From 97f5ce52d129c460e4a8af3d55aefd05092a79a9 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 15 Oct 2019 16:48:05 +0200
Subject: v2.57c release

---
 docs/ChangeLog | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

(limited to 'docs/ChangeLog')

diff --git a/docs/ChangeLog b/docs/ChangeLog
index 7ccc8b66..aafb7bff 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -13,12 +13,13 @@ Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
 
-----------------------
-Version ++2.54d (dev):
-----------------------
+--------------------------------
+Version ++2.54d-2.57c (release):
+--------------------------------
 
+  - we jump to 2.57 instead of 2.55 to catch up with Google's versioning
   - persistent mode for QEMU (see qemu_mode/README.md)
-  - custom mutator library is now a standard mutator, to exclusivly use it
+  - custom mutator library is now an additional mutator, to exclusivly use it
     add AFL_CUSTOM_MUTATOR_ONLY (that will trigger the previous behaviour)
   - new library qemu_mode/unsigaction which filters sigaction events
   - afl-fuzz: new command line option -I to execute a command on a new crash
-- 
cgit 1.4.1


From 1aec670c43f76c3cf5600a48f12e88c1fc79e07d Mon Sep 17 00:00:00 2001
From: hexcoder- <heiko@hexco.de>
Date: Wed, 16 Oct 2019 20:37:58 +0200
Subject: add forgotten floating point comparisons in laf-intel/llvm_mode

---
 docs/ChangeLog | 1 +
 1 file changed, 1 insertion(+)

(limited to 'docs/ChangeLog')

diff --git a/docs/ChangeLog b/docs/ChangeLog
index aafb7bff..8c799c44 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -42,6 +42,7 @@ Version ++2.54d-2.57c (release):
   - updated documentation
   - Wine mode to run Win32 binaries with the QEMU instrumentation (-W)
   - CompareCoverage for ARM target in QEMU/Unicorn
+  - laf-intel in llvm_mode now also handles floating point comparisons
 
 
 --------------------------
-- 
cgit 1.4.1


From 73da639654aa4e91220eb0adcbe380800b06a768 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 18 Oct 2019 08:25:43 +0200
Subject: revert patch

---
 docs/ChangeLog     | 7 +++++++
 src/afl-fuzz-run.c | 8 ++++----
 2 files changed, 11 insertions(+), 4 deletions(-)

(limited to 'docs/ChangeLog')

diff --git a/docs/ChangeLog b/docs/ChangeLog
index 8c799c44..f073123c 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -13,6 +13,13 @@ Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
 
+----------------------
+Version ++2.57d (dev):
+----------------------
+
+  - revertedd patch to not unlink and recreate the input file, it resulted in performance loss
+
+
 --------------------------------
 Version ++2.54d-2.57c (release):
 --------------------------------
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 46d12423..fc235b27 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -288,10 +288,10 @@ void write_to_testcase(void* mem, u32 len) {
 
   if (out_file) {
 
-    // unlink(out_file);                                     /* Ignore errors.
+    unlink(out_file);                                     /* Ignore errors.
     // */
 
-    fd = open(out_file, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+    fd = open(out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
 
     if (fd < 0) PFATAL("Unable to create '%s'", out_file);
 
@@ -331,10 +331,10 @@ void write_with_gap(void* mem, u32 len, u32 skip_at, u32 skip_len) {
 
   if (out_file) {
 
-    // unlink(out_file);                                     /* Ignore errors.
+    unlink(out_file);                                     /* Ignore errors.
     // */
 
-    fd = open(out_file, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+    fd = open(out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
 
     if (fd < 0) PFATAL("Unable to create '%s'", out_file);
 
-- 
cgit 1.4.1


From f4a74a3405d140e81111657ca28b994c5758286c Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 18 Oct 2019 10:10:47 +0200
Subject: added test/test-performance.sh

---
 docs/ChangeLog           |   3 +-
 test/test-performance.sh | 189 +++++++++++++++++++++++++++++++++++++++++++++++
 test/test.sh             |  15 ++--
 3 files changed, 199 insertions(+), 8 deletions(-)
 create mode 100755 test/test-performance.sh

(limited to 'docs/ChangeLog')

diff --git a/docs/ChangeLog b/docs/ChangeLog
index f073123c..9ffa17e3 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -17,7 +17,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
 Version ++2.57d (dev):
 ----------------------
 
-  - revertedd patch to not unlink and recreate the input file, it resulted in performance loss
+  - reverted patch to not unlink and recreate the input file, it resulted in performance loss
+  - added test/test-performance.sh script
 
 
 --------------------------------
diff --git a/test/test-performance.sh b/test/test-performance.sh
new file mode 100755
index 00000000..198b58c4
--- /dev/null
+++ b/test/test-performance.sh
@@ -0,0 +1,189 @@
+#!/bin/bash
+
+FILE=~/.afl_performance
+
+test -e $FILE || {
+  echo Warning: This script measure the performance of afl++ and saves the result for future comparisons into $FILE
+  echo Press ENTER to continue or CONTROL-C to abort
+  read IN
+}
+
+export AFL_QUIET=1
+unset AFL_EXIT_WHEN_DONE
+unset AFL_SKIP_CPUFREQ
+unset AFL_DEBUG
+unset AFL_HARDEN
+unset AFL_USE_ASAN
+unset AFL_USE_MSAN
+unset AFL_CC
+unset AFL_PRELOAD
+unset AFL_LLVM_WHITELIST
+unset AFL_LLVM_INSTRIM
+unset AFL_LLVM_LAF_SPLIT_SWITCHES
+unset AFL_LLVM_LAF_TRANSFORM_COMPARES
+unset AFL_LLVM_LAF_SPLIT_COMPARES
+
+# on OpenBSD we need to work with llvm from /usr/local/bin
+test -e /usr/local/bin/opt && {
+  export PATH=/usr/local/bin:${PATH}
+} 
+# on MacOS X we prefer afl-clang over afl-gcc, because
+# afl-gcc does not work there
+test `uname -s` = 'Darwin' -o `uname -s` = 'FreeBSD' && {
+  AFL_GCC=afl-clang
+} || {
+  AFL_GCC=afl-gcc
+}
+
+ECHO="printf %b\\n"
+$ECHO \\101 2>&1 | grep -qE '^A' || {
+  ECHO=
+  test -e /bin/printf && {
+    ECHO="/bin/printf %b\\n"
+    $ECHO '\\101' 2>&1 | grep -qE '^A' || ECHO=
+  }
+}
+test -z "$ECHO" && { printf Error: printf command does not support octal character codes ; exit 1 ; }
+
+GREY="\\033[1;90m"
+BLUE="\\033[1;94m"
+GREEN="\\033[0;32m"
+RED="\\033[0;31m"
+YELLOW="\\033[1;93m"
+RESET="\\033[0m"
+
+MEM_LIMIT=150
+
+>> $FILE || { echo Error: can not write to $FILE ; exit 1 ; }
+
+echo Warning: this script is setting performance parameters with afl-system-config
+sleep 1
+afl-system-config > /dev/null 2>&1
+echo Performance settings applied.
+echo
+
+$ECHO "${RESET}${GREY}[*] starting afl++ performance test framework ..."
+
+$ECHO "$BLUE[*] Testing: ${AFL_GCC}"
+GCC=x
+test -e ../${AFL_GCC} -a -e ../afl-fuzz && {
+  ../${AFL_GCC} -o test-instr.plain ../test-instr.c > /dev/null 2>&1
+  test -e test-instr.plain && {
+    $ECHO "$GREEN[+] ${AFL_GCC} compilation succeeded"
+    mkdir -p in
+    echo 0 > in/in
+    $ECHO "$GREY[*] running afl-fuzz for ${AFL_GCC} for 30 seconds"
+    {
+      ../afl-fuzz -V 30 -s 123 -m ${MEM_LIMIT} -i in -o out-gcc -- ./test-instr.plain
+    } >>errors 2>&1
+    test -n "$( ls out-gcc/queue/id:000002* 2> /dev/null )" && {
+      GCC=`grep execs_done out-gcc/fuzzer_stats | awk '{print$3}'`
+    } || {
+        echo CUT----------------------------------------------------------------
+        cat errors
+        echo CUT----------------------------------------------------------------
+      $ECHO "$RED[!] afl-fuzz is not working correctly with ${AFL_GCC}"
+    }
+    rm -rf in out-gcc errors test-instr.plain
+  } || $ECHO "$RED[!] ${AFL_GCC} instrumentation failed"
+} || $ECHO "$YELLOW[-] afl is not compiled, cannot test"
+
+$ECHO "$BLUE[*] Testing: llvm_mode"
+LLVM=x
+test -e ../afl-clang-fast -a -e ../afl-fuzz && {
+  ../afl-clang-fast -o test-instr.llvm ../test-instr.c > /dev/null 2>&1
+  test -e test-instr.llvm && {
+    $ECHO "$GREEN[+] llvm_mode compilation succeeded"
+    mkdir -p in
+    echo 0 > in/in
+    $ECHO "$GREY[*] running afl-fuzz for llvm_mode for 30 seconds"
+    {
+      ../afl-fuzz -V 30 -s 123 -m ${MEM_LIMIT} -i in -o out-llvm -- ./test-instr.llvm
+    } >>errors 2>&1
+    test -n "$( ls out-llvm/queue/id:000002* 2> /dev/null )" && {
+      LLVM=`grep execs_done out-llvm/fuzzer_stats | awk '{print$3}'`
+    } || {
+        echo CUT----------------------------------------------------------------
+        cat errors
+        echo CUT----------------------------------------------------------------
+      $ECHO "$RED[!] afl-fuzz is not working correctly with llvm_mode"
+    }
+    rm -rf in out-llvm errors test-instr.llvm
+  } || $ECHO "$RED[!] llvm_mode instrumentation failed"
+} || $ECHO "$YELLOW[-] llvm_mode is not compiled, cannot test"
+
+$ECHO "$BLUE[*] Testing: qemu_mode"
+QEMU=x
+test -e ../afl-qemu-trace -a -e ../afl-fuzz && {
+  cc -o test-instr.qemu ../test-instr.c > /dev/null 2>&1
+  test -e test-instr.qemu && {
+    $ECHO "$GREEN[+] native compilation with cc succeeded"
+    mkdir -p in
+    echo 0 > in/in
+    $ECHO "$GREY[*] running afl-fuzz for qemu_mode for 30 seconds"
+    {
+      ../afl-fuzz -Q -V 30 -s 123 -m ${MEM_LIMIT} -i in -o out-qemu -- ./test-instr.qemu
+    } >>errors 2>&1
+    test -n "$( ls out-qemu/queue/id:000002* 2> /dev/null )" && {
+      QEMU=`grep execs_done out-qemu/fuzzer_stats | awk '{print$3}'`
+    } || {
+        echo CUT----------------------------------------------------------------
+        cat errors
+        echo CUT----------------------------------------------------------------
+      $ECHO "$RED[!] afl-fuzz is not working correctly with qemu_mode"
+    }
+    rm -rf in out-qemu errors test-instr.qemu
+  } || $ECHO "$RED[!] qemu_mode instrumentation failed"
+} || $ECHO "$YELLOW[-] qemu_mode is not compiled, cannot test"
+
+LOW_GCC=
+HIGH_GCC=
+LAST_GCC=
+LOW_LLVM=
+HIGH_LLVM=
+LAST_LLVM=
+LOW_QEMU=
+HIGH_QEMU=
+LAST_QEMU=
+
+test -s $FILE && {
+  while read LINE; do
+    G=`echo $LINE | awk '{print$1}'`
+    L=`echo $LINE | awk '{print$2}'`
+    Q=`echo $LINE | awk '{print$3}'`
+    test "$G" = x && G=
+    test "$L" = x && L=
+    test "$Q" = x && Q=
+    test -n "$G" && LAST_GCC=$G
+    test -n "$L" && LAST_LLVM=$L
+    test -n "$Q" && LAST_QEMU=$Q
+    test -n "$G" -a -z "$LOW_GCC" && LOW_GCC=$G || {
+      test -n "$G" -a "$G" -lt "$LOW_GCC" 2> /dev/null && LOW_GCC=$G
+    }
+    test -n "$L" -a -z "$LOW_LLVM" && LOW_LLVM=$L || {
+      test -n "$L" -a "$L" -lt "$LOW_LLVM" 2> /dev/null && LOW_LLVM=$L
+    }
+    test -n "$Q" -a -z "$LOW_QEMU" && LOW_QEMU=$Q || {
+      test -n "$Q" -a "$Q" -lt "$LOW_QEMU" 2> /dev/null && LOW_QEMU=$Q
+    }   
+    test -n "$G" -a -z "$HIGH_GCC" && HIGH_GCC=$G || {
+      test -n "$G" -a "$G" -gt "$HIGH_GCC" 2> /dev/null && HIGH_GCC=$G
+    }
+    test -n "$L" -a -z "$HIGH_LLVM" && HIGH_LLVM=$L || {
+      test -n "$L" -a "$L" -gt "$HIGH_LLVM" 2> /dev/null && HIGH_LLVM=$L
+    }
+    test -n "$Q" -a -z "$HIGH_QEMU" && HIGH_QEMU=$Q || {
+      test -n "$Q" -a "$Q" -gt "$HIGH_QEMU" 2> /dev/null && HIGH_QEMU=$Q
+    }
+  done < $FILE
+  $ECHO "$YELLOW[!] Reading saved data from $FILE completed, please compare the results:"
+  $ECHO "$BLUE[!] afl-cc: lowest=$LOW_GCC highest=$HIGH_GCC last=$LAST_GCC current=$GCC"
+  $ECHO "$BLUE[!] llvm_mode: lowest=$LOW_LLVM highest=$HIGH_LLVM last=$LAST_LLVM current=$LLVM"
+  $ECHO "$BLUE[!] qemu_mode: lowest=$LOW_QEMU highest=$HIGH_QEMU last=$LAST_QEMU current=$QEMU"
+} || {
+  $ECHO "$YELLOW[!] First run, just saving data"
+  $ECHO "$BLUE[!] afl-gcc=$GCC  llvm_mode=$LLVM  qemu_mode=$QEMU"
+}
+echo "$GCC $LLVM $QEMU" >> $FILE
+$ECHO "$GREY[*] done."
+$ECHO "$RESET"
diff --git a/test/test.sh b/test/test.sh
index e93e19f8..ab2985fe 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -46,10 +46,11 @@ test -e /usr/local/bin/opt && {
 # on MacOS X we prefer afl-clang over afl-gcc, because
 # afl-gcc does not work there
 test `uname -s` = 'Darwin' -o `uname -s` = 'FreeBSD' && {
-AFL_GCC=afl-clang
+  AFL_GCC=afl-clang
 } || {
-AFL_GCC=afl-gcc
+  AFL_GCC=afl-gcc
 }
+
 GREY="\\033[1;90m"
 BLUE="\\033[1;94m"
 GREEN="\\033[0;32m"
@@ -102,9 +103,9 @@ test -e ../${AFL_GCC} -a -e ../afl-showmap -a -e ../afl-fuzz && {
     test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
       $ECHO "$GREEN[+] afl-fuzz is working correctly with ${AFL_GCC}"
     } || {
-        echo CUT------------------------------------------------------------------CUT
-        cat errors
-        echo CUT------------------------------------------------------------------CUT
+      echo CUT------------------------------------------------------------------CUT
+      cat errors
+      echo CUT------------------------------------------------------------------CUT
       $ECHO "$RED[!] afl-fuzz is not working correctly with ${AFL_GCC}"
     }
     rm -rf in out errors
@@ -116,9 +117,9 @@ $ECHO "$BLUE[*] Testing: llvm_mode"
 test -e ../afl-clang-fast && {
   # on FreeBSD need to set AFL_CC
   if which clang >/dev/null; then
-      export AFL_CC=`which clang`
+    export AFL_CC=`which clang`
   else
-      export AFL_CC=`llvm-config --bindir`/clang
+    export AFL_CC=`llvm-config --bindir`/clang
   fi
   ../afl-clang-fast -o test-instr.plain ../test-instr.c > /dev/null 2>&1
   AFL_HARDEN=1 ../afl-clang-fast -o test-compcov.harden test-compcov.c > /dev/null 2>&1
-- 
cgit 1.4.1


From bf544af690798436892b313de80855d348ad272c Mon Sep 17 00:00:00 2001
From: hexcoder- <heiko@hexco.de>
Date: Fri, 18 Oct 2019 21:21:17 +0200
Subject: new entries for gcc_plugin

---
 docs/ChangeLog | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'docs/ChangeLog')

diff --git a/docs/ChangeLog b/docs/ChangeLog
index 9ffa17e3..46b9e330 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -19,6 +19,8 @@ Version ++2.57d (dev):
 
   - reverted patch to not unlink and recreate the input file, it resulted in performance loss
   - added test/test-performance.sh script
+  - (re)added gcc_plugin, fast inline instrumentation is not yet finished
+  - added gcc_plugin tests
 
 
 --------------------------------
-- 
cgit 1.4.1


From be6bc155ebd891eebd21eac8982784e7f2be4f41 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 21 Oct 2019 11:28:32 +0200
Subject: v2.58c

---
 Makefile                       |  9 ++++++++-
 README.md                      | 18 +++++++++---------
 TODO                           |  5 +----
 docs/ChangeLog                 | 14 ++++++++------
 gcc_plugin/README.gcc.md       |  4 ----
 gcc_plugin/README.whitelist.md |  3 +--
 include/config.h               |  2 +-
 7 files changed, 28 insertions(+), 27 deletions(-)

(limited to 'docs/ChangeLog')

diff --git a/Makefile b/Makefile
index cfcd0890..87c7cdef 100644
--- a/Makefile
+++ b/Makefile
@@ -104,6 +104,13 @@ man:    $(MANPAGES)
 tests:	source-only
 	@cd test ; ./test.sh
 
+performance-tests:	performance-test
+test-performance:	performance-test
+
+performance-test:	source-only
+	@cd test ; ./test-performance.sh
+
+
 help:
 	@echo "HELP --- the following make targets exist:"
 	@echo "=========================================="
@@ -307,7 +314,7 @@ install: all $(MANPAGES)
 	install -m 755 $(PROGS) $(SH_PROGS) $${DESTDIR}$(BIN_PATH)
 	rm -f $${DESTDIR}$(BIN_PATH)/afl-as
 	if [ -f afl-qemu-trace ]; then install -m 755 afl-qemu-trace $${DESTDIR}$(BIN_PATH); fi
-	#if [ -f afl-gcc-fast ]; then set e; install -m 755 afl-gcc-fast $${DESTDIR}$(BIN_PATH); ln -sf afl-gcc-fast $${DESTDIR}$(BIN_PATH)/afl-g++-fast; install -m 755 afl-gcc-pass.so afl-gcc-rt.o $${DESTDIR}$(HELPER_PATH); fi
+	if [ -f afl-gcc-fast ]; then set e; install -m 755 afl-gcc-fast $${DESTDIR}$(BIN_PATH); ln -sf afl-gcc-fast $${DESTDIR}$(BIN_PATH)/afl-g++-fast; install -m 755 afl-gcc-pass.so afl-gcc-rt.o $${DESTDIR}$(HELPER_PATH); fi
 ifndef AFL_TRACE_PC
 	if [ -f afl-clang-fast -a -f libLLVMInsTrim.so -a -f afl-llvm-rt.o ]; then set -e; install -m 755 afl-clang-fast $${DESTDIR}$(BIN_PATH); ln -sf afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang-fast++; install -m 755 libLLVMInsTrim.so afl-llvm-pass.so afl-llvm-rt.o $${DESTDIR}$(HELPER_PATH); fi
 else
diff --git a/README.md b/README.md
index f0e6faef..4b9537d2 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,8 @@
 # american fuzzy lop plus plus (afl++)
 
-  Release Version: 2.57c 
+  Release Version: 2.58c 
 
-  Github Version: 2.57d
+  Github Version: 2.58d
 
   includes all necessary/interesting changes from Google's afl 2.56b
 
@@ -52,13 +52,13 @@
 
   A more thorough list is available in the PATCHES file.
 
-  | Feature/Instrumentation | LLVM | GCC | QEMU | Unicorn |
-  | ----------------------- |:----:|:---:|:----:| -------:|
-  | laf-intel / CompCov     |  x   |     |  x   |    x    |
-  | NeverZero               |  x(1)|  x  |  x   |    x    |
-  | Persistent mode         |  x   |     |  x   |         |
-  | Whitelist               |  x   |     |      |         |
-  | InsTrim                 |  x   |     |      |         |
+  | Feature/Instrumentation | AFL-GCC | LLVM_MODE | GCC_PLUGIN | QEMU_MODE | Unicorn |
+  | ----------------------- |:-------:|:---------:|:----------:|:---------:|:-------:|
+  | laf-intel / CompCov     |         |     x     |            |     x     |    x    |
+  | NeverZero               |    X    |     x(1)  |            |     x     |    x    |
+  | Persistent mode         |         |     x     |     X      |     x     |         |
+  | Whitelist               |         |     x     |     X      |           |         |
+  | InsTrim                 |         |     x     |            |           |         |
 
   (1) only in LLVM >= 9.0 due to a bug in llvm in previous versions
 
diff --git a/TODO b/TODO
index 3ca13d6e..f2642b1a 100644
--- a/TODO
+++ b/TODO
@@ -7,11 +7,8 @@ afl-fuzz:
  - test the libmutator actually works and does not run infinite (need an example though)
 
 gcc_plugin:
- - needs to be rewritten
- - whitelist support
- - skip over uninteresting blocks
- - laf-intel
  - neverZero
+ - laf-intel
 
 qemu_mode:
  - update to 4.x (probably this will be skipped :( )
diff --git a/docs/ChangeLog b/docs/ChangeLog
index 46b9e330..c2d46e4d 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -13,14 +13,16 @@ Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
 
-----------------------
-Version ++2.57d (dev):
-----------------------
+--------------------------
+Version ++2.58c (release):
+--------------------------
 
-  - reverted patch to not unlink and recreate the input file, it resulted in performance loss
+  - reverted patch to not unlink and recreate the input file, it resulted in
+    performance loss of ~10%
   - added test/test-performance.sh script
-  - (re)added gcc_plugin, fast inline instrumentation is not yet finished
-  - added gcc_plugin tests
+  - (re)added gcc_plugin, fast inline instrumentation is not yet finished,
+    however it includes the whitelisting and persistance feature! by hexcoder-
+  - gcc_plugin tests added to testing framework
 
 
 --------------------------------
diff --git a/gcc_plugin/README.gcc.md b/gcc_plugin/README.gcc.md
index 2e19e911..676ef427 100644
--- a/gcc_plugin/README.gcc.md
+++ b/gcc_plugin/README.gcc.md
@@ -156,7 +156,3 @@ depending on whether the input loop is being entered for the first time or
 executed again. To avoid spurious warnings, the feature implies
 AFL_NO_VAR_CHECK and hides the "variable path" warnings in the UI.
 
-PS. Because there are task switches still involved, the mode isn't as fast as
-"pure" in-process fuzzing offered, say, by LLVM's LibFuzzer; but it is a lot
-faster than the normal fork() model, and compared to in-process fuzzing,
-should be a lot more robust.
diff --git a/gcc_plugin/README.whitelist.md b/gcc_plugin/README.whitelist.md
index bcc02693..8ad2068d 100644
--- a/gcc_plugin/README.whitelist.md
+++ b/gcc_plugin/README.whitelist.md
@@ -6,8 +6,7 @@ Using afl++ with partial instrumentation
   that are interesting to you using the gcc instrumentation provided by
   afl++.
 
-  Originally developed by Christian Holler (:decoder) <choller@mozilla.com>, 
-  adapted to gcc plugin by hexcoder-.
+  Plugin by hexcoder-.
 
 
 ## 1) Description and purpose
diff --git a/include/config.h b/include/config.h
index 2e993a42..f121025d 100644
--- a/include/config.h
+++ b/include/config.h
@@ -26,7 +26,7 @@
 
 /* Version string: */
 
-#define VERSION "++2.57d"  // c = release, d = volatile github dev
+#define VERSION "++2.58c"  // c = release, d = volatile github dev
 
 /******************************************************
  *                                                    *
-- 
cgit 1.4.1


From 64fa11d204c13ad32f9fe0dbb9abbfedc00ebb3d Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 28 Oct 2019 11:52:31 +0100
Subject: updated changelog, afl-analyze AFL_SKIP_BIN_CHECK support

---
 docs/ChangeLog    | 13 +++++++++++++
 src/afl-analyze.c |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

(limited to 'docs/ChangeLog')

diff --git a/docs/ChangeLog b/docs/ChangeLog
index c2d46e4d..4c51502b 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -13,6 +13,19 @@ Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
 
+----------------------
+Version ++2.58d (dev):
+----------------------
+
+  - afl-analyze: added AFL_SKIP_BIN_CHECK support
+  - better random numbers for gcc_plugin and llvm_mode (thanks to devnexen)
+  - afl-fuzz: CPU affinity support for DragonFly
+  - llvm_mode: float splitting is now configured via AFL_LLVM_LAF_SPLIT_FLOATS
+  - libtokencap: support for *BSD/OSX added
+  - libcompcov floating point splitting support for qemu and unicorn
+  - removed unnecessary warnings
+
+
 --------------------------
 Version ++2.58c (release):
 --------------------------
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index 5555a262..ee281af8 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -987,7 +987,7 @@ int main(int argc, char** argv) {
   if (child_timed_out)
     FATAL("Target binary times out (adjusting -t may help).");
 
-  if (!anything_set()) FATAL("No instrumentation detected.");
+  if (getenv("AFL_SKIP_BIN_CHECK") == NULL && !anything_set()) FATAL("No instrumentation detected.");
 
   analyze(use_argv);
 
-- 
cgit 1.4.1


From 1c7b6a5e0590b4a34819fec3cdfe430d32b041d5 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 4 Nov 2019 13:10:52 +0100
Subject: travis

---
 .travis.yml              |   3 +-
 dictionaries/regexp.dict | 244 +++++++++++++++++++++++++++++++++++++++++++++++
 docs/ChangeLog           |   1 +
 test/test.sh             | 162 ++++++++++++++++++++++++-------
 4 files changed, 376 insertions(+), 34 deletions(-)
 create mode 100644 dictionaries/regexp.dict

(limited to 'docs/ChangeLog')

diff --git a/.travis.yml b/.travis.yml
index 87b3ef04..00d58853 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,8 +9,7 @@ env:
 
 before_install:
   - sudo apt update
-  - sudo apt install -y libtool libtool-bin automake bison libglib2.0 build-essential clang gcc-8 gcc-8-plugin-dev libc++-8-dev
-# libc++-7-dev
+  - sudo apt install -y libtool libtool-bin automake bison libglib2.0 build-essential clang gcc-7 gcc-7-plugin-dev libc++-7-dev
 
 script:
   - gcc -v
diff --git a/dictionaries/regexp.dict b/dictionaries/regexp.dict
new file mode 100644
index 00000000..957d18e2
--- /dev/null
+++ b/dictionaries/regexp.dict
@@ -0,0 +1,244 @@
+#
+# AFL dictionary for JS regex
+# ---------------------------
+#
+# Contains various regular expressions.
+#
+# Created by Yang Guo <yangguo@chromium.org>
+# 
+# Contributed by Dhiraj Mishra <dhiraj@inputzero.io>
+#
+"?"
+"abc"
+"()"
+"[]"
+"abc|def"
+"abc|def|ghi"
+"^xxx$"
+"ab\\b\\d\\bcd"
+"\\w|\\d"
+"a*?"
+"abc+"
+"abc+?"
+"xyz?"
+"xyz??"
+"xyz{0,1}"
+"xyz{0,1}?"
+"xyz{93}"
+"xyz{1,32}"
+"xyz{1,32}?"
+"xyz{1,}"
+"xyz{1,}?"
+"a\\fb\\nc\\rd\\te\\vf"
+"a\\nb\\bc"
+"/^\d*\./"
+"(?:foo)"
+"(?: foo )"
+"foo|(bar|baz)|quux"
+"foo(?=bar)baz"
+"foo(?!bar)baz"
+"foo(?<=bar)baz"
+"foo(?<!bar)baz"
+"()"
+"(?=)"
+"[]"
+"[x]"
+"[xyz]"
+"[a-zA-Z0-9]"
+"[-123]"
+"[^123]"
+"]"
+"}"
+"[a-b-c]"
+"[x\\dz]"
+"[\\d-z]"
+"[\\d-\\d]"
+"[z-\\d]"
+"\\cj\\cJ\\ci\\cI\\ck\\cK"
+"\\c!"
+"\\c_"
+"\\c~"
+"[\\c!]"
+"[\\c_]"
+"[\\c~]"
+"[\\ca]"
+"[\\cz]"
+"[\\cA]"
+"[\\cZ]"
+"[\\c1]"
+"\\[\\]\\{\\}\\(\\)\\%\\^\\#\\ "
+"[\\[\\]\\{\\}\\(\\)\\%\\^\\#\\ ]"
+"\\8"
+"\\9"
+"\\11"
+"\\11a"
+"\\011"
+"\\118"
+"\\111"
+"\\1111"
+"(x)(x)(x)\\1"
+"(x)(x)(x)\\2"
+"(x)(x)(x)\\3"
+"(x)(x)(x)\\4"
+"(x)(x)(x)\\1*"
+"(x)(x)(x)\\3*"
+"(x)(x)(x)\\4*"
+"(x)(x)(x)(x)(x)(x)(x)(x)(x)(x)\\10"
+"(x)(x)(x)(x)(x)(x)(x)(x)(x)(x)\\11"
+"(a)\\1"
+"(a\\1)"
+"(\\1a)"
+"(\\2)(\\1)"
+"(?=a){0,10}a"
+"(?=a){1,10}a"
+"(?=a){9,10}a"
+"(?!a)?a"
+"\\1(a)"
+"(?!(a))\\1"
+"(?!\\1(a\\1)\\1)\\1"
+"\\1\\2(a(?:\\1(b\\1\\2))\\2)\\1"
+"[\\0]"
+"[\\11]"
+"[\\11a]"
+"[\\011]"
+"[\\00011]"
+"[\\118]"
+"[\\111]"
+"[\\1111]"
+"\\x60"
+"\\x3z"
+"\\c"
+"\\u0034"
+"\\u003z"
+"foo[z]*"
+"\\u{12345}"
+"\\u{12345}\\u{23456}"
+"\\u{12345}{3}"
+"\\u{12345}*"
+"\\ud808\\udf45*"
+"[\\ud808\\udf45-\\ud809\\udccc]"
+"a"
+"a|b"
+"a\\n"
+"a$"
+"a\\b!"
+"a\\Bb"
+"a*?"
+"a?"
+"a??"
+"a{0,1}?"
+"a{1,2}?"
+"a+?"
+"(a)"
+"(a)\\1"
+"(\\1a)"
+"\\1(a)"
+"a\\s"
+"a\\S"
+"a\\D"
+"a\\w"
+"a\\W"
+"a."
+"a\\q"
+"a[a]"
+"a[^a]"
+"a[a-z]"
+"a(?:b)"
+"a(?=b)"
+"a(?!b)"
+"\\x60"
+"\\u0060"
+"\\cA"
+"\\q"
+"\\1112"
+"(a)\\1"
+"(?!a)?a\\1"
+"(?:(?=a))a\\1"
+"a{}"
+"a{,}"
+"a{"
+"a{z}"
+"a{12z}"
+"a{12,"
+"a{12,3b"
+"{}"
+"{,}"
+"{"
+"{z}"
+"{1z}"
+"{12,"
+"{12,3b"
+"a"
+"abc"
+"a[bc]d"
+"a|bc"
+"ab|c"
+"a||bc"
+"(?:ab)"
+"(?:ab|cde)"
+"(?:ab)|cde"
+"(ab)"
+"(ab|cde)"
+"(ab)\\1"
+"(ab|cde)\\1"
+"(?:ab)?"
+"(?:ab)+"
+"a?"
+"a+"
+"a??"
+"a*?"
+"a+?"
+"(?:a?)?"
+"(?:a+)?"
+"(?:a?)+"
+"(?:a*)+"
+"(?:a+)+"
+"(?:a?)*"
+"(?:a*)*"
+"(?:a+)*"
+"a{0}"
+"(?:a+){0,0}"
+"a*b"
+"a+b"
+"a*b|c"
+"a+b|c"
+"(?:a{5,1000000}){3,1000000}"
+"(?:ab){4,7}"
+"a\\bc"
+"a\\sc"
+"a\\Sc"
+"a(?=b)c"
+"a(?=bbb|bb)c"
+"a(?!bbb|bb)c"
+"\xe2\x81\xa3"
+"[\xe2\x81\xa3]"
+"\xed\xb0\x80"
+"\xed\xa0\x80"
+"(\xed\xb0\x80)\x01"
+"((\xed\xa0\x80))\x02"
+"\xf0\x9f\x92\xa9"
+"\x01"
+"\x0f"
+"[-\xf0\x9f\x92\xa9]+"
+"[\xf0\x9f\x92\xa9-\xf4\x8f\xbf\xbf]"
+"\[DataMember\((.+?)\)\]"
+"/\d{1,2}\/\d{1,2}\/\d{4}/"
+"a*b\+\|[0-9]\|\d{1,9}"
+"(?<=)"
+"(?<=a)"
+"(?<!)"
+"(?<!a)"
+"(?<a>)"
+"(?<a>.)"
+"(?<a>.)\\k<a>"
+"\\p{Script=Greek}"
+"\\P{sc=Greek}"
+"\\p{Script_Extensions=Greek}"
+"\\P{scx=Greek}"
+"\\p{General_Category=Decimal_Number}"
+"\\P{gc=Decimal_Number}"
+"\\p{gc=Nd}"
+"\\P{Decimal_Number}"
+"\\p{Nd}"
+"\\P{Any}"
+"\\p{Changes_When_NFKC_Casefolded}"
diff --git a/docs/ChangeLog b/docs/ChangeLog
index 4c51502b..3a5961ad 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -23,6 +23,7 @@ Version ++2.58d (dev):
   - llvm_mode: float splitting is now configured via AFL_LLVM_LAF_SPLIT_FLOATS
   - libtokencap: support for *BSD/OSX added
   - libcompcov floating point splitting support for qemu and unicorn
+  - ripped regex.dictionary from Google afl PR
   - removed unnecessary warnings
 
 
diff --git a/test/test.sh b/test/test.sh
index 2d5c5e39..f954776f 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -24,6 +24,8 @@ $ECHO \\101 2>&1 | grep -qE '^A' || {
 }
 test -z "$ECHO" && { printf Error: printf command does not support octal character codes ; exit 1 ; }
 
+CODE=0
+
 export AFL_EXIT_WHEN_DONE=1
 export AFL_SKIP_CPUFREQ=1
 export AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
@@ -75,16 +77,26 @@ test -e ../${AFL_GCC} -a -e ../afl-showmap -a -e ../afl-fuzz && {
     test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
       diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
         $ECHO "$RED[!] ${AFL_GCC} instrumentation should be different on different input but is not"
+        CODE=1
       } || $ECHO "$GREEN[+] ${AFL_GCC} instrumentation present and working correctly"
-    } || $ECHO "$RED[!] ${AFL_GCC} instrumentation failed"
+    } || {
+      $ECHO "$RED[!] ${AFL_GCC} instrumentation failed"
+      CODE=1
+    }
     rm -f test-instr.plain.0 test-instr.plain.1
   } || $ECHO "$RED[!] ${AFL_GCC} failed"
   test -e test-compcov.harden && {
     grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && {
       $ECHO "$GREEN[+] ${AFL_GCC} hardened mode succeeded and is working"
-    } || $ECHO "$RED[!] ${AFL_GCC} hardened mode is not hardened"
+    } || {
+      $ECHO "$RED[!] ${AFL_GCC} hardened mode is not hardened"
+      CODE=1
+    }
     rm -f test-compcov.harden
-  } || $ECHO "$RED[!] ${AFL_GCC} hardened mode compilation failed"
+  } || { 
+    $ECHO "$RED[!] ${AFL_GCC} hardened mode compilation failed"
+    CODE=1
+  }
   # now we want to be sure that afl-fuzz is working  
   # make sure core_pattern is set to core on linux
   (test "$(uname -s)" = "Linux" && test "$(sysctl kernel.core_pattern)" != "kernel.core_pattern = core" && {
@@ -109,6 +121,7 @@ test -e ../${AFL_GCC} -a -e ../afl-showmap -a -e ../afl-fuzz && {
       cat errors
       echo CUT------------------------------------------------------------------CUT
       $ECHO "$RED[!] afl-fuzz is not working correctly with ${AFL_GCC}"
+      CODE=1
     }
     rm -rf in out errors
   }
@@ -132,16 +145,29 @@ test -e ../afl-clang-fast && {
     test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
       diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
         $ECHO "$RED[!] llvm_mode instrumentation should be different on different input but is not"
+        CODE=1
       } || $ECHO "$GREEN[+] llvm_mode instrumentation present and working correctly"
-    } || $ECHO "$RED[!] llvm_mode instrumentation failed"
+    } || { 
+      $ECHO "$RED[!] llvm_mode instrumentation failed"
+      CODE=1
+    }
     rm -f test-instr.plain.0 test-instr.plain.1
-  } || $ECHO "$RED[!] llvm_mode failed"
+  } || {
+    $ECHO "$RED[!] llvm_mode failed"
+    CODE=1
+  }
   test -e test-compcov.harden && {
     grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && {
       $ECHO "$GREEN[+] llvm_mode hardened mode succeeded and is working"
-    } || $ECHO "$RED[!] llvm_mode hardened mode is not hardened"
+    } || {
+      $ECHO "$RED[!] llvm_mode hardened mode is not hardened"
+      CODE=1
+    }
     rm -f test-compcov.harden
-  } || $ECHO "$RED[!] llvm_mode hardened mode compilation failed"
+  } || { 
+    $ECHO "$RED[!] llvm_mode hardened mode compilation failed"
+    CODE=1
+  }
   # now we want to be sure that afl-fuzz is working  
   (test "$(uname -s)" = "Linux" && test "$(sysctl kernel.core_pattern)" != "kernel.core_pattern = core" && {
     $ECHO "$YELLOW[!] we should not run afl-fuzz with enabled core dumps. Run 'sudo sh afl-system-config'.$RESET"
@@ -150,6 +176,7 @@ test -e ../afl-clang-fast && {
   # make sure crash reporter is disabled on Mac OS X
   (test "$(uname -s)" = "Darwin" && test $(launchctl list 2>/dev/null | grep -q '\.ReportCrash$') && {
     $ECHO "$RED[!] we cannot run afl-fuzz with enabled crash reporter. Run 'sudo sh afl-system-config'.$RESET"
+    CODE=1
     true
   }) || {
     mkdir -p in
@@ -165,6 +192,7 @@ test -e ../afl-clang-fast && {
       cat errors
       echo CUT------------------------------------------------------------------CUT
       $ECHO "$RED[!] afl-fuzz is not working correctly with llvm_mode"
+      CODE=1
     }
     rm -rf in out errors
   }
@@ -175,30 +203,54 @@ test -e ../afl-clang-fast && {
   test -e test-compcov.instrim && {
     grep -Eq " [1-3] location" test.out && {
       $ECHO "$GREEN[+] llvm_mode InsTrim feature works correctly"
-    } || $ECHO "$RED[!] llvm_mode InsTrim feature failed"
-  } || $ECHO "$RED[!] llvm_mode InsTrim feature compilation failed"
+    } || {
+      $ECHO "$RED[!] llvm_mode InsTrim feature failed"
+      CODE=1
+    }
+  } || {
+    $ECHO "$RED[!] llvm_mode InsTrim feature compilation failed"
+    CODE=1
+  }
   rm -f test-compcov.instrim test.out
   AFL_LLVM_LAF_SPLIT_SWITCHES=1 AFL_LLVM_LAF_TRANSFORM_COMPARES=1 AFL_LLVM_LAF_SPLIT_COMPARES=1 ../afl-clang-fast -o test-compcov.compcov test-compcov.c > /dev/null 2> test.out
   test -e test-compcov.compcov && {
     grep -Eq " [3-9][0-9] location" test.out && {
       $ECHO "$GREEN[+] llvm_mode laf-intel/compcov feature works correctly"
-    } || $ECHO "$RED[!] llvm_mode laf-intel/compcov feature failed"
-  } || $ECHO "$RED[!] llvm_mode laf-intel/compcov feature compilation failed"
+    } || {
+      $ECHO "$RED[!] llvm_mode laf-intel/compcov feature failed"
+      CODE=1
+    }
+  } || {
+    $ECHO "$RED[!] llvm_mode laf-intel/compcov feature compilation failed"
+    CODE=1
+  }
   rm -f test-compcov.compcov test.out
   echo foobar.c > whitelist.txt
   AFL_LLVM_WHITELIST=whitelist.txt ../afl-clang-fast -o test-compcov test-compcov.c > test.out 2>&1
   test -e test-compcov && {
     grep -q "No instrumentation targets found" test.out && {
       $ECHO "$GREEN[+] llvm_mode whitelist feature works correctly"
-    } || $ECHO "$RED[!] llvm_mode whitelist feature failed"
-  } || $ECHO "$RED[!] llvm_mode whitelist feature compilation failed"
+    } || {
+      $ECHO "$RED[!] llvm_mode whitelist feature failed"
+      CODE=1
+    }
+  } || { 
+    $ECHO "$RED[!] llvm_mode whitelist feature compilation failed"
+    CODE=1
+  }
   rm -f test-compcov test.out whitelist.txt
   ../afl-clang-fast -o test-persistent ../experimental/persistent_demo/persistent_demo.c > /dev/null 2>&1
   test -e test-persistent && {
     echo foo | ../afl-showmap -o /dev/null -q -r ./test-persistent && {
       $ECHO "$GREEN[+] llvm_mode persistent mode feature works correctly"
-    } || $ECHO "$RED[!] llvm_mode persistent mode feature failed to work"
-  } || $ECHO "$RED[!] llvm_mode persistent mode feature compilation failed"
+    } || {
+      $ECHO "$RED[!] llvm_mode persistent mode feature failed to work"
+      CODE=1
+    }
+  } || {
+    $ECHO "$RED[!] llvm_mode persistent mode feature compilation failed"
+    CODE=1
+  }
   rm -f test-persistent
 } || $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test"
 
@@ -214,17 +266,32 @@ test -e ../afl-gcc-fast && {
     test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
       diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
         $ECHO "$RED[!] gcc_plugin instrumentation should be different on different input but is not"
-      } || $ECHO "$GREEN[+] gcc_plugin instrumentation present and working correctly"
-    } || $ECHO "$RED[!] gcc_plugin instrumentation failed"
+        CODE=1
+      } || { 
+        $ECHO "$GREEN[+] gcc_plugin instrumentation present and working correctly"
+      }
+    } || {
+      $ECHO "$RED[!] gcc_plugin instrumentation failed"
+      CODE=1
+    }
     rm -f test-instr.plain.0 test-instr.plain.1
-  } || $ECHO "$RED[!] gcc_plugin failed"
+  } || {
+    $ECHO "$RED[!] gcc_plugin failed"
+    CODE=1
+  }
 
   test -e test-compcov.harden.gccpi && {
     grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden.gccpi > /dev/null 2>&1 && {
       $ECHO "$GREEN[+] gcc_plugin hardened mode succeeded and is working"
-    } || $ECHO "$RED[!] gcc_plugin hardened mode is not hardened"
+    } || {
+      $ECHO "$RED[!] gcc_plugin hardened mode is not hardened"
+      CODE=1
+    }
     rm -f test-compcov.harden.gccpi
-  } || $ECHO "$RED[!] gcc_plugin hardened mode compilation failed"
+  } || {
+    $ECHO "$RED[!] gcc_plugin hardened mode compilation failed"
+    CODE=1
+  }
   # now we want to be sure that afl-fuzz is working  
   (test "$(uname -s)" = "Linux" && test "$(sysctl kernel.core_pattern)" != "kernel.core_pattern = core" && {
     $ECHO "$YELLOW[!] we should not run afl-fuzz with enabled core dumps. Run 'sudo sh afl-system-config'.$RESET"
@@ -233,6 +300,7 @@ test -e ../afl-gcc-fast && {
   # make sure crash reporter is disabled on Mac OS X
   (test "$(uname -s)" = "Darwin" && test $(launchctl list 2>/dev/null | grep -q '\.ReportCrash$') && {
     $ECHO "$RED[!] we cannot run afl-fuzz with enabled crash reporter. Run 'sudo sh afl-system-config'.$RESET"
+    CODE=1
     true
   }) || {
     mkdir -p in
@@ -248,6 +316,7 @@ test -e ../afl-gcc-fast && {
       cat errors
       echo CUT------------------------------------------------------------------CUT
       $ECHO "$RED[!] afl-fuzz is not working correctly with gcc_plugin"
+      CODE=1
     }
     rm -rf in out errors
   }
@@ -259,15 +328,27 @@ test -e ../afl-gcc-fast && {
   test -e test-compcov && {
     echo 1 | ../afl-showmap -m ${MEM_LIMIT} -o - -r -- ./test-compcov 2>&1 | grep -q "Captured 1 tuples" && {
       $ECHO "$GREEN[+] gcc_plugin whitelist feature works correctly"
-    } || $ECHO "$RED[!] gcc_plugin whitelist feature failed"
-  } || $ECHO "$RED[!] gcc_plugin whitelist feature compilation failed"
+    } || { 
+      $ECHO "$RED[!] gcc_plugin whitelist feature failed"
+      CODE=1
+    }
+  } || { 
+    $ECHO "$RED[!] gcc_plugin whitelist feature compilation failed"
+    CODE=1
+  }
   rm -f test-compcov test.out whitelist.txt
   ../afl-gcc-fast -o test-persistent ../experimental/persistent_demo/persistent_demo.c > /dev/null 2>&1
   test -e test-persistent && {
     echo foo | ../afl-showmap -o /dev/null -q -r ./test-persistent && {
       $ECHO "$GREEN[+] gcc_plugin persistent mode feature works correctly"
-    } || $ECHO "$RED[!] gcc_plugin persistent mode feature failed to work"
-  } || $ECHO "$RED[!] gcc_plugin persistent mode feature compilation failed"
+    } || {
+      $ECHO "$RED[!] gcc_plugin persistent mode feature failed to work"
+      CODE=1
+    }
+  } || {
+    $ECHO "$RED[!] gcc_plugin persistent mode feature compilation failed"
+    CODE=1
+  }
   rm -f test-persistent
 } || $ECHO "$YELLOW[-] gcc_plugin not compiled, cannot test"
 
@@ -277,7 +358,10 @@ test -e ../libtokencap.so && {
   AFL_TOKEN_FILE=token.out LD_PRELOAD=../libtokencap.so DYLD_INSERT_LIBRARIES=../libtokencap.so DYLD_FORCE_FLAT_NAMESPACE=1 ./test-compcov foobar > /dev/null 2>&1
   grep -q BUGMENOT token.out > /dev/null 2>&1 && {
     $ECHO "$GREEN[+] libtokencap did successfully capture tokens"
-  } || $ECHO "$RED[!] libtokencap did not capture tokens"
+  } || { 
+    $ECHO "$RED[!] libtokencap did not capture tokens"
+    CODE=1
+  }
   rm -f token.out
 } || $ECHO "$YELLOW[-] libtokencap is not compiled, cannot test"
 test -e ../libdislocator.so && {
@@ -288,6 +372,7 @@ test -e ../libdislocator.so && {
   } > /dev/null 2>&1
   grep -q BUFFEROVERFLOW test.out > /dev/null 2>&1 && {
     $ECHO "$RED[!] libdislocator did not detect the memory corruption"
+    CODE=1
   } || $ECHO "$GREEN[+] libdislocator did successfully detect the memory corruption" 
   rm -f test.out core test-compcov.core core.test-compcov
 } || $ECHO "$YELLOW[-] libdislocator is not compiled, cannot test"
@@ -313,6 +398,7 @@ test -e ../afl-qemu-trace && {
         cat errors
         echo CUT------------------------------------------------------------------CUT
         $ECHO "$RED[!] afl-fuzz is not working correctly with qemu_mode"
+        CODE=1
       }
       rm -f errors
 
@@ -330,6 +416,7 @@ test -e ../afl-qemu-trace && {
           cat errors
           echo CUT------------------------------------------------------------------CUT
           $ECHO "$RED[!] afl-fuzz is not working correctly with qemu_mode libcompcov"
+          CODE=1
         }
       } || $ECHO "$YELLOW[-] we cannot test qemu_mode libcompcov because it is not present"
       rm -f errors
@@ -359,12 +446,16 @@ test -e ../afl-qemu-trace && {
         cat errors
         echo CUT------------------------------------------------------------------CUT
         $ECHO "$RED[!] afl-fuzz is not working correctly with persistent qemu_mode"
+        CODE=1
         exit 1
       }
       $ECHO "$YELLOW[?] we need a test case for qemu_mode unsigaction library"
       rm -rf in out errors
     }
-  } || $ECHO "$RED[-] gcc compilation of test targets failed - what is going on??"
+  } || {
+    $ECHO "$RED[-] gcc compilation of test targets failed - what is going on??"
+    CODE=1
+  }
   
   rm -f test-instr test-compcov
 } || $ECHO "$YELLOW[-] qemu_mode is not compiled, cannot test"
@@ -379,9 +470,9 @@ test -d ../unicorn_mode/unicorn && {
       mkdir -p in
       echo 0 > in/in
       $ECHO "$GREY[*] Using python binary $PY"
-      $ECHO "$GREY[*] running afl-fuzz for unicorn_mode, this will take approx 20 seconds"
+      $ECHO "$GREY[*] running afl-fuzz for unicorn_mode, this will take approx 25 seconds"
       {
-        ../afl-fuzz -V20 -U -i in -o out -d -- "$PY" ../unicorn_mode/samples/simple/simple_test_harness.py @@ >>errors 2>&1
+        ../afl-fuzz -V25 -U -i in -o out -d -- "$PY" ../unicorn_mode/samples/simple/simple_test_harness.py @@ >>errors 2>&1
       } >>errors 2>&1
       test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
         $ECHO "$GREEN[+] afl-fuzz is working correctly with unicorn_mode"
@@ -390,13 +481,14 @@ test -d ../unicorn_mode/unicorn && {
         cat errors
         echo CUT------------------------------------------------------------------CUT
         $ECHO "$RED[!] afl-fuzz is not working correctly with unicorn_mode"
+        CODE=1
       }
       rm -f errors
 
-      $ECHO "$GREY[*] running afl-fuzz for unicorn_mode compcov, this will take approx 25 seconds"
+      $ECHO "$GREY[*] running afl-fuzz for unicorn_mode compcov, this will take approx 35 seconds"
       {
         export AFL_COMPCOV_LEVEL=2
-        ../afl-fuzz -V25 -U -i in -o out -d -- "$PY" ../unicorn_mode/samples/compcov_x64/compcov_test_harness.py @@ >>errors 2>&1
+        ../afl-fuzz -V35 -U -i in -o out -d -- "$PY" ../unicorn_mode/samples/compcov_x64/compcov_test_harness.py @@ >>errors 2>&1
       } >>errors 2>&1
       test -n "$( ls out/queue/id:000001* 2> /dev/null )" && {
         $ECHO "$GREEN[+] afl-fuzz is working correctly with unicorn_mode compcov"
@@ -405,12 +497,18 @@ test -d ../unicorn_mode/unicorn && {
         cat errors
         echo CUT------------------------------------------------------------------CUT
         $ECHO "$RED[!] afl-fuzz is not working correctly with unicorn_mode compcov"
+        CODE=1
       }
       rm -rf in out errors
     }
-  } || $ECHO "$RED[-] missing sample binaries in unicorn_mode/samples/ - what is going on??"
+  } || {
+    $ECHO "$RED[-] missing sample binaries in unicorn_mode/samples/ - what is going on??"
+    CODE=1
+  }
   
 } || $ECHO "$YELLOW[-] unicorn_mode is not compiled, cannot test"
 
 $ECHO "$GREY[*] all test cases completed.$RESET"
-
+test "$CODE" = "0" && $ECHO "$GREEN[+] all tests were successful :-)$RESET"
+test "$CODE" = "0" || $ECHO "$RED[-] failure in tests :-($RESET"
+exit $CODE
-- 
cgit 1.4.1


From dede2e976400cec53099ab42fa3f4fa73e324d2c Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 5 Nov 2019 09:16:04 +0100
Subject: dockerfile additions

---
 Dockerfile     | 4 +++-
 README.md      | 8 ++++++++
 docs/ChangeLog | 1 +
 3 files changed, 12 insertions(+), 1 deletion(-)

(limited to 'docs/ChangeLog')

diff --git a/Dockerfile b/Dockerfile
index 7defa8e9..558968d8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,6 @@
 FROM ubuntu:eoan
+MAINTAINER David Carlier <devnexen@gmail.com>
+LABEL "about"="AFLplusplus docker image"
 RUN apt-get update && apt-get install -y --no-install-recommends \
     automake \
     bison \
@@ -22,4 +24,4 @@ COPY . .
 ENV CC=gcc-9
 ENV CXX=g++-9
 ENV LLVM_CONFIG=llvm-config-9
-RUN make clean && make distrib && make tests
+RUN make clean && make distrib && make install
diff --git a/README.md b/README.md
index e8d4e6a8..583b7df8 100644
--- a/README.md
+++ b/README.md
@@ -115,6 +115,14 @@ afl++ binaries by passing the STATIC=1 argument to make:
 $ make all STATIC=1
 ```
 
+Note that afl++ is faster and better the newer the compilers used.
+Hence gcc-9 and especially llvm-9 should be the compilers of choice.
+If your distribution does not have them, you can use the Dockerfile:
+
+```shell
+$ docker build -t aflplusplus
+```
+
 
 ## 1) Challenges of guided fuzzing
 
diff --git a/docs/ChangeLog b/docs/ChangeLog
index 3a5961ad..3924226e 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -23,6 +23,7 @@ Version ++2.58d (dev):
   - llvm_mode: float splitting is now configured via AFL_LLVM_LAF_SPLIT_FLOATS
   - libtokencap: support for *BSD/OSX added
   - libcompcov floating point splitting support for qemu and unicorn
+  - Dockerfile by courtesy of devnexen
   - ripped regex.dictionary from Google afl PR
   - removed unnecessary warnings
 
-- 
cgit 1.4.1


From 499f078c3759a22dd5cfd81d2271969f19b75090 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 7 Nov 2019 11:48:39 +0100
Subject: f*ckin travis

---
 docs/ChangeLog                        | 2 ++
 qemu_mode/build_qemu_support.sh       | 5 ++++-
 unicorn_mode/build_unicorn_support.sh | 5 ++++-
 3 files changed, 10 insertions(+), 2 deletions(-)

(limited to 'docs/ChangeLog')

diff --git a/docs/ChangeLog b/docs/ChangeLog
index 3924226e..7bc6dec4 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -25,6 +25,8 @@ Version ++2.58d (dev):
   - libcompcov floating point splitting support for qemu and unicorn
   - Dockerfile by courtesy of devnexen
   - ripped regex.dictionary from Google afl PR
+  - qemu and unicorn download scripts now try to download until the full
+    download succeeded. f*ckin travis fails downloading 40% of the time!
   - removed unnecessary warnings
 
 
diff --git a/qemu_mode/build_qemu_support.sh b/qemu_mode/build_qemu_support.sh
index 6b9f91f9..c3983aa1 100755
--- a/qemu_mode/build_qemu_support.sh
+++ b/qemu_mode/build_qemu_support.sh
@@ -100,7 +100,10 @@ if [ ! "$CKSUM" = "$QEMU_SHA384" ]; then
 
   echo "[*] Downloading QEMU ${VERSION} from the web..."
   rm -f "$ARCHIVE"
-  wget -O "$ARCHIVE" -- "$QEMU_URL" || exit 1
+  OK=
+  while [ -z "$OK" ]; do
+    wget -c -O "$ARCHIVE" -- "$QEMU_URL" && OK=1
+  done
 
   CKSUM=`sha384sum -- "$ARCHIVE" 2>/dev/null | cut -d' ' -f1`
 
diff --git a/unicorn_mode/build_unicorn_support.sh b/unicorn_mode/build_unicorn_support.sh
index 3bd404b8..fdbcda62 100755
--- a/unicorn_mode/build_unicorn_support.sh
+++ b/unicorn_mode/build_unicorn_support.sh
@@ -106,7 +106,10 @@ if [ ! "$CKSUM" = "$UNICORN_SHA384" ]; then
 
   echo "[*] Downloading Unicorn v1.0.1 from the web..."
   rm -f "$ARCHIVE"
-  wget -O "$ARCHIVE" -- "$UNICORN_URL" || exit 1
+  OK=
+  while [ -z "$OK" ]; do
+    wget -c -O "$ARCHIVE" -- "$UNICORN_URL" && OK=1
+  done
 
   CKSUM=`sha384sum -- "$ARCHIVE" 2>/dev/null | cut -d' ' -f1`
 
-- 
cgit 1.4.1