From 396157dedae2049f830c49eb81ef9617275333ee Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Fri, 5 May 2023 13:52:54 +0200
Subject: tritondse custom mutator attempt

---
 custom_mutators/aflpp_tritondse/README.md          |  17 ++++
 custom_mutators/aflpp_tritondse/aflpp_tritondse.py | 106 +++++++++++++++++++++
 2 files changed, 123 insertions(+)
 create mode 100644 custom_mutators/aflpp_tritondse/README.md
 create mode 100644 custom_mutators/aflpp_tritondse/aflpp_tritondse.py

(limited to 'custom_mutators')

diff --git a/custom_mutators/aflpp_tritondse/README.md b/custom_mutators/aflpp_tritondse/README.md
new file mode 100644
index 00000000..8a5dd02b
--- /dev/null
+++ b/custom_mutators/aflpp_tritondse/README.md
@@ -0,0 +1,17 @@
+# An AFL++ custom mutator using TritonDSE
+
+## Installing the requirements
+
+`pip3 install tritondse`
+
+## How to run with an example
+
+```
+../../afl-cc -o ../../test-instr ../../test-instr.c
+mkdir -p in
+echo aaaa > in/in
+TRITON_DSE_TARGET=../../test-instr AFL_CUSTOM_MUTATOR_ONLY=1 AFL_SYNC_TIME=1 AFL_PYTHON_MODULE=aflpp_tritondse PYTHONPATH=. ../../afl-fuzz -i in -o out -- ../../test-instr
+```
+
+Note that this custom mutator works differently, new finds are synced
+after 10-60 seconds to the fuzzing instance.
diff --git a/custom_mutators/aflpp_tritondse/aflpp_tritondse.py b/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
new file mode 100644
index 00000000..33bf8a9f
--- /dev/null
+++ b/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
@@ -0,0 +1,106 @@
+import sys
+import os
+import logging
+
+from tritondse import Config
+from tritondse import CoverageStrategy
+from tritondse import ProcessState
+from tritondse import Program
+from tritondse import Seed
+from tritondse import SeedFormat
+from tritondse import SymbolicExecutor
+from tritondse import SymbolicExplorator
+
+
+#logging.basicConfig(level=logging.INFO)
+
+is_debug = False
+out_path = "out/tritondse/queue"
+input_file = None
+prog = None
+config = None
+dse = None
+cycle = 0
+count = 0
+hashes = set()
+
+def pre_exec_hook(se: SymbolicExecutor, state: ProcessState):
+    #logging.info(f"[PRE-EXEC] Processing seed: {se.seed.hash}, \
+    #                ({repr(se.seed.content)})")
+    global count
+    global hasshes
+    if se.seed.hash not in hashes:
+        hashes.add(se.seed.hash)
+        filename = out_path + "/id:" + f"{count:06}" + "," + se.seed.hash
+        if not os.path.exists(filename):
+            with open(filename, 'wb') as file:
+                file.write(se.seed.content)
+                count += 1
+    if input_file:
+        with open(input_file, 'wb') as file:
+            file.write(se.seed.content)
+
+
+def init(seed):
+    global prog
+    global config
+    global dse
+    global input_file
+    global is_debug
+    # Load the program (LIEF-based program loader).
+    prog = Program(os.environ['TRITON_DSE_TARGET'])
+    # Set the configuration.
+    argv = None
+    try:
+        foo = os.environ['AFL_DEBUG']
+        is_debug = True
+    except KeyError:
+        pass
+    try:
+        argv_list = os.environ['TRITON_DSE_TARGET_ARGV']
+        argv = argv_list.split()
+    except KeyError:
+        pass
+    try:
+        foo = os.environ['TRITON_DSE_TARGET_INPUT']
+        input_file = foo
+    except KeyError:
+        pass
+    config = Config(coverage_strategy = CoverageStrategy.PATH,
+                    debug = is_debug,
+                    pipe_stdout = is_debug,
+                    pipe_stderr = is_debug,
+                    execution_timeout = 1,
+                    program_argv = argv,
+                    smt_timeout= 50,
+                    seed_format = SeedFormat.RAW)
+    # Create an instance of the Symbolic Explorator
+    dse = SymbolicExplorator(config, prog)
+    # Add callbacks.
+    dse.callback_manager.register_pre_execution_callback(pre_exec_hook)
+    # Create the output directory
+    os.makedirs(out_path, exist_ok=True)
+
+
+#def fuzz(buf, add_buf, max_size):
+#    return b""
+
+
+def queue_new_entry(filename_new_queue, filename_orig_queue):
+    global dse
+    global cycle
+    # Add seed to the worklist.
+    with open(filename_new_queue, "rb") as file:
+        seed = file.read()
+    seed = Seed(seed)
+    dse.add_input_seed(seed)
+    if is_debug:
+        print("NEW FILE " + filename_new_queue + " count " + str(cycle))
+        cycle += 1
+    # Start exploration!
+    #dse.step()
+    dse.explore()
+    pass
+
+def splice_optout():
+    pass
-- 
cgit 1.4.1


From f585f262669c14d8b7037d4a34eaa9eb7aef38c5 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Fri, 5 May 2023 14:04:53 +0200
Subject: tritondse fixes

---
 custom_mutators/aflpp_tritondse/aflpp_tritondse.py | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

(limited to 'custom_mutators')

diff --git a/custom_mutators/aflpp_tritondse/aflpp_tritondse.py b/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
index 33bf8a9f..49f67d75 100644
--- a/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
+++ b/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
@@ -1,6 +1,7 @@
 import sys
 import os
 import logging
+import hashlib
 
 from tritondse import Config
 from tritondse import CoverageStrategy
@@ -92,14 +93,17 @@ def queue_new_entry(filename_new_queue, filename_orig_queue):
     # Add seed to the worklist.
     with open(filename_new_queue, "rb") as file:
         seed = file.read()
-    seed = Seed(seed)
-    dse.add_input_seed(seed)
-    if is_debug:
-        print("NEW FILE " + filename_new_queue + " count " + str(cycle))
-        cycle += 1
-    # Start exploration!
-    #dse.step()
-    dse.explore()
+    hash = hashlib.md5(seed).hexdigest()
+    if hash not in hashes:
+        hashes.add(hash)
+        if is_debug:
+            print("NEW FILE " + filename_new_queue + " hash " + hash + " count " + str(cycle))
+            cycle += 1
+        seed = Seed(seed)
+        dse.add_input_seed(seed)
+        # Start exploration!
+        #dse.step()
+        dse.explore()
     pass
 
 def splice_optout():
-- 
cgit 1.4.1


From 70da0c2e405102dc044cb4bed0f4f1e847c90d0b Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 10 May 2023 16:09:18 +0200
Subject: better tritondse support

---
 custom_mutators/aflpp_tritondse/aflpp_tritondse.py | 54 ++++++++++---
 docs/custom_mutators.md                            | 28 +++++++
 include/envs.h                                     |  4 +
 src/afl-fuzz.c                                     | 91 ++++++++++++++++------
 4 files changed, 145 insertions(+), 32 deletions(-)

(limited to 'custom_mutators')

diff --git a/custom_mutators/aflpp_tritondse/aflpp_tritondse.py b/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
index 49f67d75..9584b368 100644
--- a/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
+++ b/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
@@ -7,6 +7,7 @@ from tritondse import Config
 from tritondse import CoverageStrategy
 from tritondse import ProcessState
 from tritondse import Program
+from tritondse import CleLoader
 from tritondse import Seed
 from tritondse import SeedFormat
 from tritondse import SymbolicExecutor
@@ -16,7 +17,7 @@ from tritondse import SymbolicExplorator
 #logging.basicConfig(level=logging.INFO)
 
 is_debug = False
-out_path = "out/tritondse/queue"
+out_path = ""
 input_file = None
 prog = None
 config = None
@@ -29,28 +30,38 @@ def pre_exec_hook(se: SymbolicExecutor, state: ProcessState):
     #logging.info(f"[PRE-EXEC] Processing seed: {se.seed.hash}, \
     #                ({repr(se.seed.content)})")
     global count
-    global hasshes
+    global hashes
+    print('DEBUG - prehook')
     if se.seed.hash not in hashes:
         hashes.add(se.seed.hash)
         filename = out_path + "/id:" + f"{count:06}" + "," + se.seed.hash
         if not os.path.exists(filename):
+            if is_debug:
+                print('Creating queue input ' + filename)
             with open(filename, 'wb') as file:
                 file.write(se.seed.content)
                 count += 1
+    else:
+        print('has hash: ' + se.seed.hash)
     if input_file:
+        if is_debug:
+            print('Writing to ' + input_file + ' the content: ' + str(se.seed.content))
         with open(input_file, 'wb') as file:
             file.write(se.seed.content)
+    else:
+        print('no input!')
 
 
 def init(seed):
     global prog
     global config
     global dse
+    global out_path
     global input_file
     global is_debug
     # Load the program (LIEF-based program loader).
-    prog = Program(os.environ['TRITON_DSE_TARGET'])
-    # Set the configuration.
+    prog = CleLoader(os.environ['AFL_CUSTOM_INFO_PROGRAM'])
+    # Process other configuration environment variables.
     argv = None
     try:
         foo = os.environ['AFL_DEBUG']
@@ -58,15 +69,42 @@ def init(seed):
     except KeyError:
         pass
     try:
-        argv_list = os.environ['TRITON_DSE_TARGET_ARGV']
-        argv = argv_list.split()
+        foo = os.environ['AFL_CUSTOM_INFO_OUT']
+        out_path = foo + '/../tritondse/queue'
     except KeyError:
         pass
     try:
-        foo = os.environ['TRITON_DSE_TARGET_INPUT']
+        foo = os.environ['AFL_CUSTOM_INFO_PROGRAM_INPUT']
         input_file = foo
     except KeyError:
         pass
+    try:
+        argv_list = os.environ['AFL_CUSTOM_INFO_PROGRAM_ARGV']
+        argv_tmp = [ os.environ['AFL_CUSTOM_INFO_PROGRAM'] ]
+        argv_tmp += argv_list.split()
+        argv = []
+        # now check for @@
+        for item in argv_tmp:
+            if "@@" in item:
+                input_file = out_path + '/../.input'
+                argv.append(input_file)
+            else:
+                argv.append(item)
+    except KeyError:
+        pass
+    # Create the output directory
+    os.makedirs(out_path, exist_ok=True)
+    # Debug
+    if is_debug:
+        print('DEBUG target: ' + os.environ['AFL_CUSTOM_INFO_PROGRAM'])
+        if argv:
+            print('DEBUG argv: ')
+            print(argv)
+        if input_file:
+            print('DEBUG input_file: ' + input_file)
+        print('DEBUG out_path: ' + out_path)
+        print('')
+    # Now set up TritonDSE
     config = Config(coverage_strategy = CoverageStrategy.PATH,
                     debug = is_debug,
                     pipe_stdout = is_debug,
@@ -79,8 +117,6 @@ def init(seed):
     dse = SymbolicExplorator(config, prog)
     # Add callbacks.
     dse.callback_manager.register_pre_execution_callback(pre_exec_hook)
-    # Create the output directory
-    os.makedirs(out_path, exist_ok=True)
 
 
 #def fuzz(buf, add_buf, max_size):
diff --git a/docs/custom_mutators.md b/docs/custom_mutators.md
index a1de479e..3f7e9e6e 100644
--- a/docs/custom_mutators.md
+++ b/docs/custom_mutators.md
@@ -304,6 +304,34 @@ Note: for some distributions, you might also need the package `python[3]-apt`.
 In case your setup is different, set the necessary variables like this:
 `PYTHON_INCLUDE=/path/to/python/include LDFLAGS=-L/path/to/python/lib make`.
 
+### Helpers
+
+For C/C++ custom mutators you get a pointer to `afl_state_t *afl` in the
+`afl_custom_init()` which contains all information that you need.
+Note that if you access it, you need to recompile your custom mutator if
+you update AFL++ because the structure might have changed!
+
+For mutators written in Python, Rust, GO, etc. there are a few environment
+variables set to help you to get started:
+
+`AFL_CUSTOM_INFO_PROGRAM` - the program name of the target that is executed.
+If your custom mutator is used with modes like Qemu (`-Q`), this will still
+contain the target program, not afl-qemu-trace.
+
+`AFL_CUSTOM_INFO_PROGRAM_INPUT` - if the `-f` parameter is used with afl-fuzz
+then this value is found in this environment variable.
+
+`AFL_CUSTOM_INFO_PROGRAM_ARGV` - this contains the parameters given to the
+target program and still has the `@@` identifier in there.
+
+Note: If `AFL_CUSTOM_INFO_PROGRAM_INPUT` is empty and `AFL_CUSTOM_INFO_PROGRAM_ARGV`
+is either empty or does not contain `@@` then the target gets the input via
+`stdin`.
+
+`AFL_CUSTOM_INFO_OUT` - This is the output directory for this fuzzer instance,
+so if `afl-fuzz` was called with `-o out -S foobar`, then this will be set to
+`out/foobar`.
+
 ### Custom Mutator Preparation
 
 For C/C++ mutators, the source code must be compiled as a shared object:
diff --git a/include/envs.h b/include/envs.h
index fe5ee0e3..edfd06e4 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -37,6 +37,10 @@ static char *afl_environment_variables[] = {
     "AFL_CRASH_EXITCODE",
     "AFL_CUSTOM_MUTATOR_LIBRARY",
     "AFL_CUSTOM_MUTATOR_ONLY",
+    "AFL_CUSTOM_INFO_PROGRAM",
+    "AFL_CUSTOM_INFO_PROGRAM_ARGV",
+    "AFL_CUSTOM_INFO_PROGRAM_INPUT",
+    "AFL_CUSTOM_INFO_OUT",
     "AFL_CXX",
     "AFL_CYCLE_SCHEDULES",
     "AFL_DEBUG",
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index f982258f..4339ddd2 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1530,29 +1530,6 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
-  if (afl->limit_time_sig > 0 && afl->custom_mutators_count) {
-
-    if (afl->custom_only) {
-
-      FATAL("Custom mutators are incompatible with MOpt (-L)");
-
-    }
-
-    u32 custom_fuzz = 0;
-    LIST_FOREACH(&afl->custom_mutator_list, struct custom_mutator, {
-
-      if (el->afl_custom_fuzz) { custom_fuzz = 1; }
-
-    });
-
-    if (custom_fuzz) {
-
-      WARNF("afl_custom_fuzz is incompatible with MOpt (-L)");
-
-    }
-
-  }
-
   if (afl->afl_env.afl_max_det_extras) {
 
     s32 max_det_extras = atoi(afl->afl_env.afl_max_det_extras);
@@ -1827,8 +1804,76 @@ int main(int argc, char **argv_orig, char **envp) {
     printf("DEBUG: rand %06d is %u\n", counter, rand_below(afl, 65536));
   #endif
 
+  if (!getenv("AFL_CUSTOM_INFO_PROGRAM")) {
+
+    setenv("AFL_CUSTOM_INFO_PROGRAM", argv[optind], 1);
+
+  }
+
+  if (!getenv("AFL_CUSTOM_INFO_PROGRAM_INPUT") && afl->fsrv.out_file) {
+
+    setenv("AFL_CUSTOM_INFO_PROGRAM_INPUT", afl->fsrv.out_file, 1);
+
+  }
+
+  {
+
+    u8 envbuf[8096] = "", tmpbuf[8096] = "";
+    for (s32 i = optind + 1; i < argc; ++i) {
+
+      strcpy(tmpbuf, envbuf);
+      if (strchr(argv[i], ' ') && !strchr(argv[i], '"') &&
+          !strchr(argv[i], '\'')) {
+
+        if (!strchr(argv[i], '\'')) {
+
+          snprintf(envbuf, sizeof(tmpbuf), "%s '%s'", tmpbuf, argv[i]);
+
+        } else {
+
+          snprintf(envbuf, sizeof(tmpbuf), "%s \"%s\"", tmpbuf, argv[i]);
+
+        }
+
+      } else {
+
+        snprintf(envbuf, sizeof(tmpbuf), "%s %s", tmpbuf, argv[i]);
+
+      }
+
+    }
+
+    setenv("AFL_CUSTOM_INFO_PROGRAM_ARGV", envbuf + 1, 1);
+
+  }
+
+  setenv("AFL_CUSTOM_INFO_OUT", afl->out_dir, 1);  // same as __AFL_OUT_DIR
+
   setup_custom_mutators(afl);
 
+  if (afl->limit_time_sig > 0 && afl->custom_mutators_count) {
+
+    if (afl->custom_only) {
+
+      FATAL("Custom mutators are incompatible with MOpt (-L)");
+
+    }
+
+    u32 custom_fuzz = 0;
+    LIST_FOREACH(&afl->custom_mutator_list, struct custom_mutator, {
+
+      if (el->afl_custom_fuzz) { custom_fuzz = 1; }
+
+    });
+
+    if (custom_fuzz) {
+
+      WARNF("afl_custom_fuzz is incompatible with MOpt (-L)");
+
+    }
+
+  }
+
   write_setup_file(afl, argc, argv);
 
   setup_cmdline_file(afl, argv + optind);
-- 
cgit 1.4.1


From eaf59d5a194f5e5469a86158aeb0e936111ad790 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Thu, 11 May 2023 07:55:17 +0200
Subject: next steps for tritondse

---
 custom_mutators/aflpp_tritondse/aflpp_tritondse.py | 50 +++++++++++-----------
 1 file changed, 26 insertions(+), 24 deletions(-)

(limited to 'custom_mutators')

diff --git a/custom_mutators/aflpp_tritondse/aflpp_tritondse.py b/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
index 9584b368..e0219f0b 100644
--- a/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
+++ b/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
@@ -3,19 +3,17 @@ import os
 import logging
 import hashlib
 
+from tritondse import CleLoader
+from tritondse import CompositeData
 from tritondse import Config
 from tritondse import CoverageStrategy
 from tritondse import ProcessState
 from tritondse import Program
-from tritondse import CleLoader
 from tritondse import Seed
 from tritondse import SeedFormat
 from tritondse import SymbolicExecutor
 from tritondse import SymbolicExplorator
 
-
-#logging.basicConfig(level=logging.INFO)
-
 is_debug = False
 out_path = ""
 input_file = None
@@ -25,13 +23,11 @@ dse = None
 cycle = 0
 count = 0
 hashes = set()
+format = SeedFormat.RAW
 
 def pre_exec_hook(se: SymbolicExecutor, state: ProcessState):
-    #logging.info(f"[PRE-EXEC] Processing seed: {se.seed.hash}, \
-    #                ({repr(se.seed.content)})")
     global count
     global hashes
-    print('DEBUG - prehook')
     if se.seed.hash not in hashes:
         hashes.add(se.seed.hash)
         filename = out_path + "/id:" + f"{count:06}" + "," + se.seed.hash
@@ -39,26 +35,26 @@ def pre_exec_hook(se: SymbolicExecutor, state: ProcessState):
             if is_debug:
                 print('Creating queue input ' + filename)
             with open(filename, 'wb') as file:
-                file.write(se.seed.content)
+                if input_file:
+                    file.write(se.seed.content.files[input_file])
+                else:
+                    file.write(se.seed.content)
                 count += 1
-    else:
-        print('has hash: ' + se.seed.hash)
-    if input_file:
-        if is_debug:
-            print('Writing to ' + input_file + ' the content: ' + str(se.seed.content))
-        with open(input_file, 'wb') as file:
-            file.write(se.seed.content)
-    else:
-        print('no input!')
+    #if input_file:
+    #    if is_debug:
+    #        print('Writing to ' + input_file + ' the content: ' + str(se.seed.content))
+    #    with open(input_file, 'wb') as file:
+    #        file.write(se.seed.content)
 
 
 def init(seed):
-    global prog
     global config
     global dse
-    global out_path
+    global format
     global input_file
     global is_debug
+    global out_path
+    global prog
     # Load the program (LIEF-based program loader).
     prog = CleLoader(os.environ['AFL_CUSTOM_INFO_PROGRAM'])
     # Process other configuration environment variables.
@@ -104,6 +100,8 @@ def init(seed):
             print('DEBUG input_file: ' + input_file)
         print('DEBUG out_path: ' + out_path)
         print('')
+    if input_file:
+        format = SeedFormat.COMPOSITE
     # Now set up TritonDSE
     config = Config(coverage_strategy = CoverageStrategy.PATH,
                     debug = is_debug,
@@ -112,7 +110,7 @@ def init(seed):
                     execution_timeout = 1,
                     program_argv = argv,
                     smt_timeout= 50,
-                    seed_format = SeedFormat.RAW)
+                    seed_format = format)
     # Create an instance of the Symbolic Explorator
     dse = SymbolicExplorator(config, prog)
     # Add callbacks.
@@ -124,18 +122,22 @@ def init(seed):
 
 
 def queue_new_entry(filename_new_queue, filename_orig_queue):
-    global dse
     global cycle
+    global dse
     # Add seed to the worklist.
     with open(filename_new_queue, "rb") as file:
-        seed = file.read()
-    hash = hashlib.md5(seed).hexdigest()
+        data = file.read()
+    hash = hashlib.md5(data).hexdigest()
     if hash not in hashes:
         hashes.add(hash)
         if is_debug:
             print("NEW FILE " + filename_new_queue + " hash " + hash + " count " + str(cycle))
             cycle += 1
-        seed = Seed(seed)
+        if input_file:
+            seed = Seed(CompositeData(files={"stdin": b"", # nothing on stdin
+                                  input_file: data}))
+        else:
+            seed = Seed(data)
         dse.add_input_seed(seed)
         # Start exploration!
         #dse.step()
-- 
cgit 1.4.1


From 1ad63a6a32d966f1ac05ff40163ef7f747011307 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Tue, 16 May 2023 12:20:58 +0200
Subject: fix tritondse

---
 custom_mutators/aflpp_tritondse/aflpp_tritondse.py | 68 +++++++++++++++++++++-
 1 file changed, 65 insertions(+), 3 deletions(-)

(limited to 'custom_mutators')

diff --git a/custom_mutators/aflpp_tritondse/aflpp_tritondse.py b/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
index e0219f0b..48367bc7 100644
--- a/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
+++ b/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
@@ -22,14 +22,17 @@ config = None
 dse = None
 cycle = 0
 count = 0
+finding = 0
 hashes = set()
 format = SeedFormat.RAW
 
 def pre_exec_hook(se: SymbolicExecutor, state: ProcessState):
     global count
     global hashes
+    global finding
     if se.seed.hash not in hashes:
         hashes.add(se.seed.hash)
+        finding = 1
         filename = out_path + "/id:" + f"{count:06}" + "," + se.seed.hash
         if not os.path.exists(filename):
             if is_debug:
@@ -47,6 +50,59 @@ def pre_exec_hook(se: SymbolicExecutor, state: ProcessState):
     #        file.write(se.seed.content)
 
 
+#def rtn_open(se: SymbolicExecutor, pstate: ProcessState, pc):
+#    """
+#    The open behavior.
+#    """
+#    logging.debug('open hooked')
+#
+#    # Get arguments
+#    arg0 = pstate.get_argument_value(0)  # const char *pathname
+#    flags = pstate.get_argument_value(1)  # int flags
+#    mode = pstate.get_argument_value(2)  # int mode
+#    arg0s = pstate.memory.read_string(arg0)
+#
+#    # Concretize the whole path name
+#    pstate.concretize_memory_bytes(arg0, len(arg0s)+1)  # Concretize the whole string + \0
+#
+#    # We use flags as concrete value
+#    pstate.concretize_argument(1)
+#
+#    # Use the flags to open the file in the write mode.
+#    mode = ""
+#    if (flags & 0xFF) == 0x00:   # O_RDONLY
+#        mode = "r"
+#    elif (flags & 0xFF) == 0x01: # O_WRONLY
+#        mode = "w"
+#    elif (flags & 0xFF) == 0x02: # O_RDWR
+#        mode = "r+"
+#
+#    if (flags & 0x0100): # O_CREAT
+#        mode += "x"
+#    if (flags & 0x0200): # O_APPEND
+#        mode = "a"  # replace completely value
+#
+#    if se.seed.is_file_defined(arg0s) and "r" in mode:  # input file and opened in reading
+#        logging.info(f"opening an input file: {arg0s}")
+#        # Program is opening an input
+#        data = se.seed.get_file_input(arg0s)
+#        filedesc = pstate.create_file_descriptor(arg0s, io.BytesIO(data))
+#        fd = filedesc.id
+#    else:
+#        # Try to open it as a regular file
+#        try:
+#            fd = open(arg0s, mode)  # use the mode here
+#            filedesc = pstate.create_file_descriptor(arg0s, fd)
+#            fd = filedesc.id
+#        except Exception as e:
+#            logging.debug(f"Failed to open {arg0s} {e}")
+#            fd = pstate.minus_one
+#
+#    pstate.write_register("rax", fd)  # write the return value
+#    pstate.cpu.program_counter = pstate.pop_stack_value()  # pop the return value
+#    se.skip_instruction()  # skip the current instruction so that the engine go straight fetching the next instruction
+
+
 def init(seed):
     global config
     global dse
@@ -115,10 +171,16 @@ def init(seed):
     dse = SymbolicExplorator(config, prog)
     # Add callbacks.
     dse.callback_manager.register_pre_execution_callback(pre_exec_hook)
+    #dse.callback_manager.register_function_callback("open", rtn_open)
 
 
-#def fuzz(buf, add_buf, max_size):
-#    return b""
+def fuzz(buf, add_buf, max_size):
+    global finding
+    finding = 1
+    while finding == 1:
+      finding = 0
+      dse.step()
+    return b""
 
 
 def queue_new_entry(filename_new_queue, filename_orig_queue):
@@ -141,7 +203,7 @@ def queue_new_entry(filename_new_queue, filename_orig_queue):
         dse.add_input_seed(seed)
         # Start exploration!
         #dse.step()
-        dse.explore()
+        #dse.explore()
     pass
 
 def splice_optout():
-- 
cgit 1.4.1


From 49997e60cba8dc260d45cc0ce68fa810588e2f23 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Tue, 16 May 2023 12:33:58 +0200
Subject: fix

---
 custom_mutators/aflpp_tritondse/aflpp_tritondse.py | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'custom_mutators')

diff --git a/custom_mutators/aflpp_tritondse/aflpp_tritondse.py b/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
index 48367bc7..cef28f34 100644
--- a/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
+++ b/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
@@ -206,5 +206,11 @@ def queue_new_entry(filename_new_queue, filename_orig_queue):
         #dse.explore()
     pass
 
+
+# we simulate just doing one single fuzz in the custom mutator
+def fuzz_count(buf):
+    return 1
+
+
 def splice_optout():
     pass
-- 
cgit 1.4.1


From 1d0694df86a3ce70ffac2846f36605eac9300abe Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 17 May 2023 15:25:26 +0200
Subject: add symqemu custom mutator

---
 custom_mutators/symcc/README.md   |   2 +
 custom_mutators/symqemu/Makefile  |  14 ++
 custom_mutators/symqemu/README.md |  11 +
 custom_mutators/symqemu/symqemu.c | 446 ++++++++++++++++++++++++++++++++++++++
 docs/Changelog.md                 |   3 +
 instrumentation/afl-llvm-common.h |   2 +-
 test-instr.c                      |   9 +-
 7 files changed, 483 insertions(+), 4 deletions(-)
 create mode 100644 custom_mutators/symqemu/Makefile
 create mode 100644 custom_mutators/symqemu/README.md
 create mode 100644 custom_mutators/symqemu/symqemu.c

(limited to 'custom_mutators')

diff --git a/custom_mutators/symcc/README.md b/custom_mutators/symcc/README.md
index 364a348e..a6839a37 100644
--- a/custom_mutators/symcc/README.md
+++ b/custom_mutators/symcc/README.md
@@ -5,6 +5,8 @@ This uses the symcc to find new paths into the target.
 Note that this is a just a proof of concept example! It is better to use
 the fuzzing helpers of symcc, symqemu, Fuzzolic, etc. rather than this.
 
+Also the symqemu custom mutator is better than this.
+
 To use this custom mutator follow the steps in the symcc repository 
 [https://github.com/eurecom-s3/symcc/](https://github.com/eurecom-s3/symcc/) 
 on how to build symcc and how to instrument a target binary (the same target
diff --git a/custom_mutators/symqemu/Makefile b/custom_mutators/symqemu/Makefile
new file mode 100644
index 00000000..3361ab0f
--- /dev/null
+++ b/custom_mutators/symqemu/Makefile
@@ -0,0 +1,14 @@
+
+ifdef DEBUG
+  CFLAGS += -DDEBUG
+endif
+
+all: symqemu-mutator.so
+
+CFLAGS	+= -O3 -funroll-loops
+
+symqemu-mutator.so: symqemu.c
+	$(CC) $(CFLAGS) $(CPPFLAGS) -g -I../../include -shared -fPIC -o symqemu-mutator.so symqemu.c
+
+clean:
+	rm -f symqemu-mutator.so *.o *~ core
diff --git a/custom_mutators/symqemu/README.md b/custom_mutators/symqemu/README.md
new file mode 100644
index 00000000..0d5cd4d7
--- /dev/null
+++ b/custom_mutators/symqemu/README.md
@@ -0,0 +1,11 @@
+# custum mutator: symqemu
+
+This uses the symcc to find new paths into the target.
+
+To use this custom mutator follow the steps in the symqemu repository 
+[https://github.com/eurecom-s3/symqemu/](https://github.com/eurecom-s3/symqemu/) 
+on how to build symqemu-x86_x64 and put it in your `PATH`.
+
+just type `make` to build this custom mutator.
+
+```AFL_CUSTOM_MUTATOR_LIBRARY=custom_mutators/symqemu/symqemu-mutator.so AFL_SYNC_TIME=1 afl-fuzz ...```
diff --git a/custom_mutators/symqemu/symqemu.c b/custom_mutators/symqemu/symqemu.c
new file mode 100644
index 00000000..9030397b
--- /dev/null
+++ b/custom_mutators/symqemu/symqemu.c
@@ -0,0 +1,446 @@
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <ctype.h>
+#include "config.h"
+#include "debug.h"
+#include "afl-fuzz.h"
+#include "common.h"
+
+afl_state_t *afl_struct;
+static u32   debug = 0;
+
+#define DBG(x...) \
+  if (debug) { fprintf(stderr, x); }
+
+typedef struct my_mutator {
+
+  afl_state_t *afl;
+  u8          *mutator_buf;
+  u8          *out_dir;
+  u8          *queue_dir;
+  u8          *target;
+  u8          *symqemu;
+  u8          *input_file;
+  u32          counter;
+  u32          seed;
+  u32          argc;
+  u8         **argv;
+
+} my_mutator_t;
+
+my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
+
+  if (getenv("AFL_DEBUG")) debug = 1;
+
+  my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
+  if (!data) {
+
+    perror("afl_custom_init alloc");
+    return NULL;
+
+  }
+
+  char *path = getenv("PATH");
+  char *exec_name = "symqemu-x86_64";
+  char *token = strtok(path, ":");
+  char  exec_path[4096];
+
+  while (token != NULL && data->symqemu == NULL) {
+
+    snprintf(exec_path, sizeof(exec_path), "%s/%s", token, exec_name);
+    if (access(exec_path, X_OK) == 0) {
+
+      data->symqemu = (u8 *)strdup(exec_path);
+      break;
+
+    }
+
+    token = strtok(NULL, ":");
+
+  }
+
+  if (!data->symqemu) FATAL("symqemu binary %s not found", exec_name);
+  DBG("Found %s\n", data->symqemu);
+
+  if (getenv("AFL_CUSTOM_MUTATOR_ONLY"))
+    FATAL("the symqemu module cannot be used with AFL_CUSTOM_MUTATOR_ONLY.");
+
+  if ((data->mutator_buf = malloc(MAX_FILE)) == NULL) {
+
+    free(data);
+    perror("mutator_buf alloc");
+    return NULL;
+
+  }
+
+  data->target = getenv("AFL_CUSTOM_INFO_PROGRAM");
+
+  u8 *path_tmp = getenv("AFL_CUSTOM_INFO_OUT");
+  u32 len = strlen(path_tmp) + 32;
+  u8 *symqemu_path = malloc(len);
+  data->out_dir = malloc(len);
+  data->queue_dir = malloc(len);
+  snprintf(symqemu_path, len, "%s/../symqemu", path_tmp);
+  snprintf(data->out_dir, len, "%s/../symqemu/out", path_tmp);
+  snprintf(data->queue_dir, len, "%s/../symqemu/queue", path_tmp);
+
+  mkdir(symqemu_path, 0755);
+  mkdir(data->out_dir, 0755);
+  mkdir(data->queue_dir, 0755);
+
+  setenv("SYMCC_OUTPUT_DIR", data->out_dir, 1);
+
+  data->input_file = getenv("AFL_CUSTOM_INFO_PROGRAM_INPUT");
+
+  u8 *tmp = NULL;
+  if ((tmp = getenv("AFL_CUSTOM_INFO_PROGRAM_ARGV")) && *tmp) {
+
+    int argc = 0, index = 2;
+    for (u32 i = 0; i < strlen(tmp); ++i)
+      if (isspace(tmp[i])) ++argc;
+
+    data->argv = (u8 **)malloc((argc + 4) * sizeof(u8 **));
+    u8 *p = strdup(tmp);
+
+    do {
+
+      data->argv[index] = p;
+      while (*p && !isspace(*p))
+        ++p;
+      if (*p) {
+
+        *p++ = 0;
+        while (isspace(*p))
+          ++p;
+
+      }
+
+      if (strcmp(data->argv[index], "@@") == 0) {
+
+        if (!data->input_file) {
+
+          u32 ilen = strlen(symqemu_path) + 32;
+          data->input_file = malloc(ilen);
+          snprintf(data->input_file, ilen, "%s/.input", symqemu_path);
+
+        }
+
+        data->argv[index] = data->input_file;
+
+      }
+
+      DBG("%d: %s\n", index, data->argv[index]);
+      index++;
+
+    } while (*p);
+
+    data->argv[index] = NULL;
+    data->argc = index;
+
+  } else {
+
+    data->argv = (u8 **)malloc(8 * sizeof(u8 **));
+    data->argc = 2;
+    data->argv[2] = NULL;
+
+  }
+
+  data->argv[0] = data->symqemu;
+  data->argv[1] = data->target;
+
+  DBG("out_dir=%s, queue_dir=%s, target=%s, input_file=%s, argc=%u\n",
+      data->out_dir, data->queue_dir, data->target,
+      data->input_file ? (char *)data->input_file : (char *)"<stdin>",
+      data->argc);
+
+  if (data->input_file) { setenv("SYMCC_INPUT_FILE", data->input_file, 1); }
+
+  data->afl = afl;
+  data->seed = seed;
+  afl_struct = afl;
+
+  if (debug) {
+
+    fprintf(stderr, "[");
+    for (u32 i = 0; i <= data->argc; ++i)
+      fprintf(stderr, " \"%s\"",
+              data->argv[i] ? (char *)data->argv[i] : "<NULL>");
+    fprintf(stderr, " ]\n");
+
+  }
+
+  OKF("Custom mutator symqemu loaded - note that the initial startup of "
+      "afl-fuzz will be delayed the more starting seeds are present. This is "
+      "fine, do not worry!");
+
+  return data;
+
+}
+
+/* When a new queue entry is added we run this input with the symqemu
+   instrumented binary */
+uint8_t afl_custom_queue_new_entry(my_mutator_t  *data,
+                                   const uint8_t *filename_new_queue,
+                                   const uint8_t *filename_orig_queue) {
+
+  int         pipefd[2];
+  struct stat st;
+  if (data->afl->afl_env.afl_no_ui)
+    ACTF("Sending to symqemu: %s", filename_new_queue);
+  u8 *fn = alloc_printf("%s", filename_new_queue);
+  if (!(stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size)) {
+
+    ck_free(fn);
+    PFATAL("Couldn't find enqueued file: %s", fn);
+
+  }
+
+  if (afl_struct->fsrv.use_stdin) {
+
+    if (pipe(pipefd) == -1) {
+
+      ck_free(fn);
+      PFATAL(
+          "Couldn't create a pipe for interacting with symqemu child process");
+
+    }
+
+  }
+
+  int fd = open(fn, O_RDONLY);
+  if (fd < 0) return 0;
+  ssize_t r = read(fd, data->mutator_buf, MAX_FILE);
+  DBG("fn=%s, fd=%d, size=%ld\n", fn, fd, r);
+  ck_free(fn);
+  close(fd);
+
+  if (data->input_file) {
+
+    fd = open(data->input_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
+    ssize_t s = write(fd, data->mutator_buf, r);
+    close(fd);
+    DBG("wrote %zd/%zd to %s\n", s, r, data->input_file);
+
+  }
+
+  int pid = fork();
+
+  if (pid == -1) return 0;
+
+  if (pid) {
+
+    if (!data->input_file || afl_struct->fsrv.use_stdin) {
+
+      close(pipefd[0]);
+
+      if (fd >= 0) {
+
+        if (r <= 0) {
+
+          close(pipefd[1]);
+          return 0;
+
+        }
+
+        if (r > fcntl(pipefd[1], F_GETPIPE_SZ))
+          fcntl(pipefd[1], F_SETPIPE_SZ, MAX_FILE);
+        ck_write(pipefd[1], data->mutator_buf, r, filename_new_queue);
+
+      } else {
+
+        ck_free(fn);
+        close(pipefd[1]);
+        PFATAL(
+            "Something happened to the enqueued file before sending its "
+            "contents to symqemu binary");
+
+      }
+
+      close(pipefd[1]);
+
+    }
+
+    pid = waitpid(pid, NULL, 0);
+    DBG("symqemu finished executing!\n");
+
+    // At this point we need to transfer files to output dir, since their names
+    // collide and symqemu will just overwrite them
+
+    struct dirent **nl;
+    int32_t         items = scandir(data->out_dir, &nl, NULL, NULL);
+    u8             *origin_name = basename(filename_new_queue);
+    u8              source_name[4096], destination_name[4096];
+    int32_t         i;
+
+    if (items > 0) {
+
+      for (i = 0; i < (u32)items; ++i) {
+
+        // symqemu output files start with a digit
+        if (!isdigit(nl[i]->d_name[0])) continue;
+
+        struct stat st;
+        snprintf(source_name, sizeof(source_name), "%s/%s", data->out_dir,
+                 nl[i]->d_name);
+        DBG("file=%s\n", source_name);
+
+        if (stat(source_name, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
+
+          snprintf(destination_name, sizeof(destination_name), "%s/id:%06u,%s",
+                   data->queue_dir, data->counter++, nl[i]->d_name);
+          DBG("src=%s dst=%s\n", source_name, destination_name);
+          rename(source_name, destination_name);
+
+        }
+
+        free(nl[i]);
+
+      }
+
+      free(nl);
+
+    }
+
+    DBG("Done!\n");
+
+  } else /* (pid == 0) */ {  // child
+
+    if (afl_struct->fsrv.use_stdin) {
+
+      close(pipefd[1]);
+      dup2(pipefd[0], 0);
+
+    }
+
+    DBG("exec=%s\n", data->target);
+    if (!debug) {
+
+      close(1);
+      close(2);
+      dup2(afl_struct->fsrv.dev_null_fd, 1);
+      dup2(afl_struct->fsrv.dev_null_fd, 2);
+
+    }
+
+    execvp((char *)data->argv[0], (char **)data->argv);
+    fprintf(stderr, "Executing: [");
+    for (u32 i = 0; i <= data->argc; ++i)
+      fprintf(stderr, " \"%s\"",
+              data->argv[i] ? (char *)data->argv[i] : "<NULL>");
+    fprintf(stderr, " ]\n");
+    FATAL("Failed to execute %s %s\n", data->argv[0], data->argv[1]);
+    exit(-1);
+
+  }
+
+  return 0;
+
+}
+
+/*
+uint32_t afl_custom_fuzz_count(my_mutator_t *data, const u8 *buf,
+                               size_t buf_size) {
+
+  uint32_t        count = 0, i;
+  struct dirent **nl;
+  int32_t         items = scandir(data->out_dir, &nl, NULL, NULL);
+
+  if (items > 0) {
+
+    for (i = 0; i < (u32)items; ++i) {
+
+      struct stat st;
+      u8 *        fn = alloc_printf("%s/%s", data->out_dir, nl[i]->d_name);
+      DBG("test=%s\n", fn);
+      if (stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
+
+        DBG("found=%s\n", fn);
+        count++;
+
+      }
+
+      ck_free(fn);
+      free(nl[i]);
+
+    }
+
+    free(nl);
+
+  }
+
+  DBG("dir=%s, count=%u\n", data->out_dir, count);
+  return count;
+
+}
+
+*/
+
+// here we actually just read the files generated from symqemu
+/*
+size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
+                       u8 **out_buf, uint8_t *add_buf, size_t add_buf_size,
+                       size_t max_size) {
+
+  struct dirent **nl;
+  int32_t         i, done = 0, items = scandir(data->out_dir, &nl, NULL, NULL);
+  ssize_t         size = 0;
+
+  if (items <= 0) return 0;
+
+  for (i = 0; i < (u32)items; ++i) {
+
+    struct stat st;
+    u8 *        fn = alloc_printf("%s/%s", data->out_dir, nl[i]->d_name);
+
+    if (done == 0) {
+
+      if (stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
+
+        int fd = open(fn, O_RDONLY);
+
+        if (fd >= 0) {
+
+          size = read(fd, data->mutator_buf, max_size);
+          *out_buf = data->mutator_buf;
+
+          close(fd);
+          done = 1;
+
+        }
+
+      }
+
+      unlink(fn);
+
+    }
+
+    ck_free(fn);
+    free(nl[i]);
+
+  }
+
+  free(nl);
+  DBG("FUZZ size=%lu\n", size);
+  return (uint32_t)size;
+
+}
+
+*/
+
+/**
+ * Deinitialize everything
+ *
+ * @param data The data ptr from afl_custom_init
+ */
+void afl_custom_deinit(my_mutator_t *data) {
+
+  free(data->mutator_buf);
+  free(data);
+
+}
+
diff --git a/docs/Changelog.md b/docs/Changelog.md
index 3602af50..e99747f6 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -23,6 +23,9 @@
   - qemu_mode:
     - Persistent mode +QASAN support for ppc32 tragets by @worksbutnottested
   - a new grammar custom mutator atnwalk was submitted by @voidptr127 !
+  - two new custom mutators are now available:
+    - TritonDSE in custom_mutators/aflpp_tritondse
+    - SymQEMU in custom_mutators/symqemu
 
 
 ### Version ++4.06c (release)
diff --git a/instrumentation/afl-llvm-common.h b/instrumentation/afl-llvm-common.h
index c9324460..23f67179 100644
--- a/instrumentation/afl-llvm-common.h
+++ b/instrumentation/afl-llvm-common.h
@@ -23,7 +23,7 @@ typedef long double max_align_t;
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/MathExtras.h"
 #if LLVM_VERSION_MAJOR < 17
-#include "llvm/Transforms/IPO/PassManagerBuilder.h"
+  #include "llvm/Transforms/IPO/PassManagerBuilder.h"
 #endif
 
 #if LLVM_VERSION_MAJOR > 3 || \
diff --git a/test-instr.c b/test-instr.c
index 1d9f2e6e..eda5189c 100644
--- a/test-instr.c
+++ b/test-instr.c
@@ -24,7 +24,7 @@
 
 int main(int argc, char **argv) {
 
-  int   fd = 0;
+  int   fd = 0, cnt;
   char  buff[8];
   char *buf = buff;
 
@@ -32,7 +32,6 @@ int main(int argc, char **argv) {
   if (argc == 2) {
 
     buf = argv[1];
-    printf("Input %s - ", buf);
 
   } else {
 
@@ -47,15 +46,19 @@ int main(int argc, char **argv) {
 
     }
 
-    if (read(fd, buf, sizeof(buf)) < 1) {
+    if ((cnt = read(fd, buf, sizeof(buf) - 1)) < 1) {
 
       printf("Hum?\n");
       return 1;
 
     }
 
+    buf[cnt] = 0;
+
   }
 
+  if (getenv("AFL_DEBUG")) fprintf(stderr, "test-instr: %s\n", buf);
+
   // we support three input cases (plus a 4th if stdin is used but there is no
   // input)
   switch (buf[0]) {
-- 
cgit 1.4.1


From 3e3adb4d377dcfa1e878ab00f061a894923bd642 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 17 May 2023 18:39:54 +0200
Subject: enforce python setting detection

---
 GNUmakefile                       | 34 +++++++++++++++++-----------------
 custom_mutators/symqemu/README.md |  2 +-
 2 files changed, 18 insertions(+), 18 deletions(-)

(limited to 'custom_mutators')

diff --git a/GNUmakefile b/GNUmakefile
index 31374c10..bfc2aa03 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -180,13 +180,13 @@ AFL_FUZZ_FILES = $(wildcard src/afl-fuzz*.c)
 
 ifneq "$(shell command -v python3m 2>/dev/null)" ""
   ifneq "$(shell command -v python3m-config 2>/dev/null)" ""
-    PYTHON_INCLUDE  ?= $(shell python3m-config --includes)
-    PYTHON_VERSION  ?= $(strip $(shell python3m --version 2>&1))
+    PYTHON_INCLUDE  := $(shell python3m-config --includes)
+    PYTHON_VERSION  := $(strip $(shell python3m --version 2>&1))
     # Starting with python3.8, we need to pass the `embed` flag. Earlier versions didn't know this flag.
     ifeq "$(shell python3m-config --embed --libs 2>/dev/null | grep -q lpython && echo 1 )" "1"
-      PYTHON_LIB      ?= $(shell python3m-config --libs --embed --ldflags)
+      PYTHON_LIB      := $(shell python3m-config --libs --embed --ldflags)
     else
-      PYTHON_LIB      ?= $(shell python3m-config --ldflags)
+      PYTHON_LIB      := $(shell python3m-config --ldflags)
     endif
   endif
 endif
@@ -194,13 +194,13 @@ endif
 ifeq "$(PYTHON_INCLUDE)" ""
   ifneq "$(shell command -v python3 2>/dev/null)" ""
     ifneq "$(shell command -v python3-config 2>/dev/null)" ""
-      PYTHON_INCLUDE  ?= $(shell python3-config --includes)
-      PYTHON_VERSION  ?= $(strip $(shell python3 --version 2>&1))
+      PYTHON_INCLUDE  := $(shell python3-config --includes)
+      PYTHON_VERSION  := $(strip $(shell python3 --version 2>&1))
       # Starting with python3.8, we need to pass the `embed` flag. Earlier versions didn't know this flag.
       ifeq "$(shell python3-config --embed --libs 2>/dev/null | grep -q lpython && echo 1 )" "1"
-        PYTHON_LIB      ?= $(shell python3-config --libs --embed --ldflags)
+        PYTHON_LIB      := $(shell python3-config --libs --embed --ldflags)
       else
-        PYTHON_LIB      ?= $(shell python3-config --ldflags)
+        PYTHON_LIB      := $(shell python3-config --ldflags)
       endif
     endif
   endif
@@ -209,9 +209,9 @@ endif
 ifeq "$(PYTHON_INCLUDE)" ""
   ifneq "$(shell command -v python 2>/dev/null)" ""
     ifneq "$(shell command -v python-config 2>/dev/null)" ""
-      PYTHON_INCLUDE  ?= $(shell python-config --includes)
-      PYTHON_LIB      ?= $(shell python-config --ldflags)
-      PYTHON_VERSION  ?= $(strip $(shell python --version 2>&1))
+      PYTHON_INCLUDE  := $(shell python-config --includes)
+      PYTHON_LIB      := $(shell python-config --ldflags)
+      PYTHON_VERSION  := $(strip $(shell python --version 2>&1))
     endif
   endif
 endif
@@ -220,9 +220,9 @@ endif
 ifeq "$(PYTHON_INCLUDE)" ""
   ifneq "$(shell command -v python3.7 2>/dev/null)" ""
     ifneq "$(shell command -v python3.7-config 2>/dev/null)" ""
-      PYTHON_INCLUDE  ?= $(shell python3.7-config --includes)
-      PYTHON_LIB      ?= $(shell python3.7-config --ldflags)
-      PYTHON_VERSION  ?= $(strip $(shell python3.7 --version 2>&1))
+      PYTHON_INCLUDE  := $(shell python3.7-config --includes)
+      PYTHON_LIB      := $(shell python3.7-config --ldflags)
+      PYTHON_VERSION  := $(strip $(shell python3.7 --version 2>&1))
     endif
   endif
 endif
@@ -231,9 +231,9 @@ endif
 ifeq "$(PYTHON_INCLUDE)" ""
   ifneq "$(shell command -v python2.7 2>/dev/null)" ""
     ifneq "$(shell command -v python2.7-config 2>/dev/null)" ""
-      PYTHON_INCLUDE  ?= $(shell python2.7-config --includes)
-      PYTHON_LIB      ?= $(shell python2.7-config --ldflags)
-      PYTHON_VERSION  ?= $(strip $(shell python2.7 --version 2>&1))
+      PYTHON_INCLUDE  := $(shell python2.7-config --includes)
+      PYTHON_LIB      := $(shell python2.7-config --ldflags)
+      PYTHON_VERSION  := $(strip $(shell python2.7 --version 2>&1))
     endif
   endif
 endif
diff --git a/custom_mutators/symqemu/README.md b/custom_mutators/symqemu/README.md
index 0d5cd4d7..55ce05c5 100644
--- a/custom_mutators/symqemu/README.md
+++ b/custom_mutators/symqemu/README.md
@@ -8,4 +8,4 @@ on how to build symqemu-x86_x64 and put it in your `PATH`.
 
 just type `make` to build this custom mutator.
 
-```AFL_CUSTOM_MUTATOR_LIBRARY=custom_mutators/symqemu/symqemu-mutator.so AFL_SYNC_TIME=1 afl-fuzz ...```
+```AFL_CUSTOM_MUTATOR_LIBRARY=custom_mutators/symqemu/symqemu-mutator.so AFL_SYNC_TIME=1 AFL_DISABLE_TRIM=1 afl-fuzz ...```
-- 
cgit 1.4.1


From abd6eace9d767e4db6019e8eb69080d2352015c9 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Thu, 18 May 2023 10:32:15 +0200
Subject: improved symqemu custom mutator

---
 custom_mutators/symqemu/README.md |   2 +-
 custom_mutators/symqemu/symqemu.c | 239 +++++++++++++++-----------------------
 include/afl-fuzz.h                |   1 +
 src/afl-fuzz-one.c                |   1 +
 4 files changed, 98 insertions(+), 145 deletions(-)

(limited to 'custom_mutators')

diff --git a/custom_mutators/symqemu/README.md b/custom_mutators/symqemu/README.md
index 55ce05c5..b7702c06 100644
--- a/custom_mutators/symqemu/README.md
+++ b/custom_mutators/symqemu/README.md
@@ -8,4 +8,4 @@ on how to build symqemu-x86_x64 and put it in your `PATH`.
 
 just type `make` to build this custom mutator.
 
-```AFL_CUSTOM_MUTATOR_LIBRARY=custom_mutators/symqemu/symqemu-mutator.so AFL_SYNC_TIME=1 AFL_DISABLE_TRIM=1 afl-fuzz ...```
+```AFL_CUSTOM_MUTATOR_LIBRARY=custom_mutators/symqemu/symqemu-mutator.so AFL_DISABLE_TRIM=1 afl-fuzz ...```
diff --git a/custom_mutators/symqemu/symqemu.c b/custom_mutators/symqemu/symqemu.c
index 9030397b..163ae240 100644
--- a/custom_mutators/symqemu/symqemu.c
+++ b/custom_mutators/symqemu/symqemu.c
@@ -13,6 +13,9 @@
 
 afl_state_t *afl_struct;
 static u32   debug = 0;
+static u32   found_items = 0;
+
+#define SYMQEMU_LOCATION "symqemu"
 
 #define DBG(x...) \
   if (debug) { fprintf(stderr, x); }
@@ -22,7 +25,6 @@ typedef struct my_mutator {
   afl_state_t *afl;
   u8          *mutator_buf;
   u8          *out_dir;
-  u8          *queue_dir;
   u8          *target;
   u8          *symqemu;
   u8          *input_file;
@@ -67,8 +69,13 @@ my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
   if (!data->symqemu) FATAL("symqemu binary %s not found", exec_name);
   DBG("Found %s\n", data->symqemu);
 
-  if (getenv("AFL_CUSTOM_MUTATOR_ONLY"))
-    FATAL("the symqemu module cannot be used with AFL_CUSTOM_MUTATOR_ONLY.");
+  if (getenv("AFL_CUSTOM_MUTATOR_ONLY")) {
+
+    WARNF(
+        "the symqemu module is not very effective with "
+        "AFL_CUSTOM_MUTATOR_ONLY.");
+
+  }
 
   if ((data->mutator_buf = malloc(MAX_FILE)) == NULL) {
 
@@ -84,14 +91,11 @@ my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
   u32 len = strlen(path_tmp) + 32;
   u8 *symqemu_path = malloc(len);
   data->out_dir = malloc(len);
-  data->queue_dir = malloc(len);
-  snprintf(symqemu_path, len, "%s/../symqemu", path_tmp);
-  snprintf(data->out_dir, len, "%s/../symqemu/out", path_tmp);
-  snprintf(data->queue_dir, len, "%s/../symqemu/queue", path_tmp);
+  snprintf(symqemu_path, len, "%s/%s", path_tmp, SYMQEMU_LOCATION);
+  snprintf(data->out_dir, len, "%s/out", symqemu_path, path_tmp);
 
-  mkdir(symqemu_path, 0755);
-  mkdir(data->out_dir, 0755);
-  mkdir(data->queue_dir, 0755);
+  (void)mkdir(symqemu_path, 0755);
+  (void)mkdir(data->out_dir, 0755);
 
   setenv("SYMCC_OUTPUT_DIR", data->out_dir, 1);
 
@@ -153,8 +157,8 @@ my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
   data->argv[0] = data->symqemu;
   data->argv[1] = data->target;
 
-  DBG("out_dir=%s, queue_dir=%s, target=%s, input_file=%s, argc=%u\n",
-      data->out_dir, data->queue_dir, data->target,
+  DBG("out_dir=%s, target=%s, input_file=%s, argc=%u\n", data->out_dir,
+      data->target,
       data->input_file ? (char *)data->input_file : (char *)"<stdin>",
       data->argc);
 
@@ -174,29 +178,39 @@ my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
 
   }
 
-  OKF("Custom mutator symqemu loaded - note that the initial startup of "
-      "afl-fuzz will be delayed the more starting seeds are present. This is "
-      "fine, do not worry!");
-
   return data;
 
 }
 
-/* When a new queue entry is added we run this input with the symqemu
-   instrumented binary */
-uint8_t afl_custom_queue_new_entry(my_mutator_t  *data,
-                                   const uint8_t *filename_new_queue,
-                                   const uint8_t *filename_orig_queue) {
+/* No need to receive a splicing item */
+void afl_custom_splice_optout(void *data) {
+
+  (void)(data);
+
+}
+
+u32 afl_custom_fuzz_count(my_mutator_t *data, const u8 *buf, size_t buf_size) {
+
+  if (likely(!afl_struct->queue_cur->favored ||
+             afl_struct->queue_cur->was_fuzzed)) {
+
+    return 0;
+
+  }
 
   int         pipefd[2];
   struct stat st;
-  if (data->afl->afl_env.afl_no_ui)
-    ACTF("Sending to symqemu: %s", filename_new_queue);
-  u8 *fn = alloc_printf("%s", filename_new_queue);
-  if (!(stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size)) {
 
-    ck_free(fn);
-    PFATAL("Couldn't find enqueued file: %s", fn);
+  if (afl_struct->afl_env.afl_no_ui) {
+
+    ACTF("Sending to symqemu: %s", afl_struct->queue_cur->fname);
+
+  }
+
+  if (!(stat(afl_struct->queue_cur->fname, &st) == 0 && S_ISREG(st.st_mode) &&
+        st.st_size)) {
+
+    PFATAL("Couldn't find enqueued file: %s", afl_struct->queue_cur->fname);
 
   }
 
@@ -204,7 +218,6 @@ uint8_t afl_custom_queue_new_entry(my_mutator_t  *data,
 
     if (pipe(pipefd) == -1) {
 
-      ck_free(fn);
       PFATAL(
           "Couldn't create a pipe for interacting with symqemu child process");
 
@@ -212,19 +225,12 @@ uint8_t afl_custom_queue_new_entry(my_mutator_t  *data,
 
   }
 
-  int fd = open(fn, O_RDONLY);
-  if (fd < 0) return 0;
-  ssize_t r = read(fd, data->mutator_buf, MAX_FILE);
-  DBG("fn=%s, fd=%d, size=%ld\n", fn, fd, r);
-  ck_free(fn);
-  close(fd);
-
   if (data->input_file) {
 
-    fd = open(data->input_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
-    ssize_t s = write(fd, data->mutator_buf, r);
+    int     fd = open(data->input_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
+    ssize_t s = write(fd, buf, buf_size);
     close(fd);
-    DBG("wrote %zd/%zd to %s\n", s, r, data->input_file);
+    DBG("wrote %zd/%zd to %s\n", s, buf_size, data->input_file);
 
   }
 
@@ -232,35 +238,20 @@ uint8_t afl_custom_queue_new_entry(my_mutator_t  *data,
 
   if (pid == -1) return 0;
 
-  if (pid) {
+  if (likely(pid)) {
 
     if (!data->input_file || afl_struct->fsrv.use_stdin) {
 
       close(pipefd[0]);
 
-      if (fd >= 0) {
-
-        if (r <= 0) {
-
-          close(pipefd[1]);
-          return 0;
-
-        }
+      if (fcntl(pipefd[1], F_GETPIPE_SZ)) {
 
-        if (r > fcntl(pipefd[1], F_GETPIPE_SZ))
-          fcntl(pipefd[1], F_SETPIPE_SZ, MAX_FILE);
-        ck_write(pipefd[1], data->mutator_buf, r, filename_new_queue);
-
-      } else {
-
-        ck_free(fn);
-        close(pipefd[1]);
-        PFATAL(
-            "Something happened to the enqueued file before sending its "
-            "contents to symqemu binary");
+        fcntl(pipefd[1], F_SETPIPE_SZ, MAX_FILE);
 
       }
 
+      ck_write(pipefd[1], buf, buf_size, data->input_file);
+
       close(pipefd[1]);
 
     }
@@ -268,46 +259,6 @@ uint8_t afl_custom_queue_new_entry(my_mutator_t  *data,
     pid = waitpid(pid, NULL, 0);
     DBG("symqemu finished executing!\n");
 
-    // At this point we need to transfer files to output dir, since their names
-    // collide and symqemu will just overwrite them
-
-    struct dirent **nl;
-    int32_t         items = scandir(data->out_dir, &nl, NULL, NULL);
-    u8             *origin_name = basename(filename_new_queue);
-    u8              source_name[4096], destination_name[4096];
-    int32_t         i;
-
-    if (items > 0) {
-
-      for (i = 0; i < (u32)items; ++i) {
-
-        // symqemu output files start with a digit
-        if (!isdigit(nl[i]->d_name[0])) continue;
-
-        struct stat st;
-        snprintf(source_name, sizeof(source_name), "%s/%s", data->out_dir,
-                 nl[i]->d_name);
-        DBG("file=%s\n", source_name);
-
-        if (stat(source_name, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
-
-          snprintf(destination_name, sizeof(destination_name), "%s/id:%06u,%s",
-                   data->queue_dir, data->counter++, nl[i]->d_name);
-          DBG("src=%s dst=%s\n", source_name, destination_name);
-          rename(source_name, destination_name);
-
-        }
-
-        free(nl[i]);
-
-      }
-
-      free(nl);
-
-    }
-
-    DBG("Done!\n");
-
   } else /* (pid == 0) */ {  // child
 
     if (afl_struct->fsrv.use_stdin) {
@@ -338,33 +289,31 @@ uint8_t afl_custom_queue_new_entry(my_mutator_t  *data,
 
   }
 
-  return 0;
-
-}
-
-/*
-uint32_t afl_custom_fuzz_count(my_mutator_t *data, const u8 *buf,
-                               size_t buf_size) {
+  /* back in mother process */
 
-  uint32_t        count = 0, i;
   struct dirent **nl;
-  int32_t         items = scandir(data->out_dir, &nl, NULL, NULL);
+  s32             i, items = scandir(data->out_dir, &nl, NULL, NULL);
+  found_items = 0;
+  char source_name[4096];
 
   if (items > 0) {
 
     for (i = 0; i < (u32)items; ++i) {
 
+      // symqemu output files start with a digit
+      if (!isdigit(nl[i]->d_name[0])) continue;
+
       struct stat st;
-      u8 *        fn = alloc_printf("%s/%s", data->out_dir, nl[i]->d_name);
-      DBG("test=%s\n", fn);
-      if (stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
+      snprintf(source_name, sizeof(source_name), "%s/%s", data->out_dir,
+               nl[i]->d_name);
+      DBG("file=%s\n", source_name);
+
+      if (stat(source_name, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
 
-        DBG("found=%s\n", fn);
-        count++;
+        ++found_items;
 
       }
 
-      ck_free(fn);
       free(nl[i]);
 
     }
@@ -373,65 +322,67 @@ uint32_t afl_custom_fuzz_count(my_mutator_t *data, const u8 *buf,
 
   }
 
-  DBG("dir=%s, count=%u\n", data->out_dir, count);
-  return count;
+  DBG("Done, found %u items!\n", found_items);
 
-}
+  return found_items;
 
-*/
+}
 
-// here we actually just read the files generated from symqemu
-/*
-size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
-                       u8 **out_buf, uint8_t *add_buf, size_t add_buf_size,
+size_t afl_custom_fuzz(my_mutator_t *data, u8 *buf, size_t buf_size,
+                       u8 **out_buf, u8 *add_buf, size_t add_buf_size,
                        size_t max_size) {
 
   struct dirent **nl;
-  int32_t         i, done = 0, items = scandir(data->out_dir, &nl, NULL, NULL);
-  ssize_t         size = 0;
+  s32             done = 0, i, items = scandir(data->out_dir, &nl, NULL, NULL);
+  char            source_name[4096];
 
-  if (items <= 0) return 0;
+  if (items > 0) {
 
-  for (i = 0; i < (u32)items; ++i) {
+    for (i = 0; i < (u32)items; ++i) {
 
-    struct stat st;
-    u8 *        fn = alloc_printf("%s/%s", data->out_dir, nl[i]->d_name);
+      // symqemu output files start with a digit
+      if (!isdigit(nl[i]->d_name[0])) continue;
 
-    if (done == 0) {
+      struct stat st;
+      snprintf(source_name, sizeof(source_name), "%s/%s", data->out_dir,
+               nl[i]->d_name);
+      DBG("file=%s\n", source_name);
 
-      if (stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
+      if (stat(source_name, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
 
-        int fd = open(fn, O_RDONLY);
+        int fd = open(source_name, O_RDONLY);
+        if (fd < 0) { goto got_an_issue; }
 
-        if (fd >= 0) {
+        ssize_t r = read(fd, data->mutator_buf, MAX_FILE);
+        close(fd);
 
-          size = read(fd, data->mutator_buf, max_size);
-          *out_buf = data->mutator_buf;
+        DBG("fn=%s, fd=%d, size=%ld\n", source_name, fd, r);
 
-          close(fd);
-          done = 1;
+        if (r < 1) { goto got_an_issue; }
 
-        }
+        done = 1;
+        --found_items;
+        unlink(source_name);
+
+        *out_buf = data->mutator_buf;
+        return (u32)r;
 
       }
 
-      unlink(fn);
+      free(nl[i]);
 
     }
 
-    ck_free(fn);
-    free(nl[i]);
+    free(nl);
 
   }
 
-  free(nl);
-  DBG("FUZZ size=%lu\n", size);
-  return (uint32_t)size;
+got_an_issue:
+  *out_buf = NULL;
+  return 0;
 
 }
 
-*/
-
 /**
  * Deinitialize everything
  *
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 8fb7ecb1..beb2de2a 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -184,6 +184,7 @@ struct queue_entry {
       handicap,                         /* Number of queue cycles behind    */
       depth,                            /* Path depth                       */
       exec_cksum,                       /* Checksum of the execution trace  */
+      custom,                           /* Marker for custom mutators       */
       stats_mutated;                    /* stats: # of mutations performed  */
 
   u8 *trace_mini;                       /* Trace bytes, if kept             */
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index c6e9a295..5c71fc59 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -1912,6 +1912,7 @@ custom_mutator_stage:
 
   afl->stage_name = "custom mutator";
   afl->stage_short = "custom";
+  afl->stage_cur = 0;
   afl->stage_val_type = STAGE_VAL_NONE;
   bool has_custom_fuzz = false;
   u32  shift = unlikely(afl->custom_only) ? 7 : 8;
-- 
cgit 1.4.1


From 401d7617efbd2f38d9132eabfd1b1152abceda52 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Thu, 18 May 2023 10:50:10 +0200
Subject: symqemu mutator options

---
 custom_mutators/aflpp_tritondse/README.md |  7 +++--
 custom_mutators/symqemu/README.md         | 10 ++++++-
 custom_mutators/symqemu/symqemu.c         | 44 +++++++++++++++++++++++++------
 src/afl-common.c                          |  2 +-
 4 files changed, 51 insertions(+), 12 deletions(-)

(limited to 'custom_mutators')

diff --git a/custom_mutators/aflpp_tritondse/README.md b/custom_mutators/aflpp_tritondse/README.md
index 8a5dd02b..608c2624 100644
--- a/custom_mutators/aflpp_tritondse/README.md
+++ b/custom_mutators/aflpp_tritondse/README.md
@@ -10,8 +10,11 @@
 ../../afl-cc -o ../../test-instr ../../test-instr.c
 mkdir -p in
 echo aaaa > in/in
-TRITON_DSE_TARGET=../../test-instr AFL_CUSTOM_MUTATOR_ONLY=1 AFL_SYNC_TIME=1 AFL_PYTHON_MODULE=aflpp_tritondse PYTHONPATH=. ../../afl-fuzz -i in -o out -- ../../test-instr
+AFL_DISABLE_TRIM=1 AFL_CUSTOM_MUTATOR_ONLY=1 AFL_SYNC_TIME=1 AFL_PYTHON_MODULE=aflpp_tritondse PYTHONPATH=. ../../afl-fuzz -i in -o out -- ../../test-instr
 ```
 
 Note that this custom mutator works differently, new finds are synced
-after 10-60 seconds to the fuzzing instance.
+after 10-60 seconds to the fuzzing instance. This is necessary because only
+C/C++ mutators have access to the internal AFL++ state.
+
+Hence the symqemu customer mutator is more effective.
diff --git a/custom_mutators/symqemu/README.md b/custom_mutators/symqemu/README.md
index b7702c06..c3071afc 100644
--- a/custom_mutators/symqemu/README.md
+++ b/custom_mutators/symqemu/README.md
@@ -2,10 +2,18 @@
 
 This uses the symcc to find new paths into the target.
 
+## How to build and use
+
 To use this custom mutator follow the steps in the symqemu repository 
 [https://github.com/eurecom-s3/symqemu/](https://github.com/eurecom-s3/symqemu/) 
 on how to build symqemu-x86_x64 and put it in your `PATH`.
 
-just type `make` to build this custom mutator.
+Just type `make` to build this custom mutator.
 
 ```AFL_CUSTOM_MUTATOR_LIBRARY=custom_mutators/symqemu/symqemu-mutator.so AFL_DISABLE_TRIM=1 afl-fuzz ...```
+
+## Options
+
+`SYMQEMU_ALL=1` - use concolic solving on **all** queue items, not only interesting/favorite ones.
+
+`SYMQEMU_LATE=1` - use concolic solving only after there have been no finds for 5 minutes.
diff --git a/custom_mutators/symqemu/symqemu.c b/custom_mutators/symqemu/symqemu.c
index 163ae240..e2b07af6 100644
--- a/custom_mutators/symqemu/symqemu.c
+++ b/custom_mutators/symqemu/symqemu.c
@@ -23,6 +23,8 @@ static u32   found_items = 0;
 typedef struct my_mutator {
 
   afl_state_t *afl;
+  u32          all;
+  u32          late;
   u8          *mutator_buf;
   u8          *out_dir;
   u8          *target;
@@ -156,18 +158,19 @@ my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
 
   data->argv[0] = data->symqemu;
   data->argv[1] = data->target;
+  data->afl = afl;
+  data->seed = seed;
+  afl_struct = afl;
+
+  if (getenv("SYMQEMU_ALL")) { data->all = 1; }
+  if (getenv("SYMQEMU_LATE")) { data->late = 1; }
+  if (data->input_file) { setenv("SYMCC_INPUT_FILE", data->input_file, 1); }
 
   DBG("out_dir=%s, target=%s, input_file=%s, argc=%u\n", data->out_dir,
       data->target,
       data->input_file ? (char *)data->input_file : (char *)"<stdin>",
       data->argc);
 
-  if (data->input_file) { setenv("SYMCC_INPUT_FILE", data->input_file, 1); }
-
-  data->afl = afl;
-  data->seed = seed;
-  afl_struct = afl;
-
   if (debug) {
 
     fprintf(stderr, "[");
@@ -189,15 +192,40 @@ void afl_custom_splice_optout(void *data) {
 
 }
 
+/* Get unix time in milliseconds */
+
+inline u64 get_cur_time(void) {
+
+  struct timeval  tv;
+  struct timezone tz;
+
+  gettimeofday(&tv, &tz);
+
+  return (tv.tv_sec * 1000ULL) + (tv.tv_usec / 1000);
+
+}
+
 u32 afl_custom_fuzz_count(my_mutator_t *data, const u8 *buf, size_t buf_size) {
 
-  if (likely(!afl_struct->queue_cur->favored ||
-             afl_struct->queue_cur->was_fuzzed)) {
+  if (likely((!afl_struct->queue_cur->favored ||
+              afl_struct->queue_cur->was_fuzzed) &&
+             !data->all)) {
 
     return 0;
 
   }
 
+  if (likely(data->late)) {
+
+    if (unlikely(get_cur_time() - afl_struct->last_find_time <=
+                 10 * 60 * 1000)) {
+
+      return 0;
+
+    }
+
+  }
+
   int         pipefd[2];
   struct stat st;
 
diff --git a/src/afl-common.c b/src/afl-common.c
index a5c48e80..84ddefd8 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -949,7 +949,7 @@ void read_bitmap(u8 *fname, u8 *map, size_t len) {
 
 /* Get unix time in milliseconds */
 
-u64 get_cur_time(void) {
+inline u64 get_cur_time(void) {
 
   struct timeval  tv;
   struct timezone tz;
-- 
cgit 1.4.1


From eec2c38a6891ea317a287498ce1da2f2c8f6f9ff Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Thu, 18 May 2023 12:29:43 +0200
Subject: symqemu fix

---
 custom_mutators/symqemu/symqemu.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

(limited to 'custom_mutators')

diff --git a/custom_mutators/symqemu/symqemu.c b/custom_mutators/symqemu/symqemu.c
index e2b07af6..73a1640a 100644
--- a/custom_mutators/symqemu/symqemu.c
+++ b/custom_mutators/symqemu/symqemu.c
@@ -207,9 +207,8 @@ inline u64 get_cur_time(void) {
 
 u32 afl_custom_fuzz_count(my_mutator_t *data, const u8 *buf, size_t buf_size) {
 
-  if (likely((!afl_struct->queue_cur->favored ||
-              afl_struct->queue_cur->was_fuzzed) &&
-             !data->all)) {
+  if (likely((!afl_struct->queue_cur->favored && !data->all) ||
+             afl_struct->queue_cur->was_fuzzed)) {
 
     return 0;
 
-- 
cgit 1.4.1


From 9a6c0ec0c0af42d33e4350ee2958b58fef1c39dd Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sun, 21 May 2023 13:04:17 +0200
Subject: make AFL_CUSTOM_INFO overridable

---
 custom_mutators/symqemu/Makefile | 2 +-
 src/afl-fuzz.c                   | 8 ++++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

(limited to 'custom_mutators')

diff --git a/custom_mutators/symqemu/Makefile b/custom_mutators/symqemu/Makefile
index 3361ab0f..958aec19 100644
--- a/custom_mutators/symqemu/Makefile
+++ b/custom_mutators/symqemu/Makefile
@@ -8,7 +8,7 @@ all: symqemu-mutator.so
 CFLAGS	+= -O3 -funroll-loops
 
 symqemu-mutator.so: symqemu.c
-	$(CC) $(CFLAGS) $(CPPFLAGS) -g -I../../include -shared -fPIC -o symqemu-mutator.so symqemu.c
+	$(CC) -g $(CFLAGS) $(CPPFLAGS) -g -I../../include -shared -fPIC -o symqemu-mutator.so symqemu.c
 
 clean:
 	rm -f symqemu-mutator.so *.o *~ core
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index e2d8dea5..a61718a7 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1833,7 +1833,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
-  {
+  if (!getenv("AFL_CUSTOM_INFO_PROGRAM_ARGV")) {
 
     u8 envbuf[8096] = "", tmpbuf[8096] = "";
     for (s32 i = optind + 1; i < argc; ++i) {
@@ -1864,7 +1864,11 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
-  setenv("AFL_CUSTOM_INFO_OUT", afl->out_dir, 1);  // same as __AFL_OUT_DIR
+  if (!getenv("AFL_CUSTOM_INFO_OUT") {
+
+    setenv("AFL_CUSTOM_INFO_OUT", afl->out_dir, 1);  // same as __AFL_OUT_DIR
+
+  }
 
   setup_custom_mutators(afl);
 
-- 
cgit 1.4.1


From 1416fea1604a19408554678d7c9fb35b67da302b Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sun, 21 May 2023 14:49:24 +0200
Subject: cleaner tritondse

---
 custom_mutators/aflpp_tritondse/README.md          | 6 ++++--
 custom_mutators/aflpp_tritondse/aflpp_tritondse.py | 4 ++++
 2 files changed, 8 insertions(+), 2 deletions(-)

(limited to 'custom_mutators')

diff --git a/custom_mutators/aflpp_tritondse/README.md b/custom_mutators/aflpp_tritondse/README.md
index 608c2624..033655d2 100644
--- a/custom_mutators/aflpp_tritondse/README.md
+++ b/custom_mutators/aflpp_tritondse/README.md
@@ -15,6 +15,8 @@ AFL_DISABLE_TRIM=1 AFL_CUSTOM_MUTATOR_ONLY=1 AFL_SYNC_TIME=1 AFL_PYTHON_MODULE=a
 
 Note that this custom mutator works differently, new finds are synced
 after 10-60 seconds to the fuzzing instance. This is necessary because only
-C/C++ mutators have access to the internal AFL++ state.
+C/C++ custom mutators have access to the internal AFL++ state.
 
-Hence the symqemu customer mutator is more effective.
+Note that you should run first with `AFL_DEBUG` for 5-10 minutes and see if
+all important libraries and syscalls are hooked (look at `WARNING` and `CRITICAL`
+output during the run, best use with `AFL_NO_UI=1`)
diff --git a/custom_mutators/aflpp_tritondse/aflpp_tritondse.py b/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
index cef28f34..58b506b6 100644
--- a/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
+++ b/custom_mutators/aflpp_tritondse/aflpp_tritondse.py
@@ -120,6 +120,10 @@ def init(seed):
         is_debug = True
     except KeyError:
         pass
+    if is_debug:
+        logging.basicConfig(level=logging.WARNING)
+    else:
+        logging.basicConfig(level=logging.CRITICAL)
     try:
         foo = os.environ['AFL_CUSTOM_INFO_OUT']
         out_path = foo + '/../tritondse/queue'
-- 
cgit 1.4.1