From bc2e65e4821ef4b8fbc33be6c705adfa1c32e02f Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Wed, 29 Apr 2020 15:18:03 +0200
Subject: added afl_network_proxy

---
 examples/afl_network_proxy/afl-network-client.c | 299 ++++++++++++++++++++++++
 1 file changed, 299 insertions(+)
 create mode 100644 examples/afl_network_proxy/afl-network-client.c

(limited to 'examples/afl_network_proxy/afl-network-client.c')

diff --git a/examples/afl_network_proxy/afl-network-client.c b/examples/afl_network_proxy/afl-network-client.c
new file mode 100644
index 00000000..bf89fc04
--- /dev/null
+++ b/examples/afl_network_proxy/afl-network-client.c
@@ -0,0 +1,299 @@
+/*
+   american fuzzy lop++ - afl-network-client
+   ---------------------------------------
+
+   Written by Marc Heuse <mh@mh-sec.de>
+
+   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+*/
+
+#ifdef __ANDROID__
+#include "android-ashmem.h"
+#endif
+#include "config.h"
+#include "types.h"
+#include "debug.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <unistd.h>
+#include <string.h>
+#include <assert.h>
+#include <stdint.h>
+#include <errno.h>
+
+#include <netinet/in.h>
+#include <netinet/ip6.h>
+#include <arpa/inet.h>
+#include <sys/mman.h>
+#include <sys/shm.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netdb.h>
+#include <fcntl.h>
+
+u8 *__afl_area_ptr;
+
+#ifdef __ANDROID__
+u32 __afl_map_size = MAP_SIZE;
+#else
+__thread u32 __afl_map_size = MAP_SIZE;
+#endif
+
+/* Error reporting to forkserver controller */
+
+void send_forkserver_error(int error) {
+
+  u32 status;
+  if (!error || error > 0xffff) return;
+  status = (FS_OPT_ERROR | FS_OPT_SET_ERROR(error));
+  if (write(FORKSRV_FD + 1, (char *)&status, 4) != 4) return;
+
+}
+
+/* SHM setup. */
+
+static void __afl_map_shm(void) {
+
+  char *id_str = getenv(SHM_ENV_VAR);
+  char *ptr;
+
+  if ((ptr = getenv("AFL_MAP_SIZE")) != NULL) {
+
+    u32 val = atoi(ptr);
+    if (val > 0) __afl_map_size = val;
+
+  }
+
+  if (__afl_map_size > MAP_SIZE) {
+
+    if (__afl_map_size > FS_OPT_MAX_MAPSIZE) {
+
+      fprintf(stderr,
+              "Error: AFL++ tools *require* to set AFL_MAP_SIZE to %u to "
+              "be able to run this instrumented program!\n",
+              __afl_map_size);
+      if (id_str) {
+
+        send_forkserver_error(FS_ERROR_MAP_SIZE);
+        exit(-1);
+
+      }
+
+    } else {
+
+      fprintf(stderr,
+              "Warning: AFL++ tools will need to set AFL_MAP_SIZE to %u to "
+              "be able to run this instrumented program!\n",
+              __afl_map_size);
+
+    }
+
+  }
+
+  if (id_str) {
+
+#ifdef USEMMAP
+    const char *   shm_file_path = id_str;
+    int            shm_fd = -1;
+    unsigned char *shm_base = NULL;
+
+    /* create the shared memory segment as if it was a file */
+    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
+    if (shm_fd == -1) {
+
+      fprintf(stderr, "shm_open() failed\n");
+      send_forkserver_error(FS_ERROR_SHM_OPEN);
+      exit(1);
+
+    }
+
+    /* map the shared memory segment to the address space of the process */
+    shm_base =
+        mmap(0, __afl_map_size, PROT_READ | PROT_WRITE, MAP_SHARED, shm_fd, 0);
+
+    if (shm_base == MAP_FAILED) {
+
+      close(shm_fd);
+      shm_fd = -1;
+
+      fprintf(stderr, "mmap() failed\n");
+      send_forkserver_error(FS_ERROR_MMAP);
+      exit(2);
+
+    }
+
+    __afl_area_ptr = shm_base;
+#else
+    u32 shm_id = atoi(id_str);
+
+    __afl_area_ptr = shmat(shm_id, 0, 0);
+
+#endif
+
+    if (__afl_area_ptr == (void *)-1) {
+
+      send_forkserver_error(FS_ERROR_SHMAT);
+      exit(1);
+
+    }
+
+    /* Write something into the bitmap so that the parent doesn't give up */
+
+    __afl_area_ptr[0] = 1;
+
+  }
+
+}
+
+/* Fork server logic. */
+
+static void __afl_start_forkserver(void) {
+
+  u8  tmp[4] = {0, 0, 0, 0};
+  u32 status = 0;
+
+  if (__afl_map_size <= FS_OPT_MAX_MAPSIZE)
+    status |= (FS_OPT_SET_MAPSIZE(__afl_map_size) | FS_OPT_MAPSIZE);
+  if (status) status |= (FS_OPT_ENABLED);
+  memcpy(tmp, &status, 4);
+
+  /* Phone home and tell the parent that we're OK. */
+
+  if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
+
+}
+
+static u32 __afl_next_testcase(u8 *buf, u32 max_len) {
+
+  s32 status, res = 0xffffff;
+
+  /* Wait for parent by reading from the pipe. Abort if read fails. */
+  if (read(FORKSRV_FD, &status, 4) != 4) return 0;
+
+  /* we have a testcase - read it */
+  status = read(0, buf, max_len);
+
+  /* report that we are starting the target */
+  if (write(FORKSRV_FD + 1, &res, 4) != 4) return 0;
+
+  if (status < 1)
+    return 0;
+  else
+    return status;
+
+}
+
+static void __afl_end_testcase(void) {
+
+  int status = 0xffffff;
+
+  if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(1);
+
+}
+
+/* you just need to modify the while() loop in this main() */
+
+int main(int argc, char *argv[]) {
+
+  u8 *            interface, *buf, *ptr;
+  s32             s = -1;
+  struct addrinfo hints, *hres, *aip;
+  u32             len, max_len = 65536;
+
+  if (argc < 3 || argc > 4) {
+
+    printf("Syntax: %s host port [max-input-size]\n\n", argv[0]);
+    printf("Requires host and port of the remote afl-proxy-server instance.\n");
+    printf(
+        "IPv4 and IPv6 are supported, also binding to an interface with "
+        "\"%%\"\n");
+    printf("The max-input-size default is %u.\n", max_len);
+    printf(
+        "The default map size is %u and can be changed with setting "
+        "AFL_MAP_SIZE.\n",
+        __afl_map_size);
+    exit(-1);
+
+  }
+
+  if ((interface = index(argv[1], '%')) != NULL) *interface++ = 0;
+
+  if (argc > 3)
+    if ((max_len = atoi(argv[3])) < 0)
+      FATAL("max-input-size may not be negative or larger than 2GB: %s",
+            argv[3]);
+
+  if ((ptr = getenv("AFL_MAP_SIZE")) != NULL)
+    if ((__afl_map_size = atoi(ptr)) < 8)
+      FATAL("illegal map size, may not be < 8 or >= 2^30: %s", ptr);
+
+  if ((buf = malloc(max_len)) == NULL)
+    PFATAL("can not allocate %u memory", max_len);
+
+  memset(&hints, 0, sizeof(hints));
+  hints.ai_socktype = SOCK_STREAM;
+  hints.ai_family = PF_UNSPEC;
+
+  if (getaddrinfo(argv[1], argv[2], &hints, &hres) != 0)
+    PFATAL("could not resolve target %s", argv[1]);
+
+  for (aip = hres; aip != NULL && s == -1; aip = aip->ai_next) {
+
+    if ((s = socket(aip->ai_family, aip->ai_socktype, aip->ai_protocol)) >= 0) {
+
+#ifdef SO_BINDTODEVICE
+      if (interface != NULL)
+        if (setsockopt(s, SOL_SOCKET, SO_BINDTODEVICE, interface,
+                       strlen(interface) + 1) < 0)
+          fprintf(stderr, "Warning: could not bind to device %s\n", interface);
+#else
+      fprintf(stderr,
+              "Warning: binding to interface is not supported for your OS\n");
+#endif
+      if (connect(s, aip->ai_addr, aip->ai_addrlen) == -1) s = -1;
+
+    }
+
+  }
+
+  if (s == -1)
+    FATAL("could not connect to target tcp://%s:%s", argv[1], argv[2]);
+
+  /* we initialize the shared memory map and start the forkserver */
+  __afl_map_shm();
+  __afl_start_forkserver();
+
+  int i = 1, j;
+  //fprintf(stderr, "Waiting for first testcase\n");
+  while ((len = __afl_next_testcase(buf, max_len)) > 0) {
+
+    //fprintf(stderr, "Sending testcase with len %u\n", len);
+    if (send(s, &len, 4, 0) != 4) PFATAL("sending size data %d failed", len);
+    if (send(s, buf, len, 0) != len) PFATAL("sending test data failed");
+
+    int received = 0, ret;
+    while (received < __afl_map_size && (ret = recv(s, __afl_area_ptr + received, __afl_map_size - received, 0)) > 0)
+      received += ret;
+    if (received != __afl_map_size)
+      FATAL("did not receive valid data (%d, %d)", received, ret);
+    //fprintf(stderr, "Received coverage\n");
+
+    /* report the test case is done and wait for the next */
+    __afl_end_testcase();
+    //fprintf(stderr, "Waiting for next testcase %d\n", ++i);
+
+  }
+
+  return 0;
+
+}
-- 
cgit 1.4.1


From fced3e00cedf1fe4a100c20dc64ee7e4f3bc3223 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Wed, 29 Apr 2020 20:44:30 +0200
Subject: wip: afl-untracer

---
 examples/afl_network_proxy/afl-network-client.c |  13 +-
 examples/afl_network_proxy/afl-network-server.c |  33 +-
 examples/afl_proxy/afl-proxy.c                  |   9 +-
 examples/afl_untracer/Makefile                  |   7 +
 examples/afl_untracer/README.md                 |  11 +
 examples/afl_untracer/afl-untracer.c            | 581 ++++++++++++++++++++++++
 examples/afl_untracer/ida_get_patchpoints.py    |  52 +++
 7 files changed, 681 insertions(+), 25 deletions(-)
 create mode 100644 examples/afl_untracer/Makefile
 create mode 100644 examples/afl_untracer/README.md
 create mode 100644 examples/afl_untracer/afl-untracer.c
 create mode 100644 examples/afl_untracer/ida_get_patchpoints.py

(limited to 'examples/afl_network_proxy/afl-network-client.c')

diff --git a/examples/afl_network_proxy/afl-network-client.c b/examples/afl_network_proxy/afl-network-client.c
index bf89fc04..ede2ff8d 100644
--- a/examples/afl_network_proxy/afl-network-client.c
+++ b/examples/afl_network_proxy/afl-network-client.c
@@ -274,26 +274,29 @@ int main(int argc, char *argv[]) {
   __afl_start_forkserver();
 
   int i = 1, j;
-  //fprintf(stderr, "Waiting for first testcase\n");
+  // fprintf(stderr, "Waiting for first testcase\n");
   while ((len = __afl_next_testcase(buf, max_len)) > 0) {
 
-    //fprintf(stderr, "Sending testcase with len %u\n", len);
+    // fprintf(stderr, "Sending testcase with len %u\n", len);
     if (send(s, &len, 4, 0) != 4) PFATAL("sending size data %d failed", len);
     if (send(s, buf, len, 0) != len) PFATAL("sending test data failed");
 
     int received = 0, ret;
-    while (received < __afl_map_size && (ret = recv(s, __afl_area_ptr + received, __afl_map_size - received, 0)) > 0)
+    while (received < __afl_map_size &&
+           (ret = recv(s, __afl_area_ptr + received, __afl_map_size - received,
+                       0)) > 0)
       received += ret;
     if (received != __afl_map_size)
       FATAL("did not receive valid data (%d, %d)", received, ret);
-    //fprintf(stderr, "Received coverage\n");
+    // fprintf(stderr, "Received coverage\n");
 
     /* report the test case is done and wait for the next */
     __afl_end_testcase();
-    //fprintf(stderr, "Waiting for next testcase %d\n", ++i);
+    // fprintf(stderr, "Waiting for next testcase %d\n", ++i);
 
   }
 
   return 0;
 
 }
+
diff --git a/examples/afl_network_proxy/afl-network-server.c b/examples/afl_network_proxy/afl-network-server.c
index dc0e00a2..1bd37560 100644
--- a/examples/afl_network_proxy/afl-network-server.c
+++ b/examples/afl_network_proxy/afl-network-server.c
@@ -118,7 +118,7 @@ static s32 write_to_file(u8 *path, u8 *mem, u32 len) {
    1 if they should be kept. */
 
 static u8 run_target(afl_forkserver_t *fsrv, char **argv, u8 *mem, u32 len,
-                          u8 first_run) {
+                     u8 first_run) {
 
   afl_fsrv_write_to_testcase(fsrv, mem, len);
 
@@ -333,31 +333,30 @@ static void usage(u8 *argv0) {
 
 }
 
-
 int recv_testcase(int s, void **buf, size_t *max_len) {
 
   int size, received = 0, ret;
-  
+
   while (received < 4 && (ret = recv(s, &size + received, 4 - received, 0)) > 0)
     received += ret;
 
-  if (received != 4)
-    FATAL("did not receive size information");
-  if (size < 1)
-    FATAL("did not receive valid size information");
-  //fprintf(stderr, "received size information of %d\n", size);
+  if (received != 4) FATAL("did not receive size information");
+  if (size < 1) FATAL("did not receive valid size information");
+  // fprintf(stderr, "received size information of %d\n", size);
 
   *buf = maybe_grow(buf, max_len, size);
-  //fprintf(stderr, "receiving testcase %p %p max %u\n", buf, *buf, *max_len);
+  // fprintf(stderr, "receiving testcase %p %p max %u\n", buf, *buf, *max_len);
   received = 0;
-  while (received < size && (ret = recv(s, ((char*)*buf) + received, size - received, 0)) > 0)
+  while (received < size &&
+         (ret = recv(s, ((char *)*buf) + received, size - received, 0)) > 0)
     received += ret;
 
   if (received != size)
     FATAL("did not receive testcase data %u != %u, %d", received, size, ret);
 
-  //fprintf(stderr, "received testcase\n");
+  // fprintf(stderr, "received testcase\n");
   return size;
+
 }
 
 /* Main entry point */
@@ -372,7 +371,7 @@ int main(int argc, char **argv_orig, char **envp) {
   int                 addrlen = sizeof(clientaddr);
   char                str[INET6_ADDRSTRLEN];
   char **             argv = argv_cpy_dup(argc, argv_orig);
-  
+
   afl_forkserver_t  fsrv_var = {0};
   afl_forkserver_t *fsrv = &fsrv_var;
   afl_fsrv_init(fsrv);
@@ -514,7 +513,7 @@ int main(int argc, char **argv_orig, char **envp) {
   sharedmem_t shm = {0};
   fsrv->trace_bits = afl_shm_init(&shm, map_size, 0);
 
-  in_data = maybe_grow((void**)&in_data, &max_len, 65536);
+  in_data = maybe_grow((void **)&in_data, &max_len, 65536);
 
   atexit(at_exit_handler);
   setup_signal_handlers();
@@ -575,17 +574,17 @@ int main(int argc, char **argv_orig, char **envp) {
   if ((s = accept(sock, NULL, NULL)) < 0) { PFATAL("accept() failed"); }
   fprintf(stderr, "Received connection, starting ...\n");
 
-  while ((in_len = recv_testcase(s, (void**)&in_data, &max_len)) > 0) {
+  while ((in_len = recv_testcase(s, (void **)&in_data, &max_len)) > 0) {
 
-    //fprintf(stderr, "received %u\n", in_len);
+    // fprintf(stderr, "received %u\n", in_len);
     run_target(fsrv, use_argv, in_data, in_len, 1);
 
     if (send(s, fsrv->trace_bits, fsrv->map_size, 0) != fsrv->map_size)
       FATAL("could not send coverage data");
-    //fprintf(stderr, "sent result\n");
+    // fprintf(stderr, "sent result\n");
 
   }
-  
+
   unlink(out_file);
   if (out_file) { ck_free(out_file); }
   out_file = NULL;
diff --git a/examples/afl_proxy/afl-proxy.c b/examples/afl_proxy/afl-proxy.c
index eea03549..36121e17 100644
--- a/examples/afl_proxy/afl-proxy.c
+++ b/examples/afl_proxy/afl-proxy.c
@@ -178,7 +178,7 @@ static void __afl_start_forkserver(void) {
 
 static u32 __afl_next_testcase(u8 *buf, u32 max_len) {
 
-  s32 status;
+  s32 status, res = 0xffffff;
 
   /* Wait for parent by reading from the pipe. Abort if read fails. */
   if (read(FORKSRV_FD, &status, 4) != 4) return 0;
@@ -186,6 +186,9 @@ static u32 __afl_next_testcase(u8 *buf, u32 max_len) {
   /* we have a testcase - read it */
   status = read(0, buf, max_len);
 
+  /* report that we are starting the target */
+  if (write(FORKSRV_FD + 1, &res, 4) != 4) return 0;
+
   if (status < 1)
     return 0;
   else
@@ -206,12 +209,12 @@ static void __afl_end_testcase(void) {
 int main(int argc, char *argv[]) {
 
   /* This is were the testcase data is written into */
-  u8  buf[1024];
+  u8  buf[1024];  // this is the maximum size for a test case! set it!
   u32 len;
 
   /* here you specify the map size you need that you are reporting to
      afl-fuzz. */
-  __afl_map_size = MAP_SIZE;
+  __afl_map_size = MAP_SIZE;  // default is 65536
 
   /* then we initialize the shared memory map and start the forkserver */
   __afl_map_shm();
diff --git a/examples/afl_untracer/Makefile b/examples/afl_untracer/Makefile
new file mode 100644
index 00000000..ea20ebc0
--- /dev/null
+++ b/examples/afl_untracer/Makefile
@@ -0,0 +1,7 @@
+all:	afl-untracer
+
+afl-untracer:	afl-untracer.c
+	$(CC) -I../../include -g -o afl-untracer afl-untracer.c -ldl
+
+clean:
+	rm -f afl-untracer *~ core
diff --git a/examples/afl_untracer/README.md b/examples/afl_untracer/README.md
new file mode 100644
index 00000000..90798028
--- /dev/null
+++ b/examples/afl_untracer/README.md
@@ -0,0 +1,11 @@
+# afl-untracer
+
+afl-untracer is an example skeleton file which can easily be used to fuzz
+a closed source library.
+
+It is faster and requires less memory than qemu_mode however it is way
+more course grained and does not provide interesting features like compcov
+or cmplog.
+
+Read and modify afl-untracer.c then `make` and use it as the afl-fuzz target
+(or even remote via afl-network-proxy).
diff --git a/examples/afl_untracer/afl-untracer.c b/examples/afl_untracer/afl-untracer.c
new file mode 100644
index 00000000..112573e2
--- /dev/null
+++ b/examples/afl_untracer/afl-untracer.c
@@ -0,0 +1,581 @@
+/*
+   american fuzzy lop++ - afl-untracer skeleton example
+   ---------------------------------------------------
+
+   Written by Marc Heuse <mh@mh-sec.de>
+
+   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+
+   HOW-TO
+   ======
+
+   You only need to change the following:
+
+   1. decide if you want to receive data from stdin [DEFAULT] or file(name)
+      -> use_stdin = 0 if via file, and what the maximum input size is
+   2. dl load the library you want to fuzz, lookup the functions you need
+      and setup the calls to these
+   3. in the while loop you call the functions in the necessary order -
+      incl the cleanup. the cleanup is important!
+
+   Just look these steps up in the code, look for "// STEP x:"
+
+
+*/
+
+#define __USE_GNU
+#define _GNU_SOURCE
+
+#ifdef __ANDROID__
+#include "android-ashmem.h"
+#endif
+#include "config.h"
+#include "types.h"
+#include "debug.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <unistd.h>
+#include <string.h>
+#include <assert.h>
+#include <stdint.h>
+#include <errno.h>
+#include <dlfcn.h>
+#include <fcntl.h>
+
+#include <sys/mman.h>
+#include <sys/shm.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+
+#if defined(__linux__)
+#include <sys/ucontext.h>
+#elif defined(__APPLE__) && defined(__LP64__)
+#include <mach-o/dyld_images.h>
+#else
+#error "Unsupproted platform"
+#endif
+
+#define MEMORY_MAP_DECREMENT 0x200000000000
+#define MAX_LIB_COUNT 128
+
+#ifdef __ANDROID__
+u32 __afl_map_size = MAP_SIZE;
+#else
+__thread u32 __afl_map_size = MAP_SIZE;
+#endif
+
+u8  __afl_dummy[MAP_SIZE];
+u8 *__afl_area_ptr = __afl_dummy;
+
+typedef struct library_list {
+
+  u8 *name;
+  u64 addr_start, addr_end;
+
+} library_list_t;
+
+library_list_t liblist[MAX_LIB_COUNT];
+u32            liblist_cnt;
+u32            use_stdin = 1;
+
+static void sigtrap_handler(int signum, siginfo_t *si, void *context);
+
+/* read the library information */
+void read_library_information() {
+
+#if defined(__linux__)
+  FILE *f;
+  u8    buf[1024], *b, *m, *e, *n;
+
+  if ((f = fopen("/proc/self/maps", "r")) == NULL)
+    FATAL("cannot open /proc/self/maps");
+
+  fprintf(stderr, "Library list:\n");
+  while (fgets(buf, sizeof(buf), f)) {
+
+    if (strstr(buf, " r-xp ")) {
+
+      if (liblist_cnt >= MAX_LIB_COUNT) {
+
+        WARNF("too many libraries to old, maximum count of %d reached",
+              liblist_cnt);
+        return;
+
+      }
+
+      b = buf;
+      m = index(buf, '-');
+      e = index(buf, ' ');
+      if ((n = rindex(buf, '/')) == NULL) n = rindex(buf, ' ');
+      if (n &&
+          ((*n >= '0' && *n <= '9') || *n == '[' || *n == '{' || *n == '('))
+        n = NULL;
+      else
+        n++;
+      if (b && m && e && n && *n) {
+
+        *m++ = 0;
+        *e = 0;
+        if (n[strlen(n) - 1] == '\n') n[strlen(n) - 1] = 0;
+
+        liblist[liblist_cnt].name = strdup(n);
+        liblist[liblist_cnt].addr_start = strtoull(b, NULL, 16);
+        liblist[liblist_cnt].addr_end = strtoull(m, NULL, 16);
+        fprintf(stderr, "%s:%x (%x-%x)\n", liblist[liblist_cnt].name,
+                liblist[liblist_cnt].addr_end - liblist[liblist_cnt].addr_start,
+                liblist[liblist_cnt].addr_start, liblist[liblist_cnt].addr_end);
+        liblist_cnt++;
+
+      }
+
+    }
+
+  }
+
+  fprintf(stderr, "\n");
+
+#endif
+
+}
+
+library_list_t *find_library(char *name) {
+
+#if defined(__linux__)
+  u32 i;
+
+  for (i = 0; i < liblist_cnt; i++)
+    if (strncmp(liblist[i].name, name, strlen(name)) == 0) return &liblist[i];
+#elif defined(__APPLE__) && defined(__LP64__)
+  kern_return_t         err;
+  static library_list_t lib;
+
+  // get the list of all loaded modules from dyld
+  // the task_info mach API will get the address of the dyld all_image_info
+  // struct for the given task from which we can get the names and load
+  // addresses of all modules
+  task_dyld_info_data_t  task_dyld_info;
+  mach_msg_type_number_t count = TASK_DYLD_INFO_COUNT;
+  err = task_info(mach_task_self(), TASK_DYLD_INFO,
+                  (task_info_t)&task_dyld_info, &count);
+
+  const struct dyld_all_image_infos *all_image_infos =
+      (const struct dyld_all_image_infos *)task_dyld_info.all_image_info_addr;
+  const struct dyld_image_info *image_infos = all_image_infos->infoArray;
+
+  for (size_t i = 0; i < all_image_infos->infoArrayCount; i++) {
+
+    const char *      image_name = image_infos[i].imageFilePath;
+    mach_vm_address_t image_load_address =
+        (mach_vm_address_t)image_infos[i].imageLoadAddress;
+    if (strstr(image_name, name)) {
+
+      lib.name = name;
+      lib.addr_start = (u64)image_load_address;
+      lib.addr_end = 0;
+      return &lib;
+
+    }
+
+  }
+
+#endif
+
+  return NULL;
+
+}
+
+/* Error reporting to forkserver controller */
+
+void send_forkserver_error(int error) {
+
+  u32 status;
+  if (!error || error > 0xffff) return;
+  status = (FS_OPT_ERROR | FS_OPT_SET_ERROR(error));
+  if (write(FORKSRV_FD + 1, (char *)&status, 4) != 4) return;
+
+}
+
+/* SHM setup. */
+
+static void __afl_map_shm(void) {
+
+  char *id_str = getenv(SHM_ENV_VAR);
+  char *ptr;
+
+  if ((ptr = getenv("AFL_MAP_SIZE")) != NULL) {
+
+    u32 val = atoi(ptr);
+    if (val > 0) __afl_map_size = val;
+
+  }
+
+  if (__afl_map_size > MAP_SIZE) {
+
+    if (__afl_map_size > FS_OPT_MAX_MAPSIZE) {
+
+      fprintf(stderr,
+              "Error: AFL++ tools *require* to set AFL_MAP_SIZE to %u to "
+              "be able to run this instrumented program!\n",
+              __afl_map_size);
+      if (id_str) {
+
+        send_forkserver_error(FS_ERROR_MAP_SIZE);
+        exit(-1);
+
+      }
+
+    } else {
+
+      fprintf(stderr,
+              "Warning: AFL++ tools will need to set AFL_MAP_SIZE to %u to "
+              "be able to run this instrumented program!\n",
+              __afl_map_size);
+
+    }
+
+  }
+
+  if (id_str) {
+
+#ifdef USEMMAP
+    const char *   shm_file_path = id_str;
+    int            shm_fd = -1;
+    unsigned char *shm_base = NULL;
+
+    /* create the shared memory segment as if it was a file */
+    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
+    if (shm_fd == -1) {
+
+      fprintf(stderr, "shm_open() failed\n");
+      send_forkserver_error(FS_ERROR_SHM_OPEN);
+      exit(1);
+
+    }
+
+    /* map the shared memory segment to the address space of the process */
+    shm_base =
+        mmap(0, __afl_map_size, PROT_READ | PROT_WRITE, MAP_SHARED, shm_fd, 0);
+
+    if (shm_base == MAP_FAILED) {
+
+      close(shm_fd);
+      shm_fd = -1;
+
+      fprintf(stderr, "mmap() failed\n");
+      send_forkserver_error(FS_ERROR_MMAP);
+      exit(2);
+
+    }
+
+    __afl_area_ptr = shm_base;
+#else
+    u32 shm_id = atoi(id_str);
+
+    __afl_area_ptr = shmat(shm_id, 0, 0);
+
+#endif
+
+    if (__afl_area_ptr == (void *)-1) {
+
+      send_forkserver_error(FS_ERROR_SHMAT);
+      exit(1);
+
+    }
+
+    /* Write something into the bitmap so that the parent doesn't give up */
+
+    __afl_area_ptr[0] = 1;
+
+  }
+
+}
+
+/* Fork server logic. */
+
+static void __afl_start_forkserver(void) {
+
+  u8  tmp[4] = {0, 0, 0, 0};
+  u32 status = 0;
+
+  if (__afl_map_size <= FS_OPT_MAX_MAPSIZE)
+    status |= (FS_OPT_SET_MAPSIZE(__afl_map_size) | FS_OPT_MAPSIZE);
+  if (status) status |= (FS_OPT_ENABLED);
+  memcpy(tmp, &status, 4);
+
+  /* Phone home and tell the parent that we're OK. */
+
+  if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
+
+}
+
+static u32 __afl_next_testcase(u8 *buf, u32 max_len) {
+
+  s32 status, res = 0xffffff;
+
+  /* Wait for parent by reading from the pipe. Abort if read fails. */
+  if (read(FORKSRV_FD, &status, 4) != 4) return 0;
+
+  /* we have a testcase - read it if we read from stdin */
+  if (use_stdin) status = read(0, buf, max_len);
+
+  /* report that we are starting the target */
+  if (write(FORKSRV_FD + 1, &res, 4) != 4) return 0;
+
+  if (status < 1)
+    return 0;
+  else
+    return status;
+
+}
+
+static void __afl_end_testcase(void) {
+
+  int status = 0xffffff;
+
+  if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(1);
+
+}
+
+#define SHADOW(addr)                                     \
+  ((uint32_t *)(((uintptr_t)addr & 0xfffffffffffffffc) - \
+                MEMORY_MAP_DECREMENT -                   \
+                ((uintptr_t)addr & 0x3) * 0x10000000000))
+
+void setup_trap_instrumentation() {
+
+  library_list_t *lib_base = NULL;
+  size_t          lib_size = 0;
+  u8 *            lib_addr;
+  char *          line = NULL;
+  size_t          nread, len = 0;
+  char *          filename = getenv("AFL_UNTRACER_FILE");
+  if (!filename) filename = getenv("TRAPFUZZ_FILE");
+  if (!filename) FATAL("AFL_UNTRACER_FILE environment variable not set");
+
+  FILE *patches = fopen(filename, "r");
+  if (!patches) FATAL("Couldn't open AFL_UNTRACER_FILE file %s", filename);
+
+  // Index into the coverage bitmap for the current trap instruction.
+  int bitmap_index = -1;
+
+  while ((nread = getline(&line, &len, patches)) != -1) {
+
+    char *end = line + len;
+
+    char *col = strchr(line, ':');
+    if (col) {
+
+      // It's a library:size pair
+      *col++ = 0;
+
+      lib_base = find_library(line);
+      if (!lib_base) FATAL("Library %s does not appear to be loaded", line);
+
+      // we ignore the defined lib_size
+      lib_size = strtoul(col, NULL, 16);
+#if (__linux__)
+      if (lib_size < lib_base->addr_end - lib_base->addr_start)
+        lib_size = lib_base->addr_end - lib_base->addr_start;
+#endif
+      if (lib_size % 0x1000 != 0)
+        WARNF("Invalid library size 0x%zx. Must be multiple of 0x1000",
+              lib_size);
+
+      lib_addr = (u8 *)lib_base->addr_start;
+
+      // Make library code writable.
+      if (mprotect((void *)lib_addr, lib_size,
+                   PROT_READ | PROT_WRITE | PROT_EXEC) != 0)
+        FATAL("Failed to mprotect library %s writable", line);
+
+      // Create shadow memory.
+      for (int i = 0; i < 4; i++) {
+
+        void *shadow_addr = SHADOW(lib_addr + i);
+        void *shadow = mmap(shadow_addr, lib_size, PROT_READ | PROT_WRITE,
+                            MAP_PRIVATE | MAP_ANON | MAP_FIXED, 0, 0);
+        fprintf(stderr, "Shadow: %s %d = %p-%p for %p\n", line, i, shadow,
+                shadow + lib_size - 1, lib_addr);
+        if (shadow == MAP_FAILED) FATAL("Failed to mmap shadow memory");
+
+      }
+
+      // Done, continue with next line.
+      continue;
+
+    }
+
+    // It's an offset, parse it and do the patching.
+    unsigned long offset = strtoul(line, NULL, 16);
+    if (offset > lib_size)
+      FATAL("Invalid offset: 0x%lx. Current library is 0x%zx bytes large",
+            offset, lib_size);
+
+    bitmap_index++;
+
+    if (bitmap_index >= __afl_map_size)
+      FATAL("Too many basic blocks to instrument");
+
+    uint32_t *shadow = SHADOW(lib_addr + offset);
+    if (*shadow != 0) FATAL("Potentially duplicate patch entry: 0x%lx", offset);
+
+      // Make lookup entry in shadow memory.
+#if ((defined(__APPLE__) && defined(__LP64__)) || defined(__x86_64__))
+    // this is for Intel x64
+
+    uint8_t orig_byte = lib_addr[offset];
+    *shadow = (bitmap_index << 8) | orig_byte;
+    lib_addr[offset] = 0xcc;  // replace instruction with debug trap
+    fprintf(stderr,
+            "Patch entry: %p[%x] = %p = %02x -> SHADOW(%p) #%d -> %08x\n",
+            lib_addr, offset, lib_addr + offset, orig_byte, shadow,
+            bitmap_index, *shadow);
+
+#else
+      // this will be ARM and AARCH64
+      // for ARM we will need to identify if the code is in thumb or ARM
+#error "non x86_64 not supported yet"
+      //__arm__
+      // linux thumb: 0xde01
+      // linux thumb2: 0xf7f0a000
+      // linux arm: 0xe7f001f0
+      //__aarch64__
+      // linux aarch64: 0xd4200000
+#endif
+
+  }
+
+  free(line);
+  fclose(patches);
+
+  // Install signal handler for SIGTRAP.
+  struct sigaction s;
+  s.sa_flags = SA_SIGINFO;
+  s.sa_sigaction = sigtrap_handler;
+  sigemptyset(&s.sa_mask);
+  sigaction(SIGTRAP, &s, 0);
+
+  fprintf(stderr, "Patched %u locations.\n", bitmap_index);
+  __afl_map_size = bitmap_index;
+  if (__afl_map_size % 8) __afl_map_size = (((__afl_map_size + 7) >> 3) << 3);
+
+}
+
+static void sigtrap_handler(int signum, siginfo_t *si, void *context) {
+
+  uint64_t addr;
+  // Must re-execute the instruction, so decrement PC by one instruction.
+  ucontext_t *ctx = (ucontext_t *)context;
+#if defined(__APPLE__) && defined(__LP64__)
+  ctx->uc_mcontext->__ss.__rip -= 1;
+  addr = ctx->uc_mcontext->__ss.__rip;
+#elif defined(__linux__)
+  ctx->uc_mcontext.gregs[REG_RIP] -= 1;
+  addr = ctx->uc_mcontext.gregs[REG_RIP];
+#else
+#error "Unsupported platform"
+#endif
+
+  fprintf(stderr, "TRAP at context addr = %lx, fault addr = %lx\n", addr,
+          si->si_addr);
+
+  // If the trap didn't come from our instrumentation, then we probably will
+  // just segfault here
+  uint8_t *faultaddr;
+  if (si->si_addr)
+    faultaddr = (u8 *)si->si_addr - 1;
+  else
+    faultaddr = (u8 *)addr;
+  // u8 *loc = SHADOW(faultaddr);
+  fprintf(stderr, "Shadow location: %p\n", SHADOW(faultaddr));
+  uint32_t shadow = *SHADOW(faultaddr);
+  uint8_t  orig_byte = shadow & 0xff;
+  uint32_t index = shadow >> 8;
+
+  fprintf(stderr, "shadow data: %x, orig_byte %02x, index %d\n", shadow,
+          orig_byte, index);
+
+  // Index zero is invalid so that it is still possible to catch actual trap
+  // instructions in instrumented libraries.
+  if (index == 0) abort();
+
+  // Restore original instruction
+  *faultaddr = orig_byte;
+
+  __afl_area_ptr[index] = 128;
+
+}
+
+/* here you need to specify the parameter for the target function */
+static void *(*o_TIFFOpen)(char *filename, char *mode);
+static void *(*o_TIFFClose)(u8 *file);
+
+int main(int argc, char *argv[]) {
+
+  // STEP 1: use stdin or filename via commandline and set the maximum
+  //         size for a test case
+
+  /* by default we use stdin, but also a filename can be passed, in this
+     case the input is argv[1] and we have to disable stdin */
+  if (argc > 1) use_stdin = 0;
+
+  /* This is were the testcase data is written into */
+  u8 buf[10000];  // this is the maximum size for a test case! set it!
+
+  // END STEP 1
+
+  // STEP 2: load the library you want to fuzz and lookup the functions,
+  //         inclusive of the cleanup functions
+  //         NOTE: above the main() you have to define the functions!
+
+  /* setup the target */
+  void *dl = dlopen("/prg/tests/libtiff.so", RTLD_LAZY);
+  if (!dl) FATAL("could not find target library");
+  o_TIFFOpen = dlsym(dl, "TIFFOpen");
+  if (!o_TIFFOpen) FATAL("could not resolve target function from library");
+  o_TIFFClose = dlsym(dl, "TIFFClose");
+  if (!o_TIFFClose) FATAL("could not resolve target function from library");
+
+  // END STEP 2
+
+  /* setup instrumentation, shared memory and forkserver */
+  u32 len;
+  read_library_information();
+  setup_trap_instrumentation();
+  __afl_map_shm();
+  __afl_start_forkserver();
+
+  while ((len = __afl_next_testcase(buf, sizeof(buf))) > 0) {
+
+// -> this still needs threading otherwise fuzzing stops when we crash
+
+    // STEP 3: call the function to fuzz, also the functions you might
+    //         need to call to prepare the function and - important! -
+    //         to clean everything up
+
+    // in this example we use the input file, not stdin!
+    u8 *file (*o_function)(argv[1], "wl");
+
+    // we have to release memory
+    if (file) (void)(*o_TIFFClose)(file);
+
+    // END STEP 3
+
+    /* report the test case is done and wait for the next */
+    __afl_end_testcase();
+
+  }
+
+  return 0;
+
+}
+
diff --git a/examples/afl_untracer/ida_get_patchpoints.py b/examples/afl_untracer/ida_get_patchpoints.py
new file mode 100644
index 00000000..5a79658d
--- /dev/null
+++ b/examples/afl_untracer/ida_get_patchpoints.py
@@ -0,0 +1,52 @@
+#
+# IDAPython script for IDA Pro
+# Slightly modified from https://github.com/googleprojectzero/p0tools/blob/master/TrapFuzz/findPatchPoints.py
+#
+
+import idautils
+import idaapi
+import ida_nalt
+import idc
+
+# See https://www.hex-rays.com/products/ida/support/ida74_idapython_no_bc695_porting_guide.shtml
+
+from os.path import expanduser
+home = expanduser("~")
+
+patchpoints = set()
+
+max_offset = 0
+for seg_ea in idautils.Segments():
+    name = idc.get_segm_name(seg_ea)
+    #print("Segment: " + name)
+    if name != "__text" and name != ".text":
+        continue
+
+    start = idc.get_segm_start(seg_ea)
+    end = idc.get_segm_end(seg_ea)
+    #print("Start: " + hex(start) + " End: " + hex(end))
+    for func_ea in idautils.Functions(start, end):
+        f = idaapi.get_func(func_ea)
+        if not f:
+            continue
+        for block in idaapi.FlowChart(f):
+            if start <= block.start_ea < end:
+                max_offset = max(max_offset, block.start_ea)
+                patchpoints.add(block.start_ea)
+            #else:
+            #    print("Warning: broken CFG?")
+
+# Round up max_offset to page size
+size = max_offset
+rem = size % 0x1000
+if rem != 0:
+    size += 0x1000 - rem
+
+print("Writing to " + home + "/Desktop/patches.txt")
+
+with open(home + "/Desktop/patches.txt", "w") as f:
+    f.write(ida_nalt.get_root_filename() + ':' + hex(size) + '\n')
+    f.write('\n'.join(map(hex, sorted(patchpoints))))
+    f.write('\n')
+
+print("Done, found {} patchpoints".format(len(patchpoints)))
-- 
cgit 1.4.1


From efa9df24c2a5f97c212a5a22dda19dcbbab0b5de Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 30 Apr 2020 17:59:59 +0200
Subject: afl-untracer completed

---
 docs/Changelog.md                               |  2 +
 examples/afl_network_proxy/README.md            | 11 +++
 examples/afl_network_proxy/afl-network-client.c | 23 +++---
 examples/afl_network_proxy/afl-network-server.c |  2 +
 examples/afl_untracer/Makefile                  |  2 +-
 examples/afl_untracer/README.md                 |  7 +-
 examples/afl_untracer/afl-untracer.c            | 96 +++++++++++--------------
 examples/afl_untracer/patches.txt               | 23 ++++++
 include/forkserver.h                            |  1 +
 src/afl-forkserver.c                            | 14 ++--
 10 files changed, 106 insertions(+), 75 deletions(-)
 create mode 100644 examples/afl_untracer/patches.txt

(limited to 'examples/afl_network_proxy/afl-network-client.c')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index faf015c6..565bee72 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -31,6 +31,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
   - added examples/afl_network_proxy which allows to fuzz a target over the
     network (not fuzzing tcp/ip services but running afl-fuzz on one system
     and the target being on an embedded device)
+  - added examples/afl_untracer which does a binary-only fuzzing with the
+    modifications done in memory
   - added examples/afl_proxy which can be easily used to fuzz and instrument
     non-standard things
   - all:
diff --git a/examples/afl_network_proxy/README.md b/examples/afl_network_proxy/README.md
index 65012601..c33096be 100644
--- a/examples/afl_network_proxy/README.md
+++ b/examples/afl_network_proxy/README.md
@@ -20,6 +20,7 @@ e.g.:
 ```
 $ afl-network-server -i 1111 -m 25M -t 1000 -- /bin/target -f @@
 ```
+
 ### on the fuzzing master
 
 Just run afl-fuzz with your normal options, however the target should be
@@ -42,3 +43,13 @@ either. Note that also the outgoing interface can be specified with a '%' for
 ## how to compile and install
 
 `make && sudo make install`
+
+## Future
+
+It would be much faster and more effective if `afl-network-server` does not
+send the map data back (64kb or more) but the checksum that `afl-fuzz` would
+generate. This change however would make it incompatible with existing
+afl spinoffs.
+
+But in the future this will be implemented and supported as a compile option.
+
diff --git a/examples/afl_network_proxy/afl-network-client.c b/examples/afl_network_proxy/afl-network-client.c
index ede2ff8d..53512286 100644
--- a/examples/afl_network_proxy/afl-network-client.c
+++ b/examples/afl_network_proxy/afl-network-client.c
@@ -175,7 +175,7 @@ static void __afl_start_forkserver(void) {
 
 static u32 __afl_next_testcase(u8 *buf, u32 max_len) {
 
-  s32 status, res = 0xffffff;
+  s32 status, res = 0x0fffffff; // res is a dummy pid
 
   /* Wait for parent by reading from the pipe. Abort if read fails. */
   if (read(FORKSRV_FD, &status, 4) != 4) return 0;
@@ -193,9 +193,7 @@ static u32 __afl_next_testcase(u8 *buf, u32 max_len) {
 
 }
 
-static void __afl_end_testcase(void) {
-
-  int status = 0xffffff;
+static void __afl_end_testcase(int status) {
 
   if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(1);
 
@@ -273,7 +271,7 @@ int main(int argc, char *argv[]) {
   __afl_map_shm();
   __afl_start_forkserver();
 
-  int i = 1, j;
+  int i = 1, j, status, ret;
   // fprintf(stderr, "Waiting for first testcase\n");
   while ((len = __afl_next_testcase(buf, max_len)) > 0) {
 
@@ -281,17 +279,25 @@ int main(int argc, char *argv[]) {
     if (send(s, &len, 4, 0) != 4) PFATAL("sending size data %d failed", len);
     if (send(s, buf, len, 0) != len) PFATAL("sending test data failed");
 
-    int received = 0, ret;
+    int received = 0;
+    while (received < 4 &&
+           (ret = recv(s, &status + received, 4 - received, 0)) > 0)
+      received += ret;
+    if (received != 4)
+      FATAL("did not receive waitpid data (%d, %d)", received, ret);
+    // fprintf(stderr, "Received status\n");
+
+    int received = 0;
     while (received < __afl_map_size &&
            (ret = recv(s, __afl_area_ptr + received, __afl_map_size - received,
                        0)) > 0)
       received += ret;
     if (received != __afl_map_size)
-      FATAL("did not receive valid data (%d, %d)", received, ret);
+      FATAL("did not receive coverage data (%d, %d)", received, ret);
     // fprintf(stderr, "Received coverage\n");
 
     /* report the test case is done and wait for the next */
-    __afl_end_testcase();
+    __afl_end_testcase(status);
     // fprintf(stderr, "Waiting for next testcase %d\n", ++i);
 
   }
@@ -299,4 +305,3 @@ int main(int argc, char *argv[]) {
   return 0;
 
 }
-
diff --git a/examples/afl_network_proxy/afl-network-server.c b/examples/afl_network_proxy/afl-network-server.c
index 1bd37560..2f9f8c8e 100644
--- a/examples/afl_network_proxy/afl-network-server.c
+++ b/examples/afl_network_proxy/afl-network-server.c
@@ -579,6 +579,8 @@ int main(int argc, char **argv_orig, char **envp) {
     // fprintf(stderr, "received %u\n", in_len);
     run_target(fsrv, use_argv, in_data, in_len, 1);
 
+    if (send(s, fsrv->child_status, 4, 0) != 4)
+      FATAL("could not send waitpid data");
     if (send(s, fsrv->trace_bits, fsrv->map_size, 0) != fsrv->map_size)
       FATAL("could not send coverage data");
     // fprintf(stderr, "sent result\n");
diff --git a/examples/afl_untracer/Makefile b/examples/afl_untracer/Makefile
index bfef8fa8..5c525877 100644
--- a/examples/afl_untracer/Makefile
+++ b/examples/afl_untracer/Makefile
@@ -7,4 +7,4 @@ libtestinstr.so:	libtestinstr.c
 	$(CC) -fPIC -o libtestinstr.so -shared libtestinstr.c
 
 clean:
-	rm -f afl-untracer *~ core
+	rm -f afl-untracer libtestinstr.so *~ core
diff --git a/examples/afl_untracer/README.md b/examples/afl_untracer/README.md
index 90798028..d3af0ceb 100644
--- a/examples/afl_untracer/README.md
+++ b/examples/afl_untracer/README.md
@@ -3,9 +3,14 @@
 afl-untracer is an example skeleton file which can easily be used to fuzz
 a closed source library.
 
-It is faster and requires less memory than qemu_mode however it is way
+It requires less memory than qemu_mode however it is way
 more course grained and does not provide interesting features like compcov
 or cmplog.
 
 Read and modify afl-untracer.c then `make` and use it as the afl-fuzz target
 (or even remote via afl-network-proxy).
+
+This idea is based on [UnTracer](https://github.com/FoRTE-Research/UnTracer-AFL)
+and modified by [Trapfuzz](https://github.com/googleprojectzero/p0tools/tree/master/TrapFuzz).
+This implementation is slower because the traps are not patched out with each
+run, but on the other hand gives much better coverage information.
diff --git a/examples/afl_untracer/afl-untracer.c b/examples/afl_untracer/afl-untracer.c
index 420f09a2..4d512356 100644
--- a/examples/afl_untracer/afl-untracer.c
+++ b/examples/afl_untracer/afl-untracer.c
@@ -76,16 +76,9 @@ static u32 use_stdin = 1;
 /* This is were the testcase data is written into */
 static u8 buf[10000];  // this is the maximum size for a test case! set it!
 
-/* if you want to use fork() then uncomment the following line. Otherwise
-   threads are used. The differences:
-                        fork()		pthread()
-  speed	        	slow		fast
-  coverage    		detailed	minimal
-  memory leaks		no problem	an issue                       */
-//#define USE_FORK
-
-/* If you want to have debug output set this to 1 */
-static u32 debug = 1;
+/* If you want to have debug output set this to 1, can also be set with
+   AFL_DEBUG  */
+static u32 debug = 0;
 
 // END STEP 1
 
@@ -130,7 +123,7 @@ void read_library_information() {
   if (debug) fprintf(stderr, "Library list:\n");
   while (fgets(buf, sizeof(buf), f)) {
 
-    if (strstr(buf, " r-xp ")) {
+    if (strstr(buf, " r-x")) {
 
       if (liblist_cnt >= MAX_LIB_COUNT) {
 
@@ -159,9 +152,9 @@ void read_library_information() {
         liblist[liblist_cnt].addr_start = strtoull(b, NULL, 16);
         liblist[liblist_cnt].addr_end = strtoull(m, NULL, 16);
         if (debug)
-          fprintf(stderr, "%s:%x (%x-%x)\n", liblist[liblist_cnt].name,
+          fprintf(stderr, "%s:%x (%lx-%lx)\n", liblist[liblist_cnt].name,
                   liblist[liblist_cnt].addr_end - liblist[liblist_cnt].addr_start,
-                  liblist[liblist_cnt].addr_start, liblist[liblist_cnt].addr_end);
+                  liblist[liblist_cnt].addr_start, liblist[liblist_cnt].addr_end - 1);
         liblist_cnt++;
 
       }
@@ -367,17 +360,13 @@ static u32 __afl_next_testcase(u8 *buf, u32 max_len) {
   if (write(FORKSRV_FD + 1, &pid, 4) != 4) do_exit = 1;
   // fprintf(stderr, "write1 %d\n", do_exit);
 
-  if (!do_exit)
-    __afl_area_ptr[0] = 1;  // otherwise afl-fuzz will exit with NOINST
   return status;
 
 }
 
-static void __afl_end_testcase(void) {
+static void __afl_end_testcase(int status) {
 
-  s32 res = 0xffffff;
-  if (write(FORKSRV_FD + 1, &res, 4) != 4) do_exit = 1;
-  // if (write(FORKSRV_FD + 1, &pid, 4) != 4) do_exit = 1;
+  if (write(FORKSRV_FD + 1, &status, 4) != 4) do_exit = 1;
   // fprintf(stderr, "write2 %d\n", do_exit);
   if (do_exit) exit(0);
 
@@ -455,6 +444,19 @@ void setup_trap_instrumentation() {
 
     // It's an offset, parse it and do the patching.
     unsigned long offset = strtoul(line, NULL, 16);
+
+    // I dont know what it is. /proc/<pid>/maps shows the right start address
+    // and the offsets generated by the python scripts are fine as well.
+    // And loading the library into gdb also shows the offsets generated
+    // by the script are correct. However when loaded via dlopen the first
+    // 0x1000 are skipped ...
+#if defined(__linux__)
+    if (offset >= 0x1000)
+      offset -= 0x1000;
+    else
+      fprintf(stderr, "Warning: offset is < 0x1000: %x\n", offset);
+#endif
+
     if (offset > lib_size)
       FATAL("Invalid offset: 0x%lx. Current library is 0x%zx bytes large",
             offset, lib_size);
@@ -482,11 +484,10 @@ void setup_trap_instrumentation() {
     // this will be ARM and AARCH64
     // for ARM we will need to identify if the code is in thumb or ARM
 #error "non x86_64 not supported yet"
-    //__arm__
+    //__arm__:
     // linux thumb: 0xde01
-    // linux thumb2: 0xf7f0a000
     // linux arm: 0xe7f001f0
-    //__aarch64__
+    //__aarch64__:
     // linux aarch64: 0xd4200000
 #endif
 
@@ -510,6 +511,8 @@ void setup_trap_instrumentation() {
 
 }
 
+/* the signal handler for the traps / debugging interrupts
+   No debug output here because this would cost speed      */
 static void sigtrap_handler(int signum, siginfo_t *si, void *context) {
 
   uint64_t addr;
@@ -525,31 +528,25 @@ static void sigtrap_handler(int signum, siginfo_t *si, void *context) {
 #error "Unsupported platform"
 #endif
 
-  if (debug)
-    fprintf(stderr, "TRAP at context addr = %lx, fault addr = %lx\n", addr,
-            si->si_addr);
+  //fprintf(stderr, "TRAP at context addr = %lx, fault addr = %lx\n", addr, si->si_addr);
 
   // If the trap didn't come from our instrumentation, then we probably will
   // just segfault here
   uint8_t *faultaddr;
-  if (si->si_addr)
+  if (unlikely(si->si_addr))
     faultaddr = (u8 *)si->si_addr - 1;
   else
     faultaddr = (u8 *)addr;
-  // u8 *loc = SHADOW(faultaddr);
-  if (debug)
-    fprintf(stderr, "Shadow location: %p\n", SHADOW(faultaddr));
+  //if (debug) fprintf(stderr, "Shadow location: %p\n", SHADOW(faultaddr));
   uint32_t shadow = *SHADOW(faultaddr);
   uint8_t  orig_byte = shadow & 0xff;
   uint32_t index = shadow >> 8;
 
-  if (debug)
-    fprintf(stderr, "shadow data: %x, orig_byte %02x, index %d\n", shadow,
-            orig_byte, index);
+  //if (debug) fprintf(stderr, "shadow data: %x, orig_byte %02x, index %d\n", shadow, orig_byte, index);
 
   // Index zero is invalid so that it is still possible to catch actual trap
   // instructions in instrumented libraries.
-  if (index == 0) abort();
+  if (unlikely(index == 0)) abort();
 
   // Restore original instruction
   *faultaddr = orig_byte;
@@ -561,6 +558,7 @@ static void sigtrap_handler(int signum, siginfo_t *si, void *context) {
 /* here you need to specify the parameter for the target function */
 static void *(*o_function)(u8 *buf, int len);
 
+/* the MAIN function */
 int main(int argc, char *argv[]) {
 
   pid = getpid();
@@ -579,11 +577,11 @@ int main(int argc, char *argv[]) {
   //         inclusive of the cleanup functions
   //         NOTE: above the main() you have to define the functions!
 
-  /* setup the target */
   void *dl = dlopen("./libtestinstr.so", RTLD_LAZY);
   if (!dl) FATAL("could not find target library");
   o_function = dlsym(dl, "testinstr");
   if (!o_function) FATAL("could not resolve target function from library");
+  if (debug) fprintf(stderr, "Function address: %p\n", o_function);
 
   // END STEP 2
 
@@ -595,42 +593,33 @@ int main(int argc, char *argv[]) {
 
   while (1) {
 
-#ifdef USE_FORK
     if ((pid = fork()) == -1) PFATAL("fork failed");
+
     if (pid) {
 
       u32 status;
       if (waitpid(pid, &status, 0) < 0) exit(1);
+      /* report the test case is done and wait for the next */
+      __afl_end_testcase(status);
 
     } else {
 
-#endif
 
       pid = getpid();
       while ((len = __afl_next_testcase(buf, sizeof(buf))) > 0) {
 
-#ifdef USE_FORK
+        // in this function the fuzz magic happens, this is STEP 3
         fuzz();
-#else
-      if (pthread_create(&__afl_thread, NULL, (void *)fuzz, NULL) != 0)
-        PFATAL("cannot create thread");
-      pthread_join(__afl_thread, NULL);
-#endif
 
-        /* report the test case is done and wait for the next */
-        __afl_end_testcase();
-#ifdef USE_FORK
-        exit(0);
-#endif
+        // we can use _exit which is faster because our target library
+        // was loaded via dlopen and there cannot have deconstructors
+        // registered.
+        _exit(0);
 
       }
 
-#ifdef USE_FORK
-
     }
 
-#endif
-
   }
 
   return 0;
@@ -651,9 +640,4 @@ static void fuzz() {
 
   // END STEP 3
 
-#ifndef USE_FORK
-  pthread_exit(NULL);
-#endif
-
 }
-
diff --git a/examples/afl_untracer/patches.txt b/examples/afl_untracer/patches.txt
new file mode 100644
index 00000000..b3063e3a
--- /dev/null
+++ b/examples/afl_untracer/patches.txt
@@ -0,0 +1,23 @@
+libtestinstr.so:0x2000L
+0x1050L
+0x1063L
+0x106fL
+0x1078L
+0x1080L
+0x10a4L
+0x10b0L
+0x10b8L
+0x10c0L
+0x10c9L
+0x10d7L
+0x10e3L
+0x10f8L
+0x1100L
+0x1105L
+0x111aL
+0x1135L
+0x1143L
+0x114eL
+0x115cL
+0x116aL
+0x116bL
diff --git a/include/forkserver.h b/include/forkserver.h
index 3c473572..7e7784f5 100644
--- a/include/forkserver.h
+++ b/include/forkserver.h
@@ -43,6 +43,7 @@ typedef struct afl_forkserver {
 
   s32 fsrv_pid,                         /* PID of the fork server           */
       child_pid,                        /* PID of the fuzzed program        */
+      child_status,                     /* waitpid result for the child     */
       out_dir_fd;                       /* FD of the lock file              */
 
   s32 out_fd,                           /* Persistent fd for fsrv->out_file */
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index d5a60077..a9e2175d 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -790,8 +790,6 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
   s32 res;
   u32 exec_ms;
 
-  int status = 0;
-
   /* After this memset, fsrv->trace_bits[] are effectively volatile, so we
      must prevent any earlier operations from venturing into that
      territory. */
@@ -821,7 +819,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
 
   if (fsrv->child_pid <= 0) { FATAL("Fork server is misbehaving (OOM?)"); }
 
-  exec_ms = read_timed(fsrv->fsrv_st_fd, &status, 4, timeout, stop_soon_p);
+  exec_ms = read_timed(fsrv->fsrv_st_fd, &fsrv->child_status, 4, timeout, stop_soon_p);
 
   if (exec_ms > timeout) {
 
@@ -830,7 +828,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
 
     kill(fsrv->child_pid, SIGKILL);
     fsrv->last_run_timed_out = 1;
-    if (read(fsrv->fsrv_st_fd, &status, 4) < 4) { exec_ms = 0; }
+    if (read(fsrv->fsrv_st_fd, &fsrv->child_status, 4) < 4) { exec_ms = 0; }
 
   }
 
@@ -862,7 +860,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
 
   }
 
-  if (!WIFSTOPPED(status)) { fsrv->child_pid = 0; }
+  if (!WIFSTOPPED(fsrv->child_status)) { fsrv->child_pid = 0; }
 
   fsrv->total_execs++;
 
@@ -874,9 +872,9 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
 
   /* Report outcome to caller. */
 
-  if (WIFSIGNALED(status) && !*stop_soon_p) {
+  if (WIFSIGNALED(fsrv->child_status) && !*stop_soon_p) {
 
-    fsrv->last_kill_signal = WTERMSIG(status);
+    fsrv->last_kill_signal = WTERMSIG(fsrv->child_status);
 
     if (fsrv->last_run_timed_out && fsrv->last_kill_signal == SIGKILL) {
 
@@ -891,7 +889,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
   /* A somewhat nasty hack for MSAN, which doesn't support abort_on_error and
      must use a special exit code. */
 
-  if (fsrv->uses_asan && WEXITSTATUS(status) == MSAN_ERROR) {
+  if (fsrv->uses_asan && WEXITSTATUS(fsrv->child_status) == MSAN_ERROR) {
 
     fsrv->last_kill_signal = 0;
     return FSRV_RUN_CRASH;
-- 
cgit 1.4.1


From 16f9cc73696b7d1bb32cdde954451b92d4c6569d Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 30 Apr 2020 21:13:45 +0200
Subject: afl-network-client fix

---
 examples/afl_network_proxy/afl-network-client.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'examples/afl_network_proxy/afl-network-client.c')

diff --git a/examples/afl_network_proxy/afl-network-client.c b/examples/afl_network_proxy/afl-network-client.c
index 53512286..b510aa14 100644
--- a/examples/afl_network_proxy/afl-network-client.c
+++ b/examples/afl_network_proxy/afl-network-client.c
@@ -287,7 +287,7 @@ int main(int argc, char *argv[]) {
       FATAL("did not receive waitpid data (%d, %d)", received, ret);
     // fprintf(stderr, "Received status\n");
 
-    int received = 0;
+    received = 0;
     while (received < __afl_map_size &&
            (ret = recv(s, __afl_area_ptr + received, __afl_map_size - received,
                        0)) > 0)
-- 
cgit 1.4.1


From cc78fb721b9abbafadde81068b8a98ffd3ef9ed2 Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Fri, 1 May 2020 01:11:54 +0200
Subject: code format

---
 examples/afl_network_proxy/afl-network-client.c |  3 +-
 examples/afl_untracer/afl-untracer.c            | 78 ++++++++++++-------------
 examples/afl_untracer/libtestinstr.c            |  4 +-
 src/afl-forkserver.c                            |  3 +-
 4 files changed, 44 insertions(+), 44 deletions(-)

(limited to 'examples/afl_network_proxy/afl-network-client.c')

diff --git a/examples/afl_network_proxy/afl-network-client.c b/examples/afl_network_proxy/afl-network-client.c
index b510aa14..b9cd88f0 100644
--- a/examples/afl_network_proxy/afl-network-client.c
+++ b/examples/afl_network_proxy/afl-network-client.c
@@ -175,7 +175,7 @@ static void __afl_start_forkserver(void) {
 
 static u32 __afl_next_testcase(u8 *buf, u32 max_len) {
 
-  s32 status, res = 0x0fffffff; // res is a dummy pid
+  s32 status, res = 0x0fffffff;  // res is a dummy pid
 
   /* Wait for parent by reading from the pipe. Abort if read fails. */
   if (read(FORKSRV_FD, &status, 4) != 4) return 0;
@@ -305,3 +305,4 @@ int main(int argc, char *argv[]) {
   return 0;
 
 }
+
diff --git a/examples/afl_untracer/afl-untracer.c b/examples/afl_untracer/afl-untracer.c
index 9f9ea3f1..5338bfd5 100644
--- a/examples/afl_untracer/afl-untracer.c
+++ b/examples/afl_untracer/afl-untracer.c
@@ -155,9 +155,11 @@ void read_library_information() {
         liblist[liblist_cnt].addr_start = strtoull(b, NULL, 16);
         liblist[liblist_cnt].addr_end = strtoull(m, NULL, 16);
         if (debug)
-          fprintf(stderr, "%s:%x (%lx-%lx)\n", liblist[liblist_cnt].name,
-                  liblist[liblist_cnt].addr_end - liblist[liblist_cnt].addr_start,
-                  liblist[liblist_cnt].addr_start, liblist[liblist_cnt].addr_end - 1);
+          fprintf(
+              stderr, "%s:%x (%lx-%lx)\n", liblist[liblist_cnt].name,
+              liblist[liblist_cnt].addr_end - liblist[liblist_cnt].addr_start,
+              liblist[liblist_cnt].addr_start,
+              liblist[liblist_cnt].addr_end - 1);
         liblist_cnt++;
 
       }
@@ -170,25 +172,17 @@ void read_library_information() {
 
 #elif defined(__FreeBSD__)
   int    mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_VMMAP, getpid()};
-  char *buf, *start, *end;
+  char * buf, *start, *end;
   size_t miblen = sizeof(mib) / sizeof(mib[0]);
   size_t len;
 
   if (debug) fprintf(stderr, "Library list:\n");
-  if (sysctl(mib, miblen, NULL, &len, NULL, 0) == -1) {
-
-    return;
-
-  }
+  if (sysctl(mib, miblen, NULL, &len, NULL, 0) == -1) { return; }
 
   len = len * 4 / 3;
 
   buf = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0);
-  if (buf == MAP_FAILED) {
-
-    return;
-
-  }
+  if (buf == MAP_FAILED) { return; }
 
   if (sysctl(mib, miblen, buf, &len, NULL, 0) == -1) {
 
@@ -205,31 +199,33 @@ void read_library_information() {
     struct kinfo_vmentry *region = (struct kinfo_vmentry *)start;
     size_t                size = region->kve_structsize;
 
-    if (size == 0) {
-
-      break;
-
-    }
+    if (size == 0) { break; }
 
     if ((region->kve_protection & KVME_PROT_READ) &&
         !(region->kve_protection & KVME_PROT_EXEC)) {
 
-        liblist[liblist_cnt].name = region->kve_path[0] != '\0' ? strdup(region->kve_path) : 0;
-        liblist[liblist_cnt].addr_start = region->kve_start;
-        liblist[liblist_cnt].addr_end = region->kve_end;
+      liblist[liblist_cnt].name =
+          region->kve_path[0] != '\0' ? strdup(region->kve_path) : 0;
+      liblist[liblist_cnt].addr_start = region->kve_start;
+      liblist[liblist_cnt].addr_end = region->kve_end;
 
-        if (debug) {
-          fprintf(stderr, "%s:%x (%lx-%lx)\n", liblist[liblist_cnt].name,
-                  liblist[liblist_cnt].addr_end - liblist[liblist_cnt].addr_start,
-                  liblist[liblist_cnt].addr_start, liblist[liblist_cnt].addr_end - 1);
-        }
+      if (debug) {
+
+        fprintf(stderr, "%s:%x (%lx-%lx)\n", liblist[liblist_cnt].name,
+                liblist[liblist_cnt].addr_end - liblist[liblist_cnt].addr_start,
+                liblist[liblist_cnt].addr_start,
+                liblist[liblist_cnt].addr_end - 1);
+
+      }
+
+      liblist_cnt++;
 
-        liblist_cnt++;
     }
 
     start += size;
 
   }
+
 #endif
 
 }
@@ -532,7 +528,7 @@ void setup_trap_instrumentation() {
     uint32_t *shadow = SHADOW(lib_addr + offset);
     if (*shadow != 0) FATAL("Duplicate patch entry: 0x%lx", offset);
 
-    // Make lookup entry in shadow memory.
+      // Make lookup entry in shadow memory.
 #if ((defined(__APPLE__) && defined(__LP64__)) || defined(__x86_64__))
     // this is for Intel x64
 
@@ -546,14 +542,14 @@ void setup_trap_instrumentation() {
               bitmap_index, *shadow);
 
 #else
-    // this will be ARM and AARCH64
-    // for ARM we will need to identify if the code is in thumb or ARM
+      // this will be ARM and AARCH64
+      // for ARM we will need to identify if the code is in thumb or ARM
 #error "non x86_64 not supported yet"
-    //__arm__:
-    // linux thumb: 0xde01
-    // linux arm: 0xe7f001f0
-    //__aarch64__:
-    // linux aarch64: 0xd4200000
+      //__arm__:
+      // linux thumb: 0xde01
+      // linux arm: 0xe7f001f0
+      //__aarch64__:
+      // linux aarch64: 0xd4200000
 #endif
 
     bitmap_index++;
@@ -596,7 +592,8 @@ static void sigtrap_handler(int signum, siginfo_t *si, void *context) {
 #error "Unsupported platform"
 #endif
 
-  //fprintf(stderr, "TRAP at context addr = %lx, fault addr = %lx\n", addr, si->si_addr);
+  // fprintf(stderr, "TRAP at context addr = %lx, fault addr = %lx\n", addr,
+  // si->si_addr);
 
   // If the trap didn't come from our instrumentation, then we probably will
   // just segfault here
@@ -605,12 +602,13 @@ static void sigtrap_handler(int signum, siginfo_t *si, void *context) {
     faultaddr = (u8 *)si->si_addr - 1;
   else
     faultaddr = (u8 *)addr;
-  //if (debug) fprintf(stderr, "Shadow location: %p\n", SHADOW(faultaddr));
+  // if (debug) fprintf(stderr, "Shadow location: %p\n", SHADOW(faultaddr));
   uint32_t shadow = *SHADOW(faultaddr);
   uint8_t  orig_byte = shadow & 0xff;
   uint32_t index = shadow >> 8;
 
-  //if (debug) fprintf(stderr, "shadow data: %x, orig_byte %02x, index %d\n", shadow, orig_byte, index);
+  // if (debug) fprintf(stderr, "shadow data: %x, orig_byte %02x, index %d\n",
+  // shadow, orig_byte, index);
 
   // Index zero is invalid so that it is still possible to catch actual trap
   // instructions in instrumented libraries.
@@ -672,7 +670,6 @@ int main(int argc, char *argv[]) {
 
     } else {
 
-
       pid = getpid();
       while ((len = __afl_next_testcase(buf, sizeof(buf))) > 0) {
 
@@ -709,3 +706,4 @@ static void fuzz() {
   // END STEP 3
 
 }
+
diff --git a/examples/afl_untracer/libtestinstr.c b/examples/afl_untracer/libtestinstr.c
index b21c3db5..96b1cf21 100644
--- a/examples/afl_untracer/libtestinstr.c
+++ b/examples/afl_untracer/libtestinstr.c
@@ -20,8 +20,7 @@
 
 void testinstr(char *buf, int len) {
 
-  if (len < 1)
-    return;
+  if (len < 1) return;
   buf[len] = 0;
 
   // we support three input cases
@@ -33,3 +32,4 @@ void testinstr(char *buf, int len) {
     printf("Neither one or zero? How quaint!\n");
 
 }
+
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index a9e2175d..c1623f22 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -819,7 +819,8 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
 
   if (fsrv->child_pid <= 0) { FATAL("Fork server is misbehaving (OOM?)"); }
 
-  exec_ms = read_timed(fsrv->fsrv_st_fd, &fsrv->child_status, 4, timeout, stop_soon_p);
+  exec_ms = read_timed(fsrv->fsrv_st_fd, &fsrv->child_status, 4, timeout,
+                       stop_soon_p);
 
   if (exec_ms > timeout) {
 
-- 
cgit 1.4.1


From 1c53bbea52cfecf6c886bb441f1c99c1ae28b0e6 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 3 May 2020 14:09:32 +0200
Subject: doubled the speed of afl_network_proxy

---
 examples/afl_network_proxy/Makefile             |  24 +----
 examples/afl_network_proxy/README.md            |  21 ++--
 examples/afl_network_proxy/afl-network-client.c | 119 ++++++++++++++++++--
 examples/afl_network_proxy/afl-network-server.c | 138 +++++++++++++++++++++---
 4 files changed, 246 insertions(+), 56 deletions(-)

(limited to 'examples/afl_network_proxy/afl-network-client.c')

diff --git a/examples/afl_network_proxy/Makefile b/examples/afl_network_proxy/Makefile
index eeee1178..0b306dde 100644
--- a/examples/afl_network_proxy/Makefile
+++ b/examples/afl_network_proxy/Makefile
@@ -1,22 +1,2 @@
-PREFIX   ?= /usr/local
-BIN_PATH  = $(PREFIX)/bin
-DOC_PATH  = $(PREFIX)/share/doc/afl
-
-PROGRAMS = afl-network-client afl-network-server
-
-all:	$(PROGRAMS)
-
-afl-network-client:	afl-network-client.c
-	$(CC) -I../../include -o afl-network-client afl-network-client.c
-
-afl-network-server:	afl-network-server.c
-	$(CC) -I../../include -o afl-network-server afl-network-server.c ../../src/afl-forkserver.c ../../src/afl-sharedmem.c ../../src/afl-common.c -DBIN_PATH=\"$(BIN_PATH)\"
-
-clean:
-	rm -f $(PROGRAMS) *~ core
-
-install: all
-	install -d -m 755 $${DESTDIR}$(BIN_PATH) $${DESTDIR}$(DOC_PATH)
-	install -m 755 $(PROGRAMS) $${DESTDIR}$(BIN_PATH)
-	install -m 644 README.md $${DESTDIR}$(DOC_PATH)/README.network_proxy.md
-	
\ No newline at end of file
+all:
+	@echo please use GNU make, thanks!
diff --git a/examples/afl_network_proxy/README.md b/examples/afl_network_proxy/README.md
index c33096be..84ebfa48 100644
--- a/examples/afl_network_proxy/README.md
+++ b/examples/afl_network_proxy/README.md
@@ -12,6 +12,14 @@ Note that the impact on fuzzing speed will be huge, expect a loss of 90%.
 
 ## how to get it running
 
+### Compiling
+
+Just type `make` and let the autodetection do everything for you.
+
+Note that compression is supported but currently disabled. It seems that
+sending 64kb of map data over TCP is faster than compressing it with the
+fastest algorithm and options to 112 byte and sending this. Weird.
+
 ### on the target
 
 Run `afl-network-server` with your target with the -m and -t values you need.
@@ -40,16 +48,11 @@ The TARGET can be an IPv4 or IPv6 address, or a host name that resolves to
 either. Note that also the outgoing interface can be specified with a '%' for
 `afl-network-client`, e.g. `fe80::1234%eth0`.
 
+Also make sure your middle value of `/proc/sys/net/ipv4/tcp_rmem` is larger
+than your MAP_SIZE (130kb is a good value). This is the default TCP window
+size value.
+
 ## how to compile and install
 
 `make && sudo make install`
 
-## Future
-
-It would be much faster and more effective if `afl-network-server` does not
-send the map data back (64kb or more) but the checksum that `afl-fuzz` would
-generate. This change however would make it incompatible with existing
-afl spinoffs.
-
-But in the future this will be implemented and supported as a compile option.
-
diff --git a/examples/afl_network_proxy/afl-network-client.c b/examples/afl_network_proxy/afl-network-client.c
index b9cd88f0..94f6bb42 100644
--- a/examples/afl_network_proxy/afl-network-client.c
+++ b/examples/afl_network_proxy/afl-network-client.c
@@ -41,6 +41,10 @@
 #include <netdb.h>
 #include <fcntl.h>
 
+#ifdef USE_DEFLATE
+#include <libdeflate.h>
+#endif
+
 u8 *__afl_area_ptr;
 
 #ifdef __ANDROID__
@@ -206,7 +210,12 @@ int main(int argc, char *argv[]) {
   u8 *            interface, *buf, *ptr;
   s32             s = -1;
   struct addrinfo hints, *hres, *aip;
-  u32             len, max_len = 65536;
+  u32 *           lenptr, max_len = 65536;
+#ifdef USE_DEFLATE
+  u8 *   buf2;
+  u32 *  lenptr1, *lenptr2, buf2_len, compress_len;
+  size_t decompress_len;
+#endif
 
   if (argc < 3 || argc > 4) {
 
@@ -235,8 +244,17 @@ int main(int argc, char *argv[]) {
     if ((__afl_map_size = atoi(ptr)) < 8)
       FATAL("illegal map size, may not be < 8 or >= 2^30: %s", ptr);
 
-  if ((buf = malloc(max_len)) == NULL)
-    PFATAL("can not allocate %u memory", max_len);
+  if ((buf = malloc(max_len + 4)) == NULL)
+    PFATAL("can not allocate %u memory", max_len + 4);
+  lenptr = (u32 *)buf;
+
+#ifdef USE_DEFLATE
+  buf2_len = (max_len > __afl_map_size ? max_len : __afl_map_size);
+  if ((buf2 = malloc(buf2_len + 8)) == NULL)
+    PFATAL("can not allocate %u memory", buf2_len + 8);
+  lenptr1 = (u32 *)buf2;
+  lenptr2 = (u32 *)(buf2 + 4);
+#endif
 
   memset(&hints, 0, sizeof(hints));
   hints.ai_socktype = SOCK_STREAM;
@@ -258,28 +276,81 @@ int main(int argc, char *argv[]) {
       fprintf(stderr,
               "Warning: binding to interface is not supported for your OS\n");
 #endif
+
+#ifdef SO_PRIORITY
+      int priority = 7;
+      if (setsockopt(s, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) <
+          0) {
+
+        priority = 6;
+        if (setsockopt(s, SOL_SOCKET, SO_PRIORITY, &priority,
+                       sizeof(priority)) < 0)
+          WARNF("could not set priority on socket");
+
+      }
+
+#endif
+
       if (connect(s, aip->ai_addr, aip->ai_addrlen) == -1) s = -1;
 
     }
 
   }
 
+#ifdef USE_DEFLATE
+  struct libdeflate_compressor *compressor;
+  compressor = libdeflate_alloc_compressor(1);
+  struct libdeflate_decompressor *decompressor;
+  decompressor = libdeflate_alloc_decompressor();
+  fprintf(stderr, "Compile with compression support\n");
+#endif
+
   if (s == -1)
     FATAL("could not connect to target tcp://%s:%s", argv[1], argv[2]);
+  else
+    fprintf(stderr, "Connected to target tcp://%s:%s\n", argv[1], argv[2]);
 
   /* we initialize the shared memory map and start the forkserver */
   __afl_map_shm();
   __afl_start_forkserver();
 
-  int i = 1, j, status, ret;
+  int i = 1, j, status, ret, received;
+
   // fprintf(stderr, "Waiting for first testcase\n");
-  while ((len = __afl_next_testcase(buf, max_len)) > 0) {
+  while ((*lenptr = __afl_next_testcase(buf + 4, max_len)) > 0) {
+
+    // fprintf(stderr, "Sending testcase with len %u\n", *lenptr);
+#ifdef USE_DEFLATE
+    // we only compress the testcase if it does not fit in the TCP packet
+    if (*lenptr > 1500 - 20 - 32 - 4) {
+
+      // set highest byte to signify compression
+      *lenptr1 = (*lenptr | 0xff000000);
+      *lenptr2 = (u32)libdeflate_deflate_compress(compressor, buf + 4, *lenptr,
+                                                  buf2 + 8, buf2_len);
+      if (send(s, buf2, *lenptr2 + 8, 0) != *lenptr2 + 8)
+        PFATAL("sending test data failed");
+      fprintf(stderr, "COMPRESS (%u->%u):\n", *lenptr, *lenptr2);
+      for (u32 i = 0; i < *lenptr; i++)
+        fprintf(stderr, "%02x", buf[i + 4]);
+      fprintf(stderr, "\n");
+      for (u32 i = 0; i < *lenptr2; i++)
+        fprintf(stderr, "%02x", buf2[i + 8]);
+      fprintf(stderr, "\n");
+
+    } else {
 
-    // fprintf(stderr, "Sending testcase with len %u\n", len);
-    if (send(s, &len, 4, 0) != 4) PFATAL("sending size data %d failed", len);
-    if (send(s, buf, len, 0) != len) PFATAL("sending test data failed");
+#endif
+      if (send(s, buf, *lenptr + 4, 0) != *lenptr + 4)
+        PFATAL("sending test data failed");
+#ifdef USE_DEFLATE
+      // fprintf(stderr, "unCOMPRESS (%u)\n", *lenptr);
 
-    int received = 0;
+    }
+
+#endif
+
+    received = 0;
     while (received < 4 &&
            (ret = recv(s, &status + received, 4 - received, 0)) > 0)
       received += ret;
@@ -288,12 +359,37 @@ int main(int argc, char *argv[]) {
     // fprintf(stderr, "Received status\n");
 
     received = 0;
+#ifdef USE_DEFLATE
+    while (received < 4 &&
+           (ret = recv(s, &compress_len + received, 4 - received, 0)) > 0)
+      received += ret;
+    if (received != 4)
+      FATAL("did not receive compress_len (%d, %d)", received, ret);
+    // fprintf(stderr, "Received status\n");
+
+    received = 0;
+    while (received < compress_len &&
+           (ret = recv(s, buf2 + received, buf2_len - received, 0)) > 0)
+      received += ret;
+    if (received != compress_len)
+      FATAL("did not receive coverage data (%d, %d)", received, ret);
+
+    if (libdeflate_deflate_decompress(decompressor, buf2, compress_len,
+                                      __afl_area_ptr, __afl_map_size,
+                                      &decompress_len) != LIBDEFLATE_SUCCESS ||
+        decompress_len != __afl_map_size)
+      FATAL("decompression failed");
+// fprintf(stderr, "DECOMPRESS (%u->%u): ", compress_len, decompress_len);
+// for (u32 i = 0; i < __afl_map_size; i++) fprintf(stderr, "%02x",
+// __afl_area_ptr[i]); fprintf(stderr, "\n");
+#else
     while (received < __afl_map_size &&
            (ret = recv(s, __afl_area_ptr + received, __afl_map_size - received,
                        0)) > 0)
       received += ret;
     if (received != __afl_map_size)
       FATAL("did not receive coverage data (%d, %d)", received, ret);
+#endif
     // fprintf(stderr, "Received coverage\n");
 
     /* report the test case is done and wait for the next */
@@ -302,6 +398,11 @@ int main(int argc, char *argv[]) {
 
   }
 
+#ifdef USE_DEFLATE
+  libdeflate_free_compressor(compressor);
+  libdeflate_free_decompressor(decompressor);
+#endif
+
   return 0;
 
 }
diff --git a/examples/afl_network_proxy/afl-network-server.c b/examples/afl_network_proxy/afl-network-server.c
index e069af3d..e4c3bc6d 100644
--- a/examples/afl_network_proxy/afl-network-server.c
+++ b/examples/afl_network_proxy/afl-network-server.c
@@ -61,13 +61,21 @@
 #include <sys/socket.h>
 #include <netdb.h>
 
+#ifdef USE_DEFLATE
+#include <libdeflate.h>
+struct libdeflate_compressor *  compressor;
+struct libdeflate_decompressor *decompressor;
+#endif
+
 static u8 *in_file,                    /* Minimizer input test case         */
     *out_file;
 
 static u8 *in_data;                    /* Input data for trimming           */
+static u8 *buf2;
 
-static s32 in_len;
-static u32 map_size = MAP_SIZE;
+static s32    in_len;
+static u32    map_size = MAP_SIZE;
+static size_t buf2_len;
 
 static volatile u8 stop_soon;          /* Ctrl-C pressed?                   */
 
@@ -335,25 +343,64 @@ static void usage(u8 *argv0) {
 
 int recv_testcase(int s, void **buf, size_t *max_len) {
 
-  int size, received = 0, ret;
+  u32    size;
+  s32    ret;
+  size_t received;
 
+  received = 0;
   while (received < 4 && (ret = recv(s, &size + received, 4 - received, 0)) > 0)
     received += ret;
-
   if (received != 4) FATAL("did not receive size information");
-  if (size < 1) FATAL("did not receive valid size information");
+  if (size == 0) FATAL("did not receive valid size information");
   // fprintf(stderr, "received size information of %d\n", size);
 
-  *buf = maybe_grow(buf, max_len, size);
-  // fprintf(stderr, "receiving testcase %p %p max %u\n", buf, *buf, *max_len);
-  received = 0;
-  while (received < size &&
-         (ret = recv(s, ((char *)*buf) + received, size - received, 0)) > 0)
-    received += ret;
+  if ((size && 0xff000000) != 0xff000000) {
+
+    *buf = maybe_grow(buf, max_len, size);
+    received = 0;
+    // fprintf(stderr, "unCOMPRESS (%u)\n", size);
+    while (received < size &&
+           (ret = recv(s, ((char *)*buf) + received, size - received, 0)) > 0)
+      received += ret;
+
+  } else {
+
+#ifdef USE_DEFLATE
+    u32 clen;
+    size = (size & 0x00ffffff);
+    *buf = maybe_grow(buf, max_len, size);
+    received = 0;
+    while (received < 4 &&
+           (ret = recv(s, &clen + received, 4 - received, 0)) > 0)
+      received += ret;
+    if (received != 4) FATAL("did not receive size information");
+    // fprintf(stderr, "received clen information of %d\n", clen);
+    if (clen < 1)
+      FATAL("did not receive valid compressed len information: %u", clen);
+    buf2 = maybe_grow((void **)&buf2, &buf2_len, clen);
+    received = 0;
+    while (received < clen &&
+           (ret = recv(s, buf2 + received, clen - received, 0)) > 0)
+      received += ret;
+    if (received != clen) FATAL("did not receive compressed information");
+    if (libdeflate_deflate_decompress(decompressor, buf2, clen, (char *)*buf,
+                                      *max_len,
+                                      &received) != LIBDEFLATE_SUCCESS)
+      FATAL("decompression failed");
+      // fprintf(stderr, "DECOMPRESS (%u->%u):\n", clen, received);
+      // for (u32 i = 0; i < clen; i++) fprintf(stderr, "%02x", buf2[i]);
+      // fprintf(stderr, "\n");
+      // for (u32 i = 0; i < received; i++) fprintf(stderr, "%02x",
+      // ((u8*)(*buf))[i]); fprintf(stderr, "\n");
+#else
+    FATAL("Received compressed data but not compiled with compression support");
+#endif
+
+  }
 
+  // fprintf(stderr, "receiving testcase %p %p max %u\n", buf, *buf, *max_len);
   if (received != size)
     FATAL("did not receive testcase data %u != %u, %d", received, size, ret);
-
   // fprintf(stderr, "received testcase\n");
   return size;
 
@@ -371,6 +418,10 @@ int main(int argc, char **argv_orig, char **envp) {
   int                 addrlen = sizeof(clientaddr);
   char                str[INET6_ADDRSTRLEN];
   char **             argv = argv_cpy_dup(argc, argv_orig);
+  u8 *                send_buf;
+#ifdef USE_DEFLATE
+  u32 *lenptr;
+#endif
 
   afl_forkserver_t  fsrv_var = {0};
   afl_forkserver_t *fsrv = &fsrv_var;
@@ -378,6 +429,8 @@ int main(int argc, char **argv_orig, char **envp) {
   map_size = get_map_size();
   fsrv->map_size = map_size;
 
+  if ((send_buf = malloc(map_size + 4)) == NULL) PFATAL("malloc");
+
   while ((opt = getopt(argc, argv, "+i:f:m:t:QUWh")) > 0) {
 
     switch (opt) {
@@ -553,6 +606,21 @@ int main(int argc, char **argv_orig, char **envp) {
   }
 
 #endif
+
+#ifdef SO_PRIORITY
+  int priority = 7;
+  if (setsockopt(sock, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) <
+      0) {
+
+    priority = 6;
+    if (setsockopt(sock, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) <
+        0)
+      WARNF("could not set priority on socket");
+
+  }
+
+#endif
+
   memset(&serveraddr, 0, sizeof(serveraddr));
   serveraddr.sin6_family = AF_INET6;
   serveraddr.sin6_port = htons(port);
@@ -566,6 +634,14 @@ int main(int argc, char **argv_orig, char **envp) {
   afl_fsrv_start(fsrv, use_argv, &stop_soon,
                  get_afl_env("AFL_DEBUG_CHILD_OUTPUT") ? 1 : 0);
 
+#ifdef USE_DEFLATE
+  compressor = libdeflate_alloc_compressor(1);
+  decompressor = libdeflate_alloc_decompressor();
+  buf2 = maybe_grow((void **)&buf2, &buf2_len, map_size + 16);
+  lenptr = (u32 *)(buf2 + 4);
+  fprintf(stderr, "Compiled with compression support\n");
+#endif
+
   fprintf(stderr,
           "Waiting for incoming connection from afl-network-client on port %d "
           "...\n",
@@ -574,15 +650,40 @@ int main(int argc, char **argv_orig, char **envp) {
   if ((s = accept(sock, NULL, NULL)) < 0) { PFATAL("accept() failed"); }
   fprintf(stderr, "Received connection, starting ...\n");
 
+#ifdef SO_PRIORITY
+  priority = 7;
+  if (setsockopt(s, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) < 0) {
+
+    priority = 6;
+    if (setsockopt(s, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) < 0)
+      WARNF("could not set priority on socket");
+
+  }
+
+#endif
+
   while ((in_len = recv_testcase(s, (void **)&in_data, &max_len)) > 0) {
 
     // fprintf(stderr, "received %u\n", in_len);
     run_target(fsrv, use_argv, in_data, in_len, 1);
 
-    if (send(s, &fsrv->child_status, 4, 0) != 4)
-      FATAL("could not send waitpid data");
-    if (send(s, fsrv->trace_bits, fsrv->map_size, 0) != fsrv->map_size)
-      FATAL("could not send coverage data");
+    memcpy(send_buf + 4, fsrv->trace_bits, fsrv->map_size);
+
+#ifdef USE_DEFLATE
+    memcpy(buf2, &fsrv->child_status, 4);
+    *lenptr = (u32)libdeflate_deflate_compress(
+        compressor, send_buf + 4, fsrv->map_size, buf2 + 8, buf2_len - 8);
+    // fprintf(stderr, "COMPRESS (%u->%u): ", fsrv->map_size, *lenptr);
+    // for (u32 i = 0; i < fsrv->map_size; i++) fprintf(stderr, "%02x",
+    // fsrv->trace_bits[i]); fprintf(stderr, "\n");
+    if (send(s, buf2, *lenptr + 8, 0) != 8 + *lenptr)
+      FATAL("could not send data");
+#else
+    memcpy(send_buf, &fsrv->child_status, 4);
+    if (send(s, send_buf, fsrv->map_size + 4, 0) != 4 + fsrv->map_size)
+      FATAL("could not send data");
+#endif
+
     // fprintf(stderr, "sent result\n");
 
   }
@@ -595,6 +696,11 @@ int main(int argc, char **argv_orig, char **envp) {
   afl_fsrv_deinit(fsrv);
   if (fsrv->target_path) { ck_free(fsrv->target_path); }
   if (in_data) { ck_free(in_data); }
+#if USE_DEFLATE
+  if (buf2) { ck_free(buf2); }
+  libdeflate_free_compressor(compressor);
+  libdeflate_free_decompressor(decompressor);
+#endif
 
   argv_cpy_free(argv);
 
-- 
cgit 1.4.1


From e592b4bcf0f85ff128d684f83d8aa9328ccca39f Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 4 May 2020 10:37:45 +0200
Subject: nw fixes

---
 examples/afl_network_proxy/afl-network-client.c | 28 +++++++++++++------------
 examples/afl_network_proxy/afl-network-server.c |  6 +++---
 2 files changed, 18 insertions(+), 16 deletions(-)

(limited to 'examples/afl_network_proxy/afl-network-client.c')

diff --git a/examples/afl_network_proxy/afl-network-client.c b/examples/afl_network_proxy/afl-network-client.c
index 94f6bb42..781ea328 100644
--- a/examples/afl_network_proxy/afl-network-client.c
+++ b/examples/afl_network_proxy/afl-network-client.c
@@ -302,7 +302,7 @@ int main(int argc, char *argv[]) {
   compressor = libdeflate_alloc_compressor(1);
   struct libdeflate_decompressor *decompressor;
   decompressor = libdeflate_alloc_decompressor();
-  fprintf(stderr, "Compile with compression support\n");
+  fprintf(stderr, "Compiled with compression support\n");
 #endif
 
   if (s == -1)
@@ -321,6 +321,7 @@ int main(int argc, char *argv[]) {
 
     // fprintf(stderr, "Sending testcase with len %u\n", *lenptr);
 #ifdef USE_DEFLATE
+  #ifdef COMPRESS_TESTCASES
     // we only compress the testcase if it does not fit in the TCP packet
     if (*lenptr > 1500 - 20 - 32 - 4) {
 
@@ -330,24 +331,25 @@ int main(int argc, char *argv[]) {
                                                   buf2 + 8, buf2_len);
       if (send(s, buf2, *lenptr2 + 8, 0) != *lenptr2 + 8)
         PFATAL("sending test data failed");
-      fprintf(stderr, "COMPRESS (%u->%u):\n", *lenptr, *lenptr2);
-      for (u32 i = 0; i < *lenptr; i++)
-        fprintf(stderr, "%02x", buf[i + 4]);
-      fprintf(stderr, "\n");
-      for (u32 i = 0; i < *lenptr2; i++)
-        fprintf(stderr, "%02x", buf2[i + 8]);
-      fprintf(stderr, "\n");
+      //fprintf(stderr, "COMPRESS (%u->%u):\n", *lenptr, *lenptr2);
+      //for (u32 i = 0; i < *lenptr; i++)
+      //  fprintf(stderr, "%02x", buf[i + 4]);
+      //fprintf(stderr, "\n");
+      //for (u32 i = 0; i < *lenptr2; i++)
+      //  fprintf(stderr, "%02x", buf2[i + 8]);
+      //fprintf(stderr, "\n");
 
     } else {
-
+  #endif
 #endif
       if (send(s, buf, *lenptr + 4, 0) != *lenptr + 4)
         PFATAL("sending test data failed");
 #ifdef USE_DEFLATE
+  #ifdef COMPRESS_TESTCASES
       // fprintf(stderr, "unCOMPRESS (%u)\n", *lenptr);
 
     }
-
+  #endif
 #endif
 
     received = 0;
@@ -379,9 +381,9 @@ int main(int argc, char *argv[]) {
                                       &decompress_len) != LIBDEFLATE_SUCCESS ||
         decompress_len != __afl_map_size)
       FATAL("decompression failed");
-// fprintf(stderr, "DECOMPRESS (%u->%u): ", compress_len, decompress_len);
-// for (u32 i = 0; i < __afl_map_size; i++) fprintf(stderr, "%02x",
-// __afl_area_ptr[i]); fprintf(stderr, "\n");
+    // fprintf(stderr, "DECOMPRESS (%u->%u): ", compress_len, decompress_len);
+    // for (u32 i = 0; i < __afl_map_size; i++) fprintf(stderr, "%02x",
+    // __afl_area_ptr[i]); fprintf(stderr, "\n");
 #else
     while (received < __afl_map_size &&
            (ret = recv(s, __afl_area_ptr + received, __afl_map_size - received,
diff --git a/examples/afl_network_proxy/afl-network-server.c b/examples/afl_network_proxy/afl-network-server.c
index ffe37447..01501cc9 100644
--- a/examples/afl_network_proxy/afl-network-server.c
+++ b/examples/afl_network_proxy/afl-network-server.c
@@ -354,7 +354,7 @@ int recv_testcase(int s, void **buf, size_t *max_len) {
   if (size == 0) FATAL("did not receive valid size information");
   // fprintf(stderr, "received size information of %d\n", size);
 
-  if ((size && 0xff000000) != 0xff000000) {
+  if ((size & 0xff000000) != 0xff000000) {
 
     *buf = maybe_grow(buf, max_len, size);
     received = 0;
@@ -367,13 +367,13 @@ int recv_testcase(int s, void **buf, size_t *max_len) {
 
 #ifdef USE_DEFLATE
     u32 clen;
-    size = (size & 0x00ffffff);
+    size -= 0xff000000;
     *buf = maybe_grow(buf, max_len, size);
     received = 0;
     while (received < 4 &&
            (ret = recv(s, &clen + received, 4 - received, 0)) > 0)
       received += ret;
-    if (received != 4) FATAL("did not receive size information");
+    if (received != 4) FATAL("did not receive clen1 information");
     // fprintf(stderr, "received clen information of %d\n", clen);
     if (clen < 1)
       FATAL("did not receive valid compressed len information: %u", clen);
-- 
cgit 1.4.1


From 16c16b3e6e0cd678f5da76f757761fb821f1011f Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 4 May 2020 18:01:47 +0200
Subject: ctx and ngram can be used together now

---
 docs/Changelog.md                               |   1 +
 docs/env_variables.md                           |   6 +-
 examples/afl_network_proxy/afl-network-client.c |  26 +--
 llvm_mode/afl-clang-fast.c                      | 202 +++++++++++++++---------
 llvm_mode/afl-llvm-pass.so.cc                   |  15 +-
 5 files changed, 150 insertions(+), 100 deletions(-)

(limited to 'examples/afl_network_proxy/afl-network-client.c')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index cae99681..8c0624b6 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -20,6 +20,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
        address for the shared memory map is used as this increases the
        fuzzing speed
      - fixes to LTO mode if instrumented edges > MAP_SIZE
+     - CTX and NGRAM can now be used together
      - added AFL_LLVM_SKIP_NEVERZERO to skip the never zero coverage counter
        implmentation. For targets with little or no loops or heavy called
        functions. Gives a small performance boost.
diff --git a/docs/env_variables.md b/docs/env_variables.md
index bdbb8520..ab5808ec 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -97,12 +97,14 @@ Then there are a few specific features that are only available in llvm_mode:
 
     - AFL_LLVM_INSTRUMENT - this configures the instrumentation mode. 
       Available options:
-        DEFAULT - classic AFL (map[cur_loc ^ prev_loc >> 1]++)
+        CLASSIC - classic AFL (map[cur_loc ^ prev_loc >> 1]++) (default)
         CFG - InsTrim instrumentation (see below)
         LTO - LTO instrumentation (see below)
         CTX - context sensitive instrumentation (see below)
         NGRAM-x - deeper previous location coverage (from NGRAM-2 up to NGRAM-16)
-      Only one can be used.
+      In CLASSIC (default) can can also specify CTX and/nor NGRAM, seperate
+      the options with a comma "," then, e.g.:
+        AFL_LLVM_INSTRUMENT=CLASSIC,CTX,NGRAM-4
 
 ### LTO
 
diff --git a/examples/afl_network_proxy/afl-network-client.c b/examples/afl_network_proxy/afl-network-client.c
index 781ea328..cf09b2ad 100644
--- a/examples/afl_network_proxy/afl-network-client.c
+++ b/examples/afl_network_proxy/afl-network-client.c
@@ -321,7 +321,7 @@ int main(int argc, char *argv[]) {
 
     // fprintf(stderr, "Sending testcase with len %u\n", *lenptr);
 #ifdef USE_DEFLATE
-  #ifdef COMPRESS_TESTCASES
+#ifdef COMPRESS_TESTCASES
     // we only compress the testcase if it does not fit in the TCP packet
     if (*lenptr > 1500 - 20 - 32 - 4) {
 
@@ -331,25 +331,27 @@ int main(int argc, char *argv[]) {
                                                   buf2 + 8, buf2_len);
       if (send(s, buf2, *lenptr2 + 8, 0) != *lenptr2 + 8)
         PFATAL("sending test data failed");
-      //fprintf(stderr, "COMPRESS (%u->%u):\n", *lenptr, *lenptr2);
-      //for (u32 i = 0; i < *lenptr; i++)
+      // fprintf(stderr, "COMPRESS (%u->%u):\n", *lenptr, *lenptr2);
+      // for (u32 i = 0; i < *lenptr; i++)
       //  fprintf(stderr, "%02x", buf[i + 4]);
-      //fprintf(stderr, "\n");
-      //for (u32 i = 0; i < *lenptr2; i++)
+      // fprintf(stderr, "\n");
+      // for (u32 i = 0; i < *lenptr2; i++)
       //  fprintf(stderr, "%02x", buf2[i + 8]);
-      //fprintf(stderr, "\n");
+      // fprintf(stderr, "\n");
 
     } else {
-  #endif
+
+#endif
 #endif
       if (send(s, buf, *lenptr + 4, 0) != *lenptr + 4)
         PFATAL("sending test data failed");
 #ifdef USE_DEFLATE
-  #ifdef COMPRESS_TESTCASES
+#ifdef COMPRESS_TESTCASES
       // fprintf(stderr, "unCOMPRESS (%u)\n", *lenptr);
 
     }
-  #endif
+
+#endif
 #endif
 
     received = 0;
@@ -381,9 +383,9 @@ int main(int argc, char *argv[]) {
                                       &decompress_len) != LIBDEFLATE_SUCCESS ||
         decompress_len != __afl_map_size)
       FATAL("decompression failed");
-    // fprintf(stderr, "DECOMPRESS (%u->%u): ", compress_len, decompress_len);
-    // for (u32 i = 0; i < __afl_map_size; i++) fprintf(stderr, "%02x",
-    // __afl_area_ptr[i]); fprintf(stderr, "\n");
+      // fprintf(stderr, "DECOMPRESS (%u->%u): ", compress_len, decompress_len);
+      // for (u32 i = 0; i < __afl_map_size; i++) fprintf(stderr, "%02x",
+      // __afl_area_ptr[i]); fprintf(stderr, "\n");
 #else
     while (received < __afl_map_size &&
            (ret = recv(s, __afl_area_ptr + received, __afl_map_size - received,
diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c
index c59b814d..9f85e5c6 100644
--- a/llvm_mode/afl-clang-fast.c
+++ b/llvm_mode/afl-clang-fast.c
@@ -43,7 +43,7 @@ static u8 * obj_path;                  /* Path to runtime libraries         */
 static u8 **cc_params;                 /* Parameters passed to the real CC  */
 static u32  cc_par_cnt = 1;            /* Param count, including argv0      */
 static u8   llvm_fullpath[PATH_MAX];
-static u8   instrument_mode;
+static u8   instrument_mode, instrument_opt_mode, ngram_size;
 static u8 * lto_flag = AFL_CLANG_FLTO;
 static u8 * march_opt = CFLAGS_OPT;
 static u8   debug;
@@ -60,14 +60,15 @@ enum {
   INSTRUMENT_INSTRIM = 2,
   INSTRUMENT_CFG = 2,
   INSTRUMENT_LTO = 3,
-  INSTRUMENT_CTX = 4,
-  INSTRUMENT_NGRAM = 5  // + ngram value of 2-16 = 7 - 21
+  INSTRUMENT_OPT_CTX = 4,
+  INSTRUMENT_OPT_NGRAM = 8
 
 };
 
-char instrument_mode_string[6][16] = {
+char instrument_mode_string[10][16] = {
 
-    "DEFAULT", "PCGUARD", "CFG", "LTO", "CTX",
+    "CLASSIC", "PCGUARD", "CFG",   "LTO", "CTX", "",
+    "",        "",        "NGRAM", ""
 
 };
 
@@ -562,59 +563,6 @@ int main(int argc, char **argv, char **envp) {
   instrument_mode = INSTRUMENT_PCGUARD;
 #endif
 
-  if (getenv("AFL_LLVM_SKIP_NEVERZERO") && getenv("AFL_LLVM_NOT_ZERO"))
-    FATAL(
-        "AFL_LLVM_NOT_ZERO and AFL_LLVM_SKIP_NEVERZERO can not be set "
-        "together");
-
-  if ((ptr = getenv("AFL_LLVM_INSTRUMENT")) != NULL) {
-
-    if (strncasecmp(ptr, "default", strlen("default")) == 0 ||
-        strncasecmp(ptr, "afl", strlen("afl")) == 0 ||
-        strncasecmp(ptr, "classic", strlen("classic")) == 0)
-      instrument_mode = INSTRUMENT_DEFAULT;
-    if (strncasecmp(ptr, "cfg", strlen("cfg")) == 0 ||
-        strncasecmp(ptr, "instrim", strlen("instrim")) == 0)
-      instrument_mode = INSTRUMENT_CFG;
-    else if (strncasecmp(ptr, "pc-guard", strlen("pc-guard")) == 0 ||
-             strncasecmp(ptr, "pcguard", strlen("pcgard")) == 0)
-      instrument_mode = INSTRUMENT_PCGUARD;
-    else if (strncasecmp(ptr, "lto", strlen("lto")) == 0)
-      instrument_mode = INSTRUMENT_LTO;
-    else if (strncasecmp(ptr, "ctx", strlen("ctx")) == 0) {
-
-      instrument_mode = INSTRUMENT_CTX;
-      setenv("AFL_LLVM_CTX", "1", 1);
-
-    } else if (strncasecmp(ptr, "ngram", strlen("ngram")) == 0) {
-
-      ptr += strlen("ngram");
-      while (*ptr && (*ptr < '0' || *ptr > '9'))
-        ptr++;
-      if (!*ptr)
-        if ((ptr = getenv("AFL_LLVM_NGRAM_SIZE")) != NULL)
-          FATAL(
-              "you must set the NGRAM size with (e.g. for value 2) "
-              "AFL_LLVM_INSTRUMENT=ngram-2");
-      instrument_mode = INSTRUMENT_NGRAM + atoi(ptr);
-      if (instrument_mode < INSTRUMENT_NGRAM + 2 ||
-          instrument_mode > INSTRUMENT_NGRAM + NGRAM_SIZE_MAX)
-        FATAL(
-            "NGRAM instrumentation mode must be between 2 and NGRAM_SIZE_MAX "
-            "(%u)",
-            NGRAM_SIZE_MAX);
-
-      ptr = alloc_printf("%u", instrument_mode - INSTRUMENT_NGRAM);
-      setenv("AFL_LLVM_NGRAM_SIZE", ptr, 1);
-
-    } else if (strncasecmp(ptr, "classic", strlen("classic")) != 0 ||
-
-               strncasecmp(ptr, "default", strlen("default")) != 0 ||
-               strncasecmp(ptr, "afl", strlen("afl")) != 0)
-      FATAL("unknown AFL_LLVM_INSTRUMENT value: %s", ptr);
-
-  }
-
   if (getenv("USE_TRACE_PC") || getenv("AFL_USE_TRACE_PC") ||
       getenv("AFL_LLVM_USE_TRACE_PC") || getenv("AFL_TRACE_PC")) {
 
@@ -636,39 +584,116 @@ int main(int argc, char **argv, char **envp) {
 
   }
 
-  if (getenv("AFL_LLVM_CTX")) {
+  if (getenv("AFL_LLVM_CTX")) instrument_opt_mode |= INSTRUMENT_OPT_CTX;
 
-    if (instrument_mode == 0)
-      instrument_mode = INSTRUMENT_CTX;
-    else if (instrument_mode != INSTRUMENT_CTX)
-      FATAL("you can not set AFL_LLVM_INSTRUMENT and AFL_LLVM_CTX together");
+  if (getenv("AFL_LLVM_NGRAM_SIZE")) {
+
+    instrument_opt_mode |= INSTRUMENT_OPT_NGRAM;
+    ngram_size = atoi(getenv("AFL_LLVM_NGRAM_SIZE"));
+    if (ngram_size < 2 || ngram_size > NGRAM_SIZE_MAX)
+      FATAL(
+          "NGRAM instrumentation mode must be between 2 and NGRAM_SIZE_MAX "
+          "(%u)",
+          NGRAM_SIZE_MAX);
 
   }
 
-  if (getenv("AFL_LLVM_NGRAM_SIZE")) {
+  if (getenv("AFL_LLVM_INSTRUMENT")) {
 
-    if (instrument_mode == 0) {
+    u8 *ptr = strtok(getenv("AFL_LLVM_INSTRUMENT"), ":,;");
 
-      instrument_mode = INSTRUMENT_NGRAM + atoi(getenv("AFL_LLVM_NGRAM_SIZE"));
-      if (instrument_mode < INSTRUMENT_NGRAM + 2 ||
-          instrument_mode > INSTRUMENT_NGRAM + NGRAM_SIZE_MAX)
-        FATAL(
-            "NGRAM instrumentation mode must be between 2 and NGRAM_SIZE_MAX "
-            "(%u)",
-            NGRAM_SIZE_MAX);
+    while (ptr) {
 
-    } else if (instrument_mode != INSTRUMENT_NGRAM)
+      if (strncasecmp(ptr, "default", strlen("default")) == 0 ||
+          strncasecmp(ptr, "afl", strlen("afl")) == 0 ||
+          strncasecmp(ptr, "classic", strlen("classic")) == 0) {
 
-      FATAL(
-          "you can not set AFL_LLVM_INSTRUMENT and AFL_LLVM_NGRAM_SIZE "
-          "together");
+        if (!instrument_mode || instrument_mode == INSTRUMENT_DEFAULT)
+          instrument_mode = INSTRUMENT_DEFAULT;
+        else
+          FATAL("main instrumentation mode already set with %s",
+                instrument_mode_string[instrument_mode]);
+
+      }
+
+      if (strncasecmp(ptr, "pc-guard", strlen("pc-guard")) == 0 ||
+          strncasecmp(ptr, "pcguard", strlen("pcgard")) == 0) {
+
+        if (!instrument_mode || instrument_mode == INSTRUMENT_PCGUARD)
+          instrument_mode = INSTRUMENT_PCGUARD;
+        else
+          FATAL("main instrumentation mode already set with %s",
+                instrument_mode_string[instrument_mode]);
+
+      }
+
+      if (strncasecmp(ptr, "cfg", strlen("cfg")) == 0 ||
+          strncasecmp(ptr, "instrim", strlen("instrim")) == 0) {
+
+        if (!instrument_mode || instrument_mode == INSTRUMENT_CFG)
+          instrument_mode = INSTRUMENT_CFG;
+        else
+          FATAL("main instrumentation mode already set with %s",
+                instrument_mode_string[instrument_mode]);
+
+      }
+
+      if (strncasecmp(ptr, "lto", strlen("lto")) == 0) {
+
+        if (!instrument_mode || instrument_mode == INSTRUMENT_LTO)
+          instrument_mode = INSTRUMENT_LTO;
+        else
+          FATAL("main instrumentation mode already set with %s",
+                instrument_mode_string[instrument_mode]);
+
+      }
+
+      if (strncasecmp(ptr, "ctx", strlen("ctx")) == 0) {
+
+        instrument_opt_mode |= INSTRUMENT_OPT_CTX;
+        setenv("AFL_LLVM_CTX", "1", 1);
+
+      }
+
+      if (strncasecmp(ptr, "ngram", strlen("ngram")) == 0) {
+
+        ptr += strlen("ngram");
+        while (*ptr && (*ptr < '0' || *ptr > '9'))
+          ptr++;
+        if (!*ptr)
+          if ((ptr = getenv("AFL_LLVM_NGRAM_SIZE")) != NULL)
+            FATAL(
+                "you must set the NGRAM size with (e.g. for value 2) "
+                "AFL_LLVM_INSTRUMENT=ngram-2");
+        ngram_size = atoi(ptr);
+        if (ngram_size < 2 || ngram_size > NGRAM_SIZE_MAX)
+          FATAL(
+              "NGRAM instrumentation option must be between 2 and "
+              "NGRAM_SIZE_MAX "
+              "(%u)",
+              NGRAM_SIZE_MAX);
+        instrument_opt_mode |= (INSTRUMENT_OPT_NGRAM);
+        ptr = alloc_printf("%u", ngram_size);
+        setenv("AFL_LLVM_NGRAM_SIZE", ptr, 1);
+
+      }
+
+      ptr = strtok(NULL, ":,;");
+
+    }
 
   }
 
-  if (instrument_mode < INSTRUMENT_NGRAM)
+  if (!instrument_opt_mode)
     ptr = instrument_mode_string[instrument_mode];
+  else if (instrument_opt_mode == INSTRUMENT_OPT_CTX)
+    ptr = alloc_printf("%s + CTX", instrument_mode_string[instrument_mode]);
+  else if (instrument_opt_mode == INSTRUMENT_OPT_NGRAM)
+    ptr = alloc_printf("%s + NGRAM-%u", instrument_mode_string[instrument_mode],
+                       ngram_size);
   else
-    ptr = alloc_printf("NGRAM-%u", instrument_mode - INSTRUMENT_NGRAM);
+    ptr = alloc_printf("%s + CTX + NGRAM-%u",
+                       instrument_mode_string[instrument_mode], ngram_size);
 
   if (strstr(argv[0], "afl-clang-lto") != NULL) {
 
@@ -690,9 +715,28 @@ int main(int argc, char **argv, char **envp) {
 
 #ifndef AFL_CLANG_FLTO
   if (instrument_mode == INSTRUMENT_LTO)
-    FATAL("instrumentation mode LTO specified but LLVM support not available");
+    FATAL(
+        "instrumentation mode LTO specified but LLVM support not available "
+        "(requires LLVM 11)");
 #endif
 
+  if (instrument_opt_mode && instrument_mode != INSTRUMENT_CLASSIC)
+    /*&& instrument_mode != INSTRUMENT_CFG*/
+    FATAL(
+        "CTX and NGRAM instrumentation options can only be used with the "
+        "CLASSIC instrumentation mode!");
+
+  if (getenv("AFL_LLVM_SKIP_NEVERZERO") && getenv("AFL_LLVM_NOT_ZERO"))
+    FATAL(
+        "AFL_LLVM_NOT_ZERO and AFL_LLVM_SKIP_NEVERZERO can not be set "
+        "together");
+
+  if (instrument_mode == INSTRUMENT_CFG &&
+      getenv("AFL_LLVM_INSTRIM_SKIPSINGLEBLOCK") == NULL && ngram_size)
+    FATAL(
+        "NGRAM option together with CFG/INSTRIM instrumentation mode can only "
+        "be used if AFL_LLVM_INSTRIM_SKIPSINGLEBLOCK is set");
+
   if (argc < 2 || strcmp(argv[1], "-h") == 0) {
 
     if (instrument_mode != INSTRUMENT_LTO)
diff --git a/llvm_mode/afl-llvm-pass.so.cc b/llvm_mode/afl-llvm-pass.so.cc
index 3e9026c8..42a2f3af 100644
--- a/llvm_mode/afl-llvm-pass.so.cc
+++ b/llvm_mode/afl-llvm-pass.so.cc
@@ -182,7 +182,7 @@ bool AFLCoverage::runOnModule(Module &M) {
 #endif
   skip_nozero = getenv("AFL_LLVM_SKIP_NEVERZERO");
 
-  unsigned PrevLocSize;
+  unsigned PrevLocSize = 0;
 
   char *ngram_size_str = getenv("AFL_LLVM_NGRAM_SIZE");
   if (!ngram_size_str) ngram_size_str = getenv("AFL_NGRAM_SIZE");
@@ -216,9 +216,6 @@ bool AFLCoverage::runOnModule(Module &M) {
   if (ngram_size) PrevLocTy = VectorType::get(IntLocTy, PrevLocVecSize);
 #endif
 
-  if (ctx_str && ngram_size_str)
-    FATAL("you must decide between NGRAM and CTX instrumentation");
-
   /* Get globals for the SHM region and the previous location. Note that
      __afl_prev_loc is thread-local. */
 
@@ -437,8 +434,10 @@ bool AFLCoverage::runOnModule(Module &M) {
         PrevLocTrans = IRB.CreateXorReduce(PrevLoc);
       else
 #endif
-          if (ctx_str)
-        PrevLocTrans = IRB.CreateZExt(IRB.CreateXor(PrevLoc, PrevCtx), Int32Ty);
+        PrevLocTrans = PrevLoc;
+      if (ctx_str)
+        PrevLocTrans =
+            IRB.CreateZExt(IRB.CreateXor(PrevLocTrans, PrevCtx), Int32Ty);
       else
         PrevLocTrans = IRB.CreateZExt(PrevLoc, IRB.getInt32Ty());
 
@@ -452,7 +451,9 @@ bool AFLCoverage::runOnModule(Module &M) {
       if (ngram_size)
         MapPtrIdx = IRB.CreateGEP(
             MapPtr,
-            IRB.CreateZExt(IRB.CreateXor(PrevLocTrans, CurLoc), Int32Ty));
+            IRB.CreateZExt(
+                IRB.CreateXor(PrevLocTrans, IRB.CreateZExt(CurLoc, Int32Ty)),
+                Int32Ty));
       else
 #endif
         MapPtrIdx = IRB.CreateGEP(MapPtr, IRB.CreateXor(PrevLocTrans, CurLoc));
-- 
cgit 1.4.1