From 123d97bfb896aefca24ff8bdc235b900fe714fde Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 20 Sep 2019 18:37:16 +0200
Subject: LLVM_CONFIG llvm_mode fix

---
 docs/ChangeLog | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'docs/ChangeLog')

diff --git a/docs/ChangeLog b/docs/ChangeLog
index 4ea4e4b2..b32253b6 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -22,6 +22,8 @@ Version ++2.54d (dev):
     add AFL_CUSTOM_MUTATOR_ONLY (that will trigger the previous behaviour)
   - no more unlinking the input file, this way the input file can also be a
     FIFO or disk partition
+  - setting LLVM_CONFIG for llvm_mode will now again switch to the selected
+    llvm version. If you setup is correct.
   - reducing duplicate code in afl-fuzz
   - added "make help"
   - removed compile warnings from python internal stuff
-- 
cgit 1.4.1


From ff5c7b155ccb44c8a529167f411f3c9783b024fa Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 20 Sep 2019 19:20:15 +0200
Subject: custom mutator fuzzing yields UI

---
 docs/ChangeLog       | 1 +
 src/afl-fuzz-stats.c | 7 ++++---
 2 files changed, 5 insertions(+), 3 deletions(-)

(limited to 'docs/ChangeLog')

diff --git a/docs/ChangeLog b/docs/ChangeLog
index b32253b6..31101056 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -24,6 +24,7 @@ Version ++2.54d (dev):
     FIFO or disk partition
   - setting LLVM_CONFIG for llvm_mode will now again switch to the selected
     llvm version. If you setup is correct.
+  - fuzzing strategy yields for custom mutator were missing from the UI, added them :)
   - reducing duplicate code in afl-fuzz
   - added "make help"
   - removed compile warnings from python internal stuff
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index 803faced..5e773e96 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -576,12 +576,13 @@ void show_stats(void) {
                 "  imported : " cRST "%-10s" bSTG       bV "\n",
        tmp, sync_id ? DI(queued_imported) : (u8*)"n/a");
 
-  sprintf(tmp, "%s/%s, %s/%s, %s/%s", DI(stage_finds[STAGE_HAVOC]),
+  sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s", DI(stage_finds[STAGE_HAVOC]),
           DI(stage_cycles[STAGE_HAVOC]), DI(stage_finds[STAGE_SPLICE]),
           DI(stage_cycles[STAGE_SPLICE]), DI(stage_finds[STAGE_PYTHON]),
-          DI(stage_cycles[STAGE_PYTHON]));
+          DI(stage_cycles[STAGE_PYTHON]), DI(stage_finds[STAGE_CUSTOM_MUTATOR]),
+          DI(stage_cycles[STAGE_CUSTOM_MUTATOR]));
 
-  SAYF(bV bSTOP "       havoc : " cRST "%-36s " bSTG bV bSTOP, tmp);
+  SAYF(bV bSTOP "havoc/custom : " cRST "%-36s " bSTG bV bSTOP, tmp);
 
   if (t_bytes)
     sprintf(tmp, "%0.02f%%", stab_ratio);
-- 
cgit 1.4.1


From 6e6480c9527d397f7554614f1e52f5652580cc4b Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 20 Sep 2019 19:39:19 +0200
Subject: install libtokencap and libdislocator if present

---
 Makefile               |  2 ++
 TODO                   | 14 +++-----------
 docs/ChangeLog         |  2 ++
 libdislocator/Makefile |  6 +++---
 libtokencap/Makefile   |  6 +++---
 5 files changed, 13 insertions(+), 17 deletions(-)

(limited to 'docs/ChangeLog')

diff --git a/Makefile b/Makefile
index da4c5e95..0a654db7 100644
--- a/Makefile
+++ b/Makefile
@@ -280,6 +280,8 @@ endif
 	if [ -f compare-transform-pass.so ]; then set -e; install -m 755 compare-transform-pass.so $${DESTDIR}$(HELPER_PATH); fi
 	if [ -f split-compares-pass.so ]; then set -e; install -m 755 split-compares-pass.so $${DESTDIR}$(HELPER_PATH); fi
 	if [ -f split-switches-pass.so ]; then set -e; install -m 755 split-switches-pass.so $${DESTDIR}$(HELPER_PATH); fi
+	if [ -f libdislocator.so ]; then set -e; install -m 755 libdislocator.so $${DESTDIR}$(HELPER_PATH); fi
+	if [ -f libtokencap.so ]; then set -e; install -m 755 libtokencap.so $${DESTDIR}$(HELPER_PATH); fi
 	if [ -f libcompcov.so ]; then set -e; install -m 755 libcompcov.so $${DESTDIR}$(HELPER_PATH); fi
 
 	set -e; ln -sf afl-gcc $${DESTDIR}$(BIN_PATH)/afl-g++
diff --git a/TODO b/TODO
index 11dc523a..4aa3dc8b 100644
--- a/TODO
+++ b/TODO
@@ -1,14 +1,3 @@
-Roadmap 2.54d:
-==============
-
-afl-fuzz:
- - enable python mutator for MOpt
- - enable custom mutator for MOpt
- - add superion?
-
-remote feature
-
-
 
 Roadmap 2.55d:
 ==============
@@ -26,6 +15,9 @@ qemu_mode:
    Idea: The static analyzer outputs a map in which each edge that must be
    skipped is marked with 1. QEMU loads it at startup in the parent process.
 
+custom_mutators:
+ - rip what Superion is doing into custom mutators for js, php, etc.
+
 unit testing / or large testcase campaign
 
 
diff --git a/docs/ChangeLog b/docs/ChangeLog
index 31101056..fdf6422a 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -25,6 +25,8 @@ Version ++2.54d (dev):
   - setting LLVM_CONFIG for llvm_mode will now again switch to the selected
     llvm version. If you setup is correct.
   - fuzzing strategy yields for custom mutator were missing from the UI, added them :)
+  - libtokencap and libdislocator now compile to the afl_root directory and are
+    installed to the .../lib/afl directory when present during make install
   - reducing duplicate code in afl-fuzz
   - added "make help"
   - removed compile warnings from python internal stuff
diff --git a/libdislocator/Makefile b/libdislocator/Makefile
index 236667ec..cbaa05ea 100644
--- a/libdislocator/Makefile
+++ b/libdislocator/Makefile
@@ -24,15 +24,15 @@ CFLAGS      += -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign
 all: libdislocator.so
 
 libdislocator.so: libdislocator.so.c ../config.h
-	$(CC) $(CFLAGS) -shared -fPIC $< -o $@ $(LDFLAGS)
+	$(CC) $(CFLAGS) -shared -fPIC $< -o ../$@ $(LDFLAGS)
 
 .NOTPARALLEL: clean
 
 clean:
 	rm -f *.o *.so *~ a.out core core.[1-9][0-9]*
-	rm -f libdislocator.so
+	rm -f ../libdislocator.so
 
 install: all
-	install -m 755 libdislocator.so $${DESTDIR}$(HELPER_PATH)
+	install -m 755 ../libdislocator.so $${DESTDIR}$(HELPER_PATH)
 	install -m 644 README.dislocator $${DESTDIR}$(HELPER_PATH)
 
diff --git a/libtokencap/Makefile b/libtokencap/Makefile
index ec4c8f95..0faad511 100644
--- a/libtokencap/Makefile
+++ b/libtokencap/Makefile
@@ -24,15 +24,15 @@ CFLAGS      += -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign
 all: libtokencap.so
 
 libtokencap.so: libtokencap.so.c ../config.h
-	$(CC) $(CFLAGS) -shared -fPIC $< -o $@ $(LDFLAGS)
+	$(CC) $(CFLAGS) -shared -fPIC $< -o ../$@ $(LDFLAGS)
 
 .NOTPARALLEL: clean
 
 clean:
 	rm -f *.o *.so *~ a.out core core.[1-9][0-9]*
-	rm -f libtokencap.so
+	rm -f ../libtokencap.so
 
 install: all
-	install -m 755 libtokencap.so $${DESTDIR}$(HELPER_PATH)
+	install -m 755 ../libtokencap.so $${DESTDIR}$(HELPER_PATH)
 	install -m 644 README.tokencap $${DESTDIR}$(HELPER_PATH)
 
-- 
cgit 1.4.1


From e423e0a0f1cdbb0f3a369030d9c3f791b5ee139f Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sat, 21 Sep 2019 19:00:43 +0200
Subject: make tests

---
 Makefile       |  4 +++-
 docs/ChangeLog |  2 ++
 test/test.sh   | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 79 insertions(+), 1 deletion(-)
 create mode 100755 test/test.sh

(limited to 'docs/ChangeLog')

diff --git a/Makefile b/Makefile
index 0a654db7..5d9a55a6 100644
--- a/Makefile
+++ b/Makefile
@@ -80,6 +80,8 @@ endif
 
 all:	test_x86 test_shm test_python27 ready $(PROGS) afl-as test_build all_done
 
+tests:
+	@cd test ; ./test.sh
 
 help:
 	@echo "HELP --- the following make targets exist:"
@@ -296,7 +298,7 @@ endif
 	cp -r testcases/ $${DESTDIR}$(MISC_PATH)
 	cp -r dictionaries/ $${DESTDIR}$(MISC_PATH)
 
-publish: clean
+#publish: clean
 #	test "`basename $$PWD`" = "afl" || exit 1
 #	test -f ~/www/afl/releases/$(PROGNAME)-$(VERSION).tgz; if [ "$$?" = "0" ]; then echo; echo "Change program version in config.h, mmkay?"; echo; exit 1; fi
 #	cd ..; rm -rf $(PROGNAME)-$(VERSION); cp -pr $(PROGNAME) $(PROGNAME)-$(VERSION); \
diff --git a/docs/ChangeLog b/docs/ChangeLog
index fdf6422a..7beb32c3 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -25,6 +25,8 @@ Version ++2.54d (dev):
   - setting LLVM_CONFIG for llvm_mode will now again switch to the selected
     llvm version. If you setup is correct.
   - fuzzing strategy yields for custom mutator were missing from the UI, added them :)
+  - added "make tests" which will perform checks to see that all functionality
+    is working as expected. this is currently the starting point, its not complete :)
   - libtokencap and libdislocator now compile to the afl_root directory and are
     installed to the .../lib/afl directory when present during make install
   - reducing duplicate code in afl-fuzz
diff --git a/test/test.sh b/test/test.sh
new file mode 100755
index 00000000..3b70509a
--- /dev/null
+++ b/test/test.sh
@@ -0,0 +1,74 @@
+#!/bin/bash
+
+#
+# Ensure we have: test, type, diff -q, echo -e, grep -qE
+#
+test -z "" 2> /dev/null || { echo Error: test command not found ; exit 1 ; }
+GREP=`type grep > /dev/null 2>&1 && echo OK`
+test "$GREP" = OK || { echo Error: grep command not found ; exit 1 ; }
+echo foobar | grep -aqE 'asd|oob' 2> /dev/null || { echo Error: grep command does not support -q, -a and/or -E option ; exit 1 ; }
+echo 1 > test.1
+echo 1 > test.2
+OK=OK
+diff -q test.1 test.2 >/dev/null 2>&1 || OK=
+rm -f test.1 test.2
+test -z "$OK" && { echo Error: diff -q is not working ; exit 1 ; }
+
+ECHO="echo -e"
+$ECHO '\x41' 2>&1 | grep -qE '^A' || {
+  ECHO=
+  test -e /bin/echo && {
+    ECHO="/bin/echo -e"
+    $ECHO '\x41' 2>&1 | grep -qE '^A' || ECHO=
+  }
+}
+test -z "$ECHO" && { echo Error: echo command does not support -e option ; exit 1 ; }
+
+GREY="\\x1b[1;90m"
+GREEN="\\x1b[0;32m"
+RED="\\x1b[0;31m"
+YELLOW="\\x1b[1;93m"
+RESET="\\x1b[0m"
+
+$ECHO "$RESET"
+
+test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && {
+  ../afl-gcc -o test-instr.plain ../test-instr.c > /dev/null 2>&1
+  AFL_HARDEN=1 ../afl-gcc -o test-instr.harden ../test-instr.c > /dev/null 2>&1
+  test -e test-instr.plain && {
+    $ECHO "$GREEN[*] afl-gcc compilation succeeded"
+    echo 0 | ../afl-showmap -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
+    ../afl-showmap -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
+    test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
+      diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
+        $ECHO "$RED[!] afl-gcc instrumentation should be different on different input but is not"
+      } || $ECHO "$GREEN[*] afl-gcc instrumentation present and working correctly"
+    } || $ECHO "$RED[!] afl-gcc instrumentation failed"
+    rm -f test-instr.plain test-instr.plain.0 test-instr.plain.1
+  } || $ECHO "$RED[!] afl-gcc failed"
+  test -e test-instr.harden && {
+    grep -qa fstack-protector-all test-instr.harden > /dev/null 2>&1 && {
+      $ECHO "$GREEN[*] afl-gcc hardened mode succeeded and is working"
+    } || $ECHO "$RED[!] hardened mode is not hardened"
+    rm -f test-instr.harden
+  } || $ECHO "$RED[!] afl-gcc hardened mode compilation failed"
+  
+
+} || $ECHO "$YELLOW[-] afl is not compiled, cannot test"
+
+test -e ../afl-clang-fast && {
+  echo todo: llvm_mode
+
+
+} || $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test"
+
+test -e ../libtokencap.so && {
+  echo todo: libtokencap
+
+} || $ECHO "$YELLOW[-] libtokencap is not compiled, cannot test"
+
+$ECHO "$RESET"
+
+# libdislocator
+# unicorn
+# qemu
\ No newline at end of file
-- 
cgit 1.4.1


From b4ca95a9fafccd0506285000595ada5ed47f9ca3 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 22 Sep 2019 13:21:15 +0200
Subject: afl-fuzz mutation documentation feature

---
 Makefile               |  7 +++++++
 docs/ChangeLog         |  2 ++
 include/afl-fuzz.h     |  5 +++++
 src/afl-fuzz-globals.c |  4 ++++
 src/afl-fuzz-one.c     | 17 +++++++++++++++++
 src/afl-fuzz-run.c     | 12 ++++++++++++
 test/test.sh           |  8 ++++++++
 7 files changed, 55 insertions(+)

(limited to 'docs/ChangeLog')

diff --git a/Makefile b/Makefile
index d7309cff..35f58ac5 100644
--- a/Makefile
+++ b/Makefile
@@ -92,6 +92,8 @@ help:
 	@echo "distrib: everything (for both binary-only and source code fuzzing)"
 	@echo "install: installs everything you have compiled with the build option above"
 	@echo "clean: cleans everything. for qemu_mode and unicorn_mode it means it deletes all downloads as well"
+	@echo "tests: this runs the test framework. It is more catered for the developers, but if you run into problems this helps pinpointing the problem"
+	@echo "document: creates afl-fuzz-document which will only do one run and save all manipulated inputs into out/queue/mutations"
 	@echo "help: shows these build options :-)"
 	@echo "=========================================="
 	@echo "Recommended: \"distrib\" or \"source-only\", then \"install\""
@@ -176,6 +178,11 @@ afl-gotcpu: src/afl-gotcpu.c $(COMM_HDR) | test_x86
 	$(CC) $(CFLAGS) src/$@.c -o $@ $(LDFLAGS)
 
 
+# document all mutations and only do one run (use with only one input file!)
+document: include/afl-fuzz.h $(AFL_FUZZ_FILES) afl-common.o afl-sharedmem.o afl-forkserver.o $(COMM_HDR) | test_x86
+	$(CC) $(CFLAGS) $(AFL_FUZZ_FILES) -D_AFL_DOCUMENT_MUTATIONS afl-common.o afl-sharedmem.o afl-forkserver.o -o afl-fuzz-document $(LDFLAGS) $(PYFLAGS)
+
+
 code-format:
 	./.custom-format.py -i src/*.c
 	./.custom-format.py -i include/*.h
diff --git a/docs/ChangeLog b/docs/ChangeLog
index 7beb32c3..0f5bb99c 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -27,6 +27,8 @@ Version ++2.54d (dev):
   - fuzzing strategy yields for custom mutator were missing from the UI, added them :)
   - added "make tests" which will perform checks to see that all functionality
     is working as expected. this is currently the starting point, its not complete :)
+  - added mutation documentation feature ("make document"), creates afl-fuzz-document
+    and saves all mutations of the first run on the first file into out/queue/mutations
   - libtokencap and libdislocator now compile to the afl_root directory and are
     installed to the .../lib/afl directory when present during make install
   - reducing duplicate code in afl-fuzz
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 9536e06a..4912b3f0 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -682,5 +682,10 @@ static u64 get_cur_time_us(void) {
 
 }
 
+#ifdef _AFL_DOCUMENT_MUTATIONS
+  extern u8 do_document;
+  extern u32 document_counter;
+#endif
+
 #endif
 
diff --git a/src/afl-fuzz-globals.c b/src/afl-fuzz-globals.c
index 1358a1fb..01b242b8 100644
--- a/src/afl-fuzz-globals.c
+++ b/src/afl-fuzz-globals.c
@@ -259,3 +259,7 @@ PyObject *py_functions[PY_FUNC_COUNT];
 
 #endif
 
+#ifdef _AFL_DOCUMENT_MUTATIONS
+  u8 do_document;
+  u32 document_counter;
+#endif
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 59483b8f..1824f0b2 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -4231,6 +4231,7 @@ pacemaker_fuzzing:
 
 #define core_fuzzing(a) common_fuzzing((a), MOpt_globals_core)
 
+
 void pso_updating(void) {
 
   g_now += 1;
@@ -4310,6 +4311,22 @@ void pso_updating(void) {
 u8 fuzz_one(char** argv) {
 
   int key_val_lv = 0;
+
+#ifdef _AFL_DOCUMENT_MUTATIONS
+  if (do_document == 0) {
+    char *fn = alloc_printf("%s/mutations", out_dir);
+    if (fn) {
+      do_document = mkdir(fn, 0700); // if it exists we do not care
+      do_document = 1;
+      ck_free(fn);
+    } else
+      PFATAL("malloc()");
+  } else {
+    do_document = 2;
+    stop_soon = 2;
+  }
+#endif
+
   if (limit_time_sig == 0) {
 
     key_val_lv = fuzz_one_original(argv);
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index f2f663dc..220433fc 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -251,6 +251,18 @@ void write_to_testcase(void* mem, u32 len) {
 
   s32 fd = out_fd;
 
+#ifdef _AFL_DOCUMENT_MUTATIONS
+  s32 doc_fd;
+  char *fn = alloc_printf("%s/mutations/%09u:%s", out_dir, document_counter++, describe_op(0));
+  if (fn != NULL) {
+    if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600)) >= 0) {
+      if (write(doc_fd, mem, len) != len) PFATAL("write to mutation file failed: %s", fn);
+      close(doc_fd);
+    }
+    ck_free(fn);
+  }
+#endif
+
   if (out_file) {
 
     // unlink(out_file);                                     /* Ignore errors.
diff --git a/test/test.sh b/test/test.sh
index 5d67588a..d230cf71 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -27,10 +27,18 @@ test -z "$ECHO" && { echo Error: echo command does not support -e option ; exit
 
 export AFL_EXIT_WHEN_DONE=1
 export AFL_SKIP_CPUFREQ=1
+unset AFL_QUIET
 unset AFL_DEBUG
 unset AFL_HARDEN
+unset AFL_USE_ASAN
+unset AFL_USE_MSAN
+unset AFL_CC
+unset AFL_PRELOAD
 unset AFL_LLVM_WHITELIST
 unset AFL_LLVM_INSTRIM
+unset AFL_LLVM_LAF_SPLIT_SWITCHES
+unset AFL_LLVM_LAF_TRANSFORM_COMPARES
+unset AFL_LLVM_LAF_SPLIT_COMPARES
 
 GREY="\\x1b[1;90m"
 BLUE="\\x1b[1;94m"
-- 
cgit 1.4.1