitmap_cvg : %0.02f%%\n" - "unique_crashes : %llu\n" - "unique_hangs : %llu\n" - "last_path : %llu\n" - "last_crash : %llu\n" - "last_hang : %llu\n" - "execs_since_crash : %llu\n" - "exec_timeout : %u\n" - "slowest_exec_ms : %u\n" - "peak_rss_mb : %lu\n" - "cpu_affinity : %d\n" - "edges_found : %u\n" - "var_byte_count : %u\n" - "havoc_expansion : %u\n" - "afl_banner : %s\n" - "afl_version : " VERSION - "\n" - "target_mode : %s%s%s%s%s%s%s%s%s\n" - "command_line : %s\n", - afl->start_time / 1000, cur_time / 1000, - (cur_time - afl->start_time) / 1000, (u32)getpid(), - afl->queue_cycle ? (afl->queue_cycle - 1) : 0, afl->cycles_wo_finds, - afl->fsrv.total_execs, - afl->fsrv.total_execs / - ((double)(get_cur_time() - afl->start_time) / 1000), - afl->last_avg_execs_saved, - afl->queued_paths, afl->queued_favored, afl->queued_discovered, - afl->queued_imported, afl->max_depth, afl->current_entry, - afl->pending_favored, afl->pending_not_fuzzed, afl->queued_variable, - stability, bitmap_cvg, afl->unique_crashes, afl->unique_hangs, - afl->last_path_time / 1000, afl->last_crash_time / 1000, - afl->last_hang_time / 1000, afl->fsrv.total_execs - afl->last_crash_execs, - afl->fsrv.exec_tmout, afl->slowest_exec_ms, + fprintf(f, + "start_time : %llu\n" + "last_update : %llu\n" + "run_time : %llu\n" + "fuzzer_pid : %u\n" + "cycles_done : %llu\n" + "cycles_wo_finds : %llu\n" + "execs_done : %llu\n" + "execs_per_sec : %0.02f\n" + "execs_ps_last_min : %0.02f\n" + "paths_total : %u\n" + "paths_favored : %u\n" + "paths_found : %u\n" + "paths_imported : %u\n" + "max_depth : %u\n" + "cur_path : %u\n" /* Must match find_start_position() */ + "pending_favs : %u\n" + "pending_total : %u\n" + "variable_paths : %u\n" + "stability : %0.02f%%\n" + "bitmap_cvg : %0.02f%%\n" + "unique_crashes : %llu\n" + "unique_hangs : %llu\n" + "last_path : %llu\n" + "last_crash : %llu\n" + "last_hang : %llu\n" + "execs_since_crash : %llu\n" + "exec_timeout : %u\n" + "slowest_exec_ms : %u\n" + "peak_rss_mb : %lu\n" + "cpu_affinity : %d\n" + "edges_found : %u\n" + "var_byte_count : %u\n" + "havoc_expansion : %u\n" + "afl_banner : %s\n" + "afl_version : " VERSION + "\n" + "target_mode : %s%s%s%s%s%s%s%s%s\n" + "command_line : %s\n", + afl->start_time / 1000, cur_time / 1000, + (cur_time - afl->start_time) / 1000, (u32)getpid(), + afl->queue_cycle ? (afl->queue_cycle - 1) : 0, afl->cycles_wo_finds, + afl->fsrv.total_execs, + afl->fsrv.total_execs / + ((double)(get_cur_time() - afl->start_time) / 1000), + afl->last_avg_execs_saved, afl->queued_paths, afl->queued_favored, + afl->queued_discovered, afl->queued_imported, afl->max_depth, + afl->current_entry, afl->pending_favored, afl->pending_not_fuzzed, + afl->queued_variable, stability, bitmap_cvg, afl->unique_crashes, + afl->unique_hangs, afl->last_path_time / 1000, + afl->last_crash_time / 1000, afl->last_hang_time / 1000, + afl->fsrv.total_execs - afl->last_crash_execs, afl->fsrv.exec_tmout, + afl->slowest_exec_ms, #ifndef __HAIKU__ #ifdef __APPLE__ (unsigned long int)(rus.ru_maxrss >> 20), @@ -150,19 +149,20 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability, #else -1, #endif - t_bytes, afl->var_byte_count, afl->expand_havoc, afl->use_banner, - afl->unicorn_mode ? "unicorn" : "", afl->fsrv.qemu_mode ? "qemu " : "", - afl->non_instrumented_mode ? " non_instrumented " : "", - afl->no_forkserver ? "no_fsrv " : "", afl->crash_mode ? "crash " : "", - afl->persistent_mode ? "persistent " : "", - afl->shmem_testcase_mode ? "shmem_testcase " : "", - afl->deferred_mode ? "deferred " : "", - (afl->unicorn_mode || afl->fsrv.qemu_mode || afl->non_instrumented_mode || - afl->no_forkserver || afl->crash_mode || afl->persistent_mode || - afl->deferred_mode) - ? "" - : "default", - afl->orig_cmdline); + t_bytes, afl->var_byte_count, afl->expand_havoc, afl->use_banner, + afl->unicorn_mode ? "unicorn" : "", + afl->fsrv.qemu_mode ? "qemu " : "", + afl->non_instrumented_mode ? " non_instrumented " : "", + afl->no_forkserver ? "no_fsrv " : "", afl->crash_mode ? "crash " : "", + afl->persistent_mode ? "persistent " : "", + afl->shmem_testcase_mode ? "shmem_testcase " : "", + afl->deferred_mode ? "deferred " : "", + (afl->unicorn_mode || afl->fsrv.qemu_mode || + afl->non_instrumented_mode || afl->no_forkserver || + afl->crash_mode || afl->persistent_mode || afl->deferred_mode) + ? "" + : "default", + afl->orig_cmdline); /* ignore errors */ if (afl->debug) { |