From a6521e89fc521a07013fd28896ac755f6b8c3a6b Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 10 Aug 2020 01:04:50 +0200
Subject: different driver

---
 examples/aflpp_driver/aflpp_driver.c | 23 ++++++-----------------
 1 file changed, 6 insertions(+), 17 deletions(-)

(limited to 'examples/aflpp_driver/aflpp_driver.c')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 7d388799..35b4f67f 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -106,9 +106,6 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
   #error "Support for your platform has not been implemented"
 #endif
 
-int                   __afl_sharedmem_fuzzing = 1;
-extern unsigned int * __afl_fuzz_len;
-extern unsigned char *__afl_fuzz_ptr;
 extern unsigned char *__afl_area_ptr;
 // extern struct cmp_map *__afl_cmp_map;
 
@@ -269,6 +266,7 @@ __attribute__((constructor(1))) void __afl_protect(void) {
 int main(int argc, char **argv) {
 
   fprintf(stderr, "dummy map is at %p\n", __afl_area_ptr);
+  unsigned char buf[1024000];
 
   printf(
       "======================= INFO =========================\n"
@@ -306,7 +304,6 @@ int main(int argc, char **argv) {
     printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
   else if (argc > 1) {
 
-    __afl_sharedmem_fuzzing = 0;
     munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
     __afl_area_ptr = NULL;
     __afl_manual_init();
@@ -328,25 +325,17 @@ int main(int argc, char **argv) {
   int num_runs = 0;
   while (__afl_persistent_loop(N)) {
 
-#ifdef _DEBUG
-    fprintf(stderr, "CLIENT crc: %016llx len: %u\n",
-            hash64(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705),
-            *__afl_fuzz_len);
-    fprintf(stderr, "RECV:");
-    for (int i = 0; i < *__afl_fuzz_len; i++)
-      fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
-    fprintf(stderr, "\n");
-#endif
-    if (*__afl_fuzz_len) {
+    ssize_t n = read(0, buf, sizeof(buf));
+
+    if (n > 0) {
 
-      num_runs++;
-      LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
+      LLVMFuzzerTestOneInput(buf, n);
 
     }
 
   }
 
-  printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);
+  printf("%s: successfully executed input(s)\n", argv[0]);
 
 }
 
-- 
cgit 1.4.1


From 9945c1648b519b0ef1490ee5eba97665af7f4caf Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 10 Aug 2020 01:34:45 +0200
Subject: fix driver

---
 examples/aflpp_driver/aflpp_driver.c | 20 --------------------
 1 file changed, 20 deletions(-)

(limited to 'examples/aflpp_driver/aflpp_driver.c')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 35b4f67f..a3a78b4e 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -106,9 +106,6 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
   #error "Support for your platform has not been implemented"
 #endif
 
-extern unsigned char *__afl_area_ptr;
-// extern struct cmp_map *__afl_cmp_map;
-
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
 __attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
@@ -248,24 +245,11 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 __attribute__((constructor(1))) void __afl_protect(void) {
 
   setenv("__AFL_DEFER_FORKSRV", "1", 1);
-  __afl_area_ptr = (unsigned char *)mmap(
-      (void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-      MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr = (unsigned char *)mmap((void *)0x10000, MAX_DUMMY_SIZE,
-                                           PROT_READ | PROT_WRITE,
-                                           MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr =
-        (unsigned char *)mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-                              MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  // __afl_cmp_map = (struct cmp_map *)__afl_area_ptr;
 
 }
 
 int main(int argc, char **argv) {
 
-  fprintf(stderr, "dummy map is at %p\n", __afl_area_ptr);
   unsigned char buf[1024000];
 
   printf(
@@ -304,8 +288,6 @@ int main(int argc, char **argv) {
     printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
   else if (argc > 1) {
 
-    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
-    __afl_area_ptr = NULL;
     __afl_manual_init();
     return ExecuteFilesOnyByOne(argc, argv);
 
@@ -314,8 +296,6 @@ int main(int argc, char **argv) {
   assert(N > 0);
 
   //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
-  munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
-  __afl_area_ptr = NULL;
   __afl_manual_init();
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
-- 
cgit 1.4.1


From 9b71f7e5e49ee5fd9987fadbaca2f0e548680b33 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 10 Aug 2020 08:47:52 +0200
Subject: debug

---
 examples/aflpp_driver/aflpp_driver.c | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'examples/aflpp_driver/aflpp_driver.c')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index a3a78b4e..1e7978b3 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -252,6 +252,8 @@ int main(int argc, char **argv) {
 
   unsigned char buf[1024000];
 
+  printf("__afl_area_ptr is at %p\n", __afl_area_ptr);
+
   printf(
       "======================= INFO =========================\n"
       "This binary is built for afl++.\n"
@@ -297,6 +299,7 @@ int main(int argc, char **argv) {
 
   //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
   __afl_manual_init();
+  fprintf(stderr, "__afl_area_ptr is now at %p\n", __afl_area_ptr);
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
   // on the first execution of LLVMFuzzerTestOneInput is ignored.
-- 
cgit 1.4.1


From 87da1e7af6b91c3e85f8ba0a846ed820713eda5f Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 10 Aug 2020 09:16:55 +0200
Subject: fix driver

---
 examples/aflpp_driver/aflpp_driver.c | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'examples/aflpp_driver/aflpp_driver.c')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 1e7978b3..2a3b7dab 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -118,6 +118,8 @@ int                  __afl_persistent_loop(unsigned int);
 static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
 void                 __afl_manual_init();
 
+extern unsigned int *__afl_area_ptr;
+
 // Use this optionally defined function to output sanitizer messages even if
 // user asks to close stderr.
 __attribute__((weak)) void __sanitizer_set_report_fd(void *);
-- 
cgit 1.4.1


From 3aa7d8081d20c824aa19c6383637ade7334e8353 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 10 Aug 2020 11:23:33 +0200
Subject: fuzzbench integration

---
 examples/aflpp_driver/aflpp_driver.c | 41 ++++++++++++++++++++++++++----------
 llvm_mode/afl-llvm-rt.o.c            |  1 -
 2 files changed, 30 insertions(+), 12 deletions(-)

(limited to 'examples/aflpp_driver/aflpp_driver.c')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 2a3b7dab..397228ed 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -106,6 +106,10 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
   #error "Support for your platform has not been implemented"
 #endif
 
+int                   __afl_sharedmem_fuzzing = 0;
+extern unsigned char *__afl_area_ptr;
+// extern struct cmp_map *__afl_cmp_map;
+
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
 __attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
@@ -118,8 +122,6 @@ int                  __afl_persistent_loop(unsigned int);
 static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
 void                 __afl_manual_init();
 
-extern unsigned int *__afl_area_ptr;
-
 // Use this optionally defined function to output sanitizer messages even if
 // user asks to close stderr.
 __attribute__((weak)) void __sanitizer_set_report_fd(void *);
@@ -247,14 +249,24 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 __attribute__((constructor(1))) void __afl_protect(void) {
 
   setenv("__AFL_DEFER_FORKSRV", "1", 1);
+  __afl_area_ptr = (unsigned char *)mmap(
+      (void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
+      MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+  if ((uint64_t)__afl_area_ptr == -1)
+    __afl_area_ptr = (unsigned char *)mmap((void *)0x10000, MAX_DUMMY_SIZE,
+                                           PROT_READ | PROT_WRITE,
+                                           MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+  if ((uint64_t)__afl_area_ptr == -1)
+    __afl_area_ptr =
+        (unsigned char *)mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
+                              MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+  // __afl_cmp_map = (struct cmp_map *)__afl_area_ptr;
 
 }
 
 int main(int argc, char **argv) {
 
-  unsigned char buf[1024000];
-
-  printf("__afl_area_ptr is at %p\n", __afl_area_ptr);
+  fprintf(stderr, "dummy map is at %p\n", __afl_area_ptr);
 
   printf(
       "======================= INFO =========================\n"
@@ -282,6 +294,7 @@ int main(int argc, char **argv) {
   // Do any other expensive one-time initialization here.
 
   uint8_t dummy_input[64] = {0};
+  uint8_t buf[1024000];
   memcpy(dummy_input, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
   memcpy(dummy_input + 32, (void *)AFL_DEFER_FORKSVR,
          sizeof(AFL_DEFER_FORKSVR));
@@ -292,6 +305,9 @@ int main(int argc, char **argv) {
     printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
   else if (argc > 1) {
 
+    __afl_sharedmem_fuzzing = 0;
+    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
+    __afl_area_ptr = NULL;
     __afl_manual_init();
     return ExecuteFilesOnyByOne(argc, argv);
 
@@ -299,9 +315,12 @@ int main(int argc, char **argv) {
 
   assert(N > 0);
 
-  //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
-  __afl_manual_init();
-  fprintf(stderr, "__afl_area_ptr is now at %p\n", __afl_area_ptr);
+  if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
+    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
+    __afl_area_ptr = NULL;
+    __afl_manual_init();
+  }
+  fprintf(stderr, "dummy map is now at %p\n", __afl_area_ptr);
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
   // on the first execution of LLVMFuzzerTestOneInput is ignored.
@@ -310,11 +329,11 @@ int main(int argc, char **argv) {
   int num_runs = 0;
   while (__afl_persistent_loop(N)) {
 
-    ssize_t n = read(0, buf, sizeof(buf));
+    ssize_t r = read(0, buf, sizeof(buf));
 
-    if (n > 0) {
+    if (r > 0) {
 
-      LLVMFuzzerTestOneInput(buf, n);
+      LLVMFuzzerTestOneInput(buf, r);
 
     }
 
diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c
index 431eb4ac..5ffae39c 100644
--- a/llvm_mode/afl-llvm-rt.o.c
+++ b/llvm_mode/afl-llvm-rt.o.c
@@ -838,7 +838,6 @@ void __afl_manual_init(void) {
       fprintf(stderr,
               "DEBUG: disabled instrumenation because of "
               "AFL_DISABLE_LLVM_INSTRUMENTATION\n");
-    __afl_area_ptr = __afl_area_initial;
 
   }
 
-- 
cgit 1.4.1


From 464c27082a8c75b400d4387d46a86542630cac45 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 10 Aug 2020 11:45:32 +0200
Subject: fuzzbench integration

---
 examples/aflpp_driver/aflpp_driver.c | 16 +++++++++-------
 llvm_mode/afl-llvm-rt.o.c            |  7 +++++++
 2 files changed, 16 insertions(+), 7 deletions(-)

(limited to 'examples/aflpp_driver/aflpp_driver.c')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 397228ed..2b7be45f 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -266,7 +266,7 @@ __attribute__((constructor(1))) void __afl_protect(void) {
 
 int main(int argc, char **argv) {
 
-  fprintf(stderr, "dummy map is at %p\n", __afl_area_ptr);
+  fprintf(stderr, "map is at %p\n", __afl_area_ptr);
 
   printf(
       "======================= INFO =========================\n"
@@ -305,10 +305,11 @@ int main(int argc, char **argv) {
     printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
   else if (argc > 1) {
 
-    __afl_sharedmem_fuzzing = 0;
-    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
-    __afl_area_ptr = NULL;
-    __afl_manual_init();
+    if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
+      munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
+      __afl_area_ptr = NULL;
+      __afl_manual_init();
+    }
     return ExecuteFilesOnyByOne(argc, argv);
 
   }
@@ -318,9 +319,10 @@ int main(int argc, char **argv) {
   if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
     munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
     __afl_area_ptr = NULL;
-    __afl_manual_init();
+    fprintf(stderr, "performing manual init\n");
+  __afl_manual_init();
   }
-  fprintf(stderr, "dummy map is now at %p\n", __afl_area_ptr);
+  fprintf(stderr, "map is now at %p\n", __afl_area_ptr);
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
   // on the first execution of LLVMFuzzerTestOneInput is ignored.
diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c
index 5ffae39c..02dd8dc8 100644
--- a/llvm_mode/afl-llvm-rt.o.c
+++ b/llvm_mode/afl-llvm-rt.o.c
@@ -834,6 +834,11 @@ void __afl_manual_init(void) {
   if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
 
     init_done = 1;
+    is_persistent = 0;
+    __afl_sharedmem_fuzzing = 0;
+    if (__afl_area_ptr == NULL)
+      __afl_area_ptr = __afl_area_initial;
+    
     if (getenv("AFL_DEBUG"))
       fprintf(stderr,
               "DEBUG: disabled instrumenation because of "
@@ -855,6 +860,8 @@ void __afl_manual_init(void) {
 
 __attribute__((constructor(CONST_PRIO))) void __afl_auto_init(void) {
 
+  if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
+
   is_persistent = !!getenv(PERSIST_ENV_VAR);
 
   if (getenv(DEFER_ENV_VAR)) return;
-- 
cgit 1.4.1


From 0ba09ee85a65878e70d1a224f9d41fcbac3ff1e5 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 11 Aug 2020 10:24:45 +0200
Subject: enhancements

---
 examples/aflpp_driver/aflpp_driver.c | 14 ++++++++------
 include/common.h                     |  2 +-
 llvm_mode/afl-llvm-rt.o.c            |  7 +++----
 src/afl-common.c                     | 30 +++++++++++++++++-------------
 src/afl-fuzz-one.c                   | 11 +++++------
 src/afl-fuzz.c                       | 11 +++++------
 6 files changed, 39 insertions(+), 36 deletions(-)

(limited to 'examples/aflpp_driver/aflpp_driver.c')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 2b7be45f..81782c67 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -306,10 +306,13 @@ int main(int argc, char **argv) {
   else if (argc > 1) {
 
     if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
+
       munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
       __afl_area_ptr = NULL;
       __afl_manual_init();
+
     }
+
     return ExecuteFilesOnyByOne(argc, argv);
 
   }
@@ -317,11 +320,14 @@ int main(int argc, char **argv) {
   assert(N > 0);
 
   if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
+
     munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
     __afl_area_ptr = NULL;
     fprintf(stderr, "performing manual init\n");
-  __afl_manual_init();
+    __afl_manual_init();
+
   }
+
   fprintf(stderr, "map is now at %p\n", __afl_area_ptr);
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
@@ -333,11 +339,7 @@ int main(int argc, char **argv) {
 
     ssize_t r = read(0, buf, sizeof(buf));
 
-    if (r > 0) {
-
-      LLVMFuzzerTestOneInput(buf, r);
-
-    }
+    if (r > 0) { LLVMFuzzerTestOneInput(buf, r); }
 
   }
 
diff --git a/include/common.h b/include/common.h
index 42c79c62..c7d57e07 100644
--- a/include/common.h
+++ b/include/common.h
@@ -55,7 +55,7 @@ extern u8 *doc_path;                    /* path to documentation dir        */
    @returns the path, allocating the string */
 
 u8 *find_binary(u8 *fname);
-u8 *find_binary_own_loc(u8 *fname, u8 *own_loc);
+u8 *find_afl_binary(u8 *fname, u8 *own_loc);
 
 /* Read a bitmap from file fname to memory
    This is for the -B option again. */
diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c
index c69d8bb7..20151aea 100644
--- a/llvm_mode/afl-llvm-rt.o.c
+++ b/llvm_mode/afl-llvm-rt.o.c
@@ -847,9 +847,8 @@ void __afl_manual_init(void) {
     init_done = 1;
     is_persistent = 0;
     __afl_sharedmem_fuzzing = 0;
-    if (__afl_area_ptr == NULL)
-      __afl_area_ptr = __afl_area_initial;
-    
+    if (__afl_area_ptr == NULL) __afl_area_ptr = __afl_area_initial;
+
     if (getenv("AFL_DEBUG"))
       fprintf(stderr,
               "DEBUG: disabled instrumenation because of "
@@ -886,7 +885,7 @@ __attribute__((constructor(0))) void __afl_auto_early(void) {
 
   is_persistent = !!getenv(PERSIST_ENV_VAR);
 
-    __afl_map_shm();
+  __afl_map_shm();
 
 }
 
diff --git a/src/afl-common.c b/src/afl-common.c
index dabeeedd..c1302080 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -138,7 +138,7 @@ void argv_cpy_free(char **argv) {
 
 }
 
-u8 *find_binary_own_loc(u8 *fname, u8 *own_loc) {
+u8 *find_afl_binary(u8 *fname, u8 *own_loc) {
 
   u8 *tmp, *rsl, *own_copy, *cp;
 
@@ -154,21 +154,25 @@ u8 *find_binary_own_loc(u8 *fname, u8 *own_loc) {
 
   }
 
-  own_copy = ck_strdup(own_loc);
-  rsl = strrchr(own_copy, '/');
+  if (own_loc) {
 
-  if (rsl) {
+    own_copy = ck_strdup(own_loc);
+    rsl = strrchr(own_copy, '/');
 
-    *rsl = 0;
+    if (rsl) {
 
-    cp = alloc_printf("%s/%s", own_copy, fname);
-    ck_free(own_copy);
+      *rsl = 0;
 
-    if (!access(cp, X_OK)) { return cp; }
+      cp = alloc_printf("%s/%s", own_copy, fname);
+      ck_free(own_copy);
 
-  } else {
+      if (!access(cp, X_OK)) { return cp; }
+
+    } else {
 
-    ck_free(own_copy);
+      ck_free(own_copy);
+
+    }
 
   }
 
@@ -196,7 +200,7 @@ char **get_qemu_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
 
   /* Now we need to actually find the QEMU binary to put in argv[0]. */
 
-  cp = find_binary_own_loc("afl-qemu-trace", own_loc);
+  cp = find_afl_binary("afl-qemu-trace", own_loc);
 
   if (cp) {
 
@@ -241,12 +245,12 @@ char **get_wine_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
 
   /* Now we need to actually find the QEMU binary to put in argv[0]. */
 
-  cp = find_binary_own_loc("afl-qemu-trace", own_loc);
+  cp = find_afl_binary("afl-qemu-trace", own_loc);
 
   if (cp) {
 
     ck_free(cp);
-    cp = find_binary_own_loc("afl-wine-trace", own_loc);
+    cp = find_afl_binary("afl-wine-trace", own_loc);
 
     if (cp) {
 
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 9f38b8f8..2f724569 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -2236,8 +2236,8 @@ havoc_stage:
 
             clone_to = rand_below(afl, temp_len);
 
-            new_buf = ck_maybe_grow(BUF_PARAMS(out_scratch),
-                                    temp_len + clone_len);
+            new_buf =
+                ck_maybe_grow(BUF_PARAMS(out_scratch), temp_len + clone_len);
 
             /* Head */
 
@@ -2403,8 +2403,7 @@ havoc_stage:
 
               if (temp_len + extra_len >= MAX_FILE) { break; }
 
-              out_buf =
-                  ck_maybe_grow(BUF_PARAMS(out), temp_len + extra_len);
+              out_buf = ck_maybe_grow(BUF_PARAMS(out), temp_len + extra_len);
 
               /* Tail */
               memmove(out_buf + insert_at + extra_len, out_buf + insert_at,
@@ -2499,8 +2498,8 @@ havoc_stage:
 
               clone_to = rand_below(afl, temp_len);
 
-              u8 *temp_buf = ck_maybe_grow(BUF_PARAMS(out_scratch),
-                                           temp_len + clone_len);
+              u8 *temp_buf =
+                  ck_maybe_grow(BUF_PARAMS(out_scratch), temp_len + clone_len);
 
               /* Head */
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 11db004d..d2b2c2d9 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1274,9 +1274,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
     ck_free(afl->taint_fsrv.target_path);
     afl->argv_taint = ck_alloc(sizeof(char *) * (argc + 4 - optind));
-    afl->taint_fsrv.target_path =
-        find_binary_own_loc("afl-qemu-taint", argv[0]);
-    afl->argv_taint[0] = find_binary_own_loc("afl-qemu-taint", argv[0]);
+    afl->taint_fsrv.target_path = find_afl_binary("afl-qemu-taint", argv[0]);
+    afl->argv_taint[0] = find_afl_binary("afl-qemu-taint", argv[0]);
     if (!afl->argv_taint[0])
       FATAL(
           "Cannot find 'afl-qemu-taint', read qemu_taint/README.md on how to "
@@ -1308,19 +1307,19 @@ int main(int argc, char **argv_orig, char **envp) {
 
     OKF("Taint forkserver successfully started");
 
-    const rlim_t kStackSize = 256L * 1024L * 1024L;   // min stack size = 256 Mb
+    const rlim_t  kStackSize = 256L * 1024L * 1024L;  // min stack size = 256 Mb
     struct rlimit rl;
     rl.rlim_cur = kStackSize;
     if (getrlimit(RLIMIT_STACK, &rl) != 0)
       WARNF("Setting a higher stack size failed!");
 
-#define BUF_PARAMS(name) (void **)&afl->name##_buf, &afl->name##_size
+  #define BUF_PARAMS(name) (void **)&afl->name##_buf, &afl->name##_size
     u8 *tmp1 = ck_maybe_grow(BUF_PARAMS(eff), MAX_FILE + 4096);
     u8 *tmp2 = ck_maybe_grow(BUF_PARAMS(ex), MAX_FILE + 4096);
     u8 *tmp3 = ck_maybe_grow(BUF_PARAMS(in_scratch), MAX_FILE + 4096);
     u8 *tmp4 = ck_maybe_grow(BUF_PARAMS(out), MAX_FILE + 4096);
     u8 *tmp5 = ck_maybe_grow(BUF_PARAMS(out_scratch), MAX_FILE + 4096);
-#undef BUF_PARAMS
+  #undef BUF_PARAMS
     if (!tmp1 || !tmp2 || !tmp3 || !tmp4 || !tmp5)
       FATAL("memory issues. me hungry, feed me!");
 
-- 
cgit 1.4.1


From b604f5eafcebb816026e198df0ea66ebcbf18421 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 11 Aug 2020 18:06:18 +0200
Subject: finalize first beta! yay!

---
 README.md                            | 14 ++++++++------
 examples/aflpp_driver/aflpp_driver.c | 28 ----------------------------
 src/afl-fuzz-init.c                  |  9 +++++++--
 src/afl-fuzz-one.c                   |  2 +-
 src/afl-fuzz-queue.c                 |  2 +-
 5 files changed, 17 insertions(+), 38 deletions(-)

(limited to 'examples/aflpp_driver/aflpp_driver.c')

diff --git a/README.md b/README.md
index 2b9bc588..6e324cb0 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # qemu_taint variant.
 
+UPDATE: **WORKS NOW** **PLEASE TEST** **:-)**
+
 ## HOWTO
 
 cd qemu_taint && ./build_qemu_taint.sh
@@ -8,13 +10,13 @@ afl-fuzz -A ...
 
 ## CAVEATS
 
- * segfaults ~10-15 minutes in ...
-
- * shmem persistent mode does not work
- * custom mutators? dunno if they work or not
- * MOpt works but totally ignores the taint information
+ * llvm shmem persistent mode does not and can not not work
+ * MOpt works but totally ignores the taint information, so disabled here
+ * custom mutators? dunno if they work or not. depends on how they work.
  * not tested with qemu_mode
- * if all seed entries are fully touched it might not work
+ * there are several debug checks to ensure the data is fine which slows down
+   fuzzing, if the beta experiment runs fine these will be improved and it
+   will result in quite a speed gain.
 
 ## THE TAINT
 
diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 81782c67..8e0b554a 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -107,8 +107,6 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
 #endif
 
 int                   __afl_sharedmem_fuzzing = 0;
-extern unsigned char *__afl_area_ptr;
-// extern struct cmp_map *__afl_cmp_map;
 
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
@@ -246,28 +244,8 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 
 }
 
-__attribute__((constructor(1))) void __afl_protect(void) {
-
-  setenv("__AFL_DEFER_FORKSRV", "1", 1);
-  __afl_area_ptr = (unsigned char *)mmap(
-      (void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-      MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr = (unsigned char *)mmap((void *)0x10000, MAX_DUMMY_SIZE,
-                                           PROT_READ | PROT_WRITE,
-                                           MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr =
-        (unsigned char *)mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-                              MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  // __afl_cmp_map = (struct cmp_map *)__afl_area_ptr;
-
-}
-
 int main(int argc, char **argv) {
 
-  fprintf(stderr, "map is at %p\n", __afl_area_ptr);
-
   printf(
       "======================= INFO =========================\n"
       "This binary is built for afl++.\n"
@@ -307,8 +285,6 @@ int main(int argc, char **argv) {
 
     if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
 
-      munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
-      __afl_area_ptr = NULL;
       __afl_manual_init();
 
     }
@@ -321,15 +297,11 @@ int main(int argc, char **argv) {
 
   if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
 
-    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
-    __afl_area_ptr = NULL;
     fprintf(stderr, "performing manual init\n");
     __afl_manual_init();
 
   }
 
-  fprintf(stderr, "map is now at %p\n", __afl_area_ptr);
-
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
   // on the first execution of LLVMFuzzerTestOneInput is ignored.
   LLVMFuzzerTestOneInput(dummy_input, 1);
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 0150e18a..359eef85 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -771,9 +771,13 @@ void perform_dry_run(afl_state_t *afl) {
     close(fd);
 
     res = calibrate_case(afl, q, use_mem, 0, 1);
-    ck_free(use_mem);
 
-    if (afl->stop_soon) { return; }
+    if (afl->stop_soon) {
+
+      ck_free(use_mem);
+      return;
+
+    }
 
     if (res == afl->crash_mode || res == FSRV_RUN_NOBITS) {
 
@@ -962,6 +966,7 @@ void perform_dry_run(afl_state_t *afl) {
 
     /* perform taint gathering on the input seed */
     if (afl->taint_mode) perform_taint_run(afl, q, q->fname, use_mem, q->len);
+    ck_free(use_mem);
 
     q = q->next;
 
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 7718256f..4db6febf 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -2342,7 +2342,7 @@ havoc_stage:
             }
 
             /* Tail */
-            memcpy(new_buf + clone_to + clone_len, out_buf + clone_to,
+            memmove(new_buf + clone_to + clone_len, out_buf + clone_to,
                    temp_len - clone_to);
 
             swap_bufs(BUF_PARAMS(out), BUF_PARAMS(out_scratch));
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index a1fe146b..43794018 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -122,7 +122,7 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
 
     afl->taint_fsrv.map_size = plen;  // speed :)
     write_to_testcase(afl, mem, len);
-    if (afl_fsrv_run_target(&afl->taint_fsrv, afl->fsrv.exec_tmout,
+    if (afl_fsrv_run_target(&afl->taint_fsrv, afl->fsrv.exec_tmout * 4,
                             &afl->stop_soon) == 0) {
 
       bytes = q->taint_bytes_all =
-- 
cgit 1.4.1