From 7adb7cf7f698b309029d4853b1ec8900fe1baafe Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 22 Sep 2019 10:42:48 +0200
Subject: more tests

---
 Makefile                      |  2 +-
 llvm_mode/afl-llvm-pass.so.cc |  4 +--
 test/test.sh                  | 66 ++++++++++++++++++++++++++++++++++++++++---
 3 files changed, 64 insertions(+), 8 deletions(-)

diff --git a/Makefile b/Makefile
index 5d9a55a6..d7309cff 100644
--- a/Makefile
+++ b/Makefile
@@ -80,7 +80,7 @@ endif
 
 all:	test_x86 test_shm test_python27 ready $(PROGS) afl-as test_build all_done
 
-tests:
+tests:	source-only
 	@cd test ; ./test.sh
 
 help:
diff --git a/llvm_mode/afl-llvm-pass.so.cc b/llvm_mode/afl-llvm-pass.so.cc
index 5d531a87..58acd9be 100644
--- a/llvm_mode/afl-llvm-pass.so.cc
+++ b/llvm_mode/afl-llvm-pass.so.cc
@@ -105,9 +105,7 @@ bool AFLCoverage::runOnModule(Module &M) {
 
     SAYF(cCYA "afl-llvm-pass" VERSION cRST " by <lszekeres@google.com>\n");
 
-  } else
-
-    be_quiet = 1;
+  } else if (getenv("AFL_QUIET")) be_quiet = 1;
 
   /* Decide instrumentation ratio */
 
diff --git a/test/test.sh b/test/test.sh
index 0e2ba52b..6a706ab9 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -34,7 +34,7 @@ RED="\\x1b[0;31m"
 YELLOW="\\x1b[1;93m"
 RESET="\\x1b[0m"
 
-$ECHO "$RESET"
+$ECHO "${RESET}${GREY}[*] starting afl++ test framework ..."
 
 test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && {
   ../afl-gcc -o test-instr.plain ../test-instr.c > /dev/null 2>&1
@@ -65,7 +65,7 @@ test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && {
       timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1
     } > /dev/null 2>&1
     test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
-      $ECHO "$GREEN[+] afl-fuzz is working correctly"
+      $ECHO "$GREEN[+] afl-fuzz is working correctly with afl-gcc"
     } || $ECHO "$RED[!] afl-fuzz is not working correctly"
     rm -rf in out
   } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command"
@@ -74,7 +74,65 @@ test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && {
 
 test -e ../afl-clang-fast && {
 
-  echo todo: llvm_mode
+  ../afl-clang-fast -o test-instr.plain ../test-instr.c > /dev/null 2>&1
+  AFL_HARDEN=1 ../afl-clang-fast -o test-compcov.harden test-compcov.c > /dev/null 2>&1
+  test -e test-instr.plain && {
+    $ECHO "$GREEN[+] llvm_mode compilation succeeded"
+    echo 0 | ../afl-showmap -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
+    ../afl-showmap -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
+    test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
+      diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
+        $ECHO "$RED[!] llvm_mode instrumentation should be different on different input but is not"
+      } || $ECHO "$GREEN[+] llvm_mode instrumentation present and working correctly"
+    } || $ECHO "$RED[!] llvm_mode instrumentation failed"
+    rm -f test-instr.plain.0 test-instr.plain.1
+  } || $ECHO "$RED[!] llvm_mode failed"
+  test -e test-compcov.harden && {
+    grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && {
+      $ECHO "$GREEN[+] llvm_mode hardened mode succeeded and is working"
+    } || $ECHO "$RED[!] hardened mode is not hardened"
+    rm -f test-compcov.harden
+  } || $ECHO "$RED[!] llvm_mode hardened mode compilation failed"
+  # now we want to be sure that afl-fuzz is working  
+  test -n "$TIMEOUT" && {
+    mkdir -p in
+    echo 0 > in/in
+    $ECHO "$GREY[*] running afl-fuzz, this will take approx 10 seconds"
+    {
+      timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1
+    } > /dev/null 2>&1
+    test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
+      $ECHO "$GREEN[+] afl-fuzz is working correctly with llvm_mode"
+    } || $ECHO "$RED[!] afl-fuzz is not working correctly"
+    rm -rf in out
+  } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command"
+  rm -f test-instr.plain
+  # now for the special llvm_mode things
+  AFL_LLVM_INSTRIM=1 AFL_LLVM_INSTRIM_LOOPHEAD=1 ../afl-clang-fast -o test-compcov.instrim test-compcov.c > /dev/null 2> test.out
+  test -e test-compcov.instrim && {
+    grep -q " 1 location" test.out && {
+      $ECHO "$GREEN[+] llvm_mode InsTrim feature works correctly"
+    } || $ECHO "$RED[!] llvm_mode InsTrim feature failed"
+  } || $ECHO "$RED[!] llvm_mode InsTrim feature compilation failed"
+  rm -f test-compcov.instrim test.out
+
+  AFL_LLVM_LAF_SPLIT_SWITCHES=1 AFL_LLVM_LAF_TRANSFORM_COMPARES=1 AFL_LLVM_LAF_SPLIT_COMPARES=1 ../afl-clang-fast -o test-compcov.compcov test-compcov.c > /dev/null 2> test.out
+  test -e test-compcov.compcov && {
+    grep -Eq " [3-9][0-9] location" test.out && {
+      $ECHO "$GREEN[+] llvm_mode laf-intel/compcov feature works correctly"
+    } || $ECHO "$RED[!] llvm_mode laf-intel/compcov feature failed"
+  } || $ECHO "$RED[!] llvm_mode laf-intel/compcov feature compilation failed"
+  rm -f test-compcov.compcov test.out
+  
+  
+  echo foobar.c > whitelist.txt
+  AFL_LLVM_WHITELIST=whitelist.txt ../afl-clang-fast -o test-compcov test-compcov.c > test.out 2>&1
+  test -e test-compcov && {
+    grep -q "No instrumentation targets found" test.out && {
+      $ECHO "$GREEN[+] llvm_mode whitelist feature works correctly"
+    } || $ECHO "$RED[!] llvm_mode whitelist feature failed"
+  } || $ECHO "$RED[!] llvm_mode whitelist feature compilation failed"
+  rm -f test-compcov test.out
 
 } || $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test"
 
@@ -108,7 +166,7 @@ test -e ../afl-qemu-trace && {
 
 rm -f test-compcov
 
-$ECHO "$GREY[*] all tests completed!"
+$ECHO "$GREY[*] all test cases completed.$RESET"
 $ECHO "$RESET"
 
 # unicorn_mode ?
-- 
cgit 1.4.1


From 99be29472657d074d53f7487198acca44a1f5c82 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 22 Sep 2019 10:44:02 +0200
Subject: fix

---
 test/test.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/test.sh b/test/test.sh
index 6a706ab9..ad1bdc97 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -132,7 +132,7 @@ test -e ../afl-clang-fast && {
       $ECHO "$GREEN[+] llvm_mode whitelist feature works correctly"
     } || $ECHO "$RED[!] llvm_mode whitelist feature failed"
   } || $ECHO "$RED[!] llvm_mode whitelist feature compilation failed"
-  rm -f test-compcov test.out
+  rm -f test-compcov test.out whitelist.txt
 
 } || $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test"
 
-- 
cgit 1.4.1


From f097f780af8bf30a51d2d462dfe303604e4a6a75 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 22 Sep 2019 11:42:39 +0200
Subject: final tests

---
 test/test-compcov.c | 35 ++++++++++++------------
 test/test.sh        | 76 +++++++++++++++++++++++++++++++++++++++--------------
 2 files changed, 74 insertions(+), 37 deletions(-)

diff --git a/test/test-compcov.c b/test/test-compcov.c
index bbad3aed..978d5551 100644
--- a/test/test-compcov.c
+++ b/test/test-compcov.c
@@ -4,25 +4,26 @@
 #include <string.h>
 
 int main(int argc, char** argv) {
+  char *input = argv[1], *buf, buffer[20];
 
-  char *buf;
-
-  if (argc > 1) {
-  
-    if (strcmp(argv[1], "LIBTOKENCAP") == 0)
-      printf("your string was libtokencap\n");
-    else if (strcmp(argv[1], "BUGMENOT") == 0)
-      printf("your string was bugmenot\n");
-    else if (strcmp(argv[1], "BUFFEROVERFLOW") == 0) {
-      buf = malloc(16);
-      strcpy(buf, "TEST");
-      strcat(buf, argv[1]);
-      printf("This will only crash with libdislocator: %s\n", buf);
-      return 0;
-    } else
-      printf("I do not know your string\n");
-  
+  if (argc < 2) {
+    ssize_t ret = read(0, buffer, sizeof(buffer) - 1);
+    buffer[ret] = 0;
+    input = buffer;
   }
+  
+  if (strcmp(input, "LIBTOKENCAP") == 0)
+    printf("your string was libtokencap\n");
+  else if (strcmp(input, "BUGMENOT") == 0)
+    printf("your string was bugmenot\n");
+  else if (strcmp(input, "BUFFEROVERFLOW") == 0) {
+    buf = malloc(16);
+    strcpy(buf, "TEST");
+    strcat(buf, input);
+    printf("This will only crash with libdislocator: %s\n", buf);
+    return 0;
+  } else
+    printf("I do not know your string\n");
 
   return 0;
 
diff --git a/test/test.sh b/test/test.sh
index ad1bdc97..5d67588a 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -27,8 +27,13 @@ test -z "$ECHO" && { echo Error: echo command does not support -e option ; exit
 
 export AFL_EXIT_WHEN_DONE=1
 export AFL_SKIP_CPUFREQ=1
+unset AFL_DEBUG
+unset AFL_HARDEN
+unset AFL_LLVM_WHITELIST
+unset AFL_LLVM_INSTRIM
 
 GREY="\\x1b[1;90m"
+BLUE="\\x1b[1;94m"
 GREEN="\\x1b[0;32m"
 RED="\\x1b[0;31m"
 YELLOW="\\x1b[1;93m"
@@ -36,6 +41,7 @@ RESET="\\x1b[0m"
 
 $ECHO "${RESET}${GREY}[*] starting afl++ test framework ..."
 
+$ECHO "$BLUE[*] Testing: afl-gcc, afl-showmap and afl-fuzz"
 test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && {
   ../afl-gcc -o test-instr.plain ../test-instr.c > /dev/null 2>&1
   AFL_HARDEN=1 ../afl-gcc -o test-instr.harden ../test-instr.c > /dev/null 2>&1
@@ -53,27 +59,27 @@ test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && {
   test -e test-instr.harden && {
     grep -qa fstack-protector-all test-instr.harden > /dev/null 2>&1 && {
       $ECHO "$GREEN[+] afl-gcc hardened mode succeeded and is working"
-    } || $ECHO "$RED[!] hardened mode is not hardened"
+    } || $ECHO "$RED[!] afl-gcc hardened mode is not hardened"
     rm -f test-instr.harden
   } || $ECHO "$RED[!] afl-gcc hardened mode compilation failed"
   # now we want to be sure that afl-fuzz is working  
   test -n "$TIMEOUT" && {
     mkdir -p in
     echo 0 > in/in
-    $ECHO "$GREY[*] running afl-fuzz, this will take approx 10 seconds"
+    $ECHO "$GREY[*] running afl-fuzz for afl-gcc, this will take approx 10 seconds"
     {
       timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1
     } > /dev/null 2>&1
     test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
       $ECHO "$GREEN[+] afl-fuzz is working correctly with afl-gcc"
-    } || $ECHO "$RED[!] afl-fuzz is not working correctly"
+    } || $ECHO "$RED[!] afl-fuzz is not working correctly with afl-gcc"
     rm -rf in out
   } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command"
   rm -f test-instr.plain
 } || $ECHO "$YELLOW[-] afl is not compiled, cannot test"
 
+$ECHO "$BLUE[*] Testing: llvm_mode"
 test -e ../afl-clang-fast && {
-
   ../afl-clang-fast -o test-instr.plain ../test-instr.c > /dev/null 2>&1
   AFL_HARDEN=1 ../afl-clang-fast -o test-compcov.harden test-compcov.c > /dev/null 2>&1
   test -e test-instr.plain && {
@@ -90,32 +96,32 @@ test -e ../afl-clang-fast && {
   test -e test-compcov.harden && {
     grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && {
       $ECHO "$GREEN[+] llvm_mode hardened mode succeeded and is working"
-    } || $ECHO "$RED[!] hardened mode is not hardened"
+    } || $ECHO "$RED[!] llvm_mode hardened mode is not hardened"
     rm -f test-compcov.harden
   } || $ECHO "$RED[!] llvm_mode hardened mode compilation failed"
   # now we want to be sure that afl-fuzz is working  
   test -n "$TIMEOUT" && {
     mkdir -p in
     echo 0 > in/in
-    $ECHO "$GREY[*] running afl-fuzz, this will take approx 10 seconds"
+    $ECHO "$GREY[*] running afl-fuzz for llvm_mode, this will take approx 10 seconds"
     {
       timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1
     } > /dev/null 2>&1
     test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
       $ECHO "$GREEN[+] afl-fuzz is working correctly with llvm_mode"
-    } || $ECHO "$RED[!] afl-fuzz is not working correctly"
+    } || $ECHO "$RED[!] afl-fuzz is not working correctly with llvm_mode"
     rm -rf in out
   } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command"
   rm -f test-instr.plain
+
   # now for the special llvm_mode things
   AFL_LLVM_INSTRIM=1 AFL_LLVM_INSTRIM_LOOPHEAD=1 ../afl-clang-fast -o test-compcov.instrim test-compcov.c > /dev/null 2> test.out
   test -e test-compcov.instrim && {
-    grep -q " 1 location" test.out && {
+    grep -Eq " [1-3] location" test.out && {
       $ECHO "$GREEN[+] llvm_mode InsTrim feature works correctly"
     } || $ECHO "$RED[!] llvm_mode InsTrim feature failed"
   } || $ECHO "$RED[!] llvm_mode InsTrim feature compilation failed"
   rm -f test-compcov.instrim test.out
-
   AFL_LLVM_LAF_SPLIT_SWITCHES=1 AFL_LLVM_LAF_TRANSFORM_COMPARES=1 AFL_LLVM_LAF_SPLIT_COMPARES=1 ../afl-clang-fast -o test-compcov.compcov test-compcov.c > /dev/null 2> test.out
   test -e test-compcov.compcov && {
     grep -Eq " [3-9][0-9] location" test.out && {
@@ -123,8 +129,6 @@ test -e ../afl-clang-fast && {
     } || $ECHO "$RED[!] llvm_mode laf-intel/compcov feature failed"
   } || $ECHO "$RED[!] llvm_mode laf-intel/compcov feature compilation failed"
   rm -f test-compcov.compcov test.out
-  
-  
   echo foobar.c > whitelist.txt
   AFL_LLVM_WHITELIST=whitelist.txt ../afl-clang-fast -o test-compcov test-compcov.c > test.out 2>&1
   test -e test-compcov && {
@@ -133,11 +137,17 @@ test -e ../afl-clang-fast && {
     } || $ECHO "$RED[!] llvm_mode whitelist feature failed"
   } || $ECHO "$RED[!] llvm_mode whitelist feature compilation failed"
   rm -f test-compcov test.out whitelist.txt
-
+  ../afl-clang-fast -o test-persistent ../experimental/persistent_demo/persistent_demo.c > /dev/null 2>&1
+  test -e test-persistent && {
+    echo foo | ../afl-showmap -o /dev/null -q -r ./test-persistent && {
+      $ECHO "$GREEN[+] lvm_mode persistent mode feature works correctly"
+    } || $ECHO "$RED[!] llvm_mode persistent mode feature failed to work"
+  } || $ECHO "$RED[!] llvm_mode persistent mode feature compilation failed"
+  rm -f test-persistent
 } || $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test"
 
+$ECHO "$BLUE[*] Testing: shared library extensions"
 gcc -o test-compcov test-compcov.c > /dev/null 2>&1
-
 test -e ../libtokencap.so && {
   AFL_TOKEN_FILE=token.out LD_PRELOAD=../libtokencap.so ./test-compcov foobar > /dev/null 2>&1
   grep -q BUGMENOT token.out > /dev/null 2>&1 && {
@@ -145,7 +155,6 @@ test -e ../libtokencap.so && {
   } || $ECHO "$RED[!] libtokencap did not capture tokens"
   rm -f token.out
 } || $ECHO "$YELLOW[-] libtokencap is not compiled, cannot test"
-
 test -e ../libdislocator.so && {
   {
     ulimit -c 1
@@ -156,17 +165,44 @@ test -e ../libdislocator.so && {
   } || $ECHO "$GREEN[+] libdislocator did successfully detect the memory corruption" 
   rm -f test.out core test-compcov.core core.test-compcov
 } || $ECHO "$YELLOW[-] libdislocator is not compiled, cannot test"
+rm -f test-compcov
 
+$ECHO "$BLUE[*] Testing: qemu_mode"
 test -e ../afl-qemu-trace && {
+  gcc -o test-instr ../test-instr.c
+  gcc -o test-compcov test-compcov.c
+  test -e test-instr -a -e test-compcov && {
+    test -n "$TIMEOUT" && {
+      mkdir -p in
+      echo 0 > in/in
+      $ECHO "$GREY[*] running afl-fuzz for qemu_mode, this will take approx 10 seconds"
+      {
+        timeout -s KILL 10 ../afl-fuzz -Q -i in -o out -- ./test-instr > /dev/null 2>&1
+      } > /dev/null 2>&1
+      test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
+        $ECHO "$GREEN[+] afl-fuzz is working correctly with qemu_mode"
+      } || $ECHO "$RED[!] afl-fuzz is not working correctly with qemu_mode"
+
+      test -e ../libcompcov.so && {
+        $ECHO "$GREY[*] running afl-fuzz for qemu_mode libcompcov, this will take approx 10 seconds"
+        {
+          export AFL_PRELOAD=../libcompcov.so 
+          export AFL_COMPCOV_LEVEL=2
+          timeout -s KILL 10 ../afl-fuzz -Q -i in -o out -- ./test-compcov > /dev/null 2>&1
+        } > /dev/null 2>&1
+        test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
+          $ECHO "$GREEN[+] afl-fuzz is working correctly with qemu_mode libcompcov"
+        } || $ECHO "$RED[!] afl-fuzz is not working correctly with qemu_mode libcompcov"
+      } || $ECHO "$YELLOW[-] we cannot test qemu_mode libcompcov because it is not present"
+      rm -rf in out
+    } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command"
+  } || $ECHO "$RED[-] gcc compilation of test targets failed - what is going on??"
+  
+  $ECHO "$YELLOW[?] we need a test case for qemu_mode persistent mode"
 
-  echo todo: qemu_mode
-  # we will use test-compcov for testing libcompcov
-
+  rm -f test-instr test-compcov
 } || $ECHO "$YELLOW[-] qemu_mode is not compiled, cannot test"
 
-rm -f test-compcov
-
 $ECHO "$GREY[*] all test cases completed.$RESET"
-$ECHO "$RESET"
 
 # unicorn_mode ?
-- 
cgit 1.4.1


From b4ca95a9fafccd0506285000595ada5ed47f9ca3 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 22 Sep 2019 13:21:15 +0200
Subject: afl-fuzz mutation documentation feature

---
 Makefile               |  7 +++++++
 docs/ChangeLog         |  2 ++
 include/afl-fuzz.h     |  5 +++++
 src/afl-fuzz-globals.c |  4 ++++
 src/afl-fuzz-one.c     | 17 +++++++++++++++++
 src/afl-fuzz-run.c     | 12 ++++++++++++
 test/test.sh           |  8 ++++++++
 7 files changed, 55 insertions(+)

diff --git a/Makefile b/Makefile
index d7309cff..35f58ac5 100644
--- a/Makefile
+++ b/Makefile
@@ -92,6 +92,8 @@ help:
 	@echo "distrib: everything (for both binary-only and source code fuzzing)"
 	@echo "install: installs everything you have compiled with the build option above"
 	@echo "clean: cleans everything. for qemu_mode and unicorn_mode it means it deletes all downloads as well"
+	@echo "tests: this runs the test framework. It is more catered for the developers, but if you run into problems this helps pinpointing the problem"
+	@echo "document: creates afl-fuzz-document which will only do one run and save all manipulated inputs into out/queue/mutations"
 	@echo "help: shows these build options :-)"
 	@echo "=========================================="
 	@echo "Recommended: \"distrib\" or \"source-only\", then \"install\""
@@ -176,6 +178,11 @@ afl-gotcpu: src/afl-gotcpu.c $(COMM_HDR) | test_x86
 	$(CC) $(CFLAGS) src/$@.c -o $@ $(LDFLAGS)
 
 
+# document all mutations and only do one run (use with only one input file!)
+document: include/afl-fuzz.h $(AFL_FUZZ_FILES) afl-common.o afl-sharedmem.o afl-forkserver.o $(COMM_HDR) | test_x86
+	$(CC) $(CFLAGS) $(AFL_FUZZ_FILES) -D_AFL_DOCUMENT_MUTATIONS afl-common.o afl-sharedmem.o afl-forkserver.o -o afl-fuzz-document $(LDFLAGS) $(PYFLAGS)
+
+
 code-format:
 	./.custom-format.py -i src/*.c
 	./.custom-format.py -i include/*.h
diff --git a/docs/ChangeLog b/docs/ChangeLog
index 7beb32c3..0f5bb99c 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -27,6 +27,8 @@ Version ++2.54d (dev):
   - fuzzing strategy yields for custom mutator were missing from the UI, added them :)
   - added "make tests" which will perform checks to see that all functionality
     is working as expected. this is currently the starting point, its not complete :)
+  - added mutation documentation feature ("make document"), creates afl-fuzz-document
+    and saves all mutations of the first run on the first file into out/queue/mutations
   - libtokencap and libdislocator now compile to the afl_root directory and are
     installed to the .../lib/afl directory when present during make install
   - reducing duplicate code in afl-fuzz
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 9536e06a..4912b3f0 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -682,5 +682,10 @@ static u64 get_cur_time_us(void) {
 
 }
 
+#ifdef _AFL_DOCUMENT_MUTATIONS
+  extern u8 do_document;
+  extern u32 document_counter;
+#endif
+
 #endif
 
diff --git a/src/afl-fuzz-globals.c b/src/afl-fuzz-globals.c
index 1358a1fb..01b242b8 100644
--- a/src/afl-fuzz-globals.c
+++ b/src/afl-fuzz-globals.c
@@ -259,3 +259,7 @@ PyObject *py_functions[PY_FUNC_COUNT];
 
 #endif
 
+#ifdef _AFL_DOCUMENT_MUTATIONS
+  u8 do_document;
+  u32 document_counter;
+#endif
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 59483b8f..1824f0b2 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -4231,6 +4231,7 @@ pacemaker_fuzzing:
 
 #define core_fuzzing(a) common_fuzzing((a), MOpt_globals_core)
 
+
 void pso_updating(void) {
 
   g_now += 1;
@@ -4310,6 +4311,22 @@ void pso_updating(void) {
 u8 fuzz_one(char** argv) {
 
   int key_val_lv = 0;
+
+#ifdef _AFL_DOCUMENT_MUTATIONS
+  if (do_document == 0) {
+    char *fn = alloc_printf("%s/mutations", out_dir);
+    if (fn) {
+      do_document = mkdir(fn, 0700); // if it exists we do not care
+      do_document = 1;
+      ck_free(fn);
+    } else
+      PFATAL("malloc()");
+  } else {
+    do_document = 2;
+    stop_soon = 2;
+  }
+#endif
+
   if (limit_time_sig == 0) {
 
     key_val_lv = fuzz_one_original(argv);
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index f2f663dc..220433fc 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -251,6 +251,18 @@ void write_to_testcase(void* mem, u32 len) {
 
   s32 fd = out_fd;
 
+#ifdef _AFL_DOCUMENT_MUTATIONS
+  s32 doc_fd;
+  char *fn = alloc_printf("%s/mutations/%09u:%s", out_dir, document_counter++, describe_op(0));
+  if (fn != NULL) {
+    if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600)) >= 0) {
+      if (write(doc_fd, mem, len) != len) PFATAL("write to mutation file failed: %s", fn);
+      close(doc_fd);
+    }
+    ck_free(fn);
+  }
+#endif
+
   if (out_file) {
 
     // unlink(out_file);                                     /* Ignore errors.
diff --git a/test/test.sh b/test/test.sh
index 5d67588a..d230cf71 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -27,10 +27,18 @@ test -z "$ECHO" && { echo Error: echo command does not support -e option ; exit
 
 export AFL_EXIT_WHEN_DONE=1
 export AFL_SKIP_CPUFREQ=1
+unset AFL_QUIET
 unset AFL_DEBUG
 unset AFL_HARDEN
+unset AFL_USE_ASAN
+unset AFL_USE_MSAN
+unset AFL_CC
+unset AFL_PRELOAD
 unset AFL_LLVM_WHITELIST
 unset AFL_LLVM_INSTRIM
+unset AFL_LLVM_LAF_SPLIT_SWITCHES
+unset AFL_LLVM_LAF_TRANSFORM_COMPARES
+unset AFL_LLVM_LAF_SPLIT_COMPARES
 
 GREY="\\x1b[1;90m"
 BLUE="\\x1b[1;94m"
-- 
cgit 1.4.1


From 5044bb0332bf2bed8fe8691f411bd9c144e332af Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 22 Sep 2019 13:39:49 +0200
Subject: move .o to src/

---
 Makefile | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/Makefile b/Makefile
index 35f58ac5..a6154561 100644
--- a/Makefile
+++ b/Makefile
@@ -153,34 +153,34 @@ afl-as: src/afl-as.c include/afl-as.h $(COMM_HDR) | test_x86
 	$(CC) $(CFLAGS) src/$@.c -o $@ $(LDFLAGS)
 	ln -sf afl-as as
 
-afl-common.o : src/afl-common.c include/common.h
-	$(CC) $(CFLAGS) -c src/afl-common.c
+src/afl-common.o : src/afl-common.c include/common.h
+	$(CC) $(CFLAGS) -c src/afl-common.c -o src/afl-common.o
 
-afl-forkserver.o : src/afl-forkserver.c include/forkserver.h
-	$(CC) $(CFLAGS) -c src/afl-forkserver.c
+src/afl-forkserver.o : src/afl-forkserver.c include/forkserver.h
+	$(CC) $(CFLAGS) -c src/afl-forkserver.c -o src/afl-forkserver.o
 
-afl-sharedmem.o : src/afl-sharedmem.c include/sharedmem.h
-	$(CC) $(CFLAGS) -c src/afl-sharedmem.c
+src/afl-sharedmem.o : src/afl-sharedmem.c include/sharedmem.h
+	$(CC) $(CFLAGS) -c src/afl-sharedmem.c -o src/afl-sharedmem.o
 
-afl-fuzz: include/afl-fuzz.h $(AFL_FUZZ_FILES) afl-common.o afl-sharedmem.o afl-forkserver.o $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) $(AFL_FUZZ_FILES) afl-common.o afl-sharedmem.o afl-forkserver.o -o $@ $(LDFLAGS) $(PYFLAGS)
+afl-fuzz: include/afl-fuzz.h $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o $(COMM_HDR) | test_x86
+	$(CC) $(CFLAGS) $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o -o $@ $(LDFLAGS) $(PYFLAGS)
 
-afl-showmap: src/afl-showmap.c afl-common.o afl-sharedmem.o $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) src/$@.c afl-common.o afl-sharedmem.o -o $@ $(LDFLAGS)
+afl-showmap: src/afl-showmap.c src/afl-common.o src/afl-sharedmem.o $(COMM_HDR) | test_x86
+	$(CC) $(CFLAGS) src/$@.c src/afl-common.o src/afl-sharedmem.o -o $@ $(LDFLAGS)
 
-afl-tmin: src/afl-tmin.c afl-common.o afl-sharedmem.o afl-forkserver.o $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) src/$@.c afl-common.o afl-sharedmem.o afl-forkserver.o -o $@ $(LDFLAGS)
+afl-tmin: src/afl-tmin.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o $(COMM_HDR) | test_x86
+	$(CC) $(CFLAGS) src/$@.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o -o $@ $(LDFLAGS)
 
-afl-analyze: src/afl-analyze.c afl-common.o afl-sharedmem.o $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) src/$@.c afl-common.o afl-sharedmem.o -o $@ $(LDFLAGS)
+afl-analyze: src/afl-analyze.c src/afl-common.o src/afl-sharedmem.o $(COMM_HDR) | test_x86
+	$(CC) $(CFLAGS) src/$@.c src/afl-common.o src/afl-sharedmem.o -o $@ $(LDFLAGS)
 
 afl-gotcpu: src/afl-gotcpu.c $(COMM_HDR) | test_x86
 	$(CC) $(CFLAGS) src/$@.c -o $@ $(LDFLAGS)
 
 
 # document all mutations and only do one run (use with only one input file!)
-document: include/afl-fuzz.h $(AFL_FUZZ_FILES) afl-common.o afl-sharedmem.o afl-forkserver.o $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) $(AFL_FUZZ_FILES) -D_AFL_DOCUMENT_MUTATIONS afl-common.o afl-sharedmem.o afl-forkserver.o -o afl-fuzz-document $(LDFLAGS) $(PYFLAGS)
+document: include/afl-fuzz.h $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o $(COMM_HDR) | test_x86
+	$(CC) $(CFLAGS) $(AFL_FUZZ_FILES) -D_AFL_DOCUMENT_MUTATIONS src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o -o afl-fuzz-document $(LDFLAGS) $(PYFLAGS)
 
 
 code-format:
@@ -228,7 +228,7 @@ all_done: test_build
 .NOTPARALLEL: clean
 
 clean:
-	rm -f $(PROGS) afl-as as afl-g++ afl-clang afl-clang++ *.o *~ a.out core core.[1-9][0-9]* *.stackdump test .test .test1 .test2 test-instr .test-instr0 .test-instr1 qemu_mode/qemu-3.1.1.tar.xz afl-qemu-trace afl-gcc-fast afl-gcc-pass.so afl-gcc-rt.o afl-g++-fast *.so unicorn_mode/24f55a7973278f20f0de21b904851d99d4716263.tar.gz *.8
+	rm -f $(PROGS) afl-as as afl-g++ afl-clang afl-clang++ *.o src/*.o *~ a.out core core.[1-9][0-9]* *.stackdump test .test .test1 .test2 test-instr .test-instr0 .test-instr1 qemu_mode/qemu-3.1.1.tar.xz afl-qemu-trace afl-gcc-fast afl-gcc-pass.so afl-gcc-rt.o afl-g++-fast *.so unicorn_mode/24f55a7973278f20f0de21b904851d99d4716263.tar.gz *.8
 	rm -rf out_dir qemu_mode/qemu-3.1.1 unicorn_mode/unicorn
 	$(MAKE) -C llvm_mode clean
 	$(MAKE) -C libdislocator clean
-- 
cgit 1.4.1


From 17bb51756faeaeda6fb17d63ede0a1a9d8ae4b5c Mon Sep 17 00:00:00 2001
From: Andrea Fioraldi <andreafioraldi@gmail.com>
Date: Sun, 22 Sep 2019 19:38:53 +0200
Subject: persistent qemu retaddr offset

---
 qemu_mode/patches/afl-qemu-common.h            | 1 +
 qemu_mode/patches/afl-qemu-cpu-inl.h           | 4 ++++
 qemu_mode/patches/afl-qemu-cpu-translate-inl.h | 2 +-
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/qemu_mode/patches/afl-qemu-common.h b/qemu_mode/patches/afl-qemu-common.h
index 2b7bd51c..e435c62f 100644
--- a/qemu_mode/patches/afl-qemu-common.h
+++ b/qemu_mode/patches/afl-qemu-common.h
@@ -61,6 +61,7 @@ extern target_long    persistent_stack_offset;
 extern unsigned char  persistent_first_pass;
 extern unsigned char  persistent_save_gpr;
 extern target_ulong   persistent_saved_gpr[CPU_NB_REGS];
+extern int            persisent_retaddr_offset;
 
 extern __thread abi_ulong afl_prev_loc;
 
diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h
index ee7d12e0..cfea04d6 100644
--- a/qemu_mode/patches/afl-qemu-cpu-inl.h
+++ b/qemu_mode/patches/afl-qemu-cpu-inl.h
@@ -90,6 +90,7 @@ target_long   persistent_stack_offset;
 unsigned char persistent_first_pass;
 unsigned char persistent_save_gpr;
 target_ulong  persistent_saved_gpr[CPU_NB_REGS];
+int           persisent_retaddr_offset;
 
 /* Instrumentation ratio: */
 
@@ -218,6 +219,9 @@ static void afl_setup(void) {
   
   if (getenv("AFL_QEMU_PERSISTENT_GPR"))
     persistent_save_gpr = 1;
+  
+  if (getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"))
+    persisent_retaddr_offset = strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 16);
 
   if (getenv("AFL_QEMU_PERSISTENT_CNT"))
     afl_persistent_cnt = strtoll(getenv("AFL_QEMU_PERSISTENT_CNT"), NULL, 16);
diff --git a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h
index 48b11c64..126cf255 100644
--- a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h
+++ b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h
@@ -195,7 +195,7 @@ static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2,
       if (afl_persistent_ret_addr == 0) {                                     \
                                                                               \
         TCGv_ptr paddr = tcg_const_ptr(afl_persistent_addr);                  \
-        tcg_gen_st_tl(paddr, cpu_regs[R_ESP], 0);                             \
+        tcg_gen_st_tl(paddr, cpu_regs[R_ESP], persisent_retaddr_offset);      \
                                                                               \
       }                                                                       \
       tcg_gen_afl_call0(&afl_persistent_loop);                                \
-- 
cgit 1.4.1


From ff1f6af7e900ab4d76c91b9f2f4a60da259cd91d Mon Sep 17 00:00:00 2001
From: Andrea Fioraldi <andreafioraldi@gmail.com>
Date: Sun, 22 Sep 2019 20:01:44 +0200
Subject: wine mode && fix llvm makefile

---
 Makefile                            |   3 ++-
 afl-wine-trace                      |  12 +++++++++---
 llvm_mode/Makefile                  |   2 +-
 qemu_mode/build_qemu_support.sh     |   2 ++
 qemu_mode/libcompcov/compcovtest    | Bin 8624 -> 0 bytes
 qemu_mode/unsigaction/Makefile      |  34 ++++++++++++++++++++++++++++++++++
 qemu_mode/unsigaction/README.md     |   7 +++++++
 qemu_mode/unsigaction/unsigaction.c |   3 +++
 8 files changed, 58 insertions(+), 5 deletions(-)
 delete mode 100755 qemu_mode/libcompcov/compcovtest
 create mode 100644 qemu_mode/unsigaction/Makefile
 create mode 100644 qemu_mode/unsigaction/README.md
 create mode 100644 qemu_mode/unsigaction/unsigaction.c

diff --git a/Makefile b/Makefile
index a6154561..42c6d737 100644
--- a/Makefile
+++ b/Makefile
@@ -228,11 +228,12 @@ all_done: test_build
 .NOTPARALLEL: clean
 
 clean:
-	rm -f $(PROGS) afl-as as afl-g++ afl-clang afl-clang++ *.o src/*.o *~ a.out core core.[1-9][0-9]* *.stackdump test .test .test1 .test2 test-instr .test-instr0 .test-instr1 qemu_mode/qemu-3.1.1.tar.xz afl-qemu-trace afl-gcc-fast afl-gcc-pass.so afl-gcc-rt.o afl-g++-fast *.so unicorn_mode/24f55a7973278f20f0de21b904851d99d4716263.tar.gz *.8
+	rm -f $(PROGS) afl-as as afl-g++ afl-clang afl-clang++ *.o src/*.o *~ a.out core core.[1-9][0-9]* *.stackdump .test .test1 .test2 test-instr .test-instr0 .test-instr1 qemu_mode/qemu-3.1.1.tar.xz afl-qemu-trace afl-gcc-fast afl-gcc-pass.so afl-gcc-rt.o afl-g++-fast *.so unicorn_mode/24f55a7973278f20f0de21b904851d99d4716263.tar.gz *.8
 	rm -rf out_dir qemu_mode/qemu-3.1.1 unicorn_mode/unicorn
 	$(MAKE) -C llvm_mode clean
 	$(MAKE) -C libdislocator clean
 	$(MAKE) -C libtokencap clean
+	$(MAKE) -C qemu_mode/unsigaction clean
 	$(MAKE) -C qemu_mode/libcompcov clean
 
 distrib: all
diff --git a/afl-wine-trace b/afl-wine-trace
index fa552051..f8284d7e 100755
--- a/afl-wine-trace
+++ b/afl-wine-trace
@@ -18,13 +18,19 @@ os.environ["WINELOADERNOEXEC"] = "1"
 
 pe = pefile.PE(sys.argv[1])
 
-os.environ["AFL_ENTRYPOINT"] = "0x%x" % (pe.OPTIONAL_HEADER.ImageBase + pe.OPTIONAL_HEADER.AddressOfEntryPoint)
+if "AFL_ENTRYPOINT" not in os.environ:
+    os.environ["AFL_ENTRYPOINT"] = "0x%x" % (pe.OPTIONAL_HEADER.ImageBase + pe.OPTIONAL_HEADER.AddressOfEntryPoint)
 if not os.getenv("AFL_INST_LIBS"):
     if "AFL_CODE_START" not in os.environ:
         os.environ["AFL_CODE_START"] = "0x%x" % (pe.OPTIONAL_HEADER.ImageBase + pe.OPTIONAL_HEADER.BaseOfCode)
     if "AFL_CODE_END" not in os.environ:
         os.environ["AFL_CODE_END"] = "0x%x" % (pe.OPTIONAL_HEADER.ImageBase + pe.OPTIONAL_HEADER.BaseOfCode + pe.OPTIONAL_HEADER.SizeOfCode)
 
+if pe.FILE_HEADER.Machine == pefile.MACHINE_TYPE["IMAGE_FILE_MACHINE_AMD64"] or pe.FILE_HEADER.Machine == pefile.MACHINE_TYPE["IMAGE_FILE_MACHINE_IA64"]:
+    os.environ["LD_PRELOAD"] = os.path.join(my_dir, "qemu_mode/unsigaction/unsigaction64.so")
+else:
+    os.environ["LD_PRELOAD"] = os.path.join(my_dir, "qemu_mode/unsigaction/unsigaction32.so")
+
 if os.getenv("WINECOV_QEMU_PATH"):
     qemu_path = os.getenv("WINECOV_QEMU_PATH")
 elif os.path.exists(os.path.join(my_dir, "afl-qemu-trace")):
@@ -36,7 +42,7 @@ else:
     elif pe.FILE_HEADER.Machine == pefile.MACHINE_TYPE["IMAGE_FILE_MACHINE_I386"]:
         qemu_path += "i386"
     else:
-        print ("[afl-wine-trace] unsupported architecture\n")
+        print ("[wine-cov] unsuppoted architecture\n")
         exit(1)
     qemu_path = shutil.which(qemu_path)
 
@@ -49,7 +55,7 @@ else:
     elif pe.FILE_HEADER.Machine == pefile.MACHINE_TYPE["IMAGE_FILE_MACHINE_I386"]:
         pass
     else:
-        print ("[wine-cov] unsuppoted architecture\n")
+        print ("[afl-wine-trace] unsopported architecture\n")
         exit(1)
 
 os.execve(qemu_path, [qemu_path, wine_path] + sys.argv[1:], os.environ)
diff --git a/llvm_mode/Makefile b/llvm_mode/Makefile
index 2d35505e..96aba898 100644
--- a/llvm_mode/Makefile
+++ b/llvm_mode/Makefile
@@ -83,7 +83,7 @@ CXX        = $(LLVM_BINDIR)/clang++
 
 ifeq "$(shell test -e $(CC) || echo 1 )" "1"
   # llvm-config --bindir is not providing a valid path, so ...
-  ifeq "$(shell test -e "$(BIN_DIR)/clang" && echo 1)" "1"
+  ifeq "$(shell test -e '$(BIN_DIR)/clang' && echo 1)" "1"
     # we found one in the local install directory, lets use these
     CC         = $(BIN_DIR)/clang
     CXX        = $(BIN_DIR)/clang++
diff --git a/qemu_mode/build_qemu_support.sh b/qemu_mode/build_qemu_support.sh
index 0ca3f494..02379eb2 100755
--- a/qemu_mode/build_qemu_support.sh
+++ b/qemu_mode/build_qemu_support.sh
@@ -212,6 +212,8 @@ fi
 
 echo "[+] Building libcompcov ..."
 make -C libcompcov
+echo "[+] Building unsigaction ..."
+make -C unsigaction
 echo "[+] libcompcov ready"
 echo "[+] All done for qemu_mode, enjoy!"
 
diff --git a/qemu_mode/libcompcov/compcovtest b/qemu_mode/libcompcov/compcovtest
deleted file mode 100755
index 0bb68d60..00000000
Binary files a/qemu_mode/libcompcov/compcovtest and /dev/null differ
diff --git a/qemu_mode/unsigaction/Makefile b/qemu_mode/unsigaction/Makefile
new file mode 100644
index 00000000..9aa96330
--- /dev/null
+++ b/qemu_mode/unsigaction/Makefile
@@ -0,0 +1,34 @@
+#
+# american fuzzy lop - unsigaction
+# --------------------------------
+#
+# Written by Andrea Fioraldi <andreafioraldi@gmail.com>
+#
+# Copyright 2019 Andrea Fioraldi. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+
+ifndef AFL_NO_X86
+
+all: lib_i386 lib_amd64
+
+lib_i386:
+	$(CC) -m32 -fPIC -shared unsigaction.c -o unsigaction32.so
+
+lib_amd64:
+	$(CC) -fPIC -shared unsigaction.c -o unsigaction64.so
+
+clean:
+	rm -f unsigaction32.so unsigaction64.so
+
+else
+
+all:
+	@echo "[!] Note: skipping compilation of unsigaction (AFL_NO_X86 set)."
+
+endif
diff --git a/qemu_mode/unsigaction/README.md b/qemu_mode/unsigaction/README.md
new file mode 100644
index 00000000..0f3707fd
--- /dev/null
+++ b/qemu_mode/unsigaction/README.md
@@ -0,0 +1,7 @@
+# unsigation
+
+This library disable sigaction when preloaded.
+
+Mainly needed by Wine mode but can be used as a separate tool.
+
+A similar solution can be found in is [preeny](https://github.com/zardus/preeny).
diff --git a/qemu_mode/unsigaction/unsigaction.c b/qemu_mode/unsigaction/unsigaction.c
new file mode 100644
index 00000000..004084f9
--- /dev/null
+++ b/qemu_mode/unsigaction/unsigaction.c
@@ -0,0 +1,3 @@
+int sigaction(int signum, void *act, void *oldact) {
+  return 0;
+}
-- 
cgit 1.4.1


From 897fb9c2e407304f4015482f4fb27896b6fbe0b7 Mon Sep 17 00:00:00 2001
From: Andrea Fioraldi <andreafioraldi@gmail.com>
Date: Sun, 22 Sep 2019 20:24:13 +0200
Subject: binary readme

---
 README.md           |  2 ++
 qemu_mode/README.md | 63 ++++++++++++++++++++++++++++++++++++-----------------
 2 files changed, 45 insertions(+), 20 deletions(-)

diff --git a/README.md b/README.md
index b1a04611..71c626fe 100644
--- a/README.md
+++ b/README.md
@@ -45,6 +45,8 @@
   * NeverZero patch for afl-gcc, llvm_mode, qemu_mode and unicorn_mode which prevents a wrapping map value to zero, increases coverage
   
   * Persistent mode and deferred forkserver for qemu_mode
+  
+  * Win32 PE binary-only fuzzing with QEMU and Wine
 
   A more thorough list is available in the PATCHES file.
 
diff --git a/qemu_mode/README.md b/qemu_mode/README.md
index 54fbf874..7bce2a05 100644
--- a/qemu_mode/README.md
+++ b/qemu_mode/README.md
@@ -44,25 +44,19 @@ Note: if you want the QEMU helper to be installed on your system for all
 users, you need to build it before issuing 'make install' in the parent
 directory.
 
-## 3) Options
+## 3) Bonus feature #1: deferred initialization
 
-There is ./libcompcov/ which implements laf-intel (splitting memcmp,
-strncmp, etc. to make these conditions easier solvable by afl-fuzz).
-Highly recommended.
+As for LLVM mode (referes to its README for mode details) QEMU mode support
+the deferred initialization.
 
-The option that enables QEMU CompareCoverage is AFL_COMPCOV_LEVEL.
-AFL_COMPCOV_LEVEL=1 is to instrument comparisons with only immediate
-values / read-only memory. AFL_COMPCOV_LEVEL=2 instruments all
-comparison instructions and memory comparison functions when libcompcov
-is preloaded. Comparison instructions are currently instrumented only
-on the x86 and x86_64 targets.
-
-Another option is the environment variable AFL_ENTRYPOINT which allows
-move the forkserver to a different part, e.g. just before the file is
+This can be enabled setting the environment variable AFL_ENTRYPOINT which allows
+to move the forkserver to a different part, e.g. just before the file is
 opened (e.g. way after command line parsing and config file loading, etc)
 which can be a huge speed improvement. Note that the specified address
 must be an address of a basic block.
 
+## 4) Bonus feature #2: persistent mode
+
 QEMU mode support also persistent mode for x86 and x86_64 targets.
 The environment variable to enable it is AFL_QEMU_PERSISTENT_ADDR=`start addr`.
 In this variable you must specify the address of the function that
@@ -78,11 +72,40 @@ Note that the format of the addresses in such variables is hex.
 
 Note that the base address of PIE binaries in QEMU user is 0x4000000000.
 
-Warning: in x86_64 parameters are passed via registers and so the target
-function of persistent mode cannot make use of arguments. An option to restore
-the state of each GPR each iteration of the loop is planned.
+With the env variable AFL_QEMU_PERSISTENT_GPR you can tell QEMU to save the original
+value of general purpose registers and restore them ech cycle.
+This allow to use as persistent loop functions that make use of arguments on 
+x86_64.
+
+With AFL_QEMU_PERSISTENT_RETADDR_OFFSET you can specify the offset from the stack pointer in which
+QEME can find the return address when `start addr` is hitted.
+
+Use this mode with caution, problably will not work at first shot.
+
+## 5) Bonus feature #3: CompareCoverage
+
+CompareCoverage is a sub-instrumentation with effects similar to laf-intel.
+
+The option that enables QEMU CompareCoverage is AFL_COMPCOV_LEVEL.
+There is also ./libcompcov/ which implements CompareCoverage for *cmp functions
+(splitting memcmp, strncmp, etc. to make these conditions easier solvable by afl-fuzz).
+AFL_COMPCOV_LEVEL=1 is to instrument comparisons with only immediate
+values / read-only memory. AFL_COMPCOV_LEVEL=2 instruments all
+comparison instructions and memory comparison functions when libcompcov
+is preloaded. Comparison instructions are currently instrumented only
+on the x86 and x86_64 targets.
+
+Highly recommended.
+
+## 6) Bonus feature #3: Wine mode
+
+AFL++ QEMU can use Wine to fuzz WIn32 PE binaries. Use the -W flag of afl-fuzz.
+
+Note that some binaries require user interaction with GUI and must be patched.
+
+For examples look [here](https://github.com/andreafioraldi/WineAFLplusplusDEMO).
 
-## 4) Notes on linking
+## 7) Notes on linking
 
 The feature is supported only on Linux. Supporting BSD may amount to porting
 the changes made to linux-user/elfload.c and applying them to
@@ -103,7 +126,7 @@ practice, this means two things:
 Setting AFL_INST_LIBS=1 can be used to circumvent the .text detection logic
 and instrument every basic block encountered.
 
-## 5) Benchmarking
+## 8) Benchmarking
 
 If you want to compare the performance of the QEMU instrumentation with that of
 afl-gcc compiled code against the same target, you need to build the
@@ -118,7 +141,7 @@ Comparative measurements of execution speed or instrumentation coverage will be
 fairly meaningless if the optimization levels or instrumentation scopes don't
 match.
 
-## 6) Gotchas, feedback, bugs
+## 9) Gotchas, feedback, bugs
 
 If you need to fix up checksums or do other cleanup on mutated test cases, see
 experimental/post_library/ for a viable solution.
@@ -139,7 +162,7 @@ with -march=core2, can help.
 Beyond that, this is an early-stage mechanism, so fields reports are welcome.
 You can send them to <afl-users@googlegroups.com>.
 
-## 7) Alternatives: static rewriting
+## 10) Alternatives: static rewriting
 
 Statically rewriting binaries just once, instead of attempting to translate
 them at run time, can be a faster alternative. That said, static rewriting is
-- 
cgit 1.4.1


From 74ef58e310d8f24596380fdb906b9fec41a7446a Mon Sep 17 00:00:00 2001
From: Andrea Fioraldi <andreafioraldi@gmail.com>
Date: Sun, 22 Sep 2019 21:51:11 +0200
Subject: readme binary only

---
 qemu_mode/README.md | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/qemu_mode/README.md b/qemu_mode/README.md
index 7bce2a05..b994e4c6 100644
--- a/qemu_mode/README.md
+++ b/qemu_mode/README.md
@@ -19,7 +19,7 @@ Andrea Fioraldi. Special thanks to abiondo that re-enabled TCG chaining.
 
 ## 2) How to use
 
-The feature is implemented with a patch to QEMU 3.1.0. The simplest way
+The feature is implemented with a patch to QEMU 3.1.1. The simplest way
 to build it is to run ./build_qemu_support.sh. The script will download,
 configure, and compile the QEMU binary for you.
 
@@ -72,13 +72,14 @@ Note that the format of the addresses in such variables is hex.
 
 Note that the base address of PIE binaries in QEMU user is 0x4000000000.
 
-With the env variable AFL_QEMU_PERSISTENT_GPR you can tell QEMU to save the original
-value of general purpose registers and restore them ech cycle.
+With the env variable AFL_QEMU_PERSISTENT_GPR you can tell QEMU to save the
+original value of general purpose registers and restore them ech cycle.
 This allow to use as persistent loop functions that make use of arguments on 
 x86_64.
 
-With AFL_QEMU_PERSISTENT_RETADDR_OFFSET you can specify the offset from the stack pointer in which
-QEME can find the return address when `start addr` is hitted.
+With AFL_QEMU_PERSISTENT_RETADDR_OFFSET you can specify the offset from the
+stack pointer in which QEME can find the return address when `start addr` is
+hitted.
 
 Use this mode with caution, problably will not work at first shot.
 
@@ -88,7 +89,8 @@ CompareCoverage is a sub-instrumentation with effects similar to laf-intel.
 
 The option that enables QEMU CompareCoverage is AFL_COMPCOV_LEVEL.
 There is also ./libcompcov/ which implements CompareCoverage for *cmp functions
-(splitting memcmp, strncmp, etc. to make these conditions easier solvable by afl-fuzz).
+(splitting memcmp, strncmp, etc. to make these conditions easier solvable by
+afl-fuzz).
 AFL_COMPCOV_LEVEL=1 is to instrument comparisons with only immediate
 values / read-only memory. AFL_COMPCOV_LEVEL=2 instruments all
 comparison instructions and memory comparison functions when libcompcov
-- 
cgit 1.4.1


From 7cdd0abfd5e29dc6e43bde55eb15e942fb2895d8 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 23 Sep 2019 11:06:41 +0200
Subject: doc update

---
 README.md      | 3 ++-
 docs/ChangeLog | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 71c626fe..ec027f48 100644
--- a/README.md
+++ b/README.md
@@ -53,10 +53,11 @@
   | Feature/Instrumentation | LLVM | GCC | QEMU | Unicorn |
   | ----------------------- |:----:|:---:|:----:| -------:|
   | laf-intel / CompCov     |  x   |     |  x   |    x    |
-  | NeverZero               |  x   |  x  |  x   |    x    |
+  | NeverZero               |  x(1)|  x  |  x   |    x    |
   | Persistent mode         |  x   |     |  x   |         |
   | Whitelist               |  x   |     |      |         |
   | InsTrim                 |  x   |     |      |         |
+  (1) only in LLVM >= 9.0 due to a bug in llvm in previous versions
 
   So all in all this is the best-of AFL that is currently out there :-)
 
diff --git a/docs/ChangeLog b/docs/ChangeLog
index 0f5bb99c..0b945d36 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -20,6 +20,7 @@ Version ++2.54d (dev):
   - persistent mode for QEMU (see qemu_mode/README.md)
   - custom mutator library is now a standard mutator, to exclusivly use it
     add AFL_CUSTOM_MUTATOR_ONLY (that will trigger the previous behaviour)
+  - new library qemu_mode/unsigaction which filters sigaction events
   - no more unlinking the input file, this way the input file can also be a
     FIFO or disk partition
   - setting LLVM_CONFIG for llvm_mode will now again switch to the selected
-- 
cgit 1.4.1


From 96c9fa0ccc4cc9b3db3e448fd685484fd271ca98 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 23 Sep 2019 11:07:28 +0200
Subject: doc update

---
 README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/README.md b/README.md
index ec027f48..8c8e74e9 100644
--- a/README.md
+++ b/README.md
@@ -57,8 +57,10 @@
   | Persistent mode         |  x   |     |  x   |         |
   | Whitelist               |  x   |     |      |         |
   | InsTrim                 |  x   |     |      |         |
+
   (1) only in LLVM >= 9.0 due to a bug in llvm in previous versions
 
+
   So all in all this is the best-of AFL that is currently out there :-)
 
   For new versions and additional information, check out:
-- 
cgit 1.4.1