aboutsummaryrefslogtreecommitdiff
path: root/utils
diff options
context:
space:
mode:
Diffstat (limited to 'utils')
-rw-r--r--utils/afl_network_proxy/GNUmakefile3
-rw-r--r--utils/afl_network_proxy/afl-network-server.c33
-rw-r--r--utils/afl_untracer/afl-untracer.c10
-rw-r--r--utils/afl_untracer/ida_get_patchpoints.py17
-rw-r--r--utils/aflpp_driver/aflpp_driver.c16
-rwxr-xr-xutils/crash_triage/triage_crashes.sh9
-rw-r--r--utils/custom_mutators/XmlMutatorMin.py110
-rw-r--r--utils/custom_mutators/common.py12
-rw-r--r--utils/custom_mutators/example.py13
-rw-r--r--utils/custom_mutators/simple-chunk-replace.py16
-rw-r--r--utils/custom_mutators/wrapper_afl_min.py13
-rw-r--r--utils/libdislocator/libdislocator.so.c12
-rw-r--r--utils/persistent_mode/persistent_demo_new.c2
13 files changed, 140 insertions, 126 deletions
diff --git a/utils/afl_network_proxy/GNUmakefile b/utils/afl_network_proxy/GNUmakefile
index 25a3df82..0b55dc2c 100644
--- a/utils/afl_network_proxy/GNUmakefile
+++ b/utils/afl_network_proxy/GNUmakefile
@@ -1,5 +1,6 @@
PREFIX ?= /usr/local
BIN_PATH = $(PREFIX)/bin
+HELPER_PATH = $(PREFIX)/lib/afl
DOC_PATH = $(PREFIX)/share/doc/afl
PROGRAMS = afl-network-client afl-network-server
@@ -31,7 +32,7 @@ afl-network-client: afl-network-client.c
$(CC) $(CFLAGS) -I../../include -o afl-network-client afl-network-client.c $(LDFLAGS)
afl-network-server: afl-network-server.c
- $(CC) $(CFLAGS) -I../../include -o afl-network-server afl-network-server.c ../../src/afl-forkserver.c ../../src/afl-sharedmem.c ../../src/afl-common.c -DBIN_PATH=\"$(BIN_PATH)\" $(LDFLAGS)
+ $(CC) $(CFLAGS) -I../../include -o afl-network-server afl-network-server.c ../../src/afl-forkserver.c ../../src/afl-sharedmem.c ../../src/afl-common.c -DAFL_PATH=\"$(HELPER_PATH)\" -DBIN_PATH=\"$(BIN_PATH)\" $(LDFLAGS)
clean:
rm -f $(PROGRAMS) *~ core
diff --git a/utils/afl_network_proxy/afl-network-server.c b/utils/afl_network_proxy/afl-network-server.c
index fe225416..0dfae658 100644
--- a/utils/afl_network_proxy/afl-network-server.c
+++ b/utils/afl_network_proxy/afl-network-server.c
@@ -237,38 +237,7 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
if (fsrv->qemu_mode) {
- u8 *qemu_preload = getenv("QEMU_SET_ENV");
- u8 *afl_preload = getenv("AFL_PRELOAD");
- u8 *buf;
-
- s32 i, afl_preload_size = strlen(afl_preload);
- for (i = 0; i < afl_preload_size; ++i) {
-
- if (afl_preload[i] == ',') {
-
- PFATAL(
- "Comma (',') is not allowed in AFL_PRELOAD when -Q is "
- "specified!");
-
- }
-
- }
-
- if (qemu_preload) {
-
- buf = alloc_printf("%s,LD_PRELOAD=%s,DYLD_INSERT_LIBRARIES=%s",
- qemu_preload, afl_preload, afl_preload);
-
- } else {
-
- buf = alloc_printf("LD_PRELOAD=%s,DYLD_INSERT_LIBRARIES=%s",
- afl_preload, afl_preload);
-
- }
-
- setenv("QEMU_SET_ENV", buf, 1);
-
- afl_free(buf);
+ /* afl-qemu-trace takes care of converting AFL_PRELOAD. */
} else {
diff --git a/utils/afl_untracer/afl-untracer.c b/utils/afl_untracer/afl-untracer.c
index 1f1a10ea..2baeb58d 100644
--- a/utils/afl_untracer/afl-untracer.c
+++ b/utils/afl_untracer/afl-untracer.c
@@ -480,9 +480,9 @@ void setup_trap_instrumentation(void) {
// Index into the coverage bitmap for the current trap instruction.
#ifdef __aarch64__
uint64_t bitmap_index = 0;
-#ifdef __APPLE__
+ #ifdef __APPLE__
pthread_jit_write_protect_np(0);
-#endif
+ #endif
#else
uint32_t bitmap_index = 0;
#endif
@@ -627,13 +627,13 @@ static void sigtrap_handler(int signum, siginfo_t *si, void *context) {
// Must re-execute the instruction, so decrement PC by one instruction.
ucontext_t *ctx = (ucontext_t *)context;
#if defined(__APPLE__) && defined(__LP64__)
-#if defined(__x86_64__)
+ #if defined(__x86_64__)
ctx->uc_mcontext->__ss.__rip -= 1;
addr = ctx->uc_mcontext->__ss.__rip;
-#else
+ #else
ctx->uc_mcontext->__ss.__pc -= 4;
addr = ctx->uc_mcontext->__ss.__pc;
-#endif
+ #endif
#elif defined(__linux__)
#if defined(__x86_64__) || defined(__i386__)
ctx->uc_mcontext.gregs[REG_RIP] -= 1;
diff --git a/utils/afl_untracer/ida_get_patchpoints.py b/utils/afl_untracer/ida_get_patchpoints.py
index 43cf6d89..807685b3 100644
--- a/utils/afl_untracer/ida_get_patchpoints.py
+++ b/utils/afl_untracer/ida_get_patchpoints.py
@@ -11,6 +11,7 @@ import idc
# See https://www.hex-rays.com/products/ida/support/ida74_idapython_no_bc695_porting_guide.shtml
from os.path import expanduser
+
home = expanduser("~")
patchpoints = set()
@@ -18,7 +19,7 @@ patchpoints = set()
max_offset = 0
for seg_ea in idautils.Segments():
name = idc.get_segm_name(seg_ea)
- #print("Segment: " + name)
+ # print("Segment: " + name)
if name != "__text" and name != ".text":
continue
@@ -26,7 +27,7 @@ for seg_ea in idautils.Segments():
end = idc.get_segm_end(seg_ea)
first = 0
subtract_addr = 0
- #print("Start: " + hex(start) + " End: " + hex(end))
+ # print("Start: " + hex(start) + " End: " + hex(end))
for func_ea in idautils.Functions(start, end):
f = idaapi.get_func(func_ea)
if not f:
@@ -37,10 +38,10 @@ for seg_ea in idautils.Segments():
if block.start_ea >= 0x1000:
subtract_addr = 0x1000
first = 1
-
+
max_offset = max(max_offset, block.start_ea)
patchpoints.add(block.start_ea - subtract_addr)
- #else:
+ # else:
# print("Warning: broken CFG?")
# Round up max_offset to page size
@@ -52,11 +53,11 @@ if rem != 0:
print("Writing to " + home + "/Desktop/patches.txt")
with open(home + "/Desktop/patches.txt", "w") as f:
- f.write(ida_nalt.get_root_filename() + ':' + hex(size) + '\n')
- f.write('\n'.join(map(hex, sorted(patchpoints))))
- f.write('\n')
+ f.write(ida_nalt.get_root_filename() + ":" + hex(size) + "\n")
+ f.write("\n".join(map(hex, sorted(patchpoints))))
+ f.write("\n")
print("Done, found {} patchpoints".format(len(patchpoints)))
# For headless script running remove the comment from the next line
-#ida_pro.qexit()
+# ida_pro.qexit()
diff --git a/utils/aflpp_driver/aflpp_driver.c b/utils/aflpp_driver/aflpp_driver.c
index 7bb929b2..ad781e64 100644
--- a/utils/aflpp_driver/aflpp_driver.c
+++ b/utils/aflpp_driver/aflpp_driver.c
@@ -173,7 +173,7 @@ size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
// Execute any files provided as parameters.
static int ExecuteFilesOnyByOne(int argc, char **argv) {
- unsigned char *buf = malloc(MAX_FILE);
+ unsigned char *buf = (unsigned char *)malloc(MAX_FILE);
for (int i = 1; i < argc; i++) {
int fd = open(argv[i], O_RDONLY);
@@ -187,6 +187,8 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
}
+ close(fd);
+
}
free(buf);
@@ -204,10 +206,20 @@ int main(int argc, char **argv) {
"To fuzz with afl-fuzz execute this:\n"
" afl-fuzz [afl-flags] -- %s [-N]\n"
"afl-fuzz will run N iterations before re-spawning the process (default: "
- "1000)\n"
+ "INT_MAX)\n"
"======================================================\n",
argv[0], argv[0]);
+ if (getenv("AFL_GDB")) {
+
+ char cmd[64];
+ snprintf(cmd, sizeof(cmd), "cat /proc/%d/maps", getpid());
+ system(cmd);
+ fprintf(stderr, "DEBUG: aflpp_driver pid is %d\n", getpid());
+ sleep(1);
+
+ }
+
output_file = stderr;
maybe_duplicate_stderr();
maybe_close_fd_mask();
diff --git a/utils/crash_triage/triage_crashes.sh b/utils/crash_triage/triage_crashes.sh
index bf763cba..c9ca1f79 100755
--- a/utils/crash_triage/triage_crashes.sh
+++ b/utils/crash_triage/triage_crashes.sh
@@ -60,12 +60,12 @@ if
fi
if [ ! -f "$BIN" -o ! -x "$BIN" ]; then
- echo "[-] Error: binary '$2' not found or is not executable." 1>&2
+ echo "[-] Error: binary '$BIN' not found or is not executable." 1>&2
exit 1
fi
if [ ! -d "$DIR/queue" ]; then
- echo "[-] Error: directory '$1' not found or not created by afl-fuzz." 1>&2
+ echo "[-] Error: directory '$DIR' not found or not created by afl-fuzz." 1>&2
exit 1
fi
@@ -90,8 +90,9 @@ for crash in $DIR/crashes/id:*; do
for a in $@; do
- if [ "$a" = "@@" ] ; then
- use_args="$use_args $crash"
+ if echo "$a" | grep -qF '@@'; then
+ escaped_fname=`echo $crash | sed 's:/:\\\\/:g'`
+ use_args="$use_args `echo $a | sed "s/@@/$escaped_fname/g"`"
unset use_stdio
else
use_args="$use_args $a"
diff --git a/utils/custom_mutators/XmlMutatorMin.py b/utils/custom_mutators/XmlMutatorMin.py
index 4c80a2ba..3e6cd0ff 100644
--- a/utils/custom_mutators/XmlMutatorMin.py
+++ b/utils/custom_mutators/XmlMutatorMin.py
@@ -12,12 +12,13 @@ import random, re, io
# The XmlMutatorMin class #
###########################
+
class XmlMutatorMin:
"""
- Optionals parameters:
- seed Seed used by the PRNG (default: "RANDOM")
- verbose Verbosity (default: False)
+ Optionals parameters:
+ seed Seed used by the PRNG (default: "RANDOM")
+ verbose Verbosity (default: False)
"""
def __init__(self, seed="RANDOM", verbose=False):
@@ -41,7 +42,12 @@ class XmlMutatorMin:
self.tree = None
# High-level mutators (no database needed)
- hl_mutators_delete = ["del_node_and_children", "del_node_but_children", "del_attribute", "del_content"] # Delete items
+ hl_mutators_delete = [
+ "del_node_and_children",
+ "del_node_but_children",
+ "del_attribute",
+ "del_content",
+ ] # Delete items
hl_mutators_fuzz = ["fuzz_attribute"] # Randomly change attribute values
# Exposed mutators
@@ -74,7 +80,9 @@ class XmlMutatorMin:
""" Serialize a XML document. Basic wrapper around lxml.tostring() """
- return ET.tostring(tree, with_tail=False, xml_declaration=True, encoding=tree.docinfo.encoding)
+ return ET.tostring(
+ tree, with_tail=False, xml_declaration=True, encoding=tree.docinfo.encoding
+ )
def __ver(self, version):
@@ -161,7 +169,7 @@ class XmlMutatorMin:
# Randomly pick one the function calls
(func, args) = random.choice(l)
# Split by "," and randomly pick one of the arguments
- value = random.choice(args.split(','))
+ value = random.choice(args.split(","))
# Remove superfluous characters
unclean_value = value
value = value.strip(" ").strip("'")
@@ -170,49 +178,49 @@ class XmlMutatorMin:
value = attrib_value
# For each type, define some possible replacement values
- choices_number = ( \
- "0", \
- "11111", \
- "-128", \
- "2", \
- "-1", \
- "1/3", \
- "42/0", \
- "1094861636 idiv 1.0", \
- "-1123329771506872 idiv 3.8", \
- "17=$numericRTF", \
- str(3 + random.randrange(0, 100)), \
- )
-
- choices_letter = ( \
- "P" * (25 * random.randrange(1, 100)), \
- "%s%s%s%s%s%s", \
- "foobar", \
- )
-
- choices_alnum = ( \
- "Abc123", \
- "020F0302020204030204", \
- "020F0302020204030204" * (random.randrange(5, 20)), \
- )
+ choices_number = (
+ "0",
+ "11111",
+ "-128",
+ "2",
+ "-1",
+ "1/3",
+ "42/0",
+ "1094861636 idiv 1.0",
+ "-1123329771506872 idiv 3.8",
+ "17=$numericRTF",
+ str(3 + random.randrange(0, 100)),
+ )
+
+ choices_letter = (
+ "P" * (25 * random.randrange(1, 100)),
+ "%s%s%s%s%s%s",
+ "foobar",
+ )
+
+ choices_alnum = (
+ "Abc123",
+ "020F0302020204030204",
+ "020F0302020204030204" * (random.randrange(5, 20)),
+ )
# Fuzz the value
- if random.choice((True,False)) and value == "":
+ if random.choice((True, False)) and value == "":
# Empty
new_value = value
- elif random.choice((True,False)) and value.isdigit():
+ elif random.choice((True, False)) and value.isdigit():
# Numbers
new_value = random.choice(choices_number)
- elif random.choice((True,False)) and value.isalpha():
+ elif random.choice((True, False)) and value.isalpha():
# Letters
new_value = random.choice(choices_letter)
- elif random.choice((True,False)) and value.isalnum():
+ elif random.choice((True, False)) and value.isalnum():
# Alphanumeric
new_value = random.choice(choices_alnum)
@@ -232,22 +240,25 @@ class XmlMutatorMin:
# Log something
if self.verbose:
- print("Fuzzing attribute #%i '%s' of tag #%i '%s'" % (rand_attrib_id, rand_attrib, rand_elem_id, rand_elem.tag))
+ print(
+ "Fuzzing attribute #%i '%s' of tag #%i '%s'"
+ % (rand_attrib_id, rand_attrib, rand_elem_id, rand_elem.tag)
+ )
# Modify the attribute
rand_elem.set(rand_attrib, new_value.decode("utf-8"))
def __del_node_and_children(self):
- """ High-level minimizing mutator
- Delete a random node and its children (i.e. delete a random tree) """
+ """High-level minimizing mutator
+ Delete a random node and its children (i.e. delete a random tree)"""
self.__del_node(True)
def __del_node_but_children(self):
- """ High-level minimizing mutator
- Delete a random node but its children (i.e. link them to the parent of the deleted node) """
+ """High-level minimizing mutator
+ Delete a random node but its children (i.e. link them to the parent of the deleted node)"""
self.__del_node(False)
@@ -270,7 +281,10 @@ class XmlMutatorMin:
# Log something
if self.verbose:
but_or_and = "and" if delete_children else "but"
- print("Deleting tag #%i '%s' %s its children" % (rand_elem_id, rand_elem.tag, but_or_and))
+ print(
+ "Deleting tag #%i '%s' %s its children"
+ % (rand_elem_id, rand_elem.tag, but_or_and)
+ )
if delete_children is False:
# Link children of the random (soon to be deleted) node to its parent
@@ -282,8 +296,8 @@ class XmlMutatorMin:
def __del_content(self):
- """ High-level minimizing mutator
- Delete the attributes and children of a random node """
+ """High-level minimizing mutator
+ Delete the attributes and children of a random node"""
# Select a node to modify
(rand_elem_id, rand_elem) = self.__pick_element()
@@ -297,8 +311,8 @@ class XmlMutatorMin:
def __del_attribute(self):
- """ High-level minimizing mutator
- Delete a random attribute from a random node """
+ """High-level minimizing mutator
+ Delete a random attribute from a random node"""
# Select a node to modify
(rand_elem_id, rand_elem) = self.__pick_element()
@@ -318,7 +332,10 @@ class XmlMutatorMin:
# Log something
if self.verbose:
- print("Deleting attribute #%i '%s' of tag #%i '%s'" % (rand_attrib_id, rand_attrib, rand_elem_id, rand_elem.tag))
+ print(
+ "Deleting attribute #%i '%s' of tag #%i '%s'"
+ % (rand_attrib_id, rand_attrib, rand_elem_id, rand_elem.tag)
+ )
# Delete the attribute
rand_elem.attrib.pop(rand_attrib)
@@ -329,4 +346,3 @@ class XmlMutatorMin:
# High-level mutation
self.__exec_among(self, self.hl_mutators_all, min, max)
-
diff --git a/utils/custom_mutators/common.py b/utils/custom_mutators/common.py
index 9a1ef0a3..44a5056a 100644
--- a/utils/custom_mutators/common.py
+++ b/utils/custom_mutators/common.py
@@ -1,6 +1,6 @@
#!/usr/bin/env python
# encoding: utf-8
-'''
+"""
Module containing functions shared between multiple AFL modules
@author: Christian Holler (:decoder)
@@ -12,7 +12,7 @@ License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at http://mozilla.org/MPL/2.0/.
@contact: choller@mozilla.com
-'''
+"""
from __future__ import print_function
import random
@@ -23,18 +23,18 @@ import re
def randel(l):
if not l:
return None
- return l[random.randint(0, len(l)-1)]
+ return l[random.randint(0, len(l) - 1)]
def randel_pop(l):
if not l:
return None
- return l.pop(random.randint(0, len(l)-1))
+ return l.pop(random.randint(0, len(l) - 1))
def write_exc_example(data, exc):
- exc_name = re.sub(r'[^a-zA-Z0-9]', '_', repr(exc))
+ exc_name = re.sub(r"[^a-zA-Z0-9]", "_", repr(exc))
if not os.path.exists(exc_name):
- with open(exc_name, 'w') as f:
+ with open(exc_name, "w") as f:
f.write(data)
diff --git a/utils/custom_mutators/example.py b/utils/custom_mutators/example.py
index cf659e5a..3a6d22e4 100644
--- a/utils/custom_mutators/example.py
+++ b/utils/custom_mutators/example.py
@@ -1,6 +1,6 @@
#!/usr/bin/env python
# encoding: utf-8
-'''
+"""
Example Python Module for AFLFuzz
@author: Christian Holler (:decoder)
@@ -12,7 +12,7 @@ License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at http://mozilla.org/MPL/2.0/.
@contact: choller@mozilla.com
-'''
+"""
import random
@@ -26,12 +26,12 @@ COMMANDS = [
def init(seed):
- '''
+ """
Called once when AFLFuzz starts up. Used to seed our RNG.
@type seed: int
@param seed: A 32-bit random value
- '''
+ """
random.seed(seed)
@@ -40,7 +40,7 @@ def deinit():
def fuzz(buf, add_buf, max_size):
- '''
+ """
Called per fuzzing iteration.
@type buf: bytearray
@@ -55,13 +55,14 @@ def fuzz(buf, add_buf, max_size):
@rtype: bytearray
@return: A new bytearray containing the mutated data
- '''
+ """
ret = bytearray(100)
ret[:3] = random.choice(COMMANDS)
return ret
+
# Uncomment and implement the following methods if you want to use a custom
# trimming algorithm. See also the documentation for a better API description.
diff --git a/utils/custom_mutators/simple-chunk-replace.py b/utils/custom_mutators/simple-chunk-replace.py
index df2f4ca7..c57218dd 100644
--- a/utils/custom_mutators/simple-chunk-replace.py
+++ b/utils/custom_mutators/simple-chunk-replace.py
@@ -1,6 +1,6 @@
#!/usr/bin/env python
# encoding: utf-8
-'''
+"""
Simple Chunk Cross-Over Replacement Module for AFLFuzz
@author: Christian Holler (:decoder)
@@ -12,24 +12,24 @@ License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at http://mozilla.org/MPL/2.0/.
@contact: choller@mozilla.com
-'''
+"""
import random
def init(seed):
- '''
+ """
Called once when AFLFuzz starts up. Used to seed our RNG.
@type seed: int
@param seed: A 32-bit random value
- '''
+ """
# Seed our RNG
random.seed(seed)
def fuzz(buf, add_buf, max_size):
- '''
+ """
Called per fuzzing iteration.
@type buf: bytearray
@@ -44,7 +44,7 @@ def fuzz(buf, add_buf, max_size):
@rtype: bytearray
@return: A new bytearray containing the mutated data
- '''
+ """
# Make a copy of our input buffer for returning
ret = bytearray(buf)
@@ -58,7 +58,9 @@ def fuzz(buf, add_buf, max_size):
rand_dst_idx = random.randint(0, len(buf))
# Make the chunk replacement
- ret[rand_dst_idx:rand_dst_idx + fragment_len] = add_buf[rand_src_idx:rand_src_idx + fragment_len]
+ ret[rand_dst_idx : rand_dst_idx + fragment_len] = add_buf[
+ rand_src_idx : rand_src_idx + fragment_len
+ ]
# Return data
return ret
diff --git a/utils/custom_mutators/wrapper_afl_min.py b/utils/custom_mutators/wrapper_afl_min.py
index ecb03b55..5cd60031 100644
--- a/utils/custom_mutators/wrapper_afl_min.py
+++ b/utils/custom_mutators/wrapper_afl_min.py
@@ -27,7 +27,7 @@ def log(text):
def init(seed):
"""
- Called once when AFL starts up. Seed is used to identify the AFL instance in log files
+ Called once when AFL starts up. Seed is used to identify the AFL instance in log files
"""
global __mutator__
@@ -72,7 +72,10 @@ def fuzz(buf, add_buf, max_size):
if via_buffer:
try:
__mutator__.init_from_string(buf_str)
- log("fuzz(): Mutator successfully initialized with AFL buffer (%d bytes)" % len(buf_str))
+ log(
+ "fuzz(): Mutator successfully initialized with AFL buffer (%d bytes)"
+ % len(buf_str)
+ )
except Exception:
via_buffer = False
log("fuzz(): Can't initialize mutator with AFL buffer")
@@ -104,7 +107,7 @@ def fuzz(buf, add_buf, max_size):
# Main (for debug)
-if __name__ == '__main__':
+if __name__ == "__main__":
__log__ = True
__log_file__ = "/dev/stdout"
@@ -112,7 +115,9 @@ if __name__ == '__main__':
init(__seed__)
- in_1 = bytearray("<foo ddd='eeee'>ffff<a b='c' d='456' eee='ffffff'>zzzzzzzzzzzz</a><b yyy='YYY' zzz='ZZZ'></b></foo>")
+ in_1 = bytearray(
+ "<foo ddd='eeee'>ffff<a b='c' d='456' eee='ffffff'>zzzzzzzzzzzz</a><b yyy='YYY' zzz='ZZZ'></b></foo>"
+ )
in_2 = bytearray("<abc abc123='456' abcCBA='ppppppppppppppppppppppppppppp'/>")
out = fuzz(in_1, in_2)
print(out)
diff --git a/utils/libdislocator/libdislocator.so.c b/utils/libdislocator/libdislocator.so.c
index c041fec6..1b247c86 100644
--- a/utils/libdislocator/libdislocator.so.c
+++ b/utils/libdislocator/libdislocator.so.c
@@ -168,7 +168,7 @@ static void *__dislocator_alloc(size_t len) {
u8 * ret, *base;
size_t tlen;
- int flags, fd, sp;
+ int flags, protflags, fd, sp;
if (total_mem + len > max_mem || total_mem + len < total_mem) {
@@ -191,8 +191,14 @@ static void *__dislocator_alloc(size_t len) {
base = NULL;
tlen = (1 + PG_COUNT(rlen + 8)) * PAGE_SIZE;
+ protflags = PROT_READ | PROT_WRITE;
flags = MAP_PRIVATE | MAP_ANONYMOUS;
fd = -1;
+#if defined(PROT_MAX)
+ // apply when sysctl vm.imply_prot_max is set to 1
+ // no-op otherwise
+ protflags |= PROT_MAX(PROT_READ | PROT_WRITE);
+#endif
#if defined(USEHUGEPAGE)
sp = (rlen >= SUPER_PAGE_SIZE && !(rlen % SUPER_PAGE_SIZE));
@@ -215,7 +221,7 @@ static void *__dislocator_alloc(size_t len) {
(void)sp;
#endif
- ret = (u8 *)mmap(base, tlen, PROT_READ | PROT_WRITE, flags, fd, 0);
+ ret = (u8 *)mmap(base, tlen, protflags, flags, fd, 0);
#if defined(USEHUGEPAGE)
/* We try one more time with regular call */
if (ret == MAP_FAILED) {
@@ -229,7 +235,7 @@ static void *__dislocator_alloc(size_t len) {
#elif defined(__sun)
flags &= -MAP_ALIGN;
#endif
- ret = (u8 *)mmap(NULL, tlen, PROT_READ | PROT_WRITE, flags, fd, 0);
+ ret = (u8 *)mmap(NULL, tlen, protflags, flags, fd, 0);
}
diff --git a/utils/persistent_mode/persistent_demo_new.c b/utils/persistent_mode/persistent_demo_new.c
index 7e694696..285f50aa 100644
--- a/utils/persistent_mode/persistent_demo_new.c
+++ b/utils/persistent_mode/persistent_demo_new.c
@@ -70,7 +70,7 @@ int main(int argc, char **argv) {
len = __AFL_FUZZ_TESTCASE_LEN; // do not use the macro directly in a call!
- fprintf(stderr, "input: %zd \"%s\"\n", len, buf);
+ // fprintf(stderr, "input: %zd \"%s\"\n", len, buf);
/* do we have enough data? */
if (len < 8) continue;
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-14 20:29:02 +0000