From 599f78a4bd9657f28a9ab0baeb9c001dbbba49a9 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Tue, 4 Feb 2020 20:14:36 +0100 Subject: afl-showmap -i with stdin --- src/afl-showmap.c | 41 +++++++++++++++++++++++++++++++++++------ 1 file changed, 35 insertions(+), 6 deletions(-) diff --git a/src/afl-showmap.c b/src/afl-showmap.c index 5061ca31..a0bcbb4c 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -67,7 +67,7 @@ s32 forksrv_pid, /* PID of the fork server */ s32 fsrv_ctl_fd, /* Fork server control pipe (write) */ fsrv_st_fd; /* Fork server status pipe (read) */ -s32 out_fd; /* Persistent fd for out_file */ +s32 out_fd; /* Persistent fd for stdin_file */ s32 dev_null_fd = -1; /* FD to /dev/null */ s32 out_fd = -1, out_dir_fd = -1, dev_urandom_fd = -1; @@ -77,6 +77,7 @@ u8 uses_asan; u8* trace_bits; /* SHM with instrumentation bitmap */ u8 *out_file, /* Trace output file */ + *stdin_file, /* stdin file */ *in_dir, /* input folder */ *doc_path, /* Path to docs */ *at_file; /* Substitution string for @@ */ @@ -158,6 +159,14 @@ static void classify_counts(u8* mem, const u8* map) { } +/* Get rid of temp files (atexit handler). */ + +static void at_exit_handler(void) { + + if (out_file) unlink(out_file); /* Ignore errors */ + +} + /* Write results. */ static u32 write_results_to_file(u8 *out_file) { @@ -265,12 +274,12 @@ static void write_to_testcase(void* mem, u32 len) { if (use_stdin) { - lseek(0, 0, SEEK_SET); + lseek(out_fd, 0, SEEK_SET); - ck_write(0, mem, len, out_file); + ck_write(out_fd, mem, len, out_file); - if (ftruncate(0, len)) PFATAL("ftruncate() failed"); - lseek(0, 0, SEEK_SET); + if (ftruncate(out_fd, len)) PFATAL("ftruncate() failed"); + lseek(out_fd, 0, SEEK_SET); } @@ -887,7 +896,7 @@ int main(int argc, char** argv) { if (!quiet_mode) { show_banner(); - ACTF("Executing '%s'...\n", target_path); + ACTF("Executing '%s'...", target_path); } @@ -932,6 +941,24 @@ int main(int argc, char** argv) { PFATAL("cannot create output directory %s", out_file); if (arg_offset) argv[arg_offset] = infile; + else { + + u8* use_dir = "."; + + if (access(use_dir, R_OK | W_OK | X_OK)) { + + use_dir = getenv("TMPDIR"); + if (!use_dir) use_dir = "/tmp"; + + } + + stdin_file = alloc_printf("%s/.afl-tmin-temp-%u", use_dir, getpid()); + unlink(stdin_file); + atexit(at_exit_handler); + out_fd = open(stdin_file, O_RDWR | O_CREAT | O_EXCL, 0600); + if (out_fd < 0) PFATAL("Unable to create '%s'", out_file); + + } init_forkserver(use_argv); @@ -950,6 +977,8 @@ int main(int argc, char** argv) { } } + + if (!quiet_mode) OKF("Processed %u input files.", total_execs); } else { -- cgit 1.4.1 From 1edc392194ee6fad60057dce4aa2c9b5e2099451 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Wed, 5 Feb 2020 17:33:02 +0100 Subject: afl-showmap fix --- afl-cmin | 2 +- libdislocator/libdislocator.so.c | 8 +++- llvm_mode/afl-clang-fast.c | 6 +-- src/afl-common.c | 28 ++++++----- src/afl-fuzz-stats.c | 18 +++---- src/afl-showmap.c | 100 +++++++++++++++++++++------------------ 6 files changed, 90 insertions(+), 72 deletions(-) diff --git a/afl-cmin b/afl-cmin index 182376c9..f15e3cb4 100755 --- a/afl-cmin +++ b/afl-cmin @@ -397,7 +397,7 @@ BEGIN { system( "AFL_CMIN_ALLOW_ANY=1 \""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"/"fn"\" -Z "extra_par" -- \""target_bin"\" "prog_args_string" <\""in_dir"/"fn"\"") } } else { - printf " Processing "in_count" files (forkserver mode)..." + printf " Processing "in_count" files (forkserver mode)...\n" system( "AFL_CMIN_ALLOW_ANY=1 \""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"\" -Z "extra_par" -i \""in_dir"\" -- \""target_bin"\" "prog_args_string" 10 * 1024) - WARNF("Some test cases are big (%s) - see %s/perf_tips.md.", - DMS(max_len), doc_path); + WARNF("Some test cases are big (%s) - see %s/perf_tips.md.", DMS(max_len), + doc_path); if (useless_at_start && !in_bitmap) WARNF(cLRD "Some test cases look useless. Consider using a smaller set."); diff --git a/src/afl-showmap.c b/src/afl-showmap.c index a0bcbb4c..9c146771 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -77,7 +77,7 @@ u8 uses_asan; u8* trace_bits; /* SHM with instrumentation bitmap */ u8 *out_file, /* Trace output file */ - *stdin_file, /* stdin file */ + *stdin_file, /* stdin file */ *in_dir, /* input folder */ *doc_path, /* Path to docs */ *at_file; /* Substitution string for @@ */ @@ -89,8 +89,7 @@ u32 exec_tmout; /* Exec timeout (ms) */ static u32 total, highest; /* tuple content information */ static u32 in_len, /* Input data length */ - arg_offset, - total_execs; /* Total number of execs */ + arg_offset, total_execs; /* Total number of execs */ u64 mem_limit = MEM_LIMIT; /* Memory limit (MB) */ @@ -169,7 +168,7 @@ static void at_exit_handler(void) { /* Write results. */ -static u32 write_results_to_file(u8 *out_file) { +static u32 write_results_to_file(u8* out_file) { s32 fd; u32 i, ret = 0; @@ -243,7 +242,7 @@ static u32 write_results_to_file(u8 *out_file) { static u32 write_results(void) { return write_results_to_file(out_file); - + } /* Write output file. */ @@ -272,16 +271,10 @@ static s32 write_to_file(u8* path, u8* mem, u32 len) { static void write_to_testcase(void* mem, u32 len) { - if (use_stdin) { - - lseek(out_fd, 0, SEEK_SET); - - ck_write(out_fd, mem, len, out_file); - - if (ftruncate(out_fd, len)) PFATAL("ftruncate() failed"); - lseek(out_fd, 0, SEEK_SET); - - } + lseek(out_fd, 0, SEEK_SET); + ck_write(out_fd, mem, len, out_file); + if (ftruncate(out_fd, len)) PFATAL("ftruncate() failed"); + lseek(out_fd, 0, SEEK_SET); } @@ -383,14 +376,15 @@ static u8 run_target_forkserver(char** argv, u8* mem, u32 len) { /* Read initial file. */ -u32 read_file(u8 *in_file) { +u32 read_file(u8* in_file) { struct stat st; s32 fd = open(in_file, O_RDONLY); if (fd < 0) WARNF("Unable to open '%s'", in_file); - if (fstat(fd, &st) || !st.st_size) WARNF("Zero-sized input file '%s'.", in_file); + if (fstat(fd, &st) || !st.st_size) + WARNF("Zero-sized input file '%s'.", in_file); in_len = st.st_size; in_data = ck_alloc_nozero(in_len); @@ -399,9 +393,10 @@ u32 read_file(u8 *in_file) { close(fd); - //OKF("Read %u byte%s from '%s'.", in_len, in_len == 1 ? "" : "s", in_file); + // OKF("Read %u byte%s from '%s'.", in_len, in_len == 1 ? "" : "s", in_file); return in_len; + } /* Execute target application. */ @@ -643,7 +638,8 @@ static void usage(u8* argv0) { "Other settings:\n\n" - " -i dir - process all files in this directory, -o must be a directory\n" + " -i dir - process all files in this directory, -o must be a " + "directory\n" " and each bitmap will be written there individually.\n" " -q - sink program's output and don't show messages\n" " -e - show edge coverage only, ignore hit counts\n" @@ -900,18 +896,17 @@ int main(int argc, char** argv) { } - if (in_dir) { - + if (in_dir) { + if (at_file) PFATAL("Options -A and -i are mutually exclusive"); at_file = "@@"; - + } - detect_file_args(argv + optind, at_file); - + detect_file_args(argv + optind, ""); + for (i = optind; i < argc; i++) - if (strcmp(argv[i], "@@") == 0) - arg_offset = i; + if (strcmp(argv[i], "@@") == 0) arg_offset = i; if (qemu_mode) { @@ -926,10 +921,10 @@ int main(int argc, char** argv) { if (in_dir) { - DIR *dir_in, *dir_out; + DIR * dir_in, *dir_out; struct dirent* dir_ent; - int done = 0; - u8 infile[4096], outfile[4096]; + int done = 0; + u8 infile[4096], outfile[4096]; dev_null_fd = open("/dev/null", O_RDWR); if (dev_null_fd < 0) PFATAL("Unable to open /dev/null"); @@ -940,44 +935,56 @@ int main(int argc, char** argv) { if (mkdir(out_file, 0700)) PFATAL("cannot create output directory %s", out_file); - if (arg_offset) argv[arg_offset] = infile; - else { - - u8* use_dir = "."; + u8* use_dir = "."; - if (access(use_dir, R_OK | W_OK | X_OK)) { + if (access(use_dir, R_OK | W_OK | X_OK)) { - use_dir = getenv("TMPDIR"); - if (!use_dir) use_dir = "/tmp"; + use_dir = getenv("TMPDIR"); + if (!use_dir) use_dir = "/tmp"; - } + } + + stdin_file = alloc_printf("%s/.afl-tmin-temp-%u", use_dir, getpid()); + unlink(stdin_file); + atexit(at_exit_handler); + out_fd = open(stdin_file, O_RDWR | O_CREAT | O_EXCL, 0600); + if (out_fd < 0) PFATAL("Unable to create '%s'", out_file); + + if (arg_offset) argv[arg_offset] = stdin_file; + + if (getenv("AFL_DEBUG")) { + + int i = optind; + SAYF(cMGN "[D]" cRST " %s:", target_path); + while (argv[i] != NULL) + SAYF(" \"%s\"", argv[i++]); + SAYF("\n"); + SAYF(cMGN "[D]" cRST " %d - %d = %d, %s\n", arg_offset, optind, + arg_offset - optind, infile); - stdin_file = alloc_printf("%s/.afl-tmin-temp-%u", use_dir, getpid()); - unlink(stdin_file); - atexit(at_exit_handler); - out_fd = open(stdin_file, O_RDWR | O_CREAT | O_EXCL, 0600); - if (out_fd < 0) PFATAL("Unable to create '%s'", out_file); - } init_forkserver(use_argv); while (done == 0 && (dir_ent = readdir(dir_in))) { - if (dir_ent->d_name[0] == '.') continue; // skip anything that starts with '.' - if (dir_ent->d_type != DT_REG) continue; // only regular files + if (dir_ent->d_name[0] == '.') + continue; // skip anything that starts with '.' + if (dir_ent->d_type != DT_REG) continue; // only regular files snprintf(infile, sizeof(infile), "%s/%s", in_dir, dir_ent->d_name); snprintf(outfile, sizeof(outfile), "%s/%s", out_file, dir_ent->d_name); if (read_file(infile)) { + run_target_forkserver(use_argv, in_data, in_len); ck_free(in_data); tcnt = write_results_to_file(outfile); + } } - + if (!quiet_mode) OKF("Processed %u input files.", total_execs); } else { @@ -998,3 +1005,4 @@ int main(int argc, char** argv) { exit(child_crashed * 2 + child_timed_out); } + -- cgit 1.4.1 From 4bcea7b31fcaa9265a1e3f05e5d67d30b32bb32c Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Wed, 5 Feb 2020 22:08:57 +0100 Subject: adapt to afl-cmin with forkserver_mode (and stdin) --- afl-cmin | 11 +++-------- test/test.sh | 4 ++-- 2 files changed, 5 insertions(+), 10 deletions(-) diff --git a/afl-cmin b/afl-cmin index f15e3cb4..0aa702ea 100755 --- a/afl-cmin +++ b/afl-cmin @@ -390,20 +390,15 @@ BEGIN { cur = 0; if (!stdin_file) { - while (cur < in_count) { - fn = infilesSmallToBig[cur] - ++cur; - printf "\r Processing file "cur"/"in_count - system( "AFL_CMIN_ALLOW_ANY=1 \""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"/"fn"\" -Z "extra_par" -- \""target_bin"\" "prog_args_string" <\""in_dir"/"fn"\"") - } + printf " Processing "in_count" files (forkserver mode)..." + system( "AFL_CMIN_ALLOW_ANY=1 \""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"\" -Z "extra_par" -i \""in_dir"\" -- \""target_bin"\" "prog_args_string) } else { - printf " Processing "in_count" files (forkserver mode)...\n" + printf " Processing "in_count" files (forkserver mode)..." system( "AFL_CMIN_ALLOW_ANY=1 \""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"\" -Z "extra_par" -i \""in_dir"\" -- \""target_bin"\" "prog_args_string" in/in2 mkdir -p in2 - ../afl-cmin -i in -o in2 -- ./test-instr.plain @@ >/dev/null + ../afl-cmin -i in -o in2 -- ./test-instr.plain >/dev/null CNT=`ls in2/ | wc -l` case "$CNT" in *1) $ECHO "$GREEN[+] afl-cmin correctly minimized the number of testcases" ;; @@ -256,7 +256,7 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && { test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" || { echo 000000000000000000000000 > in/in2 mkdir -p in2 - ../afl-cmin -i in -o in2 -- ./test-instr.plain @@ >/dev/null + ../afl-cmin -i in -o in2 -- ./test-instr.plain >/dev/null CNT=`ls in2/ | wc -l` case "$CNT" in *1) $ECHO "$GREEN[+] afl-cmin correctly minimized the number of testcases" ;; -- cgit 1.4.1 From 95558a29655e91b975e876ec9bccf79b77139d80 Mon Sep 17 00:00:00 2001 From: hexcoder Date: Wed, 5 Feb 2020 22:28:52 +0100 Subject: small typo fixes --- docs/ideas.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/ideas.md b/docs/ideas.md index 8ba59c17..92b3ce49 100644 --- a/docs/ideas.md +++ b/docs/ideas.md @@ -4,7 +4,7 @@ In the following, we describe a variety of ideas that could be implemented for f ## Flexible Grammar Mutator -Currently, AFL++'s mutation do not have deper knowledge about the fuzzed binary, apart from feedback, even though the developer may have insights about the target. A developer may chose to provide dictionaries and implement own mutations in python or c, but an easy mutator that behaves according to a given grammar, does not exist. +Currently, AFL++'s mutation do not have deeper knowledge about the fuzzed binary, apart from feedback, even though the developer may have insights about the target. A developer may chose to provide dictionaries and implement own mutations in python or c, but an easy mutator that behaves according to a given grammar, does not exist. ## LTO Based Non-Colliding Edge Coverage @@ -18,4 +18,4 @@ This is the case why, right now, we cannot switch to QEMU 4.2. Understanding the ## WASM Instrumentation Currently, AFL++ can be used for source code fuzzing and traditional binaries. -With the rise of WASM as compile target, however, a novel way of instrumentation needs to be implemented for binaries compiled to Webassembly. This can either be done by inserting instrumentation directly into the WASM AST, or by patching feeback into a WASM VMs of choice, similar to the current Unicorn instrumentation. +With the rise of WASM as compile target, however, a novel way of instrumentation needs to be implemented for binaries compiled to Webassembly. This can either be done by inserting instrumentation directly into the WASM AST, or by patching feedback into a WASM VMs of choice, similar to the current Unicorn instrumentation. -- cgit 1.4.1 From ff210e824b4e3b1fe60f9a0500b48732937786d2 Mon Sep 17 00:00:00 2001 From: hexcoder Date: Wed, 5 Feb 2020 22:31:40 +0100 Subject: typos --- docs/ideas.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/ideas.md b/docs/ideas.md index 92b3ce49..10d97ca0 100644 --- a/docs/ideas.md +++ b/docs/ideas.md @@ -4,16 +4,16 @@ In the following, we describe a variety of ideas that could be implemented for f ## Flexible Grammar Mutator -Currently, AFL++'s mutation do not have deeper knowledge about the fuzzed binary, apart from feedback, even though the developer may have insights about the target. A developer may chose to provide dictionaries and implement own mutations in python or c, but an easy mutator that behaves according to a given grammar, does not exist. +Currently, AFL++'s mutation does not have deeper knowledge about the fuzzed binary, apart from feedback, even though the developer may have insights about the target. A developer may choose to provide dictionaries and implement own mutations in python or c, but an easy mutator that behaves according to a given grammar, does not exist. ## LTO Based Non-Colliding Edge Coverage -An unsolved problem in fuzzing, right now, are hash collisions between paths. By iterating through all functions at link time, assigning unique values to each branch, therefore reducing or even eliminating collisions, should be possible. +An unsolved problem in our fuzzing, right now, are hash collisions between paths. By iterating through all functions at link time, assigning unique values to each branch, therefore reducing or even eliminating collisions, should be possible. ## QEMU 4-based Instrumentation First tests to use QEMU 4 for binary-only AFL++ showed that caching behavior changed, which vastly decreases fuzzing speeds. -This is the case why, right now, we cannot switch to QEMU 4.2. Understanding the current instumentation and fixing the current caching issues will be needed. +This is the cause why, right now, we cannot switch to QEMU 4.2. Understanding the current instrumentation and fixing the current caching issues will be needed. ## WASM Instrumentation -- cgit 1.4.1 From b2191985765e58db4a3b7a2eb1e25f063733839a Mon Sep 17 00:00:00 2001 From: van Hauser Date: Thu, 6 Feb 2020 15:50:01 +0100 Subject: made cmin testcase more complex and added cmin.bash --- test/test.sh | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/test/test.sh b/test/test.sh index a2f2ab53..57b50eb4 100755 --- a/test/test.sh +++ b/test/test.sh @@ -149,12 +149,22 @@ test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" && { CODE=1 } echo 000000000000000000000000 > in/in2 + echo 111 > in/in3 mkdir -p in2 - ../afl-cmin -i in -o in2 -- ./test-instr.plain >/dev/null - CNT=`ls in2/ | wc -l` + ../afl-cmin -i in -o in2 -- ./test-instr.plain >/dev/null 2>&1 # why is afl-forkserver writing to stderr? + CNT=`ls in2/* 2>/dev/null | wc -l` case "$CNT" in - *1) $ECHO "$GREEN[+] afl-cmin correctly minimized the number of testcases" ;; - *) $ECHO "$RED[!] afl-cmin did not correctly minimize the number of testcases" + *2) $ECHO "$GREEN[+] afl-cmin correctly minimized the number of testcases" ;; + *) $ECHO "$RED[!] afl-cmin did not correctly minimize the number of testcases ($CNT)" + CODE=1 + ;; + esac + rm -f in2/in* + AFL_PATH=`pwd`/.. ../afl-cmin.bash -i in -o in2 -- ./test-instr.plain >/dev/null + CNT=`ls in2/* 2>/dev/null | wc -l` + case "$CNT" in + *2) $ECHO "$GREEN[+] afl-cmin.bash correctly minimized the number of testcases" ;; + *) $ECHO "$RED[!] afl-cmin.bash did not correctly minimize the number of testcases ($CNT)" CODE=1 ;; esac -- cgit 1.4.1 From 1ece4bb7dfc617dd03a9d416108aade97579a3c1 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Thu, 6 Feb 2020 17:12:59 +0100 Subject: unicorn readme enhancements --- unicorn_mode/README.md | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/unicorn_mode/README.md b/unicorn_mode/README.md index 07dca451..86683839 100644 --- a/unicorn_mode/README.md +++ b/unicorn_mode/README.md @@ -28,8 +28,10 @@ First, make afl++ as usual. Once that completes successfully you need to build and add in the Unicorn Mode features: - $ cd unicorn_mode - $ ./build_unicorn_support.sh +``` +$ cd unicorn_mode +$ ./build_unicorn_support.sh +``` NOTE: This script checks out a Unicorn Engine fork as submodule that has been tested and is stable-ish, based on the unicorn engine master. @@ -68,7 +70,9 @@ To really use unicorn-mode effectively you need to prepare the following: Once you have all those things ready to go you just need to run afl-fuzz in 'unicorn-mode' by passing in the '-U' flag: - $ afl-fuzz -U -m none -i /path/to/inputs -o /path/to/results -- ./test_harness @@ +``` +$ afl-fuzz -U -m none -i /path/to/inputs -o /path/to/results -- ./test_harness @@ +``` The normal afl-fuzz command line format applies to everything here. Refer to AFL's main documentation for more info about how to use afl-fuzz effectively. @@ -77,14 +81,14 @@ For a much clearer vision of what all of this looks like, please refer to the sample provided in the 'unicorn_mode/samples' directory. There is also a blog post that goes over the basics at: -https://medium.com/@njvoss299/afl-unicorn-fuzzing-arbitrary-binary-code-563ca28936bf +[https://medium.com/@njvoss299/afl-unicorn-fuzzing-arbitrary-binary-code-563ca28936bf](https://medium.com/@njvoss299/afl-unicorn-fuzzing-arbitrary-binary-code-563ca28936bf) The 'helper_scripts' directory also contains several helper scripts that allow you to dump context from a running process, load it, and hook heap allocations. For details on how to use this check out the follow-up blog post to the one linked above. A example use of AFL-Unicorn mode is discussed in the paper Unicorefuzz: -https://www.usenix.org/conference/woot19/presentation/maier +[https://www.usenix.org/conference/woot19/presentation/maier](https://www.usenix.org/conference/woot19/presentation/maier) ## 3) Options @@ -92,10 +96,11 @@ As for the QEMU-based instrumentation, the afl-unicorn twist of afl++ comes with a sub-instruction based instrumentation similar in purpose to laf-intel. The options that enable Unicorn CompareCoverage are the same used for QEMU. -AFL_COMPCOV_LEVEL=1 is to instrument comparisons with only immediate -values. AFL_COMPCOV_LEVEL=2 instruments all -comparison instructions. Comparison instructions are currently instrumented only -for the x86, x86_64 and ARM targets. +AFL_COMPCOV_LEVEL=1 is to instrument comparisons with only immediate values. + +AFL_COMPCOV_LEVEL=2 instruments all comparison instructions. + +Comparison instructions are currently instrumented only for the x86, x86_64 and ARM targets. ## 4) Gotchas, feedback, bugs @@ -114,6 +119,6 @@ unicornafl.monkeypatch() This will replace all unicorn imports with unicornafl inputs. -Refer to the unicorn_mode/samples/arm_example/arm_tester.c for an example +Refer to the [samples/arm_example/arm_tester.c](samples/arm_example/arm_tester.c) for an example of how to do this properly! If you don't get this right, AFL will not load any mutated inputs and your fuzzing will be useless! -- cgit 1.4.1 From 2c7fba0a9c5ffdf9a040be0f8441d9fef77aa0c7 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Thu, 6 Feb 2020 19:37:23 +0000 Subject: unicorn mode build fix for FreeBSD. --- unicorn_mode/build_unicorn_support.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/unicorn_mode/build_unicorn_support.sh b/unicorn_mode/build_unicorn_support.sh index 582e0669..a04cca6b 100755 --- a/unicorn_mode/build_unicorn_support.sh +++ b/unicorn_mode/build_unicorn_support.sh @@ -81,6 +81,7 @@ if [ "$PLT" = "FreeBSD" ]; then MAKECMD=gmake CORES=`sysctl -n hw.ncpu` TARCMD=gtar + PYTHONBIN=python3 fi if [ "$PLT" = "NetBSD" ] || [ "$PLT" = "OpenBSD" ]; then -- cgit 1.4.1 From e5972efa41c6371a6d1fed14492418ad0a756eae Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Thu, 6 Feb 2020 21:43:50 +0100 Subject: cmplog for qemu mode --- qemu_mode/patches/afl-qemu-common.h | 6 ++ qemu_mode/patches/afl-qemu-cpu-inl.h | 22 +++++- qemu_mode/patches/afl-qemu-cpu-translate-inl.h | 96 ++++++++++++++++++++++---- src/afl-fuzz-cmplog.c | 12 ++-- 4 files changed, 117 insertions(+), 19 deletions(-) diff --git a/qemu_mode/patches/afl-qemu-common.h b/qemu_mode/patches/afl-qemu-common.h index 4d651385..18c36f73 100644 --- a/qemu_mode/patches/afl-qemu-common.h +++ b/qemu_mode/patches/afl-qemu-common.h @@ -35,6 +35,9 @@ #define __AFL_QEMU_COMMON #include "../../config.h" +#include "../../include/cmplog.h" + +#define PERSISTENT_DEFAULT_MAX_CNT 1000 #ifndef CPU_NB_REGS #define AFL_REGS_NUM 1000 @@ -74,6 +77,9 @@ extern int persisent_retaddr_offset; extern __thread abi_ulong afl_prev_loc; +extern struct cmp_map* __afl_cmp_map; +extern __thread u32 __afl_cmp_counter; + void afl_debug_dump_saved_regs(); void afl_persistent_loop(); diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h index ac847371..0ae6364b 100644 --- a/qemu_mode/patches/afl-qemu-cpu-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-inl.h @@ -32,11 +32,8 @@ */ #include -#include "../../config.h" #include "afl-qemu-common.h" -#define PERSISTENT_DEFAULT_MAX_CNT 1000 - /*************************** * VARIOUS AUXILIARY STUFF * ***************************/ @@ -81,6 +78,9 @@ u8 afl_compcov_level; __thread abi_ulong afl_prev_loc; +struct cmp_map* __afl_cmp_map; +__thread u32 __afl_cmp_counter; + /* Set in the child process in forkserver mode: */ static int forkserver_installed = 0; @@ -181,6 +181,22 @@ static void afl_setup(void) { if (inst_r) afl_area_ptr[0] = 1; } + + if (getenv("___AFL_EINS_ZWEI_POLIZEI___")) { // CmpLog forkserver + + id_str = getenv(CMPLOG_SHM_ENV_VAR); + + if (id_str) { + + u32 shm_id = atoi(id_str); + + __afl_cmp_map = shmat(shm_id, NULL, 0); + + if (__afl_cmp_map == (void*)-1) _exit(1); + + } + + } if (getenv("AFL_INST_LIBS")) { diff --git a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h index 6d42bf3d..9f032feb 100644 --- a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h @@ -102,31 +102,103 @@ static void afl_compcov_log_64(target_ulong cur_loc, target_ulong arg1, } +static void afl_cmplog_16(target_ulong cur_loc, target_ulong arg1, + target_ulong arg2) { + + register uintptr_t k = (uintptr_t)cur_loc; + + u32 hits = __afl_cmp_map->headers[k].hits; + __afl_cmp_map->headers[k].hits = hits + 1; + // if (!__afl_cmp_map->headers[k].cnt) + // __afl_cmp_map->headers[k].cnt = __afl_cmp_counter++; + + __afl_cmp_map->headers[k].shape = 1; + //__afl_cmp_map->headers[k].type = CMP_TYPE_INS; + + hits &= CMP_MAP_H - 1; + __afl_cmp_map->log[k][hits].v0 = arg1; + __afl_cmp_map->log[k][hits].v1 = arg2; + +} + +static void afl_cmplog_32(target_ulong cur_loc, target_ulong arg1, + target_ulong arg2) { + + register uintptr_t k = (uintptr_t)cur_loc; + + u32 hits = __afl_cmp_map->headers[k].hits; + __afl_cmp_map->headers[k].hits = hits + 1; + + __afl_cmp_map->headers[k].shape = 3; + + hits &= CMP_MAP_H - 1; + __afl_cmp_map->log[k][hits].v0 = arg1; + __afl_cmp_map->log[k][hits].v1 = arg2; + +} + +static void afl_cmplog_64(target_ulong cur_loc, target_ulong arg1, + target_ulong arg2) { + + register uintptr_t k = (uintptr_t)cur_loc; + + u32 hits = __afl_cmp_map->headers[k].hits; + __afl_cmp_map->headers[k].hits = hits + 1; + + __afl_cmp_map->headers[k].shape = 7; + + hits &= CMP_MAP_H - 1; + __afl_cmp_map->log[k][hits].v0 = arg1; + __afl_cmp_map->log[k][hits].v1 = arg2; + +} + + static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2, TCGMemOp ot, int is_imm) { void *func; - if (!afl_compcov_level || cur_loc > afl_end_code || cur_loc < afl_start_code) + if (cur_loc > afl_end_code || cur_loc < afl_start_code) return; - if (!is_imm && afl_compcov_level < 2) return; + if (__afl_cmp_map) { + + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= CMP_MAP_W - 1; - switch (ot) { + switch (ot) { - case MO_64: func = &afl_compcov_log_64; break; - case MO_32: func = &afl_compcov_log_32; break; - case MO_16: func = &afl_compcov_log_16; break; - default: return; + case MO_64: func = &afl_cmplog_64; break; + case MO_32: func = &afl_cmplog_32; break; + case MO_16: func = &afl_cmplog_16; break; + default: return; - } + } + + tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2); + + } else if (afl_compcov_level) { + + if (!is_imm && afl_compcov_level < 2) return; + + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 7; - cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); - cur_loc &= MAP_SIZE - 7; + if (cur_loc >= afl_inst_rms) return; + + switch (ot) { - if (cur_loc >= afl_inst_rms) return; + case MO_64: func = &afl_compcov_log_64; break; + case MO_32: func = &afl_compcov_log_32; break; + case MO_16: func = &afl_compcov_log_16; break; + default: return; - tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2); + } + + tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2); + + } } diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c index 92bac4ab..69efcffa 100644 --- a/src/afl-fuzz-cmplog.c +++ b/src/afl-fuzz-cmplog.c @@ -150,8 +150,10 @@ void init_cmplog_forkserver(char** argv) { "msan_track_origins=0", 0); - argv[0] = cmplog_binary; - execv(cmplog_binary, argv); + setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1); + + if (!qemu_mode) argv[0] = cmplog_binary; + execv(argv[0], argv); /* Use a distinctive bitmap signature to tell the parent about execv() falling through. */ @@ -440,9 +442,11 @@ u8 run_cmplog_target(char** argv, u32 timeout) { setenv("MSAN_OPTIONS", "exit_code=" STRINGIFY(MSAN_ERROR) ":" "symbolize=0:" "msan_track_origins=0", 0); + + setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1); - argv[0] = cmplog_binary; - execv(cmplog_binary, argv); + if (!qemu_mode) argv[0] = cmplog_binary; + execv(argv[0], argv); /* Use a distinctive bitmap value to tell the parent about execv() falling through. */ -- cgit 1.4.1 From 0d8f70423ac97c521d6c2c070d65e802825b8679 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Thu, 6 Feb 2020 22:35:14 +0100 Subject: save input with high entropy after colorization --- src/afl-fuzz-redqueen.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c index c21c973f..6fb1964f 100644 --- a/src/afl-fuzz-redqueen.c +++ b/src/afl-fuzz-redqueen.c @@ -108,6 +108,8 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) { struct range* ranges = add_range(NULL, 0, len); u8* backup = ck_alloc_nozero(len); + u8 needs_write = 0; + u64 orig_hit_cnt, new_hit_cnt; orig_hit_cnt = queued_paths + unique_crashes; @@ -132,7 +134,7 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) { ranges = add_range(ranges, rng->start + s / 2 + 1, rng->end); memcpy(buf + rng->start, backup, s); - } + } else needs_write = 1; ck_free(rng); --stage_cur; @@ -150,6 +152,32 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) { ck_free(rng); } + + // save the input with the high entropy + + if (needs_write) { + + s32 fd; + + if (no_unlink) { + + fd = open(queue_cur->fname, O_WRONLY | O_CREAT | O_TRUNC, 0600); + + } else { + + unlink(queue_cur->fname); /* ignore errors */ + fd = open(queue_cur->fname, O_WRONLY | O_CREAT | O_EXCL, 0600); + + } + + if (fd < 0) PFATAL("Unable to create '%s'", queue_cur->fname); + + ck_write(fd, buf, len, queue_cur->fname); + queue_cur->len = len; // no-op, just to be 100% safe + + close(fd); + + } return 0; @@ -362,7 +390,7 @@ u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len, } - memcpy(buf, orig_buf, len); + memcpy(orig_buf, buf, len); new_hit_cnt = queued_paths + unique_crashes; stage_finds[STAGE_ITS] += new_hit_cnt - orig_hit_cnt; -- cgit 1.4.1 From 369b6d2f670a7cb8a268855810006d92590b1528 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Fri, 7 Feb 2020 09:52:30 +0100 Subject: docker fix --- Dockerfile | 2 +- TODO | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 7bb60610..396954ab 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ FROM ubuntu:eoan MAINTAINER David Carlier LABEL "about"="AFLplusplus docker image" -RUN apt-get update && apt-get install -y \ +RUN apt-get update && apt-get -y install \ --no-install-suggests --no-install-recommends \ automake \ bison \ diff --git a/TODO b/TODO index e935eafa..d153f1b4 100644 --- a/TODO +++ b/TODO @@ -7,6 +7,7 @@ Makefile: afl-fuzz: - sync_fuzzers(): only masters sync from all, slaves only sync from master + - ascii_only mode gcc_plugin: - laf-intel -- cgit 1.4.1 From 7734a9229e5470a2c1c2f67702d4c299cd7a6264 Mon Sep 17 00:00:00 2001 From: hexcoder Date: Fri, 7 Feb 2020 13:04:49 +0100 Subject: track afl-cmin test changes --- test/test.sh | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/test/test.sh b/test/test.sh index 57b50eb4..1709468e 100755 --- a/test/test.sh +++ b/test/test.sh @@ -265,12 +265,22 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && { } test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" || { echo 000000000000000000000000 > in/in2 + echo 111 > in/in3 mkdir -p in2 - ../afl-cmin -i in -o in2 -- ./test-instr.plain >/dev/null - CNT=`ls in2/ | wc -l` + ../afl-cmin -i in -o in2 -- ./test-instr.plain >/dev/null 2>&1 # why is afl-forkserver writing to stderr? + CNT=`ls in2/* 2>/dev/null | wc -l` case "$CNT" in - *1) $ECHO "$GREEN[+] afl-cmin correctly minimized the number of testcases" ;; - *) $ECHO "$RED[!] afl-cmin did not correctly minimize the number of testcases" + *2) $ECHO "$GREEN[+] afl-cmin correctly minimized the number of testcases" ;; + *) $ECHO "$RED[!] afl-cmin did not correctly minimize the number of testcases ($CNT)" + CODE=1 + ;; + esac + rm -f in2/in* + AFL_PATH=`pwd`/.. ../afl-cmin.bash -i in -o in2 -- ./test-instr.plain >/dev/null + CNT=`ls in2/* 2>/dev/null | wc -l` + case "$CNT" in + *2) $ECHO "$GREEN[+] afl-cmin.bash correctly minimized the number of testcases" ;; + *) $ECHO "$RED[!] afl-cmin.bash did not correctly minimize the number of testcases ($CNT)" CODE=1 ;; esac -- cgit 1.4.1 From ea37d8cef9648dfbe317517959be3d4eb9cb6cc7 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Fri, 7 Feb 2020 16:04:43 +0100 Subject: redqueen auto extras --- src/afl-fuzz-redqueen.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c index 6fb1964f..d46d2b19 100644 --- a/src/afl-fuzz-redqueen.c +++ b/src/afl-fuzz-redqueen.c @@ -298,6 +298,44 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx, } +void try_to_add_to_dict(u64 v, u8 shape) { + + u8* b = (u8*)&v; + + u32 k; + u8 cons_ff = 0, cons_0 = 0; + for (k = 0; k < shape; ++k) { + + if (b[k] == 0) ++cons_0; + else if (b[k] == 0xff) ++cons_0; + else cons_0 = cons_ff = 0; + + if (cons_0 > 1 || cons_ff > 1) + return; + + } + + maybe_add_auto((u8*)&v, shape); + + u64 rev; + switch (shape) { + case 1: break; + case 2: + rev = SWAP16((u16)v); + maybe_add_auto((u8*)&rev, shape); + break; + case 4: + rev = SWAP32((u32)v); + maybe_add_auto((u8*)&rev, shape); + break; + case 8: + rev = SWAP64(v); + maybe_add_auto((u8*)&rev, shape); + break; + } + +} + u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) { struct cmp_header* h = &cmp_map->headers[key]; @@ -338,6 +376,14 @@ u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) { break; } + + // If failed, add to dictionary + if (fails == 8) { + + try_to_add_to_dict(o->v0, SHAPE_BYTES(h->shape)); + try_to_add_to_dict(o->v1, SHAPE_BYTES(h->shape)); + + } cmp_fuzz_next_iter: stage_cur++; -- cgit 1.4.1 From 1e10e452aaa366c3d06e7eda9f56f127fbf25319 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Fri, 7 Feb 2020 17:00:11 +0100 Subject: fix empty range bug in colorization --- Makefile | 2 +- qemu_mode/patches/afl-qemu-cpu-inl.h | 4 +++- src/afl-fuzz-redqueen.c | 4 ++++ 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 13be4ec9..70eac6b9 100644 --- a/Makefile +++ b/Makefile @@ -57,7 +57,7 @@ ifneq "$(shell uname -m)" "x86_64" endif CFLAGS ?= -O3 -funroll-loops $(CFLAGS_OPT) -CFLAGS += -Wall -g -Wno-pointer-sign -I include/ \ +override CFLAGS += -Wall -g -Wno-pointer-sign -I include/ \ -DAFL_PATH=\"$(HELPER_PATH)\" -DBIN_PATH=\"$(BIN_PATH)\" \ -DDOC_PATH=\"$(DOC_PATH)\" -Wno-unused-function diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h index 0ae6364b..9a98fde3 100644 --- a/qemu_mode/patches/afl-qemu-cpu-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-inl.h @@ -368,8 +368,10 @@ static void afl_forkserver(CPUState *cpu) { if (WIFSTOPPED(status)) child_stopped = 1; - else if (unlikely(first_run && is_persistent)) + else if (unlikely(first_run && is_persistent)) { + fprintf(stderr, "[AFL] ERROR: no persistent iteration executed\n"); exit(12); // Persistent is wrong + } first_run = 0; if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(7); diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c index d46d2b19..bac7357e 100644 --- a/src/afl-fuzz-redqueen.c +++ b/src/afl-fuzz-redqueen.c @@ -122,6 +122,9 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) { while ((rng = pop_biggest_range(&ranges)) != NULL && stage_cur) { u32 s = rng->end - rng->start; + if (s == 0) + goto empty_range; + memcpy(backup, buf + rng->start, s); rand_replace(buf + rng->start, s); @@ -136,6 +139,7 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) { } else needs_write = 1; +empty_range: ck_free(rng); --stage_cur; -- cgit 1.4.1 From e360726730aa9e4e54548f20f76da7de368fa35f Mon Sep 17 00:00:00 2001 From: van Hauser Date: Fri, 7 Feb 2020 19:41:48 +0100 Subject: todo update --- TODO | 3 +++ src/afl-fuzz.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/TODO b/TODO index d153f1b4..b9c209f8 100644 --- a/TODO +++ b/TODO @@ -18,6 +18,9 @@ qemu_mode: - instrim for QEMU mode via static analysis (with r2pipe? or angr?) Idea: The static analyzer outputs a map in which each edge that must be skipped is marked with 1. QEMU loads it at startup in the parent process. + - rename qemu specific envs to AFL_QEMU (espec. AFL_ENTRYPOINT) + - add AFL_QEMU_EXITPOINT (maybe multiple?) + - add/implement AFL_QEMU_INST_LIBLIST and AFL_QEMU_NOINST_PROGRAM custom_mutators: - rip what Superion is doing into custom mutators for js, php, etc. diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 8833244d..63d2b997 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -100,7 +100,7 @@ static void usage(u8* argv0) { " -f file - location read by the fuzzed program (stdin)\n" " -t msec - timeout for each run (auto-scaled, 50-%d ms)\n" " -m megs - memory limit for child process (%d MB)\n" - " -c program - enable CmpLog specifying a binary compiled for it\n" + " -c program - enable CmpLog by specifying a binary compiled for it\n" " -Q - use binary-only instrumentation (QEMU mode)\n" " -U - use unicorn-based instrumentation (Unicorn mode)\n" " -W - use qemu-based instrumentation with Wine (Wine " -- cgit 1.4.1 From f2f6be5e999632b05ce92b4934ee97531d546a44 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Fri, 7 Feb 2020 20:43:17 +0100 Subject: afl qemu persistent hook --- examples/qemu_persistent_hook/README.md | 20 +++++ examples/qemu_persistent_hook/read_into_rdi.c | 42 ++++++++++ examples/qemu_persistent_hook/test.c | 34 ++++++++ include/afl-fuzz.h | 2 +- qemu_mode/build_qemu_support.sh | 10 ++- qemu_mode/patches/afl-qemu-common.h | 6 +- qemu_mode/patches/afl-qemu-cpu-inl.h | 35 +++++++- qemu_mode/patches/afl-qemu-cpu-translate-inl.h | 112 ++++++++++++++----------- qemu_mode/patches/configure.diff | 26 ++++++ src/afl-fuzz-cmplog.c | 2 +- src/afl-fuzz-globals.c | 2 +- src/afl-fuzz-init.c | 2 + src/afl-fuzz.c | 2 + 13 files changed, 235 insertions(+), 60 deletions(-) create mode 100644 examples/qemu_persistent_hook/README.md create mode 100644 examples/qemu_persistent_hook/read_into_rdi.c create mode 100644 examples/qemu_persistent_hook/test.c create mode 100644 qemu_mode/patches/configure.diff diff --git a/examples/qemu_persistent_hook/README.md b/examples/qemu_persistent_hook/README.md new file mode 100644 index 00000000..3278b60c --- /dev/null +++ b/examples/qemu_persistent_hook/README.md @@ -0,0 +1,20 @@ +# QEMU persistent hook example + +Compile the test binary and the library: + +``` +gcc -no-pie test.c -o test +gcc -fPIC -shared read_into_rdi.c -o read_into_rdi.so +``` + +Fuzz with: + +``` +export AFL_QEMU_PERSISTENT_ADDR=0x$(nm test | grep "T target_func" | awk '{print $1}') +export AFL_QEMU_PERSISTENT_HOOK=./read_into_rdi.so + +mkdir in +echo 0000 > in/in + +../../afl-fuzz -Q -i in -o out -- ./test +``` diff --git a/examples/qemu_persistent_hook/read_into_rdi.c b/examples/qemu_persistent_hook/read_into_rdi.c new file mode 100644 index 00000000..4c5119e0 --- /dev/null +++ b/examples/qemu_persistent_hook/read_into_rdi.c @@ -0,0 +1,42 @@ +#include +#include +#include + +#define g2h(x) ((void *)((unsigned long)(x) + guest_base)) +#define h2g(x) ((uint64_t)(x) - guest_base) + +enum { + R_EAX = 0, + R_ECX = 1, + R_EDX = 2, + R_EBX = 3, + R_ESP = 4, + R_EBP = 5, + R_ESI = 6, + R_EDI = 7, + R_R8 = 8, + R_R9 = 9, + R_R10 = 10, + R_R11 = 11, + R_R12 = 12, + R_R13 = 13, + R_R14 = 14, + R_R15 = 15, + + R_AL = 0, + R_CL = 1, + R_DL = 2, + R_BL = 3, + R_AH = 4, + R_CH = 5, + R_DH = 6, + R_BH = 7, +}; + +void afl_persistent_hook(uint64_t* regs, uint64_t guest_base) { + + printf("reading into %p\n", regs[R_EDI]); + size_t r = read(0, g2h(regs[R_EDI]), 1024); + printf("readed %ld bytes\n", r); + +} diff --git a/examples/qemu_persistent_hook/test.c b/examples/qemu_persistent_hook/test.c new file mode 100644 index 00000000..079d2be4 --- /dev/null +++ b/examples/qemu_persistent_hook/test.c @@ -0,0 +1,34 @@ +#include + +int target_func(char *buf, int size) { + + printf("buffer:%p, size:%p\n", buf, size); + switch (buf[0]) { + + case 1: + if (buf[1] == '\x44') { + puts("a"); + } + break; + case 0xff: + if (buf[2] == '\xff') { + if (buf[1] == '\x44') { + puts("b"); + } + } + break; + default: break; + + } + + return 1; + +} + +char data[1024]; + +int main() { + + target_func(data, 1024); + +} diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index 751bd93c..c62fcc84 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -455,7 +455,7 @@ u8* (*post_handler)(u8* buf, u32* len); /* CmpLog */ extern u8* cmplog_binary; -extern s32 cmplog_forksrv_pid; +extern s32 cmplog_child_pid, cmplog_forksrv_pid; /* hooks for the custom mutator function */ /** diff --git a/qemu_mode/build_qemu_support.sh b/qemu_mode/build_qemu_support.sh index 6f2bc448..0413228c 100755 --- a/qemu_mode/build_qemu_support.sh +++ b/qemu_mode/build_qemu_support.sh @@ -156,16 +156,18 @@ patch -p1 <../patches/arm-translate.diff || exit 1 patch -p1 <../patches/i386-ops_sse.diff || exit 1 patch -p1 <../patches/i386-fpu_helper.diff || exit 1 patch -p1 <../patches/softfloat.diff || exit 1 +patch -p1 <../patches/configure.diff || exit 1 echo "[+] Patching done." if [ "$STATIC" = "1" ]; then - CFLAGS="-O3 -ggdb" ./configure --disable-bsd-user --disable-guest-agent --disable-strip --disable-werror \ + ./configure --extra-cflags="-O3 -ggdb -DAFL_QEMU_STATIC_BUILD=1" \ + --disable-bsd-user --disable-guest-agent --disable-strip --disable-werror \ --disable-gcrypt --disable-debug-info --disable-debug-tcg --disable-tcg-interpreter \ --enable-attr --disable-brlapi --disable-linux-aio --disable-bzip2 --disable-bluez --disable-cap-ng \ --disable-curl --disable-fdt --disable-glusterfs --disable-gnutls --disable-nettle --disable-gtk \ - --disable-rdma --disable-libiscsi --disable-vnc-jpeg --enable-kvm --disable-lzo --disable-curses \ + --disable-rdma --disable-libiscsi --disable-vnc-jpeg --disable-lzo --disable-curses \ --disable-libnfs --disable-numa --disable-opengl --disable-vnc-png --disable-rbd --disable-vnc-sasl \ --disable-sdl --disable-seccomp --disable-smartcard --disable-snappy --disable-spice --disable-libssh2 \ --disable-libusb --disable-usb-redir --disable-vde --disable-vhost-net --disable-virglrenderer \ @@ -178,9 +180,9 @@ else # --enable-pie seems to give a couple of exec's a second performance # improvement, much to my surprise. Not sure how universal this is.. - CFLAGS="-O3 -ggdb" ./configure --disable-system \ + ./configure --disable-system \ --enable-linux-user --disable-gtk --disable-sdl --disable-vnc \ - --target-list="${CPU_TARGET}-linux-user" --enable-pie --enable-kvm $CROSS_PREFIX || exit 1 + --target-list="${CPU_TARGET}-linux-user" --enable-pie $CROSS_PREFIX || exit 1 fi diff --git a/qemu_mode/patches/afl-qemu-common.h b/qemu_mode/patches/afl-qemu-common.h index 18c36f73..de6c7b73 100644 --- a/qemu_mode/patches/afl-qemu-common.h +++ b/qemu_mode/patches/afl-qemu-common.h @@ -59,6 +59,8 @@ #define INC_AFL_AREA(loc) afl_area_ptr[loc]++ #endif +typedef void (*afl_persistent_hook_fn)(uint64_t* regs, uint64_t guest_base); + /* Declared in afl-qemu-cpu-inl.h */ extern unsigned char *afl_area_ptr; @@ -72,9 +74,11 @@ extern unsigned char is_persistent; extern target_long persistent_stack_offset; extern unsigned char persistent_first_pass; extern unsigned char persistent_save_gpr; -extern target_ulong persistent_saved_gpr[AFL_REGS_NUM]; +extern uint64_t persistent_saved_gpr[AFL_REGS_NUM]; extern int persisent_retaddr_offset; +extern afl_persistent_hook_fn afl_persistent_hook_ptr; + extern __thread abi_ulong afl_prev_loc; extern struct cmp_map* __afl_cmp_map; diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h index 9a98fde3..7ef54d78 100644 --- a/qemu_mode/patches/afl-qemu-cpu-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-inl.h @@ -34,6 +34,10 @@ #include #include "afl-qemu-common.h" +#ifndef AFL_QEMU_STATIC_BUILD +#include +#endif + /*************************** * VARIOUS AUXILIARY STUFF * ***************************/ @@ -95,6 +99,8 @@ unsigned char persistent_save_gpr; target_ulong persistent_saved_gpr[AFL_REGS_NUM]; int persisent_retaddr_offset; +afl_persistent_hook_fn afl_persistent_hook_ptr; + /* Instrumentation ratio: */ unsigned int afl_inst_rms = MAP_SIZE; /* Exported for afl_gen_trace */ @@ -192,7 +198,7 @@ static void afl_setup(void) { __afl_cmp_map = shmat(shm_id, NULL, 0); - if (__afl_cmp_map == (void*)-1) _exit(1); + if (__afl_cmp_map == (void*)-1) exit(1); } @@ -240,6 +246,33 @@ static void afl_setup(void) { if (getenv("AFL_QEMU_PERSISTENT_GPR")) persistent_save_gpr = 1; + if (getenv("AFL_QEMU_PERSISTENT_HOOK")) { + +#ifdef AFL_QEMU_STATIC_BUILD + + fprintf(stderr, "[AFL] ERROR: you cannot use AFL_QEMU_PERSISTENT_HOOK when afl-qemu-trace is static\n"); + exit(1); + +#else + + persistent_save_gpr = 1; + + void* plib = dlopen(getenv("AFL_QEMU_PERSISTENT_HOOK"), RTLD_NOW); + if (!plib) { + fprintf(stderr, "[AFL] ERROR: invalid AFL_QEMU_PERSISTENT_HOOK=%s\n", getenv("AFL_QEMU_PERSISTENT_HOOK")); + exit(1); + } + + afl_persistent_hook_ptr = dlsym(plib, "afl_persistent_hook"); + if (!afl_persistent_hook_ptr) { + fprintf(stderr, "[AFL] ERROR: failed to find the function \"afl_persistent_hook\" in %s\n", getenv("AFL_QEMU_PERSISTENT_HOOK")); + exit(1); + } + +#endif + + } + if (getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET")) persisent_retaddr_offset = strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 0); diff --git a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h index 9f032feb..d081060f 100644 --- a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h @@ -254,62 +254,71 @@ static void log_x86_sp_content(void) { }*/ -#define I386_RESTORE_STATE_FOR_PERSISTENT \ - do { \ - \ - if (persistent_save_gpr) { \ - \ - int i; \ - TCGv_ptr gpr_sv; \ - \ - TCGv_ptr first_pass_ptr = tcg_const_ptr(&persistent_first_pass); \ - TCGv first_pass = tcg_temp_local_new(); \ - TCGv one = tcg_const_tl(1); \ - tcg_gen_ld8u_tl(first_pass, first_pass_ptr, 0); \ - \ - TCGLabel *lbl_save_gpr = gen_new_label(); \ - TCGLabel *lbl_finish_restore_gpr = gen_new_label(); \ - tcg_gen_brcond_tl(TCG_COND_EQ, first_pass, one, lbl_save_gpr); \ - \ - for (i = 0; i < CPU_NB_REGS; ++i) { \ - \ - gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); \ - tcg_gen_ld_tl(cpu_regs[i], gpr_sv, 0); \ - \ - } \ - \ - tcg_gen_br(lbl_finish_restore_gpr); \ - \ - gen_set_label(lbl_save_gpr); \ - \ - for (i = 0; i < CPU_NB_REGS; ++i) { \ - \ - gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); \ - tcg_gen_st_tl(cpu_regs[i], gpr_sv, 0); \ - \ - } \ - \ - gen_set_label(lbl_finish_restore_gpr); \ - tcg_temp_free(first_pass); \ - \ - } else if (afl_persistent_ret_addr == 0) { \ - \ - TCGv_ptr stack_off_ptr = tcg_const_ptr(&persistent_stack_offset); \ - TCGv stack_off = tcg_temp_new(); \ - tcg_gen_ld_tl(stack_off, stack_off_ptr, 0); \ - tcg_gen_sub_tl(cpu_regs[R_ESP], cpu_regs[R_ESP], stack_off); \ - tcg_temp_free(stack_off); \ - \ - } \ - \ - } while (0) + +static void callback_to_persistent_hook(void) { + + afl_persistent_hook_ptr(persistent_saved_gpr, guest_base); + +} + +static void i386_restore_state_for_persistent(TCGv* cpu_regs) { + + if (persistent_save_gpr) { + + int i; + TCGv_ptr gpr_sv; + + TCGv_ptr first_pass_ptr = tcg_const_ptr(&persistent_first_pass); + TCGv first_pass = tcg_temp_local_new(); + TCGv one = tcg_const_tl(1); + tcg_gen_ld8u_tl(first_pass, first_pass_ptr, 0); + + TCGLabel *lbl_restore_gpr = gen_new_label(); + tcg_gen_brcond_tl(TCG_COND_NE, first_pass, one, lbl_restore_gpr); + + // save GRP registers + for (i = 0; i < CPU_NB_REGS; ++i) { + + gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); + tcg_gen_st_tl(cpu_regs[i], gpr_sv, 0); + + } + + gen_set_label(lbl_restore_gpr); + + tcg_gen_afl_call0(&afl_persistent_loop); + + if (afl_persistent_hook_ptr) + tcg_gen_afl_call0(callback_to_persistent_hook); + + // restore GRP registers + for (i = 0; i < CPU_NB_REGS; ++i) { + + gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); + tcg_gen_ld_tl(cpu_regs[i], gpr_sv, 0); + + } + + tcg_temp_free(first_pass); + + } else if (afl_persistent_ret_addr == 0) { + + TCGv_ptr stack_off_ptr = tcg_const_ptr(&persistent_stack_offset); + TCGv stack_off = tcg_temp_new(); + tcg_gen_ld_tl(stack_off, stack_off_ptr, 0); + tcg_gen_sub_tl(cpu_regs[R_ESP], cpu_regs[R_ESP], stack_off); + tcg_temp_free(stack_off); + + } + +} #define AFL_QEMU_TARGET_i386_SNIPPET \ if (is_persistent) { \ \ if (s->pc == afl_persistent_addr) { \ \ - I386_RESTORE_STATE_FOR_PERSISTENT; \ + i386_restore_state_for_persistent(cpu_regs); \ /*tcg_gen_afl_call0(log_x86_saved_gpr); \ tcg_gen_afl_call0(log_x86_sp_content);*/ \ \ @@ -319,7 +328,8 @@ static void log_x86_sp_content(void) { tcg_gen_st_tl(paddr, cpu_regs[R_ESP], persisent_retaddr_offset); \ \ } \ - tcg_gen_afl_call0(&afl_persistent_loop); \ + \ + if (!persistent_save_gpr) tcg_gen_afl_call0(&afl_persistent_loop); \ /*tcg_gen_afl_call0(log_x86_sp_content);*/ \ \ } else if (afl_persistent_ret_addr && s->pc == afl_persistent_ret_addr) { \ diff --git a/qemu_mode/patches/configure.diff b/qemu_mode/patches/configure.diff new file mode 100644 index 00000000..acb96294 --- /dev/null +++ b/qemu_mode/patches/configure.diff @@ -0,0 +1,26 @@ +diff --git a/configure b/configure +index 1c9f609..3edc9a7 100755 +--- a/configure ++++ b/configure +@@ -4603,6 +4603,21 @@ if test "$darwin" != "yes" -a "$mingw32" != "yes" -a "$solaris" != yes -a \ + libs_softmmu="-lutil $libs_softmmu" + fi + ++########################################## ++cat > $TMPC << EOF ++#include ++#include ++int main(int argc, char **argv) { return dlopen("libc.so", RTLD_NOW) != NULL; } ++EOF ++if compile_prog "" "" ; then ++ : ++elif compile_prog "" "-ldl" ; then ++ LIBS="-ldl $LIBS" ++ libs_qga="-ldl $libs_qga" ++else ++ error_exit "libdl check failed" ++fi ++ + ########################################## + # spice probe + if test "$spice" != "no" ; then diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c index 69efcffa..709abefe 100644 --- a/src/afl-fuzz-cmplog.c +++ b/src/afl-fuzz-cmplog.c @@ -27,7 +27,7 @@ #include "afl-fuzz.h" #include "cmplog.h" -static s32 cmplog_child_pid, cmplog_fsrv_ctl_fd, cmplog_fsrv_st_fd; +static s32 cmplog_fsrv_ctl_fd, cmplog_fsrv_st_fd; void init_cmplog_forkserver(char** argv) { diff --git a/src/afl-fuzz-globals.c b/src/afl-fuzz-globals.c index 154f281e..d5d70542 100644 --- a/src/afl-fuzz-globals.c +++ b/src/afl-fuzz-globals.c @@ -252,7 +252,7 @@ u32 a_extras_cnt; /* Total number of tokens available */ u8 *(*post_handler)(u8 *buf, u32 *len); u8 *cmplog_binary; -s32 cmplog_forksrv_pid; +s32 cmplog_child_pid, cmplog_forksrv_pid; /* hooks for the custom mutator function */ size_t (*custom_mutator)(u8 *data, size_t size, u8 *mutated_out, diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c index 9265e4a5..fc3e1140 100644 --- a/src/afl-fuzz-init.c +++ b/src/afl-fuzz-init.c @@ -1822,6 +1822,8 @@ static void handle_stop_sig(int sig) { if (child_pid > 0) kill(child_pid, SIGKILL); if (forksrv_pid > 0) kill(forksrv_pid, SIGKILL); + if (cmplog_child_pid > 0) kill(cmplog_child_pid, SIGKILL); + if (cmplog_forksrv_pid > 0) kill(cmplog_forksrv_pid, SIGKILL); } diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 8833244d..5f453a27 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -1017,6 +1017,8 @@ int main(int argc, char** argv) { if (child_pid > 0) kill(child_pid, SIGKILL); if (forksrv_pid > 0) kill(forksrv_pid, SIGKILL); + if (cmplog_child_pid > 0) kill(cmplog_child_pid, SIGKILL); + if (cmplog_forksrv_pid > 0) kill(cmplog_forksrv_pid, SIGKILL); /* Now that we've killed the forkserver, we wait for it to be able to get * rusage stats. */ if (waitpid(forksrv_pid, NULL, 0) <= 0) { WARNF("error waitpid\n"); } -- cgit 1.4.1 From aa2cb66ea23884eb03cb0220dcfafbdd7343f54d Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Fri, 7 Feb 2020 20:44:36 +0100 Subject: code format --- examples/qemu_persistent_hook/read_into_rdi.c | 57 ++++++++------- examples/qemu_persistent_hook/test.c | 12 ++-- qemu_mode/patches/afl-qemu-common.h | 4 +- qemu_mode/patches/afl-qemu-cpu-inl.h | 43 +++++++---- qemu_mode/patches/afl-qemu-cpu-translate-inl.h | 98 ++++++++++++-------------- src/afl-fuzz-cmplog.c | 2 +- src/afl-fuzz-redqueen.c | 55 ++++++++------- src/afl-fuzz-stats.c | 14 ++-- 8 files changed, 151 insertions(+), 134 deletions(-) diff --git a/examples/qemu_persistent_hook/read_into_rdi.c b/examples/qemu_persistent_hook/read_into_rdi.c index 4c5119e0..fd4c9000 100644 --- a/examples/qemu_persistent_hook/read_into_rdi.c +++ b/examples/qemu_persistent_hook/read_into_rdi.c @@ -2,35 +2,37 @@ #include #include -#define g2h(x) ((void *)((unsigned long)(x) + guest_base)) -#define h2g(x) ((uint64_t)(x) - guest_base) +#define g2h(x) ((void*)((unsigned long)(x) + guest_base)) +#define h2g(x) ((uint64_t)(x)-guest_base) enum { - R_EAX = 0, - R_ECX = 1, - R_EDX = 2, - R_EBX = 3, - R_ESP = 4, - R_EBP = 5, - R_ESI = 6, - R_EDI = 7, - R_R8 = 8, - R_R9 = 9, - R_R10 = 10, - R_R11 = 11, - R_R12 = 12, - R_R13 = 13, - R_R14 = 14, - R_R15 = 15, - - R_AL = 0, - R_CL = 1, - R_DL = 2, - R_BL = 3, - R_AH = 4, - R_CH = 5, - R_DH = 6, - R_BH = 7, + + R_EAX = 0, + R_ECX = 1, + R_EDX = 2, + R_EBX = 3, + R_ESP = 4, + R_EBP = 5, + R_ESI = 6, + R_EDI = 7, + R_R8 = 8, + R_R9 = 9, + R_R10 = 10, + R_R11 = 11, + R_R12 = 12, + R_R13 = 13, + R_R14 = 14, + R_R15 = 15, + + R_AL = 0, + R_CL = 1, + R_DL = 2, + R_BL = 3, + R_AH = 4, + R_CH = 5, + R_DH = 6, + R_BH = 7, + }; void afl_persistent_hook(uint64_t* regs, uint64_t guest_base) { @@ -40,3 +42,4 @@ void afl_persistent_hook(uint64_t* regs, uint64_t guest_base) { printf("readed %ld bytes\n", r); } + diff --git a/examples/qemu_persistent_hook/test.c b/examples/qemu_persistent_hook/test.c index 079d2be4..83001545 100644 --- a/examples/qemu_persistent_hook/test.c +++ b/examples/qemu_persistent_hook/test.c @@ -6,16 +6,15 @@ int target_func(char *buf, int size) { switch (buf[0]) { case 1: - if (buf[1] == '\x44') { - puts("a"); - } + if (buf[1] == '\x44') { puts("a"); } break; case 0xff: if (buf[2] == '\xff') { - if (buf[1] == '\x44') { - puts("b"); - } + + if (buf[1] == '\x44') { puts("b"); } + } + break; default: break; @@ -32,3 +31,4 @@ int main() { target_func(data, 1024); } + diff --git a/qemu_mode/patches/afl-qemu-common.h b/qemu_mode/patches/afl-qemu-common.h index de6c7b73..da3d563e 100644 --- a/qemu_mode/patches/afl-qemu-common.h +++ b/qemu_mode/patches/afl-qemu-common.h @@ -59,7 +59,7 @@ #define INC_AFL_AREA(loc) afl_area_ptr[loc]++ #endif -typedef void (*afl_persistent_hook_fn)(uint64_t* regs, uint64_t guest_base); +typedef void (*afl_persistent_hook_fn)(uint64_t *regs, uint64_t guest_base); /* Declared in afl-qemu-cpu-inl.h */ @@ -81,7 +81,7 @@ extern afl_persistent_hook_fn afl_persistent_hook_ptr; extern __thread abi_ulong afl_prev_loc; -extern struct cmp_map* __afl_cmp_map; +extern struct cmp_map *__afl_cmp_map; extern __thread u32 __afl_cmp_counter; void afl_debug_dump_saved_regs(); diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h index 7ef54d78..5e155c74 100644 --- a/qemu_mode/patches/afl-qemu-cpu-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-inl.h @@ -82,7 +82,7 @@ u8 afl_compcov_level; __thread abi_ulong afl_prev_loc; -struct cmp_map* __afl_cmp_map; +struct cmp_map *__afl_cmp_map; __thread u32 __afl_cmp_counter; /* Set in the child process in forkserver mode: */ @@ -187,9 +187,9 @@ static void afl_setup(void) { if (inst_r) afl_area_ptr[0] = 1; } - - if (getenv("___AFL_EINS_ZWEI_POLIZEI___")) { // CmpLog forkserver - + + if (getenv("___AFL_EINS_ZWEI_POLIZEI___")) { // CmpLog forkserver + id_str = getenv(CMPLOG_SHM_ENV_VAR); if (id_str) { @@ -198,10 +198,10 @@ static void afl_setup(void) { __afl_cmp_map = shmat(shm_id, NULL, 0); - if (__afl_cmp_map == (void*)-1) exit(1); + if (__afl_cmp_map == (void *)-1) exit(1); } - + } if (getenv("AFL_INST_LIBS")) { @@ -247,32 +247,42 @@ static void afl_setup(void) { if (getenv("AFL_QEMU_PERSISTENT_GPR")) persistent_save_gpr = 1; if (getenv("AFL_QEMU_PERSISTENT_HOOK")) { - + #ifdef AFL_QEMU_STATIC_BUILD - fprintf(stderr, "[AFL] ERROR: you cannot use AFL_QEMU_PERSISTENT_HOOK when afl-qemu-trace is static\n"); + fprintf(stderr, + "[AFL] ERROR: you cannot use AFL_QEMU_PERSISTENT_HOOK when " + "afl-qemu-trace is static\n"); exit(1); #else - + persistent_save_gpr = 1; - - void* plib = dlopen(getenv("AFL_QEMU_PERSISTENT_HOOK"), RTLD_NOW); + + void *plib = dlopen(getenv("AFL_QEMU_PERSISTENT_HOOK"), RTLD_NOW); if (!plib) { - fprintf(stderr, "[AFL] ERROR: invalid AFL_QEMU_PERSISTENT_HOOK=%s\n", getenv("AFL_QEMU_PERSISTENT_HOOK")); + + fprintf(stderr, "[AFL] ERROR: invalid AFL_QEMU_PERSISTENT_HOOK=%s\n", + getenv("AFL_QEMU_PERSISTENT_HOOK")); exit(1); + } - + afl_persistent_hook_ptr = dlsym(plib, "afl_persistent_hook"); if (!afl_persistent_hook_ptr) { - fprintf(stderr, "[AFL] ERROR: failed to find the function \"afl_persistent_hook\" in %s\n", getenv("AFL_QEMU_PERSISTENT_HOOK")); + + fprintf(stderr, + "[AFL] ERROR: failed to find the function " + "\"afl_persistent_hook\" in %s\n", + getenv("AFL_QEMU_PERSISTENT_HOOK")); exit(1); + } #endif } - + if (getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET")) persisent_retaddr_offset = strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 0); @@ -402,9 +412,12 @@ static void afl_forkserver(CPUState *cpu) { if (WIFSTOPPED(status)) child_stopped = 1; else if (unlikely(first_run && is_persistent)) { + fprintf(stderr, "[AFL] ERROR: no persistent iteration executed\n"); exit(12); // Persistent is wrong + } + first_run = 0; if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(7); diff --git a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h index d081060f..3c230c30 100644 --- a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h @@ -153,17 +153,15 @@ static void afl_cmplog_64(target_ulong cur_loc, target_ulong arg1, } - static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2, TCGMemOp ot, int is_imm) { void *func; - if (cur_loc > afl_end_code || cur_loc < afl_start_code) - return; + if (cur_loc > afl_end_code || cur_loc < afl_start_code) return; if (__afl_cmp_map) { - + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); cur_loc &= CMP_MAP_W - 1; @@ -177,16 +175,16 @@ static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2, } tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2); - + } else if (afl_compcov_level) { - + if (!is_imm && afl_compcov_level < 2) return; cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); cur_loc &= MAP_SIZE - 7; if (cur_loc >= afl_inst_rms) return; - + switch (ot) { case MO_64: func = &afl_compcov_log_64; break; @@ -197,7 +195,7 @@ static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2, } tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2); - + } } @@ -254,62 +252,60 @@ static void log_x86_sp_content(void) { }*/ - static void callback_to_persistent_hook(void) { afl_persistent_hook_ptr(persistent_saved_gpr, guest_base); - + } -static void i386_restore_state_for_persistent(TCGv* cpu_regs) { - - if (persistent_save_gpr) { - - int i; - TCGv_ptr gpr_sv; - - TCGv_ptr first_pass_ptr = tcg_const_ptr(&persistent_first_pass); - TCGv first_pass = tcg_temp_local_new(); - TCGv one = tcg_const_tl(1); - tcg_gen_ld8u_tl(first_pass, first_pass_ptr, 0); - - TCGLabel *lbl_restore_gpr = gen_new_label(); - tcg_gen_brcond_tl(TCG_COND_NE, first_pass, one, lbl_restore_gpr); - +static void i386_restore_state_for_persistent(TCGv *cpu_regs) { + + if (persistent_save_gpr) { + + int i; + TCGv_ptr gpr_sv; + + TCGv_ptr first_pass_ptr = tcg_const_ptr(&persistent_first_pass); + TCGv first_pass = tcg_temp_local_new(); + TCGv one = tcg_const_tl(1); + tcg_gen_ld8u_tl(first_pass, first_pass_ptr, 0); + + TCGLabel *lbl_restore_gpr = gen_new_label(); + tcg_gen_brcond_tl(TCG_COND_NE, first_pass, one, lbl_restore_gpr); + // save GRP registers - for (i = 0; i < CPU_NB_REGS; ++i) { - - gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); - tcg_gen_st_tl(cpu_regs[i], gpr_sv, 0); - + for (i = 0; i < CPU_NB_REGS; ++i) { + + gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); + tcg_gen_st_tl(cpu_regs[i], gpr_sv, 0); + } gen_set_label(lbl_restore_gpr); - + tcg_gen_afl_call0(&afl_persistent_loop); - - if (afl_persistent_hook_ptr) - tcg_gen_afl_call0(callback_to_persistent_hook); - - // restore GRP registers - for (i = 0; i < CPU_NB_REGS; ++i) { - - gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); - tcg_gen_ld_tl(cpu_regs[i], gpr_sv, 0); - + + if (afl_persistent_hook_ptr) tcg_gen_afl_call0(callback_to_persistent_hook); + + // restore GRP registers + for (i = 0; i < CPU_NB_REGS; ++i) { + + gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); + tcg_gen_ld_tl(cpu_regs[i], gpr_sv, 0); + } - - tcg_temp_free(first_pass); - + + tcg_temp_free(first_pass); + } else if (afl_persistent_ret_addr == 0) { - + TCGv_ptr stack_off_ptr = tcg_const_ptr(&persistent_stack_offset); - TCGv stack_off = tcg_temp_new(); - tcg_gen_ld_tl(stack_off, stack_off_ptr, 0); - tcg_gen_sub_tl(cpu_regs[R_ESP], cpu_regs[R_ESP], stack_off); - tcg_temp_free(stack_off); - - } + TCGv stack_off = tcg_temp_new(); + tcg_gen_ld_tl(stack_off, stack_off_ptr, 0); + tcg_gen_sub_tl(cpu_regs[R_ESP], cpu_regs[R_ESP], stack_off); + tcg_temp_free(stack_off); + + } } diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c index 709abefe..3d34bf71 100644 --- a/src/afl-fuzz-cmplog.c +++ b/src/afl-fuzz-cmplog.c @@ -442,7 +442,7 @@ u8 run_cmplog_target(char** argv, u32 timeout) { setenv("MSAN_OPTIONS", "exit_code=" STRINGIFY(MSAN_ERROR) ":" "symbolize=0:" "msan_track_origins=0", 0); - + setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1); if (!qemu_mode) argv[0] = cmplog_binary; diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c index bac7357e..296fcd98 100644 --- a/src/afl-fuzz-redqueen.c +++ b/src/afl-fuzz-redqueen.c @@ -122,9 +122,8 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) { while ((rng = pop_biggest_range(&ranges)) != NULL && stage_cur) { u32 s = rng->end - rng->start; - if (s == 0) - goto empty_range; - + if (s == 0) goto empty_range; + memcpy(backup, buf + rng->start, s); rand_replace(buf + rng->start, s); @@ -137,9 +136,11 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) { ranges = add_range(ranges, rng->start + s / 2 + 1, rng->end); memcpy(buf + rng->start, backup, s); - } else needs_write = 1; + } else + + needs_write = 1; -empty_range: + empty_range: ck_free(rng); --stage_cur; @@ -156,9 +157,9 @@ empty_range: ck_free(rng); } - + // save the input with the high entropy - + if (needs_write) { s32 fd; @@ -169,7 +170,7 @@ empty_range: } else { - unlink(queue_cur->fname); /* ignore errors */ + unlink(queue_cur->fname); /* ignore errors */ fd = open(queue_cur->fname, O_WRONLY | O_CREAT | O_EXCL, 0600); } @@ -177,10 +178,10 @@ empty_range: if (fd < 0) PFATAL("Unable to create '%s'", queue_cur->fname); ck_write(fd, buf, len, queue_cur->fname); - queue_cur->len = len; // no-op, just to be 100% safe - + queue_cur->len = len; // no-op, just to be 100% safe + close(fd); - + } return 0; @@ -305,24 +306,27 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx, void try_to_add_to_dict(u64 v, u8 shape) { u8* b = (u8*)&v; - + u32 k; - u8 cons_ff = 0, cons_0 = 0; + u8 cons_ff = 0, cons_0 = 0; for (k = 0; k < shape; ++k) { - if (b[k] == 0) ++cons_0; - else if (b[k] == 0xff) ++cons_0; - else cons_0 = cons_ff = 0; - - if (cons_0 > 1 || cons_ff > 1) - return; + if (b[k] == 0) + ++cons_0; + else if (b[k] == 0xff) + ++cons_0; + else + cons_0 = cons_ff = 0; + + if (cons_0 > 1 || cons_ff > 1) return; } - + maybe_add_auto((u8*)&v, shape); - + u64 rev; switch (shape) { + case 1: break; case 2: rev = SWAP16((u16)v); @@ -336,8 +340,9 @@ void try_to_add_to_dict(u64 v, u8 shape) { rev = SWAP64(v); maybe_add_auto((u8*)&rev, shape); break; + } - + } u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) { @@ -380,13 +385,13 @@ u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) { break; } - + // If failed, add to dictionary if (fails == 8) { - + try_to_add_to_dict(o->v0, SHAPE_BYTES(h->shape)); try_to_add_to_dict(o->v1, SHAPE_BYTES(h->shape)); - + } cmp_fuzz_next_iter: diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index 1b7e5226..d09b4fe6 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -334,9 +334,9 @@ void show_stats(void) { /* Lord, forgive me this. */ - SAYF(SET_G1 bSTG bLT bH bSTOP cCYA + SAYF(SET_G1 bSTG bLT bH bSTOP cCYA " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA - " overall results " bSTG bH2 bH2 bRT "\n"); + " overall results " bSTG bH2 bH2 bRT "\n"); if (dumb_mode) { @@ -413,9 +413,9 @@ void show_stats(void) { " uniq hangs : " cRST "%-6s" bSTG bV "\n", DTD(cur_ms, last_hang_time), tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA - " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); + " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); /* This gets funny because we want to print several variable-length variables together, but then cram them into a fixed-width field - so we need to @@ -443,9 +443,9 @@ void show_stats(void) { SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA - " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); + " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); sprintf(tmp, "%s (%0.02f%%)", DI(queued_favored), ((double)queued_favored) * 100 / queued_paths); @@ -514,7 +514,7 @@ void show_stats(void) { /* Aaaalmost there... hold on! */ - SAYF(bVR bH cCYA bSTOP + SAYF(bVR bH cCYA bSTOP " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA " path geometry " bSTG bH5 bH2 bVL "\n"); -- cgit 1.4.1 From 9ea498585c9c875faa2bd3b9752a1fc7d0bcd287 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Sat, 8 Feb 2020 10:14:48 +0100 Subject: travis timeout reattempts :) --- unicorn_mode/build_unicorn_support.sh | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/unicorn_mode/build_unicorn_support.sh b/unicorn_mode/build_unicorn_support.sh index a04cca6b..ecd80d95 100755 --- a/unicorn_mode/build_unicorn_support.sh +++ b/unicorn_mode/build_unicorn_support.sh @@ -127,7 +127,14 @@ echo "[+] All checks passed!" echo "[*] Making sure unicornafl is checked out" rm -rf unicornafl # workaround for travis ... sadly ... #test -d unicorn && { cd unicorn && { git stash ; git pull ; cd .. ; } } -test -d unicornafl || git clone https://github.com/vanhauser-thc/unicornafl +test -d unicornafl || { + CNT=1 + while [ '!' -d unicornafl -a "$CNT" -lt 4 ]; do + echo "Trying to clone unicornafl (attempt $CNT/3)" + git clone https://github.com/vanhauser-thc/unicornafl + CNT=`expr "$CNT" + 1` + done +} test -d unicornafl || { echo "[-] not checked out, please install git or check your internet connection." ; exit 1 ; } echo "[+] Got unicornafl." -- cgit 1.4.1 From ff0617f41ee3fe14afbaaced4b1075c48e8798ec Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Sat, 8 Feb 2020 11:19:03 +0100 Subject: changelog & TODO --- TODO | 2 ++ docs/ChangeLog | 9 ++++++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/TODO b/TODO index b9c209f8..691cda67 100644 --- a/TODO +++ b/TODO @@ -7,6 +7,7 @@ Makefile: afl-fuzz: - sync_fuzzers(): only masters sync from all, slaves only sync from master + (@andrea: be careful, often people run all slaves) - ascii_only mode gcc_plugin: @@ -24,6 +25,7 @@ qemu_mode: custom_mutators: - rip what Superion is doing into custom mutators for js, php, etc. + - uniform python and custom mutators API diff --git a/docs/ChangeLog b/docs/ChangeLog index f5430057..997db96c 100644 --- a/docs/ChangeLog +++ b/docs/ChangeLog @@ -24,13 +24,16 @@ Version ++2.60d (develop): - Android: prefer bigcores when selecting a CPU - CmpLog forkserver - Redqueen input-2-state mutator (cmp instructions only ATM) - - all python 2+3 versions supported now + - all Python 2+3 versions supported now - afl-clang-fast: - show in the help output for which llvm version it was compiled for - now does not need to be recompiled between trace-pc and pass instrumentation. compile normally and set AFL_LLVM_USE_TRACE_PC :) - - llvm 11 is supported - - CmpLog mode (see llvm_mode/README.cmplog) + - LLVM 11 is supported + - CmpLog instrumentation using SanCov (see llvm_mode/README.cmplog) + - CmpLog instrumentation for QEMU + - AFL_PERSISTENT_HOOK callback module for persistent QEMU + (see examples/qemu_persistent_hook) - afl-cmin is now a sh script (invoking awk) instead of bash for portability the original script is still present as afl-cmin.bash - afl-showmap: -i dir option now allows processing multiple inputs using the -- cgit 1.4.1 From 96b378d5ba9b057bd9a78f37b7817e335242c4a5 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Sat, 8 Feb 2020 11:28:59 +0100 Subject: markdown todo & changelog --- ChangeLog.md | 1 + Changelog | 1 - TODO | 63 -- TODO.md | 70 ++ docs/ChangeLog | 2900 ----------------------------------------------------- docs/ChangeLog.md | 2420 ++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 2491 insertions(+), 2964 deletions(-) create mode 120000 ChangeLog.md delete mode 120000 Changelog delete mode 100644 TODO create mode 100644 TODO.md delete mode 100644 docs/ChangeLog create mode 100644 docs/ChangeLog.md diff --git a/ChangeLog.md b/ChangeLog.md new file mode 120000 index 00000000..84ffa672 --- /dev/null +++ b/ChangeLog.md @@ -0,0 +1 @@ +docs/ChangeLog.md \ No newline at end of file diff --git a/Changelog b/Changelog deleted file mode 120000 index fef2ac30..00000000 --- a/Changelog +++ /dev/null @@ -1 +0,0 @@ -docs/ChangeLog \ No newline at end of file diff --git a/TODO b/TODO deleted file mode 100644 index 691cda67..00000000 --- a/TODO +++ /dev/null @@ -1,63 +0,0 @@ - -Roadmap 2.61+: -============== - -Makefile: - - -march=native -Ofast -flto=full - -afl-fuzz: - - sync_fuzzers(): only masters sync from all, slaves only sync from master - (@andrea: be careful, often people run all slaves) - - ascii_only mode - -gcc_plugin: - - laf-intel - - better instrumentation - -qemu_mode: - - update to 4.x (probably this will be skipped :( ) - - instrim for QEMU mode via static analysis (with r2pipe? or angr?) - Idea: The static analyzer outputs a map in which each edge that must be - skipped is marked with 1. QEMU loads it at startup in the parent process. - - rename qemu specific envs to AFL_QEMU (espec. AFL_ENTRYPOINT) - - add AFL_QEMU_EXITPOINT (maybe multiple?) - - add/implement AFL_QEMU_INST_LIBLIST and AFL_QEMU_NOINST_PROGRAM - -custom_mutators: - - rip what Superion is doing into custom mutators for js, php, etc. - - uniform python and custom mutators API - - - -The far away future: -==================== - -Problem: Average targets (tiff, jpeg, unrar) go through 1500 edges. - At afl's default map that means ~16 collisions and ~3 wrappings. - Solution #1: increase map size. - every +1 decreases fuzzing speed by ~10% and halfs the collisions - birthday paradox predicts collisions at this # of edges: - mapsize => collisions - 2^16 = 302 - 2^17 = 427 - 2^18 = 603 - 2^19 = 853 - 2^20 = 1207 - 2^21 = 1706 - 2^22 = 2412 - 2^23 = 3411 - 2^24 = 4823 - Increasing the map is an easy solution but also not a good one. - Solution #2: use dynamic map size and collision free basic block IDs - This only works in llvm_mode and llvm >= 9 though - A potential good future solution. Heiko/hexcoder follows this up - Solution #3: write instruction pointers to a big shared map - 512kb/1MB shared map and the instrumented code writes the instruction - pointer into the map. Map must be big enough but could be command line - controlled. - Good: complete coverage information, nothing is lost. choice of analysis - impacts speed, but this can be decided by user options - Neutral: a little bit slower but no loss of coverage - Bad: completely changes how afl uses the map and the scheduling. - Overall another very good solution, Marc Heuse/vanHauser follows this up - diff --git a/TODO.md b/TODO.md new file mode 100644 index 00000000..39e219ff --- /dev/null +++ b/TODO.md @@ -0,0 +1,70 @@ + +## Roadmap 2.61 + +Makefile: + - -march=native -Ofast -flto=full + +afl-fuzz: + - sync_fuzzers(): only masters sync from all, slaves only sync from master + (@andrea: be careful, often people run all slaves) + - ascii_only mode + +gcc_plugin: + - laf-intel + - better instrumentation + +qemu_mode: + - update to 4.x (probably this will be skipped :( ) + - instrim for QEMU mode via static analysis (with r2pipe? or angr?) + Idea: The static analyzer outputs a map in which each edge that must be + skipped is marked with 1. QEMU loads it at startup in the parent process. + - rename qemu specific envs to AFL_QEMU (espec. AFL_ENTRYPOINT) + - add AFL_QEMU_EXITPOINT (maybe multiple?) + - add/implement AFL_QEMU_INST_LIBLIST and AFL_QEMU_NOINST_PROGRAM + +custom_mutators: + - rip what Superion is doing into custom mutators for js, php, etc. + - uniform python and custom mutators API + + + +## The far away future: + +Problem: Average targets (tiff, jpeg, unrar) go through 1500 edges. + At afl's default map that means ~16 collisions and ~3 wrappings. + + - Solution #1: increase map size. + every +1 decreases fuzzing speed by ~10% and halfs the collisions + birthday paradox predicts collisions at this # of edges: + + | mapsize | collisions | + | :-----: | :--------: | + | 2^16 | 302 | + | 2^17 | 427 | + | 2^18 | 603 | + | 2^19 | 853 | + | 2^20 | 1207 | + | 2^21 | 1706 | + | 2^22 | 2412 | + | 2^23 | 3411 | + | 2^24 | 4823 | + + Increasing the map is an easy solution but also not a good one. + + - Solution #2: use dynamic map size and collision free basic block IDs + This only works in llvm_mode and llvm >= 9 though + A potential good future solution. Heiko/hexcoder follows this up + + - Solution #3: write instruction pointers to a big shared map + 512kb/1MB shared map and the instrumented code writes the instruction + pointer into the map. Map must be big enough but could be command line + controlled. + + Good: complete coverage information, nothing is lost. choice of analysis + impacts speed, but this can be decided by user options + + Neutral: a little bit slower but no loss of coverage + + Bad: completely changes how afl uses the map and the scheduling. + Overall another very good solution, Marc Heuse/vanHauser follows this up + diff --git a/docs/ChangeLog b/docs/ChangeLog deleted file mode 100644 index 997db96c..00000000 --- a/docs/ChangeLog +++ /dev/null @@ -1,2900 +0,0 @@ -========= -ChangeLog -========= - - This is the list of all noteworthy changes made in every public release of - the tool. See README for the general instruction manual. - ----------------- -Staying informed ----------------- - -Want to stay in the loop on major new features? Join our mailing list by -sending a mail to . - - --------------------------- -Version ++2.60d (develop): --------------------------- - - - use -march=native if available - - afl-fuzz: - - now prints the real python version support compiled in - - set stronger performance compile options and little tweaks - - Android: prefer bigcores when selecting a CPU - - CmpLog forkserver - - Redqueen input-2-state mutator (cmp instructions only ATM) - - all Python 2+3 versions supported now - - afl-clang-fast: - - show in the help output for which llvm version it was compiled for - - now does not need to be recompiled between trace-pc and pass - instrumentation. compile normally and set AFL_LLVM_USE_TRACE_PC :) - - LLVM 11 is supported - - CmpLog instrumentation using SanCov (see llvm_mode/README.cmplog) - - CmpLog instrumentation for QEMU - - AFL_PERSISTENT_HOOK callback module for persistent QEMU - (see examples/qemu_persistent_hook) - - afl-cmin is now a sh script (invoking awk) instead of bash for portability - the original script is still present as afl-cmin.bash - - afl-showmap: -i dir option now allows processing multiple inputs using the - forkserver. This is for enhanced speed in afl-cmin. - - added blacklist and whitelisting function check in all modules of llvm_mode - - added fix from Debian project to compile libdislocator and libtokencap - - libdislocator: AFL_ALIGNED_ALLOC to force size alignment to max_align_t - - --------------------------- -Version ++2.60c (release): --------------------------- - - - fixed a critical bug in afl-tmin that was introduced during ++2.53d - - added test cases for afl-cmin and afl-tmin to test/test.sh - - added ./examples/argv_fuzzing ld_preload library by Kjell Braden - - added preeny's desock_dup ld_preload library as - ./examples/socket_fuzzing for network fuzzing - - added AFL_AS_FORCE_INSTRUMENT environment variable for afl-as - this is - for the retrorewrite project - - we now set QEMU_SET_ENV from AFL_PRELOAD when qemu_mode is used - - --------------------------- -Version ++2.59c (release): --------------------------- - - - qbdi_mode: fuzz android native libraries via QBDI framework - - unicorn_mode: switched to the new unicornafl, thanks domenukk - (see https://github.com/vanhauser-thc/unicorn) - - afl-fuzz: - - added radamsa as (an optional) mutator stage (-R[R]) - - added -u command line option to not unlink the fuzz input file - - Python3 support (autodetect) - - AFL_DISABLE_TRIM env var to disable the trim stage - - CPU affinity support for DragonFly - - llvm_mode: - - float splitting is now configured via AFL_LLVM_LAF_SPLIT_FLOATS - - support for llvm 10 included now (thanks to devnexen) - - libtokencap: - - support for *BSD/OSX/Dragonfly added - - hook common *cmp functions from widely used libraries - - compcov: - - hook common *cmp functions from widely used libraries - - floating point splitting support for QEMU on x86 targets - - qemu_mode: AFL_QEMU_DISABLE_CACHE env to disable QEMU TranslationBlocks caching - - afl-analyze: added AFL_SKIP_BIN_CHECK support - - better random numbers for gcc_plugin and llvm_mode (thanks to devnexen) - - Dockerfile by courtesy of devnexen - - added regex.dictionary - - qemu and unicorn download scripts now try to download until the full - download succeeded. f*ckin travis fails downloading 40% of the time! - - more support for Android (please test!) - - added the few Android stuff we didnt have already from Google afl repository - - removed unnecessary warnings - - --------------------------- -Version ++2.58c (release): --------------------------- - - - reverted patch to not unlink and recreate the input file, it resulted in - performance loss of ~10% - - added test/test-performance.sh script - - (re)added gcc_plugin, fast inline instrumentation is not yet finished, - however it includes the whitelisting and persistance feature! by hexcoder- - - gcc_plugin tests added to testing framework - - --------------------------------- -Version ++2.54d-2.57c (release): --------------------------------- - - - we jump to 2.57 instead of 2.55 to catch up with Google's versioning - - persistent mode for QEMU (see qemu_mode/README.md) - - custom mutator library is now an additional mutator, to exclusivly use it - add AFL_CUSTOM_MUTATOR_ONLY (that will trigger the previous behaviour) - - new library qemu_mode/unsigaction which filters sigaction events - - afl-fuzz: new command line option -I to execute a command on a new crash - - no more unlinking the input file, this way the input file can also be a - FIFO or disk partition - - setting LLVM_CONFIG for llvm_mode will now again switch to the selected - llvm version. If your setup is correct. - - fuzzing strategy yields for custom mutator were missing from the UI, added them :) - - added "make tests" which will perform checks to see that all functionality - is working as expected. this is currently the starting point, its not complete :) - - added mutation documentation feature ("make document"), creates afl-fuzz-document - and saves all mutations of the first run on the first file into out/queue/mutations - - libtokencap and libdislocator now compile to the afl_root directory and are - installed to the .../lib/afl directory when present during make install - - more BSD support, e.g. free CPU binding code for FreeBSD (thanks to devnexen) - - reducing duplicate code in afl-fuzz - - added "make help" - - removed compile warnings from python internal stuff - - added man page for afl-clang-fast[++] - - updated documentation - - Wine mode to run Win32 binaries with the QEMU instrumentation (-W) - - CompareCoverage for ARM target in QEMU/Unicorn - - laf-intel in llvm_mode now also handles floating point comparisons - - --------------------------- -Version ++2.54c (release): --------------------------- - - - big code refactoring: - * all includes are now in include/ - * all afl sources are now in src/ - see src/README.src - * afl-fuzz was splitted up in various individual files for including - functionality in other programs (e.g. forkserver, memory map, etc.) - for better readability. - * new code indention everywhere - - auto-generating man pages for all (main) tools - - added AFL_FORCE_UI to show the UI even if the terminal is not detected - - llvm 9 is now supported (still needs testing) - - Android is now supported (thank to JoeyJiao!) - still need to modify the Makefile though - - fix building qemu on some Ubuntus (thanks to floyd!) - - custom mutator by a loaded library is now supported (thanks to kyakdan!) - - added PR that includes peak_rss_mb and slowest_exec_ms in the fuzzer_stats report - - more support for *BSD (thanks to devnexen!) - - fix building on *BSD (thanks to tobias.kortkamp for the patch) - - fix for a few features to support different map sized than 2^16 - - afl-showmap: new option -r now shows the real values in the buckets (stock - afl never did), plus shows tuple content summary information now - - small docu updates - - NeverZero counters for QEMU - - NeverZero counters for Unicorn - - CompareCoverage Unicorn - - immediates-only instrumentation for CompareCoverage - - --------------------------- -Version ++2.53c (release): --------------------------- - - - README is now README.md - - imported the few minor changes from the 2.53b release - - unicorn_mode got added - thanks to domenukk for the patch! - - fix llvm_mode AFL_TRACE_PC with modern llvm - - fix a crash in qemu_mode which also exists in stock afl - - added libcompcov, a laf-intel implementation for qemu! :) - see qemu_mode/libcompcov/README.libcompcov - - afl-fuzz now displays the selected core in the status screen (blue {#}) - - updated afl-fuzz and afl-system-config for new scaling governor location - in modern kernels - - using the old ineffective afl-gcc will now show a deprecation warning - - all queue, hang and crash files now have their discovery time in their name - - if llvm_mode was compiled, afl-clang/afl-clang++ will point to these - instead of afl-gcc - - added instrim, a much faster llvm_mode instrumentation at the cost of - path discovery. See llvm_mode/README.instrim (https://github.com/csienslab/instrim) - - added MOpt (github.com/puppet-meteor/MOpt-AFL) mode, see docs/README.MOpt - - added code to make it more portable to other platforms than Intel Linux - - added never zero counters for afl-gcc and optionally (because of an - optimization issue in llvm < 9) for llvm_mode (AFL_LLVM_NEVER_ZERO=1) - - added a new doc about binary only fuzzing: docs/binaryonly_fuzzing.txt - - more cpu power for afl-system-config - - added forkserver patch to afl-tmin, makes it much faster (originally from - github.com/nccgroup/TriforceAFL) - - added whitelist support for llvm_mode via AFL_LLVM_WHITELIST to allow - only to instrument what is actually interesting. Gives more speed and less - map pollution (originally by choller@mozilla) - - added Python Module mutator support, python2.7-dev is autodetected. - see docs/python_mutators.txt (originally by choller@mozilla) - - added AFL_CAL_FAST for slow applications and AFL_DEBUG_CHILD_OUTPUT for - debugging - - added -V time and -E execs option to better comparison runs, runs afl-fuzz - for a specific time/executions. - - added a -s seed switch to allow afl run with a fixed initial - seed that is not updated. This is good for performance and path discovery - tests as the random numbers are deterministic then - - llvm_mode LAF_... env variables can now be specified as AFL_LLVM_LAF_... - that is longer but in line with other llvm specific env vars - - ------------------------------ -Version ++2.52c (2019-06-05): ------------------------------ - - - Applied community patches. See docs/PATCHES for the full list. - LLVM and Qemu modes are now faster. - Important changes: - afl-fuzz: -e EXTENSION commandline option - llvm_mode: LAF-intel performance (needs activation, see llvm/README.laf-intel) - a few new environment variables for afl-fuzz, llvm and qemu, see docs/env_variables.txt - - Added the power schedules of AFLfast by Marcel Boehme, but set the default - to the AFL schedule, not to the FAST schedule. So nothing changes unless - you use the new -p option :-) - see docs/power_schedules.txt - - added afl-system-config script to set all system performance options for fuzzing - - llvm_mode works with llvm 3.9 up to including 8 ! - - qemu_mode got upgraded from 2.1 to 3.1 - incorporated from - https://github.com/andreafioraldi/afl and with community patches added - - ---------------------------- -Version 2.52b (2017-11-04): ---------------------------- - - - Upgraded QEMU patches from 2.3.0 to 2.10.0. Required troubleshooting - several weird issues. All the legwork done by Andrew Griffiths. - - - Added setsid to afl-showmap. See the notes for 2.51b. - - - Added target mode (deferred, persistent, qemu, etc) to fuzzer_stats. - Requested by Jakub Wilk. - - - afl-tmin should now save a partially minimized file when Ctrl-C - is pressed. Suggested by Jakub Wilk. - - - Added an option for afl-analyze to dump offsets in hex. Suggested by - Jakub Wilk. - - - Added support for parameters in triage_crashes.sh. Patch by Adam of - DC949. - ---------------------------- -Version 2.51b (2017-08-30): ---------------------------- - - - Made afl-tmin call setsid to prevent glibc traceback junk from showing - up on the terminal in some distros. Suggested by Jakub Wilk. - ---------------------------- -Version 2.50b (2017-08-19): ---------------------------- - - - Fixed an interesting timing corner case spotted by Jakub Wilk. - - - Addressed a libtokencap / pthreads incompatibility issue. Likewise, spotted - by Jakub Wilk. - - - Added a mention of afl-kit and Pythia. - - - Added AFL_FAST_CAL. - - - In-place resume now preserves .synced. Suggested by Jakub Wilk. - ---------------------------- -Version 2.49b (2017-07-18): ---------------------------- - - - Added AFL_TMIN_EXACT to allow path constraint for crash minimization. - - - Added dates for releases (retroactively for all of 2017). - ---------------------------- -Version 2.48b (2017-07-17): ---------------------------- - - - Added AFL_ALLOW_TMP to permit some scripts to run in /tmp. - - - Fixed cwd handling in afl-analyze (similar to the quirk in afl-tmin). - - - Made it possible to point -o and -f to the same file in afl-tmin. - ---------------------------- -Version 2.47b (2017-07-14): ---------------------------- - - - Fixed cwd handling in afl-tmin. Spotted by Jakub Wilk. - ---------------------------- -Version 2.46b (2017-07-10): ---------------------------- - - - libdislocator now supports AFL_LD_NO_CALLOC_OVER for folks who do not - want to abort on calloc() overflows. - - - Made a minor fix to libtokencap. Reported by Daniel Stender. - - - Added a small JSON dictionary, inspired on a dictionary done by Jakub Wilk. - ---------------------------- -Version 2.45b (2017-07-04): ---------------------------- - - - Added strstr, strcasestr support to libtokencap. Contributed by - Daniel Hodson. - - - Fixed a resumption offset glitch spotted by Jakub Wilk. - - - There are definitely no bugs in afl-showmap -c now. - ---------------------------- -Version 2.44b (2017-06-28): ---------------------------- - - - Added a visual indicator of ASAN / MSAN mode when compiling. Requested - by Jakub Wilk. - - - Added support for afl-showmap coredumps (-c). Suggested by Jakub Wilk. - - - Added LD_BIND_NOW=1 for afl-showmap by default. Although not really useful, - it reportedly helps reproduce some crashes. Suggested by Jakub Wilk. - - - Added a note about allocator_may_return_null=1 not always working with - ASAN. Spotted by Jakub Wilk. - ---------------------------- -Version 2.43b (2017-06-16): ---------------------------- - - - Added AFL_NO_ARITH to aid in the fuzzing of text-based formats. - Requested by Jakub Wilk. - ---------------------------- -Version 2.42b (2017-06-02): ---------------------------- - - - Renamed the R() macro to avoid a problem with llvm_mode in the latest - versions of LLVM. Fix suggested by Christian Holler. - ---------------------------- -Version 2.41b (2017-04-12): ---------------------------- - - - Addressed a major user complaint related to timeout detection. Timing out - inputs are now binned as "hangs" only if they exceed a far more generous - time limit than the one used to reject slow paths. - ---------------------------- -Version 2.40b (2017-04-02): ---------------------------- - - - Fixed a minor oversight in the insertion strategy for dictionary words. - Spotted by Andrzej Jackowski. - - - Made a small improvement to the havoc block insertion strategy. - - - Adjusted color rules for "is it done yet?" indicators. - ---------------------------- -Version 2.39b (2017-02-02): ---------------------------- - - - Improved error reporting in afl-cmin. Suggested by floyd. - - - Made a minor tweak to trace-pc-guard support. Suggested by kcc. - - - Added a mention of afl-monitor. - ---------------------------- -Version 2.38b (2017-01-22): ---------------------------- - - - Added -mllvm -sanitizer-coverage-block-threshold=0 to trace-pc-guard - mode, as suggested by Kostya Serebryany. - ---------------------------- -Version 2.37b (2017-01-22): ---------------------------- - - - Fixed a typo. Spotted by Jakub Wilk. - - - Fixed support for make install when using trace-pc. Spotted by - Kurt Roeckx. - - - Switched trace-pc to trace-pc-guard, which should be considerably - faster and is less quirky. Kudos to Konstantin Serebryany (and sorry - for dragging my feet). - - Note that for some reason, this mode doesn't perform as well as - "vanilla" afl-clang-fast / afl-clang. - ---------------------------- -Version 2.36b (2017-01-14): ---------------------------- - - - Fixed a cosmetic bad free() bug when aborting -S sessions. Spotted - by Johannes S. - - - Made a small change to afl-whatsup to sort fuzzers by name. - - - Fixed a minor issue with malloc(0) in libdislocator. Spotted by - Rene Freingruber. - - - Changed the clobber pattern in libdislocator to a slightly more - reliable one. Suggested by Rene Freingruber. - - - Added a note about THP performance. Suggested by Sergey Davidoff. - - - Added a somewhat unofficial support for running afl-tmin with a - baseline "mask" that causes it to minimize only for edges that - are unique to the input file, but not to the "boring" baseline. - Suggested by Sami Liedes. - - - "Fixed" a getPassName() problem with newer versions of clang. - Reported by Craig Young and several other folks. - - Yep, I know I have a backlog on several other feature requests. - Stay tuned! - --------------- -Version 2.35b: --------------- - - - Fixed a minor cmdline reporting glitch, spotted by Leo Barnes. - - - Fixed a silly bug in libdislocator. Spotted by Johannes Schultz. - --------------- -Version 2.34b: --------------- - - - Added a note about afl-tmin to technical_details.txt. - - - Added support for AFL_NO_UI, as suggested by Leo Barnes. - --------------- -Version 2.33b: --------------- - - - Added code to strip -Wl,-z,defs and -Wl,--no-undefined for afl-clang-fast, - since they interfere with -shared. Spotted and diagnosed by Toby Hutton. - - - Added some fuzzing tips for Android. - --------------- -Version 2.32b: --------------- - - - Added a check for AFL_HARDEN combined with AFL_USE_*SAN. Suggested by - Hanno Boeck. - - - Made several other cosmetic adjustments to cycle timing in the wake of the - big tweak made in 2.31b. - --------------- -Version 2.31b: --------------- - - - Changed havoc cycle counts for a marked performance boost, especially - with -S / -d. See the discussion of FidgetyAFL in: - - https://groups.google.com/forum/#!topic/afl-users/fOPeb62FZUg - - While this does not implement the approach proposed by the authors of - the CCS paper, the solution is a result of digging into that research; - more improvements may follow as I do more experiments and get more - definitive data. - --------------- -Version 2.30b: --------------- - - - Made minor improvements to persistent mode to avoid the remote - possibility of "no instrumentation detected" issues with very low - instrumentation densities. - - - Fixed a minor glitch with a leftover process in persistent mode. - Reported by Jakub Wilk and Daniel Stender. - - - Made persistent mode bitmaps a bit more consistent and adjusted the way - this is shown in the UI, especially in persistent mode. - --------------- -Version 2.29b: --------------- - - - Made a minor #include fix to llvm_mode. Suggested by Jonathan Metzman. - - - Made cosmetic updates to the docs. - --------------- -Version 2.28b: --------------- - - - Added "life pro tips" to docs/. - - - Moved testcases/_extras/ to dictionaries/ for visibility. - - - Made minor improvements to install scripts. - - - Added an important safety tip. - --------------- -Version 2.27b: --------------- - - - Added libtokencap, a simple feature to intercept strcmp / memcmp and - generate dictionary entries that can help extend coverage. - - - Moved libdislocator to its own dir, added README. - - - The demo in examples/instrumented_cmp is no more. - --------------- -Version 2.26b: --------------- - - - Made a fix for libdislocator.so to compile on MacOS X. - - - Added support for DYLD_INSERT_LIBRARIES. - - - Renamed AFL_LD_PRELOAD to AFL_PRELOAD. - --------------- -Version 2.25b: --------------- - - - Made some cosmetic updates to libdislocator.so, renamed one env - variable. - --------------- -Version 2.24b: --------------- - - - Added libdislocator.so, an experimental, abusive allocator. Try - it out with AFL_LD_PRELOAD=/path/to/libdislocator.so when running - afl-fuzz. - --------------- -Version 2.23b: --------------- - - - Improved the stability metric for persistent mode binaries. Problem - spotted by Kurt Roeckx. - - - Made a related improvement that may bring the metric to 100% for those - targets. - --------------- -Version 2.22b: --------------- - - - Mentioned the potential conflicts between MSAN / ASAN and FORTIFY_SOURCE. - There is no automated check for this, since some distros may implicitly - set FORTIFY_SOURCE outside of the compiler's argv[]. - - - Populated the support for AFL_LD_PRELOAD to all companion tools. - - - Made a change to the handling of ./afl-clang-fast -v. Spotted by - Jan Kneschke. - --------------- -Version 2.21b: --------------- - - - Added some crash reporting notes for Solaris in docs/INSTALL, as - investigated by Martin Carpenter. - - - Fixed a minor UI mix-up with havoc strategy stats. - --------------- -Version 2.20b: --------------- - - - Revamped the handling of variable paths, replacing path count with a - "stability" score to give users a much better signal. Based on the - feedback from Vegard Nossum. - - - Made a stability improvement to the syncing behavior with resuming - fuzzers. Based on the feedback from Vegard. - - - Changed the UI to include current input bitmap density along with - total density. Ditto. - - - Added experimental support for parallelizing -M. - --------------- -Version 2.19b: --------------- - - - Made a fix to make sure that auto CPU binding happens at non-overlapping - times. - --------------- -Version 2.18b: --------------- - - - Made several performance improvements to has_new_bits() and - classify_counts(). This should offer a robust performance bump with - fast targets. - --------------- -Version 2.17b: --------------- - - - Killed the error-prone and manual -Z option. On Linux, AFL will now - automatically bind to the first free core (or complain if there are no - free cores left). - - - Made some doc updates along these lines. - --------------- -Version 2.16b: --------------- - - - Improved support for older versions of clang (hopefully without - breaking anything). - - - Moved version data from Makefile to config.h. Suggested by - Jonathan Metzman. - --------------- -Version 2.15b: --------------- - - - Added a README section on looking for non-crashing bugs. - - - Added license data to several boring files. Contributed by - Jonathan Metzman. - --------------- -Version 2.14b: --------------- - - - Added FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION as a macro defined when - compiling with afl-gcc and friends. Suggested by Kostya Serebryany. - - - Refreshed some of the non-x86 docs. - --------------- -Version 2.13b: --------------- - - - Fixed a spurious build test error with trace-pc and llvm_mode/Makefile. - Spotted by Markus Teufelberger. - - - Fixed a cosmetic issue with afl-whatsup. Spotted by Brandon Perry. - --------------- -Version 2.12b: --------------- - - - Fixed a minor issue in afl-tmin that can make alphabet minimization less - efficient during passes > 1. Spotted by Daniel Binderman. - --------------- -Version 2.11b: --------------- - - - Fixed a minor typo in instrumented_cmp, spotted by Hanno Eissfeldt. - - - Added a missing size check for deterministic insertion steps. - - - Made an improvement to afl-gotcpu when -Z not used. - - - Fixed a typo in post_library_png.so.c in examples/. Spotted by Kostya - Serebryany. - --------------- -Version 2.10b: --------------- - - - Fixed a minor core counting glitch, reported by Tyler Nighswander. - --------------- -Version 2.09b: --------------- - - - Made several documentation updates. - - - Added some visual indicators to promote and simplify the use of -Z. - --------------- -Version 2.08b: --------------- - - - Added explicit support for -m32 and -m64 for llvm_mode. Inspired by - a request from Christian Holler. - - - Added a new benchmarking option, as requested by Kostya Serebryany. - --------------- -Version 2.07b: --------------- - - - Added CPU affinity option (-Z) on Linux. With some caution, this can - offer a significant (10%+) performance bump and reduce jitter. - Proposed by Austin Seipp. - - - Updated afl-gotcpu to use CPU affinity where supported. - - - Fixed confusing CPU_TARGET error messages with QEMU build. Spotted by - Daniel Komaromy and others. - --------------- -Version 2.06b: --------------- - - - Worked around LLVM persistent mode hiccups with -shared code. - Contributed by Christian Holler. - - - Added __AFL_COMPILER as a convenient way to detect that something is - built under afl-gcc / afl-clang / afl-clang-fast and enable custom - optimizations in your code. Suggested by Pedro Corte-Real. - - - Upstreamed several minor changes developed by Franjo Ivancic to - allow AFL to be built as a library. This is fairly use-specific and - may have relatively little appeal to general audiences. - --------------- -Version 2.05b: --------------- - - - Put __sanitizer_cov_module_init & co behind #ifdef to avoid problems - with ASAN. Spotted by Christian Holler. - --------------- -Version 2.04b: --------------- - - - Removed indirect-calls coverage from -fsanitize-coverage (since it's - redundant). Spotted by Kostya Serebryany. - --------------- -Version 2.03b: --------------- - - - Added experimental -fsanitize-coverage=trace-pc support that goes with - some recent additions to LLVM, as implemented by Kostya Serebryany. - Right now, this is cumbersome to use with common build systems, so - the mode remains undocumented. - - - Made several substantial improvements to better support non-standard - map sizes in LLVM mode. - - - Switched LLVM mode to thread-local execution tracing, which may offer - better results in some multithreaded apps. - - - Fixed a minor typo, reported by Heiko Eissfeldt. - - - Force-disabled symbolization for ASAN, as suggested by Christian Holler. - - - AFL_NOX86 renamed to AFL_NO_X86 for consistency. - - - Added AFL_LD_PRELOAD to allow LD_PRELOAD to be set for targets without - affecting AFL itself. Suggested by Daniel Godas-Lopez. - --------------- -Version 2.02b: --------------- - - - Fixed a "lcamtuf can't count to 16" bug in the havoc stage. Reported - by Guillaume Endignoux. - --------------- -Version 2.01b: --------------- - - - Made an improvement to cycle counter color coding, based on feedback - from Shai Sarfaty. - - - Added a mention of aflize to sister_projects.txt. - - - Fixed an installation issue with afl-as, as spotted by ilovezfs. - --------------- -Version 2.00b: --------------- - - - Cleaned up color handling after a minor snafu in 1.99b (affecting some - terminals). - - - Made minor updates to the documentation. - --------------- -Version 1.99b: --------------- - - - Substantially revamped the output and the internal logic of afl-analyze. - - - Cleaned up some of the color handling code and added support for - background colors. - - - Removed some stray files (oops). - - - Updated docs to better explain afl-analyze. - --------------- -Version 1.98b: --------------- - - - Improved to "boring string" detection in afl-analyze. - - - Added technical_details.txt for afl-analyze. - --------------- -Version 1.97b: --------------- - - - Added afl-analyze, a nifty tool to analyze the structure of a file - based on the feedback from AFL instrumentation. This is kinda experimental, - so field reports welcome. - - - Added a mention of afl-cygwin. - - - Fixed a couple of typos, as reported by Jakub Wilk and others. - --------------- -Version 1.96b: --------------- - - - Added -fpic to CFLAGS for the clang plugin, as suggested by Hanno Boeck. - - - Made another clang change (IRBuilder) suggested by Jeff Trull. - - - Fixed several typos, spotted by Jakub Wilk. - - - Added support for AFL_SHUFFLE_QUEUE, based on discussions with - Christian Holler. - --------------- -Version 1.95b: --------------- - - - Fixed a harmless bug when handling -B. Spotted by Jacek Wielemborek. - - - Made the exit message a bit more accurate when AFL_EXIT_WHEN_DONE is set. - - - Added some error-checking for old-style forkserver syntax. Suggested by - Ben Nagy. - - - Switched from exit() to _exit() in injected code to avoid snafus with - destructors in C++ code. Spotted by sunblate. - - - Made a change to avoid spuriously setting __AFL_SHM_ID when - AFL_DUMB_FORKSRV is set in conjunction with -n. Spotted by Jakub Wilk. - --------------- -Version 1.94b: --------------- - - - Changed allocator alignment to improve support for non-x86 systems (now - that llvm_mode makes this more feasible). - - - Fixed a minor typo in afl-cmin. Spotted by Jonathan Neuschafer. - - - Fixed an obscure bug that would affect people trying to use afl-gcc - with $TMP set but $TMPDIR absent. Spotted by Jeremy Barnes. - --------------- -Version 1.93b: --------------- - - - Hopefully fixed a problem with MacOS X and persistent mode, spotted by - Leo Barnes. - --------------- -Version 1.92b: --------------- - - - Made yet another C++ fix (namespaces). Reported by Daniel Lockyer. - --------------- -Version 1.91b: --------------- - - - Made another fix to make 1.90b actually work properly with C++ (d'oh). - Problem spotted by Daniel Lockyer. - --------------- -Version 1.90b: --------------- - - - Fixed a minor typo spotted by Kai Zhao; and made several other minor updates - to docs. - - - Updated the project URL for python-afl. Requested by Jakub Wilk. - - - Fixed a potential problem with deferred mode signatures getting optimized - out by the linker (with --gc-sections). - --------------- -Version 1.89b: --------------- - - - Revamped the support for persistent and deferred forkserver modes. - Both now feature simpler syntax and do not require companion env - variables. Suggested by Jakub Wilk. - - - Added a bit more info about afl-showmap. Suggested by Jacek Wielemborek. - --------------- -Version 1.88b: --------------- - - - Made AFL_EXIT_WHEN_DONE work in non-tty mode. Issue spotted by - Jacek Wielemborek. - --------------- -Version 1.87b: --------------- - - - Added QuickStartGuide.txt, a one-page quick start doc. - - - Fixed several typos spotted by Dominique Pelle. - - - Revamped several parts of README. - --------------- -Version 1.86b: --------------- - - - Added support for AFL_SKIP_CRASHES, which is a very hackish solution to - the problem of resuming sessions with intermittently crashing inputs. - - - Removed the hard-fail terminal size check, replaced with a dynamic - warning shown in place of the UI. Based on feedback from Christian Holler. - - - Fixed a minor typo in show_stats. Spotted by Dingbao Xie. - --------------- -Version 1.85b: --------------- - - - Fixed a garbled sentence in notes on parallel fuzzing. Thanks to Jakub Wilk. - - - Fixed a minor glitch in afl-cmin. Spotted by Jonathan Foote. - --------------- -Version 1.84b: --------------- - - - Made SIMPLE_FILES behave as expected when naming backup directories for - crashes and hangs. - - - Added the total number of favored paths to fuzzer_stats. Requested by - Ben Nagy. - - - Made afl-tmin, afl-fuzz, and afl-cmin reject negative values passed to - -t and -m, since they generally won't work as expected. - - - Made a fix for no lahf / sahf support on older versions of FreeBSD. - Patch contributed by Alex Moneger. - --------------- -Version 1.83b: --------------- - - - Fixed a problem with xargs -d on non-Linux systems in afl-cmin. Spotted by - teor2345 and Ben Nagy. - - - Fixed an implicit declaration in LLVM mode on MacOS X. Reported by - Kai Zhao. - --------------- -Version 1.82b: --------------- - - - Fixed a harmless but annoying race condition in persistent mode - signal - delivery is a bit more finicky than I thought. - - - Updated the documentation to explain persistent mode a bit better. - - - Tweaked AFL_PERSISTENT to force AFL_NO_VAR_CHECK. - --------------- -Version 1.81b: --------------- - - - Added persistent mode for in-process fuzzing. See llvm_mode/README.llvm. - Inspired by Kostya Serebryany and Christian Holler. - - - Changed the in-place resume code to preserve crashes/README.txt. Suggested - by Ben Nagy. - - - Included a potential fix for LLVM mode issues on MacOS X, based on the - investigation done by teor2345. - --------------- -Version 1.80b: --------------- - - - Made afl-cmin tolerant of whitespaces in filenames. Suggested by - Jonathan Neuschafer and Ketil Froyn. - - - Added support for AFL_EXIT_WHEN_DONE, as suggested by Michael Rash. - --------------- -Version 1.79b: --------------- - - - Added support for dictionary levels, see testcases/README.testcases. - - - Reworked the SQL dictionary to use levels. - - - Added a note about Preeny. - --------------- -Version 1.78b: --------------- - - - Added a dictionary for PDF, contributed by Ben Nagy. - - - Added several references to afl-cov, a new tool by Michael Rash. - - - Fixed a problem with crash reporter detection on MacOS X, as reported by - Louis Dassy. - --------------- -Version 1.77b: --------------- - - - Extended the -x option to support single-file dictionaries. - - - Replaced factory-packaged dictionaries with file-based variants. - - - Removed newlines from HTML keywords in testcases/_extras/html/. - --------------- -Version 1.76b: --------------- - - - Very significantly reduced the number of duplicate execs during - deterministic checks, chiefly in int16 and int32 stages. Confirmed - identical path yields. This should improve early-stage efficiency by - around 5-10%. - - - Reduced the likelihood of duplicate non-deterministic execs by - bumping up lowest stacking factor from 1 to 2. Quickly confirmed - that this doesn't seem to have significant impact on coverage with - libpng. - - - Added a note about integrating afl-fuzz with third-party tools. - --------------- -Version 1.75b: --------------- - - - Improved argv_fuzzing to allow it to emit empty args. Spotted by Jakub - Wilk. - - - afl-clang-fast now defines __AFL_HAVE_MANUAL_INIT. Suggested by Jakub Wilk. - - - Fixed a libtool-related bug with afl-clang-fast that would make some - ./configure invocations generate incorrect output. Spotted by Jakub Wilk. - - - Removed flock() on Solaris. This means no locking on this platform, - but so be it. Problem reported by Martin Carpenter. - - - Fixed a typo. Reported by Jakub Wilk. - --------------- -Version 1.74b: --------------- - - - Added an example argv[] fuzzing wrapper in examples/argv_fuzzing. - Reworked the bash example to be faster, too. - - - Clarified llvm_mode prerequisites for FreeBSD. - - - Improved afl-tmin to use /tmp if cwd is not writeable. - - - Removed redundant includes for sys/fcntl.h, which caused warnings with - some nitpicky versions of libc. - - - Added a corpus of basic HTML tags that parsers are likely to pay attention - to (no attributes). - - - Added EP_EnabledOnOptLevel0 to llvm_mode, so that the instrumentation is - inserted even when AFL_DONT_OPTIMIZE=1 is set. - - - Switched qemu_mode to use the newly-released QEMU 2.3.0, which contains - a couple of minor bugfixes. - --------------- -Version 1.73b: --------------- - - - Fixed a pretty stupid bug in effector maps that could sometimes cause - AFL to fuzz slightly more than necessary; and in very rare circumstances, - could lead to SEGV if eff_map is aligned with page boundary and followed - by an unmapped page. Spotted by Jonathan Gray. - --------------- -Version 1.72b: --------------- - - - Fixed a glitch in non-x86 install, spotted by Tobias Ospelt. - - - Added a minor safeguard to llvm_mode Makefile following a report from - Kai Zhao. - --------------- -Version 1.71b: --------------- - - - Fixed a bug with installed copies of AFL trying to use QEMU mode. Spotted - by G.M. Lime. - - - Added last path / crash / hang times to fuzzer_stats, suggested by - Richard Hipp. - - - Fixed a typo, thanks to Jakub Wilk. - --------------- -Version 1.70b: --------------- - - - Modified resumption code to reuse the original timeout value when resuming - a session if -t is not given. This prevents timeout creep in continuous - fuzzing. - - - Added improved error messages for failed handshake when AFL_DEFER_FORKSRV - is set. - - - Made a slight improvement to llvm_mode/Makefile based on feedback from - Jakub Wilk. - - - Refreshed several bits of documentation. - - - Added a more prominent note about the MacOS X trade-offs to Makefile. - --------------- -Version 1.69b: --------------- - - - Added support for deferred initialization in LLVM mode. Suggested by - Richard Godbee. - --------------- -Version 1.68b: --------------- - - - Fixed a minor PRNG glitch that would make the first seconds of a fuzzing - job deterministic. Thanks to Andreas Stieger. - - - Made tmp[] static in the LLVM runtime to keep Valgrind happy (this had - no impact on anything else). Spotted by Richard Godbee. - - - Clarified the footnote in README. - --------------- -Version 1.67b: --------------- - - - Made one more correction to llvm_mode Makefile, spotted by Jakub Wilk. - --------------- -Version 1.66b: --------------- - - - Added CC / CXX support to llvm_mode Makefile. Requested by Charlie Eriksen. - - - Fixed 'make clean' with gmake. Suggested by Oliver Schneider. - - - Fixed 'make -j n clean all'. Suggested by Oliver Schneider. - - - Removed build date and time from banners to give people deterministic - builds. Requested by Jakub Wilk. - --------------- -Version 1.65b: --------------- - - - Fixed a snafu with some leftover code in afl-clang-fast. - - - Corrected even moar typos. - --------------- -Version 1.64b: --------------- - - - Further simplified afl-clang-fast runtime by reverting .init_array to - __attribute__((constructor(0)). This should improve compatibility with - non-ELF platforms. - - - Fixed a problem with afl-clang-fast and -shared libraries. Simplified - the code by getting rid of .preinit_array and replacing it with a .comm - object. Problem reported by Charlie Eriksen. - - - Removed unnecessary instrumentation density adjustment for the LLVM mode. - Reported by Jonathan Neuschafer. - --------------- -Version 1.63b: --------------- - - - Updated cgroups_asan/ with a new version from Sam, made a couple changes - to streamline it and keep parallel afl instances in separate groups. - - - Fixed typos, thanks to Jakub Wilk. - --------------- -Version 1.62b: --------------- - - - Improved the handling of -x in afl-clang-fast, - - - Improved the handling of low AFL_INST_RATIO settings for QEMU and - LLVM modes. - - - Fixed the llvm-config bug for good (thanks to Tobias Ospelt). - --------------- -Version 1.61b: --------------- - - - Fixed an obscure bug compiling OpenSSL with afl-clang-fast. Patch by - Laszlo Szekeres. - - - Fixed a 'make install' bug on non-x86 systems, thanks to Tobias Ospelt. - - - Fixed a problem with half-broken llvm-config on Odroid, thanks to - Tobias Ospelt. (There is another odd bug there that hasn't been fully - fixed - TBD). - --------------- -Version 1.60b: --------------- - - - Allowed examples/llvm_instrumentation/ to graduate to llvm_mode/. - - - Removed examples/arm_support/, since it's completely broken and likely - unnecessary with LLVM support in place. - - - Added ASAN cgroups script to examples/asan_cgroups/, updated existing - docs. Courtesy Sam Hakim and David A. Wheeler. - - - Refactored afl-tmin to reduce the number of execs in common use cases. - Ideas from Jonathan Neuschafer and Turo Lamminen. - - - Added a note about CLAs at the bottom of README. - - - Renamed testcases_readme.txt to README.testcases for some semblance of - consistency. - - - Made assorted updates to docs. - - - Added MEM_BARRIER() to afl-showmap and afl-tmin, just to be safe. - --------------- -Version 1.59b: --------------- - - - Imported Laszlo Szekeres' experimental LLVM instrumentation into - examples/llvm_instrumentation. I'll work on including it in the - "mainstream" version soon. - - - Fixed another typo, thanks to Jakub Wilk. - --------------- -Version 1.58b: --------------- - - - Added a workaround for abort() behavior in -lpthread programs in QEMU mode. - Spotted by Aidan Thornton. - - - Made several documentation updates, including links to the static - instrumentation tool (sister_projects.txt). - --------------- -Version 1.57b: --------------- - - - Fixed a problem with exception handling on some versions of MacOS X. - Spotted by Samir Aguiar and Anders Wang Kristensen. - - - Tweaked afl-gcc to use BIN_PATH instead of a fixed string in help - messages. - --------------- -Version 1.56b: --------------- - - - Renamed related_work.txt to historical_notes.txt. - - - Made minor edits to the ASAN doc. - - - Added docs/sister_projects.txt with a list of inspired or closely - related utilities. - --------------- -Version 1.55b: --------------- - - - Fixed a glitch with afl-showmap opening /dev/null with O_RDONLY when - running in quiet mode. Spotted by Tyler Nighswander. - --------------- -Version 1.54b: --------------- - - - Added another postprocessor example for PNG. - - - Made a cosmetic fix to realloc() handling in examples/post_library/, - suggested by Jakub Wilk. - - - Improved -ldl handling. Suggested by Jakub Wilk. - --------------- -Version 1.53b: --------------- - - - Fixed an -l ordering issue that is apparently still a problem on Ubuntu. - Spotted by William Robinet. - --------------- -Version 1.52b: --------------- - - - Added support for file format postprocessors. Requested by Ben Nagy. This - feature is intentionally buried, since it's fairly easy to misuse and - useful only in some scenarios. See examples/post_library/. - --------------- -Version 1.51b: --------------- - - - Made it possible to properly override LD_BIND_NOW after one very unusual - report of trouble. - - - Cleaned up typos, thanks to Jakub Wilk. - - - Fixed a bug in AFL_DUMB_FORKSRV. - --------------- -Version 1.50b: --------------- - - - Fixed a flock() bug that would prevent dir reuse errors from kicking - in every now and then. - - - Renamed references to ppvm (the project is now called recidivm). - - - Made improvements to file descriptor handling to avoid leaving some fds - unnecessarily open in the child process. - - - Fixed a typo or two. - --------------- -Version 1.49b: --------------- - - - Added code to save original command line in fuzzer_stats and - crashes/README.txt. Also saves fuzzer version in fuzzer_stats. - Requested by Ben Nagy. - --------------- -Version 1.48b: --------------- - - - Fixed a bug with QEMU fork server crashes when translation is attempted - after a jump to an invalid pointer in the child process (i.e., after - bumping into a particularly nasty security bug in the tested binary). - Reported by Tyler Nighswander. - --------------- -Version 1.47b: --------------- - - - Fixed a bug with afl-cmin in -Q mode complaining about binary being not - instrumented. Thanks to Jonathan Neuschafer for the bug report. - - - Fixed another bug with argv handling for afl-fuzz in -Q mode. Reported - by Jonathan Neuschafer. - - - Improved the use of colors when showing crash counts in -C mode. - --------------- -Version 1.46b: --------------- - - - Improved instrumentation performance on 32-bit systems by getting rid of - xor-swap (oddly enough, xor-swap is still faster on 64-bit) and tweaking - alignment. - - - Made path depth numbers more accurate with imported test cases. - --------------- -Version 1.45b: --------------- - - - Added support for SIMPLE_FILES in config.h for folks who don't like - descriptive file names. Generates very simple names without colons, - commas, plus signs, dashes, etc. - - - Replaced zero-sized files with symlinks in the variable behavior state - dir to simplify examining the relevant test cases. - - - Changed the period of limited-range block ops from 5 to 10 minutes based - on a couple of experiments. The basic goal of this delay timer behavior - is to better support jobs that are seeded with completely invalid files, - in which case, the first few queue cycles may be completed very quickly - without discovering new paths. Should have no effect on well-seeded jobs. - - - Made several minor updates to docs. - --------------- -Version 1.44b: --------------- - - - Corrected two bungled attempts to get the -C mode work properly - with afl-cmin (accounting for the short-lived releases tagged 1.42 and - 1.43b) - sorry. - - - Removed AFL_ALLOW_CRASHES in favor of the -C mode in said tool. - - - Said goodbye to Hello Kitty, as requested by Padraig Brady. - --------------- -Version 1.41b: --------------- - - - Added AFL_ALLOW_CRASHES=1 to afl-cmin. Allows crashing inputs in the - output corpus. Changed the default behavior to disallow it. - - - Made the afl-cmin output dir default to 0700, not 0755, to be consistent - with afl-fuzz; documented the rationale for 0755 in afl-plot. - - - Lowered the output dir reuse time limit to 25 minutes as a dice-roll - compromise after a discussion on afl-users@. - - - Made afl-showmap accept -o /dev/null without borking out. - - - Added support for crash / hang info in exit codes of afl-showmap. - - - Tweaked block operation scaling to also factor in ballpark run time - in cases where queue passes take very little time. - - - Fixed typos and made improvements to several docs. - --------------- -Version 1.40b: --------------- - - - Switched to smaller block op sizes during the first passes over the - queue. Helps keep test cases small. - - - Added memory barrier for run_target(), just in case compilers get - smarter than they are today. - - - Updated a bunch of docs. - --------------- -Version 1.39b: --------------- - - - Added the ability to skip inputs by sending SIGUSR1 to the fuzzer. - - - Reworked several portions of the documentation. - - - Changed the code to reset splicing perf scores between runs to keep - them closer to intended length. - - - Reduced the minimum value of -t to 5 for afl-fuzz (~200 exec/sec) - and to 10 for auxiliary tools (due to the absence of a fork server). - - - Switched to more aggressive default timeouts (rounded up to 25 ms - versus 50 ms - ~40 execs/sec) and made several other cosmetic changes - to the timeout code. - --------------- -Version 1.38b: --------------- - - - Fixed a bug in the QEMU build script, spotted by William Robinet. - - - Improved the reporting of skipped bitflips to keep the UI counters a bit - more accurate. - - - Cleaned up related_work.txt and added some non-goals. - - - Fixed typos, thanks to Jakub Wilk. - --------------- -Version 1.37b: --------------- - - - Added effector maps, which detect regions that do not seem to respond - to bitflips and subsequently exclude them from more expensive steps - (arithmetics, known ints, etc). This should offer significant performance - improvements with quite a few types of text-based formats, reducing the - number of deterministic execs by a factor of 2 or so. - - - Cleaned up mem limit handling in afl-cmin. - - - Switched from uname -i to uname -m to work around Gentoo-specific - issues with coreutils when building QEMU. Reported by William Robinet. - - - Switched from PID checking to flock() to detect running sessions. - Problem, against all odds, bumped into by Jakub Wilk. - - - Added SKIP_COUNTS and changed the behavior of COVERAGE_ONLY in config.h. - Useful only for internal benchmarking. - - - Made improvements to UI refresh rates and exec/sec stats to make them - more stable. - - - Made assorted improvements to the documentation and to the QEMU build - script. - - - Switched from perror() to strerror() in error macros, thanks to Jakub - Wilk for the nag. - - - Moved afl-cmin back to bash, wasn't thinking straight. It has to stay - on bash because other shells may have restrictive limits on array sizes. - --------------- -Version 1.36b: --------------- - - - Switched afl-cmin over to /bin/sh. Thanks to Jonathan Gray. - - - Fixed an off-by-one bug in queue limit check when resuming sessions - (could cause NULL ptr deref if you are *really* unlucky). - - - Fixed the QEMU script to tolerate i686 if returned by uname -i. Based on - a problem report from Sebastien Duquette. - - - Added multiple references to Jakub's ppvm tool. - - - Made several minor improvements to the Makefile. - - - Believe it or not, fixed some typos. Thanks to Jakub Wilk. - --------------- -Version 1.35b: --------------- - - - Cleaned up regular expressions in some of the scripts to avoid errors - on *BSD systems. Spotted by Jonathan Gray. - --------------- -Version 1.34b: --------------- - - - Performed a substantial documentation and program output cleanup to - better explain the QEMU feature. - --------------- -Version 1.33b: --------------- - - - Added support for AFL_INST_RATIO and AFL_INST_LIBS in the QEMU mode. - - - Fixed a stack allocation crash in QEMU mode (bug in QEMU, fixed with - an extra patch applied to the downloaded release). - - - Added code to test the QEMU instrumentation once the afl-qemu-trace - binary is built. - - - Modified afl-tmin and afl-showmap to search $PATH for binaries and to - better handle QEMU support. - - - Added a check for instrumented binaries when passing -Q to afl-fuzz. - --------------- -Version 1.32b: --------------- - - - Fixed 'make install' following the QEMU changes. Spotted by Hanno Boeck. - - - Fixed EXTRA_PAR handling in afl-cmin. - --------------- -Version 1.31b: --------------- - - - Hallelujah! Thanks to Andrew Griffiths, we now support very fast, black-box - instrumentation of binary-only code. See qemu_mode/README.qemu. - - To use this feature, you need to follow the instructions in that - directory and then run afl-fuzz with -Q. - --------------- -Version 1.30b: --------------- - - - Added -s (summary) option to afl-whatsup. Suggested by Jodie Cunningham. - - - Added a sanity check in afl-tmin to detect minimization to zero len or - excess hangs. - - - Fixed alphabet size counter in afl-tmin. - - - Slightly improved the handling of -B in afl-fuzz. - - - Fixed process crash messages with -m none. - --------------- -Version 1.29b: --------------- - - - Improved the naming of test cases when orig: is already present in the file - name. - - - Made substantial improvements to technical_details.txt. - --------------- -Version 1.28b: --------------- - - - Made a minor tweak to the instrumentation to preserve the directionality - of tuples (i.e., A -> B != B -> A) and to maintain the identity of tight - loops (A -> A). You need to recompile targeted binaries to leverage this. - - - Cleaned up some of the afl-whatsup stats. - - - Added several sanity checks to afl-cmin. - --------------- -Version 1.27b: --------------- - - - Made afl-tmin recursive. Thanks to Hanno Boeck for the tip. - - - Added docs/technical_details.txt. - - - Changed afl-showmap search strategy in afl-cmap to just look into the - same place that afl-cmin is executed from. Thanks to Jakub Wilk. - - - Removed current_todo.txt and cleaned up the remaining docs. - --------------- -Version 1.26b: --------------- - - - Added total execs/sec stat for afl-whatsup. - - - afl-cmin now auto-selects between cp or ln. Based on feedback from - Even Huus. - - - Fixed a typo. Thanks to Jakub Wilk. - - - Made afl-gotcpu a bit more accurate by using getrusage instead of - times. Thanks to Jakub Wilk. - - - Fixed a memory limit issue during the build process on NetBSD-current. - Reported by Thomas Klausner. - --------------- -Version 1.25b: --------------- - - - Introduced afl-whatsup, a simple tool for querying the status of - local synced instances of afl-fuzz. - - - Added -x compiler to clang options on Darwin. Suggested by Filipe - Cabecinhas. - - - Improved exit codes for afl-gotcpu. - - - Improved the checks for -m and -t values in afl-cmin. Bug report - from Evan Huus. - --------------- -Version 1.24b: --------------- - - - Introduced afl-getcpu, an experimental tool to empirically measure - CPU preemption rates. Thanks to Jakub Wilk for the idea. - --------------- -Version 1.23b: --------------- - - - Reverted one change to afl-cmin that actually made it slower. - --------------- -Version 1.22b: --------------- - - - Reworked afl-showmap.c to support normal options, including -o, -q, - -e. Also added support for timeouts and memory limits. - - - Made changes to afl-cmin and other scripts to accommodate the new - semantics. - - - Officially retired AFL_EDGES_ONLY. - - - Fixed another typo in afl-tmin, courtesy of Jakub Wilk. - --------------- -Version 1.21b: --------------- - - - Graduated minimize_corpus.sh to afl-cmin. It is now a first-class - utility bundled with the fuzzer. - - - Made significant improvements to afl-cmin to make it faster, more - robust, and more versatile. - - - Refactored some of afl-tmin code to make it a bit more readable. - - - Made assorted changes to the doc to document afl-cmin and other stuff. - --------------- -Version 1.20b: --------------- - - - Added AFL_DUMB_FORKSRV, as requested by Jakub Wilk. This works only - in -n mode and allows afl-fuzz to run with "dummy" fork servers that - don't output any instrumentation, but follow the same protocol. - - - Renamed AFL_SKIP_CHECKS to AFL_SKIP_BIN_CHECK to make it at least - somewhat descriptive. - - - Switched to using clang as the default assembler on MacOS X to work - around Xcode issues with newer builds of clang. Testing and patch by - Nico Weber. - - - Fixed a typo (via Jakub Wilk). - --------------- -Version 1.19b: --------------- - - - Improved exec failure detection in afl-fuzz and afl-showmap. - - - Improved Ctrl-C handling in afl-showmap. - - - Added afl-tmin, a handy instrumentation-enabled minimizer. - --------------- -Version 1.18b: --------------- - - - Fixed a serious but short-lived bug in the resumption behavior introduced - in version 1.16b. - - - Added -t nn+ mode for soft-skipping timing-out paths. - --------------- -Version 1.17b: --------------- - - - Fixed a compiler warning introduced in 1.16b for newer versions of GCC. - Thanks to Jakub Wilk and Ilfak Guilfanov. - - - Improved the consistency of saving fuzzer_stats, bitmap info, and - auto-dictionaries when aborting fuzzing sessions. - - - Made several noticeable performance improvements to deterministic arith - and known int steps. - --------------- -Version 1.16b: --------------- - - - Added a bit of code to make resumption pick up from the last known - offset in the queue, rather than always rewinding to the start. Suggested - by Jakub Wilk. - - - Switched to tighter timeout control for slow programs (3x rather than - 5x average exec speed at init). - --------------- -Version 1.15b: --------------- - - - Added support for AFL_NO_VAR_CHECK to speed up resumption and inhibit - variable path warnings for some programs. - - - Made the trimmer run even for variable paths, since there is no special - harm in doing so and it can be very beneficial if the trimming still - pans out. - - - Made the UI a bit more descriptive by adding "n/a" instead of "0" in a - couple of corner cases. - --------------- -Version 1.14b: --------------- - - - Added a (partial) dictionary for JavaScript. - - - Added AFL_NO_CPU_RED, as suggested by Jakub Wilk. - - - Tweaked the havoc scaling logic added in 1.12b. - --------------- -Version 1.13b: --------------- - - - Improved the performance of minimize_corpus.sh by switching to a - sort-based approach. - - - Made several minor revisions to the docs. - --------------- -Version 1.12b: --------------- - - - Made an improvement to dictionary generation to avoid runs of identical - bytes. - - - Added havoc cycle scaling to help with slow binaries in -d mode. Based on - a thread with Sami Liedes. - - - Added AFL_SYNC_FIRST for afl-fuzz. This is useful for those who obsess - over stats, no special purpose otherwise. - - - Switched to more robust box drawing codes, suggested by Jakub Wilk. - - - Created faster 64-bit variants of several critical-path bitmap functions - (sorry, no difference on 32 bits). - - - Fixed moar typos, as reported by Jakub Wilk. - --------------- -Version 1.11b: --------------- - - - Added a bit more info about dictionary strategies to the status screen. - --------------- -Version 1.10b: --------------- - - - Revised the dictionary behavior to use insertion and overwrite in - deterministic steps, rather than just the latter. This improves coverage - with SQL and the like. - - - Added a mention of "*" in status_screen.txt, as suggested by Jakub Wilk. - --------------- -Version 1.09b: --------------- - - - Corrected a cosmetic problem with 'extras' stage count not always being - accurate in the stage yields view. - - - Fixed a typo reported by Jakub Wilk and made some minor documentation - improvements. - --------------- -Version 1.08b: --------------- - - - Fixed a div-by-zero bug in the newly-added code when using a dictionary. - --------------- -Version 1.07b: --------------- - - - Added code that automatically finds and extracts syntax tokens from the - input corpus. - - - Fixed a problem with ld dead-code removal option on MacOS X, reported - by Filipe Cabecinhas. - - - Corrected minor typos spotted by Jakub Wilk. - - - Added a couple of more exotic archive format samples. - --------------- -Version 1.06b: --------------- - - - Switched to slightly more accurate (if still not very helpful) reporting - of short read and short write errors. These theoretically shouldn't happen - unless you kill the forkserver or run out of disk space. Suggested by - Jakub Wilk. - - - Revamped some of the allocator and debug code, adding comments and - cleaning up other mess. - - - Tweaked the odds of fuzzing non-favored test cases to make sure that - baseline coverage of all inputs is reached sooner. - --------------- -Version 1.05b: --------------- - - - Added a dictionary for WebP. - - - Made some additional performance improvements to minimize_corpus.sh, - getting deeper into the bash woods. - --------------- -Version 1.04b: --------------- - - - Made substantial performance improvements to minimize_corpus.sh with - large datasets, albeit at the expense of having to switch back to bash - (other shells may have limits on array sizes, etc). - - - Tweaked afl-showmap to support the format used by the new script. - --------------- -Version 1.03b: --------------- - - - Added code to skip README.txt in the input directory to make the crash - exploration mode work better. Suggested by Jakub Wilk. - - - Added a dictionary for SQLite. - --------------- -Version 1.02b: --------------- - - - Reverted the ./ search path in minimize_corpus.sh because people did - not like it. - - - Added very explicit warnings not to run various shell scripts that - read or write to /tmp/ (since this is generally a pretty bad idea on - multi-user systems). - - - Added a check for /tmp binaries and -f locations in afl-fuzz. - --------------- -Version 1.01b: --------------- - - - Added dictionaries for XML and GIF. - --------------- -Version 1.00b: --------------- - - - Slightly improved the performance of minimize_corpus.sh, especially on - Linux. - - - Made a couple of improvements to calibration timeouts for resumed scans. - --------------- -Version 0.99b: --------------- - - - Fixed minimize_corpus.sh to work with dash, as suggested by Jakub Wilk. - - - Modified minimize_corpus.sh to try locate afl-showmap in $PATH and ./. - The first part requested by Jakub Wilk. - - - Added support for afl-as --version, as required by one funky build - script. Reported by William Robinet. - --------------- -Version 0.98b: --------------- - - - Added a dictionary for TIFF. - - - Fixed another cosmetic snafu with stage exec counts for -x. - - - Switched afl-plot to /bin/sh, since it seems bashism-free. Also tried - to remove any obvious bashisms from other examples/ scripts, - most notably including minimize_corpus.sh and triage_crashes.sh. - Requested by Jonathan Gray. - --------------- -Version 0.97b: --------------- - - - Fixed cosmetic issues around the naming of -x strategy files. - - - Added a dictionary for JPEG. - - - Fixed a very rare glitch when running instrumenting 64-bit code that makes - heavy use of xmm registers that are also touched by glibc. - --------------- -Version 0.96b: --------------- - - - Added support for extra dictionaries, provided testcases/_extras/png/ - as a demo. - - - Fixed a minor bug in number formatting routines used by the UI. - - - Added several additional PNG test cases that are relatively unlikely - to be hit by chance. - - - Fixed afl-plot syntax for gnuplot 5.x. Reported by David Necas. - --------------- -Version 0.95b: --------------- - - - Cleaned up the OSX ReportCrash code. Thanks to Tobias Ospelt for help. - - - Added some extra tips for AFL_NO_FORKSERVER on OSX. - - - Refreshed the INSTALL file. - --------------- -Version 0.94b: --------------- - - - Added in-place resume (-i-) to address a common user complaint. - - - Added an awful workaround for ReportCrash on MacOS X. Problem - spotted by Joseph Gentle. - --------------- -Version 0.93b: --------------- - - - Fixed the link() workaround, as reported by Jakub Wilk. - --------------- -Version 0.92b: --------------- - - - Added support for reading test cases from another filesystem. - Requested by Jakub Wilk. - - - Added pointers to the mailing list. - - - Added a sample PDF document. - --------------- -Version 0.91b: --------------- - - - Refactored minimize_corpus.sh to make it a bit more user-friendly and to - select for smallest files, not largest bitmaps. Offers a modest corpus - size improvement in most cases. - - - Slightly improved the performance of splicing code. - --------------- -Version 0.90b: --------------- - - - Moved to an algorithm where paths are marked as preferred primarily based - on size and speed, rather than bitmap coverage. This should offer - noticeable performance gains in many use cases. - - - Refactored path calibration code; calibration now takes place as soon as a - test case is discovered, to facilitate better prioritization decisions later - on. - - - Changed the way of marking variable paths to avoid .state metadata - inconsistencies. - - - Made sure that calibration routines always create a new test case to avoid - hypothetical problems with utilities that modify the input file. - - - Added bitmap saturation to fuzzer stats and plot data. - - - Added a testcase for JPEG XR. - - - Added a tty check for the colors warning in Makefile, to keep distro build - logs tidy. Suggested by Jakub Wilk. - --------------- -Version 0.89b: --------------- - - - Renamed afl-plot.sh to afl-plot, as requested by Padraig Brady. - - - Improved the compatibility of afl-plot with older versions of gnuplot. - - - Added banner information to fuzzer_stats, populated it to afl-plot. - --------------- -Version 0.88b: --------------- - - - Added support for plotting, with design and implementation based on a - prototype design proposed by Michael Rash. Huge thanks! - - - Added afl-plot.sh, which allows you to, well, generate a nice plot using - this data. - - - Refactored the code slightly to make more frequent updates to fuzzer_stats - and to provide more detail about synchronization. - - - Added an fflush(stdout) call for non-tty operation, as requested by - Joonas Kuorilehto. - - - Added some detail to fuzzer_stats for parity with plot_file. - --------------- -Version 0.87b: --------------- - - - Added support for MSAN, via AFL_USE_MSAN, same gotchas as for ASAN. - --------------- -Version 0.86b: --------------- - - - Added AFL_NO_FORKSRV, allowing the forkserver to be bypassed. Suggested - by Ryan Govostes. - - - Simplified afl-showmap.c to make use of the no-forkserver mode. - - - Made minor improvements to crash_triage.sh, as suggested by Jakub Wilk. - --------------- -Version 0.85b: --------------- - - - Fixed the CPU counting code - no sysctlbyname() on OpenBSD, d'oh. Bug - reported by Daniel Dickman. - - - Made a slight correction to error messages - the advice on testing - with ulimit was a tiny bit off by a factor of 1024. - --------------- -Version 0.84b: --------------- - - - Added support for the CPU widget on some non-Linux platforms (I hope). - Based on feedback from Ryan Govostes. - - - Cleaned up the changelog (very meta). - --------------- -Version 0.83b: --------------- - - - Added examples/clang_asm_normalize/ and related notes in - env_variables.txt and afl-as.c. Thanks to Ryan Govostes for the idea. - - - Added advice on hardware utilization in README. - --------------- -Version 0.82b: --------------- - - - Made additional fixes for Xcode support, juggling -Q and -q flags. Thanks to - Ryan Govostes. - - - Added a check for __asm__ blocks and switches to .intel_syntax in assembly. - Based on feedback from Ryan Govostes. - --------------- -Version 0.81b: --------------- - - - A workaround for Xcode 6 as -Q flag glitch. Spotted by Ryan Govostes. - - - Improved Solaris build instructions, as suggested by Martin Carpenter. - - - Fix for a slightly busted path scoring conditional. Minor practical impact. - --------------- -Version 0.80b: --------------- - - - Added a check for $PATH-induced loops. Problem noticed by Kartik Agaram. - - - Added AFL_KEEP_ASSEMBLY for easier troubleshooting. - - - Added an override for AFL_USE_ASAN if set at afl compile time. Requested by - Hanno Boeck. - --------------- -Version 0.79b: --------------- - - - Made minor adjustments to path skipping logic. - - - Made several documentation updates to reflect the path selection changes - made in 0.78b. - --------------- -Version 0.78b: --------------- - - - Added a CPU governor check. Bug report from Joe Zbiciak. - - - Favored paths are now selected strictly based on new edges, not hit - counts. This speeds up the first pass by a factor of 3-6x without - significantly impacting ultimate coverage (tested with libgif, libpng, - libjpeg). - - It also allows some performance & memory usage improvements by making - some of the in-memory bitmaps much smaller. - - - Made multiple significant performance improvements to bitmap checking - functions, plus switched to a faster hash. - - - Owing largely to these optimizations, bumped the size of the bitmap to - 64k and added a warning to detect older binaries that rely on smaller - bitmaps. - --------------- -Version 0.77b: --------------- - - - Added AFL_SKIP_CHECKS to bypass binary checks when really warranted. - Feature requested by Jakub Wilk. - - - Fixed a couple of typos. - - - Added a warning for runs that are aborted early on. - --------------- -Version 0.76b: --------------- - - - Incorporated another signal handling fix for Solaris. Suggestion - submitted by Martin Carpenter. - --------------- -Version 0.75b: --------------- - - - Implemented a slightly more "elegant" kludge for the %llu glitch (see - types.h). - - - Relaxed CPU load warnings to stay in sync with reality. - --------------- -Version 0.74b: --------------- - - - Switched to more responsive exec speed averages and better UI speed - scaling. - - - Fixed a bug with interrupted reads on Solaris. Issue spotted by Martin - Carpenter. - --------------- -Version 0.73b: --------------- - - - Fixed a stray memcpy() instead of memmove() on overlapping buffers. - Mostly harmless but still dumb. Mistake spotted thanks to David Higgs. - --------------- -Version 0.72b: --------------- - - - Bumped map size up to 32k. You may want to recompile instrumented - binaries (but nothing horrible will happen if you don't). - - - Made huge performance improvements for bit-counting functions. - - - Default optimizations now include -funroll-loops. This should have - interesting effects on the instrumentation. Frankly, I'm just going to - ship it and see what happens next. I have a good feeling about this. - - - Made a fix for stack alignment crash on MacOS X 10.10; looks like the - rhetorical question in the comments in afl-as.h has been answered. - Tracked down by Mudge Zatko. - --------------- -Version 0.71b: --------------- - - - Added a fix for the nonsensical MacOS ELF check. Spotted by Mudge Zatko. - - - Made some improvements to ASAN checks. - --------------- -Version 0.70b: --------------- - - - Added explicit detection of ASANified binaries. - - - Fixed compilation issues on Solaris. Reported by Martin Carpenter. - --------------- -Version 0.69b: --------------- - - - Improved the detection of non-instrumented binaries. - - - Made the crash counter in -C mode accurate. - - - Fixed an obscure install bug that made afl-as non-functional with the tool - installed to /usr/bin instead of /usr/local/bin. Found by Florian Kiersch. - - - Fixed for a cosmetic SIGFPE when Ctrl-C is pressed while the fork server - is spinning up. - --------------- -Version 0.68b: --------------- - - - Added crash exploration mode! Woot! - --------------- -Version 0.67b: --------------- - - - Fixed several more typos, the project is now cartified 100% typo-free. - Thanks to Thomas Jarosch and Jakub Wilk. - - - Made a change to write fuzzer_stats early on. - - - Fixed a glitch when (not!) running on MacOS X as root. Spotted by Tobias - Ospelt. - - - Made it possible to override -O3 in Makefile. Suggested by Jakub Wilk. - --------------- -Version 0.66b: --------------- - - - Fixed a very obscure issue with build systems that use gcc as an assembler - for hand-written .s files; this would confuse afl-as. Affected nss, reported - by Hanno Boeck. - - - Fixed a bug when cleaning up synchronized fuzzer output dirs. Issue reported - by Thomas Jarosch. - --------------- -Version 0.65b: --------------- - - - Cleaned up shell printf escape codes in Makefile. Reported by Jakub Wilk. - - - Added more color to fuzzer_stats, provided short documentation of the file - format, and made several other stats-related improvements. - --------------- -Version 0.64b: --------------- - - - Enabled GCC support on MacOS X. - --------------- -Version 0.63b: --------------- - - - Provided a new, simplified way to pass data in files (@@). See README. - - - Made additional fixes for 64-bit MacOS X, working around a crashing bug in - their linker (umpf) and several other things. It's alive! - - - Added a minor workaround for a bug in 64-bit FreeBSD (clang -m32 -g doesn't - work on that platform, but clang -m32 does, so we no longer insert -g). - - - Added a build-time warning for inverse video terminals and better - instructions in status_screen.txt. - --------------- -Version 0.62b: --------------- - - - Made minor improvements to the allocator, as suggested by Tobias Ospelt. - - - Added example instrumented memcmp() in examples/instrumented_cmp. - - - Added a speculative fix for MacOS X (clang detection, again). - - - Fixed typos in parallel_fuzzing.txt. Problems spotted by Thomas Jarosch. - --------------- -Version 0.61b: --------------- - - - Fixed a minor issue with clang detection on systems with a clang cc - wrapper, so that afl-gcc doesn't confuse it with GCC. - - - Made cosmetic improvements to docs and to the CPU load indicator. - - - Fixed a glitch with crash removal (README.txt left behind, d'oh). - --------------- -Version 0.60b: --------------- - - - Fixed problems with jump tables generated by exotic versions of GCC. This - solves an outstanding problem on OpenBSD when using afl-gcc + PIE (not - present with afl-clang). - - - Fixed permissions on one of the sample archives. - - - Added a lahf / sahf workaround for OpenBSD (their assembler doesn't know - about these opcodes). - - - Added docs/INSTALL. - --------------- -Version 0.59b: --------------- - - - Modified 'make install' to also install test cases. - - - Provided better pointers to installed README in afl-fuzz. - - - More work on RLIMIT_AS for OpenBSD. - --------------- -Version 0.58b: --------------- - - - Added a core count check on Linux. - - - Refined the code for the lack-of-RLIMIT_AS case on OpenBSD. - - - Added a rudimentary CPU utilization meter to help with optimal loading. - --------------- -Version 0.57b: --------------- - - - Made fixes to support FreeBSD and OpenBSD: use_64bit is now inferred if not - explicitly specified when calling afl-as, and RLIMIT_AS is behind an #ifdef. - Thanks to Fabian Keil and Jonathan Gray for helping troubleshoot this. - - - Modified 'make install' to also install docs (in /usr/local/share/doc/afl). - - - Fixed a typo in status_screen.txt. - - - Made a couple of Makefile improvements as proposed by Jakub Wilk. - --------------- -Version 0.56b: --------------- - - - Added probabilistic instrumentation density reduction in ASAN mode. This - compensates for ASAN-specific branches in a crude but workable way. - - - Updated notes_for_asan.txt. - --------------- -Version 0.55b: --------------- - - - Implemented smarter out_dir behavior, automatically deleting directories - that don't contain anything of special value. Requested by several folks, - including Hanno Boeck. - - - Added more detail in fuzzer_stats (start time, run time, fuzzer PID). - - - Implemented support for configurable install prefixes in Makefile - ($PREFIX), as requested by Luca Barbato. - - - Made it possible to resume by doing -i , without having to specify - -i /queue/. - --------------- -Version 0.54b: --------------- - - - Added a fix for -Wformat warning messages (oops, I thought this had been in - place for a while). - --------------- -Version 0.53b: --------------- - - - Redesigned the crash & hang duplicate detection code to better deal with - fault conditions that can be reached in a multitude of ways. - - The old approach could be compared to hashing stack traces to de-dupe - crashes, a method prone to crash count inflation. The alternative I - wanted to avoid would be equivalent to just looking at crash %eip, - which can have false negatives in common functions such as memcpy(). - - The middle ground currently used in afl-fuzz can be compared to looking - at every line item in the stack trace and tagging crashes as unique if - we see any function name that we haven't seen before (or if something that - we have *always* seen there suddenly disappears). We do the comparison - without paying any attention to ordering or hit counts. This can still - cause some crash inflation early on, but the problem will quickly taper - off. So, you may get 20 dupes instead of 5,000. - - - Added a fix for harmless but absurd trim ratios shown if the first exec in - the trimmer timed out. Spotted by @EspenGx. - --------------- -Version 0.52b: --------------- - - - Added a quick summary of the contents in examples/. - - - Made a fix to the process of writing fuzzer_stats. - - - Slightly reorganized the .state/ directory, now recording redundant paths, - too. Note that this breaks the ability to properly resume older sessions - - sorry about that. - - (To fix this, simply move /.state/* from an older run - to /.state/deterministic_done/*.) - --------------- -Version 0.51b: --------------- - - - Changed the search order for afl-as to avoid the problem with older copies - installed system-wide; this also means that I can remove the Makefile check - for that. - - - Made it possible to set instrumentation ratio of 0%. - - - Introduced some typos, fixed others. - - - Fixed the test_prev target in Makefile, as reported by Ozzy Johnson. - --------------- -Version 0.50b: --------------- - - - Improved the 'make install' logic, as suggested by Padraig Brady. - - - Revamped various bits of the documentation, especially around perf_tips.txt; - based on the feedback from Alexander Cherepanov. - - - Added AFL_INST_RATIO to afl-as. The only case where this comes handy is - ffmpeg, at least as far as I can tell. (Trivia: the current version of - ffmpeg ./configure also ignores CC and --cc, probably unintentionally). - - - Added documentation for all environmental variables (env_variables.txt). - - - Implemented a visual warning for excessive or insufficient bitmap density. - - - Changed afl-gcc to add -O3 by default; use AFL_DONT_OPTIMIZE if you don't - like that. Big speed gain for ffmpeg, so seems like a good idea. - - - Made a regression fix to afl-as to ignore .LBB labels in gcc mode. - --------------- -Version 0.49b: --------------- - - - Fixed more typos, as found by Jakub Wilk. - - - Added support for clang! - - - Changed AFL_HARDEN to *not* include ASAN by default. Use AFL_USE_ASAN if - needed. The reasons for this are in notes_for_asan.txt. - - - Switched from configure auto-detection to isatty() to keep afl-as and - afl-gcc quiet. - - - Improved installation process to properly create symlinks, rather than - copies of binaries. - --------------- -Version 0.48b: --------------- - - - Improved afl-fuzz to force-set ASAN_OPTIONS=abort_on_error=1. Otherwise, - ASAN crashes wouldn't be caught at all. Reported by Hanno Boeck. - - - Improved Makefile mkdir logic, as suggested by Hanno Boeck. - - - Improved the 64-bit instrumentation to properly save r8-r11 registers in - the x86 setup code. The old behavior could cause rare problems running - *without* instrumentation when the first function called in a particular - .o file has 5+ parameters. No impact on code running under afl-fuzz or - afl-showmap. Issue spotted by Padraig Brady. - --------------- -Version 0.47b: --------------- - - - Fixed another Makefile bug for parallel builds of afl. Problem identified - by Richard W. M. Jones. - - - Added support for suffixes for -m. - - - Updated the documentation and added notes_for_asan.txt. Based on feedback - from Hanno Boeck, Ben Laurie, and others. - - - Moved the project to http://lcamtuf.coredump.cx/afl/. - --------------- -Version 0.46b: --------------- - - - Cleaned up Makefile dependencies for parallel builds. Requested by - Richard W. M. Jones. - - - Added support for DESTDIR in Makefile. Once again suggested by - Richard W. M. Jones :-) - - - Removed all the USE_64BIT stuff; we now just auto-detect compilation mode. - As requested by many callers to the show. - - - Fixed rare problems with programs that use snippets of assembly and - switch between .code32 and .code64. Addresses a glitch spotted by - Hanno Boeck with compiling ToT gdb. - --------------- -Version 0.45b: --------------- - - - Implemented a test case trimmer. Results in 20-30% size reduction for many - types of work loads, with very pronounced improvements in path discovery - speeds. - - - Added better warnings for various problems with input directories. - - - Added a Makefile warning for older copies, based on counterintuitive - behavior observed by Hovik Manucharyan. - - - Added fuzzer_stats file for status monitoring. Suggested by @dronesec. - - - Fixed moar typos, thanks to Alexander Cherepanov. - - - Implemented better warnings for ASAN memory requirements, based on calls - from several angry listeners. - - - Switched to saner behavior with non-tty stdout (less output generated, - no ANSI art). - --------------- -Version 0.44b: --------------- - - - Added support for AFL_CC and AFL_CXX, based on a patch from Ben Laurie. - - - Replaced afl-fuzz -S -D with -M for simplicity. - - - Added a check for .section .text; lack of this prevented main() from - getting instrumented for some users. Reported by Tom Ritter. - - - Reorganized the testcases/ directory. - - - Added an extra check to confirm that the build is operational. - - - Made more consistent use of color reset codes, as suggested by Oliver - Kunz. - --------------- -Version 0.43b: --------------- - - - Fixed a bug with 64-bit gcc -shared relocs. - - - Removed echo -e from Makefile for compatibility with dash. Suggested - by Jakub Wilk. - - - Added status_screen.txt. - - - Added examples/canvas_harness. - - - Made a minor change to the Makefile GCC check. Suggested by Hanno Boeck. - --------------- -Version 0.42b: --------------- - - - Fixed a bug with red zone handling for 64-bit (oops!). Problem reported by - Felix Groebert. - - - Implemented horribly experimental ARM support in examples/arm_support. - - - Made several improvements to error messages. - - - Added AFL_QUIET to silence afl-gcc and afl-as when using wonky build - systems. Reported by Hanno Boeck. - - - Improved check for 64-bit compilation, plus several sanity checks - in Makefile. - --------------- -Version 0.41b: --------------- - - - Fixed a fork served bug for processes that call execve(). - - - Made minor compatibility fixes to Makefile, afl-gcc; suggested by Jakub - Wilk. - - - Fixed triage_crashes.sh to work with the new layout of output directories. - Suggested by Jakub Wilk. - - - Made multiple performance-related improvements to the injected - instrumentation. - - - Added visual indication of the number of imported paths. - - - Fixed afl-showmap to make it work well with new instrumentation. - - - Added much better error messages for crashes when importing test cases - or otherwise calibrating the binary. - --------------- -Version 0.40b: --------------- - - - Added support for parallelized fuzzing. Inspired by earlier patch - from Sebastian Roschke. - - - Added an example in examples/distributed_fuzzing/. - --------------- -Version 0.39b: --------------- - - - Redesigned status screen, now 90% more spiffy. - - - Added more verbose and user-friendly messages for some common problems. - - - Modified the resumption code to reconstruct path depth. - - - Changed the code to inhibit core dumps and improve the ability to detect - SEGVs. - - - Added a check for redirection of core dumps to programs. - - - Made a minor improvement to the handling of variable paths. - - - Made additional performance tweaks to afl-fuzz, chiefly around mem limits. - - - Added performance_tips.txt. - --------------- -Version 0.38b: --------------- - - - Fixed an fd leak and +cov tracking bug resulting from changes in 0.37b. - - - Implemented auto-scaling for screen update speed. - - - Added a visual indication when running in non-instrumented mode. - --------------- -Version 0.37b: --------------- - - - Added fuzz state tracking for more seamless resumption of aborted - fuzzing sessions. - - - Removed the -D option, as it's no longer necessary. - - - Refactored calibration code and improved startup reporting. - - - Implemented dynamically scaled timeouts, so that you don't need to - play with -t except in some very rare cases. - - - Added visual notification for slow binaries. - - - Improved instrumentation to explicitly cover the other leg of every - branch. - --------------- -Version 0.36b: --------------- - - - Implemented fork server support to avoid the overhead of execve(). A - nearly-verbatim design from Jann Horn; still pending part 2 that would - also skip initial setup steps (thinking about reliable heuristics now). - - - Added a check for shell scripts used as fuzz targets. - - - Added a check for fuzz jobs that don't seem to be finding anything. - - - Fixed the way IGNORE_FINDS works (was a bit broken after adding splicing - and path skip heuristics). - --------------- -Version 0.35b: --------------- - - - Properly integrated 64-bit instrumentation into afl-as. - --------------- -Version 0.34b: --------------- - - - Added a new exec count classifier (the working theory is that it gets - meaningful coverage with fewer test cases spewed out). - --------------- -Version 0.33b: --------------- - - - Switched to new, somewhat experimental instrumentation that tries to - target only arcs, rather than every line. May be fragile, but is a lot - faster (2x+). - - - Made several other cosmetic fixes and typo corrections, thanks to - Jakub Wilk. - --------------- -Version 0.32b: --------------- - - - Another take at fixing the C++ exception thing. Reported by Jakub Wilk. - --------------- -Version 0.31b: --------------- - - - Made another fix to afl-as to address a potential problem with newer - versions of GCC (introduced in 0.28b). Thanks to Jann Horn. - --------------- -Version 0.30b: --------------- - - - Added more detail about the underlying operations in file names. - --------------- -Version 0.29b: --------------- - - - Made some general improvements to chunk operations. - --------------- -Version 0.28b: --------------- - - - Fixed C++ exception handling in newer versions of GCC. Problem diagnosed - by Eberhard Mattes. - - - Fixed the handling of the overflow flag. Once again, thanks to - Eberhard Mattes. - --------------- -Version 0.27b: --------------- - - - Added prioritization of new paths over the already-fuzzed ones. - - - Included spliced test case ID in the output file name. - - - Fixed a rare, cosmetic null ptr deref after Ctrl-C. - - - Refactored the code to make copies of test cases in the output directory. - - - Switched to better output file names, keeping track of stage and splicing - sources. - --------------- -Version 0.26b: --------------- - - - Revamped storage of testcases, -u option removed, - - - Added a built-in effort minimizer to get rid of potentially redundant - inputs, - - - Provided a testcase count minimization script in examples/, - - - Made miscellaneous improvements to directory and file handling. - - - Fixed a bug in timeout detection. - --------------- -Version 0.25b: --------------- - - - Improved count-based instrumentation. - - - Improved the hang deduplication logic. - - - Added -cov prefixes for test cases. - - - Switched from readdir() to scandir() + alphasort() to preserve ordering of - test cases. - - - Added a splicing strategy. - - - Made various minor UI improvements and several other bugfixes. - --------------- -Version 0.24b: --------------- - - - Added program name to the status screen, plus the -T parameter to go with - it. - --------------- -Version 0.23b: --------------- - - - Improved the detection of variable behaviors. - - - Added path depth tracking, - - - Improved the UI a bit, - - - Switched to simplified (XOR-based) tuple instrumentation. - --------------- -Version 0.22b: --------------- - - - Refactored the handling of long bitflips and some swaps. - - - Fixed the handling of gcc -pipe, thanks to anonymous reporter. - ---------------------------- -Version 0.21b (2013-11-12): ---------------------------- - - - Initial public release. diff --git a/docs/ChangeLog.md b/docs/ChangeLog.md new file mode 100644 index 00000000..ad0b9e88 --- /dev/null +++ b/docs/ChangeLog.md @@ -0,0 +1,2420 @@ +# ChangeLog + + This is the list of all noteworthy changes made in every public release of + the tool. See README for the general instruction manual. + +## Staying informed + +Want to stay in the loop on major new features? Join our mailing list by +sending a mail to . + + +### Version ++2.60d (develop): + + - use -march=native if available + - afl-fuzz: + - now prints the real python version support compiled in + - set stronger performance compile options and little tweaks + - Android: prefer bigcores when selecting a CPU + - CmpLog forkserver + - Redqueen input-2-state mutator (cmp instructions only ATM) + - all Python 2+3 versions supported now + - afl-clang-fast: + - show in the help output for which llvm version it was compiled for + - now does not need to be recompiled between trace-pc and pass + instrumentation. compile normally and set AFL_LLVM_USE_TRACE_PC :) + - LLVM 11 is supported + - CmpLog instrumentation using SanCov (see llvm_mode/README.cmplog) + - CmpLog instrumentation for QEMU + - AFL_PERSISTENT_HOOK callback module for persistent QEMU + (see examples/qemu_persistent_hook) + - afl-cmin is now a sh script (invoking awk) instead of bash for portability + the original script is still present as afl-cmin.bash + - afl-showmap: -i dir option now allows processing multiple inputs using the + forkserver. This is for enhanced speed in afl-cmin. + - added blacklist and whitelisting function check in all modules of llvm_mode + - added fix from Debian project to compile libdislocator and libtokencap + - libdislocator: AFL_ALIGNED_ALLOC to force size alignment to max_align_t + + +### Version ++2.60c (release): + + - fixed a critical bug in afl-tmin that was introduced during ++2.53d + - added test cases for afl-cmin and afl-tmin to test/test.sh + - added ./examples/argv_fuzzing ld_preload library by Kjell Braden + - added preeny's desock_dup ld_preload library as + ./examples/socket_fuzzing for network fuzzing + - added AFL_AS_FORCE_INSTRUMENT environment variable for afl-as - this is + for the retrorewrite project + - we now set QEMU_SET_ENV from AFL_PRELOAD when qemu_mode is used + + +### Version ++2.59c (release): + + - qbdi_mode: fuzz android native libraries via QBDI framework + - unicorn_mode: switched to the new unicornafl, thanks domenukk + (see https://github.com/vanhauser-thc/unicorn) + - afl-fuzz: + - added radamsa as (an optional) mutator stage (-R[R]) + - added -u command line option to not unlink the fuzz input file + - Python3 support (autodetect) + - AFL_DISABLE_TRIM env var to disable the trim stage + - CPU affinity support for DragonFly + - llvm_mode: + - float splitting is now configured via AFL_LLVM_LAF_SPLIT_FLOATS + - support for llvm 10 included now (thanks to devnexen) + - libtokencap: + - support for *BSD/OSX/Dragonfly added + - hook common *cmp functions from widely used libraries + - compcov: + - hook common *cmp functions from widely used libraries + - floating point splitting support for QEMU on x86 targets + - qemu_mode: AFL_QEMU_DISABLE_CACHE env to disable QEMU TranslationBlocks caching + - afl-analyze: added AFL_SKIP_BIN_CHECK support + - better random numbers for gcc_plugin and llvm_mode (thanks to devnexen) + - Dockerfile by courtesy of devnexen + - added regex.dictionary + - qemu and unicorn download scripts now try to download until the full + download succeeded. f*ckin travis fails downloading 40% of the time! + - more support for Android (please test!) + - added the few Android stuff we didnt have already from Google afl repository + - removed unnecessary warnings + + +### Version ++2.58c (release): + + - reverted patch to not unlink and recreate the input file, it resulted in + performance loss of ~10% + - added test/test-performance.sh script + - (re)added gcc_plugin, fast inline instrumentation is not yet finished, + however it includes the whitelisting and persistance feature! by hexcoder- + - gcc_plugin tests added to testing framework + + +### Version ++2.54d-2.57c (release): + + - we jump to 2.57 instead of 2.55 to catch up with Google's versioning + - persistent mode for QEMU (see qemu_mode/README.md) + - custom mutator library is now an additional mutator, to exclusivly use it + add AFL_CUSTOM_MUTATOR_ONLY (that will trigger the previous behaviour) + - new library qemu_mode/unsigaction which filters sigaction events + - afl-fuzz: new command line option -I to execute a command on a new crash + - no more unlinking the input file, this way the input file can also be a + FIFO or disk partition + - setting LLVM_CONFIG for llvm_mode will now again switch to the selected + llvm version. If your setup is correct. + - fuzzing strategy yields for custom mutator were missing from the UI, added them :) + - added "make tests" which will perform checks to see that all functionality + is working as expected. this is currently the starting point, its not complete :) + - added mutation documentation feature ("make document"), creates afl-fuzz-document + and saves all mutations of the first run on the first file into out/queue/mutations + - libtokencap and libdislocator now compile to the afl_root directory and are + installed to the .../lib/afl directory when present during make install + - more BSD support, e.g. free CPU binding code for FreeBSD (thanks to devnexen) + - reducing duplicate code in afl-fuzz + - added "make help" + - removed compile warnings from python internal stuff + - added man page for afl-clang-fast[++] + - updated documentation + - Wine mode to run Win32 binaries with the QEMU instrumentation (-W) + - CompareCoverage for ARM target in QEMU/Unicorn + - laf-intel in llvm_mode now also handles floating point comparisons + + +### Version ++2.54c (release): + + - big code refactoring: + * all includes are now in include/ + * all afl sources are now in src/ - see src/README.src + * afl-fuzz was splitted up in various individual files for including + functionality in other programs (e.g. forkserver, memory map, etc.) + for better readability. + * new code indention everywhere + - auto-generating man pages for all (main) tools + - added AFL_FORCE_UI to show the UI even if the terminal is not detected + - llvm 9 is now supported (still needs testing) + - Android is now supported (thank to JoeyJiao!) - still need to modify the Makefile though + - fix building qemu on some Ubuntus (thanks to floyd!) + - custom mutator by a loaded library is now supported (thanks to kyakdan!) + - added PR that includes peak_rss_mb and slowest_exec_ms in the fuzzer_stats report + - more support for *BSD (thanks to devnexen!) + - fix building on *BSD (thanks to tobias.kortkamp for the patch) + - fix for a few features to support different map sized than 2^16 + - afl-showmap: new option -r now shows the real values in the buckets (stock + afl never did), plus shows tuple content summary information now + - small docu updates + - NeverZero counters for QEMU + - NeverZero counters for Unicorn + - CompareCoverage Unicorn + - immediates-only instrumentation for CompareCoverage + + +### Version ++2.53c (release): + + - README is now README.md + - imported the few minor changes from the 2.53b release + - unicorn_mode got added - thanks to domenukk for the patch! + - fix llvm_mode AFL_TRACE_PC with modern llvm + - fix a crash in qemu_mode which also exists in stock afl + - added libcompcov, a laf-intel implementation for qemu! :) + see qemu_mode/libcompcov/README.libcompcov + - afl-fuzz now displays the selected core in the status screen (blue {#}) + - updated afl-fuzz and afl-system-config for new scaling governor location + in modern kernels + - using the old ineffective afl-gcc will now show a deprecation warning + - all queue, hang and crash files now have their discovery time in their name + - if llvm_mode was compiled, afl-clang/afl-clang++ will point to these + instead of afl-gcc + - added instrim, a much faster llvm_mode instrumentation at the cost of + path discovery. See llvm_mode/README.instrim (https://github.com/csienslab/instrim) + - added MOpt (github.com/puppet-meteor/MOpt-AFL) mode, see docs/README.MOpt + - added code to make it more portable to other platforms than Intel Linux + - added never zero counters for afl-gcc and optionally (because of an + optimization issue in llvm < 9) for llvm_mode (AFL_LLVM_NEVER_ZERO=1) + - added a new doc about binary only fuzzing: docs/binaryonly_fuzzing.txt + - more cpu power for afl-system-config + - added forkserver patch to afl-tmin, makes it much faster (originally from + github.com/nccgroup/TriforceAFL) + - added whitelist support for llvm_mode via AFL_LLVM_WHITELIST to allow + only to instrument what is actually interesting. Gives more speed and less + map pollution (originally by choller@mozilla) + - added Python Module mutator support, python2.7-dev is autodetected. + see docs/python_mutators.txt (originally by choller@mozilla) + - added AFL_CAL_FAST for slow applications and AFL_DEBUG_CHILD_OUTPUT for + debugging + - added -V time and -E execs option to better comparison runs, runs afl-fuzz + for a specific time/executions. + - added a -s seed switch to allow afl run with a fixed initial + seed that is not updated. This is good for performance and path discovery + tests as the random numbers are deterministic then + - llvm_mode LAF_... env variables can now be specified as AFL_LLVM_LAF_... + that is longer but in line with other llvm specific env vars + + +### Version ++2.52c (2019-06-05): + + - Applied community patches. See docs/PATCHES for the full list. + LLVM and Qemu modes are now faster. + Important changes: + afl-fuzz: -e EXTENSION commandline option + llvm_mode: LAF-intel performance (needs activation, see llvm/README.laf-intel) + a few new environment variables for afl-fuzz, llvm and qemu, see docs/env_variables.txt + - Added the power schedules of AFLfast by Marcel Boehme, but set the default + to the AFL schedule, not to the FAST schedule. So nothing changes unless + you use the new -p option :-) - see docs/power_schedules.txt + - added afl-system-config script to set all system performance options for fuzzing + - llvm_mode works with llvm 3.9 up to including 8 ! + - qemu_mode got upgraded from 2.1 to 3.1 - incorporated from + https://github.com/andreafioraldi/afl and with community patches added + + +### Version 2.52b (2017-11-04): + + - Upgraded QEMU patches from 2.3.0 to 2.10.0. Required troubleshooting + several weird issues. All the legwork done by Andrew Griffiths. + + - Added setsid to afl-showmap. See the notes for 2.51b. + + - Added target mode (deferred, persistent, qemu, etc) to fuzzer_stats. + Requested by Jakub Wilk. + + - afl-tmin should now save a partially minimized file when Ctrl-C + is pressed. Suggested by Jakub Wilk. + + - Added an option for afl-analyze to dump offsets in hex. Suggested by + Jakub Wilk. + + - Added support for parameters in triage_crashes.sh. Patch by Adam of + DC949. + +### Version 2.51b (2017-08-30): + + - Made afl-tmin call setsid to prevent glibc traceback junk from showing + up on the terminal in some distros. Suggested by Jakub Wilk. + +### Version 2.50b (2017-08-19): + + - Fixed an interesting timing corner case spotted by Jakub Wilk. + + - Addressed a libtokencap / pthreads incompatibility issue. Likewise, spotted + by Jakub Wilk. + + - Added a mention of afl-kit and Pythia. + + - Added AFL_FAST_CAL. + + - In-place resume now preserves .synced. Suggested by Jakub Wilk. + +### Version 2.49b (2017-07-18): + + - Added AFL_TMIN_EXACT to allow path constraint for crash minimization. + + - Added dates for releases (retroactively for all of 2017). + +### Version 2.48b (2017-07-17): + + - Added AFL_ALLOW_TMP to permit some scripts to run in /tmp. + + - Fixed cwd handling in afl-analyze (similar to the quirk in afl-tmin). + + - Made it possible to point -o and -f to the same file in afl-tmin. + +### Version 2.47b (2017-07-14): + + - Fixed cwd handling in afl-tmin. Spotted by Jakub Wilk. + +### Version 2.46b (2017-07-10): + + - libdislocator now supports AFL_LD_NO_CALLOC_OVER for folks who do not + want to abort on calloc() overflows. + + - Made a minor fix to libtokencap. Reported by Daniel Stender. + + - Added a small JSON dictionary, inspired on a dictionary done by Jakub Wilk. + +### Version 2.45b (2017-07-04): + + - Added strstr, strcasestr support to libtokencap. Contributed by + Daniel Hodson. + + - Fixed a resumption offset glitch spotted by Jakub Wilk. + + - There are definitely no bugs in afl-showmap -c now. + +### Version 2.44b (2017-06-28): + + - Added a visual indicator of ASAN / MSAN mode when compiling. Requested + by Jakub Wilk. + + - Added support for afl-showmap coredumps (-c). Suggested by Jakub Wilk. + + - Added LD_BIND_NOW=1 for afl-showmap by default. Although not really useful, + it reportedly helps reproduce some crashes. Suggested by Jakub Wilk. + + - Added a note about allocator_may_return_null=1 not always working with + ASAN. Spotted by Jakub Wilk. + +### Version 2.43b (2017-06-16): + + - Added AFL_NO_ARITH to aid in the fuzzing of text-based formats. + Requested by Jakub Wilk. + +### Version 2.42b (2017-06-02): + + - Renamed the R() macro to avoid a problem with llvm_mode in the latest + versions of LLVM. Fix suggested by Christian Holler. + +### Version 2.41b (2017-04-12): + + - Addressed a major user complaint related to timeout detection. Timing out + inputs are now binned as "hangs" only if they exceed a far more generous + time limit than the one used to reject slow paths. + +### Version 2.40b (2017-04-02): + + - Fixed a minor oversight in the insertion strategy for dictionary words. + Spotted by Andrzej Jackowski. + + - Made a small improvement to the havoc block insertion strategy. + + - Adjusted color rules for "is it done yet?" indicators. + +### Version 2.39b (2017-02-02): + + - Improved error reporting in afl-cmin. Suggested by floyd. + + - Made a minor tweak to trace-pc-guard support. Suggested by kcc. + + - Added a mention of afl-monitor. + +### Version 2.38b (2017-01-22): + + - Added -mllvm -sanitizer-coverage-block-threshold=0 to trace-pc-guard + mode, as suggested by Kostya Serebryany. + +### Version 2.37b (2017-01-22): + + - Fixed a typo. Spotted by Jakub Wilk. + + - Fixed support for make install when using trace-pc. Spotted by + Kurt Roeckx. + + - Switched trace-pc to trace-pc-guard, which should be considerably + faster and is less quirky. Kudos to Konstantin Serebryany (and sorry + for dragging my feet). + + Note that for some reason, this mode doesn't perform as well as + "vanilla" afl-clang-fast / afl-clang. + +### Version 2.36b (2017-01-14): + + - Fixed a cosmetic bad free() bug when aborting -S sessions. Spotted + by Johannes S. + + - Made a small change to afl-whatsup to sort fuzzers by name. + + - Fixed a minor issue with malloc(0) in libdislocator. Spotted by + Rene Freingruber. + + - Changed the clobber pattern in libdislocator to a slightly more + reliable one. Suggested by Rene Freingruber. + + - Added a note about THP performance. Suggested by Sergey Davidoff. + + - Added a somewhat unofficial support for running afl-tmin with a + baseline "mask" that causes it to minimize only for edges that + are unique to the input file, but not to the "boring" baseline. + Suggested by Sami Liedes. + + - "Fixed" a getPassName() problem with newer versions of clang. + Reported by Craig Young and several other folks. + + Yep, I know I have a backlog on several other feature requests. + Stay tuned! + +### Version 2.35b: + + - Fixed a minor cmdline reporting glitch, spotted by Leo Barnes. + + - Fixed a silly bug in libdislocator. Spotted by Johannes Schultz. + +### Version 2.34b: + + - Added a note about afl-tmin to technical_details.txt. + + - Added support for AFL_NO_UI, as suggested by Leo Barnes. + +### Version 2.33b: + + - Added code to strip -Wl,-z,defs and -Wl,--no-undefined for afl-clang-fast, + since they interfere with -shared. Spotted and diagnosed by Toby Hutton. + + - Added some fuzzing tips for Android. + +### Version 2.32b: + + - Added a check for AFL_HARDEN combined with AFL_USE_*SAN. Suggested by + Hanno Boeck. + + - Made several other cosmetic adjustments to cycle timing in the wake of the + big tweak made in 2.31b. + +### Version 2.31b: + + - Changed havoc cycle counts for a marked performance boost, especially + with -S / -d. See the discussion of FidgetyAFL in: + + https://groups.google.com/forum/#!topic/afl-users/fOPeb62FZUg + + While this does not implement the approach proposed by the authors of + the CCS paper, the solution is a result of digging into that research; + more improvements may follow as I do more experiments and get more + definitive data. + +### Version 2.30b: + + - Made minor improvements to persistent mode to avoid the remote + possibility of "no instrumentation detected" issues with very low + instrumentation densities. + + - Fixed a minor glitch with a leftover process in persistent mode. + Reported by Jakub Wilk and Daniel Stender. + + - Made persistent mode bitmaps a bit more consistent and adjusted the way + this is shown in the UI, especially in persistent mode. + +### Version 2.29b: + + - Made a minor #include fix to llvm_mode. Suggested by Jonathan Metzman. + + - Made cosmetic updates to the docs. + +### Version 2.28b: + + - Added "life pro tips" to docs/. + + - Moved testcases/_extras/ to dictionaries/ for visibility. + + - Made minor improvements to install scripts. + + - Added an important safety tip. + +### Version 2.27b: + + - Added libtokencap, a simple feature to intercept strcmp / memcmp and + generate dictionary entries that can help extend coverage. + + - Moved libdislocator to its own dir, added README. + + - The demo in examples/instrumented_cmp is no more. + +### Version 2.26b: + + - Made a fix for libdislocator.so to compile on MacOS X. + + - Added support for DYLD_INSERT_LIBRARIES. + + - Renamed AFL_LD_PRELOAD to AFL_PRELOAD. + +### Version 2.25b: + + - Made some cosmetic updates to libdislocator.so, renamed one env + variable. + +### Version 2.24b: + + - Added libdislocator.so, an experimental, abusive allocator. Try + it out with AFL_LD_PRELOAD=/path/to/libdislocator.so when running + afl-fuzz. + +### Version 2.23b: + + - Improved the stability metric for persistent mode binaries. Problem + spotted by Kurt Roeckx. + + - Made a related improvement that may bring the metric to 100% for those + targets. + +### Version 2.22b: + + - Mentioned the potential conflicts between MSAN / ASAN and FORTIFY_SOURCE. + There is no automated check for this, since some distros may implicitly + set FORTIFY_SOURCE outside of the compiler's argv[]. + + - Populated the support for AFL_LD_PRELOAD to all companion tools. + + - Made a change to the handling of ./afl-clang-fast -v. Spotted by + Jan Kneschke. + +### Version 2.21b: + + - Added some crash reporting notes for Solaris in docs/INSTALL, as + investigated by Martin Carpenter. + + - Fixed a minor UI mix-up with havoc strategy stats. + +### Version 2.20b: + + - Revamped the handling of variable paths, replacing path count with a + "stability" score to give users a much better signal. Based on the + feedback from Vegard Nossum. + + - Made a stability improvement to the syncing behavior with resuming + fuzzers. Based on the feedback from Vegard. + + - Changed the UI to include current input bitmap density along with + total density. Ditto. + + - Added experimental support for parallelizing -M. + +### Version 2.19b: + + - Made a fix to make sure that auto CPU binding happens at non-overlapping + times. + +### Version 2.18b: + + - Made several performance improvements to has_new_bits() and + classify_counts(). This should offer a robust performance bump with + fast targets. + +### Version 2.17b: + + - Killed the error-prone and manual -Z option. On Linux, AFL will now + automatically bind to the first free core (or complain if there are no + free cores left). + + - Made some doc updates along these lines. + +### Version 2.16b: + + - Improved support for older versions of clang (hopefully without + breaking anything). + + - Moved version data from Makefile to config.h. Suggested by + Jonathan Metzman. + +### Version 2.15b: + + - Added a README section on looking for non-crashing bugs. + + - Added license data to several boring files. Contributed by + Jonathan Metzman. + +### Version 2.14b: + + - Added FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION as a macro defined when + compiling with afl-gcc and friends. Suggested by Kostya Serebryany. + + - Refreshed some of the non-x86 docs. + +### Version 2.13b: + + - Fixed a spurious build test error with trace-pc and llvm_mode/Makefile. + Spotted by Markus Teufelberger. + + - Fixed a cosmetic issue with afl-whatsup. Spotted by Brandon Perry. + +### Version 2.12b: + + - Fixed a minor issue in afl-tmin that can make alphabet minimization less + efficient during passes > 1. Spotted by Daniel Binderman. + +### Version 2.11b: + + - Fixed a minor typo in instrumented_cmp, spotted by Hanno Eissfeldt. + + - Added a missing size check for deterministic insertion steps. + + - Made an improvement to afl-gotcpu when -Z not used. + + - Fixed a typo in post_library_png.so.c in examples/. Spotted by Kostya + Serebryany. + +### Version 2.10b: + + - Fixed a minor core counting glitch, reported by Tyler Nighswander. + +### Version 2.09b: + + - Made several documentation updates. + + - Added some visual indicators to promote and simplify the use of -Z. + +### Version 2.08b: + + - Added explicit support for -m32 and -m64 for llvm_mode. Inspired by + a request from Christian Holler. + + - Added a new benchmarking option, as requested by Kostya Serebryany. + +### Version 2.07b: + + - Added CPU affinity option (-Z) on Linux. With some caution, this can + offer a significant (10%+) performance bump and reduce jitter. + Proposed by Austin Seipp. + + - Updated afl-gotcpu to use CPU affinity where supported. + + - Fixed confusing CPU_TARGET error messages with QEMU build. Spotted by + Daniel Komaromy and others. + +### Version 2.06b: + + - Worked around LLVM persistent mode hiccups with -shared code. + Contributed by Christian Holler. + + - Added __AFL_COMPILER as a convenient way to detect that something is + built under afl-gcc / afl-clang / afl-clang-fast and enable custom + optimizations in your code. Suggested by Pedro Corte-Real. + + - Upstreamed several minor changes developed by Franjo Ivancic to + allow AFL to be built as a library. This is fairly use-specific and + may have relatively little appeal to general audiences. + +### Version 2.05b: + + - Put __sanitizer_cov_module_init & co behind #ifdef to avoid problems + with ASAN. Spotted by Christian Holler. + +### Version 2.04b: + + - Removed indirect-calls coverage from -fsanitize-coverage (since it's + redundant). Spotted by Kostya Serebryany. + +### Version 2.03b: + + - Added experimental -fsanitize-coverage=trace-pc support that goes with + some recent additions to LLVM, as implemented by Kostya Serebryany. + Right now, this is cumbersome to use with common build systems, so + the mode remains undocumented. + + - Made several substantial improvements to better support non-standard + map sizes in LLVM mode. + + - Switched LLVM mode to thread-local execution tracing, which may offer + better results in some multithreaded apps. + + - Fixed a minor typo, reported by Heiko Eissfeldt. + + - Force-disabled symbolization for ASAN, as suggested by Christian Holler. + + - AFL_NOX86 renamed to AFL_NO_X86 for consistency. + + - Added AFL_LD_PRELOAD to allow LD_PRELOAD to be set for targets without + affecting AFL itself. Suggested by Daniel Godas-Lopez. + +### Version 2.02b: + + - Fixed a "lcamtuf can't count to 16" bug in the havoc stage. Reported + by Guillaume Endignoux. + +### Version 2.01b: + + - Made an improvement to cycle counter color coding, based on feedback + from Shai Sarfaty. + + - Added a mention of aflize to sister_projects.txt. + + - Fixed an installation issue with afl-as, as spotted by ilovezfs. + +### Version 2.00b: + + - Cleaned up color handling after a minor snafu in 1.99b (affecting some + terminals). + + - Made minor updates to the documentation. + +### Version 1.99b: + + - Substantially revamped the output and the internal logic of afl-analyze. + + - Cleaned up some of the color handling code and added support for + background colors. + + - Removed some stray files (oops). + + - Updated docs to better explain afl-analyze. + +### Version 1.98b: + + - Improved to "boring string" detection in afl-analyze. + + - Added technical_details.txt for afl-analyze. + +### Version 1.97b: + + - Added afl-analyze, a nifty tool to analyze the structure of a file + based on the feedback from AFL instrumentation. This is kinda experimental, + so field reports welcome. + + - Added a mention of afl-cygwin. + + - Fixed a couple of typos, as reported by Jakub Wilk and others. + +### Version 1.96b: + + - Added -fpic to CFLAGS for the clang plugin, as suggested by Hanno Boeck. + + - Made another clang change (IRBuilder) suggested by Jeff Trull. + + - Fixed several typos, spotted by Jakub Wilk. + + - Added support for AFL_SHUFFLE_QUEUE, based on discussions with + Christian Holler. + +### Version 1.95b: + + - Fixed a harmless bug when handling -B. Spotted by Jacek Wielemborek. + + - Made the exit message a bit more accurate when AFL_EXIT_WHEN_DONE is set. + + - Added some error-checking for old-style forkserver syntax. Suggested by + Ben Nagy. + + - Switched from exit() to _exit() in injected code to avoid snafus with + destructors in C++ code. Spotted by sunblate. + + - Made a change to avoid spuriously setting __AFL_SHM_ID when + AFL_DUMB_FORKSRV is set in conjunction with -n. Spotted by Jakub Wilk. + +### Version 1.94b: + + - Changed allocator alignment to improve support for non-x86 systems (now + that llvm_mode makes this more feasible). + + - Fixed a minor typo in afl-cmin. Spotted by Jonathan Neuschafer. + + - Fixed an obscure bug that would affect people trying to use afl-gcc + with $TMP set but $TMPDIR absent. Spotted by Jeremy Barnes. + +### Version 1.93b: + + - Hopefully fixed a problem with MacOS X and persistent mode, spotted by + Leo Barnes. + +### Version 1.92b: + + - Made yet another C++ fix (namespaces). Reported by Daniel Lockyer. + +### Version 1.91b: + + - Made another fix to make 1.90b actually work properly with C++ (d'oh). + Problem spotted by Daniel Lockyer. + +### Version 1.90b: + + - Fixed a minor typo spotted by Kai Zhao; and made several other minor updates + to docs. + + - Updated the project URL for python-afl. Requested by Jakub Wilk. + + - Fixed a potential problem with deferred mode signatures getting optimized + out by the linker (with --gc-sections). + +### Version 1.89b: + + - Revamped the support for persistent and deferred forkserver modes. + Both now feature simpler syntax and do not require companion env + variables. Suggested by Jakub Wilk. + + - Added a bit more info about afl-showmap. Suggested by Jacek Wielemborek. + +### Version 1.88b: + + - Made AFL_EXIT_WHEN_DONE work in non-tty mode. Issue spotted by + Jacek Wielemborek. + +### Version 1.87b: + + - Added QuickStartGuide.txt, a one-page quick start doc. + + - Fixed several typos spotted by Dominique Pelle. + + - Revamped several parts of README. + +### Version 1.86b: + + - Added support for AFL_SKIP_CRASHES, which is a very hackish solution to + the problem of resuming sessions with intermittently crashing inputs. + + - Removed the hard-fail terminal size check, replaced with a dynamic + warning shown in place of the UI. Based on feedback from Christian Holler. + + - Fixed a minor typo in show_stats. Spotted by Dingbao Xie. + +### Version 1.85b: + + - Fixed a garbled sentence in notes on parallel fuzzing. Thanks to Jakub Wilk. + + - Fixed a minor glitch in afl-cmin. Spotted by Jonathan Foote. + +### Version 1.84b: + + - Made SIMPLE_FILES behave as expected when naming backup directories for + crashes and hangs. + + - Added the total number of favored paths to fuzzer_stats. Requested by + Ben Nagy. + + - Made afl-tmin, afl-fuzz, and afl-cmin reject negative values passed to + -t and -m, since they generally won't work as expected. + + - Made a fix for no lahf / sahf support on older versions of FreeBSD. + Patch contributed by Alex Moneger. + +### Version 1.83b: + + - Fixed a problem with xargs -d on non-Linux systems in afl-cmin. Spotted by + teor2345 and Ben Nagy. + + - Fixed an implicit declaration in LLVM mode on MacOS X. Reported by + Kai Zhao. + +### Version 1.82b: + + - Fixed a harmless but annoying race condition in persistent mode - signal + delivery is a bit more finicky than I thought. + + - Updated the documentation to explain persistent mode a bit better. + + - Tweaked AFL_PERSISTENT to force AFL_NO_VAR_CHECK. + +### Version 1.81b: + + - Added persistent mode for in-process fuzzing. See llvm_mode/README.llvm. + Inspired by Kostya Serebryany and Christian Holler. + + - Changed the in-place resume code to preserve crashes/README.txt. Suggested + by Ben Nagy. + + - Included a potential fix for LLVM mode issues on MacOS X, based on the + investigation done by teor2345. + +### Version 1.80b: + + - Made afl-cmin tolerant of whitespaces in filenames. Suggested by + Jonathan Neuschafer and Ketil Froyn. + + - Added support for AFL_EXIT_WHEN_DONE, as suggested by Michael Rash. + +### Version 1.79b: + + - Added support for dictionary levels, see testcases/README.testcases. + + - Reworked the SQL dictionary to use levels. + + - Added a note about Preeny. + +### Version 1.78b: + + - Added a dictionary for PDF, contributed by Ben Nagy. + + - Added several references to afl-cov, a new tool by Michael Rash. + + - Fixed a problem with crash reporter detection on MacOS X, as reported by + Louis Dassy. + +### Version 1.77b: + + - Extended the -x option to support single-file dictionaries. + + - Replaced factory-packaged dictionaries with file-based variants. + + - Removed newlines from HTML keywords in testcases/_extras/html/. + +### Version 1.76b: + + - Very significantly reduced the number of duplicate execs during + deterministic checks, chiefly in int16 and int32 stages. Confirmed + identical path yields. This should improve early-stage efficiency by + around 5-10%. + + - Reduced the likelihood of duplicate non-deterministic execs by + bumping up lowest stacking factor from 1 to 2. Quickly confirmed + that this doesn't seem to have significant impact on coverage with + libpng. + + - Added a note about integrating afl-fuzz with third-party tools. + +### Version 1.75b: + + - Improved argv_fuzzing to allow it to emit empty args. Spotted by Jakub + Wilk. + + - afl-clang-fast now defines __AFL_HAVE_MANUAL_INIT. Suggested by Jakub Wilk. + + - Fixed a libtool-related bug with afl-clang-fast that would make some + ./configure invocations generate incorrect output. Spotted by Jakub Wilk. + + - Removed flock() on Solaris. This means no locking on this platform, + but so be it. Problem reported by Martin Carpenter. + + - Fixed a typo. Reported by Jakub Wilk. + +### Version 1.74b: + + - Added an example argv[] fuzzing wrapper in examples/argv_fuzzing. + Reworked the bash example to be faster, too. + + - Clarified llvm_mode prerequisites for FreeBSD. + + - Improved afl-tmin to use /tmp if cwd is not writeable. + + - Removed redundant includes for sys/fcntl.h, which caused warnings with + some nitpicky versions of libc. + + - Added a corpus of basic HTML tags that parsers are likely to pay attention + to (no attributes). + + - Added EP_EnabledOnOptLevel0 to llvm_mode, so that the instrumentation is + inserted even when AFL_DONT_OPTIMIZE=1 is set. + + - Switched qemu_mode to use the newly-released QEMU 2.3.0, which contains + a couple of minor bugfixes. + +### Version 1.73b: + + - Fixed a pretty stupid bug in effector maps that could sometimes cause + AFL to fuzz slightly more than necessary; and in very rare circumstances, + could lead to SEGV if eff_map is aligned with page boundary and followed + by an unmapped page. Spotted by Jonathan Gray. + +### Version 1.72b: + + - Fixed a glitch in non-x86 install, spotted by Tobias Ospelt. + + - Added a minor safeguard to llvm_mode Makefile following a report from + Kai Zhao. + +### Version 1.71b: + + - Fixed a bug with installed copies of AFL trying to use QEMU mode. Spotted + by G.M. Lime. + + - Added last path / crash / hang times to fuzzer_stats, suggested by + Richard Hipp. + + - Fixed a typo, thanks to Jakub Wilk. + +### Version 1.70b: + + - Modified resumption code to reuse the original timeout value when resuming + a session if -t is not given. This prevents timeout creep in continuous + fuzzing. + + - Added improved error messages for failed handshake when AFL_DEFER_FORKSRV + is set. + + - Made a slight improvement to llvm_mode/Makefile based on feedback from + Jakub Wilk. + + - Refreshed several bits of documentation. + + - Added a more prominent note about the MacOS X trade-offs to Makefile. + +### Version 1.69b: + + - Added support for deferred initialization in LLVM mode. Suggested by + Richard Godbee. + +### Version 1.68b: + + - Fixed a minor PRNG glitch that would make the first seconds of a fuzzing + job deterministic. Thanks to Andreas Stieger. + + - Made tmp[] static in the LLVM runtime to keep Valgrind happy (this had + no impact on anything else). Spotted by Richard Godbee. + + - Clarified the footnote in README. + +### Version 1.67b: + + - Made one more correction to llvm_mode Makefile, spotted by Jakub Wilk. + +### Version 1.66b: + + - Added CC / CXX support to llvm_mode Makefile. Requested by Charlie Eriksen. + + - Fixed 'make clean' with gmake. Suggested by Oliver Schneider. + + - Fixed 'make -j n clean all'. Suggested by Oliver Schneider. + + - Removed build date and time from banners to give people deterministic + builds. Requested by Jakub Wilk. + +### Version 1.65b: + + - Fixed a snafu with some leftover code in afl-clang-fast. + + - Corrected even moar typos. + +### Version 1.64b: + + - Further simplified afl-clang-fast runtime by reverting .init_array to + __attribute__((constructor(0)). This should improve compatibility with + non-ELF platforms. + + - Fixed a problem with afl-clang-fast and -shared libraries. Simplified + the code by getting rid of .preinit_array and replacing it with a .comm + object. Problem reported by Charlie Eriksen. + + - Removed unnecessary instrumentation density adjustment for the LLVM mode. + Reported by Jonathan Neuschafer. + +### Version 1.63b: + + - Updated cgroups_asan/ with a new version from Sam, made a couple changes + to streamline it and keep parallel afl instances in separate groups. + + - Fixed typos, thanks to Jakub Wilk. + +### Version 1.62b: + + - Improved the handling of -x in afl-clang-fast, + + - Improved the handling of low AFL_INST_RATIO settings for QEMU and + LLVM modes. + + - Fixed the llvm-config bug for good (thanks to Tobias Ospelt). + +### Version 1.61b: + + - Fixed an obscure bug compiling OpenSSL with afl-clang-fast. Patch by + Laszlo Szekeres. + + - Fixed a 'make install' bug on non-x86 systems, thanks to Tobias Ospelt. + + - Fixed a problem with half-broken llvm-config on Odroid, thanks to + Tobias Ospelt. (There is another odd bug there that hasn't been fully + fixed - TBD). + +### Version 1.60b: + + - Allowed examples/llvm_instrumentation/ to graduate to llvm_mode/. + + - Removed examples/arm_support/, since it's completely broken and likely + unnecessary with LLVM support in place. + + - Added ASAN cgroups script to examples/asan_cgroups/, updated existing + docs. Courtesy Sam Hakim and David A. Wheeler. + + - Refactored afl-tmin to reduce the number of execs in common use cases. + Ideas from Jonathan Neuschafer and Turo Lamminen. + + - Added a note about CLAs at the bottom of README. + + - Renamed testcases_readme.txt to README.testcases for some semblance of + consistency. + + - Made assorted updates to docs. + + - Added MEM_BARRIER() to afl-showmap and afl-tmin, just to be safe. + +### Version 1.59b: + + - Imported Laszlo Szekeres' experimental LLVM instrumentation into + examples/llvm_instrumentation. I'll work on including it in the + "mainstream" version soon. + + - Fixed another typo, thanks to Jakub Wilk. + +### Version 1.58b: + + - Added a workaround for abort() behavior in -lpthread programs in QEMU mode. + Spotted by Aidan Thornton. + + - Made several documentation updates, including links to the static + instrumentation tool (sister_projects.txt). + +### Version 1.57b: + + - Fixed a problem with exception handling on some versions of MacOS X. + Spotted by Samir Aguiar and Anders Wang Kristensen. + + - Tweaked afl-gcc to use BIN_PATH instead of a fixed string in help + messages. + +### Version 1.56b: + + - Renamed related_work.txt to historical_notes.txt. + + - Made minor edits to the ASAN doc. + + - Added docs/sister_projects.txt with a list of inspired or closely + related utilities. + +### Version 1.55b: + + - Fixed a glitch with afl-showmap opening /dev/null with O_RDONLY when + running in quiet mode. Spotted by Tyler Nighswander. + +### Version 1.54b: + + - Added another postprocessor example for PNG. + + - Made a cosmetic fix to realloc() handling in examples/post_library/, + suggested by Jakub Wilk. + + - Improved -ldl handling. Suggested by Jakub Wilk. + +### Version 1.53b: + + - Fixed an -l ordering issue that is apparently still a problem on Ubuntu. + Spotted by William Robinet. + +### Version 1.52b: + + - Added support for file format postprocessors. Requested by Ben Nagy. This + feature is intentionally buried, since it's fairly easy to misuse and + useful only in some scenarios. See examples/post_library/. + +### Version 1.51b: + + - Made it possible to properly override LD_BIND_NOW after one very unusual + report of trouble. + + - Cleaned up typos, thanks to Jakub Wilk. + + - Fixed a bug in AFL_DUMB_FORKSRV. + +### Version 1.50b: + + - Fixed a flock() bug that would prevent dir reuse errors from kicking + in every now and then. + + - Renamed references to ppvm (the project is now called recidivm). + + - Made improvements to file descriptor handling to avoid leaving some fds + unnecessarily open in the child process. + + - Fixed a typo or two. + +### Version 1.49b: + + - Added code to save original command line in fuzzer_stats and + crashes/README.txt. Also saves fuzzer version in fuzzer_stats. + Requested by Ben Nagy. + +### Version 1.48b: + + - Fixed a bug with QEMU fork server crashes when translation is attempted + after a jump to an invalid pointer in the child process (i.e., after + bumping into a particularly nasty security bug in the tested binary). + Reported by Tyler Nighswander. + +### Version 1.47b: + + - Fixed a bug with afl-cmin in -Q mode complaining about binary being not + instrumented. Thanks to Jonathan Neuschafer for the bug report. + + - Fixed another bug with argv handling for afl-fuzz in -Q mode. Reported + by Jonathan Neuschafer. + + - Improved the use of colors when showing crash counts in -C mode. + +### Version 1.46b: + + - Improved instrumentation performance on 32-bit systems by getting rid of + xor-swap (oddly enough, xor-swap is still faster on 64-bit) and tweaking + alignment. + + - Made path depth numbers more accurate with imported test cases. + +### Version 1.45b: + + - Added support for SIMPLE_FILES in config.h for folks who don't like + descriptive file names. Generates very simple names without colons, + commas, plus signs, dashes, etc. + + - Replaced zero-sized files with symlinks in the variable behavior state + dir to simplify examining the relevant test cases. + + - Changed the period of limited-range block ops from 5 to 10 minutes based + on a couple of experiments. The basic goal of this delay timer behavior + is to better support jobs that are seeded with completely invalid files, + in which case, the first few queue cycles may be completed very quickly + without discovering new paths. Should have no effect on well-seeded jobs. + + - Made several minor updates to docs. + +### Version 1.44b: + + - Corrected two bungled attempts to get the -C mode work properly + with afl-cmin (accounting for the short-lived releases tagged 1.42 and + 1.43b) - sorry. + + - Removed AFL_ALLOW_CRASHES in favor of the -C mode in said tool. + + - Said goodbye to Hello Kitty, as requested by Padraig Brady. + +### Version 1.41b: + + - Added AFL_ALLOW_CRASHES=1 to afl-cmin. Allows crashing inputs in the + output corpus. Changed the default behavior to disallow it. + + - Made the afl-cmin output dir default to 0700, not 0755, to be consistent + with afl-fuzz; documented the rationale for 0755 in afl-plot. + + - Lowered the output dir reuse time limit to 25 minutes as a dice-roll + compromise after a discussion on afl-users@. + + - Made afl-showmap accept -o /dev/null without borking out. + + - Added support for crash / hang info in exit codes of afl-showmap. + + - Tweaked block operation scaling to also factor in ballpark run time + in cases where queue passes take very little time. + + - Fixed typos and made improvements to several docs. + +### Version 1.40b: + + - Switched to smaller block op sizes during the first passes over the + queue. Helps keep test cases small. + + - Added memory barrier for run_target(), just in case compilers get + smarter than they are today. + + - Updated a bunch of docs. + +### Version 1.39b: + + - Added the ability to skip inputs by sending SIGUSR1 to the fuzzer. + + - Reworked several portions of the documentation. + + - Changed the code to reset splicing perf scores between runs to keep + them closer to intended length. + + - Reduced the minimum value of -t to 5 for afl-fuzz (~200 exec/sec) + and to 10 for auxiliary tools (due to the absence of a fork server). + + - Switched to more aggressive default timeouts (rounded up to 25 ms + versus 50 ms - ~40 execs/sec) and made several other cosmetic changes + to the timeout code. + +### Version 1.38b: + + - Fixed a bug in the QEMU build script, spotted by William Robinet. + + - Improved the reporting of skipped bitflips to keep the UI counters a bit + more accurate. + + - Cleaned up related_work.txt and added some non-goals. + + - Fixed typos, thanks to Jakub Wilk. + +### Version 1.37b: + + - Added effector maps, which detect regions that do not seem to respond + to bitflips and subsequently exclude them from more expensive steps + (arithmetics, known ints, etc). This should offer significant performance + improvements with quite a few types of text-based formats, reducing the + number of deterministic execs by a factor of 2 or so. + + - Cleaned up mem limit handling in afl-cmin. + + - Switched from uname -i to uname -m to work around Gentoo-specific + issues with coreutils when building QEMU. Reported by William Robinet. + + - Switched from PID checking to flock() to detect running sessions. + Problem, against all odds, bumped into by Jakub Wilk. + + - Added SKIP_COUNTS and changed the behavior of COVERAGE_ONLY in config.h. + Useful only for internal benchmarking. + + - Made improvements to UI refresh rates and exec/sec stats to make them + more stable. + + - Made assorted improvements to the documentation and to the QEMU build + script. + + - Switched from perror() to strerror() in error macros, thanks to Jakub + Wilk for the nag. + + - Moved afl-cmin back to bash, wasn't thinking straight. It has to stay + on bash because other shells may have restrictive limits on array sizes. + +### Version 1.36b: + + - Switched afl-cmin over to /bin/sh. Thanks to Jonathan Gray. + + - Fixed an off-by-one bug in queue limit check when resuming sessions + (could cause NULL ptr deref if you are *really* unlucky). + + - Fixed the QEMU script to tolerate i686 if returned by uname -i. Based on + a problem report from Sebastien Duquette. + + - Added multiple references to Jakub's ppvm tool. + + - Made several minor improvements to the Makefile. + + - Believe it or not, fixed some typos. Thanks to Jakub Wilk. + +### Version 1.35b: + + - Cleaned up regular expressions in some of the scripts to avoid errors + on *BSD systems. Spotted by Jonathan Gray. + +### Version 1.34b: + + - Performed a substantial documentation and program output cleanup to + better explain the QEMU feature. + +### Version 1.33b: + + - Added support for AFL_INST_RATIO and AFL_INST_LIBS in the QEMU mode. + + - Fixed a stack allocation crash in QEMU mode (bug in QEMU, fixed with + an extra patch applied to the downloaded release). + + - Added code to test the QEMU instrumentation once the afl-qemu-trace + binary is built. + + - Modified afl-tmin and afl-showmap to search $PATH for binaries and to + better handle QEMU support. + + - Added a check for instrumented binaries when passing -Q to afl-fuzz. + +### Version 1.32b: + + - Fixed 'make install' following the QEMU changes. Spotted by Hanno Boeck. + + - Fixed EXTRA_PAR handling in afl-cmin. + +### Version 1.31b: + + - Hallelujah! Thanks to Andrew Griffiths, we now support very fast, black-box + instrumentation of binary-only code. See qemu_mode/README.qemu. + + To use this feature, you need to follow the instructions in that + directory and then run afl-fuzz with -Q. + +### Version 1.30b: + + - Added -s (summary) option to afl-whatsup. Suggested by Jodie Cunningham. + + - Added a sanity check in afl-tmin to detect minimization to zero len or + excess hangs. + + - Fixed alphabet size counter in afl-tmin. + + - Slightly improved the handling of -B in afl-fuzz. + + - Fixed process crash messages with -m none. + +### Version 1.29b: + + - Improved the naming of test cases when orig: is already present in the file + name. + + - Made substantial improvements to technical_details.txt. + +### Version 1.28b: + + - Made a minor tweak to the instrumentation to preserve the directionality + of tuples (i.e., A -> B != B -> A) and to maintain the identity of tight + loops (A -> A). You need to recompile targeted binaries to leverage this. + + - Cleaned up some of the afl-whatsup stats. + + - Added several sanity checks to afl-cmin. + +### Version 1.27b: + + - Made afl-tmin recursive. Thanks to Hanno Boeck for the tip. + + - Added docs/technical_details.txt. + + - Changed afl-showmap search strategy in afl-cmap to just look into the + same place that afl-cmin is executed from. Thanks to Jakub Wilk. + + - Removed current_todo.txt and cleaned up the remaining docs. + +### Version 1.26b: + + - Added total execs/sec stat for afl-whatsup. + + - afl-cmin now auto-selects between cp or ln. Based on feedback from + Even Huus. + + - Fixed a typo. Thanks to Jakub Wilk. + + - Made afl-gotcpu a bit more accurate by using getrusage instead of + times. Thanks to Jakub Wilk. + + - Fixed a memory limit issue during the build process on NetBSD-current. + Reported by Thomas Klausner. + +### Version 1.25b: + + - Introduced afl-whatsup, a simple tool for querying the status of + local synced instances of afl-fuzz. + + - Added -x compiler to clang options on Darwin. Suggested by Filipe + Cabecinhas. + + - Improved exit codes for afl-gotcpu. + + - Improved the checks for -m and -t values in afl-cmin. Bug report + from Evan Huus. + +### Version 1.24b: + + - Introduced afl-getcpu, an experimental tool to empirically measure + CPU preemption rates. Thanks to Jakub Wilk for the idea. + +### Version 1.23b: + + - Reverted one change to afl-cmin that actually made it slower. + +### Version 1.22b: + + - Reworked afl-showmap.c to support normal options, including -o, -q, + -e. Also added support for timeouts and memory limits. + + - Made changes to afl-cmin and other scripts to accommodate the new + semantics. + + - Officially retired AFL_EDGES_ONLY. + + - Fixed another typo in afl-tmin, courtesy of Jakub Wilk. + +### Version 1.21b: + + - Graduated minimize_corpus.sh to afl-cmin. It is now a first-class + utility bundled with the fuzzer. + + - Made significant improvements to afl-cmin to make it faster, more + robust, and more versatile. + + - Refactored some of afl-tmin code to make it a bit more readable. + + - Made assorted changes to the doc to document afl-cmin and other stuff. + +### Version 1.20b: + + - Added AFL_DUMB_FORKSRV, as requested by Jakub Wilk. This works only + in -n mode and allows afl-fuzz to run with "dummy" fork servers that + don't output any instrumentation, but follow the same protocol. + + - Renamed AFL_SKIP_CHECKS to AFL_SKIP_BIN_CHECK to make it at least + somewhat descriptive. + + - Switched to using clang as the default assembler on MacOS X to work + around Xcode issues with newer builds of clang. Testing and patch by + Nico Weber. + + - Fixed a typo (via Jakub Wilk). + +### Version 1.19b: + + - Improved exec failure detection in afl-fuzz and afl-showmap. + + - Improved Ctrl-C handling in afl-showmap. + + - Added afl-tmin, a handy instrumentation-enabled minimizer. + +### Version 1.18b: + + - Fixed a serious but short-lived bug in the resumption behavior introduced + in version 1.16b. + + - Added -t nn+ mode for soft-skipping timing-out paths. + +### Version 1.17b: + + - Fixed a compiler warning introduced in 1.16b for newer versions of GCC. + Thanks to Jakub Wilk and Ilfak Guilfanov. + + - Improved the consistency of saving fuzzer_stats, bitmap info, and + auto-dictionaries when aborting fuzzing sessions. + + - Made several noticeable performance improvements to deterministic arith + and known int steps. + +### Version 1.16b: + + - Added a bit of code to make resumption pick up from the last known + offset in the queue, rather than always rewinding to the start. Suggested + by Jakub Wilk. + + - Switched to tighter timeout control for slow programs (3x rather than + 5x average exec speed at init). + +### Version 1.15b: + + - Added support for AFL_NO_VAR_CHECK to speed up resumption and inhibit + variable path warnings for some programs. + + - Made the trimmer run even for variable paths, since there is no special + harm in doing so and it can be very beneficial if the trimming still + pans out. + + - Made the UI a bit more descriptive by adding "n/a" instead of "0" in a + couple of corner cases. + +### Version 1.14b: + + - Added a (partial) dictionary for JavaScript. + + - Added AFL_NO_CPU_RED, as suggested by Jakub Wilk. + + - Tweaked the havoc scaling logic added in 1.12b. + +### Version 1.13b: + + - Improved the performance of minimize_corpus.sh by switching to a + sort-based approach. + + - Made several minor revisions to the docs. + +### Version 1.12b: + + - Made an improvement to dictionary generation to avoid runs of identical + bytes. + + - Added havoc cycle scaling to help with slow binaries in -d mode. Based on + a thread with Sami Liedes. + + - Added AFL_SYNC_FIRST for afl-fuzz. This is useful for those who obsess + over stats, no special purpose otherwise. + + - Switched to more robust box drawing codes, suggested by Jakub Wilk. + + - Created faster 64-bit variants of several critical-path bitmap functions + (sorry, no difference on 32 bits). + + - Fixed moar typos, as reported by Jakub Wilk. + +### Version 1.11b: + + - Added a bit more info about dictionary strategies to the status screen. + +### Version 1.10b: + + - Revised the dictionary behavior to use insertion and overwrite in + deterministic steps, rather than just the latter. This improves coverage + with SQL and the like. + + - Added a mention of "*" in status_screen.txt, as suggested by Jakub Wilk. + +### Version 1.09b: + + - Corrected a cosmetic problem with 'extras' stage count not always being + accurate in the stage yields view. + + - Fixed a typo reported by Jakub Wilk and made some minor documentation + improvements. + +### Version 1.08b: + + - Fixed a div-by-zero bug in the newly-added code when using a dictionary. + +### Version 1.07b: + + - Added code that automatically finds and extracts syntax tokens from the + input corpus. + + - Fixed a problem with ld dead-code removal option on MacOS X, reported + by Filipe Cabecinhas. + + - Corrected minor typos spotted by Jakub Wilk. + + - Added a couple of more exotic archive format samples. + +### Version 1.06b: + + - Switched to slightly more accurate (if still not very helpful) reporting + of short read and short write errors. These theoretically shouldn't happen + unless you kill the forkserver or run out of disk space. Suggested by + Jakub Wilk. + + - Revamped some of the allocator and debug code, adding comments and + cleaning up other mess. + + - Tweaked the odds of fuzzing non-favored test cases to make sure that + baseline coverage of all inputs is reached sooner. + +### Version 1.05b: + + - Added a dictionary for WebP. + + - Made some additional performance improvements to minimize_corpus.sh, + getting deeper into the bash woods. + +### Version 1.04b: + + - Made substantial performance improvements to minimize_corpus.sh with + large datasets, albeit at the expense of having to switch back to bash + (other shells may have limits on array sizes, etc). + + - Tweaked afl-showmap to support the format used by the new script. + +### Version 1.03b: + + - Added code to skip README.txt in the input directory to make the crash + exploration mode work better. Suggested by Jakub Wilk. + + - Added a dictionary for SQLite. + +### Version 1.02b: + + - Reverted the ./ search path in minimize_corpus.sh because people did + not like it. + + - Added very explicit warnings not to run various shell scripts that + read or write to /tmp/ (since this is generally a pretty bad idea on + multi-user systems). + + - Added a check for /tmp binaries and -f locations in afl-fuzz. + +### Version 1.01b: + + - Added dictionaries for XML and GIF. + +### Version 1.00b: + + - Slightly improved the performance of minimize_corpus.sh, especially on + Linux. + + - Made a couple of improvements to calibration timeouts for resumed scans. + +### Version 0.99b: + + - Fixed minimize_corpus.sh to work with dash, as suggested by Jakub Wilk. + + - Modified minimize_corpus.sh to try locate afl-showmap in $PATH and ./. + The first part requested by Jakub Wilk. + + - Added support for afl-as --version, as required by one funky build + script. Reported by William Robinet. + +### Version 0.98b: + + - Added a dictionary for TIFF. + + - Fixed another cosmetic snafu with stage exec counts for -x. + + - Switched afl-plot to /bin/sh, since it seems bashism-free. Also tried + to remove any obvious bashisms from other examples/ scripts, + most notably including minimize_corpus.sh and triage_crashes.sh. + Requested by Jonathan Gray. + +### Version 0.97b: + + - Fixed cosmetic issues around the naming of -x strategy files. + + - Added a dictionary for JPEG. + + - Fixed a very rare glitch when running instrumenting 64-bit code that makes + heavy use of xmm registers that are also touched by glibc. + +### Version 0.96b: + + - Added support for extra dictionaries, provided testcases/_extras/png/ + as a demo. + + - Fixed a minor bug in number formatting routines used by the UI. + + - Added several additional PNG test cases that are relatively unlikely + to be hit by chance. + + - Fixed afl-plot syntax for gnuplot 5.x. Reported by David Necas. + +### Version 0.95b: + + - Cleaned up the OSX ReportCrash code. Thanks to Tobias Ospelt for help. + + - Added some extra tips for AFL_NO_FORKSERVER on OSX. + + - Refreshed the INSTALL file. + +### Version 0.94b: + + - Added in-place resume (-i-) to address a common user complaint. + + - Added an awful workaround for ReportCrash on MacOS X. Problem + spotted by Joseph Gentle. + +### Version 0.93b: + + - Fixed the link() workaround, as reported by Jakub Wilk. + +### Version 0.92b: + + - Added support for reading test cases from another filesystem. + Requested by Jakub Wilk. + + - Added pointers to the mailing list. + + - Added a sample PDF document. + +### Version 0.91b: + + - Refactored minimize_corpus.sh to make it a bit more user-friendly and to + select for smallest files, not largest bitmaps. Offers a modest corpus + size improvement in most cases. + + - Slightly improved the performance of splicing code. + +### Version 0.90b: + + - Moved to an algorithm where paths are marked as preferred primarily based + on size and speed, rather than bitmap coverage. This should offer + noticeable performance gains in many use cases. + + - Refactored path calibration code; calibration now takes place as soon as a + test case is discovered, to facilitate better prioritization decisions later + on. + + - Changed the way of marking variable paths to avoid .state metadata + inconsistencies. + + - Made sure that calibration routines always create a new test case to avoid + hypothetical problems with utilities that modify the input file. + + - Added bitmap saturation to fuzzer stats and plot data. + + - Added a testcase for JPEG XR. + + - Added a tty check for the colors warning in Makefile, to keep distro build + logs tidy. Suggested by Jakub Wilk. + +### Version 0.89b: + + - Renamed afl-plot.sh to afl-plot, as requested by Padraig Brady. + + - Improved the compatibility of afl-plot with older versions of gnuplot. + + - Added banner information to fuzzer_stats, populated it to afl-plot. + +### Version 0.88b: + + - Added support for plotting, with design and implementation based on a + prototype design proposed by Michael Rash. Huge thanks! + + - Added afl-plot.sh, which allows you to, well, generate a nice plot using + this data. + + - Refactored the code slightly to make more frequent updates to fuzzer_stats + and to provide more detail about synchronization. + + - Added an fflush(stdout) call for non-tty operation, as requested by + Joonas Kuorilehto. + + - Added some detail to fuzzer_stats for parity with plot_file. + +### Version 0.87b: + + - Added support for MSAN, via AFL_USE_MSAN, same gotchas as for ASAN. + +### Version 0.86b: + + - Added AFL_NO_FORKSRV, allowing the forkserver to be bypassed. Suggested + by Ryan Govostes. + + - Simplified afl-showmap.c to make use of the no-forkserver mode. + + - Made minor improvements to crash_triage.sh, as suggested by Jakub Wilk. + +### Version 0.85b: + + - Fixed the CPU counting code - no sysctlbyname() on OpenBSD, d'oh. Bug + reported by Daniel Dickman. + + - Made a slight correction to error messages - the advice on testing + with ulimit was a tiny bit off by a factor of 1024. + +### Version 0.84b: + + - Added support for the CPU widget on some non-Linux platforms (I hope). + Based on feedback from Ryan Govostes. + + - Cleaned up the changelog (very meta). + +### Version 0.83b: + + - Added examples/clang_asm_normalize/ and related notes in + env_variables.txt and afl-as.c. Thanks to Ryan Govostes for the idea. + + - Added advice on hardware utilization in README. + +### Version 0.82b: + + - Made additional fixes for Xcode support, juggling -Q and -q flags. Thanks to + Ryan Govostes. + + - Added a check for __asm__ blocks and switches to .intel_syntax in assembly. + Based on feedback from Ryan Govostes. + +### Version 0.81b: + + - A workaround for Xcode 6 as -Q flag glitch. Spotted by Ryan Govostes. + + - Improved Solaris build instructions, as suggested by Martin Carpenter. + + - Fix for a slightly busted path scoring conditional. Minor practical impact. + +### Version 0.80b: + + - Added a check for $PATH-induced loops. Problem noticed by Kartik Agaram. + + - Added AFL_KEEP_ASSEMBLY for easier troubleshooting. + + - Added an override for AFL_USE_ASAN if set at afl compile time. Requested by + Hanno Boeck. + +### Version 0.79b: + + - Made minor adjustments to path skipping logic. + + - Made several documentation updates to reflect the path selection changes + made in 0.78b. + +### Version 0.78b: + + - Added a CPU governor check. Bug report from Joe Zbiciak. + + - Favored paths are now selected strictly based on new edges, not hit + counts. This speeds up the first pass by a factor of 3-6x without + significantly impacting ultimate coverage (tested with libgif, libpng, + libjpeg). + + It also allows some performance & memory usage improvements by making + some of the in-memory bitmaps much smaller. + + - Made multiple significant performance improvements to bitmap checking + functions, plus switched to a faster hash. + + - Owing largely to these optimizations, bumped the size of the bitmap to + 64k and added a warning to detect older binaries that rely on smaller + bitmaps. + +### Version 0.77b: + + - Added AFL_SKIP_CHECKS to bypass binary checks when really warranted. + Feature requested by Jakub Wilk. + + - Fixed a couple of typos. + + - Added a warning for runs that are aborted early on. + +### Version 0.76b: + + - Incorporated another signal handling fix for Solaris. Suggestion + submitted by Martin Carpenter. + +### Version 0.75b: + + - Implemented a slightly more "elegant" kludge for the %llu glitch (see + types.h). + + - Relaxed CPU load warnings to stay in sync with reality. + +### Version 0.74b: + + - Switched to more responsive exec speed averages and better UI speed + scaling. + + - Fixed a bug with interrupted reads on Solaris. Issue spotted by Martin + Carpenter. + +### Version 0.73b: + + - Fixed a stray memcpy() instead of memmove() on overlapping buffers. + Mostly harmless but still dumb. Mistake spotted thanks to David Higgs. + +### Version 0.72b: + + - Bumped map size up to 32k. You may want to recompile instrumented + binaries (but nothing horrible will happen if you don't). + + - Made huge performance improvements for bit-counting functions. + + - Default optimizations now include -funroll-loops. This should have + interesting effects on the instrumentation. Frankly, I'm just going to + ship it and see what happens next. I have a good feeling about this. + + - Made a fix for stack alignment crash on MacOS X 10.10; looks like the + rhetorical question in the comments in afl-as.h has been answered. + Tracked down by Mudge Zatko. + +### Version 0.71b: + + - Added a fix for the nonsensical MacOS ELF check. Spotted by Mudge Zatko. + + - Made some improvements to ASAN checks. + +### Version 0.70b: + + - Added explicit detection of ASANified binaries. + + - Fixed compilation issues on Solaris. Reported by Martin Carpenter. + +### Version 0.69b: + + - Improved the detection of non-instrumented binaries. + + - Made the crash counter in -C mode accurate. + + - Fixed an obscure install bug that made afl-as non-functional with the tool + installed to /usr/bin instead of /usr/local/bin. Found by Florian Kiersch. + + - Fixed for a cosmetic SIGFPE when Ctrl-C is pressed while the fork server + is spinning up. + +### Version 0.68b: + + - Added crash exploration mode! Woot! + +### Version 0.67b: + + - Fixed several more typos, the project is now cartified 100% typo-free. + Thanks to Thomas Jarosch and Jakub Wilk. + + - Made a change to write fuzzer_stats early on. + + - Fixed a glitch when (not!) running on MacOS X as root. Spotted by Tobias + Ospelt. + + - Made it possible to override -O3 in Makefile. Suggested by Jakub Wilk. + +### Version 0.66b: + + - Fixed a very obscure issue with build systems that use gcc as an assembler + for hand-written .s files; this would confuse afl-as. Affected nss, reported + by Hanno Boeck. + + - Fixed a bug when cleaning up synchronized fuzzer output dirs. Issue reported + by Thomas Jarosch. + +### Version 0.65b: + + - Cleaned up shell printf escape codes in Makefile. Reported by Jakub Wilk. + + - Added more color to fuzzer_stats, provided short documentation of the file + format, and made several other stats-related improvements. + +### Version 0.64b: + + - Enabled GCC support on MacOS X. + +### Version 0.63b: + + - Provided a new, simplified way to pass data in files (@@). See README. + + - Made additional fixes for 64-bit MacOS X, working around a crashing bug in + their linker (umpf) and several other things. It's alive! + + - Added a minor workaround for a bug in 64-bit FreeBSD (clang -m32 -g doesn't + work on that platform, but clang -m32 does, so we no longer insert -g). + + - Added a build-time warning for inverse video terminals and better + instructions in status_screen.txt. + +### Version 0.62b: + + - Made minor improvements to the allocator, as suggested by Tobias Ospelt. + + - Added example instrumented memcmp() in examples/instrumented_cmp. + + - Added a speculative fix for MacOS X (clang detection, again). + + - Fixed typos in parallel_fuzzing.txt. Problems spotted by Thomas Jarosch. + +### Version 0.61b: + + - Fixed a minor issue with clang detection on systems with a clang cc + wrapper, so that afl-gcc doesn't confuse it with GCC. + + - Made cosmetic improvements to docs and to the CPU load indicator. + + - Fixed a glitch with crash removal (README.txt left behind, d'oh). + +### Version 0.60b: + + - Fixed problems with jump tables generated by exotic versions of GCC. This + solves an outstanding problem on OpenBSD when using afl-gcc + PIE (not + present with afl-clang). + + - Fixed permissions on one of the sample archives. + + - Added a lahf / sahf workaround for OpenBSD (their assembler doesn't know + about these opcodes). + + - Added docs/INSTALL. + +### Version 0.59b: + + - Modified 'make install' to also install test cases. + + - Provided better pointers to installed README in afl-fuzz. + + - More work on RLIMIT_AS for OpenBSD. + +### Version 0.58b: + + - Added a core count check on Linux. + + - Refined the code for the lack-of-RLIMIT_AS case on OpenBSD. + + - Added a rudimentary CPU utilization meter to help with optimal loading. + +### Version 0.57b: + + - Made fixes to support FreeBSD and OpenBSD: use_64bit is now inferred if not + explicitly specified when calling afl-as, and RLIMIT_AS is behind an #ifdef. + Thanks to Fabian Keil and Jonathan Gray for helping troubleshoot this. + + - Modified 'make install' to also install docs (in /usr/local/share/doc/afl). + + - Fixed a typo in status_screen.txt. + + - Made a couple of Makefile improvements as proposed by Jakub Wilk. + +### Version 0.56b: + + - Added probabilistic instrumentation density reduction in ASAN mode. This + compensates for ASAN-specific branches in a crude but workable way. + + - Updated notes_for_asan.txt. + +### Version 0.55b: + + - Implemented smarter out_dir behavior, automatically deleting directories + that don't contain anything of special value. Requested by several folks, + including Hanno Boeck. + + - Added more detail in fuzzer_stats (start time, run time, fuzzer PID). + + - Implemented support for configurable install prefixes in Makefile + ($PREFIX), as requested by Luca Barbato. + + - Made it possible to resume by doing -i , without having to specify + -i /queue/. + +### Version 0.54b: + + - Added a fix for -Wformat warning messages (oops, I thought this had been in + place for a while). + +### Version 0.53b: + + - Redesigned the crash & hang duplicate detection code to better deal with + fault conditions that can be reached in a multitude of ways. + + The old approach could be compared to hashing stack traces to de-dupe + crashes, a method prone to crash count inflation. The alternative I + wanted to avoid would be equivalent to just looking at crash %eip, + which can have false negatives in common functions such as memcpy(). + + The middle ground currently used in afl-fuzz can be compared to looking + at every line item in the stack trace and tagging crashes as unique if + we see any function name that we haven't seen before (or if something that + we have *always* seen there suddenly disappears). We do the comparison + without paying any attention to ordering or hit counts. This can still + cause some crash inflation early on, but the problem will quickly taper + off. So, you may get 20 dupes instead of 5,000. + + - Added a fix for harmless but absurd trim ratios shown if the first exec in + the trimmer timed out. Spotted by @EspenGx. + +### Version 0.52b: + + - Added a quick summary of the contents in examples/. + + - Made a fix to the process of writing fuzzer_stats. + + - Slightly reorganized the .state/ directory, now recording redundant paths, + too. Note that this breaks the ability to properly resume older sessions + - sorry about that. + + (To fix this, simply move /.state/* from an older run + to /.state/deterministic_done/*.) + +### Version 0.51b: + + - Changed the search order for afl-as to avoid the problem with older copies + installed system-wide; this also means that I can remove the Makefile check + for that. + + - Made it possible to set instrumentation ratio of 0%. + + - Introduced some typos, fixed others. + + - Fixed the test_prev target in Makefile, as reported by Ozzy Johnson. + +### Version 0.50b: + + - Improved the 'make install' logic, as suggested by Padraig Brady. + + - Revamped various bits of the documentation, especially around perf_tips.txt; + based on the feedback from Alexander Cherepanov. + + - Added AFL_INST_RATIO to afl-as. The only case where this comes handy is + ffmpeg, at least as far as I can tell. (Trivia: the current version of + ffmpeg ./configure also ignores CC and --cc, probably unintentionally). + + - Added documentation for all environmental variables (env_variables.txt). + + - Implemented a visual warning for excessive or insufficient bitmap density. + + - Changed afl-gcc to add -O3 by default; use AFL_DONT_OPTIMIZE if you don't + like that. Big speed gain for ffmpeg, so seems like a good idea. + + - Made a regression fix to afl-as to ignore .LBB labels in gcc mode. + +### Version 0.49b: + + - Fixed more typos, as found by Jakub Wilk. + + - Added support for clang! + + - Changed AFL_HARDEN to *not* include ASAN by default. Use AFL_USE_ASAN if + needed. The reasons for this are in notes_for_asan.txt. + + - Switched from configure auto-detection to isatty() to keep afl-as and + afl-gcc quiet. + + - Improved installation process to properly create symlinks, rather than + copies of binaries. + +### Version 0.48b: + + - Improved afl-fuzz to force-set ASAN_OPTIONS=abort_on_error=1. Otherwise, + ASAN crashes wouldn't be caught at all. Reported by Hanno Boeck. + + - Improved Makefile mkdir logic, as suggested by Hanno Boeck. + + - Improved the 64-bit instrumentation to properly save r8-r11 registers in + the x86 setup code. The old behavior could cause rare problems running + *without* instrumentation when the first function called in a particular + .o file has 5+ parameters. No impact on code running under afl-fuzz or + afl-showmap. Issue spotted by Padraig Brady. + +### Version 0.47b: + + - Fixed another Makefile bug for parallel builds of afl. Problem identified + by Richard W. M. Jones. + + - Added support for suffixes for -m. + + - Updated the documentation and added notes_for_asan.txt. Based on feedback + from Hanno Boeck, Ben Laurie, and others. + + - Moved the project to http://lcamtuf.coredump.cx/afl/. + +### Version 0.46b: + + - Cleaned up Makefile dependencies for parallel builds. Requested by + Richard W. M. Jones. + + - Added support for DESTDIR in Makefile. Once again suggested by + Richard W. M. Jones :-) + + - Removed all the USE_64BIT stuff; we now just auto-detect compilation mode. + As requested by many callers to the show. + + - Fixed rare problems with programs that use snippets of assembly and + switch between .code32 and .code64. Addresses a glitch spotted by + Hanno Boeck with compiling ToT gdb. + +### Version 0.45b: + + - Implemented a test case trimmer. Results in 20-30% size reduction for many + types of work loads, with very pronounced improvements in path discovery + speeds. + + - Added better warnings for various problems with input directories. + + - Added a Makefile warning for older copies, based on counterintuitive + behavior observed by Hovik Manucharyan. + + - Added fuzzer_stats file for status monitoring. Suggested by @dronesec. + + - Fixed moar typos, thanks to Alexander Cherepanov. + + - Implemented better warnings for ASAN memory requirements, based on calls + from several angry listeners. + + - Switched to saner behavior with non-tty stdout (less output generated, + no ANSI art). + +### Version 0.44b: + + - Added support for AFL_CC and AFL_CXX, based on a patch from Ben Laurie. + + - Replaced afl-fuzz -S -D with -M for simplicity. + + - Added a check for .section .text; lack of this prevented main() from + getting instrumented for some users. Reported by Tom Ritter. + + - Reorganized the testcases/ directory. + + - Added an extra check to confirm that the build is operational. + + - Made more consistent use of color reset codes, as suggested by Oliver + Kunz. + +### Version 0.43b: + + - Fixed a bug with 64-bit gcc -shared relocs. + + - Removed echo -e from Makefile for compatibility with dash. Suggested + by Jakub Wilk. + + - Added status_screen.txt. + + - Added examples/canvas_harness. + + - Made a minor change to the Makefile GCC check. Suggested by Hanno Boeck. + +### Version 0.42b: + + - Fixed a bug with red zone handling for 64-bit (oops!). Problem reported by + Felix Groebert. + + - Implemented horribly experimental ARM support in examples/arm_support. + + - Made several improvements to error messages. + + - Added AFL_QUIET to silence afl-gcc and afl-as when using wonky build + systems. Reported by Hanno Boeck. + + - Improved check for 64-bit compilation, plus several sanity checks + in Makefile. + +### Version 0.41b: + + - Fixed a fork served bug for processes that call execve(). + + - Made minor compatibility fixes to Makefile, afl-gcc; suggested by Jakub + Wilk. + + - Fixed triage_crashes.sh to work with the new layout of output directories. + Suggested by Jakub Wilk. + + - Made multiple performance-related improvements to the injected + instrumentation. + + - Added visual indication of the number of imported paths. + + - Fixed afl-showmap to make it work well with new instrumentation. + + - Added much better error messages for crashes when importing test cases + or otherwise calibrating the binary. + +### Version 0.40b: + + - Added support for parallelized fuzzing. Inspired by earlier patch + from Sebastian Roschke. + + - Added an example in examples/distributed_fuzzing/. + +### Version 0.39b: + + - Redesigned status screen, now 90% more spiffy. + + - Added more verbose and user-friendly messages for some common problems. + + - Modified the resumption code to reconstruct path depth. + + - Changed the code to inhibit core dumps and improve the ability to detect + SEGVs. + + - Added a check for redirection of core dumps to programs. + + - Made a minor improvement to the handling of variable paths. + + - Made additional performance tweaks to afl-fuzz, chiefly around mem limits. + + - Added performance_tips.txt. + +### Version 0.38b: + + - Fixed an fd leak and +cov tracking bug resulting from changes in 0.37b. + + - Implemented auto-scaling for screen update speed. + + - Added a visual indication when running in non-instrumented mode. + +### Version 0.37b: + + - Added fuzz state tracking for more seamless resumption of aborted + fuzzing sessions. + + - Removed the -D option, as it's no longer necessary. + + - Refactored calibration code and improved startup reporting. + + - Implemented dynamically scaled timeouts, so that you don't need to + play with -t except in some very rare cases. + + - Added visual notification for slow binaries. + + - Improved instrumentation to explicitly cover the other leg of every + branch. + +### Version 0.36b: + + - Implemented fork server support to avoid the overhead of execve(). A + nearly-verbatim design from Jann Horn; still pending part 2 that would + also skip initial setup steps (thinking about reliable heuristics now). + + - Added a check for shell scripts used as fuzz targets. + + - Added a check for fuzz jobs that don't seem to be finding anything. + + - Fixed the way IGNORE_FINDS works (was a bit broken after adding splicing + and path skip heuristics). + +### Version 0.35b: + + - Properly integrated 64-bit instrumentation into afl-as. + +### Version 0.34b: + + - Added a new exec count classifier (the working theory is that it gets + meaningful coverage with fewer test cases spewed out). + +### Version 0.33b: + + - Switched to new, somewhat experimental instrumentation that tries to + target only arcs, rather than every line. May be fragile, but is a lot + faster (2x+). + + - Made several other cosmetic fixes and typo corrections, thanks to + Jakub Wilk. + +### Version 0.32b: + + - Another take at fixing the C++ exception thing. Reported by Jakub Wilk. + +### Version 0.31b: + + - Made another fix to afl-as to address a potential problem with newer + versions of GCC (introduced in 0.28b). Thanks to Jann Horn. + +### Version 0.30b: + + - Added more detail about the underlying operations in file names. + +### Version 0.29b: + + - Made some general improvements to chunk operations. + +### Version 0.28b: + + - Fixed C++ exception handling in newer versions of GCC. Problem diagnosed + by Eberhard Mattes. + + - Fixed the handling of the overflow flag. Once again, thanks to + Eberhard Mattes. + +### Version 0.27b: + + - Added prioritization of new paths over the already-fuzzed ones. + + - Included spliced test case ID in the output file name. + + - Fixed a rare, cosmetic null ptr deref after Ctrl-C. + + - Refactored the code to make copies of test cases in the output directory. + + - Switched to better output file names, keeping track of stage and splicing + sources. + +### Version 0.26b: + + - Revamped storage of testcases, -u option removed, + + - Added a built-in effort minimizer to get rid of potentially redundant + inputs, + + - Provided a testcase count minimization script in examples/, + + - Made miscellaneous improvements to directory and file handling. + + - Fixed a bug in timeout detection. + +### Version 0.25b: + + - Improved count-based instrumentation. + + - Improved the hang deduplication logic. + + - Added -cov prefixes for test cases. + + - Switched from readdir() to scandir() + alphasort() to preserve ordering of + test cases. + + - Added a splicing strategy. + + - Made various minor UI improvements and several other bugfixes. + +### Version 0.24b: + + - Added program name to the status screen, plus the -T parameter to go with + it. + +### Version 0.23b: + + - Improved the detection of variable behaviors. + + - Added path depth tracking, + + - Improved the UI a bit, + + - Switched to simplified (XOR-based) tuple instrumentation. + +### Version 0.22b: + + - Refactored the handling of long bitflips and some swaps. + + - Fixed the handling of gcc -pipe, thanks to anonymous reporter. + +### Version 0.21b (2013-11-12): + + - Initial public release. -- cgit 1.4.1 From 0403f008e3c68a9b212d38a5fc0de79eb2f40895 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Sat, 8 Feb 2020 12:14:00 +0100 Subject: solve small error on building new qemu patches for not x86 targets --- qemu_mode/patches/afl-qemu-cpu-translate-inl.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h index 3c230c30..06e73831 100644 --- a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h @@ -274,7 +274,7 @@ static void i386_restore_state_for_persistent(TCGv *cpu_regs) { tcg_gen_brcond_tl(TCG_COND_NE, first_pass, one, lbl_restore_gpr); // save GRP registers - for (i = 0; i < CPU_NB_REGS; ++i) { + for (i = 0; i < AFL_REGS_NUM; ++i) { gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); tcg_gen_st_tl(cpu_regs[i], gpr_sv, 0); @@ -288,7 +288,7 @@ static void i386_restore_state_for_persistent(TCGv *cpu_regs) { if (afl_persistent_hook_ptr) tcg_gen_afl_call0(callback_to_persistent_hook); // restore GRP registers - for (i = 0; i < CPU_NB_REGS; ++i) { + for (i = 0; i < AFL_REGS_NUM; ++i) { gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); tcg_gen_ld_tl(cpu_regs[i], gpr_sv, 0); -- cgit 1.4.1 From b5dae8e4f1b32cc256719e862e731fabc59029ba Mon Sep 17 00:00:00 2001 From: van Hauser Date: Sat, 8 Feb 2020 13:43:26 +0100 Subject: fix for md changes --- ChangeLog.md | 1 - Makefile | 2 +- docs/ChangeLog.md | 2420 ----------------------------------------------------- docs/Changelog.md | 2420 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 2421 insertions(+), 2422 deletions(-) delete mode 120000 ChangeLog.md delete mode 100644 docs/ChangeLog.md create mode 100644 docs/Changelog.md diff --git a/ChangeLog.md b/ChangeLog.md deleted file mode 120000 index 84ffa672..00000000 --- a/ChangeLog.md +++ /dev/null @@ -1 +0,0 @@ -docs/ChangeLog.md \ No newline at end of file diff --git a/Makefile b/Makefile index 70eac6b9..e1307fb1 100644 --- a/Makefile +++ b/Makefile @@ -423,7 +423,7 @@ endif install -m 755 afl-as $${DESTDIR}$(HELPER_PATH) ln -sf afl-as $${DESTDIR}$(HELPER_PATH)/as - install -m 644 docs/*.md docs/ChangeLog $${DESTDIR}$(DOC_PATH) + install -m 644 docs/*.md $${DESTDIR}$(DOC_PATH) cp -r testcases/ $${DESTDIR}$(MISC_PATH) cp -r dictionaries/ $${DESTDIR}$(MISC_PATH) diff --git a/docs/ChangeLog.md b/docs/ChangeLog.md deleted file mode 100644 index ad0b9e88..00000000 --- a/docs/ChangeLog.md +++ /dev/null @@ -1,2420 +0,0 @@ -# ChangeLog - - This is the list of all noteworthy changes made in every public release of - the tool. See README for the general instruction manual. - -## Staying informed - -Want to stay in the loop on major new features? Join our mailing list by -sending a mail to . - - -### Version ++2.60d (develop): - - - use -march=native if available - - afl-fuzz: - - now prints the real python version support compiled in - - set stronger performance compile options and little tweaks - - Android: prefer bigcores when selecting a CPU - - CmpLog forkserver - - Redqueen input-2-state mutator (cmp instructions only ATM) - - all Python 2+3 versions supported now - - afl-clang-fast: - - show in the help output for which llvm version it was compiled for - - now does not need to be recompiled between trace-pc and pass - instrumentation. compile normally and set AFL_LLVM_USE_TRACE_PC :) - - LLVM 11 is supported - - CmpLog instrumentation using SanCov (see llvm_mode/README.cmplog) - - CmpLog instrumentation for QEMU - - AFL_PERSISTENT_HOOK callback module for persistent QEMU - (see examples/qemu_persistent_hook) - - afl-cmin is now a sh script (invoking awk) instead of bash for portability - the original script is still present as afl-cmin.bash - - afl-showmap: -i dir option now allows processing multiple inputs using the - forkserver. This is for enhanced speed in afl-cmin. - - added blacklist and whitelisting function check in all modules of llvm_mode - - added fix from Debian project to compile libdislocator and libtokencap - - libdislocator: AFL_ALIGNED_ALLOC to force size alignment to max_align_t - - -### Version ++2.60c (release): - - - fixed a critical bug in afl-tmin that was introduced during ++2.53d - - added test cases for afl-cmin and afl-tmin to test/test.sh - - added ./examples/argv_fuzzing ld_preload library by Kjell Braden - - added preeny's desock_dup ld_preload library as - ./examples/socket_fuzzing for network fuzzing - - added AFL_AS_FORCE_INSTRUMENT environment variable for afl-as - this is - for the retrorewrite project - - we now set QEMU_SET_ENV from AFL_PRELOAD when qemu_mode is used - - -### Version ++2.59c (release): - - - qbdi_mode: fuzz android native libraries via QBDI framework - - unicorn_mode: switched to the new unicornafl, thanks domenukk - (see https://github.com/vanhauser-thc/unicorn) - - afl-fuzz: - - added radamsa as (an optional) mutator stage (-R[R]) - - added -u command line option to not unlink the fuzz input file - - Python3 support (autodetect) - - AFL_DISABLE_TRIM env var to disable the trim stage - - CPU affinity support for DragonFly - - llvm_mode: - - float splitting is now configured via AFL_LLVM_LAF_SPLIT_FLOATS - - support for llvm 10 included now (thanks to devnexen) - - libtokencap: - - support for *BSD/OSX/Dragonfly added - - hook common *cmp functions from widely used libraries - - compcov: - - hook common *cmp functions from widely used libraries - - floating point splitting support for QEMU on x86 targets - - qemu_mode: AFL_QEMU_DISABLE_CACHE env to disable QEMU TranslationBlocks caching - - afl-analyze: added AFL_SKIP_BIN_CHECK support - - better random numbers for gcc_plugin and llvm_mode (thanks to devnexen) - - Dockerfile by courtesy of devnexen - - added regex.dictionary - - qemu and unicorn download scripts now try to download until the full - download succeeded. f*ckin travis fails downloading 40% of the time! - - more support for Android (please test!) - - added the few Android stuff we didnt have already from Google afl repository - - removed unnecessary warnings - - -### Version ++2.58c (release): - - - reverted patch to not unlink and recreate the input file, it resulted in - performance loss of ~10% - - added test/test-performance.sh script - - (re)added gcc_plugin, fast inline instrumentation is not yet finished, - however it includes the whitelisting and persistance feature! by hexcoder- - - gcc_plugin tests added to testing framework - - -### Version ++2.54d-2.57c (release): - - - we jump to 2.57 instead of 2.55 to catch up with Google's versioning - - persistent mode for QEMU (see qemu_mode/README.md) - - custom mutator library is now an additional mutator, to exclusivly use it - add AFL_CUSTOM_MUTATOR_ONLY (that will trigger the previous behaviour) - - new library qemu_mode/unsigaction which filters sigaction events - - afl-fuzz: new command line option -I to execute a command on a new crash - - no more unlinking the input file, this way the input file can also be a - FIFO or disk partition - - setting LLVM_CONFIG for llvm_mode will now again switch to the selected - llvm version. If your setup is correct. - - fuzzing strategy yields for custom mutator were missing from the UI, added them :) - - added "make tests" which will perform checks to see that all functionality - is working as expected. this is currently the starting point, its not complete :) - - added mutation documentation feature ("make document"), creates afl-fuzz-document - and saves all mutations of the first run on the first file into out/queue/mutations - - libtokencap and libdislocator now compile to the afl_root directory and are - installed to the .../lib/afl directory when present during make install - - more BSD support, e.g. free CPU binding code for FreeBSD (thanks to devnexen) - - reducing duplicate code in afl-fuzz - - added "make help" - - removed compile warnings from python internal stuff - - added man page for afl-clang-fast[++] - - updated documentation - - Wine mode to run Win32 binaries with the QEMU instrumentation (-W) - - CompareCoverage for ARM target in QEMU/Unicorn - - laf-intel in llvm_mode now also handles floating point comparisons - - -### Version ++2.54c (release): - - - big code refactoring: - * all includes are now in include/ - * all afl sources are now in src/ - see src/README.src - * afl-fuzz was splitted up in various individual files for including - functionality in other programs (e.g. forkserver, memory map, etc.) - for better readability. - * new code indention everywhere - - auto-generating man pages for all (main) tools - - added AFL_FORCE_UI to show the UI even if the terminal is not detected - - llvm 9 is now supported (still needs testing) - - Android is now supported (thank to JoeyJiao!) - still need to modify the Makefile though - - fix building qemu on some Ubuntus (thanks to floyd!) - - custom mutator by a loaded library is now supported (thanks to kyakdan!) - - added PR that includes peak_rss_mb and slowest_exec_ms in the fuzzer_stats report - - more support for *BSD (thanks to devnexen!) - - fix building on *BSD (thanks to tobias.kortkamp for the patch) - - fix for a few features to support different map sized than 2^16 - - afl-showmap: new option -r now shows the real values in the buckets (stock - afl never did), plus shows tuple content summary information now - - small docu updates - - NeverZero counters for QEMU - - NeverZero counters for Unicorn - - CompareCoverage Unicorn - - immediates-only instrumentation for CompareCoverage - - -### Version ++2.53c (release): - - - README is now README.md - - imported the few minor changes from the 2.53b release - - unicorn_mode got added - thanks to domenukk for the patch! - - fix llvm_mode AFL_TRACE_PC with modern llvm - - fix a crash in qemu_mode which also exists in stock afl - - added libcompcov, a laf-intel implementation for qemu! :) - see qemu_mode/libcompcov/README.libcompcov - - afl-fuzz now displays the selected core in the status screen (blue {#}) - - updated afl-fuzz and afl-system-config for new scaling governor location - in modern kernels - - using the old ineffective afl-gcc will now show a deprecation warning - - all queue, hang and crash files now have their discovery time in their name - - if llvm_mode was compiled, afl-clang/afl-clang++ will point to these - instead of afl-gcc - - added instrim, a much faster llvm_mode instrumentation at the cost of - path discovery. See llvm_mode/README.instrim (https://github.com/csienslab/instrim) - - added MOpt (github.com/puppet-meteor/MOpt-AFL) mode, see docs/README.MOpt - - added code to make it more portable to other platforms than Intel Linux - - added never zero counters for afl-gcc and optionally (because of an - optimization issue in llvm < 9) for llvm_mode (AFL_LLVM_NEVER_ZERO=1) - - added a new doc about binary only fuzzing: docs/binaryonly_fuzzing.txt - - more cpu power for afl-system-config - - added forkserver patch to afl-tmin, makes it much faster (originally from - github.com/nccgroup/TriforceAFL) - - added whitelist support for llvm_mode via AFL_LLVM_WHITELIST to allow - only to instrument what is actually interesting. Gives more speed and less - map pollution (originally by choller@mozilla) - - added Python Module mutator support, python2.7-dev is autodetected. - see docs/python_mutators.txt (originally by choller@mozilla) - - added AFL_CAL_FAST for slow applications and AFL_DEBUG_CHILD_OUTPUT for - debugging - - added -V time and -E execs option to better comparison runs, runs afl-fuzz - for a specific time/executions. - - added a -s seed switch to allow afl run with a fixed initial - seed that is not updated. This is good for performance and path discovery - tests as the random numbers are deterministic then - - llvm_mode LAF_... env variables can now be specified as AFL_LLVM_LAF_... - that is longer but in line with other llvm specific env vars - - -### Version ++2.52c (2019-06-05): - - - Applied community patches. See docs/PATCHES for the full list. - LLVM and Qemu modes are now faster. - Important changes: - afl-fuzz: -e EXTENSION commandline option - llvm_mode: LAF-intel performance (needs activation, see llvm/README.laf-intel) - a few new environment variables for afl-fuzz, llvm and qemu, see docs/env_variables.txt - - Added the power schedules of AFLfast by Marcel Boehme, but set the default - to the AFL schedule, not to the FAST schedule. So nothing changes unless - you use the new -p option :-) - see docs/power_schedules.txt - - added afl-system-config script to set all system performance options for fuzzing - - llvm_mode works with llvm 3.9 up to including 8 ! - - qemu_mode got upgraded from 2.1 to 3.1 - incorporated from - https://github.com/andreafioraldi/afl and with community patches added - - -### Version 2.52b (2017-11-04): - - - Upgraded QEMU patches from 2.3.0 to 2.10.0. Required troubleshooting - several weird issues. All the legwork done by Andrew Griffiths. - - - Added setsid to afl-showmap. See the notes for 2.51b. - - - Added target mode (deferred, persistent, qemu, etc) to fuzzer_stats. - Requested by Jakub Wilk. - - - afl-tmin should now save a partially minimized file when Ctrl-C - is pressed. Suggested by Jakub Wilk. - - - Added an option for afl-analyze to dump offsets in hex. Suggested by - Jakub Wilk. - - - Added support for parameters in triage_crashes.sh. Patch by Adam of - DC949. - -### Version 2.51b (2017-08-30): - - - Made afl-tmin call setsid to prevent glibc traceback junk from showing - up on the terminal in some distros. Suggested by Jakub Wilk. - -### Version 2.50b (2017-08-19): - - - Fixed an interesting timing corner case spotted by Jakub Wilk. - - - Addressed a libtokencap / pthreads incompatibility issue. Likewise, spotted - by Jakub Wilk. - - - Added a mention of afl-kit and Pythia. - - - Added AFL_FAST_CAL. - - - In-place resume now preserves .synced. Suggested by Jakub Wilk. - -### Version 2.49b (2017-07-18): - - - Added AFL_TMIN_EXACT to allow path constraint for crash minimization. - - - Added dates for releases (retroactively for all of 2017). - -### Version 2.48b (2017-07-17): - - - Added AFL_ALLOW_TMP to permit some scripts to run in /tmp. - - - Fixed cwd handling in afl-analyze (similar to the quirk in afl-tmin). - - - Made it possible to point -o and -f to the same file in afl-tmin. - -### Version 2.47b (2017-07-14): - - - Fixed cwd handling in afl-tmin. Spotted by Jakub Wilk. - -### Version 2.46b (2017-07-10): - - - libdislocator now supports AFL_LD_NO_CALLOC_OVER for folks who do not - want to abort on calloc() overflows. - - - Made a minor fix to libtokencap. Reported by Daniel Stender. - - - Added a small JSON dictionary, inspired on a dictionary done by Jakub Wilk. - -### Version 2.45b (2017-07-04): - - - Added strstr, strcasestr support to libtokencap. Contributed by - Daniel Hodson. - - - Fixed a resumption offset glitch spotted by Jakub Wilk. - - - There are definitely no bugs in afl-showmap -c now. - -### Version 2.44b (2017-06-28): - - - Added a visual indicator of ASAN / MSAN mode when compiling. Requested - by Jakub Wilk. - - - Added support for afl-showmap coredumps (-c). Suggested by Jakub Wilk. - - - Added LD_BIND_NOW=1 for afl-showmap by default. Although not really useful, - it reportedly helps reproduce some crashes. Suggested by Jakub Wilk. - - - Added a note about allocator_may_return_null=1 not always working with - ASAN. Spotted by Jakub Wilk. - -### Version 2.43b (2017-06-16): - - - Added AFL_NO_ARITH to aid in the fuzzing of text-based formats. - Requested by Jakub Wilk. - -### Version 2.42b (2017-06-02): - - - Renamed the R() macro to avoid a problem with llvm_mode in the latest - versions of LLVM. Fix suggested by Christian Holler. - -### Version 2.41b (2017-04-12): - - - Addressed a major user complaint related to timeout detection. Timing out - inputs are now binned as "hangs" only if they exceed a far more generous - time limit than the one used to reject slow paths. - -### Version 2.40b (2017-04-02): - - - Fixed a minor oversight in the insertion strategy for dictionary words. - Spotted by Andrzej Jackowski. - - - Made a small improvement to the havoc block insertion strategy. - - - Adjusted color rules for "is it done yet?" indicators. - -### Version 2.39b (2017-02-02): - - - Improved error reporting in afl-cmin. Suggested by floyd. - - - Made a minor tweak to trace-pc-guard support. Suggested by kcc. - - - Added a mention of afl-monitor. - -### Version 2.38b (2017-01-22): - - - Added -mllvm -sanitizer-coverage-block-threshold=0 to trace-pc-guard - mode, as suggested by Kostya Serebryany. - -### Version 2.37b (2017-01-22): - - - Fixed a typo. Spotted by Jakub Wilk. - - - Fixed support for make install when using trace-pc. Spotted by - Kurt Roeckx. - - - Switched trace-pc to trace-pc-guard, which should be considerably - faster and is less quirky. Kudos to Konstantin Serebryany (and sorry - for dragging my feet). - - Note that for some reason, this mode doesn't perform as well as - "vanilla" afl-clang-fast / afl-clang. - -### Version 2.36b (2017-01-14): - - - Fixed a cosmetic bad free() bug when aborting -S sessions. Spotted - by Johannes S. - - - Made a small change to afl-whatsup to sort fuzzers by name. - - - Fixed a minor issue with malloc(0) in libdislocator. Spotted by - Rene Freingruber. - - - Changed the clobber pattern in libdislocator to a slightly more - reliable one. Suggested by Rene Freingruber. - - - Added a note about THP performance. Suggested by Sergey Davidoff. - - - Added a somewhat unofficial support for running afl-tmin with a - baseline "mask" that causes it to minimize only for edges that - are unique to the input file, but not to the "boring" baseline. - Suggested by Sami Liedes. - - - "Fixed" a getPassName() problem with newer versions of clang. - Reported by Craig Young and several other folks. - - Yep, I know I have a backlog on several other feature requests. - Stay tuned! - -### Version 2.35b: - - - Fixed a minor cmdline reporting glitch, spotted by Leo Barnes. - - - Fixed a silly bug in libdislocator. Spotted by Johannes Schultz. - -### Version 2.34b: - - - Added a note about afl-tmin to technical_details.txt. - - - Added support for AFL_NO_UI, as suggested by Leo Barnes. - -### Version 2.33b: - - - Added code to strip -Wl,-z,defs and -Wl,--no-undefined for afl-clang-fast, - since they interfere with -shared. Spotted and diagnosed by Toby Hutton. - - - Added some fuzzing tips for Android. - -### Version 2.32b: - - - Added a check for AFL_HARDEN combined with AFL_USE_*SAN. Suggested by - Hanno Boeck. - - - Made several other cosmetic adjustments to cycle timing in the wake of the - big tweak made in 2.31b. - -### Version 2.31b: - - - Changed havoc cycle counts for a marked performance boost, especially - with -S / -d. See the discussion of FidgetyAFL in: - - https://groups.google.com/forum/#!topic/afl-users/fOPeb62FZUg - - While this does not implement the approach proposed by the authors of - the CCS paper, the solution is a result of digging into that research; - more improvements may follow as I do more experiments and get more - definitive data. - -### Version 2.30b: - - - Made minor improvements to persistent mode to avoid the remote - possibility of "no instrumentation detected" issues with very low - instrumentation densities. - - - Fixed a minor glitch with a leftover process in persistent mode. - Reported by Jakub Wilk and Daniel Stender. - - - Made persistent mode bitmaps a bit more consistent and adjusted the way - this is shown in the UI, especially in persistent mode. - -### Version 2.29b: - - - Made a minor #include fix to llvm_mode. Suggested by Jonathan Metzman. - - - Made cosmetic updates to the docs. - -### Version 2.28b: - - - Added "life pro tips" to docs/. - - - Moved testcases/_extras/ to dictionaries/ for visibility. - - - Made minor improvements to install scripts. - - - Added an important safety tip. - -### Version 2.27b: - - - Added libtokencap, a simple feature to intercept strcmp / memcmp and - generate dictionary entries that can help extend coverage. - - - Moved libdislocator to its own dir, added README. - - - The demo in examples/instrumented_cmp is no more. - -### Version 2.26b: - - - Made a fix for libdislocator.so to compile on MacOS X. - - - Added support for DYLD_INSERT_LIBRARIES. - - - Renamed AFL_LD_PRELOAD to AFL_PRELOAD. - -### Version 2.25b: - - - Made some cosmetic updates to libdislocator.so, renamed one env - variable. - -### Version 2.24b: - - - Added libdislocator.so, an experimental, abusive allocator. Try - it out with AFL_LD_PRELOAD=/path/to/libdislocator.so when running - afl-fuzz. - -### Version 2.23b: - - - Improved the stability metric for persistent mode binaries. Problem - spotted by Kurt Roeckx. - - - Made a related improvement that may bring the metric to 100% for those - targets. - -### Version 2.22b: - - - Mentioned the potential conflicts between MSAN / ASAN and FORTIFY_SOURCE. - There is no automated check for this, since some distros may implicitly - set FORTIFY_SOURCE outside of the compiler's argv[]. - - - Populated the support for AFL_LD_PRELOAD to all companion tools. - - - Made a change to the handling of ./afl-clang-fast -v. Spotted by - Jan Kneschke. - -### Version 2.21b: - - - Added some crash reporting notes for Solaris in docs/INSTALL, as - investigated by Martin Carpenter. - - - Fixed a minor UI mix-up with havoc strategy stats. - -### Version 2.20b: - - - Revamped the handling of variable paths, replacing path count with a - "stability" score to give users a much better signal. Based on the - feedback from Vegard Nossum. - - - Made a stability improvement to the syncing behavior with resuming - fuzzers. Based on the feedback from Vegard. - - - Changed the UI to include current input bitmap density along with - total density. Ditto. - - - Added experimental support for parallelizing -M. - -### Version 2.19b: - - - Made a fix to make sure that auto CPU binding happens at non-overlapping - times. - -### Version 2.18b: - - - Made several performance improvements to has_new_bits() and - classify_counts(). This should offer a robust performance bump with - fast targets. - -### Version 2.17b: - - - Killed the error-prone and manual -Z option. On Linux, AFL will now - automatically bind to the first free core (or complain if there are no - free cores left). - - - Made some doc updates along these lines. - -### Version 2.16b: - - - Improved support for older versions of clang (hopefully without - breaking anything). - - - Moved version data from Makefile to config.h. Suggested by - Jonathan Metzman. - -### Version 2.15b: - - - Added a README section on looking for non-crashing bugs. - - - Added license data to several boring files. Contributed by - Jonathan Metzman. - -### Version 2.14b: - - - Added FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION as a macro defined when - compiling with afl-gcc and friends. Suggested by Kostya Serebryany. - - - Refreshed some of the non-x86 docs. - -### Version 2.13b: - - - Fixed a spurious build test error with trace-pc and llvm_mode/Makefile. - Spotted by Markus Teufelberger. - - - Fixed a cosmetic issue with afl-whatsup. Spotted by Brandon Perry. - -### Version 2.12b: - - - Fixed a minor issue in afl-tmin that can make alphabet minimization less - efficient during passes > 1. Spotted by Daniel Binderman. - -### Version 2.11b: - - - Fixed a minor typo in instrumented_cmp, spotted by Hanno Eissfeldt. - - - Added a missing size check for deterministic insertion steps. - - - Made an improvement to afl-gotcpu when -Z not used. - - - Fixed a typo in post_library_png.so.c in examples/. Spotted by Kostya - Serebryany. - -### Version 2.10b: - - - Fixed a minor core counting glitch, reported by Tyler Nighswander. - -### Version 2.09b: - - - Made several documentation updates. - - - Added some visual indicators to promote and simplify the use of -Z. - -### Version 2.08b: - - - Added explicit support for -m32 and -m64 for llvm_mode. Inspired by - a request from Christian Holler. - - - Added a new benchmarking option, as requested by Kostya Serebryany. - -### Version 2.07b: - - - Added CPU affinity option (-Z) on Linux. With some caution, this can - offer a significant (10%+) performance bump and reduce jitter. - Proposed by Austin Seipp. - - - Updated afl-gotcpu to use CPU affinity where supported. - - - Fixed confusing CPU_TARGET error messages with QEMU build. Spotted by - Daniel Komaromy and others. - -### Version 2.06b: - - - Worked around LLVM persistent mode hiccups with -shared code. - Contributed by Christian Holler. - - - Added __AFL_COMPILER as a convenient way to detect that something is - built under afl-gcc / afl-clang / afl-clang-fast and enable custom - optimizations in your code. Suggested by Pedro Corte-Real. - - - Upstreamed several minor changes developed by Franjo Ivancic to - allow AFL to be built as a library. This is fairly use-specific and - may have relatively little appeal to general audiences. - -### Version 2.05b: - - - Put __sanitizer_cov_module_init & co behind #ifdef to avoid problems - with ASAN. Spotted by Christian Holler. - -### Version 2.04b: - - - Removed indirect-calls coverage from -fsanitize-coverage (since it's - redundant). Spotted by Kostya Serebryany. - -### Version 2.03b: - - - Added experimental -fsanitize-coverage=trace-pc support that goes with - some recent additions to LLVM, as implemented by Kostya Serebryany. - Right now, this is cumbersome to use with common build systems, so - the mode remains undocumented. - - - Made several substantial improvements to better support non-standard - map sizes in LLVM mode. - - - Switched LLVM mode to thread-local execution tracing, which may offer - better results in some multithreaded apps. - - - Fixed a minor typo, reported by Heiko Eissfeldt. - - - Force-disabled symbolization for ASAN, as suggested by Christian Holler. - - - AFL_NOX86 renamed to AFL_NO_X86 for consistency. - - - Added AFL_LD_PRELOAD to allow LD_PRELOAD to be set for targets without - affecting AFL itself. Suggested by Daniel Godas-Lopez. - -### Version 2.02b: - - - Fixed a "lcamtuf can't count to 16" bug in the havoc stage. Reported - by Guillaume Endignoux. - -### Version 2.01b: - - - Made an improvement to cycle counter color coding, based on feedback - from Shai Sarfaty. - - - Added a mention of aflize to sister_projects.txt. - - - Fixed an installation issue with afl-as, as spotted by ilovezfs. - -### Version 2.00b: - - - Cleaned up color handling after a minor snafu in 1.99b (affecting some - terminals). - - - Made minor updates to the documentation. - -### Version 1.99b: - - - Substantially revamped the output and the internal logic of afl-analyze. - - - Cleaned up some of the color handling code and added support for - background colors. - - - Removed some stray files (oops). - - - Updated docs to better explain afl-analyze. - -### Version 1.98b: - - - Improved to "boring string" detection in afl-analyze. - - - Added technical_details.txt for afl-analyze. - -### Version 1.97b: - - - Added afl-analyze, a nifty tool to analyze the structure of a file - based on the feedback from AFL instrumentation. This is kinda experimental, - so field reports welcome. - - - Added a mention of afl-cygwin. - - - Fixed a couple of typos, as reported by Jakub Wilk and others. - -### Version 1.96b: - - - Added -fpic to CFLAGS for the clang plugin, as suggested by Hanno Boeck. - - - Made another clang change (IRBuilder) suggested by Jeff Trull. - - - Fixed several typos, spotted by Jakub Wilk. - - - Added support for AFL_SHUFFLE_QUEUE, based on discussions with - Christian Holler. - -### Version 1.95b: - - - Fixed a harmless bug when handling -B. Spotted by Jacek Wielemborek. - - - Made the exit message a bit more accurate when AFL_EXIT_WHEN_DONE is set. - - - Added some error-checking for old-style forkserver syntax. Suggested by - Ben Nagy. - - - Switched from exit() to _exit() in injected code to avoid snafus with - destructors in C++ code. Spotted by sunblate. - - - Made a change to avoid spuriously setting __AFL_SHM_ID when - AFL_DUMB_FORKSRV is set in conjunction with -n. Spotted by Jakub Wilk. - -### Version 1.94b: - - - Changed allocator alignment to improve support for non-x86 systems (now - that llvm_mode makes this more feasible). - - - Fixed a minor typo in afl-cmin. Spotted by Jonathan Neuschafer. - - - Fixed an obscure bug that would affect people trying to use afl-gcc - with $TMP set but $TMPDIR absent. Spotted by Jeremy Barnes. - -### Version 1.93b: - - - Hopefully fixed a problem with MacOS X and persistent mode, spotted by - Leo Barnes. - -### Version 1.92b: - - - Made yet another C++ fix (namespaces). Reported by Daniel Lockyer. - -### Version 1.91b: - - - Made another fix to make 1.90b actually work properly with C++ (d'oh). - Problem spotted by Daniel Lockyer. - -### Version 1.90b: - - - Fixed a minor typo spotted by Kai Zhao; and made several other minor updates - to docs. - - - Updated the project URL for python-afl. Requested by Jakub Wilk. - - - Fixed a potential problem with deferred mode signatures getting optimized - out by the linker (with --gc-sections). - -### Version 1.89b: - - - Revamped the support for persistent and deferred forkserver modes. - Both now feature simpler syntax and do not require companion env - variables. Suggested by Jakub Wilk. - - - Added a bit more info about afl-showmap. Suggested by Jacek Wielemborek. - -### Version 1.88b: - - - Made AFL_EXIT_WHEN_DONE work in non-tty mode. Issue spotted by - Jacek Wielemborek. - -### Version 1.87b: - - - Added QuickStartGuide.txt, a one-page quick start doc. - - - Fixed several typos spotted by Dominique Pelle. - - - Revamped several parts of README. - -### Version 1.86b: - - - Added support for AFL_SKIP_CRASHES, which is a very hackish solution to - the problem of resuming sessions with intermittently crashing inputs. - - - Removed the hard-fail terminal size check, replaced with a dynamic - warning shown in place of the UI. Based on feedback from Christian Holler. - - - Fixed a minor typo in show_stats. Spotted by Dingbao Xie. - -### Version 1.85b: - - - Fixed a garbled sentence in notes on parallel fuzzing. Thanks to Jakub Wilk. - - - Fixed a minor glitch in afl-cmin. Spotted by Jonathan Foote. - -### Version 1.84b: - - - Made SIMPLE_FILES behave as expected when naming backup directories for - crashes and hangs. - - - Added the total number of favored paths to fuzzer_stats. Requested by - Ben Nagy. - - - Made afl-tmin, afl-fuzz, and afl-cmin reject negative values passed to - -t and -m, since they generally won't work as expected. - - - Made a fix for no lahf / sahf support on older versions of FreeBSD. - Patch contributed by Alex Moneger. - -### Version 1.83b: - - - Fixed a problem with xargs -d on non-Linux systems in afl-cmin. Spotted by - teor2345 and Ben Nagy. - - - Fixed an implicit declaration in LLVM mode on MacOS X. Reported by - Kai Zhao. - -### Version 1.82b: - - - Fixed a harmless but annoying race condition in persistent mode - signal - delivery is a bit more finicky than I thought. - - - Updated the documentation to explain persistent mode a bit better. - - - Tweaked AFL_PERSISTENT to force AFL_NO_VAR_CHECK. - -### Version 1.81b: - - - Added persistent mode for in-process fuzzing. See llvm_mode/README.llvm. - Inspired by Kostya Serebryany and Christian Holler. - - - Changed the in-place resume code to preserve crashes/README.txt. Suggested - by Ben Nagy. - - - Included a potential fix for LLVM mode issues on MacOS X, based on the - investigation done by teor2345. - -### Version 1.80b: - - - Made afl-cmin tolerant of whitespaces in filenames. Suggested by - Jonathan Neuschafer and Ketil Froyn. - - - Added support for AFL_EXIT_WHEN_DONE, as suggested by Michael Rash. - -### Version 1.79b: - - - Added support for dictionary levels, see testcases/README.testcases. - - - Reworked the SQL dictionary to use levels. - - - Added a note about Preeny. - -### Version 1.78b: - - - Added a dictionary for PDF, contributed by Ben Nagy. - - - Added several references to afl-cov, a new tool by Michael Rash. - - - Fixed a problem with crash reporter detection on MacOS X, as reported by - Louis Dassy. - -### Version 1.77b: - - - Extended the -x option to support single-file dictionaries. - - - Replaced factory-packaged dictionaries with file-based variants. - - - Removed newlines from HTML keywords in testcases/_extras/html/. - -### Version 1.76b: - - - Very significantly reduced the number of duplicate execs during - deterministic checks, chiefly in int16 and int32 stages. Confirmed - identical path yields. This should improve early-stage efficiency by - around 5-10%. - - - Reduced the likelihood of duplicate non-deterministic execs by - bumping up lowest stacking factor from 1 to 2. Quickly confirmed - that this doesn't seem to have significant impact on coverage with - libpng. - - - Added a note about integrating afl-fuzz with third-party tools. - -### Version 1.75b: - - - Improved argv_fuzzing to allow it to emit empty args. Spotted by Jakub - Wilk. - - - afl-clang-fast now defines __AFL_HAVE_MANUAL_INIT. Suggested by Jakub Wilk. - - - Fixed a libtool-related bug with afl-clang-fast that would make some - ./configure invocations generate incorrect output. Spotted by Jakub Wilk. - - - Removed flock() on Solaris. This means no locking on this platform, - but so be it. Problem reported by Martin Carpenter. - - - Fixed a typo. Reported by Jakub Wilk. - -### Version 1.74b: - - - Added an example argv[] fuzzing wrapper in examples/argv_fuzzing. - Reworked the bash example to be faster, too. - - - Clarified llvm_mode prerequisites for FreeBSD. - - - Improved afl-tmin to use /tmp if cwd is not writeable. - - - Removed redundant includes for sys/fcntl.h, which caused warnings with - some nitpicky versions of libc. - - - Added a corpus of basic HTML tags that parsers are likely to pay attention - to (no attributes). - - - Added EP_EnabledOnOptLevel0 to llvm_mode, so that the instrumentation is - inserted even when AFL_DONT_OPTIMIZE=1 is set. - - - Switched qemu_mode to use the newly-released QEMU 2.3.0, which contains - a couple of minor bugfixes. - -### Version 1.73b: - - - Fixed a pretty stupid bug in effector maps that could sometimes cause - AFL to fuzz slightly more than necessary; and in very rare circumstances, - could lead to SEGV if eff_map is aligned with page boundary and followed - by an unmapped page. Spotted by Jonathan Gray. - -### Version 1.72b: - - - Fixed a glitch in non-x86 install, spotted by Tobias Ospelt. - - - Added a minor safeguard to llvm_mode Makefile following a report from - Kai Zhao. - -### Version 1.71b: - - - Fixed a bug with installed copies of AFL trying to use QEMU mode. Spotted - by G.M. Lime. - - - Added last path / crash / hang times to fuzzer_stats, suggested by - Richard Hipp. - - - Fixed a typo, thanks to Jakub Wilk. - -### Version 1.70b: - - - Modified resumption code to reuse the original timeout value when resuming - a session if -t is not given. This prevents timeout creep in continuous - fuzzing. - - - Added improved error messages for failed handshake when AFL_DEFER_FORKSRV - is set. - - - Made a slight improvement to llvm_mode/Makefile based on feedback from - Jakub Wilk. - - - Refreshed several bits of documentation. - - - Added a more prominent note about the MacOS X trade-offs to Makefile. - -### Version 1.69b: - - - Added support for deferred initialization in LLVM mode. Suggested by - Richard Godbee. - -### Version 1.68b: - - - Fixed a minor PRNG glitch that would make the first seconds of a fuzzing - job deterministic. Thanks to Andreas Stieger. - - - Made tmp[] static in the LLVM runtime to keep Valgrind happy (this had - no impact on anything else). Spotted by Richard Godbee. - - - Clarified the footnote in README. - -### Version 1.67b: - - - Made one more correction to llvm_mode Makefile, spotted by Jakub Wilk. - -### Version 1.66b: - - - Added CC / CXX support to llvm_mode Makefile. Requested by Charlie Eriksen. - - - Fixed 'make clean' with gmake. Suggested by Oliver Schneider. - - - Fixed 'make -j n clean all'. Suggested by Oliver Schneider. - - - Removed build date and time from banners to give people deterministic - builds. Requested by Jakub Wilk. - -### Version 1.65b: - - - Fixed a snafu with some leftover code in afl-clang-fast. - - - Corrected even moar typos. - -### Version 1.64b: - - - Further simplified afl-clang-fast runtime by reverting .init_array to - __attribute__((constructor(0)). This should improve compatibility with - non-ELF platforms. - - - Fixed a problem with afl-clang-fast and -shared libraries. Simplified - the code by getting rid of .preinit_array and replacing it with a .comm - object. Problem reported by Charlie Eriksen. - - - Removed unnecessary instrumentation density adjustment for the LLVM mode. - Reported by Jonathan Neuschafer. - -### Version 1.63b: - - - Updated cgroups_asan/ with a new version from Sam, made a couple changes - to streamline it and keep parallel afl instances in separate groups. - - - Fixed typos, thanks to Jakub Wilk. - -### Version 1.62b: - - - Improved the handling of -x in afl-clang-fast, - - - Improved the handling of low AFL_INST_RATIO settings for QEMU and - LLVM modes. - - - Fixed the llvm-config bug for good (thanks to Tobias Ospelt). - -### Version 1.61b: - - - Fixed an obscure bug compiling OpenSSL with afl-clang-fast. Patch by - Laszlo Szekeres. - - - Fixed a 'make install' bug on non-x86 systems, thanks to Tobias Ospelt. - - - Fixed a problem with half-broken llvm-config on Odroid, thanks to - Tobias Ospelt. (There is another odd bug there that hasn't been fully - fixed - TBD). - -### Version 1.60b: - - - Allowed examples/llvm_instrumentation/ to graduate to llvm_mode/. - - - Removed examples/arm_support/, since it's completely broken and likely - unnecessary with LLVM support in place. - - - Added ASAN cgroups script to examples/asan_cgroups/, updated existing - docs. Courtesy Sam Hakim and David A. Wheeler. - - - Refactored afl-tmin to reduce the number of execs in common use cases. - Ideas from Jonathan Neuschafer and Turo Lamminen. - - - Added a note about CLAs at the bottom of README. - - - Renamed testcases_readme.txt to README.testcases for some semblance of - consistency. - - - Made assorted updates to docs. - - - Added MEM_BARRIER() to afl-showmap and afl-tmin, just to be safe. - -### Version 1.59b: - - - Imported Laszlo Szekeres' experimental LLVM instrumentation into - examples/llvm_instrumentation. I'll work on including it in the - "mainstream" version soon. - - - Fixed another typo, thanks to Jakub Wilk. - -### Version 1.58b: - - - Added a workaround for abort() behavior in -lpthread programs in QEMU mode. - Spotted by Aidan Thornton. - - - Made several documentation updates, including links to the static - instrumentation tool (sister_projects.txt). - -### Version 1.57b: - - - Fixed a problem with exception handling on some versions of MacOS X. - Spotted by Samir Aguiar and Anders Wang Kristensen. - - - Tweaked afl-gcc to use BIN_PATH instead of a fixed string in help - messages. - -### Version 1.56b: - - - Renamed related_work.txt to historical_notes.txt. - - - Made minor edits to the ASAN doc. - - - Added docs/sister_projects.txt with a list of inspired or closely - related utilities. - -### Version 1.55b: - - - Fixed a glitch with afl-showmap opening /dev/null with O_RDONLY when - running in quiet mode. Spotted by Tyler Nighswander. - -### Version 1.54b: - - - Added another postprocessor example for PNG. - - - Made a cosmetic fix to realloc() handling in examples/post_library/, - suggested by Jakub Wilk. - - - Improved -ldl handling. Suggested by Jakub Wilk. - -### Version 1.53b: - - - Fixed an -l ordering issue that is apparently still a problem on Ubuntu. - Spotted by William Robinet. - -### Version 1.52b: - - - Added support for file format postprocessors. Requested by Ben Nagy. This - feature is intentionally buried, since it's fairly easy to misuse and - useful only in some scenarios. See examples/post_library/. - -### Version 1.51b: - - - Made it possible to properly override LD_BIND_NOW after one very unusual - report of trouble. - - - Cleaned up typos, thanks to Jakub Wilk. - - - Fixed a bug in AFL_DUMB_FORKSRV. - -### Version 1.50b: - - - Fixed a flock() bug that would prevent dir reuse errors from kicking - in every now and then. - - - Renamed references to ppvm (the project is now called recidivm). - - - Made improvements to file descriptor handling to avoid leaving some fds - unnecessarily open in the child process. - - - Fixed a typo or two. - -### Version 1.49b: - - - Added code to save original command line in fuzzer_stats and - crashes/README.txt. Also saves fuzzer version in fuzzer_stats. - Requested by Ben Nagy. - -### Version 1.48b: - - - Fixed a bug with QEMU fork server crashes when translation is attempted - after a jump to an invalid pointer in the child process (i.e., after - bumping into a particularly nasty security bug in the tested binary). - Reported by Tyler Nighswander. - -### Version 1.47b: - - - Fixed a bug with afl-cmin in -Q mode complaining about binary being not - instrumented. Thanks to Jonathan Neuschafer for the bug report. - - - Fixed another bug with argv handling for afl-fuzz in -Q mode. Reported - by Jonathan Neuschafer. - - - Improved the use of colors when showing crash counts in -C mode. - -### Version 1.46b: - - - Improved instrumentation performance on 32-bit systems by getting rid of - xor-swap (oddly enough, xor-swap is still faster on 64-bit) and tweaking - alignment. - - - Made path depth numbers more accurate with imported test cases. - -### Version 1.45b: - - - Added support for SIMPLE_FILES in config.h for folks who don't like - descriptive file names. Generates very simple names without colons, - commas, plus signs, dashes, etc. - - - Replaced zero-sized files with symlinks in the variable behavior state - dir to simplify examining the relevant test cases. - - - Changed the period of limited-range block ops from 5 to 10 minutes based - on a couple of experiments. The basic goal of this delay timer behavior - is to better support jobs that are seeded with completely invalid files, - in which case, the first few queue cycles may be completed very quickly - without discovering new paths. Should have no effect on well-seeded jobs. - - - Made several minor updates to docs. - -### Version 1.44b: - - - Corrected two bungled attempts to get the -C mode work properly - with afl-cmin (accounting for the short-lived releases tagged 1.42 and - 1.43b) - sorry. - - - Removed AFL_ALLOW_CRASHES in favor of the -C mode in said tool. - - - Said goodbye to Hello Kitty, as requested by Padraig Brady. - -### Version 1.41b: - - - Added AFL_ALLOW_CRASHES=1 to afl-cmin. Allows crashing inputs in the - output corpus. Changed the default behavior to disallow it. - - - Made the afl-cmin output dir default to 0700, not 0755, to be consistent - with afl-fuzz; documented the rationale for 0755 in afl-plot. - - - Lowered the output dir reuse time limit to 25 minutes as a dice-roll - compromise after a discussion on afl-users@. - - - Made afl-showmap accept -o /dev/null without borking out. - - - Added support for crash / hang info in exit codes of afl-showmap. - - - Tweaked block operation scaling to also factor in ballpark run time - in cases where queue passes take very little time. - - - Fixed typos and made improvements to several docs. - -### Version 1.40b: - - - Switched to smaller block op sizes during the first passes over the - queue. Helps keep test cases small. - - - Added memory barrier for run_target(), just in case compilers get - smarter than they are today. - - - Updated a bunch of docs. - -### Version 1.39b: - - - Added the ability to skip inputs by sending SIGUSR1 to the fuzzer. - - - Reworked several portions of the documentation. - - - Changed the code to reset splicing perf scores between runs to keep - them closer to intended length. - - - Reduced the minimum value of -t to 5 for afl-fuzz (~200 exec/sec) - and to 10 for auxiliary tools (due to the absence of a fork server). - - - Switched to more aggressive default timeouts (rounded up to 25 ms - versus 50 ms - ~40 execs/sec) and made several other cosmetic changes - to the timeout code. - -### Version 1.38b: - - - Fixed a bug in the QEMU build script, spotted by William Robinet. - - - Improved the reporting of skipped bitflips to keep the UI counters a bit - more accurate. - - - Cleaned up related_work.txt and added some non-goals. - - - Fixed typos, thanks to Jakub Wilk. - -### Version 1.37b: - - - Added effector maps, which detect regions that do not seem to respond - to bitflips and subsequently exclude them from more expensive steps - (arithmetics, known ints, etc). This should offer significant performance - improvements with quite a few types of text-based formats, reducing the - number of deterministic execs by a factor of 2 or so. - - - Cleaned up mem limit handling in afl-cmin. - - - Switched from uname -i to uname -m to work around Gentoo-specific - issues with coreutils when building QEMU. Reported by William Robinet. - - - Switched from PID checking to flock() to detect running sessions. - Problem, against all odds, bumped into by Jakub Wilk. - - - Added SKIP_COUNTS and changed the behavior of COVERAGE_ONLY in config.h. - Useful only for internal benchmarking. - - - Made improvements to UI refresh rates and exec/sec stats to make them - more stable. - - - Made assorted improvements to the documentation and to the QEMU build - script. - - - Switched from perror() to strerror() in error macros, thanks to Jakub - Wilk for the nag. - - - Moved afl-cmin back to bash, wasn't thinking straight. It has to stay - on bash because other shells may have restrictive limits on array sizes. - -### Version 1.36b: - - - Switched afl-cmin over to /bin/sh. Thanks to Jonathan Gray. - - - Fixed an off-by-one bug in queue limit check when resuming sessions - (could cause NULL ptr deref if you are *really* unlucky). - - - Fixed the QEMU script to tolerate i686 if returned by uname -i. Based on - a problem report from Sebastien Duquette. - - - Added multiple references to Jakub's ppvm tool. - - - Made several minor improvements to the Makefile. - - - Believe it or not, fixed some typos. Thanks to Jakub Wilk. - -### Version 1.35b: - - - Cleaned up regular expressions in some of the scripts to avoid errors - on *BSD systems. Spotted by Jonathan Gray. - -### Version 1.34b: - - - Performed a substantial documentation and program output cleanup to - better explain the QEMU feature. - -### Version 1.33b: - - - Added support for AFL_INST_RATIO and AFL_INST_LIBS in the QEMU mode. - - - Fixed a stack allocation crash in QEMU mode (bug in QEMU, fixed with - an extra patch applied to the downloaded release). - - - Added code to test the QEMU instrumentation once the afl-qemu-trace - binary is built. - - - Modified afl-tmin and afl-showmap to search $PATH for binaries and to - better handle QEMU support. - - - Added a check for instrumented binaries when passing -Q to afl-fuzz. - -### Version 1.32b: - - - Fixed 'make install' following the QEMU changes. Spotted by Hanno Boeck. - - - Fixed EXTRA_PAR handling in afl-cmin. - -### Version 1.31b: - - - Hallelujah! Thanks to Andrew Griffiths, we now support very fast, black-box - instrumentation of binary-only code. See qemu_mode/README.qemu. - - To use this feature, you need to follow the instructions in that - directory and then run afl-fuzz with -Q. - -### Version 1.30b: - - - Added -s (summary) option to afl-whatsup. Suggested by Jodie Cunningham. - - - Added a sanity check in afl-tmin to detect minimization to zero len or - excess hangs. - - - Fixed alphabet size counter in afl-tmin. - - - Slightly improved the handling of -B in afl-fuzz. - - - Fixed process crash messages with -m none. - -### Version 1.29b: - - - Improved the naming of test cases when orig: is already present in the file - name. - - - Made substantial improvements to technical_details.txt. - -### Version 1.28b: - - - Made a minor tweak to the instrumentation to preserve the directionality - of tuples (i.e., A -> B != B -> A) and to maintain the identity of tight - loops (A -> A). You need to recompile targeted binaries to leverage this. - - - Cleaned up some of the afl-whatsup stats. - - - Added several sanity checks to afl-cmin. - -### Version 1.27b: - - - Made afl-tmin recursive. Thanks to Hanno Boeck for the tip. - - - Added docs/technical_details.txt. - - - Changed afl-showmap search strategy in afl-cmap to just look into the - same place that afl-cmin is executed from. Thanks to Jakub Wilk. - - - Removed current_todo.txt and cleaned up the remaining docs. - -### Version 1.26b: - - - Added total execs/sec stat for afl-whatsup. - - - afl-cmin now auto-selects between cp or ln. Based on feedback from - Even Huus. - - - Fixed a typo. Thanks to Jakub Wilk. - - - Made afl-gotcpu a bit more accurate by using getrusage instead of - times. Thanks to Jakub Wilk. - - - Fixed a memory limit issue during the build process on NetBSD-current. - Reported by Thomas Klausner. - -### Version 1.25b: - - - Introduced afl-whatsup, a simple tool for querying the status of - local synced instances of afl-fuzz. - - - Added -x compiler to clang options on Darwin. Suggested by Filipe - Cabecinhas. - - - Improved exit codes for afl-gotcpu. - - - Improved the checks for -m and -t values in afl-cmin. Bug report - from Evan Huus. - -### Version 1.24b: - - - Introduced afl-getcpu, an experimental tool to empirically measure - CPU preemption rates. Thanks to Jakub Wilk for the idea. - -### Version 1.23b: - - - Reverted one change to afl-cmin that actually made it slower. - -### Version 1.22b: - - - Reworked afl-showmap.c to support normal options, including -o, -q, - -e. Also added support for timeouts and memory limits. - - - Made changes to afl-cmin and other scripts to accommodate the new - semantics. - - - Officially retired AFL_EDGES_ONLY. - - - Fixed another typo in afl-tmin, courtesy of Jakub Wilk. - -### Version 1.21b: - - - Graduated minimize_corpus.sh to afl-cmin. It is now a first-class - utility bundled with the fuzzer. - - - Made significant improvements to afl-cmin to make it faster, more - robust, and more versatile. - - - Refactored some of afl-tmin code to make it a bit more readable. - - - Made assorted changes to the doc to document afl-cmin and other stuff. - -### Version 1.20b: - - - Added AFL_DUMB_FORKSRV, as requested by Jakub Wilk. This works only - in -n mode and allows afl-fuzz to run with "dummy" fork servers that - don't output any instrumentation, but follow the same protocol. - - - Renamed AFL_SKIP_CHECKS to AFL_SKIP_BIN_CHECK to make it at least - somewhat descriptive. - - - Switched to using clang as the default assembler on MacOS X to work - around Xcode issues with newer builds of clang. Testing and patch by - Nico Weber. - - - Fixed a typo (via Jakub Wilk). - -### Version 1.19b: - - - Improved exec failure detection in afl-fuzz and afl-showmap. - - - Improved Ctrl-C handling in afl-showmap. - - - Added afl-tmin, a handy instrumentation-enabled minimizer. - -### Version 1.18b: - - - Fixed a serious but short-lived bug in the resumption behavior introduced - in version 1.16b. - - - Added -t nn+ mode for soft-skipping timing-out paths. - -### Version 1.17b: - - - Fixed a compiler warning introduced in 1.16b for newer versions of GCC. - Thanks to Jakub Wilk and Ilfak Guilfanov. - - - Improved the consistency of saving fuzzer_stats, bitmap info, and - auto-dictionaries when aborting fuzzing sessions. - - - Made several noticeable performance improvements to deterministic arith - and known int steps. - -### Version 1.16b: - - - Added a bit of code to make resumption pick up from the last known - offset in the queue, rather than always rewinding to the start. Suggested - by Jakub Wilk. - - - Switched to tighter timeout control for slow programs (3x rather than - 5x average exec speed at init). - -### Version 1.15b: - - - Added support for AFL_NO_VAR_CHECK to speed up resumption and inhibit - variable path warnings for some programs. - - - Made the trimmer run even for variable paths, since there is no special - harm in doing so and it can be very beneficial if the trimming still - pans out. - - - Made the UI a bit more descriptive by adding "n/a" instead of "0" in a - couple of corner cases. - -### Version 1.14b: - - - Added a (partial) dictionary for JavaScript. - - - Added AFL_NO_CPU_RED, as suggested by Jakub Wilk. - - - Tweaked the havoc scaling logic added in 1.12b. - -### Version 1.13b: - - - Improved the performance of minimize_corpus.sh by switching to a - sort-based approach. - - - Made several minor revisions to the docs. - -### Version 1.12b: - - - Made an improvement to dictionary generation to avoid runs of identical - bytes. - - - Added havoc cycle scaling to help with slow binaries in -d mode. Based on - a thread with Sami Liedes. - - - Added AFL_SYNC_FIRST for afl-fuzz. This is useful for those who obsess - over stats, no special purpose otherwise. - - - Switched to more robust box drawing codes, suggested by Jakub Wilk. - - - Created faster 64-bit variants of several critical-path bitmap functions - (sorry, no difference on 32 bits). - - - Fixed moar typos, as reported by Jakub Wilk. - -### Version 1.11b: - - - Added a bit more info about dictionary strategies to the status screen. - -### Version 1.10b: - - - Revised the dictionary behavior to use insertion and overwrite in - deterministic steps, rather than just the latter. This improves coverage - with SQL and the like. - - - Added a mention of "*" in status_screen.txt, as suggested by Jakub Wilk. - -### Version 1.09b: - - - Corrected a cosmetic problem with 'extras' stage count not always being - accurate in the stage yields view. - - - Fixed a typo reported by Jakub Wilk and made some minor documentation - improvements. - -### Version 1.08b: - - - Fixed a div-by-zero bug in the newly-added code when using a dictionary. - -### Version 1.07b: - - - Added code that automatically finds and extracts syntax tokens from the - input corpus. - - - Fixed a problem with ld dead-code removal option on MacOS X, reported - by Filipe Cabecinhas. - - - Corrected minor typos spotted by Jakub Wilk. - - - Added a couple of more exotic archive format samples. - -### Version 1.06b: - - - Switched to slightly more accurate (if still not very helpful) reporting - of short read and short write errors. These theoretically shouldn't happen - unless you kill the forkserver or run out of disk space. Suggested by - Jakub Wilk. - - - Revamped some of the allocator and debug code, adding comments and - cleaning up other mess. - - - Tweaked the odds of fuzzing non-favored test cases to make sure that - baseline coverage of all inputs is reached sooner. - -### Version 1.05b: - - - Added a dictionary for WebP. - - - Made some additional performance improvements to minimize_corpus.sh, - getting deeper into the bash woods. - -### Version 1.04b: - - - Made substantial performance improvements to minimize_corpus.sh with - large datasets, albeit at the expense of having to switch back to bash - (other shells may have limits on array sizes, etc). - - - Tweaked afl-showmap to support the format used by the new script. - -### Version 1.03b: - - - Added code to skip README.txt in the input directory to make the crash - exploration mode work better. Suggested by Jakub Wilk. - - - Added a dictionary for SQLite. - -### Version 1.02b: - - - Reverted the ./ search path in minimize_corpus.sh because people did - not like it. - - - Added very explicit warnings not to run various shell scripts that - read or write to /tmp/ (since this is generally a pretty bad idea on - multi-user systems). - - - Added a check for /tmp binaries and -f locations in afl-fuzz. - -### Version 1.01b: - - - Added dictionaries for XML and GIF. - -### Version 1.00b: - - - Slightly improved the performance of minimize_corpus.sh, especially on - Linux. - - - Made a couple of improvements to calibration timeouts for resumed scans. - -### Version 0.99b: - - - Fixed minimize_corpus.sh to work with dash, as suggested by Jakub Wilk. - - - Modified minimize_corpus.sh to try locate afl-showmap in $PATH and ./. - The first part requested by Jakub Wilk. - - - Added support for afl-as --version, as required by one funky build - script. Reported by William Robinet. - -### Version 0.98b: - - - Added a dictionary for TIFF. - - - Fixed another cosmetic snafu with stage exec counts for -x. - - - Switched afl-plot to /bin/sh, since it seems bashism-free. Also tried - to remove any obvious bashisms from other examples/ scripts, - most notably including minimize_corpus.sh and triage_crashes.sh. - Requested by Jonathan Gray. - -### Version 0.97b: - - - Fixed cosmetic issues around the naming of -x strategy files. - - - Added a dictionary for JPEG. - - - Fixed a very rare glitch when running instrumenting 64-bit code that makes - heavy use of xmm registers that are also touched by glibc. - -### Version 0.96b: - - - Added support for extra dictionaries, provided testcases/_extras/png/ - as a demo. - - - Fixed a minor bug in number formatting routines used by the UI. - - - Added several additional PNG test cases that are relatively unlikely - to be hit by chance. - - - Fixed afl-plot syntax for gnuplot 5.x. Reported by David Necas. - -### Version 0.95b: - - - Cleaned up the OSX ReportCrash code. Thanks to Tobias Ospelt for help. - - - Added some extra tips for AFL_NO_FORKSERVER on OSX. - - - Refreshed the INSTALL file. - -### Version 0.94b: - - - Added in-place resume (-i-) to address a common user complaint. - - - Added an awful workaround for ReportCrash on MacOS X. Problem - spotted by Joseph Gentle. - -### Version 0.93b: - - - Fixed the link() workaround, as reported by Jakub Wilk. - -### Version 0.92b: - - - Added support for reading test cases from another filesystem. - Requested by Jakub Wilk. - - - Added pointers to the mailing list. - - - Added a sample PDF document. - -### Version 0.91b: - - - Refactored minimize_corpus.sh to make it a bit more user-friendly and to - select for smallest files, not largest bitmaps. Offers a modest corpus - size improvement in most cases. - - - Slightly improved the performance of splicing code. - -### Version 0.90b: - - - Moved to an algorithm where paths are marked as preferred primarily based - on size and speed, rather than bitmap coverage. This should offer - noticeable performance gains in many use cases. - - - Refactored path calibration code; calibration now takes place as soon as a - test case is discovered, to facilitate better prioritization decisions later - on. - - - Changed the way of marking variable paths to avoid .state metadata - inconsistencies. - - - Made sure that calibration routines always create a new test case to avoid - hypothetical problems with utilities that modify the input file. - - - Added bitmap saturation to fuzzer stats and plot data. - - - Added a testcase for JPEG XR. - - - Added a tty check for the colors warning in Makefile, to keep distro build - logs tidy. Suggested by Jakub Wilk. - -### Version 0.89b: - - - Renamed afl-plot.sh to afl-plot, as requested by Padraig Brady. - - - Improved the compatibility of afl-plot with older versions of gnuplot. - - - Added banner information to fuzzer_stats, populated it to afl-plot. - -### Version 0.88b: - - - Added support for plotting, with design and implementation based on a - prototype design proposed by Michael Rash. Huge thanks! - - - Added afl-plot.sh, which allows you to, well, generate a nice plot using - this data. - - - Refactored the code slightly to make more frequent updates to fuzzer_stats - and to provide more detail about synchronization. - - - Added an fflush(stdout) call for non-tty operation, as requested by - Joonas Kuorilehto. - - - Added some detail to fuzzer_stats for parity with plot_file. - -### Version 0.87b: - - - Added support for MSAN, via AFL_USE_MSAN, same gotchas as for ASAN. - -### Version 0.86b: - - - Added AFL_NO_FORKSRV, allowing the forkserver to be bypassed. Suggested - by Ryan Govostes. - - - Simplified afl-showmap.c to make use of the no-forkserver mode. - - - Made minor improvements to crash_triage.sh, as suggested by Jakub Wilk. - -### Version 0.85b: - - - Fixed the CPU counting code - no sysctlbyname() on OpenBSD, d'oh. Bug - reported by Daniel Dickman. - - - Made a slight correction to error messages - the advice on testing - with ulimit was a tiny bit off by a factor of 1024. - -### Version 0.84b: - - - Added support for the CPU widget on some non-Linux platforms (I hope). - Based on feedback from Ryan Govostes. - - - Cleaned up the changelog (very meta). - -### Version 0.83b: - - - Added examples/clang_asm_normalize/ and related notes in - env_variables.txt and afl-as.c. Thanks to Ryan Govostes for the idea. - - - Added advice on hardware utilization in README. - -### Version 0.82b: - - - Made additional fixes for Xcode support, juggling -Q and -q flags. Thanks to - Ryan Govostes. - - - Added a check for __asm__ blocks and switches to .intel_syntax in assembly. - Based on feedback from Ryan Govostes. - -### Version 0.81b: - - - A workaround for Xcode 6 as -Q flag glitch. Spotted by Ryan Govostes. - - - Improved Solaris build instructions, as suggested by Martin Carpenter. - - - Fix for a slightly busted path scoring conditional. Minor practical impact. - -### Version 0.80b: - - - Added a check for $PATH-induced loops. Problem noticed by Kartik Agaram. - - - Added AFL_KEEP_ASSEMBLY for easier troubleshooting. - - - Added an override for AFL_USE_ASAN if set at afl compile time. Requested by - Hanno Boeck. - -### Version 0.79b: - - - Made minor adjustments to path skipping logic. - - - Made several documentation updates to reflect the path selection changes - made in 0.78b. - -### Version 0.78b: - - - Added a CPU governor check. Bug report from Joe Zbiciak. - - - Favored paths are now selected strictly based on new edges, not hit - counts. This speeds up the first pass by a factor of 3-6x without - significantly impacting ultimate coverage (tested with libgif, libpng, - libjpeg). - - It also allows some performance & memory usage improvements by making - some of the in-memory bitmaps much smaller. - - - Made multiple significant performance improvements to bitmap checking - functions, plus switched to a faster hash. - - - Owing largely to these optimizations, bumped the size of the bitmap to - 64k and added a warning to detect older binaries that rely on smaller - bitmaps. - -### Version 0.77b: - - - Added AFL_SKIP_CHECKS to bypass binary checks when really warranted. - Feature requested by Jakub Wilk. - - - Fixed a couple of typos. - - - Added a warning for runs that are aborted early on. - -### Version 0.76b: - - - Incorporated another signal handling fix for Solaris. Suggestion - submitted by Martin Carpenter. - -### Version 0.75b: - - - Implemented a slightly more "elegant" kludge for the %llu glitch (see - types.h). - - - Relaxed CPU load warnings to stay in sync with reality. - -### Version 0.74b: - - - Switched to more responsive exec speed averages and better UI speed - scaling. - - - Fixed a bug with interrupted reads on Solaris. Issue spotted by Martin - Carpenter. - -### Version 0.73b: - - - Fixed a stray memcpy() instead of memmove() on overlapping buffers. - Mostly harmless but still dumb. Mistake spotted thanks to David Higgs. - -### Version 0.72b: - - - Bumped map size up to 32k. You may want to recompile instrumented - binaries (but nothing horrible will happen if you don't). - - - Made huge performance improvements for bit-counting functions. - - - Default optimizations now include -funroll-loops. This should have - interesting effects on the instrumentation. Frankly, I'm just going to - ship it and see what happens next. I have a good feeling about this. - - - Made a fix for stack alignment crash on MacOS X 10.10; looks like the - rhetorical question in the comments in afl-as.h has been answered. - Tracked down by Mudge Zatko. - -### Version 0.71b: - - - Added a fix for the nonsensical MacOS ELF check. Spotted by Mudge Zatko. - - - Made some improvements to ASAN checks. - -### Version 0.70b: - - - Added explicit detection of ASANified binaries. - - - Fixed compilation issues on Solaris. Reported by Martin Carpenter. - -### Version 0.69b: - - - Improved the detection of non-instrumented binaries. - - - Made the crash counter in -C mode accurate. - - - Fixed an obscure install bug that made afl-as non-functional with the tool - installed to /usr/bin instead of /usr/local/bin. Found by Florian Kiersch. - - - Fixed for a cosmetic SIGFPE when Ctrl-C is pressed while the fork server - is spinning up. - -### Version 0.68b: - - - Added crash exploration mode! Woot! - -### Version 0.67b: - - - Fixed several more typos, the project is now cartified 100% typo-free. - Thanks to Thomas Jarosch and Jakub Wilk. - - - Made a change to write fuzzer_stats early on. - - - Fixed a glitch when (not!) running on MacOS X as root. Spotted by Tobias - Ospelt. - - - Made it possible to override -O3 in Makefile. Suggested by Jakub Wilk. - -### Version 0.66b: - - - Fixed a very obscure issue with build systems that use gcc as an assembler - for hand-written .s files; this would confuse afl-as. Affected nss, reported - by Hanno Boeck. - - - Fixed a bug when cleaning up synchronized fuzzer output dirs. Issue reported - by Thomas Jarosch. - -### Version 0.65b: - - - Cleaned up shell printf escape codes in Makefile. Reported by Jakub Wilk. - - - Added more color to fuzzer_stats, provided short documentation of the file - format, and made several other stats-related improvements. - -### Version 0.64b: - - - Enabled GCC support on MacOS X. - -### Version 0.63b: - - - Provided a new, simplified way to pass data in files (@@). See README. - - - Made additional fixes for 64-bit MacOS X, working around a crashing bug in - their linker (umpf) and several other things. It's alive! - - - Added a minor workaround for a bug in 64-bit FreeBSD (clang -m32 -g doesn't - work on that platform, but clang -m32 does, so we no longer insert -g). - - - Added a build-time warning for inverse video terminals and better - instructions in status_screen.txt. - -### Version 0.62b: - - - Made minor improvements to the allocator, as suggested by Tobias Ospelt. - - - Added example instrumented memcmp() in examples/instrumented_cmp. - - - Added a speculative fix for MacOS X (clang detection, again). - - - Fixed typos in parallel_fuzzing.txt. Problems spotted by Thomas Jarosch. - -### Version 0.61b: - - - Fixed a minor issue with clang detection on systems with a clang cc - wrapper, so that afl-gcc doesn't confuse it with GCC. - - - Made cosmetic improvements to docs and to the CPU load indicator. - - - Fixed a glitch with crash removal (README.txt left behind, d'oh). - -### Version 0.60b: - - - Fixed problems with jump tables generated by exotic versions of GCC. This - solves an outstanding problem on OpenBSD when using afl-gcc + PIE (not - present with afl-clang). - - - Fixed permissions on one of the sample archives. - - - Added a lahf / sahf workaround for OpenBSD (their assembler doesn't know - about these opcodes). - - - Added docs/INSTALL. - -### Version 0.59b: - - - Modified 'make install' to also install test cases. - - - Provided better pointers to installed README in afl-fuzz. - - - More work on RLIMIT_AS for OpenBSD. - -### Version 0.58b: - - - Added a core count check on Linux. - - - Refined the code for the lack-of-RLIMIT_AS case on OpenBSD. - - - Added a rudimentary CPU utilization meter to help with optimal loading. - -### Version 0.57b: - - - Made fixes to support FreeBSD and OpenBSD: use_64bit is now inferred if not - explicitly specified when calling afl-as, and RLIMIT_AS is behind an #ifdef. - Thanks to Fabian Keil and Jonathan Gray for helping troubleshoot this. - - - Modified 'make install' to also install docs (in /usr/local/share/doc/afl). - - - Fixed a typo in status_screen.txt. - - - Made a couple of Makefile improvements as proposed by Jakub Wilk. - -### Version 0.56b: - - - Added probabilistic instrumentation density reduction in ASAN mode. This - compensates for ASAN-specific branches in a crude but workable way. - - - Updated notes_for_asan.txt. - -### Version 0.55b: - - - Implemented smarter out_dir behavior, automatically deleting directories - that don't contain anything of special value. Requested by several folks, - including Hanno Boeck. - - - Added more detail in fuzzer_stats (start time, run time, fuzzer PID). - - - Implemented support for configurable install prefixes in Makefile - ($PREFIX), as requested by Luca Barbato. - - - Made it possible to resume by doing -i , without having to specify - -i /queue/. - -### Version 0.54b: - - - Added a fix for -Wformat warning messages (oops, I thought this had been in - place for a while). - -### Version 0.53b: - - - Redesigned the crash & hang duplicate detection code to better deal with - fault conditions that can be reached in a multitude of ways. - - The old approach could be compared to hashing stack traces to de-dupe - crashes, a method prone to crash count inflation. The alternative I - wanted to avoid would be equivalent to just looking at crash %eip, - which can have false negatives in common functions such as memcpy(). - - The middle ground currently used in afl-fuzz can be compared to looking - at every line item in the stack trace and tagging crashes as unique if - we see any function name that we haven't seen before (or if something that - we have *always* seen there suddenly disappears). We do the comparison - without paying any attention to ordering or hit counts. This can still - cause some crash inflation early on, but the problem will quickly taper - off. So, you may get 20 dupes instead of 5,000. - - - Added a fix for harmless but absurd trim ratios shown if the first exec in - the trimmer timed out. Spotted by @EspenGx. - -### Version 0.52b: - - - Added a quick summary of the contents in examples/. - - - Made a fix to the process of writing fuzzer_stats. - - - Slightly reorganized the .state/ directory, now recording redundant paths, - too. Note that this breaks the ability to properly resume older sessions - - sorry about that. - - (To fix this, simply move /.state/* from an older run - to /.state/deterministic_done/*.) - -### Version 0.51b: - - - Changed the search order for afl-as to avoid the problem with older copies - installed system-wide; this also means that I can remove the Makefile check - for that. - - - Made it possible to set instrumentation ratio of 0%. - - - Introduced some typos, fixed others. - - - Fixed the test_prev target in Makefile, as reported by Ozzy Johnson. - -### Version 0.50b: - - - Improved the 'make install' logic, as suggested by Padraig Brady. - - - Revamped various bits of the documentation, especially around perf_tips.txt; - based on the feedback from Alexander Cherepanov. - - - Added AFL_INST_RATIO to afl-as. The only case where this comes handy is - ffmpeg, at least as far as I can tell. (Trivia: the current version of - ffmpeg ./configure also ignores CC and --cc, probably unintentionally). - - - Added documentation for all environmental variables (env_variables.txt). - - - Implemented a visual warning for excessive or insufficient bitmap density. - - - Changed afl-gcc to add -O3 by default; use AFL_DONT_OPTIMIZE if you don't - like that. Big speed gain for ffmpeg, so seems like a good idea. - - - Made a regression fix to afl-as to ignore .LBB labels in gcc mode. - -### Version 0.49b: - - - Fixed more typos, as found by Jakub Wilk. - - - Added support for clang! - - - Changed AFL_HARDEN to *not* include ASAN by default. Use AFL_USE_ASAN if - needed. The reasons for this are in notes_for_asan.txt. - - - Switched from configure auto-detection to isatty() to keep afl-as and - afl-gcc quiet. - - - Improved installation process to properly create symlinks, rather than - copies of binaries. - -### Version 0.48b: - - - Improved afl-fuzz to force-set ASAN_OPTIONS=abort_on_error=1. Otherwise, - ASAN crashes wouldn't be caught at all. Reported by Hanno Boeck. - - - Improved Makefile mkdir logic, as suggested by Hanno Boeck. - - - Improved the 64-bit instrumentation to properly save r8-r11 registers in - the x86 setup code. The old behavior could cause rare problems running - *without* instrumentation when the first function called in a particular - .o file has 5+ parameters. No impact on code running under afl-fuzz or - afl-showmap. Issue spotted by Padraig Brady. - -### Version 0.47b: - - - Fixed another Makefile bug for parallel builds of afl. Problem identified - by Richard W. M. Jones. - - - Added support for suffixes for -m. - - - Updated the documentation and added notes_for_asan.txt. Based on feedback - from Hanno Boeck, Ben Laurie, and others. - - - Moved the project to http://lcamtuf.coredump.cx/afl/. - -### Version 0.46b: - - - Cleaned up Makefile dependencies for parallel builds. Requested by - Richard W. M. Jones. - - - Added support for DESTDIR in Makefile. Once again suggested by - Richard W. M. Jones :-) - - - Removed all the USE_64BIT stuff; we now just auto-detect compilation mode. - As requested by many callers to the show. - - - Fixed rare problems with programs that use snippets of assembly and - switch between .code32 and .code64. Addresses a glitch spotted by - Hanno Boeck with compiling ToT gdb. - -### Version 0.45b: - - - Implemented a test case trimmer. Results in 20-30% size reduction for many - types of work loads, with very pronounced improvements in path discovery - speeds. - - - Added better warnings for various problems with input directories. - - - Added a Makefile warning for older copies, based on counterintuitive - behavior observed by Hovik Manucharyan. - - - Added fuzzer_stats file for status monitoring. Suggested by @dronesec. - - - Fixed moar typos, thanks to Alexander Cherepanov. - - - Implemented better warnings for ASAN memory requirements, based on calls - from several angry listeners. - - - Switched to saner behavior with non-tty stdout (less output generated, - no ANSI art). - -### Version 0.44b: - - - Added support for AFL_CC and AFL_CXX, based on a patch from Ben Laurie. - - - Replaced afl-fuzz -S -D with -M for simplicity. - - - Added a check for .section .text; lack of this prevented main() from - getting instrumented for some users. Reported by Tom Ritter. - - - Reorganized the testcases/ directory. - - - Added an extra check to confirm that the build is operational. - - - Made more consistent use of color reset codes, as suggested by Oliver - Kunz. - -### Version 0.43b: - - - Fixed a bug with 64-bit gcc -shared relocs. - - - Removed echo -e from Makefile for compatibility with dash. Suggested - by Jakub Wilk. - - - Added status_screen.txt. - - - Added examples/canvas_harness. - - - Made a minor change to the Makefile GCC check. Suggested by Hanno Boeck. - -### Version 0.42b: - - - Fixed a bug with red zone handling for 64-bit (oops!). Problem reported by - Felix Groebert. - - - Implemented horribly experimental ARM support in examples/arm_support. - - - Made several improvements to error messages. - - - Added AFL_QUIET to silence afl-gcc and afl-as when using wonky build - systems. Reported by Hanno Boeck. - - - Improved check for 64-bit compilation, plus several sanity checks - in Makefile. - -### Version 0.41b: - - - Fixed a fork served bug for processes that call execve(). - - - Made minor compatibility fixes to Makefile, afl-gcc; suggested by Jakub - Wilk. - - - Fixed triage_crashes.sh to work with the new layout of output directories. - Suggested by Jakub Wilk. - - - Made multiple performance-related improvements to the injected - instrumentation. - - - Added visual indication of the number of imported paths. - - - Fixed afl-showmap to make it work well with new instrumentation. - - - Added much better error messages for crashes when importing test cases - or otherwise calibrating the binary. - -### Version 0.40b: - - - Added support for parallelized fuzzing. Inspired by earlier patch - from Sebastian Roschke. - - - Added an example in examples/distributed_fuzzing/. - -### Version 0.39b: - - - Redesigned status screen, now 90% more spiffy. - - - Added more verbose and user-friendly messages for some common problems. - - - Modified the resumption code to reconstruct path depth. - - - Changed the code to inhibit core dumps and improve the ability to detect - SEGVs. - - - Added a check for redirection of core dumps to programs. - - - Made a minor improvement to the handling of variable paths. - - - Made additional performance tweaks to afl-fuzz, chiefly around mem limits. - - - Added performance_tips.txt. - -### Version 0.38b: - - - Fixed an fd leak and +cov tracking bug resulting from changes in 0.37b. - - - Implemented auto-scaling for screen update speed. - - - Added a visual indication when running in non-instrumented mode. - -### Version 0.37b: - - - Added fuzz state tracking for more seamless resumption of aborted - fuzzing sessions. - - - Removed the -D option, as it's no longer necessary. - - - Refactored calibration code and improved startup reporting. - - - Implemented dynamically scaled timeouts, so that you don't need to - play with -t except in some very rare cases. - - - Added visual notification for slow binaries. - - - Improved instrumentation to explicitly cover the other leg of every - branch. - -### Version 0.36b: - - - Implemented fork server support to avoid the overhead of execve(). A - nearly-verbatim design from Jann Horn; still pending part 2 that would - also skip initial setup steps (thinking about reliable heuristics now). - - - Added a check for shell scripts used as fuzz targets. - - - Added a check for fuzz jobs that don't seem to be finding anything. - - - Fixed the way IGNORE_FINDS works (was a bit broken after adding splicing - and path skip heuristics). - -### Version 0.35b: - - - Properly integrated 64-bit instrumentation into afl-as. - -### Version 0.34b: - - - Added a new exec count classifier (the working theory is that it gets - meaningful coverage with fewer test cases spewed out). - -### Version 0.33b: - - - Switched to new, somewhat experimental instrumentation that tries to - target only arcs, rather than every line. May be fragile, but is a lot - faster (2x+). - - - Made several other cosmetic fixes and typo corrections, thanks to - Jakub Wilk. - -### Version 0.32b: - - - Another take at fixing the C++ exception thing. Reported by Jakub Wilk. - -### Version 0.31b: - - - Made another fix to afl-as to address a potential problem with newer - versions of GCC (introduced in 0.28b). Thanks to Jann Horn. - -### Version 0.30b: - - - Added more detail about the underlying operations in file names. - -### Version 0.29b: - - - Made some general improvements to chunk operations. - -### Version 0.28b: - - - Fixed C++ exception handling in newer versions of GCC. Problem diagnosed - by Eberhard Mattes. - - - Fixed the handling of the overflow flag. Once again, thanks to - Eberhard Mattes. - -### Version 0.27b: - - - Added prioritization of new paths over the already-fuzzed ones. - - - Included spliced test case ID in the output file name. - - - Fixed a rare, cosmetic null ptr deref after Ctrl-C. - - - Refactored the code to make copies of test cases in the output directory. - - - Switched to better output file names, keeping track of stage and splicing - sources. - -### Version 0.26b: - - - Revamped storage of testcases, -u option removed, - - - Added a built-in effort minimizer to get rid of potentially redundant - inputs, - - - Provided a testcase count minimization script in examples/, - - - Made miscellaneous improvements to directory and file handling. - - - Fixed a bug in timeout detection. - -### Version 0.25b: - - - Improved count-based instrumentation. - - - Improved the hang deduplication logic. - - - Added -cov prefixes for test cases. - - - Switched from readdir() to scandir() + alphasort() to preserve ordering of - test cases. - - - Added a splicing strategy. - - - Made various minor UI improvements and several other bugfixes. - -### Version 0.24b: - - - Added program name to the status screen, plus the -T parameter to go with - it. - -### Version 0.23b: - - - Improved the detection of variable behaviors. - - - Added path depth tracking, - - - Improved the UI a bit, - - - Switched to simplified (XOR-based) tuple instrumentation. - -### Version 0.22b: - - - Refactored the handling of long bitflips and some swaps. - - - Fixed the handling of gcc -pipe, thanks to anonymous reporter. - -### Version 0.21b (2013-11-12): - - - Initial public release. diff --git a/docs/Changelog.md b/docs/Changelog.md new file mode 100644 index 00000000..ad0b9e88 --- /dev/null +++ b/docs/Changelog.md @@ -0,0 +1,2420 @@ +# ChangeLog + + This is the list of all noteworthy changes made in every public release of + the tool. See README for the general instruction manual. + +## Staying informed + +Want to stay in the loop on major new features? Join our mailing list by +sending a mail to . + + +### Version ++2.60d (develop): + + - use -march=native if available + - afl-fuzz: + - now prints the real python version support compiled in + - set stronger performance compile options and little tweaks + - Android: prefer bigcores when selecting a CPU + - CmpLog forkserver + - Redqueen input-2-state mutator (cmp instructions only ATM) + - all Python 2+3 versions supported now + - afl-clang-fast: + - show in the help output for which llvm version it was compiled for + - now does not need to be recompiled between trace-pc and pass + instrumentation. compile normally and set AFL_LLVM_USE_TRACE_PC :) + - LLVM 11 is supported + - CmpLog instrumentation using SanCov (see llvm_mode/README.cmplog) + - CmpLog instrumentation for QEMU + - AFL_PERSISTENT_HOOK callback module for persistent QEMU + (see examples/qemu_persistent_hook) + - afl-cmin is now a sh script (invoking awk) instead of bash for portability + the original script is still present as afl-cmin.bash + - afl-showmap: -i dir option now allows processing multiple inputs using the + forkserver. This is for enhanced speed in afl-cmin. + - added blacklist and whitelisting function check in all modules of llvm_mode + - added fix from Debian project to compile libdislocator and libtokencap + - libdislocator: AFL_ALIGNED_ALLOC to force size alignment to max_align_t + + +### Version ++2.60c (release): + + - fixed a critical bug in afl-tmin that was introduced during ++2.53d + - added test cases for afl-cmin and afl-tmin to test/test.sh + - added ./examples/argv_fuzzing ld_preload library by Kjell Braden + - added preeny's desock_dup ld_preload library as + ./examples/socket_fuzzing for network fuzzing + - added AFL_AS_FORCE_INSTRUMENT environment variable for afl-as - this is + for the retrorewrite project + - we now set QEMU_SET_ENV from AFL_PRELOAD when qemu_mode is used + + +### Version ++2.59c (release): + + - qbdi_mode: fuzz android native libraries via QBDI framework + - unicorn_mode: switched to the new unicornafl, thanks domenukk + (see https://github.com/vanhauser-thc/unicorn) + - afl-fuzz: + - added radamsa as (an optional) mutator stage (-R[R]) + - added -u command line option to not unlink the fuzz input file + - Python3 support (autodetect) + - AFL_DISABLE_TRIM env var to disable the trim stage + - CPU affinity support for DragonFly + - llvm_mode: + - float splitting is now configured via AFL_LLVM_LAF_SPLIT_FLOATS + - support for llvm 10 included now (thanks to devnexen) + - libtokencap: + - support for *BSD/OSX/Dragonfly added + - hook common *cmp functions from widely used libraries + - compcov: + - hook common *cmp functions from widely used libraries + - floating point splitting support for QEMU on x86 targets + - qemu_mode: AFL_QEMU_DISABLE_CACHE env to disable QEMU TranslationBlocks caching + - afl-analyze: added AFL_SKIP_BIN_CHECK support + - better random numbers for gcc_plugin and llvm_mode (thanks to devnexen) + - Dockerfile by courtesy of devnexen + - added regex.dictionary + - qemu and unicorn download scripts now try to download until the full + download succeeded. f*ckin travis fails downloading 40% of the time! + - more support for Android (please test!) + - added the few Android stuff we didnt have already from Google afl repository + - removed unnecessary warnings + + +### Version ++2.58c (release): + + - reverted patch to not unlink and recreate the input file, it resulted in + performance loss of ~10% + - added test/test-performance.sh script + - (re)added gcc_plugin, fast inline instrumentation is not yet finished, + however it includes the whitelisting and persistance feature! by hexcoder- + - gcc_plugin tests added to testing framework + + +### Version ++2.54d-2.57c (release): + + - we jump to 2.57 instead of 2.55 to catch up with Google's versioning + - persistent mode for QEMU (see qemu_mode/README.md) + - custom mutator library is now an additional mutator, to exclusivly use it + add AFL_CUSTOM_MUTATOR_ONLY (that will trigger the previous behaviour) + - new library qemu_mode/unsigaction which filters sigaction events + - afl-fuzz: new command line option -I to execute a command on a new crash + - no more unlinking the input file, this way the input file can also be a + FIFO or disk partition + - setting LLVM_CONFIG for llvm_mode will now again switch to the selected + llvm version. If your setup is correct. + - fuzzing strategy yields for custom mutator were missing from the UI, added them :) + - added "make tests" which will perform checks to see that all functionality + is working as expected. this is currently the starting point, its not complete :) + - added mutation documentation feature ("make document"), creates afl-fuzz-document + and saves all mutations of the first run on the first file into out/queue/mutations + - libtokencap and libdislocator now compile to the afl_root directory and are + installed to the .../lib/afl directory when present during make install + - more BSD support, e.g. free CPU binding code for FreeBSD (thanks to devnexen) + - reducing duplicate code in afl-fuzz + - added "make help" + - removed compile warnings from python internal stuff + - added man page for afl-clang-fast[++] + - updated documentation + - Wine mode to run Win32 binaries with the QEMU instrumentation (-W) + - CompareCoverage for ARM target in QEMU/Unicorn + - laf-intel in llvm_mode now also handles floating point comparisons + + +### Version ++2.54c (release): + + - big code refactoring: + * all includes are now in include/ + * all afl sources are now in src/ - see src/README.src + * afl-fuzz was splitted up in various individual files for including + functionality in other programs (e.g. forkserver, memory map, etc.) + for better readability. + * new code indention everywhere + - auto-generating man pages for all (main) tools + - added AFL_FORCE_UI to show the UI even if the terminal is not detected + - llvm 9 is now supported (still needs testing) + - Android is now supported (thank to JoeyJiao!) - still need to modify the Makefile though + - fix building qemu on some Ubuntus (thanks to floyd!) + - custom mutator by a loaded library is now supported (thanks to kyakdan!) + - added PR that includes peak_rss_mb and slowest_exec_ms in the fuzzer_stats report + - more support for *BSD (thanks to devnexen!) + - fix building on *BSD (thanks to tobias.kortkamp for the patch) + - fix for a few features to support different map sized than 2^16 + - afl-showmap: new option -r now shows the real values in the buckets (stock + afl never did), plus shows tuple content summary information now + - small docu updates + - NeverZero counters for QEMU + - NeverZero counters for Unicorn + - CompareCoverage Unicorn + - immediates-only instrumentation for CompareCoverage + + +### Version ++2.53c (release): + + - README is now README.md + - imported the few minor changes from the 2.53b release + - unicorn_mode got added - thanks to domenukk for the patch! + - fix llvm_mode AFL_TRACE_PC with modern llvm + - fix a crash in qemu_mode which also exists in stock afl + - added libcompcov, a laf-intel implementation for qemu! :) + see qemu_mode/libcompcov/README.libcompcov + - afl-fuzz now displays the selected core in the status screen (blue {#}) + - updated afl-fuzz and afl-system-config for new scaling governor location + in modern kernels + - using the old ineffective afl-gcc will now show a deprecation warning + - all queue, hang and crash files now have their discovery time in their name + - if llvm_mode was compiled, afl-clang/afl-clang++ will point to these + instead of afl-gcc + - added instrim, a much faster llvm_mode instrumentation at the cost of + path discovery. See llvm_mode/README.instrim (https://github.com/csienslab/instrim) + - added MOpt (github.com/puppet-meteor/MOpt-AFL) mode, see docs/README.MOpt + - added code to make it more portable to other platforms than Intel Linux + - added never zero counters for afl-gcc and optionally (because of an + optimization issue in llvm < 9) for llvm_mode (AFL_LLVM_NEVER_ZERO=1) + - added a new doc about binary only fuzzing: docs/binaryonly_fuzzing.txt + - more cpu power for afl-system-config + - added forkserver patch to afl-tmin, makes it much faster (originally from + github.com/nccgroup/TriforceAFL) + - added whitelist support for llvm_mode via AFL_LLVM_WHITELIST to allow + only to instrument what is actually interesting. Gives more speed and less + map pollution (originally by choller@mozilla) + - added Python Module mutator support, python2.7-dev is autodetected. + see docs/python_mutators.txt (originally by choller@mozilla) + - added AFL_CAL_FAST for slow applications and AFL_DEBUG_CHILD_OUTPUT for + debugging + - added -V time and -E execs option to better comparison runs, runs afl-fuzz + for a specific time/executions. + - added a -s seed switch to allow afl run with a fixed initial + seed that is not updated. This is good for performance and path discovery + tests as the random numbers are deterministic then + - llvm_mode LAF_... env variables can now be specified as AFL_LLVM_LAF_... + that is longer but in line with other llvm specific env vars + + +### Version ++2.52c (2019-06-05): + + - Applied community patches. See docs/PATCHES for the full list. + LLVM and Qemu modes are now faster. + Important changes: + afl-fuzz: -e EXTENSION commandline option + llvm_mode: LAF-intel performance (needs activation, see llvm/README.laf-intel) + a few new environment variables for afl-fuzz, llvm and qemu, see docs/env_variables.txt + - Added the power schedules of AFLfast by Marcel Boehme, but set the default + to the AFL schedule, not to the FAST schedule. So nothing changes unless + you use the new -p option :-) - see docs/power_schedules.txt + - added afl-system-config script to set all system performance options for fuzzing + - llvm_mode works with llvm 3.9 up to including 8 ! + - qemu_mode got upgraded from 2.1 to 3.1 - incorporated from + https://github.com/andreafioraldi/afl and with community patches added + + +### Version 2.52b (2017-11-04): + + - Upgraded QEMU patches from 2.3.0 to 2.10.0. Required troubleshooting + several weird issues. All the legwork done by Andrew Griffiths. + + - Added setsid to afl-showmap. See the notes for 2.51b. + + - Added target mode (deferred, persistent, qemu, etc) to fuzzer_stats. + Requested by Jakub Wilk. + + - afl-tmin should now save a partially minimized file when Ctrl-C + is pressed. Suggested by Jakub Wilk. + + - Added an option for afl-analyze to dump offsets in hex. Suggested by + Jakub Wilk. + + - Added support for parameters in triage_crashes.sh. Patch by Adam of + DC949. + +### Version 2.51b (2017-08-30): + + - Made afl-tmin call setsid to prevent glibc traceback junk from showing + up on the terminal in some distros. Suggested by Jakub Wilk. + +### Version 2.50b (2017-08-19): + + - Fixed an interesting timing corner case spotted by Jakub Wilk. + + - Addressed a libtokencap / pthreads incompatibility issue. Likewise, spotted + by Jakub Wilk. + + - Added a mention of afl-kit and Pythia. + + - Added AFL_FAST_CAL. + + - In-place resume now preserves .synced. Suggested by Jakub Wilk. + +### Version 2.49b (2017-07-18): + + - Added AFL_TMIN_EXACT to allow path constraint for crash minimization. + + - Added dates for releases (retroactively for all of 2017). + +### Version 2.48b (2017-07-17): + + - Added AFL_ALLOW_TMP to permit some scripts to run in /tmp. + + - Fixed cwd handling in afl-analyze (similar to the quirk in afl-tmin). + + - Made it possible to point -o and -f to the same file in afl-tmin. + +### Version 2.47b (2017-07-14): + + - Fixed cwd handling in afl-tmin. Spotted by Jakub Wilk. + +### Version 2.46b (2017-07-10): + + - libdislocator now supports AFL_LD_NO_CALLOC_OVER for folks who do not + want to abort on calloc() overflows. + + - Made a minor fix to libtokencap. Reported by Daniel Stender. + + - Added a small JSON dictionary, inspired on a dictionary done by Jakub Wilk. + +### Version 2.45b (2017-07-04): + + - Added strstr, strcasestr support to libtokencap. Contributed by + Daniel Hodson. + + - Fixed a resumption offset glitch spotted by Jakub Wilk. + + - There are definitely no bugs in afl-showmap -c now. + +### Version 2.44b (2017-06-28): + + - Added a visual indicator of ASAN / MSAN mode when compiling. Requested + by Jakub Wilk. + + - Added support for afl-showmap coredumps (-c). Suggested by Jakub Wilk. + + - Added LD_BIND_NOW=1 for afl-showmap by default. Although not really useful, + it reportedly helps reproduce some crashes. Suggested by Jakub Wilk. + + - Added a note about allocator_may_return_null=1 not always working with + ASAN. Spotted by Jakub Wilk. + +### Version 2.43b (2017-06-16): + + - Added AFL_NO_ARITH to aid in the fuzzing of text-based formats. + Requested by Jakub Wilk. + +### Version 2.42b (2017-06-02): + + - Renamed the R() macro to avoid a problem with llvm_mode in the latest + versions of LLVM. Fix suggested by Christian Holler. + +### Version 2.41b (2017-04-12): + + - Addressed a major user complaint related to timeout detection. Timing out + inputs are now binned as "hangs" only if they exceed a far more generous + time limit than the one used to reject slow paths. + +### Version 2.40b (2017-04-02): + + - Fixed a minor oversight in the insertion strategy for dictionary words. + Spotted by Andrzej Jackowski. + + - Made a small improvement to the havoc block insertion strategy. + + - Adjusted color rules for "is it done yet?" indicators. + +### Version 2.39b (2017-02-02): + + - Improved error reporting in afl-cmin. Suggested by floyd. + + - Made a minor tweak to trace-pc-guard support. Suggested by kcc. + + - Added a mention of afl-monitor. + +### Version 2.38b (2017-01-22): + + - Added -mllvm -sanitizer-coverage-block-threshold=0 to trace-pc-guard + mode, as suggested by Kostya Serebryany. + +### Version 2.37b (2017-01-22): + + - Fixed a typo. Spotted by Jakub Wilk. + + - Fixed support for make install when using trace-pc. Spotted by + Kurt Roeckx. + + - Switched trace-pc to trace-pc-guard, which should be considerably + faster and is less quirky. Kudos to Konstantin Serebryany (and sorry + for dragging my feet). + + Note that for some reason, this mode doesn't perform as well as + "vanilla" afl-clang-fast / afl-clang. + +### Version 2.36b (2017-01-14): + + - Fixed a cosmetic bad free() bug when aborting -S sessions. Spotted + by Johannes S. + + - Made a small change to afl-whatsup to sort fuzzers by name. + + - Fixed a minor issue with malloc(0) in libdislocator. Spotted by + Rene Freingruber. + + - Changed the clobber pattern in libdislocator to a slightly more + reliable one. Suggested by Rene Freingruber. + + - Added a note about THP performance. Suggested by Sergey Davidoff. + + - Added a somewhat unofficial support for running afl-tmin with a + baseline "mask" that causes it to minimize only for edges that + are unique to the input file, but not to the "boring" baseline. + Suggested by Sami Liedes. + + - "Fixed" a getPassName() problem with newer versions of clang. + Reported by Craig Young and several other folks. + + Yep, I know I have a backlog on several other feature requests. + Stay tuned! + +### Version 2.35b: + + - Fixed a minor cmdline reporting glitch, spotted by Leo Barnes. + + - Fixed a silly bug in libdislocator. Spotted by Johannes Schultz. + +### Version 2.34b: + + - Added a note about afl-tmin to technical_details.txt. + + - Added support for AFL_NO_UI, as suggested by Leo Barnes. + +### Version 2.33b: + + - Added code to strip -Wl,-z,defs and -Wl,--no-undefined for afl-clang-fast, + since they interfere with -shared. Spotted and diagnosed by Toby Hutton. + + - Added some fuzzing tips for Android. + +### Version 2.32b: + + - Added a check for AFL_HARDEN combined with AFL_USE_*SAN. Suggested by + Hanno Boeck. + + - Made several other cosmetic adjustments to cycle timing in the wake of the + big tweak made in 2.31b. + +### Version 2.31b: + + - Changed havoc cycle counts for a marked performance boost, especially + with -S / -d. See the discussion of FidgetyAFL in: + + https://groups.google.com/forum/#!topic/afl-users/fOPeb62FZUg + + While this does not implement the approach proposed by the authors of + the CCS paper, the solution is a result of digging into that research; + more improvements may follow as I do more experiments and get more + definitive data. + +### Version 2.30b: + + - Made minor improvements to persistent mode to avoid the remote + possibility of "no instrumentation detected" issues with very low + instrumentation densities. + + - Fixed a minor glitch with a leftover process in persistent mode. + Reported by Jakub Wilk and Daniel Stender. + + - Made persistent mode bitmaps a bit more consistent and adjusted the way + this is shown in the UI, especially in persistent mode. + +### Version 2.29b: + + - Made a minor #include fix to llvm_mode. Suggested by Jonathan Metzman. + + - Made cosmetic updates to the docs. + +### Version 2.28b: + + - Added "life pro tips" to docs/. + + - Moved testcases/_extras/ to dictionaries/ for visibility. + + - Made minor improvements to install scripts. + + - Added an important safety tip. + +### Version 2.27b: + + - Added libtokencap, a simple feature to intercept strcmp / memcmp and + generate dictionary entries that can help extend coverage. + + - Moved libdislocator to its own dir, added README. + + - The demo in examples/instrumented_cmp is no more. + +### Version 2.26b: + + - Made a fix for libdislocator.so to compile on MacOS X. + + - Added support for DYLD_INSERT_LIBRARIES. + + - Renamed AFL_LD_PRELOAD to AFL_PRELOAD. + +### Version 2.25b: + + - Made some cosmetic updates to libdislocator.so, renamed one env + variable. + +### Version 2.24b: + + - Added libdislocator.so, an experimental, abusive allocator. Try + it out with AFL_LD_PRELOAD=/path/to/libdislocator.so when running + afl-fuzz. + +### Version 2.23b: + + - Improved the stability metric for persistent mode binaries. Problem + spotted by Kurt Roeckx. + + - Made a related improvement that may bring the metric to 100% for those + targets. + +### Version 2.22b: + + - Mentioned the potential conflicts between MSAN / ASAN and FORTIFY_SOURCE. + There is no automated check for this, since some distros may implicitly + set FORTIFY_SOURCE outside of the compiler's argv[]. + + - Populated the support for AFL_LD_PRELOAD to all companion tools. + + - Made a change to the handling of ./afl-clang-fast -v. Spotted by + Jan Kneschke. + +### Version 2.21b: + + - Added some crash reporting notes for Solaris in docs/INSTALL, as + investigated by Martin Carpenter. + + - Fixed a minor UI mix-up with havoc strategy stats. + +### Version 2.20b: + + - Revamped the handling of variable paths, replacing path count with a + "stability" score to give users a much better signal. Based on the + feedback from Vegard Nossum. + + - Made a stability improvement to the syncing behavior with resuming + fuzzers. Based on the feedback from Vegard. + + - Changed the UI to include current input bitmap density along with + total density. Ditto. + + - Added experimental support for parallelizing -M. + +### Version 2.19b: + + - Made a fix to make sure that auto CPU binding happens at non-overlapping + times. + +### Version 2.18b: + + - Made several performance improvements to has_new_bits() and + classify_counts(). This should offer a robust performance bump with + fast targets. + +### Version 2.17b: + + - Killed the error-prone and manual -Z option. On Linux, AFL will now + automatically bind to the first free core (or complain if there are no + free cores left). + + - Made some doc updates along these lines. + +### Version 2.16b: + + - Improved support for older versions of clang (hopefully without + breaking anything). + + - Moved version data from Makefile to config.h. Suggested by + Jonathan Metzman. + +### Version 2.15b: + + - Added a README section on looking for non-crashing bugs. + + - Added license data to several boring files. Contributed by + Jonathan Metzman. + +### Version 2.14b: + + - Added FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION as a macro defined when + compiling with afl-gcc and friends. Suggested by Kostya Serebryany. + + - Refreshed some of the non-x86 docs. + +### Version 2.13b: + + - Fixed a spurious build test error with trace-pc and llvm_mode/Makefile. + Spotted by Markus Teufelberger. + + - Fixed a cosmetic issue with afl-whatsup. Spotted by Brandon Perry. + +### Version 2.12b: + + - Fixed a minor issue in afl-tmin that can make alphabet minimization less + efficient during passes > 1. Spotted by Daniel Binderman. + +### Version 2.11b: + + - Fixed a minor typo in instrumented_cmp, spotted by Hanno Eissfeldt. + + - Added a missing size check for deterministic insertion steps. + + - Made an improvement to afl-gotcpu when -Z not used. + + - Fixed a typo in post_library_png.so.c in examples/. Spotted by Kostya + Serebryany. + +### Version 2.10b: + + - Fixed a minor core counting glitch, reported by Tyler Nighswander. + +### Version 2.09b: + + - Made several documentation updates. + + - Added some visual indicators to promote and simplify the use of -Z. + +### Version 2.08b: + + - Added explicit support for -m32 and -m64 for llvm_mode. Inspired by + a request from Christian Holler. + + - Added a new benchmarking option, as requested by Kostya Serebryany. + +### Version 2.07b: + + - Added CPU affinity option (-Z) on Linux. With some caution, this can + offer a significant (10%+) performance bump and reduce jitter. + Proposed by Austin Seipp. + + - Updated afl-gotcpu to use CPU affinity where supported. + + - Fixed confusing CPU_TARGET error messages with QEMU build. Spotted by + Daniel Komaromy and others. + +### Version 2.06b: + + - Worked around LLVM persistent mode hiccups with -shared code. + Contributed by Christian Holler. + + - Added __AFL_COMPILER as a convenient way to detect that something is + built under afl-gcc / afl-clang / afl-clang-fast and enable custom + optimizations in your code. Suggested by Pedro Corte-Real. + + - Upstreamed several minor changes developed by Franjo Ivancic to + allow AFL to be built as a library. This is fairly use-specific and + may have relatively little appeal to general audiences. + +### Version 2.05b: + + - Put __sanitizer_cov_module_init & co behind #ifdef to avoid problems + with ASAN. Spotted by Christian Holler. + +### Version 2.04b: + + - Removed indirect-calls coverage from -fsanitize-coverage (since it's + redundant). Spotted by Kostya Serebryany. + +### Version 2.03b: + + - Added experimental -fsanitize-coverage=trace-pc support that goes with + some recent additions to LLVM, as implemented by Kostya Serebryany. + Right now, this is cumbersome to use with common build systems, so + the mode remains undocumented. + + - Made several substantial improvements to better support non-standard + map sizes in LLVM mode. + + - Switched LLVM mode to thread-local execution tracing, which may offer + better results in some multithreaded apps. + + - Fixed a minor typo, reported by Heiko Eissfeldt. + + - Force-disabled symbolization for ASAN, as suggested by Christian Holler. + + - AFL_NOX86 renamed to AFL_NO_X86 for consistency. + + - Added AFL_LD_PRELOAD to allow LD_PRELOAD to be set for targets without + affecting AFL itself. Suggested by Daniel Godas-Lopez. + +### Version 2.02b: + + - Fixed a "lcamtuf can't count to 16" bug in the havoc stage. Reported + by Guillaume Endignoux. + +### Version 2.01b: + + - Made an improvement to cycle counter color coding, based on feedback + from Shai Sarfaty. + + - Added a mention of aflize to sister_projects.txt. + + - Fixed an installation issue with afl-as, as spotted by ilovezfs. + +### Version 2.00b: + + - Cleaned up color handling after a minor snafu in 1.99b (affecting some + terminals). + + - Made minor updates to the documentation. + +### Version 1.99b: + + - Substantially revamped the output and the internal logic of afl-analyze. + + - Cleaned up some of the color handling code and added support for + background colors. + + - Removed some stray files (oops). + + - Updated docs to better explain afl-analyze. + +### Version 1.98b: + + - Improved to "boring string" detection in afl-analyze. + + - Added technical_details.txt for afl-analyze. + +### Version 1.97b: + + - Added afl-analyze, a nifty tool to analyze the structure of a file + based on the feedback from AFL instrumentation. This is kinda experimental, + so field reports welcome. + + - Added a mention of afl-cygwin. + + - Fixed a couple of typos, as reported by Jakub Wilk and others. + +### Version 1.96b: + + - Added -fpic to CFLAGS for the clang plugin, as suggested by Hanno Boeck. + + - Made another clang change (IRBuilder) suggested by Jeff Trull. + + - Fixed several typos, spotted by Jakub Wilk. + + - Added support for AFL_SHUFFLE_QUEUE, based on discussions with + Christian Holler. + +### Version 1.95b: + + - Fixed a harmless bug when handling -B. Spotted by Jacek Wielemborek. + + - Made the exit message a bit more accurate when AFL_EXIT_WHEN_DONE is set. + + - Added some error-checking for old-style forkserver syntax. Suggested by + Ben Nagy. + + - Switched from exit() to _exit() in injected code to avoid snafus with + destructors in C++ code. Spotted by sunblate. + + - Made a change to avoid spuriously setting __AFL_SHM_ID when + AFL_DUMB_FORKSRV is set in conjunction with -n. Spotted by Jakub Wilk. + +### Version 1.94b: + + - Changed allocator alignment to improve support for non-x86 systems (now + that llvm_mode makes this more feasible). + + - Fixed a minor typo in afl-cmin. Spotted by Jonathan Neuschafer. + + - Fixed an obscure bug that would affect people trying to use afl-gcc + with $TMP set but $TMPDIR absent. Spotted by Jeremy Barnes. + +### Version 1.93b: + + - Hopefully fixed a problem with MacOS X and persistent mode, spotted by + Leo Barnes. + +### Version 1.92b: + + - Made yet another C++ fix (namespaces). Reported by Daniel Lockyer. + +### Version 1.91b: + + - Made another fix to make 1.90b actually work properly with C++ (d'oh). + Problem spotted by Daniel Lockyer. + +### Version 1.90b: + + - Fixed a minor typo spotted by Kai Zhao; and made several other minor updates + to docs. + + - Updated the project URL for python-afl. Requested by Jakub Wilk. + + - Fixed a potential problem with deferred mode signatures getting optimized + out by the linker (with --gc-sections). + +### Version 1.89b: + + - Revamped the support for persistent and deferred forkserver modes. + Both now feature simpler syntax and do not require companion env + variables. Suggested by Jakub Wilk. + + - Added a bit more info about afl-showmap. Suggested by Jacek Wielemborek. + +### Version 1.88b: + + - Made AFL_EXIT_WHEN_DONE work in non-tty mode. Issue spotted by + Jacek Wielemborek. + +### Version 1.87b: + + - Added QuickStartGuide.txt, a one-page quick start doc. + + - Fixed several typos spotted by Dominique Pelle. + + - Revamped several parts of README. + +### Version 1.86b: + + - Added support for AFL_SKIP_CRASHES, which is a very hackish solution to + the problem of resuming sessions with intermittently crashing inputs. + + - Removed the hard-fail terminal size check, replaced with a dynamic + warning shown in place of the UI. Based on feedback from Christian Holler. + + - Fixed a minor typo in show_stats. Spotted by Dingbao Xie. + +### Version 1.85b: + + - Fixed a garbled sentence in notes on parallel fuzzing. Thanks to Jakub Wilk. + + - Fixed a minor glitch in afl-cmin. Spotted by Jonathan Foote. + +### Version 1.84b: + + - Made SIMPLE_FILES behave as expected when naming backup directories for + crashes and hangs. + + - Added the total number of favored paths to fuzzer_stats. Requested by + Ben Nagy. + + - Made afl-tmin, afl-fuzz, and afl-cmin reject negative values passed to + -t and -m, since they generally won't work as expected. + + - Made a fix for no lahf / sahf support on older versions of FreeBSD. + Patch contributed by Alex Moneger. + +### Version 1.83b: + + - Fixed a problem with xargs -d on non-Linux systems in afl-cmin. Spotted by + teor2345 and Ben Nagy. + + - Fixed an implicit declaration in LLVM mode on MacOS X. Reported by + Kai Zhao. + +### Version 1.82b: + + - Fixed a harmless but annoying race condition in persistent mode - signal + delivery is a bit more finicky than I thought. + + - Updated the documentation to explain persistent mode a bit better. + + - Tweaked AFL_PERSISTENT to force AFL_NO_VAR_CHECK. + +### Version 1.81b: + + - Added persistent mode for in-process fuzzing. See llvm_mode/README.llvm. + Inspired by Kostya Serebryany and Christian Holler. + + - Changed the in-place resume code to preserve crashes/README.txt. Suggested + by Ben Nagy. + + - Included a potential fix for LLVM mode issues on MacOS X, based on the + investigation done by teor2345. + +### Version 1.80b: + + - Made afl-cmin tolerant of whitespaces in filenames. Suggested by + Jonathan Neuschafer and Ketil Froyn. + + - Added support for AFL_EXIT_WHEN_DONE, as suggested by Michael Rash. + +### Version 1.79b: + + - Added support for dictionary levels, see testcases/README.testcases. + + - Reworked the SQL dictionary to use levels. + + - Added a note about Preeny. + +### Version 1.78b: + + - Added a dictionary for PDF, contributed by Ben Nagy. + + - Added several references to afl-cov, a new tool by Michael Rash. + + - Fixed a problem with crash reporter detection on MacOS X, as reported by + Louis Dassy. + +### Version 1.77b: + + - Extended the -x option to support single-file dictionaries. + + - Replaced factory-packaged dictionaries with file-based variants. + + - Removed newlines from HTML keywords in testcases/_extras/html/. + +### Version 1.76b: + + - Very significantly reduced the number of duplicate execs during + deterministic checks, chiefly in int16 and int32 stages. Confirmed + identical path yields. This should improve early-stage efficiency by + around 5-10%. + + - Reduced the likelihood of duplicate non-deterministic execs by + bumping up lowest stacking factor from 1 to 2. Quickly confirmed + that this doesn't seem to have significant impact on coverage with + libpng. + + - Added a note about integrating afl-fuzz with third-party tools. + +### Version 1.75b: + + - Improved argv_fuzzing to allow it to emit empty args. Spotted by Jakub + Wilk. + + - afl-clang-fast now defines __AFL_HAVE_MANUAL_INIT. Suggested by Jakub Wilk. + + - Fixed a libtool-related bug with afl-clang-fast that would make some + ./configure invocations generate incorrect output. Spotted by Jakub Wilk. + + - Removed flock() on Solaris. This means no locking on this platform, + but so be it. Problem reported by Martin Carpenter. + + - Fixed a typo. Reported by Jakub Wilk. + +### Version 1.74b: + + - Added an example argv[] fuzzing wrapper in examples/argv_fuzzing. + Reworked the bash example to be faster, too. + + - Clarified llvm_mode prerequisites for FreeBSD. + + - Improved afl-tmin to use /tmp if cwd is not writeable. + + - Removed redundant includes for sys/fcntl.h, which caused warnings with + some nitpicky versions of libc. + + - Added a corpus of basic HTML tags that parsers are likely to pay attention + to (no attributes). + + - Added EP_EnabledOnOptLevel0 to llvm_mode, so that the instrumentation is + inserted even when AFL_DONT_OPTIMIZE=1 is set. + + - Switched qemu_mode to use the newly-released QEMU 2.3.0, which contains + a couple of minor bugfixes. + +### Version 1.73b: + + - Fixed a pretty stupid bug in effector maps that could sometimes cause + AFL to fuzz slightly more than necessary; and in very rare circumstances, + could lead to SEGV if eff_map is aligned with page boundary and followed + by an unmapped page. Spotted by Jonathan Gray. + +### Version 1.72b: + + - Fixed a glitch in non-x86 install, spotted by Tobias Ospelt. + + - Added a minor safeguard to llvm_mode Makefile following a report from + Kai Zhao. + +### Version 1.71b: + + - Fixed a bug with installed copies of AFL trying to use QEMU mode. Spotted + by G.M. Lime. + + - Added last path / crash / hang times to fuzzer_stats, suggested by + Richard Hipp. + + - Fixed a typo, thanks to Jakub Wilk. + +### Version 1.70b: + + - Modified resumption code to reuse the original timeout value when resuming + a session if -t is not given. This prevents timeout creep in continuous + fuzzing. + + - Added improved error messages for failed handshake when AFL_DEFER_FORKSRV + is set. + + - Made a slight improvement to llvm_mode/Makefile based on feedback from + Jakub Wilk. + + - Refreshed several bits of documentation. + + - Added a more prominent note about the MacOS X trade-offs to Makefile. + +### Version 1.69b: + + - Added support for deferred initialization in LLVM mode. Suggested by + Richard Godbee. + +### Version 1.68b: + + - Fixed a minor PRNG glitch that would make the first seconds of a fuzzing + job deterministic. Thanks to Andreas Stieger. + + - Made tmp[] static in the LLVM runtime to keep Valgrind happy (this had + no impact on anything else). Spotted by Richard Godbee. + + - Clarified the footnote in README. + +### Version 1.67b: + + - Made one more correction to llvm_mode Makefile, spotted by Jakub Wilk. + +### Version 1.66b: + + - Added CC / CXX support to llvm_mode Makefile. Requested by Charlie Eriksen. + + - Fixed 'make clean' with gmake. Suggested by Oliver Schneider. + + - Fixed 'make -j n clean all'. Suggested by Oliver Schneider. + + - Removed build date and time from banners to give people deterministic + builds. Requested by Jakub Wilk. + +### Version 1.65b: + + - Fixed a snafu with some leftover code in afl-clang-fast. + + - Corrected even moar typos. + +### Version 1.64b: + + - Further simplified afl-clang-fast runtime by reverting .init_array to + __attribute__((constructor(0)). This should improve compatibility with + non-ELF platforms. + + - Fixed a problem with afl-clang-fast and -shared libraries. Simplified + the code by getting rid of .preinit_array and replacing it with a .comm + object. Problem reported by Charlie Eriksen. + + - Removed unnecessary instrumentation density adjustment for the LLVM mode. + Reported by Jonathan Neuschafer. + +### Version 1.63b: + + - Updated cgroups_asan/ with a new version from Sam, made a couple changes + to streamline it and keep parallel afl instances in separate groups. + + - Fixed typos, thanks to Jakub Wilk. + +### Version 1.62b: + + - Improved the handling of -x in afl-clang-fast, + + - Improved the handling of low AFL_INST_RATIO settings for QEMU and + LLVM modes. + + - Fixed the llvm-config bug for good (thanks to Tobias Ospelt). + +### Version 1.61b: + + - Fixed an obscure bug compiling OpenSSL with afl-clang-fast. Patch by + Laszlo Szekeres. + + - Fixed a 'make install' bug on non-x86 systems, thanks to Tobias Ospelt. + + - Fixed a problem with half-broken llvm-config on Odroid, thanks to + Tobias Ospelt. (There is another odd bug there that hasn't been fully + fixed - TBD). + +### Version 1.60b: + + - Allowed examples/llvm_instrumentation/ to graduate to llvm_mode/. + + - Removed examples/arm_support/, since it's completely broken and likely + unnecessary with LLVM support in place. + + - Added ASAN cgroups script to examples/asan_cgroups/, updated existing + docs. Courtesy Sam Hakim and David A. Wheeler. + + - Refactored afl-tmin to reduce the number of execs in common use cases. + Ideas from Jonathan Neuschafer and Turo Lamminen. + + - Added a note about CLAs at the bottom of README. + + - Renamed testcases_readme.txt to README.testcases for some semblance of + consistency. + + - Made assorted updates to docs. + + - Added MEM_BARRIER() to afl-showmap and afl-tmin, just to be safe. + +### Version 1.59b: + + - Imported Laszlo Szekeres' experimental LLVM instrumentation into + examples/llvm_instrumentation. I'll work on including it in the + "mainstream" version soon. + + - Fixed another typo, thanks to Jakub Wilk. + +### Version 1.58b: + + - Added a workaround for abort() behavior in -lpthread programs in QEMU mode. + Spotted by Aidan Thornton. + + - Made several documentation updates, including links to the static + instrumentation tool (sister_projects.txt). + +### Version 1.57b: + + - Fixed a problem with exception handling on some versions of MacOS X. + Spotted by Samir Aguiar and Anders Wang Kristensen. + + - Tweaked afl-gcc to use BIN_PATH instead of a fixed string in help + messages. + +### Version 1.56b: + + - Renamed related_work.txt to historical_notes.txt. + + - Made minor edits to the ASAN doc. + + - Added docs/sister_projects.txt with a list of inspired or closely + related utilities. + +### Version 1.55b: + + - Fixed a glitch with afl-showmap opening /dev/null with O_RDONLY when + running in quiet mode. Spotted by Tyler Nighswander. + +### Version 1.54b: + + - Added another postprocessor example for PNG. + + - Made a cosmetic fix to realloc() handling in examples/post_library/, + suggested by Jakub Wilk. + + - Improved -ldl handling. Suggested by Jakub Wilk. + +### Version 1.53b: + + - Fixed an -l ordering issue that is apparently still a problem on Ubuntu. + Spotted by William Robinet. + +### Version 1.52b: + + - Added support for file format postprocessors. Requested by Ben Nagy. This + feature is intentionally buried, since it's fairly easy to misuse and + useful only in some scenarios. See examples/post_library/. + +### Version 1.51b: + + - Made it possible to properly override LD_BIND_NOW after one very unusual + report of trouble. + + - Cleaned up typos, thanks to Jakub Wilk. + + - Fixed a bug in AFL_DUMB_FORKSRV. + +### Version 1.50b: + + - Fixed a flock() bug that would prevent dir reuse errors from kicking + in every now and then. + + - Renamed references to ppvm (the project is now called recidivm). + + - Made improvements to file descriptor handling to avoid leaving some fds + unnecessarily open in the child process. + + - Fixed a typo or two. + +### Version 1.49b: + + - Added code to save original command line in fuzzer_stats and + crashes/README.txt. Also saves fuzzer version in fuzzer_stats. + Requested by Ben Nagy. + +### Version 1.48b: + + - Fixed a bug with QEMU fork server crashes when translation is attempted + after a jump to an invalid pointer in the child process (i.e., after + bumping into a particularly nasty security bug in the tested binary). + Reported by Tyler Nighswander. + +### Version 1.47b: + + - Fixed a bug with afl-cmin in -Q mode complaining about binary being not + instrumented. Thanks to Jonathan Neuschafer for the bug report. + + - Fixed another bug with argv handling for afl-fuzz in -Q mode. Reported + by Jonathan Neuschafer. + + - Improved the use of colors when showing crash counts in -C mode. + +### Version 1.46b: + + - Improved instrumentation performance on 32-bit systems by getting rid of + xor-swap (oddly enough, xor-swap is still faster on 64-bit) and tweaking + alignment. + + - Made path depth numbers more accurate with imported test cases. + +### Version 1.45b: + + - Added support for SIMPLE_FILES in config.h for folks who don't like + descriptive file names. Generates very simple names without colons, + commas, plus signs, dashes, etc. + + - Replaced zero-sized files with symlinks in the variable behavior state + dir to simplify examining the relevant test cases. + + - Changed the period of limited-range block ops from 5 to 10 minutes based + on a couple of experiments. The basic goal of this delay timer behavior + is to better support jobs that are seeded with completely invalid files, + in which case, the first few queue cycles may be completed very quickly + without discovering new paths. Should have no effect on well-seeded jobs. + + - Made several minor updates to docs. + +### Version 1.44b: + + - Corrected two bungled attempts to get the -C mode work properly + with afl-cmin (accounting for the short-lived releases tagged 1.42 and + 1.43b) - sorry. + + - Removed AFL_ALLOW_CRASHES in favor of the -C mode in said tool. + + - Said goodbye to Hello Kitty, as requested by Padraig Brady. + +### Version 1.41b: + + - Added AFL_ALLOW_CRASHES=1 to afl-cmin. Allows crashing inputs in the + output corpus. Changed the default behavior to disallow it. + + - Made the afl-cmin output dir default to 0700, not 0755, to be consistent + with afl-fuzz; documented the rationale for 0755 in afl-plot. + + - Lowered the output dir reuse time limit to 25 minutes as a dice-roll + compromise after a discussion on afl-users@. + + - Made afl-showmap accept -o /dev/null without borking out. + + - Added support for crash / hang info in exit codes of afl-showmap. + + - Tweaked block operation scaling to also factor in ballpark run time + in cases where queue passes take very little time. + + - Fixed typos and made improvements to several docs. + +### Version 1.40b: + + - Switched to smaller block op sizes during the first passes over the + queue. Helps keep test cases small. + + - Added memory barrier for run_target(), just in case compilers get + smarter than they are today. + + - Updated a bunch of docs. + +### Version 1.39b: + + - Added the ability to skip inputs by sending SIGUSR1 to the fuzzer. + + - Reworked several portions of the documentation. + + - Changed the code to reset splicing perf scores between runs to keep + them closer to intended length. + + - Reduced the minimum value of -t to 5 for afl-fuzz (~200 exec/sec) + and to 10 for auxiliary tools (due to the absence of a fork server). + + - Switched to more aggressive default timeouts (rounded up to 25 ms + versus 50 ms - ~40 execs/sec) and made several other cosmetic changes + to the timeout code. + +### Version 1.38b: + + - Fixed a bug in the QEMU build script, spotted by William Robinet. + + - Improved the reporting of skipped bitflips to keep the UI counters a bit + more accurate. + + - Cleaned up related_work.txt and added some non-goals. + + - Fixed typos, thanks to Jakub Wilk. + +### Version 1.37b: + + - Added effector maps, which detect regions that do not seem to respond + to bitflips and subsequently exclude them from more expensive steps + (arithmetics, known ints, etc). This should offer significant performance + improvements with quite a few types of text-based formats, reducing the + number of deterministic execs by a factor of 2 or so. + + - Cleaned up mem limit handling in afl-cmin. + + - Switched from uname -i to uname -m to work around Gentoo-specific + issues with coreutils when building QEMU. Reported by William Robinet. + + - Switched from PID checking to flock() to detect running sessions. + Problem, against all odds, bumped into by Jakub Wilk. + + - Added SKIP_COUNTS and changed the behavior of COVERAGE_ONLY in config.h. + Useful only for internal benchmarking. + + - Made improvements to UI refresh rates and exec/sec stats to make them + more stable. + + - Made assorted improvements to the documentation and to the QEMU build + script. + + - Switched from perror() to strerror() in error macros, thanks to Jakub + Wilk for the nag. + + - Moved afl-cmin back to bash, wasn't thinking straight. It has to stay + on bash because other shells may have restrictive limits on array sizes. + +### Version 1.36b: + + - Switched afl-cmin over to /bin/sh. Thanks to Jonathan Gray. + + - Fixed an off-by-one bug in queue limit check when resuming sessions + (could cause NULL ptr deref if you are *really* unlucky). + + - Fixed the QEMU script to tolerate i686 if returned by uname -i. Based on + a problem report from Sebastien Duquette. + + - Added multiple references to Jakub's ppvm tool. + + - Made several minor improvements to the Makefile. + + - Believe it or not, fixed some typos. Thanks to Jakub Wilk. + +### Version 1.35b: + + - Cleaned up regular expressions in some of the scripts to avoid errors + on *BSD systems. Spotted by Jonathan Gray. + +### Version 1.34b: + + - Performed a substantial documentation and program output cleanup to + better explain the QEMU feature. + +### Version 1.33b: + + - Added support for AFL_INST_RATIO and AFL_INST_LIBS in the QEMU mode. + + - Fixed a stack allocation crash in QEMU mode (bug in QEMU, fixed with + an extra patch applied to the downloaded release). + + - Added code to test the QEMU instrumentation once the afl-qemu-trace + binary is built. + + - Modified afl-tmin and afl-showmap to search $PATH for binaries and to + better handle QEMU support. + + - Added a check for instrumented binaries when passing -Q to afl-fuzz. + +### Version 1.32b: + + - Fixed 'make install' following the QEMU changes. Spotted by Hanno Boeck. + + - Fixed EXTRA_PAR handling in afl-cmin. + +### Version 1.31b: + + - Hallelujah! Thanks to Andrew Griffiths, we now support very fast, black-box + instrumentation of binary-only code. See qemu_mode/README.qemu. + + To use this feature, you need to follow the instructions in that + directory and then run afl-fuzz with -Q. + +### Version 1.30b: + + - Added -s (summary) option to afl-whatsup. Suggested by Jodie Cunningham. + + - Added a sanity check in afl-tmin to detect minimization to zero len or + excess hangs. + + - Fixed alphabet size counter in afl-tmin. + + - Slightly improved the handling of -B in afl-fuzz. + + - Fixed process crash messages with -m none. + +### Version 1.29b: + + - Improved the naming of test cases when orig: is already present in the file + name. + + - Made substantial improvements to technical_details.txt. + +### Version 1.28b: + + - Made a minor tweak to the instrumentation to preserve the directionality + of tuples (i.e., A -> B != B -> A) and to maintain the identity of tight + loops (A -> A). You need to recompile targeted binaries to leverage this. + + - Cleaned up some of the afl-whatsup stats. + + - Added several sanity checks to afl-cmin. + +### Version 1.27b: + + - Made afl-tmin recursive. Thanks to Hanno Boeck for the tip. + + - Added docs/technical_details.txt. + + - Changed afl-showmap search strategy in afl-cmap to just look into the + same place that afl-cmin is executed from. Thanks to Jakub Wilk. + + - Removed current_todo.txt and cleaned up the remaining docs. + +### Version 1.26b: + + - Added total execs/sec stat for afl-whatsup. + + - afl-cmin now auto-selects between cp or ln. Based on feedback from + Even Huus. + + - Fixed a typo. Thanks to Jakub Wilk. + + - Made afl-gotcpu a bit more accurate by using getrusage instead of + times. Thanks to Jakub Wilk. + + - Fixed a memory limit issue during the build process on NetBSD-current. + Reported by Thomas Klausner. + +### Version 1.25b: + + - Introduced afl-whatsup, a simple tool for querying the status of + local synced instances of afl-fuzz. + + - Added -x compiler to clang options on Darwin. Suggested by Filipe + Cabecinhas. + + - Improved exit codes for afl-gotcpu. + + - Improved the checks for -m and -t values in afl-cmin. Bug report + from Evan Huus. + +### Version 1.24b: + + - Introduced afl-getcpu, an experimental tool to empirically measure + CPU preemption rates. Thanks to Jakub Wilk for the idea. + +### Version 1.23b: + + - Reverted one change to afl-cmin that actually made it slower. + +### Version 1.22b: + + - Reworked afl-showmap.c to support normal options, including -o, -q, + -e. Also added support for timeouts and memory limits. + + - Made changes to afl-cmin and other scripts to accommodate the new + semantics. + + - Officially retired AFL_EDGES_ONLY. + + - Fixed another typo in afl-tmin, courtesy of Jakub Wilk. + +### Version 1.21b: + + - Graduated minimize_corpus.sh to afl-cmin. It is now a first-class + utility bundled with the fuzzer. + + - Made significant improvements to afl-cmin to make it faster, more + robust, and more versatile. + + - Refactored some of afl-tmin code to make it a bit more readable. + + - Made assorted changes to the doc to document afl-cmin and other stuff. + +### Version 1.20b: + + - Added AFL_DUMB_FORKSRV, as requested by Jakub Wilk. This works only + in -n mode and allows afl-fuzz to run with "dummy" fork servers that + don't output any instrumentation, but follow the same protocol. + + - Renamed AFL_SKIP_CHECKS to AFL_SKIP_BIN_CHECK to make it at least + somewhat descriptive. + + - Switched to using clang as the default assembler on MacOS X to work + around Xcode issues with newer builds of clang. Testing and patch by + Nico Weber. + + - Fixed a typo (via Jakub Wilk). + +### Version 1.19b: + + - Improved exec failure detection in afl-fuzz and afl-showmap. + + - Improved Ctrl-C handling in afl-showmap. + + - Added afl-tmin, a handy instrumentation-enabled minimizer. + +### Version 1.18b: + + - Fixed a serious but short-lived bug in the resumption behavior introduced + in version 1.16b. + + - Added -t nn+ mode for soft-skipping timing-out paths. + +### Version 1.17b: + + - Fixed a compiler warning introduced in 1.16b for newer versions of GCC. + Thanks to Jakub Wilk and Ilfak Guilfanov. + + - Improved the consistency of saving fuzzer_stats, bitmap info, and + auto-dictionaries when aborting fuzzing sessions. + + - Made several noticeable performance improvements to deterministic arith + and known int steps. + +### Version 1.16b: + + - Added a bit of code to make resumption pick up from the last known + offset in the queue, rather than always rewinding to the start. Suggested + by Jakub Wilk. + + - Switched to tighter timeout control for slow programs (3x rather than + 5x average exec speed at init). + +### Version 1.15b: + + - Added support for AFL_NO_VAR_CHECK to speed up resumption and inhibit + variable path warnings for some programs. + + - Made the trimmer run even for variable paths, since there is no special + harm in doing so and it can be very beneficial if the trimming still + pans out. + + - Made the UI a bit more descriptive by adding "n/a" instead of "0" in a + couple of corner cases. + +### Version 1.14b: + + - Added a (partial) dictionary for JavaScript. + + - Added AFL_NO_CPU_RED, as suggested by Jakub Wilk. + + - Tweaked the havoc scaling logic added in 1.12b. + +### Version 1.13b: + + - Improved the performance of minimize_corpus.sh by switching to a + sort-based approach. + + - Made several minor revisions to the docs. + +### Version 1.12b: + + - Made an improvement to dictionary generation to avoid runs of identical + bytes. + + - Added havoc cycle scaling to help with slow binaries in -d mode. Based on + a thread with Sami Liedes. + + - Added AFL_SYNC_FIRST for afl-fuzz. This is useful for those who obsess + over stats, no special purpose otherwise. + + - Switched to more robust box drawing codes, suggested by Jakub Wilk. + + - Created faster 64-bit variants of several critical-path bitmap functions + (sorry, no difference on 32 bits). + + - Fixed moar typos, as reported by Jakub Wilk. + +### Version 1.11b: + + - Added a bit more info about dictionary strategies to the status screen. + +### Version 1.10b: + + - Revised the dictionary behavior to use insertion and overwrite in + deterministic steps, rather than just the latter. This improves coverage + with SQL and the like. + + - Added a mention of "*" in status_screen.txt, as suggested by Jakub Wilk. + +### Version 1.09b: + + - Corrected a cosmetic problem with 'extras' stage count not always being + accurate in the stage yields view. + + - Fixed a typo reported by Jakub Wilk and made some minor documentation + improvements. + +### Version 1.08b: + + - Fixed a div-by-zero bug in the newly-added code when using a dictionary. + +### Version 1.07b: + + - Added code that automatically finds and extracts syntax tokens from the + input corpus. + + - Fixed a problem with ld dead-code removal option on MacOS X, reported + by Filipe Cabecinhas. + + - Corrected minor typos spotted by Jakub Wilk. + + - Added a couple of more exotic archive format samples. + +### Version 1.06b: + + - Switched to slightly more accurate (if still not very helpful) reporting + of short read and short write errors. These theoretically shouldn't happen + unless you kill the forkserver or run out of disk space. Suggested by + Jakub Wilk. + + - Revamped some of the allocator and debug code, adding comments and + cleaning up other mess. + + - Tweaked the odds of fuzzing non-favored test cases to make sure that + baseline coverage of all inputs is reached sooner. + +### Version 1.05b: + + - Added a dictionary for WebP. + + - Made some additional performance improvements to minimize_corpus.sh, + getting deeper into the bash woods. + +### Version 1.04b: + + - Made substantial performance improvements to minimize_corpus.sh with + large datasets, albeit at the expense of having to switch back to bash + (other shells may have limits on array sizes, etc). + + - Tweaked afl-showmap to support the format used by the new script. + +### Version 1.03b: + + - Added code to skip README.txt in the input directory to make the crash + exploration mode work better. Suggested by Jakub Wilk. + + - Added a dictionary for SQLite. + +### Version 1.02b: + + - Reverted the ./ search path in minimize_corpus.sh because people did + not like it. + + - Added very explicit warnings not to run various shell scripts that + read or write to /tmp/ (since this is generally a pretty bad idea on + multi-user systems). + + - Added a check for /tmp binaries and -f locations in afl-fuzz. + +### Version 1.01b: + + - Added dictionaries for XML and GIF. + +### Version 1.00b: + + - Slightly improved the performance of minimize_corpus.sh, especially on + Linux. + + - Made a couple of improvements to calibration timeouts for resumed scans. + +### Version 0.99b: + + - Fixed minimize_corpus.sh to work with dash, as suggested by Jakub Wilk. + + - Modified minimize_corpus.sh to try locate afl-showmap in $PATH and ./. + The first part requested by Jakub Wilk. + + - Added support for afl-as --version, as required by one funky build + script. Reported by William Robinet. + +### Version 0.98b: + + - Added a dictionary for TIFF. + + - Fixed another cosmetic snafu with stage exec counts for -x. + + - Switched afl-plot to /bin/sh, since it seems bashism-free. Also tried + to remove any obvious bashisms from other examples/ scripts, + most notably including minimize_corpus.sh and triage_crashes.sh. + Requested by Jonathan Gray. + +### Version 0.97b: + + - Fixed cosmetic issues around the naming of -x strategy files. + + - Added a dictionary for JPEG. + + - Fixed a very rare glitch when running instrumenting 64-bit code that makes + heavy use of xmm registers that are also touched by glibc. + +### Version 0.96b: + + - Added support for extra dictionaries, provided testcases/_extras/png/ + as a demo. + + - Fixed a minor bug in number formatting routines used by the UI. + + - Added several additional PNG test cases that are relatively unlikely + to be hit by chance. + + - Fixed afl-plot syntax for gnuplot 5.x. Reported by David Necas. + +### Version 0.95b: + + - Cleaned up the OSX ReportCrash code. Thanks to Tobias Ospelt for help. + + - Added some extra tips for AFL_NO_FORKSERVER on OSX. + + - Refreshed the INSTALL file. + +### Version 0.94b: + + - Added in-place resume (-i-) to address a common user complaint. + + - Added an awful workaround for ReportCrash on MacOS X. Problem + spotted by Joseph Gentle. + +### Version 0.93b: + + - Fixed the link() workaround, as reported by Jakub Wilk. + +### Version 0.92b: + + - Added support for reading test cases from another filesystem. + Requested by Jakub Wilk. + + - Added pointers to the mailing list. + + - Added a sample PDF document. + +### Version 0.91b: + + - Refactored minimize_corpus.sh to make it a bit more user-friendly and to + select for smallest files, not largest bitmaps. Offers a modest corpus + size improvement in most cases. + + - Slightly improved the performance of splicing code. + +### Version 0.90b: + + - Moved to an algorithm where paths are marked as preferred primarily based + on size and speed, rather than bitmap coverage. This should offer + noticeable performance gains in many use cases. + + - Refactored path calibration code; calibration now takes place as soon as a + test case is discovered, to facilitate better prioritization decisions later + on. + + - Changed the way of marking variable paths to avoid .state metadata + inconsistencies. + + - Made sure that calibration routines always create a new test case to avoid + hypothetical problems with utilities that modify the input file. + + - Added bitmap saturation to fuzzer stats and plot data. + + - Added a testcase for JPEG XR. + + - Added a tty check for the colors warning in Makefile, to keep distro build + logs tidy. Suggested by Jakub Wilk. + +### Version 0.89b: + + - Renamed afl-plot.sh to afl-plot, as requested by Padraig Brady. + + - Improved the compatibility of afl-plot with older versions of gnuplot. + + - Added banner information to fuzzer_stats, populated it to afl-plot. + +### Version 0.88b: + + - Added support for plotting, with design and implementation based on a + prototype design proposed by Michael Rash. Huge thanks! + + - Added afl-plot.sh, which allows you to, well, generate a nice plot using + this data. + + - Refactored the code slightly to make more frequent updates to fuzzer_stats + and to provide more detail about synchronization. + + - Added an fflush(stdout) call for non-tty operation, as requested by + Joonas Kuorilehto. + + - Added some detail to fuzzer_stats for parity with plot_file. + +### Version 0.87b: + + - Added support for MSAN, via AFL_USE_MSAN, same gotchas as for ASAN. + +### Version 0.86b: + + - Added AFL_NO_FORKSRV, allowing the forkserver to be bypassed. Suggested + by Ryan Govostes. + + - Simplified afl-showmap.c to make use of the no-forkserver mode. + + - Made minor improvements to crash_triage.sh, as suggested by Jakub Wilk. + +### Version 0.85b: + + - Fixed the CPU counting code - no sysctlbyname() on OpenBSD, d'oh. Bug + reported by Daniel Dickman. + + - Made a slight correction to error messages - the advice on testing + with ulimit was a tiny bit off by a factor of 1024. + +### Version 0.84b: + + - Added support for the CPU widget on some non-Linux platforms (I hope). + Based on feedback from Ryan Govostes. + + - Cleaned up the changelog (very meta). + +### Version 0.83b: + + - Added examples/clang_asm_normalize/ and related notes in + env_variables.txt and afl-as.c. Thanks to Ryan Govostes for the idea. + + - Added advice on hardware utilization in README. + +### Version 0.82b: + + - Made additional fixes for Xcode support, juggling -Q and -q flags. Thanks to + Ryan Govostes. + + - Added a check for __asm__ blocks and switches to .intel_syntax in assembly. + Based on feedback from Ryan Govostes. + +### Version 0.81b: + + - A workaround for Xcode 6 as -Q flag glitch. Spotted by Ryan Govostes. + + - Improved Solaris build instructions, as suggested by Martin Carpenter. + + - Fix for a slightly busted path scoring conditional. Minor practical impact. + +### Version 0.80b: + + - Added a check for $PATH-induced loops. Problem noticed by Kartik Agaram. + + - Added AFL_KEEP_ASSEMBLY for easier troubleshooting. + + - Added an override for AFL_USE_ASAN if set at afl compile time. Requested by + Hanno Boeck. + +### Version 0.79b: + + - Made minor adjustments to path skipping logic. + + - Made several documentation updates to reflect the path selection changes + made in 0.78b. + +### Version 0.78b: + + - Added a CPU governor check. Bug report from Joe Zbiciak. + + - Favored paths are now selected strictly based on new edges, not hit + counts. This speeds up the first pass by a factor of 3-6x without + significantly impacting ultimate coverage (tested with libgif, libpng, + libjpeg). + + It also allows some performance & memory usage improvements by making + some of the in-memory bitmaps much smaller. + + - Made multiple significant performance improvements to bitmap checking + functions, plus switched to a faster hash. + + - Owing largely to these optimizations, bumped the size of the bitmap to + 64k and added a warning to detect older binaries that rely on smaller + bitmaps. + +### Version 0.77b: + + - Added AFL_SKIP_CHECKS to bypass binary checks when really warranted. + Feature requested by Jakub Wilk. + + - Fixed a couple of typos. + + - Added a warning for runs that are aborted early on. + +### Version 0.76b: + + - Incorporated another signal handling fix for Solaris. Suggestion + submitted by Martin Carpenter. + +### Version 0.75b: + + - Implemented a slightly more "elegant" kludge for the %llu glitch (see + types.h). + + - Relaxed CPU load warnings to stay in sync with reality. + +### Version 0.74b: + + - Switched to more responsive exec speed averages and better UI speed + scaling. + + - Fixed a bug with interrupted reads on Solaris. Issue spotted by Martin + Carpenter. + +### Version 0.73b: + + - Fixed a stray memcpy() instead of memmove() on overlapping buffers. + Mostly harmless but still dumb. Mistake spotted thanks to David Higgs. + +### Version 0.72b: + + - Bumped map size up to 32k. You may want to recompile instrumented + binaries (but nothing horrible will happen if you don't). + + - Made huge performance improvements for bit-counting functions. + + - Default optimizations now include -funroll-loops. This should have + interesting effects on the instrumentation. Frankly, I'm just going to + ship it and see what happens next. I have a good feeling about this. + + - Made a fix for stack alignment crash on MacOS X 10.10; looks like the + rhetorical question in the comments in afl-as.h has been answered. + Tracked down by Mudge Zatko. + +### Version 0.71b: + + - Added a fix for the nonsensical MacOS ELF check. Spotted by Mudge Zatko. + + - Made some improvements to ASAN checks. + +### Version 0.70b: + + - Added explicit detection of ASANified binaries. + + - Fixed compilation issues on Solaris. Reported by Martin Carpenter. + +### Version 0.69b: + + - Improved the detection of non-instrumented binaries. + + - Made the crash counter in -C mode accurate. + + - Fixed an obscure install bug that made afl-as non-functional with the tool + installed to /usr/bin instead of /usr/local/bin. Found by Florian Kiersch. + + - Fixed for a cosmetic SIGFPE when Ctrl-C is pressed while the fork server + is spinning up. + +### Version 0.68b: + + - Added crash exploration mode! Woot! + +### Version 0.67b: + + - Fixed several more typos, the project is now cartified 100% typo-free. + Thanks to Thomas Jarosch and Jakub Wilk. + + - Made a change to write fuzzer_stats early on. + + - Fixed a glitch when (not!) running on MacOS X as root. Spotted by Tobias + Ospelt. + + - Made it possible to override -O3 in Makefile. Suggested by Jakub Wilk. + +### Version 0.66b: + + - Fixed a very obscure issue with build systems that use gcc as an assembler + for hand-written .s files; this would confuse afl-as. Affected nss, reported + by Hanno Boeck. + + - Fixed a bug when cleaning up synchronized fuzzer output dirs. Issue reported + by Thomas Jarosch. + +### Version 0.65b: + + - Cleaned up shell printf escape codes in Makefile. Reported by Jakub Wilk. + + - Added more color to fuzzer_stats, provided short documentation of the file + format, and made several other stats-related improvements. + +### Version 0.64b: + + - Enabled GCC support on MacOS X. + +### Version 0.63b: + + - Provided a new, simplified way to pass data in files (@@). See README. + + - Made additional fixes for 64-bit MacOS X, working around a crashing bug in + their linker (umpf) and several other things. It's alive! + + - Added a minor workaround for a bug in 64-bit FreeBSD (clang -m32 -g doesn't + work on that platform, but clang -m32 does, so we no longer insert -g). + + - Added a build-time warning for inverse video terminals and better + instructions in status_screen.txt. + +### Version 0.62b: + + - Made minor improvements to the allocator, as suggested by Tobias Ospelt. + + - Added example instrumented memcmp() in examples/instrumented_cmp. + + - Added a speculative fix for MacOS X (clang detection, again). + + - Fixed typos in parallel_fuzzing.txt. Problems spotted by Thomas Jarosch. + +### Version 0.61b: + + - Fixed a minor issue with clang detection on systems with a clang cc + wrapper, so that afl-gcc doesn't confuse it with GCC. + + - Made cosmetic improvements to docs and to the CPU load indicator. + + - Fixed a glitch with crash removal (README.txt left behind, d'oh). + +### Version 0.60b: + + - Fixed problems with jump tables generated by exotic versions of GCC. This + solves an outstanding problem on OpenBSD when using afl-gcc + PIE (not + present with afl-clang). + + - Fixed permissions on one of the sample archives. + + - Added a lahf / sahf workaround for OpenBSD (their assembler doesn't know + about these opcodes). + + - Added docs/INSTALL. + +### Version 0.59b: + + - Modified 'make install' to also install test cases. + + - Provided better pointers to installed README in afl-fuzz. + + - More work on RLIMIT_AS for OpenBSD. + +### Version 0.58b: + + - Added a core count check on Linux. + + - Refined the code for the lack-of-RLIMIT_AS case on OpenBSD. + + - Added a rudimentary CPU utilization meter to help with optimal loading. + +### Version 0.57b: + + - Made fixes to support FreeBSD and OpenBSD: use_64bit is now inferred if not + explicitly specified when calling afl-as, and RLIMIT_AS is behind an #ifdef. + Thanks to Fabian Keil and Jonathan Gray for helping troubleshoot this. + + - Modified 'make install' to also install docs (in /usr/local/share/doc/afl). + + - Fixed a typo in status_screen.txt. + + - Made a couple of Makefile improvements as proposed by Jakub Wilk. + +### Version 0.56b: + + - Added probabilistic instrumentation density reduction in ASAN mode. This + compensates for ASAN-specific branches in a crude but workable way. + + - Updated notes_for_asan.txt. + +### Version 0.55b: + + - Implemented smarter out_dir behavior, automatically deleting directories + that don't contain anything of special value. Requested by several folks, + including Hanno Boeck. + + - Added more detail in fuzzer_stats (start time, run time, fuzzer PID). + + - Implemented support for configurable install prefixes in Makefile + ($PREFIX), as requested by Luca Barbato. + + - Made it possible to resume by doing -i , without having to specify + -i /queue/. + +### Version 0.54b: + + - Added a fix for -Wformat warning messages (oops, I thought this had been in + place for a while). + +### Version 0.53b: + + - Redesigned the crash & hang duplicate detection code to better deal with + fault conditions that can be reached in a multitude of ways. + + The old approach could be compared to hashing stack traces to de-dupe + crashes, a method prone to crash count inflation. The alternative I + wanted to avoid would be equivalent to just looking at crash %eip, + which can have false negatives in common functions such as memcpy(). + + The middle ground currently used in afl-fuzz can be compared to looking + at every line item in the stack trace and tagging crashes as unique if + we see any function name that we haven't seen before (or if something that + we have *always* seen there suddenly disappears). We do the comparison + without paying any attention to ordering or hit counts. This can still + cause some crash inflation early on, but the problem will quickly taper + off. So, you may get 20 dupes instead of 5,000. + + - Added a fix for harmless but absurd trim ratios shown if the first exec in + the trimmer timed out. Spotted by @EspenGx. + +### Version 0.52b: + + - Added a quick summary of the contents in examples/. + + - Made a fix to the process of writing fuzzer_stats. + + - Slightly reorganized the .state/ directory, now recording redundant paths, + too. Note that this breaks the ability to properly resume older sessions + - sorry about that. + + (To fix this, simply move /.state/* from an older run + to /.state/deterministic_done/*.) + +### Version 0.51b: + + - Changed the search order for afl-as to avoid the problem with older copies + installed system-wide; this also means that I can remove the Makefile check + for that. + + - Made it possible to set instrumentation ratio of 0%. + + - Introduced some typos, fixed others. + + - Fixed the test_prev target in Makefile, as reported by Ozzy Johnson. + +### Version 0.50b: + + - Improved the 'make install' logic, as suggested by Padraig Brady. + + - Revamped various bits of the documentation, especially around perf_tips.txt; + based on the feedback from Alexander Cherepanov. + + - Added AFL_INST_RATIO to afl-as. The only case where this comes handy is + ffmpeg, at least as far as I can tell. (Trivia: the current version of + ffmpeg ./configure also ignores CC and --cc, probably unintentionally). + + - Added documentation for all environmental variables (env_variables.txt). + + - Implemented a visual warning for excessive or insufficient bitmap density. + + - Changed afl-gcc to add -O3 by default; use AFL_DONT_OPTIMIZE if you don't + like that. Big speed gain for ffmpeg, so seems like a good idea. + + - Made a regression fix to afl-as to ignore .LBB labels in gcc mode. + +### Version 0.49b: + + - Fixed more typos, as found by Jakub Wilk. + + - Added support for clang! + + - Changed AFL_HARDEN to *not* include ASAN by default. Use AFL_USE_ASAN if + needed. The reasons for this are in notes_for_asan.txt. + + - Switched from configure auto-detection to isatty() to keep afl-as and + afl-gcc quiet. + + - Improved installation process to properly create symlinks, rather than + copies of binaries. + +### Version 0.48b: + + - Improved afl-fuzz to force-set ASAN_OPTIONS=abort_on_error=1. Otherwise, + ASAN crashes wouldn't be caught at all. Reported by Hanno Boeck. + + - Improved Makefile mkdir logic, as suggested by Hanno Boeck. + + - Improved the 64-bit instrumentation to properly save r8-r11 registers in + the x86 setup code. The old behavior could cause rare problems running + *without* instrumentation when the first function called in a particular + .o file has 5+ parameters. No impact on code running under afl-fuzz or + afl-showmap. Issue spotted by Padraig Brady. + +### Version 0.47b: + + - Fixed another Makefile bug for parallel builds of afl. Problem identified + by Richard W. M. Jones. + + - Added support for suffixes for -m. + + - Updated the documentation and added notes_for_asan.txt. Based on feedback + from Hanno Boeck, Ben Laurie, and others. + + - Moved the project to http://lcamtuf.coredump.cx/afl/. + +### Version 0.46b: + + - Cleaned up Makefile dependencies for parallel builds. Requested by + Richard W. M. Jones. + + - Added support for DESTDIR in Makefile. Once again suggested by + Richard W. M. Jones :-) + + - Removed all the USE_64BIT stuff; we now just auto-detect compilation mode. + As requested by many callers to the show. + + - Fixed rare problems with programs that use snippets of assembly and + switch between .code32 and .code64. Addresses a glitch spotted by + Hanno Boeck with compiling ToT gdb. + +### Version 0.45b: + + - Implemented a test case trimmer. Results in 20-30% size reduction for many + types of work loads, with very pronounced improvements in path discovery + speeds. + + - Added better warnings for various problems with input directories. + + - Added a Makefile warning for older copies, based on counterintuitive + behavior observed by Hovik Manucharyan. + + - Added fuzzer_stats file for status monitoring. Suggested by @dronesec. + + - Fixed moar typos, thanks to Alexander Cherepanov. + + - Implemented better warnings for ASAN memory requirements, based on calls + from several angry listeners. + + - Switched to saner behavior with non-tty stdout (less output generated, + no ANSI art). + +### Version 0.44b: + + - Added support for AFL_CC and AFL_CXX, based on a patch from Ben Laurie. + + - Replaced afl-fuzz -S -D with -M for simplicity. + + - Added a check for .section .text; lack of this prevented main() from + getting instrumented for some users. Reported by Tom Ritter. + + - Reorganized the testcases/ directory. + + - Added an extra check to confirm that the build is operational. + + - Made more consistent use of color reset codes, as suggested by Oliver + Kunz. + +### Version 0.43b: + + - Fixed a bug with 64-bit gcc -shared relocs. + + - Removed echo -e from Makefile for compatibility with dash. Suggested + by Jakub Wilk. + + - Added status_screen.txt. + + - Added examples/canvas_harness. + + - Made a minor change to the Makefile GCC check. Suggested by Hanno Boeck. + +### Version 0.42b: + + - Fixed a bug with red zone handling for 64-bit (oops!). Problem reported by + Felix Groebert. + + - Implemented horribly experimental ARM support in examples/arm_support. + + - Made several improvements to error messages. + + - Added AFL_QUIET to silence afl-gcc and afl-as when using wonky build + systems. Reported by Hanno Boeck. + + - Improved check for 64-bit compilation, plus several sanity checks + in Makefile. + +### Version 0.41b: + + - Fixed a fork served bug for processes that call execve(). + + - Made minor compatibility fixes to Makefile, afl-gcc; suggested by Jakub + Wilk. + + - Fixed triage_crashes.sh to work with the new layout of output directories. + Suggested by Jakub Wilk. + + - Made multiple performance-related improvements to the injected + instrumentation. + + - Added visual indication of the number of imported paths. + + - Fixed afl-showmap to make it work well with new instrumentation. + + - Added much better error messages for crashes when importing test cases + or otherwise calibrating the binary. + +### Version 0.40b: + + - Added support for parallelized fuzzing. Inspired by earlier patch + from Sebastian Roschke. + + - Added an example in examples/distributed_fuzzing/. + +### Version 0.39b: + + - Redesigned status screen, now 90% more spiffy. + + - Added more verbose and user-friendly messages for some common problems. + + - Modified the resumption code to reconstruct path depth. + + - Changed the code to inhibit core dumps and improve the ability to detect + SEGVs. + + - Added a check for redirection of core dumps to programs. + + - Made a minor improvement to the handling of variable paths. + + - Made additional performance tweaks to afl-fuzz, chiefly around mem limits. + + - Added performance_tips.txt. + +### Version 0.38b: + + - Fixed an fd leak and +cov tracking bug resulting from changes in 0.37b. + + - Implemented auto-scaling for screen update speed. + + - Added a visual indication when running in non-instrumented mode. + +### Version 0.37b: + + - Added fuzz state tracking for more seamless resumption of aborted + fuzzing sessions. + + - Removed the -D option, as it's no longer necessary. + + - Refactored calibration code and improved startup reporting. + + - Implemented dynamically scaled timeouts, so that you don't need to + play with -t except in some very rare cases. + + - Added visual notification for slow binaries. + + - Improved instrumentation to explicitly cover the other leg of every + branch. + +### Version 0.36b: + + - Implemented fork server support to avoid the overhead of execve(). A + nearly-verbatim design from Jann Horn; still pending part 2 that would + also skip initial setup steps (thinking about reliable heuristics now). + + - Added a check for shell scripts used as fuzz targets. + + - Added a check for fuzz jobs that don't seem to be finding anything. + + - Fixed the way IGNORE_FINDS works (was a bit broken after adding splicing + and path skip heuristics). + +### Version 0.35b: + + - Properly integrated 64-bit instrumentation into afl-as. + +### Version 0.34b: + + - Added a new exec count classifier (the working theory is that it gets + meaningful coverage with fewer test cases spewed out). + +### Version 0.33b: + + - Switched to new, somewhat experimental instrumentation that tries to + target only arcs, rather than every line. May be fragile, but is a lot + faster (2x+). + + - Made several other cosmetic fixes and typo corrections, thanks to + Jakub Wilk. + +### Version 0.32b: + + - Another take at fixing the C++ exception thing. Reported by Jakub Wilk. + +### Version 0.31b: + + - Made another fix to afl-as to address a potential problem with newer + versions of GCC (introduced in 0.28b). Thanks to Jann Horn. + +### Version 0.30b: + + - Added more detail about the underlying operations in file names. + +### Version 0.29b: + + - Made some general improvements to chunk operations. + +### Version 0.28b: + + - Fixed C++ exception handling in newer versions of GCC. Problem diagnosed + by Eberhard Mattes. + + - Fixed the handling of the overflow flag. Once again, thanks to + Eberhard Mattes. + +### Version 0.27b: + + - Added prioritization of new paths over the already-fuzzed ones. + + - Included spliced test case ID in the output file name. + + - Fixed a rare, cosmetic null ptr deref after Ctrl-C. + + - Refactored the code to make copies of test cases in the output directory. + + - Switched to better output file names, keeping track of stage and splicing + sources. + +### Version 0.26b: + + - Revamped storage of testcases, -u option removed, + + - Added a built-in effort minimizer to get rid of potentially redundant + inputs, + + - Provided a testcase count minimization script in examples/, + + - Made miscellaneous improvements to directory and file handling. + + - Fixed a bug in timeout detection. + +### Version 0.25b: + + - Improved count-based instrumentation. + + - Improved the hang deduplication logic. + + - Added -cov prefixes for test cases. + + - Switched from readdir() to scandir() + alphasort() to preserve ordering of + test cases. + + - Added a splicing strategy. + + - Made various minor UI improvements and several other bugfixes. + +### Version 0.24b: + + - Added program name to the status screen, plus the -T parameter to go with + it. + +### Version 0.23b: + + - Improved the detection of variable behaviors. + + - Added path depth tracking, + + - Improved the UI a bit, + + - Switched to simplified (XOR-based) tuple instrumentation. + +### Version 0.22b: + + - Refactored the handling of long bitflips and some swaps. + + - Fixed the handling of gcc -pipe, thanks to anonymous reporter. + +### Version 0.21b (2013-11-12): + + - Initial public release. -- cgit 1.4.1 From ce49ba428bde81d34c01720f6e45bb28c66adee9 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Sat, 8 Feb 2020 13:45:25 +0100 Subject: changes update --- docs/Changelog.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/docs/Changelog.md b/docs/Changelog.md index ad0b9e88..96cfa935 100644 --- a/docs/Changelog.md +++ b/docs/Changelog.md @@ -1,4 +1,4 @@ -# ChangeLog +# Changelog This is the list of all noteworthy changes made in every public release of the tool. See README for the general instruction manual. @@ -25,9 +25,10 @@ sending a mail to . instrumentation. compile normally and set AFL_LLVM_USE_TRACE_PC :) - LLVM 11 is supported - CmpLog instrumentation using SanCov (see llvm_mode/README.cmplog) - - CmpLog instrumentation for QEMU - - AFL_PERSISTENT_HOOK callback module for persistent QEMU - (see examples/qemu_persistent_hook) + - qemu_mode: + - CmpLog instrumentation for QEMU (-c afl-fuzz command line option) + - AFL_PERSISTENT_HOOK callback module for persistent QEMU + (see examples/qemu_persistent_hook) - afl-cmin is now a sh script (invoking awk) instead of bash for portability the original script is still present as afl-cmin.bash - afl-showmap: -i dir option now allows processing multiple inputs using the -- cgit 1.4.1 From 079f177cdaf43f017bf320912cd97f86dea586be Mon Sep 17 00:00:00 2001 From: van Hauser Date: Sat, 8 Feb 2020 15:41:17 +0100 Subject: persistent mode doc --- docs/Changelog.md | 1 + examples/qemu_persistent_hook/read_into_rdi.c | 4 ++ qemu_mode/README.md | 30 ++------ qemu_mode/README.persistent.md | 99 +++++++++++++++++++++++++++ 4 files changed, 109 insertions(+), 25 deletions(-) create mode 100644 qemu_mode/README.persistent.md diff --git a/docs/Changelog.md b/docs/Changelog.md index 96cfa935..f2c39e65 100644 --- a/docs/Changelog.md +++ b/docs/Changelog.md @@ -29,6 +29,7 @@ sending a mail to . - CmpLog instrumentation for QEMU (-c afl-fuzz command line option) - AFL_PERSISTENT_HOOK callback module for persistent QEMU (see examples/qemu_persistent_hook) + - added qemu_mode/README.persistent.md documentation - afl-cmin is now a sh script (invoking awk) instead of bash for portability the original script is still present as afl-cmin.bash - afl-showmap: -i dir option now allows processing multiple inputs using the diff --git a/examples/qemu_persistent_hook/read_into_rdi.c b/examples/qemu_persistent_hook/read_into_rdi.c index fd4c9000..3994e790 100644 --- a/examples/qemu_persistent_hook/read_into_rdi.c +++ b/examples/qemu_persistent_hook/read_into_rdi.c @@ -37,8 +37,12 @@ enum { void afl_persistent_hook(uint64_t* regs, uint64_t guest_base) { + // In this example the register RDI is pointing to the memory location + // of the target buffer, and the length of the input is in RAX. + printf("reading into %p\n", regs[R_EDI]); size_t r = read(0, g2h(regs[R_EDI]), 1024); + regs[R_EAX] = r; printf("readed %ld bytes\n", r); } diff --git a/qemu_mode/README.md b/qemu_mode/README.md index ccfd50e3..95b75e9c 100644 --- a/qemu_mode/README.md +++ b/qemu_mode/README.md @@ -71,31 +71,11 @@ must be an address of a basic block. ## 4) Bonus feature #2: persistent mode -QEMU mode supports also persistent mode for x86 and x86_64 targets. -The environment variable to enable it is AFL_QEMU_PERSISTENT_ADDR=`start addr`. -In this variable you must specify the address of the function that -has to be the body of the persistent loop. -The code in this function must be stateless like in the LLVM persistent mode. -The return address on stack is patched like in WinAFL in order to repeat the -execution of such function. -Another modality to execute the persistent loop is to specify also the -AFL_QEMU_PERSISTENT_RET=`end addr` env variable. -With this variable assigned, instead of patching the return address, the -specified instruction is transformed to a jump towards `start addr`. -Note that the format of the addresses in such variables is hex. - -Note that the base address of PIE binaries in QEMU user mode is 0x4000000000. - -With the env variable AFL_QEMU_PERSISTENT_GPR you can tell QEMU to save the -original value of general purpose registers and restore them in each cycle. -This allows to use as persistent loop functions that make use of arguments on -x86_64. - -With AFL_QEMU_PERSISTENT_RETADDR_OFFSET you can specify the offset from the -stack pointer in which QEMU can find the return address when `start addr` is -hitted. - -Use this mode with caution, probably it will not work at the first shot. +AFL++'s QEMU mode now supports also persistent mode for x86 and x86_64 targets. +This increases the speed by several factors, however it is a bit of work to set +up - but worth the effort. + +Please see the extra documentation for it: [README.persistent.md](README.persistent.md) ## 5) Bonus feature #3: CompareCoverage diff --git a/qemu_mode/README.persistent.md b/qemu_mode/README.persistent.md new file mode 100644 index 00000000..6dba5a00 --- /dev/null +++ b/qemu_mode/README.persistent.md @@ -0,0 +1,99 @@ +# How to use the persistent mode in AFL++'s QEMU mode + +## 1) Introduction + +Persistent mode let you fuzz your target persistently between to +addresses - without forking for every fuzzing attempt. +This increases the speed by a factor between x2 and x5, hence it is +very, very valuable. + +The persistent mode is currently only available for x86/x86_64 targets. + + +## 2) How use the persistent mode + +### 2.1) The START address + +The start of the persistent mode has to be set with AFL_QEMU_PERSISTENT_ADDR. + +This address must be at the start of a function or the starting address of +basic block. This (as well as the RET address, see below) has to be defined +in hexadecimal with the 0x prefix. + +If the target is compiled with position independant code (PIE/PIC), you must +add 0x4000000000 to that address, because qemu loads to this base address. + +If this address is not valid, afl-fuzz will error during startup with the +message that the forkserver was not found. + + +### 2.2) the RET address + +The RET address is optional, and only needed if the the return should not be +at the end of the function to which the START address points into, but earlier. + +It is defined by setting AFL_QEMU_PERSISTENT_RET, and too 0x4000000000 has to +be set if the target is position independant. + + +### 2.3) the OFFSET + +If the START address is *not* the beginning of a function, and *no* RET has +been set (so the end of the loop will be at the end of the function), the +ESP pointer very likely has to be reset correctly. + +The value by which the ESP pointer has to be corrected has to set in the +variable AFL_QEMU_PERSISTENT_RETADDR_OFFSET + +Now to get this value right here some help: +1. use gdb on the target +2. set a breakpoint to your START address +3. set a breakpoint to the end of the same function +4. "run" the target with a valid commandline +5. at the first breakpoint print the ESP value with +``` +print $esp +``` +6. "continue" the target until the second breakpoint +7. again print the ESP value +8. calculate the difference between the two values - and this is the offset + + +### 2.4) resetting the register state + +It is very, very likely you need to reste the register state when starting +a new loop. Because of this you 99% of the time should set + +AFL_QEMU_PERSISTENT_GPR=1 + + +## 3) optional parameters + +### 3.1) loop counter value + +The more stable your loop in the target, the longer you can run it, the more +unstable it is the lower the loop count should be. A low value would be 100, +the maximum value should be 10000. The default is 1000. +This value can be set with AFL_QEMU_PERSISTENT_CNT + +This is the same concept as in the llvm_mode persistent mode with __AFL_LOOP(). + + +### 3.2) a hook for in-memory fuzzing + +You can increase the speed of the persistent mode even more by bypassing all +the reading of the fuzzing input via a file by reading directly into the +memory address space of the target process. + +All this needs is that the START address has a register pointing to the +memory buffer, and another register holding the value of the read length +(or pointing to the memory where that value is held). + +If the target reads from an input file you have to supply an input file +that is of least of the size that your fuzzing input will be (and do not +supply @@). + +An example that you can use with little modification for your target can +be found here: [examples/qemu_persistent_hook](../examples/qemu_persistent_hook) +This shared library is specified via AFL_QEMU_PERSISTENT_HOOK + -- cgit 1.4.1 From b6209b373217a7cc84e229cf8f7fff3253815b8e Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Sat, 8 Feb 2020 17:23:45 +0100 Subject: build fixes for FreeBSD 11 --- Makefile | 1 + libdislocator/libdislocator.so.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index e1307fb1..c5781256 100644 --- a/Makefile +++ b/Makefile @@ -109,6 +109,7 @@ endif ifneq "$(findstring FreeBSD, $(shell uname))" "" CFLAGS += -pthread + LDFLAGS += -lpthread endif ifneq "$(findstring NetBSD, $(shell uname))" "" diff --git a/libdislocator/libdislocator.so.c b/libdislocator/libdislocator.so.c index a426c387..98f16358 100644 --- a/libdislocator/libdislocator.so.c +++ b/libdislocator/libdislocator.so.c @@ -64,7 +64,7 @@ #include "config.h" #include "types.h" -#if __STDC_VERSION__ < 201112L +#if __STDC_VERSION__ < 201112L || defined __FreeBSD__ // use this hack if not C11 typedef struct { -- cgit 1.4.1 From 0aad26d85ee13c56acfed7204a9e2f18ec2079e1 Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Sat, 8 Feb 2020 16:38:24 +0100 Subject: add libpthread on NetBSD --- Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/Makefile b/Makefile index c5781256..9cfe7206 100644 --- a/Makefile +++ b/Makefile @@ -114,6 +114,7 @@ endif ifneq "$(findstring NetBSD, $(shell uname))" "" CFLAGS += -pthread + LDFLAGS += -lpthread endif ifeq "$(findstring clang, $(shell $(CC) --version 2>/dev/null))" "" -- cgit 1.4.1 From a93e11b79702eece7bda93bc8646c0bb9c2b0b64 Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Sat, 8 Feb 2020 16:50:37 +0100 Subject: first work for OpenIndiana (solaris flavor) --- Makefile | 2 ++ test/test.sh | 6 +++--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index 9cfe7206..5af8444a 100644 --- a/Makefile +++ b/Makefile @@ -51,7 +51,9 @@ endif ifneq "$(shell uname -m)" "x86_64" ifneq "$(shell uname -m)" "i386" ifneq "$(shell uname -m)" "amd64" + ifneq "$(shell uname -m)" "i86pc" AFL_NO_X86=1 + endif endif endif endif diff --git a/test/test.sh b/test/test.sh index 1709468e..db197cf2 100755 --- a/test/test.sh +++ b/test/test.sh @@ -75,7 +75,7 @@ $ECHO "${RESET}${GREY}[*] starting afl++ test framework ..." test -z "$SYS" && $ECHO "$YELLOW[-] uname -m did not succeed" $ECHO "$BLUE[*] Testing: ${AFL_GCC}, afl-showmap, afl-fuzz, afl-cmin and afl-tmin" -test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" && { +test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc" && { test -e ../${AFL_GCC} -a -e ../afl-showmap -a -e ../afl-fuzz && { ../${AFL_GCC} -o test-instr.plain ../test-instr.c > /dev/null 2>&1 AFL_HARDEN=1 ../${AFL_GCC} -o test-compcov.harden test-compcov.c > /dev/null 2>&1 @@ -263,7 +263,7 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && { $ECHO "$RED[!] afl-fuzz is not working correctly with llvm_mode" CODE=1 } - test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" || { + test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc" || { echo 000000000000000000000000 > in/in2 echo 111 > in/in3 mkdir -p in2 @@ -583,7 +583,7 @@ test -e ../afl-qemu-trace && { } rm -f errors - test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" && { + test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc" && { $ECHO "$GREY[*] running afl-fuzz for persistent qemu_mode, this will take approx 10 seconds" { export AFL_QEMU_PERSISTENT_ADDR=`expr 0x4$(nm test-instr | grep "T main" | awk '{print $1}' | sed 's/^.......//')` -- cgit 1.4.1 From 4dbb47feb13bd56daeeaee4e567999eae8e8e463 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Sat, 8 Feb 2020 16:05:35 +0000 Subject: libdislocator FreeBSD build fix. max_align_t had been define from the 12th release. --- libdislocator/libdislocator.so.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libdislocator/libdislocator.so.c b/libdislocator/libdislocator.so.c index 98f16358..bb767495 100644 --- a/libdislocator/libdislocator.so.c +++ b/libdislocator/libdislocator.so.c @@ -33,6 +33,10 @@ #include #endif +#ifdef __FreeBSD__ +#include +#endif + #ifdef __linux__ #include #include @@ -64,7 +68,7 @@ #include "config.h" #include "types.h" -#if __STDC_VERSION__ < 201112L || defined __FreeBSD__ +#if __STDC_VERSION__ < 201112L || (defined(__FreeBSD__) && __FreeBSD_version < 1200000) // use this hack if not C11 typedef struct { -- cgit 1.4.1 From 5fa4f47baec7e3dc78e685f9f8a44bf34c3eba53 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Sat, 8 Feb 2020 18:07:31 +0100 Subject: persistent qemu mode arm/arm64 && compcov arm64 --- qemu_mode/build_qemu_support.sh | 1 + qemu_mode/patches/afl-qemu-common.h | 10 ++- qemu_mode/patches/afl-qemu-cpu-translate-inl.h | 119 +++++++++++++++++++------ qemu_mode/patches/arm-translate-a64.diff | 64 +++++++++++++ qemu_mode/patches/arm-translate.diff | 20 ++++- qemu_mode/patches/i386-translate.diff | 2 +- 6 files changed, 183 insertions(+), 33 deletions(-) create mode 100644 qemu_mode/patches/arm-translate-a64.diff diff --git a/qemu_mode/build_qemu_support.sh b/qemu_mode/build_qemu_support.sh index 0413228c..79993ce2 100755 --- a/qemu_mode/build_qemu_support.sh +++ b/qemu_mode/build_qemu_support.sh @@ -153,6 +153,7 @@ patch -p1 <../patches/translate-all.diff || exit 1 patch -p1 <../patches/tcg.diff || exit 1 patch -p1 <../patches/i386-translate.diff || exit 1 patch -p1 <../patches/arm-translate.diff || exit 1 +patch -p1 <../patches/arm-translate-a64.diff || exit 1 patch -p1 <../patches/i386-ops_sse.diff || exit 1 patch -p1 <../patches/i386-fpu_helper.diff || exit 1 patch -p1 <../patches/softfloat.diff || exit 1 diff --git a/qemu_mode/patches/afl-qemu-common.h b/qemu_mode/patches/afl-qemu-common.h index da3d563e..4303a5e6 100644 --- a/qemu_mode/patches/afl-qemu-common.h +++ b/qemu_mode/patches/afl-qemu-common.h @@ -39,10 +39,14 @@ #define PERSISTENT_DEFAULT_MAX_CNT 1000 -#ifndef CPU_NB_REGS -#define AFL_REGS_NUM 1000 -#else +#ifdef CPU_NB_REGS #define AFL_REGS_NUM CPU_NB_REGS +#elif TARGET_ARM +#define AFL_REGS_NUM 32 +#elif TARGET_AARCH64 +#define AFL_REGS_NUM 32 +#else +#define AFL_REGS_NUM 100 #endif /* NeverZero */ diff --git a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h index 06e73831..2b9472b8 100644 --- a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h @@ -67,7 +67,7 @@ static void afl_compcov_log_64(target_ulong cur_loc, target_ulong arg1, target_ulong arg2) { register uintptr_t idx = cur_loc; - + if ((arg1 & 0xff00000000000000) == (arg2 & 0xff00000000000000)) { INC_AFL_AREA(idx + 6); @@ -258,63 +258,72 @@ static void callback_to_persistent_hook(void) { } -static void i386_restore_state_for_persistent(TCGv *cpu_regs) { +static void gpr_saving(TCGv *cpu_regs, int regs_num) { - if (persistent_save_gpr) { + int i; + TCGv_ptr gpr_sv; - int i; - TCGv_ptr gpr_sv; + TCGv_ptr first_pass_ptr = tcg_const_ptr(&persistent_first_pass); + TCGv first_pass = tcg_temp_local_new(); + TCGv one = tcg_const_tl(1); + tcg_gen_ld8u_tl(first_pass, first_pass_ptr, 0); - TCGv_ptr first_pass_ptr = tcg_const_ptr(&persistent_first_pass); - TCGv first_pass = tcg_temp_local_new(); - TCGv one = tcg_const_tl(1); - tcg_gen_ld8u_tl(first_pass, first_pass_ptr, 0); + TCGLabel *lbl_restore_gpr = gen_new_label(); + tcg_gen_brcond_tl(TCG_COND_NE, first_pass, one, lbl_restore_gpr); - TCGLabel *lbl_restore_gpr = gen_new_label(); - tcg_gen_brcond_tl(TCG_COND_NE, first_pass, one, lbl_restore_gpr); + // save GPR registers + for (i = 0; i < regs_num; ++i) { - // save GRP registers - for (i = 0; i < AFL_REGS_NUM; ++i) { + gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); + tcg_gen_st_tl(cpu_regs[i], gpr_sv, 0); - gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); - tcg_gen_st_tl(cpu_regs[i], gpr_sv, 0); + } - } + gen_set_label(lbl_restore_gpr); - gen_set_label(lbl_restore_gpr); + tcg_gen_afl_call0(&afl_persistent_loop); - tcg_gen_afl_call0(&afl_persistent_loop); + if (afl_persistent_hook_ptr) tcg_gen_afl_call0(callback_to_persistent_hook); - if (afl_persistent_hook_ptr) tcg_gen_afl_call0(callback_to_persistent_hook); + // restore GPR registers + for (i = 0; i < regs_num; ++i) { - // restore GRP registers - for (i = 0; i < AFL_REGS_NUM; ++i) { + gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); + tcg_gen_ld_tl(cpu_regs[i], gpr_sv, 0); - gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]); - tcg_gen_ld_tl(cpu_regs[i], gpr_sv, 0); + } - } + tcg_temp_free_ptr(first_pass_ptr); + tcg_temp_free(first_pass); + tcg_temp_free(one); - tcg_temp_free(first_pass); +} + + +static void restore_state_for_persistent(TCGv *cpu_regs, int regs_num, int sp) { + + if (persistent_save_gpr) { + + gpr_saving(cpu_regs, regs_num); } else if (afl_persistent_ret_addr == 0) { TCGv_ptr stack_off_ptr = tcg_const_ptr(&persistent_stack_offset); TCGv stack_off = tcg_temp_new(); tcg_gen_ld_tl(stack_off, stack_off_ptr, 0); - tcg_gen_sub_tl(cpu_regs[R_ESP], cpu_regs[R_ESP], stack_off); + tcg_gen_sub_tl(cpu_regs[sp], cpu_regs[sp], stack_off); tcg_temp_free(stack_off); } } -#define AFL_QEMU_TARGET_i386_SNIPPET \ +#define AFL_QEMU_TARGET_I386_SNIPPET \ if (is_persistent) { \ \ if (s->pc == afl_persistent_addr) { \ \ - i386_restore_state_for_persistent(cpu_regs); \ + restore_state_for_persistent(cpu_regs, AFL_REGS_NUM, R_ESP); \ /*tcg_gen_afl_call0(log_x86_saved_gpr); \ tcg_gen_afl_call0(log_x86_sp_content);*/ \ \ @@ -322,6 +331,7 @@ static void i386_restore_state_for_persistent(TCGv *cpu_regs) { \ TCGv_ptr paddr = tcg_const_ptr(afl_persistent_addr); \ tcg_gen_st_tl(paddr, cpu_regs[R_ESP], persisent_retaddr_offset); \ + tcg_temp_free_ptr(paddr); \ \ } \ \ @@ -337,3 +347,56 @@ static void i386_restore_state_for_persistent(TCGv *cpu_regs) { \ } +// SP = 13, LINK = 14 + +#define AFL_QEMU_TARGET_ARM_SNIPPET \ + if (is_persistent) { \ + \ + if (dc->pc == afl_persistent_addr) { \ + \ + if (persistent_save_gpr) gpr_saving(cpu_R, AFL_REGS_NUM); \ + \ + if (afl_persistent_ret_addr == 0) { \ + \ + TCGv_ptr paddr = tcg_const_ptr(afl_persistent_addr); \ + tcg_gen_mov_i32(cpu_R[14], paddr); \ + tcg_temp_free_ptr(paddr); \ + \ + } \ + \ + if (!persistent_save_gpr) tcg_gen_afl_call0(&afl_persistent_loop); \ + \ + } else if (afl_persistent_ret_addr && dc->pc == afl_persistent_ret_addr) {\ + \ + gen_bx_im(dc, afl_persistent_addr); \ + \ + } \ + \ + } + +// SP = 31, LINK = 30 + +#define AFL_QEMU_TARGET_ARM64_SNIPPET \ + if (is_persistent) { \ + \ + if (s->pc == afl_persistent_addr) { \ + \ + if (persistent_save_gpr) gpr_saving(cpu_X, AFL_REGS_NUM); \ + \ + if (afl_persistent_ret_addr == 0) { \ + \ + TCGv_ptr paddr = tcg_const_ptr(afl_persistent_addr); \ + tcg_gen_mov_i32(cpu_X[30], paddr); \ + tcg_temp_free_ptr(paddr); \ + \ + } \ + \ + if (!persistent_save_gpr) tcg_gen_afl_call0(&afl_persistent_loop); \ + \ + } else if (afl_persistent_ret_addr && s->pc == afl_persistent_ret_addr) { \ + \ + gen_goto_tb(s, 0, afl_persistent_addr); \ + \ + } \ + \ + } diff --git a/qemu_mode/patches/arm-translate-a64.diff b/qemu_mode/patches/arm-translate-a64.diff new file mode 100644 index 00000000..83856217 --- /dev/null +++ b/qemu_mode/patches/arm-translate-a64.diff @@ -0,0 +1,64 @@ +diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c +index fd36425..992bf17 100644 +--- a/target/arm/translate-a64.c ++++ b/target/arm/translate-a64.c +@@ -39,6 +39,8 @@ + #include "translate-a64.h" + #include "qemu/atomic128.h" + ++#include "../patches/afl-qemu-cpu-translate-inl.h" ++ + static TCGv_i64 cpu_X[32]; + static TCGv_i64 cpu_pc; + +@@ -3365,6 +3367,12 @@ static void disas_add_sub_imm(DisasContext *s, uint32_t insn) + return; + } + ++ if (rd == 31 && sub_op) { // cmp xX, imm ++ TCGv_i64 tcg_imm = tcg_const_i64(imm); ++ afl_gen_compcov(s->pc, tcg_rn, tcg_imm, is_64bit ? MO_64 : MO_32, 1); ++ tcg_temp_free_i64(tcg_imm); ++ } ++ + tcg_result = tcg_temp_new_i64(); + if (!setflags) { + if (sub_op) { +@@ -3972,6 +3980,9 @@ static void disas_add_sub_ext_reg(DisasContext *s, uint32_t insn) + + tcg_rm = read_cpu_reg(s, rm, sf); + ext_and_shift_reg(tcg_rm, tcg_rm, option, imm3); ++ ++ if (rd == 31 && sub_op) // cmp xX, xY ++ afl_gen_compcov(s->pc, tcg_rn, tcg_rm, sf ? MO_64 : MO_32, 0); + + tcg_result = tcg_temp_new_i64(); + +@@ -4037,6 +4048,9 @@ static void disas_add_sub_reg(DisasContext *s, uint32_t insn) + + shift_reg_imm(tcg_rm, tcg_rm, sf, shift_type, imm6); + ++ if (rd == 31 && sub_op) // cmp xX, xY ++ afl_gen_compcov(s->pc, tcg_rn, tcg_rm, sf ? MO_64 : MO_32, 0); ++ + tcg_result = tcg_temp_new_i64(); + + if (!setflags) { +@@ -4246,6 +4260,8 @@ static void disas_cc(DisasContext *s, uint32_t insn) + tcg_y = cpu_reg(s, y); + } + tcg_rn = cpu_reg(s, rn); ++ ++ afl_gen_compcov(s->pc, tcg_rn, tcg_y, sf ? MO_64 : MO_32, is_imm); + + /* Set the flags for the new comparison. */ + tcg_tmp = tcg_temp_new_i64(); +@@ -13317,6 +13333,8 @@ static void disas_data_proc_simd_fp(DisasContext *s, uint32_t insn) + static void disas_a64_insn(CPUARMState *env, DisasContext *s) + { + uint32_t insn; ++ ++ AFL_QEMU_TARGET_ARM64_SNIPPET + + insn = arm_ldl_code(env, s->pc, s->sctlr_b); + s->insn = insn; diff --git a/qemu_mode/patches/arm-translate.diff b/qemu_mode/patches/arm-translate.diff index 58b4a873..daa5d43b 100644 --- a/qemu_mode/patches/arm-translate.diff +++ b/qemu_mode/patches/arm-translate.diff @@ -1,5 +1,5 @@ diff --git a/target/arm/translate.c b/target/arm/translate.c -index 7c4675ff..0f0928b6 100644 +index 7c4675f..e3d999a 100644 --- a/target/arm/translate.c +++ b/target/arm/translate.c @@ -59,6 +59,8 @@ @@ -132,3 +132,21 @@ index 7c4675ff..0f0928b6 100644 rd = 16; break; case 0xb: /* cmn */ +@@ -13233,6 +13247,8 @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu) + return; + } + ++ AFL_QEMU_TARGET_ARM_SNIPPET ++ + insn = arm_ldl_code(env, dc->pc, dc->sctlr_b); + dc->insn = insn; + dc->pc += 4; +@@ -13301,6 +13317,8 @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu) + return; + } + ++ AFL_QEMU_TARGET_ARM_SNIPPET ++ + insn = arm_lduw_code(env, dc->pc, dc->sctlr_b); + is_16bit = thumb_insn_is_16bit(dc, insn); + dc->pc += 2; diff --git a/qemu_mode/patches/i386-translate.diff b/qemu_mode/patches/i386-translate.diff index 00337e2c..8ccd6f4e 100644 --- a/qemu_mode/patches/i386-translate.diff +++ b/qemu_mode/patches/i386-translate.diff @@ -35,7 +35,7 @@ index 0dd5fbe4..a23da128 100644 rex_w = -1; rex_r = 0; -+ AFL_QEMU_TARGET_i386_SNIPPET ++ AFL_QEMU_TARGET_I386_SNIPPET + next_byte: b = x86_ldub_code(env, s); -- cgit 1.4.1 From 312732bdbe50e67ad900ae5e4fe7696c7b3f753c Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Sat, 8 Feb 2020 18:11:57 +0100 Subject: more portability for (solaris-based OpenIndiana) --- src/afl-showmap.c | 12 ++++++++++++ src/third_party/libradamsa/libradamsa.c | 6 +++++- test/test.sh | 22 +++++++++++----------- 3 files changed, 28 insertions(+), 12 deletions(-) diff --git a/src/afl-showmap.c b/src/afl-showmap.c index 9c146771..1686a750 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -925,6 +925,9 @@ int main(int argc, char** argv) { struct dirent* dir_ent; int done = 0; u8 infile[4096], outfile[4096]; +#if !defined(DT_REG) + struct stat statbuf; +#endif dev_null_fd = open("/dev/null", O_RDWR); if (dev_null_fd < 0) PFATAL("Unable to open /dev/null"); @@ -970,9 +973,18 @@ int main(int argc, char** argv) { if (dir_ent->d_name[0] == '.') continue; // skip anything that starts with '.' + +#if defined(DT_REG) /* Posix and Solaris do not know d_type and DT_REG */ if (dir_ent->d_type != DT_REG) continue; // only regular files +#endif snprintf(infile, sizeof(infile), "%s/%s", in_dir, dir_ent->d_name); + +#if !defined(DT_REG) /* use stat() */ + if (-1 == stat(infile, &statbuf) + || !S_ISREG(statbuf.st_mode)) continue; +#endif + snprintf(outfile, sizeof(outfile), "%s/%s", out_file, dir_ent->d_name); if (read_file(infile)) { diff --git a/src/third_party/libradamsa/libradamsa.c b/src/third_party/libradamsa/libradamsa.c index be3050b1..f3677fa7 100644 --- a/src/third_party/libradamsa/libradamsa.c +++ b/src/third_party/libradamsa/libradamsa.c @@ -2405,7 +2405,11 @@ static word prim_sys(word op, word a, word b, word c) { EOPNOTSUPP, EOVERFLOW, EOWNERDEAD, EPERM, EPIPE, EPROTO, EPROTONOSUPPORT, EPROTOTYPE, ERANGE, EROFS, ESPIPE, ESRCH, ESTALE, ETIME, ETIMEDOUT, ETXTBSY, EWOULDBLOCK, EXDEV, SEEK_SET, SEEK_CUR, SEEK_END, O_EXEC, O_RDONLY, O_RDWR, - O_SEARCH, O_WRONLY, O_APPEND, O_CLOEXEC, O_CREAT, O_DIRECTORY, O_DSYNC, O_EXCL, + O_SEARCH, O_WRONLY, O_APPEND, O_CLOEXEC, O_CREAT, +#if defined O_DIRECTORY + O_DIRECTORY, +#endif + O_DSYNC, O_EXCL, O_NOCTTY, O_NOFOLLOW, O_NONBLOCK, O_RSYNC, O_SYNC, O_TRUNC, O_TTY_INIT, O_ACCMODE, FD_CLOEXEC, F_DUPFD, F_DUPFD_CLOEXEC, F_GETFD, F_SETFD, F_GETFL, F_SETFL, F_GETOWN, F_SETOWN, F_GETLK, F_SETLK, F_SETLKW, F_RDLCK, F_UNLCK, F_WRLCK, CLOCK_MONOTONIC, diff --git a/test/test.sh b/test/test.sh index db197cf2..d9374f96 100755 --- a/test/test.sh +++ b/test/test.sh @@ -1,18 +1,18 @@ #!/bin/sh # -# Ensure we have: test, type, diff -q, grep -aqE +# Ensure we have: test, type, diff, grep -qE # test -z "" 2> /dev/null || { echo Error: test command not found ; exit 1 ; } GREP=`type grep > /dev/null 2>&1 && echo OK` test "$GREP" = OK || { echo Error: grep command not found ; exit 1 ; } -echo foobar | grep -aqE 'asd|oob' 2> /dev/null || { echo Error: grep command does not support -q, -a and/or -E option ; exit 1 ; } +echo foobar | grep -qE 'asd|oob' 2> /dev/null || { echo Error: grep command does not support -q and/or -E option ; exit 1 ; } echo 1 > test.1 echo 1 > test.2 OK=OK -diff -q test.1 test.2 >/dev/null 2>&1 || OK= +diff test.1 test.2 >/dev/null 2>&1 || OK= rm -f test.1 test.2 -test -z "$OK" && { echo Error: diff -q is not working ; exit 1 ; } +test -z "$OK" && { echo Error: diff is not working ; exit 1 ; } test -z "$LLVM_CONFIG" && LLVM_CONFIG=llvm-config @@ -21,7 +21,7 @@ $ECHO \\101 2>&1 | grep -qE '^A' || { ECHO= test -e /bin/printf && { ECHO="/bin/printf %b\\n" - $ECHO '\\101' 2>&1 | grep -qE '^A' || ECHO= + $ECHO "\\101" 2>&1 | grep -qE '^A' || ECHO= } } test -z "$ECHO" && { printf Error: printf command does not support octal character codes ; exit 1 ; } @@ -84,7 +84,7 @@ test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 test -e test-instr.plain.0 -a -e test-instr.plain.1 && { - diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { + diff test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { $ECHO "$RED[!] ${AFL_GCC} instrumentation should be different on different input but is not" CODE=1 } || { @@ -111,7 +111,7 @@ test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc CODE=1 } test -e test-compcov.harden && { - grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && { + grep -Eq 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && { $ECHO "$GREEN[+] ${AFL_GCC} hardened mode succeeded and is working" } || { $ECHO "$RED[!] ${AFL_GCC} hardened mode is not hardened" @@ -203,7 +203,7 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && { echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 test -e test-instr.plain.0 -a -e test-instr.plain.1 && { - diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { + diff test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { $ECHO "$RED[!] llvm_mode instrumentation should be different on different input but is not" CODE=1 } || { @@ -226,7 +226,7 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && { CODE=1 } test -e test-compcov.harden && { - grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && { + grep -Eq 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && { $ECHO "$GREEN[+] llvm_mode hardened mode succeeded and is working" } || { $ECHO "$RED[!] llvm_mode hardened mode is not hardened" @@ -366,7 +366,7 @@ test -e ../afl-gcc-fast -a -e ../afl-gcc-rt.o && { echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain.gccpi > /dev/null 2>&1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain.gccpi < /dev/null > /dev/null 2>&1 test -e test-instr.plain.0 -a -e test-instr.plain.1 && { - diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { + diff test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { $ECHO "$RED[!] gcc_plugin instrumentation should be different on different input but is not" CODE=1 } || { @@ -391,7 +391,7 @@ test -e ../afl-gcc-fast -a -e ../afl-gcc-rt.o && { } test -e test-compcov.harden.gccpi && { - grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden.gccpi > /dev/null 2>&1 && { + grep -Eq 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden.gccpi > /dev/null 2>&1 && { $ECHO "$GREEN[+] gcc_plugin hardened mode succeeded and is working" } || { $ECHO "$RED[!] gcc_plugin hardened mode is not hardened" -- cgit 1.4.1 From 49acc388dd9d318cfe7aa7766be7eea0daf2cbf1 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Sun, 9 Feb 2020 09:29:56 +0100 Subject: update documentation --- README.md | 3 ++- docs/Changelog.md | 2 ++ qemu_mode/README.md | 31 +++++++++++++++++++++++-------- qemu_mode/README.persistent.md | 3 ++- 4 files changed, 29 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index e7b216e7..c3e8dc48 100644 --- a/README.md +++ b/README.md @@ -61,9 +61,10 @@ | Feature/Instrumentation | afl-gcc | llvm_mode | gcc_plugin | qemu_mode | unicorn_mode | | ----------------------- |:-------:|:---------:|:----------:|:---------:|:------------:| - | laf-intel / CompCov | | x | | x86/arm | x86/arm | | NeverZero | x | x(1) | (2) | x | x | | Persistent mode | | x | x | x86 | x | + | laf-intel / CompCov | | x | | x86/arm | x86/arm | + | CmpLog | | x | | x | | | Whitelist | | x | x | | | | InsTrim | | x | | | | diff --git a/docs/Changelog.md b/docs/Changelog.md index f2c39e65..8b56603f 100644 --- a/docs/Changelog.md +++ b/docs/Changelog.md @@ -26,7 +26,9 @@ sending a mail to . - LLVM 11 is supported - CmpLog instrumentation using SanCov (see llvm_mode/README.cmplog) - qemu_mode: + - persistent mode is now also available for arm and aarch64 - CmpLog instrumentation for QEMU (-c afl-fuzz command line option) + for x86, x86_64, arm and aarch64 - AFL_PERSISTENT_HOOK callback module for persistent QEMU (see examples/qemu_persistent_hook) - added qemu_mode/README.persistent.md documentation diff --git a/qemu_mode/README.md b/qemu_mode/README.md index 95b75e9c..4198af14 100644 --- a/qemu_mode/README.md +++ b/qemu_mode/README.md @@ -71,7 +71,8 @@ must be an address of a basic block. ## 4) Bonus feature #2: persistent mode -AFL++'s QEMU mode now supports also persistent mode for x86 and x86_64 targets. +AFL++'s QEMU mode now supports also persistent mode for x86, x86_64, arm +and aarch64 targets. This increases the speed by several factors, however it is a bit of work to set up - but worth the effort. @@ -85,6 +86,7 @@ The option that enables QEMU CompareCoverage is AFL_COMPCOV_LEVEL. There is also ./libcompcov/ which implements CompareCoverage for *cmp functions (splitting memcmp, strncmp, etc. to make these conditions easier solvable by afl-fuzz). + AFL_COMPCOV_LEVEL=1 is to instrument comparisons with only immediate values / read-only memory. AFL_COMPCOV_LEVEL=2 instruments all comparison instructions and memory comparison functions when libcompcov @@ -93,11 +95,23 @@ AFL_COMPCOV_LEVEL=3 has the same effects of AFL_COMPCOV_LEVEL=2 but enables also the instrumentation of the floating-point comparisons on x86 and x86_64 (experimental). Integer comparison instructions are currently instrumented only -on the x86, x86_64 and ARM targets. +on the x86, x86_64, arm and aarch64 targets. Highly recommended. -## 6) Bonus feature #4: Wine mode +## 6) CMPLOG mode + +Another new feature is CMPLOG, which is based on the redqueen project. +Here all immidiates in CMP instructions are learned and put into a dynamic +dictionary and applied to all locations in the input that reached that +CMP, trying to solve and pass it. +This is a very effective feature and it is available for x86, x86_64, arm +and aarch64. + +To enable it you must pass on the command line of afl-fuzz: + -c /path/to/your/target + +## 7) Bonus feature #4: Wine mode AFL++ QEMU can use Wine to fuzz WIn32 PE binaries. Use the -W flag of afl-fuzz. @@ -105,7 +119,7 @@ Note that some binaries require user interaction with the GUI and must be patche For examples look [here](https://github.com/andreafioraldi/WineAFLplusplusDEMO). -## 7) Notes on linking +## 8) Notes on linking The feature is supported only on Linux. Supporting BSD may amount to porting the changes made to linux-user/elfload.c and applying them to @@ -126,7 +140,7 @@ practice, this means two things: Setting AFL_INST_LIBS=1 can be used to circumvent the .text detection logic and instrument every basic block encountered. -## 8) Benchmarking +## 9) Benchmarking If you want to compare the performance of the QEMU instrumentation with that of afl-gcc compiled code against the same target, you need to build the @@ -141,7 +155,7 @@ Comparative measurements of execution speed or instrumentation coverage will be fairly meaningless if the optimization levels or instrumentation scopes don't match. -## 9) Gotchas, feedback, bugs +## 10) Gotchas, feedback, bugs If you need to fix up checksums or do other cleanup on mutated test cases, see examples/post_library/ for a viable solution. @@ -162,7 +176,7 @@ with -march=core2, can help. Beyond that, this is an early-stage mechanism, so fields reports are welcome. You can send them to . -## 10) Alternatives: static rewriting +## 11) Alternatives: static rewriting Statically rewriting binaries just once, instead of attempting to translate them at run time, can be a faster alternative. That said, static rewriting is @@ -176,4 +190,5 @@ The best implementation is this one: The issue however is Dyninst which is not rewriting the binaries so that they run stable. A lot of crashes happen, especially in C++ programs that use throw/catch. Try it first, and if it works for you be happy as it is -2-3x as fast as qemu_mode. +2-3x as fast as qemu_mode, however usually not as fast as QEMU persistent mode. + diff --git a/qemu_mode/README.persistent.md b/qemu_mode/README.persistent.md index 6dba5a00..e2e372d8 100644 --- a/qemu_mode/README.persistent.md +++ b/qemu_mode/README.persistent.md @@ -7,7 +7,8 @@ addresses - without forking for every fuzzing attempt. This increases the speed by a factor between x2 and x5, hence it is very, very valuable. -The persistent mode is currently only available for x86/x86_64 targets. +The persistent mode is currently only available for x86/x86_64, arm +and aarch64 targets. ## 2) How use the persistent mode -- cgit 1.4.1 From e2ef2428986f45add509a6402de76678ca75b5da Mon Sep 17 00:00:00 2001 From: van Hauser Date: Sun, 9 Feb 2020 09:43:33 +0100 Subject: fuzzer_stat eps is now overall not current, clang-format fixed to v8 --- .custom-format.py | 32 ++++---- docs/Changelog.md | 2 + docs/status_screen.md | 2 +- libdislocator/libdislocator.so.c | 3 +- qemu_mode/patches/afl-qemu-cpu-translate-inl.h | 50 ++++++------ src/afl-fuzz-stats.c | 103 +++++++++++++------------ src/afl-showmap.c | 9 +-- 7 files changed, 104 insertions(+), 97 deletions(-) diff --git a/.custom-format.py b/.custom-format.py index f493a2d9..e3779b68 100755 --- a/.custom-format.py +++ b/.custom-format.py @@ -29,27 +29,29 @@ CLANG_FORMAT_BIN = os.getenv("CLANG_FORMAT_BIN") if CLANG_FORMAT_BIN is None: o = 0 try: - p = subprocess.Popen(["clang-format", "--version"], stdout=subprocess.PIPE) + p = subprocess.Popen(["clang-format-8", "--version"], stdout=subprocess.PIPE) o, _ = p.communicate() o = str(o, "utf-8") o = o[len("clang-format version "):].strip() o = o[:o.find(".")] o = int(o) - except: pass - if o < 7: - if subprocess.call(['which', 'clang-format-7'], stdout=subprocess.PIPE) == 0: - CLANG_FORMAT_BIN = 'clang-format-7' - elif subprocess.call(['which', 'clang-format-8'], stdout=subprocess.PIPE) == 0: - CLANG_FORMAT_BIN = 'clang-format-8' - elif subprocess.call(['which', 'clang-format-9'], stdout=subprocess.PIPE) == 0: - CLANG_FORMAT_BIN = 'clang-format-9' - elif subprocess.call(['which', 'clang-format-10'], stdout=subprocess.PIPE) == 0: - CLANG_FORMAT_BIN = 'clang-format-10' - else: - print ("clang-format 7 or above is needed. Aborted.") - exit(1) + except: + print ("clang-format-8 is needed. Aborted.") + exit(1) + #if o < 7: + # if subprocess.call(['which', 'clang-format-7'], stdout=subprocess.PIPE) == 0: + # CLANG_FORMAT_BIN = 'clang-format-7' + # elif subprocess.call(['which', 'clang-format-8'], stdout=subprocess.PIPE) == 0: + # CLANG_FORMAT_BIN = 'clang-format-8' + # elif subprocess.call(['which', 'clang-format-9'], stdout=subprocess.PIPE) == 0: + # CLANG_FORMAT_BIN = 'clang-format-9' + # elif subprocess.call(['which', 'clang-format-10'], stdout=subprocess.PIPE) == 0: + # CLANG_FORMAT_BIN = 'clang-format-10' + # else: + # print ("clang-format 7 or above is needed. Aborted.") + # exit(1) else: - CLANG_FORMAT_BIN = 'clang-format' + CLANG_FORMAT_BIN = 'clang-format-8' COLUMN_LIMIT = 80 for line in fmt.split("\n"): diff --git a/docs/Changelog.md b/docs/Changelog.md index 8b56603f..751b051a 100644 --- a/docs/Changelog.md +++ b/docs/Changelog.md @@ -19,6 +19,8 @@ sending a mail to . - CmpLog forkserver - Redqueen input-2-state mutator (cmp instructions only ATM) - all Python 2+3 versions supported now + - changed execs_per_sec in fuzzer_stats from "current" execs per second + (which is pointless) to total execs per second - afl-clang-fast: - show in the help output for which llvm version it was compiled for - now does not need to be recompiled between trace-pc and pass diff --git a/docs/status_screen.md b/docs/status_screen.md index 1ea98415..066c2c07 100644 --- a/docs/status_screen.md +++ b/docs/status_screen.md @@ -377,7 +377,7 @@ directory. This includes: - `fuzzer_pid` - PID of the fuzzer process - `cycles_done` - queue cycles completed so far - `execs_done` - number of execve() calls attempted - - `execs_per_sec` - current number of execs per second + - `execs_per_sec` - overall number of execs per second - `paths_total` - total number of entries in the queue - `paths_found` - number of entries discovered through local fuzzing - `paths_imported` - number of entries imported from other instances diff --git a/libdislocator/libdislocator.so.c b/libdislocator/libdislocator.so.c index bb767495..a0795c87 100644 --- a/libdislocator/libdislocator.so.c +++ b/libdislocator/libdislocator.so.c @@ -68,7 +68,8 @@ #include "config.h" #include "types.h" -#if __STDC_VERSION__ < 201112L || (defined(__FreeBSD__) && __FreeBSD_version < 1200000) +#if __STDC_VERSION__ < 201112L || \ + (defined(__FreeBSD__) && __FreeBSD_version < 1200000) // use this hack if not C11 typedef struct { diff --git a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h index 2b9472b8..6f526d92 100644 --- a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h @@ -67,7 +67,7 @@ static void afl_compcov_log_64(target_ulong cur_loc, target_ulong arg1, target_ulong arg2) { register uintptr_t idx = cur_loc; - + if ((arg1 & 0xff00000000000000) == (arg2 & 0xff00000000000000)) { INC_AFL_AREA(idx + 6); @@ -299,7 +299,6 @@ static void gpr_saving(TCGv *cpu_regs, int regs_num) { } - static void restore_state_for_persistent(TCGv *cpu_regs, int regs_num, int sp) { if (persistent_save_gpr) { @@ -349,29 +348,29 @@ static void restore_state_for_persistent(TCGv *cpu_regs, int regs_num, int sp) { // SP = 13, LINK = 14 -#define AFL_QEMU_TARGET_ARM_SNIPPET \ - if (is_persistent) { \ - \ - if (dc->pc == afl_persistent_addr) { \ - \ - if (persistent_save_gpr) gpr_saving(cpu_R, AFL_REGS_NUM); \ - \ - if (afl_persistent_ret_addr == 0) { \ - \ - TCGv_ptr paddr = tcg_const_ptr(afl_persistent_addr); \ - tcg_gen_mov_i32(cpu_R[14], paddr); \ - tcg_temp_free_ptr(paddr); \ - \ - } \ - \ - if (!persistent_save_gpr) tcg_gen_afl_call0(&afl_persistent_loop); \ - \ - } else if (afl_persistent_ret_addr && dc->pc == afl_persistent_ret_addr) {\ - \ - gen_bx_im(dc, afl_persistent_addr); \ - \ - } \ - \ +#define AFL_QEMU_TARGET_ARM_SNIPPET \ + if (is_persistent) { \ + \ + if (dc->pc == afl_persistent_addr) { \ + \ + if (persistent_save_gpr) gpr_saving(cpu_R, AFL_REGS_NUM); \ + \ + if (afl_persistent_ret_addr == 0) { \ + \ + TCGv_ptr paddr = tcg_const_ptr(afl_persistent_addr); \ + tcg_gen_mov_i32(cpu_R[14], paddr); \ + tcg_temp_free_ptr(paddr); \ + \ + } \ + \ + if (!persistent_save_gpr) tcg_gen_afl_call0(&afl_persistent_loop); \ + \ + } else if (afl_persistent_ret_addr && dc->pc == afl_persistent_ret_addr) { \ + \ + gen_bx_im(dc, afl_persistent_addr); \ + \ + } \ + \ } // SP = 31, LINK = 30 @@ -400,3 +399,4 @@ static void restore_state_for_persistent(TCGv *cpu_regs, int regs_num, int sp) { } \ \ } + diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index d09b4fe6..344e0abf 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -65,59 +65,62 @@ void write_stats_file(double bitmap_cvg, double stability, double eps) { if (getrusage(RUSAGE_CHILDREN, &rus)) rus.ru_maxrss = 0; - fprintf(f, - "start_time : %llu\n" - "last_update : %llu\n" - "fuzzer_pid : %d\n" - "cycles_done : %llu\n" - "execs_done : %llu\n" - "execs_per_sec : %0.02f\n" - "paths_total : %u\n" - "paths_favored : %u\n" - "paths_found : %u\n" - "paths_imported : %u\n" - "max_depth : %u\n" - "cur_path : %u\n" /* Must match find_start_position() */ - "pending_favs : %u\n" - "pending_total : %u\n" - "variable_paths : %u\n" - "stability : %0.02f%%\n" - "bitmap_cvg : %0.02f%%\n" - "unique_crashes : %llu\n" - "unique_hangs : %llu\n" - "last_path : %llu\n" - "last_crash : %llu\n" - "last_hang : %llu\n" - "execs_since_crash : %llu\n" - "exec_timeout : %u\n" - "slowest_exec_ms : %llu\n" - "peak_rss_mb : %lu\n" - "afl_banner : %s\n" - "afl_version : " VERSION - "\n" - "target_mode : %s%s%s%s%s%s%s%s\n" - "command_line : %s\n", - start_time / 1000, get_cur_time() / 1000, getpid(), - queue_cycle ? (queue_cycle - 1) : 0, total_execs, eps, queued_paths, - queued_favored, queued_discovered, queued_imported, max_depth, - current_entry, pending_favored, pending_not_fuzzed, queued_variable, - stability, bitmap_cvg, unique_crashes, unique_hangs, - last_path_time / 1000, last_crash_time / 1000, last_hang_time / 1000, - total_execs - last_crash_execs, exec_tmout, slowest_exec_ms, + fprintf( + f, + "start_time : %llu\n" + "last_update : %llu\n" + "fuzzer_pid : %d\n" + "cycles_done : %llu\n" + "execs_done : %llu\n" + "execs_per_sec : %0.02f\n" + // "real_execs_per_sec: %0.02f\n" // damn the name is too long + "paths_total : %u\n" + "paths_favored : %u\n" + "paths_found : %u\n" + "paths_imported : %u\n" + "max_depth : %u\n" + "cur_path : %u\n" /* Must match find_start_position() */ + "pending_favs : %u\n" + "pending_total : %u\n" + "variable_paths : %u\n" + "stability : %0.02f%%\n" + "bitmap_cvg : %0.02f%%\n" + "unique_crashes : %llu\n" + "unique_hangs : %llu\n" + "last_path : %llu\n" + "last_crash : %llu\n" + "last_hang : %llu\n" + "execs_since_crash : %llu\n" + "exec_timeout : %u\n" + "slowest_exec_ms : %llu\n" + "peak_rss_mb : %lu\n" + "afl_banner : %s\n" + "afl_version : " VERSION + "\n" + "target_mode : %s%s%s%s%s%s%s%s\n" + "command_line : %s\n", + start_time / 1000, get_cur_time() / 1000, getpid(), + queue_cycle ? (queue_cycle - 1) : 0, total_execs, + /*eps,*/ total_execs / ((double)(get_cur_time() - start_time) / 1000), + queued_paths, queued_favored, queued_discovered, queued_imported, + max_depth, current_entry, pending_favored, pending_not_fuzzed, + queued_variable, stability, bitmap_cvg, unique_crashes, unique_hangs, + last_path_time / 1000, last_crash_time / 1000, last_hang_time / 1000, + total_execs - last_crash_execs, exec_tmout, slowest_exec_ms, #ifdef __APPLE__ - (unsigned long int)(rus.ru_maxrss >> 20), + (unsigned long int)(rus.ru_maxrss >> 20), #else - (unsigned long int)(rus.ru_maxrss >> 10), + (unsigned long int)(rus.ru_maxrss >> 10), #endif - use_banner, unicorn_mode ? "unicorn" : "", qemu_mode ? "qemu " : "", - dumb_mode ? " dumb " : "", no_forkserver ? "no_forksrv " : "", - crash_mode ? "crash " : "", persistent_mode ? "persistent " : "", - deferred_mode ? "deferred " : "", - (unicorn_mode || qemu_mode || dumb_mode || no_forkserver || - crash_mode || persistent_mode || deferred_mode) - ? "" - : "default", - orig_cmdline); + use_banner, unicorn_mode ? "unicorn" : "", qemu_mode ? "qemu " : "", + dumb_mode ? " dumb " : "", no_forkserver ? "no_forksrv " : "", + crash_mode ? "crash " : "", persistent_mode ? "persistent " : "", + deferred_mode ? "deferred " : "", + (unicorn_mode || qemu_mode || dumb_mode || no_forkserver || crash_mode || + persistent_mode || deferred_mode) + ? "" + : "default", + orig_cmdline); /* ignore errors */ fclose(f); diff --git a/src/afl-showmap.c b/src/afl-showmap.c index 1686a750..1fd425a2 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -926,7 +926,7 @@ int main(int argc, char** argv) { int done = 0; u8 infile[4096], outfile[4096]; #if !defined(DT_REG) - struct stat statbuf; + struct stat statbuf; #endif dev_null_fd = open("/dev/null", O_RDWR); @@ -974,15 +974,14 @@ int main(int argc, char** argv) { if (dir_ent->d_name[0] == '.') continue; // skip anything that starts with '.' -#if defined(DT_REG) /* Posix and Solaris do not know d_type and DT_REG */ +#if defined(DT_REG) /* Posix and Solaris do not know d_type and DT_REG */ if (dir_ent->d_type != DT_REG) continue; // only regular files #endif snprintf(infile, sizeof(infile), "%s/%s", in_dir, dir_ent->d_name); -#if !defined(DT_REG) /* use stat() */ - if (-1 == stat(infile, &statbuf) - || !S_ISREG(statbuf.st_mode)) continue; +#if !defined(DT_REG) /* use stat() */ + if (-1 == stat(infile, &statbuf) || !S_ISREG(statbuf.st_mode)) continue; #endif snprintf(outfile, sizeof(outfile), "%s/%s", out_file, dir_ent->d_name); -- cgit 1.4.1 From d84cd978d452fc8ab723aadd30e3db9e33bd7709 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Sun, 9 Feb 2020 11:27:49 +0100 Subject: persistent readme --- qemu_mode/README.persistent.md | 87 +++++++++++++++++++++++++++--------------- 1 file changed, 56 insertions(+), 31 deletions(-) diff --git a/qemu_mode/README.persistent.md b/qemu_mode/README.persistent.md index e2e372d8..e4ac5cee 100644 --- a/qemu_mode/README.persistent.md +++ b/qemu_mode/README.persistent.md @@ -10,67 +10,86 @@ very, very valuable. The persistent mode is currently only available for x86/x86_64, arm and aarch64 targets. - ## 2) How use the persistent mode ### 2.1) The START address -The start of the persistent mode has to be set with AFL_QEMU_PERSISTENT_ADDR. +The start of the persistent loop has to be set with AFL_QEMU_PERSISTENT_ADDR. -This address must be at the start of a function or the starting address of -basic block. This (as well as the RET address, see below) has to be defined -in hexadecimal with the 0x prefix. +This address can be the address of whatever instruction but the way in which +you setup persistent mode change if it is the starting instruction of a +function (suggested). This (as well as the RET address, see below) has to be +defined in hexadecimal with the 0x prefix or as a decimal value. If the target is compiled with position independant code (PIE/PIC), you must add 0x4000000000 to that address, because qemu loads to this base address. +On strange setups the base address set by QEMU for PIE executable may change, +you can check it printing the process map using AFL_QEMU_DEBUG_MAPS=1. If this address is not valid, afl-fuzz will error during startup with the message that the forkserver was not found. - ### 2.2) the RET address -The RET address is optional, and only needed if the the return should not be +The RET address is the last instruction of the persistent loop. +The emulator will emit a jump to START when translating the instruction at RET. +It is optional, and only needed if the the return should not be at the end of the function to which the START address points into, but earlier. +It is not set, QEMU will assume that START points to a function and will patch +the return address (on stack or in the link register) to return to START +(like WinAFL). + It is defined by setting AFL_QEMU_PERSISTENT_RET, and too 0x4000000000 has to be set if the target is position independant. - ### 2.3) the OFFSET +This option is for x86 only, arm doesn't save the return address on stack. + If the START address is *not* the beginning of a function, and *no* RET has -been set (so the end of the loop will be at the end of the function), the -ESP pointer very likely has to be reset correctly. +been set (so the end of the loop will be at the end of the function but START +will not be at the beginning), we need an offset from the ESP pointer to locate +the return address to patch. The value by which the ESP pointer has to be corrected has to set in the variable AFL_QEMU_PERSISTENT_RETADDR_OFFSET Now to get this value right here some help: 1. use gdb on the target -2. set a breakpoint to your START address -3. set a breakpoint to the end of the same function +2. set a breakpoint to the function in which START is contained +3. set a breakpoint to your START address 4. "run" the target with a valid commandline -5. at the first breakpoint print the ESP value with -``` -print $esp -``` +5. at the first breakpoint print the ESP value with `p $esp` and take not of it 6. "continue" the target until the second breakpoint 7. again print the ESP value 8. calculate the difference between the two values - and this is the offset - ### 2.4) resetting the register state -It is very, very likely you need to reste the register state when starting -a new loop. Because of this you 99% of the time should set +It is very, very likely you need to restore the general purpose registers state +when starting a new loop. Because of this you 99% of the time should set AFL_QEMU_PERSISTENT_GPR=1 +An example, is when you want to use main() as persistent START: -## 3) optional parameters +```c +int main(int argc, char **argv) { -### 3.1) loop counter value + if (argc < 2) return 1; + + // do stuffs + +} +``` + +If you don't save and restore the registers in x86_64, the paramteter argc +will be lost at the second execution of the loop. + +## 3) Optional parameters + +### 3.1) Loop counter value The more stable your loop in the target, the longer you can run it, the more unstable it is the lower the loop count should be. A low value would be 100, @@ -79,22 +98,28 @@ This value can be set with AFL_QEMU_PERSISTENT_CNT This is the same concept as in the llvm_mode persistent mode with __AFL_LOOP(). - -### 3.2) a hook for in-memory fuzzing +### 3.2) A hook for in-memory fuzzing You can increase the speed of the persistent mode even more by bypassing all the reading of the fuzzing input via a file by reading directly into the memory address space of the target process. -All this needs is that the START address has a register pointing to the -memory buffer, and another register holding the value of the read length -(or pointing to the memory where that value is held). +All this needs is that the START address has a register that can reach the +memory buffer or that the memory buffer is at a know location. You probably need +the value of the size of the buffer (maybe it is in a register when START is +hitted). + +The persistent hook will execute a function on every persistent iteration +(at the start START) defined in a shared object specified with +AFL_QEMU_PERSISTENT_HOOK=/path/to/hook.so. -If the target reads from an input file you have to supply an input file -that is of least of the size that your fuzzing input will be (and do not -supply @@). +The signature is: + +```c +void afl_persistent_hook(uint64_t* regs, uint64_t guest_base); +``` + +In this hook, you can inspect and change the saved GPR state at START. An example that you can use with little modification for your target can be found here: [examples/qemu_persistent_hook](../examples/qemu_persistent_hook) -This shared library is specified via AFL_QEMU_PERSISTENT_HOOK - -- cgit 1.4.1 From a86f740995ffe7c2a456390403d1c78df42d9dcd Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Sun, 9 Feb 2020 11:31:34 +0100 Subject: typo --- qemu_mode/README.persistent.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qemu_mode/README.persistent.md b/qemu_mode/README.persistent.md index e4ac5cee..6948c316 100644 --- a/qemu_mode/README.persistent.md +++ b/qemu_mode/README.persistent.md @@ -60,7 +60,7 @@ Now to get this value right here some help: 2. set a breakpoint to the function in which START is contained 3. set a breakpoint to your START address 4. "run" the target with a valid commandline -5. at the first breakpoint print the ESP value with `p $esp` and take not of it +5. at the first breakpoint print the ESP value with `p $esp` and take note of it 6. "continue" the target until the second breakpoint 7. again print the ESP value 8. calculate the difference between the two values - and this is the offset -- cgit 1.4.1 From 1dcc6b2e10cd07929202ada008da61325add483c Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Sun, 9 Feb 2020 11:45:00 +0100 Subject: readme --- README.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index c3e8dc48..bd741a8b 100644 --- a/README.md +++ b/README.md @@ -59,14 +59,14 @@ A more thorough list is available in the PATCHES file. - | Feature/Instrumentation | afl-gcc | llvm_mode | gcc_plugin | qemu_mode | unicorn_mode | - | ----------------------- |:-------:|:---------:|:----------:|:---------:|:------------:| - | NeverZero | x | x(1) | (2) | x | x | - | Persistent mode | | x | x | x86 | x | - | laf-intel / CompCov | | x | | x86/arm | x86/arm | - | CmpLog | | x | | x | | - | Whitelist | | x | x | | | - | InsTrim | | x | | | | + | Feature/Instrumentation | afl-gcc | llvm_mode | gcc_plugin | qemu_mode | unicorn_mode | + | ----------------------- |:-------:|:---------:|:----------:|:----------------:|:------------:| + | NeverZero | x | x(1) | (2) | x | x | + | Persistent mode | | x | x | x86[_64]/arm[64] | x | + | laf-intel / CompCov | | x | | x86[_64]/arm[64] | x86[_64]/arm | + | CmpLog | | x | | x | | + | Whitelist | | x | x | | | + | InsTrim | | x | | | | neverZero: -- cgit 1.4.1 From 1bb6e1911b4a983687de09b39072638c0c001d3e Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Sun, 9 Feb 2020 11:46:43 +0100 Subject: readme --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index bd741a8b..601704d4 100644 --- a/README.md +++ b/README.md @@ -64,7 +64,7 @@ | NeverZero | x | x(1) | (2) | x | x | | Persistent mode | | x | x | x86[_64]/arm[64] | x | | laf-intel / CompCov | | x | | x86[_64]/arm[64] | x86[_64]/arm | - | CmpLog | | x | | x | | + | CmpLog | | x | | x86[_64]/arm[64] | | | Whitelist | | x | x | | | | InsTrim | | x | | | | -- cgit 1.4.1 From 34a9419b8990fe36da3148c006f6278b20205e94 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Sun, 9 Feb 2020 12:22:39 +0100 Subject: readme fixes --- PATCHES | 1 - qemu_mode/README.persistent.md | 40 +++++++++++++++++++++++----------------- 2 files changed, 23 insertions(+), 18 deletions(-) delete mode 120000 PATCHES diff --git a/PATCHES b/PATCHES deleted file mode 120000 index b34f8c1d..00000000 --- a/PATCHES +++ /dev/null @@ -1 +0,0 @@ -docs/PATCHES \ No newline at end of file diff --git a/qemu_mode/README.persistent.md b/qemu_mode/README.persistent.md index 6948c316..c96a451b 100644 --- a/qemu_mode/README.persistent.md +++ b/qemu_mode/README.persistent.md @@ -2,7 +2,7 @@ ## 1) Introduction -Persistent mode let you fuzz your target persistently between to +Persistent mode let you fuzz your target persistently between two addresses - without forking for every fuzzing attempt. This increases the speed by a factor between x2 and x5, hence it is very, very valuable. @@ -16,10 +16,12 @@ and aarch64 targets. The start of the persistent loop has to be set with AFL_QEMU_PERSISTENT_ADDR. -This address can be the address of whatever instruction but the way in which -you setup persistent mode change if it is the starting instruction of a -function (suggested). This (as well as the RET address, see below) has to be -defined in hexadecimal with the 0x prefix or as a decimal value. +This address can be the address of whatever instruction. +Setting this address to the start of a function makes the usage simple. +If the address is however within a function, either RET or OFFSET (see below +in 2.2 and 2.3) have to be set. +This address (as well as the RET address, see below) has to be defined in +hexadecimal with the 0x prefix or as a decimal value. If the target is compiled with position independant code (PIE/PIC), you must add 0x4000000000 to that address, because qemu loads to this base address. @@ -36,8 +38,8 @@ The emulator will emit a jump to START when translating the instruction at RET. It is optional, and only needed if the the return should not be at the end of the function to which the START address points into, but earlier. -It is not set, QEMU will assume that START points to a function and will patch -the return address (on stack or in the link register) to return to START +If it is not set, QEMU will assume that START points to a function and will +patch the return address (on stack or in the link register) to return to START (like WinAFL). It is defined by setting AFL_QEMU_PERSISTENT_RET, and too 0x4000000000 has to @@ -45,25 +47,29 @@ be set if the target is position independant. ### 2.3) the OFFSET -This option is for x86 only, arm doesn't save the return address on stack. +This option is valid only for x86/x86_64 only, arm/aarch64 do not save the +return address on stack. If the START address is *not* the beginning of a function, and *no* RET has been set (so the end of the loop will be at the end of the function but START -will not be at the beginning), we need an offset from the ESP pointer to locate -the return address to patch. +will not be at the beginning of it), we need an offset from the ESP pointer +to locate the return address to patch. The value by which the ESP pointer has to be corrected has to set in the variable AFL_QEMU_PERSISTENT_RETADDR_OFFSET Now to get this value right here some help: 1. use gdb on the target -2. set a breakpoint to the function in which START is contained -3. set a breakpoint to your START address -4. "run" the target with a valid commandline -5. at the first breakpoint print the ESP value with `p $esp` and take note of it -6. "continue" the target until the second breakpoint -7. again print the ESP value -8. calculate the difference between the two values - and this is the offset +2. set a breakpoint to "main" (this is required for PIE/PIC binaries so the + addresses are set up) +3. "run" the target with a valid commandline +4. set a breakpoint to the function in which START is contained +5. set a breakpoint to your START address +6. "continue" to the function start breakpoint +6. print the ESP value with `print $esp` and take note of it +7. "continue" the target until the second breakpoint +8. again print the ESP value +9. calculate the difference between the two values - and this is the offset ### 2.4) resetting the register state -- cgit 1.4.1 From f47d905225939e3c4b02a041423efdf27ec1501b Mon Sep 17 00:00:00 2001 From: van Hauser Date: Sun, 9 Feb 2020 13:03:55 +0100 Subject: more unset for test.sh --- test/test.sh | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/test/test.sh b/test/test.sh index d9374f96..fde40736 100755 --- a/test/test.sh +++ b/test/test.sh @@ -45,6 +45,17 @@ unset AFL_LLVM_INSTRIM unset AFL_LLVM_LAF_SPLIT_SWITCHES unset AFL_LLVM_LAF_TRANSFORM_COMPARES unset AFL_LLVM_LAF_SPLIT_COMPARES +unset AFL_QEMU_PERSISTENT_ADDR +unset AFL_QEMU_PERSISTENT_RETADDR_OFFSET +unset AFL_QEMU_PERSISTENT_GPR +unset AFL_QEMU_PERSISTENT_RET +unset AFL_QEMU_PERSISTENT_HOOK +unset AFL_QEMU_PERSISTENT_CNT +unset AFL_POST_LIBRARY +unset AFL_CUSTOM_MUTATOR_LIBRARY +unset AFL_PYTHON_MODULE +unset AFL_PRELOAD +unset LD_PRELOAD # on OpenBSD we need to work with llvm from /usr/local/bin test -e /usr/local/bin/opt && { -- cgit 1.4.1 From f64f2261278d59ca78740df756f02944f571b6e6 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Sun, 9 Feb 2020 23:11:50 +0100 Subject: readme --- README.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 601704d4..939cfb92 100644 --- a/README.md +++ b/README.md @@ -61,11 +61,11 @@ | Feature/Instrumentation | afl-gcc | llvm_mode | gcc_plugin | qemu_mode | unicorn_mode | | ----------------------- |:-------:|:---------:|:----------:|:----------------:|:------------:| - | NeverZero | x | x(1) | (2) | x | x | + | NeverZero | x | x(1) | (2) | x | x | | Persistent mode | | x | x | x86[_64]/arm[64] | x | | laf-intel / CompCov | | x | | x86[_64]/arm[64] | x86[_64]/arm | | CmpLog | | x | | x86[_64]/arm[64] | | - | Whitelist | | x | x | | | + | Whitelist | | x | x | (x)(3) | | | InsTrim | | x | | | | neverZero: @@ -74,6 +74,8 @@ (2) gcc creates non-performant code, hence it is disabled in gcc_plugin + (3) partially via AFL_CODE_START/AFL_CODE_END + So all in all this is the best-of afl that is currently out there :-) For new versions and additional information, check out: -- cgit 1.4.1 From 1a589e231306033fca083713be639fc393625ec3 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Sun, 9 Feb 2020 23:29:15 +0100 Subject: update docs --- TODO.md | 2 +- docs/binaryonly_fuzzing.md | 45 +++++++++++++++++++++++++++++++++++++++------ 2 files changed, 40 insertions(+), 7 deletions(-) diff --git a/TODO.md b/TODO.md index 39e219ff..02850276 100644 --- a/TODO.md +++ b/TODO.md @@ -18,7 +18,7 @@ qemu_mode: - instrim for QEMU mode via static analysis (with r2pipe? or angr?) Idea: The static analyzer outputs a map in which each edge that must be skipped is marked with 1. QEMU loads it at startup in the parent process. - - rename qemu specific envs to AFL_QEMU (espec. AFL_ENTRYPOINT) + - rename qemu specific envs to AFL_QEMU (AFL_ENTRYPOINT, AFL_CODE_START/END, AFL_COMPCOV_LEVEL?) - add AFL_QEMU_EXITPOINT (maybe multiple?) - add/implement AFL_QEMU_INST_LIBLIST and AFL_QEMU_NOINST_PROGRAM diff --git a/docs/binaryonly_fuzzing.md b/docs/binaryonly_fuzzing.md index ff98ed00..e49c9b3e 100644 --- a/docs/binaryonly_fuzzing.md +++ b/docs/binaryonly_fuzzing.md @@ -8,10 +8,11 @@ The following is a description of how these binaries can be fuzzed with afl++ - !!!!! - TL;DR: try DYNINST with afl-dyninst. If it produces too many crashes then - use afl -Q qemu_mode, or better: use both in parallel. - !!!!! +## TL;DR: + + qemu_mode in persistent mode is the fastest - if the stability is + high enough. Otherwise try retrowrite, afl-dyninst and if these + fail too then standard qemu_mode with AFL_ENTRYPOINT to where you need it. ## QEMU @@ -19,11 +20,19 @@ Qemu is the "native" solution to the program. It is available in the ./qemu_mode/ directory and once compiled it can be accessed by the afl-fuzz -Q command line option. - The speed decrease is at about 50%. It is the easiest to use alternative and even works for cross-platform binaries. + The speed decrease is at about 50%. + However various options exist to increase the speed: + - using AFL_ENTRYPOINT to move the forkserver to a later basic block in + the binary (+5-10% speed) + - using persistent mode [qemu_mode/README.persistent.md](../qemu_mode/README.persistent.md) + this will result in 150-300% overall speed - so 3-8x the original + qemu_mode speed! + - using AFL_CODE_START/AFL_CODE_END to only instrument specific parts + Note that there is also honggfuzz: [https://github.com/google/honggfuzz](https://github.com/google/honggfuzz) - which now has a qemu_mode, but its performance is just 1.5%! + which now has a qemu_mode, but its performance is just 1.5% ... As it is included in afl++ this needs no URL. @@ -74,6 +83,27 @@ [https://github.com/vanhauser-thc/afl-dyninst](https://github.com/vanhauser-thc/afl-dyninst) +## RETROWRITE + + If you have an x86/x86_64 binary that still has it's symbols, is compiled + with position independant code (PIC/PIE) and does not use most of the C++ + features then the retrowrite solution might be for you. + It decompiles to ASM files which can then be instrumented with afl-gcc. + + It is at about 80-85% performance. + + [https://github.com/HexHive/retrowrite](https://github.com/HexHive/retrowrite) + + +## MCSEMA + + Theoretically you can also decompile to llvm IR with mcsema, and then + use llvm_mode to instrument the binary. + Good luck with that. + + [https://github.com/lifting-bits/mcsema](https://github.com/lifting-bits/mcsema) + + ## INTEL-PT If you have a newer Intel CPU, you can make use of Intels processor trace. @@ -117,6 +147,9 @@ There is a WIP fuzzer available at [https://github.com/andreafioraldi/frida-fuzzer](https://github.com/andreafioraldi/frida-fuzzer) + There is also an early implementation in an AFL++ test branch: + [https://github.com/vanhauser-thc/AFLplusplus/tree/frida](https://github.com/vanhauser-thc/AFLplusplus/tree/frida) + ## PIN & DYNAMORIO -- cgit 1.4.1 From 33c18c36db70859fc484dd41a317634809d5c043 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Sun, 9 Feb 2020 23:31:19 +0100 Subject: add 'e' code for version --- include/config.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/config.h b/include/config.h index 8b8924f5..d47908f6 100644 --- a/include/config.h +++ b/include/config.h @@ -26,7 +26,8 @@ /* Version string: */ -#define VERSION "++2.60d" // c = release, d = volatile github dev + // c = release, d = volatile github dev, e = experimental branch +#define VERSION "++2.60d" /****************************************************** * * -- cgit 1.4.1