aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/afl-fuzz-bitmap.c63
-rw-r--r--src/afl-fuzz-mutators.c80
-rw-r--r--src/afl-fuzz-one.c9
3 files changed, 122 insertions, 30 deletions
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index 2d14b04e..a78bf374 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -425,7 +425,7 @@ void minimize_bits(afl_state_t *afl, u8 *dst, u8 *src) {
/* Construct a file name for a new test case, capturing the operation
that led to its discovery. Returns a ptr to afl->describe_op_buf_256. */
-u8 *describe_op(afl_state_t *afl, u8 hnb) {
+u8 *describe_op(afl_state_t *afl, u8 new_bits) {
u8 *ret = afl->describe_op_buf_256;
@@ -445,29 +445,64 @@ u8 *describe_op(afl_state_t *afl, u8 hnb) {
sprintf(ret + strlen(ret), ",time:%llu", get_cur_time() - afl->start_time);
- sprintf(ret + strlen(ret), ",op:%s", afl->stage_short);
+ if (afl->current_custom_fuzz &&
+ afl->current_custom_fuzz->afl_custom_describe) {
- if (afl->stage_cur_byte >= 0) {
+ /* We are currently in a custom mutator that supports afl_custom_describe,
+ * use it! */
- sprintf(ret + strlen(ret), ",pos:%d", afl->stage_cur_byte);
+ size_t len_current = strlen(ret);
+ ret[len_current++] = ',';
+ ret[len_current++] = '\0';
- if (afl->stage_val_type != STAGE_VAL_NONE) {
+ size_t size_left =
+ sizeof(afl->describe_op_buf_256) - len_current - strlen(",+cov") - 2;
+ assert(size_left > 0);
- sprintf(ret + strlen(ret), ",val:%s%+d",
- (afl->stage_val_type == STAGE_VAL_BE) ? "be:" : "",
- afl->stage_cur_val);
+ const char *custom_description =
+ afl->current_custom_fuzz->afl_custom_describe(
+ afl->current_custom_fuzz->data, size_left);
+ if (!custom_description || !custom_description[0]) {
+
+ DEBUGF("Error getting a description from afl_custom_describe");
+ /* Take the stage name as description fallback */
+ sprintf(ret + len_current, "op:%s", afl->stage_short);
+
+ } else {
+
+ /* We got a proper custom description, use it */
+ strncat(ret + len_current, custom_description, size_left);
}
} else {
- sprintf(ret + strlen(ret), ",rep:%d", afl->stage_cur_val);
+ /* Normal testcase descriptions start here */
+ sprintf(ret + strlen(ret), ",op:%s", afl->stage_short);
+
+ if (afl->stage_cur_byte >= 0) {
+
+ sprintf(ret + strlen(ret), ",pos:%d", afl->stage_cur_byte);
+
+ if (afl->stage_val_type != STAGE_VAL_NONE) {
+
+ sprintf(ret + strlen(ret), ",val:%s%+d",
+ (afl->stage_val_type == STAGE_VAL_BE) ? "be:" : "",
+ afl->stage_cur_val);
+
+ }
+
+ } else {
+
+ sprintf(ret + strlen(ret), ",rep:%d", afl->stage_cur_val);
+
+ }
}
}
- if (hnb == 2) { strcat(ret, ",+cov"); }
+ if (new_bits == 2) { strcat(ret, ",+cov"); }
return ret;
@@ -540,7 +575,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
if (unlikely(len == 0)) { return 0; }
u8 *queue_fn = "";
- u8 hnb = '\0';
+ u8 new_bits = '\0';
s32 fd;
u8 keeping = 0, res;
u64 cksum = 0;
@@ -566,7 +601,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
/* Keep only if there are new bits in the map, add to queue for
future fuzzing, etc. */
- if (!(hnb = has_new_bits(afl, afl->virgin_bits))) {
+ if (!(new_bits = has_new_bits(afl, afl->virgin_bits))) {
if (unlikely(afl->crash_mode)) { ++afl->total_crashes; }
return 0;
@@ -576,7 +611,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
#ifndef SIMPLE_FILES
queue_fn = alloc_printf("%s/queue/id:%06u,%s", afl->out_dir,
- afl->queued_paths, describe_op(afl, hnb));
+ afl->queued_paths, describe_op(afl, new_bits));
#else
@@ -619,7 +654,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
#endif
- if (hnb == 2) {
+ if (new_bits == 2) {
afl->queue_top->has_new_cov = 1;
++afl->queued_with_cov;
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index 1d14f657..0c85458e 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -151,7 +151,11 @@ struct custom_mutator *load_custom_mutator(afl_state_t *afl, const char *fn) {
/* Mutator */
/* "afl_custom_init", optional for backward compatibility */
mutator->afl_custom_init = dlsym(dh, "afl_custom_init");
- if (!mutator->afl_custom_init) FATAL("Symbol 'afl_custom_init' not found.");
+ if (!mutator->afl_custom_init) {
+
+ FATAL("Symbol 'afl_custom_init' not found.");
+
+ }
/* "afl_custom_fuzz" or "afl_custom_mutator", required */
mutator->afl_custom_fuzz = dlsym(dh, "afl_custom_fuzz");
@@ -161,49 +165,74 @@ struct custom_mutator *load_custom_mutator(afl_state_t *afl, const char *fn) {
WARNF("Symbol 'afl_custom_fuzz' not found. Try 'afl_custom_mutator'.");
mutator->afl_custom_fuzz = dlsym(dh, "afl_custom_mutator");
- if (!mutator->afl_custom_fuzz)
+ if (!mutator->afl_custom_fuzz) {
+
WARNF("Symbol 'afl_custom_mutator' not found.");
+ }
+
}
/* "afl_custom_introspection", optional */
#ifdef INTROSPECTION
mutator->afl_custom_introspection = dlsym(dh, "afl_custom_introspection");
- if (!mutator->afl_custom_introspection)
+ if (!mutator->afl_custom_introspection) {
+
ACTF("optional symbol 'afl_custom_introspection' not found.");
+
+ }
+
#endif
/* "afl_custom_fuzz_count", optional */
mutator->afl_custom_fuzz_count = dlsym(dh, "afl_custom_fuzz_count");
- if (!mutator->afl_custom_fuzz_count)
+ if (!mutator->afl_custom_fuzz_count) {
+
ACTF("optional symbol 'afl_custom_fuzz_count' not found.");
+ }
+
/* "afl_custom_deinit", optional for backward compatibility */
mutator->afl_custom_deinit = dlsym(dh, "afl_custom_deinit");
- if (!mutator->afl_custom_deinit)
+ if (!mutator->afl_custom_deinit) {
+
FATAL("Symbol 'afl_custom_deinit' not found.");
+ }
+
/* "afl_custom_post_process", optional */
mutator->afl_custom_post_process = dlsym(dh, "afl_custom_post_process");
- if (!mutator->afl_custom_post_process)
+ if (!mutator->afl_custom_post_process) {
+
ACTF("optional symbol 'afl_custom_post_process' not found.");
+ }
+
u8 notrim = 0;
/* "afl_custom_init_trim", optional */
mutator->afl_custom_init_trim = dlsym(dh, "afl_custom_init_trim");
- if (!mutator->afl_custom_init_trim)
+ if (!mutator->afl_custom_init_trim) {
+
ACTF("optional symbol 'afl_custom_init_trim' not found.");
+ }
+
/* "afl_custom_trim", optional */
mutator->afl_custom_trim = dlsym(dh, "afl_custom_trim");
- if (!mutator->afl_custom_trim)
+ if (!mutator->afl_custom_trim) {
+
ACTF("optional symbol 'afl_custom_trim' not found.");
+ }
+
/* "afl_custom_post_trim", optional */
mutator->afl_custom_post_trim = dlsym(dh, "afl_custom_post_trim");
- if (!mutator->afl_custom_post_trim)
+ if (!mutator->afl_custom_post_trim) {
+
ACTF("optional symbol 'afl_custom_post_trim' not found.");
+ }
+
if (notrim) {
mutator->afl_custom_init_trim = NULL;
@@ -217,31 +246,54 @@ struct custom_mutator *load_custom_mutator(afl_state_t *afl, const char *fn) {
/* "afl_custom_havoc_mutation", optional */
mutator->afl_custom_havoc_mutation = dlsym(dh, "afl_custom_havoc_mutation");
- if (!mutator->afl_custom_havoc_mutation)
+ if (!mutator->afl_custom_havoc_mutation) {
+
ACTF("optional symbol 'afl_custom_havoc_mutation' not found.");
+ }
+
/* "afl_custom_havoc_mutation", optional */
mutator->afl_custom_havoc_mutation_probability =
dlsym(dh, "afl_custom_havoc_mutation_probability");
- if (!mutator->afl_custom_havoc_mutation_probability)
+ if (!mutator->afl_custom_havoc_mutation_probability) {
+
ACTF("optional symbol 'afl_custom_havoc_mutation_probability' not found.");
+ }
+
/* "afl_custom_queue_get", optional */
mutator->afl_custom_queue_get = dlsym(dh, "afl_custom_queue_get");
- if (!mutator->afl_custom_queue_get)
+ if (!mutator->afl_custom_queue_get) {
+
ACTF("optional symbol 'afl_custom_queue_get' not found.");
+ }
+
/* "afl_custom_queue_new_entry", optional */
mutator->afl_custom_queue_new_entry = dlsym(dh, "afl_custom_queue_new_entry");
- if (!mutator->afl_custom_queue_new_entry)
+ if (!mutator->afl_custom_queue_new_entry) {
+
ACTF("optional symbol 'afl_custom_queue_new_entry' not found");
+ }
+
+ /* "afl_custom_describe", optional */
+ mutator->afl_custom_describe = dlsym(dh, "afl_custom_describe");
+ if (!mutator->afl_custom_describe) {
+
+ ACTF("Symbol 'afl_custom_describe' not found.");
+
+ }
+
OKF("Custom mutator '%s' installed successfully.", fn);
/* Initialize the custom mutator */
- if (mutator->afl_custom_init)
+ if (mutator->afl_custom_init) {
+
mutator->data = mutator->afl_custom_init(afl, rand_below(afl, 0xFFFFFFFF));
+ }
+
mutator->stacked_custom = (mutator && mutator->afl_custom_havoc_mutation);
mutator->stacked_custom_prob =
6; // like one of the default mutations in havoc
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 0adc3719..ca48f72a 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -1790,11 +1790,16 @@ custom_mutator_stage:
afl->current_custom_fuzz = el;
- if (el->afl_custom_fuzz_count)
+ if (el->afl_custom_fuzz_count) {
+
afl->stage_max = el->afl_custom_fuzz_count(el->data, out_buf, len);
- else
+
+ } else {
+
afl->stage_max = saved_max;
+ }
+
has_custom_fuzz = true;
afl->stage_short = el->name_short;
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-15 21:29:53 +0000