aboutsummaryrefslogtreecommitdiff
path: root/utils
diff options
context:
space:
mode:
Diffstat (limited to 'utils')
-rw-r--r--utils/afl_frida/README.md2
-rw-r--r--utils/afl_frida/afl-frida.c173
-rw-r--r--utils/afl_untracer/afl-untracer.c15
-rw-r--r--utils/afl_untracer/ida_get_patchpoints.py17
-rw-r--r--utils/aflpp_driver/aflpp_driver.c3
-rw-r--r--utils/custom_mutators/XmlMutatorMin.py110
-rw-r--r--utils/custom_mutators/common.py12
-rw-r--r--utils/custom_mutators/example.py13
-rw-r--r--utils/custom_mutators/simple-chunk-replace.py16
-rw-r--r--utils/custom_mutators/wrapper_afl_min.py13
-rw-r--r--utils/defork/defork.c1
11 files changed, 252 insertions, 123 deletions
diff --git a/utils/afl_frida/README.md b/utils/afl_frida/README.md
index 7743479b..68b62009 100644
--- a/utils/afl_frida/README.md
+++ b/utils/afl_frida/README.md
@@ -20,7 +20,7 @@ search and edit the `STEP 1`, `STEP 2` and `STEP 3` locations.
Example (after modifying afl-frida.c to your needs and compile it):
```
-LD_LIBRARY_PATH=/path/to/the/target/library afl-fuzz -i in -o out -- ./afl-frida
+LD_LIBRARY_PATH=/path/to/the/target/library/ afl-fuzz -i in -o out -- ./afl-frida
```
(or even remote via afl-network-proxy).
diff --git a/utils/afl_frida/afl-frida.c b/utils/afl_frida/afl-frida.c
index 087f18e8..711d8f33 100644
--- a/utils/afl_frida/afl-frida.c
+++ b/utils/afl_frida/afl-frida.c
@@ -78,11 +78,11 @@ extern unsigned int * __afl_fuzz_len;
extern unsigned char *__afl_fuzz_ptr;
// Notify AFL about persistent mode.
-static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##";
+static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##\0";
int __afl_persistent_loop(unsigned int);
// Notify AFL about deferred forkserver.
-static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
+static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##\0";
void __afl_manual_init();
// Because we do our own logging.
@@ -94,6 +94,8 @@ typedef struct {
GumAddress base_address;
guint64 code_start, code_end;
+ GumAddress current_log_impl;
+ uint64_t afl_prev_loc;
} range_t;
@@ -109,12 +111,58 @@ inline static void afl_maybe_log(guint64 current_pc) {
}
+#if GUM_NATIVE_CPU == GUM_CPU_AMD64
+
+static const guint8 afl_maybe_log_code[] = {
+
+ 0x9c, // pushfq
+ 0x50, // push rax
+ 0x51, // push rcx
+ 0x52, // push rdx
+ 0x56, // push rsi
+
+ 0x89, 0xf8, // mov eax, edi
+ 0xc1, 0xe0, 0x08, // shl eax, 8
+ 0xc1, 0xef, 0x04, // shr edi, 4
+ 0x31, 0xc7, // xor edi, eax
+ 0x0f, 0xb7, 0xc7, // movzx eax, di
+ 0x48, 0x8d, 0x0d, 0x30, 0x00, 0x00, 0x00, // lea rcx, sym._afl_area_ptr_ptr
+ 0x48, 0x8b, 0x09, // mov rcx, qword [rcx]
+ 0x48, 0x8b, 0x09, // mov rcx, qword [rcx]
+ 0x48, 0x8d, 0x15, 0x1b, 0x00, 0x00, 0x00, // lea rdx, sym._afl_prev_loc_ptr
+ 0x48, 0x8b, 0x32, // mov rsi, qword [rdx]
+ 0x48, 0x8b, 0x36, // mov rsi, qword [rsi]
+ 0x48, 0x31, 0xc6, // xor rsi, rax
+ 0xfe, 0x04, 0x31, // inc byte [rcx + rsi]
+
+ 0x48, 0xd1, 0xe8, // shr rax, 1
+ 0x48, 0x8b, 0x0a, // mov rcx, qword [rdx]
+ 0x48, 0x89, 0x01, // mov qword [rcx], rax
+
+ 0x5e, // pop rsi
+ 0x5a, // pop rdx
+ 0x59, // pop rcx
+ 0x58, // pop rax
+ 0x9d, // popfq
+
+ 0xc3, // ret
+ // Read-only data goes here:
+ // uint64_t* afl_prev_loc_ptr
+ // uint8_t** afl_area_ptr_ptr
+ // unsigned int afl_instr_rms
+
+};
+
+#else
+
static void on_basic_block(GumCpuContext *context, gpointer user_data) {
afl_maybe_log((guint64)user_data);
}
+#endif
+
void instr_basic_block(GumStalkerIterator *iterator, GumStalkerOutput *output,
gpointer user_data) {
@@ -129,8 +177,45 @@ void instr_basic_block(GumStalkerIterator *iterator, GumStalkerOutput *output,
if (instr->address >= range->code_start &&
instr->address <= range->code_end) {
+#if GUM_NATIVE_CPU == GUM_CPU_AMD64
+ GumX86Writer *cw = output->writer.x86;
+ if (range->current_log_impl == 0 ||
+ !gum_x86_writer_can_branch_directly_between(
+ cw->pc, range->current_log_impl) ||
+ !gum_x86_writer_can_branch_directly_between(
+ cw->pc + 128, range->current_log_impl)) {
+
+ gconstpointer after_log_impl = cw->code + 1;
+
+ gum_x86_writer_put_jmp_near_label(cw, after_log_impl);
+
+ range->current_log_impl = cw->pc;
+ gum_x86_writer_put_bytes(cw, afl_maybe_log_code,
+ sizeof(afl_maybe_log_code));
+
+ uint64_t *afl_prev_loc_ptr = &range->afl_prev_loc;
+ uint8_t **afl_area_ptr_ptr = &__afl_area_ptr;
+ gum_x86_writer_put_bytes(cw, (const guint8 *)&afl_prev_loc_ptr,
+ sizeof(afl_prev_loc_ptr));
+ gum_x86_writer_put_bytes(cw, (const guint8 *)&afl_area_ptr_ptr,
+ sizeof(afl_area_ptr_ptr));
+ gum_x86_writer_put_label(cw, after_log_impl);
+
+ }
+
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
+ -GUM_RED_ZONE_SIZE);
+ gum_x86_writer_put_push_reg(cw, GUM_REG_RDI);
+ gum_x86_writer_put_mov_reg_address(cw, GUM_REG_RDI,
+ GUM_ADDRESS(instr->address));
+ gum_x86_writer_put_call_address(cw, range->current_log_impl);
+ gum_x86_writer_put_pop_reg(cw, GUM_REG_RDI);
+ gum_x86_writer_put_lea_reg_reg_offset(cw, GUM_REG_RSP, GUM_REG_RSP,
+ GUM_RED_ZONE_SIZE);
+#else
gum_stalker_iterator_put_callout(iterator, on_basic_block,
(gpointer)instr->address, NULL);
+#endif
begin = FALSE;
}
@@ -153,7 +238,7 @@ static int enumerate_ranges(const GumRangeDetails *details,
}
-int main(int argc, char** argv) {
+int main(int argc, char **argv) {
#ifndef __APPLE__
(void)personality(ADDR_NO_RANDOMIZE); // disable ASLR
@@ -166,10 +251,15 @@ int main(int argc, char** argv) {
void *dl = NULL;
if (argc > 2) {
+
dl = dlopen(argv[1], RTLD_LAZY);
+
} else {
+
dl = dlopen(TARGET_LIBRARY, RTLD_LAZY);
+
}
+
if (!dl) {
if (argc > 2)
@@ -197,17 +287,18 @@ int main(int argc, char** argv) {
// END STEP 2
if (!getenv("AFL_FRIDA_TEST_INPUT")) {
+
gum_init_embedded();
if (!gum_stalker_is_supported()) {
-
+
gum_deinit_embedded();
return 1;
-
+
}
-
+
GumStalker *stalker = gum_stalker_new();
-
- GumAddress base_address;
+
+ GumAddress base_address;
if (argc > 2)
base_address = gum_module_find_base_address(argv[1]);
else
@@ -215,87 +306,89 @@ int main(int argc, char** argv) {
GumMemoryRange code_range;
if (argc > 2)
gum_module_enumerate_ranges(argv[1], GUM_PAGE_RX, enumerate_ranges,
- &code_range);
+ &code_range);
else
gum_module_enumerate_ranges(TARGET_LIBRARY, GUM_PAGE_RX, enumerate_ranges,
- &code_range);
-
+ &code_range);
+
guint64 code_start = code_range.base_address;
guint64 code_end = code_range.base_address + code_range.size;
- range_t instr_range = {0, code_start, code_end};
-
+ range_t instr_range = {0, code_start, code_end, 0, 0};
+
printf("Frida instrumentation: base=0x%lx instrumenting=0x%lx-%lx\n",
base_address, code_start, code_end);
if (!code_start || !code_end) {
-
+
if (argc > 2)
fprintf(stderr, "Error: no valid memory address found for %s\n",
- argv[1]);
+ argv[1]);
else
fprintf(stderr, "Error: no valid memory address found for %s\n",
- TARGET_LIBRARY);
+ TARGET_LIBRARY);
exit(-1);
-
+
}
-
+
GumStalkerTransformer *transformer =
gum_stalker_transformer_make_from_callback(instr_basic_block,
&instr_range, NULL);
-
+
// to ensure that the signatures are not optimized out
- memcpy(__afl_area_ptr, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT) + 1);
+ memcpy(__afl_area_ptr, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
memcpy(__afl_area_ptr + 32, (void *)AFL_DEFER_FORKSVR,
- sizeof(AFL_DEFER_FORKSVR) + 1);
+ sizeof(AFL_DEFER_FORKSVR));
__afl_manual_init();
-
+
//
// any expensive target library initialization that has to be done just once
// - put that here
//
-
+
gum_stalker_follow_me(stalker, transformer, NULL);
-
+
while (__afl_persistent_loop(UINT32_MAX) != 0) {
-
+
previous_pc = 0; // Required!
-
- #ifdef _DEBUG
+
+#ifdef _DEBUG
fprintf(stderr, "CLIENT crc: %016llx len: %u\n",
hash64(__afl_fuzz_ptr, *__afl_fuzz_len), *__afl_fuzz_len);
fprintf(stderr, "RECV:");
for (int i = 0; i < *__afl_fuzz_len; i++)
fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
fprintf(stderr, "\n");
- #endif
-
+#endif
+
// STEP 3: ensure the minimum length is present and setup the target
// function to fuzz.
-
+
if (*__afl_fuzz_len > 0) {
-
+
__afl_fuzz_ptr[*__afl_fuzz_len] = 0; // if you need to null terminate
(*o_function)(__afl_fuzz_ptr, *__afl_fuzz_len);
-
+
}
-
+
// END STEP 3
-
+
}
-
+
gum_stalker_unfollow_me(stalker);
-
+
while (gum_stalker_garbage_collect(stalker))
g_usleep(10000);
-
+
g_object_unref(stalker);
g_object_unref(transformer);
gum_deinit_embedded();
} else {
- char buf[8*1024] = {0};
- int count = read(0, buf, sizeof(buf));
- buf[8*1024-1] = '\0';
+
+ char buf[8 * 1024] = {0};
+ int count = read(0, buf, sizeof(buf));
+ buf[8 * 1024 - 1] = '\0';
(*o_function)(buf, count);
+
}
return 0;
diff --git a/utils/afl_untracer/afl-untracer.c b/utils/afl_untracer/afl-untracer.c
index 695f8dd1..2baeb58d 100644
--- a/utils/afl_untracer/afl-untracer.c
+++ b/utils/afl_untracer/afl-untracer.c
@@ -56,9 +56,9 @@
#include <sys/shm.h>
#include <sys/wait.h>
#include <sys/types.h>
-#include <sys/personality.h>
#if defined(__linux__)
+ #include <sys/personality.h>
#include <sys/ucontext.h>
#elif defined(__APPLE__) && defined(__LP64__)
#include <mach-o/dyld_images.h>
@@ -143,7 +143,7 @@ void read_library_information(void) {
b = buf;
m = index(buf, '-');
e = index(buf, ' ');
- if ((n = rindex(buf, '/')) == NULL) n = rindex(buf, ' ');
+ if ((n = strrchr(buf, '/')) == NULL) n = strrchr(buf, ' ');
if (n &&
((*n >= '0' && *n <= '9') || *n == '[' || *n == '{' || *n == '('))
n = NULL;
@@ -480,6 +480,9 @@ void setup_trap_instrumentation(void) {
// Index into the coverage bitmap for the current trap instruction.
#ifdef __aarch64__
uint64_t bitmap_index = 0;
+ #ifdef __APPLE__
+ pthread_jit_write_protect_np(0);
+ #endif
#else
uint32_t bitmap_index = 0;
#endif
@@ -508,7 +511,6 @@ void setup_trap_instrumentation(void) {
lib_size);
lib_addr = (u8 *)lib_base->addr_start;
-
// Make library code writable.
if (mprotect((void *)lib_addr, lib_size,
PROT_READ | PROT_WRITE | PROT_EXEC) != 0)
@@ -625,8 +627,13 @@ static void sigtrap_handler(int signum, siginfo_t *si, void *context) {
// Must re-execute the instruction, so decrement PC by one instruction.
ucontext_t *ctx = (ucontext_t *)context;
#if defined(__APPLE__) && defined(__LP64__)
+ #if defined(__x86_64__)
ctx->uc_mcontext->__ss.__rip -= 1;
addr = ctx->uc_mcontext->__ss.__rip;
+ #else
+ ctx->uc_mcontext->__ss.__pc -= 4;
+ addr = ctx->uc_mcontext->__ss.__pc;
+ #endif
#elif defined(__linux__)
#if defined(__x86_64__) || defined(__i386__)
ctx->uc_mcontext.gregs[REG_RIP] -= 1;
@@ -676,7 +683,9 @@ static void sigtrap_handler(int signum, siginfo_t *si, void *context) {
/* the MAIN function */
int main(int argc, char *argv[]) {
+#if defined(__linux__)
(void)personality(ADDR_NO_RANDOMIZE); // disable ASLR
+#endif
pid = getpid();
if (getenv("AFL_DEBUG")) debug = 1;
diff --git a/utils/afl_untracer/ida_get_patchpoints.py b/utils/afl_untracer/ida_get_patchpoints.py
index 43cf6d89..807685b3 100644
--- a/utils/afl_untracer/ida_get_patchpoints.py
+++ b/utils/afl_untracer/ida_get_patchpoints.py
@@ -11,6 +11,7 @@ import idc
# See https://www.hex-rays.com/products/ida/support/ida74_idapython_no_bc695_porting_guide.shtml
from os.path import expanduser
+
home = expanduser("~")
patchpoints = set()
@@ -18,7 +19,7 @@ patchpoints = set()
max_offset = 0
for seg_ea in idautils.Segments():
name = idc.get_segm_name(seg_ea)
- #print("Segment: " + name)
+ # print("Segment: " + name)
if name != "__text" and name != ".text":
continue
@@ -26,7 +27,7 @@ for seg_ea in idautils.Segments():
end = idc.get_segm_end(seg_ea)
first = 0
subtract_addr = 0
- #print("Start: " + hex(start) + " End: " + hex(end))
+ # print("Start: " + hex(start) + " End: " + hex(end))
for func_ea in idautils.Functions(start, end):
f = idaapi.get_func(func_ea)
if not f:
@@ -37,10 +38,10 @@ for seg_ea in idautils.Segments():
if block.start_ea >= 0x1000:
subtract_addr = 0x1000
first = 1
-
+
max_offset = max(max_offset, block.start_ea)
patchpoints.add(block.start_ea - subtract_addr)
- #else:
+ # else:
# print("Warning: broken CFG?")
# Round up max_offset to page size
@@ -52,11 +53,11 @@ if rem != 0:
print("Writing to " + home + "/Desktop/patches.txt")
with open(home + "/Desktop/patches.txt", "w") as f:
- f.write(ida_nalt.get_root_filename() + ':' + hex(size) + '\n')
- f.write('\n'.join(map(hex, sorted(patchpoints))))
- f.write('\n')
+ f.write(ida_nalt.get_root_filename() + ":" + hex(size) + "\n")
+ f.write("\n".join(map(hex, sorted(patchpoints))))
+ f.write("\n")
print("Done, found {} patchpoints".format(len(patchpoints)))
# For headless script running remove the comment from the next line
-#ida_pro.qexit()
+# ida_pro.qexit()
diff --git a/utils/aflpp_driver/aflpp_driver.c b/utils/aflpp_driver/aflpp_driver.c
index 30e6ebb9..6af79e14 100644
--- a/utils/aflpp_driver/aflpp_driver.c
+++ b/utils/aflpp_driver/aflpp_driver.c
@@ -47,6 +47,7 @@ $AFL_HOME/afl-fuzz -i IN -o OUT ./a.out
#include <sys/mman.h>
#include "config.h"
+#include "types.h"
#include "cmplog.h"
#ifdef _DEBUG
@@ -172,7 +173,7 @@ size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
// Execute any files provided as parameters.
static int ExecuteFilesOnyByOne(int argc, char **argv) {
- unsigned char *buf = malloc(MAX_FILE);
+ unsigned char *buf = (unsigned char *)malloc(MAX_FILE);
for (int i = 1; i < argc; i++) {
int fd = open(argv[i], O_RDONLY);
diff --git a/utils/custom_mutators/XmlMutatorMin.py b/utils/custom_mutators/XmlMutatorMin.py
index 4c80a2ba..3e6cd0ff 100644
--- a/utils/custom_mutators/XmlMutatorMin.py
+++ b/utils/custom_mutators/XmlMutatorMin.py
@@ -12,12 +12,13 @@ import random, re, io
# The XmlMutatorMin class #
###########################
+
class XmlMutatorMin:
"""
- Optionals parameters:
- seed Seed used by the PRNG (default: "RANDOM")
- verbose Verbosity (default: False)
+ Optionals parameters:
+ seed Seed used by the PRNG (default: "RANDOM")
+ verbose Verbosity (default: False)
"""
def __init__(self, seed="RANDOM", verbose=False):
@@ -41,7 +42,12 @@ class XmlMutatorMin:
self.tree = None
# High-level mutators (no database needed)
- hl_mutators_delete = ["del_node_and_children", "del_node_but_children", "del_attribute", "del_content"] # Delete items
+ hl_mutators_delete = [
+ "del_node_and_children",
+ "del_node_but_children",
+ "del_attribute",
+ "del_content",
+ ] # Delete items
hl_mutators_fuzz = ["fuzz_attribute"] # Randomly change attribute values
# Exposed mutators
@@ -74,7 +80,9 @@ class XmlMutatorMin:
""" Serialize a XML document. Basic wrapper around lxml.tostring() """
- return ET.tostring(tree, with_tail=False, xml_declaration=True, encoding=tree.docinfo.encoding)
+ return ET.tostring(
+ tree, with_tail=False, xml_declaration=True, encoding=tree.docinfo.encoding
+ )
def __ver(self, version):
@@ -161,7 +169,7 @@ class XmlMutatorMin:
# Randomly pick one the function calls
(func, args) = random.choice(l)
# Split by "," and randomly pick one of the arguments
- value = random.choice(args.split(','))
+ value = random.choice(args.split(","))
# Remove superfluous characters
unclean_value = value
value = value.strip(" ").strip("'")
@@ -170,49 +178,49 @@ class XmlMutatorMin:
value = attrib_value
# For each type, define some possible replacement values
- choices_number = ( \
- "0", \
- "11111", \
- "-128", \
- "2", \
- "-1", \
- "1/3", \
- "42/0", \
- "1094861636 idiv 1.0", \
- "-1123329771506872 idiv 3.8", \
- "17=$numericRTF", \
- str(3 + random.randrange(0, 100)), \
- )
-
- choices_letter = ( \
- "P" * (25 * random.randrange(1, 100)), \
- "%s%s%s%s%s%s", \
- "foobar", \
- )
-
- choices_alnum = ( \
- "Abc123", \
- "020F0302020204030204", \
- "020F0302020204030204" * (random.randrange(5, 20)), \
- )
+ choices_number = (
+ "0",
+ "11111",
+ "-128",
+ "2",
+ "-1",
+ "1/3",
+ "42/0",
+ "1094861636 idiv 1.0",
+ "-1123329771506872 idiv 3.8",
+ "17=$numericRTF",
+ str(3 + random.randrange(0, 100)),
+ )
+
+ choices_letter = (
+ "P" * (25 * random.randrange(1, 100)),
+ "%s%s%s%s%s%s",
+ "foobar",
+ )
+
+ choices_alnum = (
+ "Abc123",
+ "020F0302020204030204",
+ "020F0302020204030204" * (random.randrange(5, 20)),
+ )
# Fuzz the value
- if random.choice((True,False)) and value == "":
+ if random.choice((True, False)) and value == "":
# Empty
new_value = value
- elif random.choice((True,False)) and value.isdigit():
+ elif random.choice((True, False)) and value.isdigit():
# Numbers
new_value = random.choice(choices_number)
- elif random.choice((True,False)) and value.isalpha():
+ elif random.choice((True, False)) and value.isalpha():
# Letters
new_value = random.choice(choices_letter)
- elif random.choice((True,False)) and value.isalnum():
+ elif random.choice((True, False)) and value.isalnum():
# Alphanumeric
new_value = random.choice(choices_alnum)
@@ -232,22 +240,25 @@ class XmlMutatorMin:
# Log something
if self.verbose:
- print("Fuzzing attribute #%i '%s' of tag #%i '%s'" % (rand_attrib_id, rand_attrib, rand_elem_id, rand_elem.tag))
+ print(
+ "Fuzzing attribute #%i '%s' of tag #%i '%s'"
+ % (rand_attrib_id, rand_attrib, rand_elem_id, rand_elem.tag)
+ )
# Modify the attribute
rand_elem.set(rand_attrib, new_value.decode("utf-8"))
def __del_node_and_children(self):
- """ High-level minimizing mutator
- Delete a random node and its children (i.e. delete a random tree) """
+ """High-level minimizing mutator
+ Delete a random node and its children (i.e. delete a random tree)"""
self.__del_node(True)
def __del_node_but_children(self):
- """ High-level minimizing mutator
- Delete a random node but its children (i.e. link them to the parent of the deleted node) """
+ """High-level minimizing mutator
+ Delete a random node but its children (i.e. link them to the parent of the deleted node)"""
self.__del_node(False)
@@ -270,7 +281,10 @@ class XmlMutatorMin:
# Log something
if self.verbose:
but_or_and = "and" if delete_children else "but"
- print("Deleting tag #%i '%s' %s its children" % (rand_elem_id, rand_elem.tag, but_or_and))
+ print(
+ "Deleting tag #%i '%s' %s its children"
+ % (rand_elem_id, rand_elem.tag, but_or_and)
+ )
if delete_children is False:
# Link children of the random (soon to be deleted) node to its parent
@@ -282,8 +296,8 @@ class XmlMutatorMin:
def __del_content(self):
- """ High-level minimizing mutator
- Delete the attributes and children of a random node """
+ """High-level minimizing mutator
+ Delete the attributes and children of a random node"""
# Select a node to modify
(rand_elem_id, rand_elem) = self.__pick_element()
@@ -297,8 +311,8 @@ class XmlMutatorMin:
def __del_attribute(self):
- """ High-level minimizing mutator
- Delete a random attribute from a random node """
+ """High-level minimizing mutator
+ Delete a random attribute from a random node"""
# Select a node to modify
(rand_elem_id, rand_elem) = self.__pick_element()
@@ -318,7 +332,10 @@ class XmlMutatorMin:
# Log something
if self.verbose:
- print("Deleting attribute #%i '%s' of tag #%i '%s'" % (rand_attrib_id, rand_attrib, rand_elem_id, rand_elem.tag))
+ print(
+ "Deleting attribute #%i '%s' of tag #%i '%s'"
+ % (rand_attrib_id, rand_attrib, rand_elem_id, rand_elem.tag)
+ )
# Delete the attribute
rand_elem.attrib.pop(rand_attrib)
@@ -329,4 +346,3 @@ class XmlMutatorMin:
# High-level mutation
self.__exec_among(self, self.hl_mutators_all, min, max)
-
diff --git a/utils/custom_mutators/common.py b/utils/custom_mutators/common.py
index 9a1ef0a3..44a5056a 100644
--- a/utils/custom_mutators/common.py
+++ b/utils/custom_mutators/common.py
@@ -1,6 +1,6 @@
#!/usr/bin/env python
# encoding: utf-8
-'''
+"""
Module containing functions shared between multiple AFL modules
@author: Christian Holler (:decoder)
@@ -12,7 +12,7 @@ License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at http://mozilla.org/MPL/2.0/.
@contact: choller@mozilla.com
-'''
+"""
from __future__ import print_function
import random
@@ -23,18 +23,18 @@ import re
def randel(l):
if not l:
return None
- return l[random.randint(0, len(l)-1)]
+ return l[random.randint(0, len(l) - 1)]
def randel_pop(l):
if not l:
return None
- return l.pop(random.randint(0, len(l)-1))
+ return l.pop(random.randint(0, len(l) - 1))
def write_exc_example(data, exc):
- exc_name = re.sub(r'[^a-zA-Z0-9]', '_', repr(exc))
+ exc_name = re.sub(r"[^a-zA-Z0-9]", "_", repr(exc))
if not os.path.exists(exc_name):
- with open(exc_name, 'w') as f:
+ with open(exc_name, "w") as f:
f.write(data)
diff --git a/utils/custom_mutators/example.py b/utils/custom_mutators/example.py
index cf659e5a..3a6d22e4 100644
--- a/utils/custom_mutators/example.py
+++ b/utils/custom_mutators/example.py
@@ -1,6 +1,6 @@
#!/usr/bin/env python
# encoding: utf-8
-'''
+"""
Example Python Module for AFLFuzz
@author: Christian Holler (:decoder)
@@ -12,7 +12,7 @@ License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at http://mozilla.org/MPL/2.0/.
@contact: choller@mozilla.com
-'''
+"""
import random
@@ -26,12 +26,12 @@ COMMANDS = [
def init(seed):
- '''
+ """
Called once when AFLFuzz starts up. Used to seed our RNG.
@type seed: int
@param seed: A 32-bit random value
- '''
+ """
random.seed(seed)
@@ -40,7 +40,7 @@ def deinit():
def fuzz(buf, add_buf, max_size):
- '''
+ """
Called per fuzzing iteration.
@type buf: bytearray
@@ -55,13 +55,14 @@ def fuzz(buf, add_buf, max_size):
@rtype: bytearray
@return: A new bytearray containing the mutated data
- '''
+ """
ret = bytearray(100)
ret[:3] = random.choice(COMMANDS)
return ret
+
# Uncomment and implement the following methods if you want to use a custom
# trimming algorithm. See also the documentation for a better API description.
diff --git a/utils/custom_mutators/simple-chunk-replace.py b/utils/custom_mutators/simple-chunk-replace.py
index df2f4ca7..c57218dd 100644
--- a/utils/custom_mutators/simple-chunk-replace.py
+++ b/utils/custom_mutators/simple-chunk-replace.py
@@ -1,6 +1,6 @@
#!/usr/bin/env python
# encoding: utf-8
-'''
+"""
Simple Chunk Cross-Over Replacement Module for AFLFuzz
@author: Christian Holler (:decoder)
@@ -12,24 +12,24 @@ License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at http://mozilla.org/MPL/2.0/.
@contact: choller@mozilla.com
-'''
+"""
import random
def init(seed):
- '''
+ """
Called once when AFLFuzz starts up. Used to seed our RNG.
@type seed: int
@param seed: A 32-bit random value
- '''
+ """
# Seed our RNG
random.seed(seed)
def fuzz(buf, add_buf, max_size):
- '''
+ """
Called per fuzzing iteration.
@type buf: bytearray
@@ -44,7 +44,7 @@ def fuzz(buf, add_buf, max_size):
@rtype: bytearray
@return: A new bytearray containing the mutated data
- '''
+ """
# Make a copy of our input buffer for returning
ret = bytearray(buf)
@@ -58,7 +58,9 @@ def fuzz(buf, add_buf, max_size):
rand_dst_idx = random.randint(0, len(buf))
# Make the chunk replacement
- ret[rand_dst_idx:rand_dst_idx + fragment_len] = add_buf[rand_src_idx:rand_src_idx + fragment_len]
+ ret[rand_dst_idx : rand_dst_idx + fragment_len] = add_buf[
+ rand_src_idx : rand_src_idx + fragment_len
+ ]
# Return data
return ret
diff --git a/utils/custom_mutators/wrapper_afl_min.py b/utils/custom_mutators/wrapper_afl_min.py
index ecb03b55..5cd60031 100644
--- a/utils/custom_mutators/wrapper_afl_min.py
+++ b/utils/custom_mutators/wrapper_afl_min.py
@@ -27,7 +27,7 @@ def log(text):
def init(seed):
"""
- Called once when AFL starts up. Seed is used to identify the AFL instance in log files
+ Called once when AFL starts up. Seed is used to identify the AFL instance in log files
"""
global __mutator__
@@ -72,7 +72,10 @@ def fuzz(buf, add_buf, max_size):
if via_buffer:
try:
__mutator__.init_from_string(buf_str)
- log("fuzz(): Mutator successfully initialized with AFL buffer (%d bytes)" % len(buf_str))
+ log(
+ "fuzz(): Mutator successfully initialized with AFL buffer (%d bytes)"
+ % len(buf_str)
+ )
except Exception:
via_buffer = False
log("fuzz(): Can't initialize mutator with AFL buffer")
@@ -104,7 +107,7 @@ def fuzz(buf, add_buf, max_size):
# Main (for debug)
-if __name__ == '__main__':
+if __name__ == "__main__":
__log__ = True
__log_file__ = "/dev/stdout"
@@ -112,7 +115,9 @@ if __name__ == '__main__':
init(__seed__)
- in_1 = bytearray("<foo ddd='eeee'>ffff<a b='c' d='456' eee='ffffff'>zzzzzzzzzzzz</a><b yyy='YYY' zzz='ZZZ'></b></foo>")
+ in_1 = bytearray(
+ "<foo ddd='eeee'>ffff<a b='c' d='456' eee='ffffff'>zzzzzzzzzzzz</a><b yyy='YYY' zzz='ZZZ'></b></foo>"
+ )
in_2 = bytearray("<abc abc123='456' abcCBA='ppppppppppppppppppppppppppppp'/>")
out = fuzz(in_1, in_2)
print(out)
diff --git a/utils/defork/defork.c b/utils/defork/defork.c
index f50b9a4b..c9be3283 100644
--- a/utils/defork/defork.c
+++ b/utils/defork/defork.c
@@ -5,6 +5,7 @@
#include <stdbool.h>
#include "../../include/config.h"
+#include "../../include/types.h"
/* we want to fork once (for the afl++ forkserver),
then immediately return as child on subsequent forks. */
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-22 21:12:04 +0000