From 9a65fe904dd0895b9f7d27aae1fbce22fcb598ef Mon Sep 17 00:00:00 2001 From: van Hauser Date: Mon, 1 Jun 2020 13:37:50 +0200 Subject: small changes to libfuzzer driver --- examples/aflpp_driver/aflpp_driver.cpp | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'examples/aflpp_driver') diff --git a/examples/aflpp_driver/aflpp_driver.cpp b/examples/aflpp_driver/aflpp_driver.cpp index 3dcc8c3c..a6b168cd 100644 --- a/examples/aflpp_driver/aflpp_driver.cpp +++ b/examples/aflpp_driver/aflpp_driver.cpp @@ -252,27 +252,27 @@ int main(int argc, char **argv) { else if(argc == 2 && (N = atoi(argv[1])) > 0) Printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N); else if (argc > 1) { - if (!getenv("AFL_DRIVER_DONT_DEFER")) { +// if (!getenv("AFL_DRIVER_DONT_DEFER")) { __afl_sharedmem_fuzzing = 0; __afl_manual_init(); - } +// } return ExecuteFilesOnyByOne(argc, argv); exit(0); } assert(N > 0); - if (!getenv("AFL_DRIVER_DONT_DEFER")) - __afl_manual_init(); - // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization // on the first execution of LLVMFuzzerTestOneInput is ignored. uint8_t dummy_input[1] = {0}; LLVMFuzzerTestOneInput(dummy_input, 1); +// if (!getenv("AFL_DRIVER_DONT_DEFER")) + __afl_manual_init(); + int num_runs = 0; while (__afl_persistent_loop(N)) { - if (__afl_fuzz_len > 0) { + if (__afl_fuzz_len) { num_runs++; LLVMFuzzerTestOneInput(__afl_fuzz_ptr, __afl_fuzz_len); } -- cgit v1.2.3 From adcffce0a083cf32ea41f5631ec0e9d77dfdd115 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Mon, 1 Jun 2020 14:57:05 +0200 Subject: fix libfuzzer driver --- examples/aflpp_driver/aflpp_driver.cpp | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'examples/aflpp_driver') diff --git a/examples/aflpp_driver/aflpp_driver.cpp b/examples/aflpp_driver/aflpp_driver.cpp index a6b168cd..1feae1c3 100644 --- a/examples/aflpp_driver/aflpp_driver.cpp +++ b/examples/aflpp_driver/aflpp_driver.cpp @@ -262,14 +262,14 @@ int main(int argc, char **argv) { assert(N > 0); - // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization - // on the first execution of LLVMFuzzerTestOneInput is ignored. - uint8_t dummy_input[1] = {0}; - LLVMFuzzerTestOneInput(dummy_input, 1); - // if (!getenv("AFL_DRIVER_DONT_DEFER")) __afl_manual_init(); + // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization + // on the first execution of LLVMFuzzerTestOneInput is ignored. + //uint8_t dummy_input[1] = {0}; + //LLVMFuzzerTestOneInput(dummy_input, 1); + int num_runs = 0; while (__afl_persistent_loop(N)) { if (__afl_fuzz_len) { -- cgit v1.2.3 From 1d15048f2f79bb6836e8a50676a8ecc8cff1e5d0 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Mon, 1 Jun 2020 15:30:44 +0200 Subject: hopeful finally change for libfuzzer driver --- examples/aflpp_driver/aflpp_driver.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'examples/aflpp_driver') diff --git a/examples/aflpp_driver/aflpp_driver.cpp b/examples/aflpp_driver/aflpp_driver.cpp index 1feae1c3..f2c604da 100644 --- a/examples/aflpp_driver/aflpp_driver.cpp +++ b/examples/aflpp_driver/aflpp_driver.cpp @@ -267,8 +267,8 @@ int main(int argc, char **argv) { // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization // on the first execution of LLVMFuzzerTestOneInput is ignored. - //uint8_t dummy_input[1] = {0}; - //LLVMFuzzerTestOneInput(dummy_input, 1); + uint8_t dummy_input[1] = {0}; + LLVMFuzzerTestOneInput(dummy_input, 1); int num_runs = 0; while (__afl_persistent_loop(N)) { -- cgit v1.2.3 From 1c95e2e8e0674b69bf38e3e097948c6db9f07493 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Wed, 3 Jun 2020 10:34:29 +0200 Subject: aflpp libfuzzer driver for qemu mode --- examples/aflpp_driver/GNUmakefile | 16 ++++++++++++++-- examples/aflpp_driver/aflpp_qemu_driver.c | 17 +++++++++++++++++ examples/aflpp_driver/aflpp_qemu_driver_hook.c | 21 +++++++++++++++++++++ 3 files changed, 52 insertions(+), 2 deletions(-) create mode 100644 examples/aflpp_driver/aflpp_qemu_driver.c create mode 100644 examples/aflpp_driver/aflpp_qemu_driver_hook.c (limited to 'examples/aflpp_driver') diff --git a/examples/aflpp_driver/GNUmakefile b/examples/aflpp_driver/GNUmakefile index a681d2cf..05ddebb0 100644 --- a/examples/aflpp_driver/GNUmakefile +++ b/examples/aflpp_driver/GNUmakefile @@ -9,7 +9,7 @@ endif FLAGS=-O3 -funroll-loops -all: libAFLDriver.a +all: libAFLDriver.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so aflpp_driver.o: aflpp_driver.cpp $(LLVM_BINDIR)clang++ $(FLAGS) -stdlib=libc++ -funroll-loops -std=c++11 -c aflpp_driver.cpp @@ -17,5 +17,17 @@ aflpp_driver.o: aflpp_driver.cpp libAFLDriver.a: aflpp_driver.o ar ru libAFLDriver.a aflpp_driver.o +aflpp_qemu_driver.o: aflpp_qemu_driver.c + $(LLVM_BINDIR)clang $(FLAGS) -funroll-loops -c aflpp_qemu_driver.c + +libAFLQemuDriver.a: aflpp_qemu_driver.o + ar ru libAFLQemuDriver.a aflpp_qemu_driver.o + +aflpp_qemu_driver_hook.so: aflpp_qemu_driver_hook.o + $(LLVM_BINDIR)clang -shared aflpp_qemu_driver_hook.o -o aflpp_qemu_driver_hook.so + +aflpp_qemu_driver_hook.o: aflpp_qemu_driver_hook.c + $(LLVM_BINDIR)clang -fPIC $(FLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c + clean: - rm -f *.o libAFLDriver*.a *~ core + rm -f *.o libAFLDriver*.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so *~ core diff --git a/examples/aflpp_driver/aflpp_qemu_driver.c b/examples/aflpp_driver/aflpp_qemu_driver.c new file mode 100644 index 00000000..dd272408 --- /dev/null +++ b/examples/aflpp_driver/aflpp_qemu_driver.c @@ -0,0 +1,17 @@ +#include +#include + +// libFuzzer interface is thin, so we don't include any libFuzzer headers. +int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size); +__attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv); + +int main(int argc, char **argv) { + if (LLVMFuzzerInitialize) + LLVMFuzzerInitialize(&argc, &argv); + // Do any other expensive one-time initialization here. + + uint8_t dummy_input[1] = {0}; + LLVMFuzzerTestOneInput(dummy_input, 1); + + return 0; +} diff --git a/examples/aflpp_driver/aflpp_qemu_driver_hook.c b/examples/aflpp_driver/aflpp_qemu_driver_hook.c new file mode 100644 index 00000000..17a84668 --- /dev/null +++ b/examples/aflpp_driver/aflpp_qemu_driver_hook.c @@ -0,0 +1,21 @@ +#include +#include + +#define g2h(x) ((void *)((unsigned long)(x) + guest_base)) + +#define REGS_RDI 7 +#define REGS_RSI 6 + +void afl_persistent_hook(uint64_t *regs, uint64_t guest_base, + uint8_t* input_buf, uint32_t input_len) { + + memcpy(g2h(regs[REGS_RDI]), input_buf, input_len); + regs[REGS_RSI] = input_len; + +} + +int afl_persistent_hook_init(void) { + + return 1; + +} -- cgit v1.2.3 From fc164e4709f1f1c91f9343eb116627417e7f267f Mon Sep 17 00:00:00 2001 From: van Hauser Date: Wed, 3 Jun 2020 10:50:49 +0200 Subject: code format --- examples/aflpp_driver/aflpp_qemu_driver.c | 8 +++++--- examples/aflpp_driver/aflpp_qemu_driver_hook.c | 5 +++-- 2 files changed, 8 insertions(+), 5 deletions(-) (limited to 'examples/aflpp_driver') diff --git a/examples/aflpp_driver/aflpp_qemu_driver.c b/examples/aflpp_driver/aflpp_qemu_driver.c index dd272408..d8862316 100644 --- a/examples/aflpp_driver/aflpp_qemu_driver.c +++ b/examples/aflpp_driver/aflpp_qemu_driver.c @@ -6,12 +6,14 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size); __attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv); int main(int argc, char **argv) { - if (LLVMFuzzerInitialize) - LLVMFuzzerInitialize(&argc, &argv); + + if (LLVMFuzzerInitialize) LLVMFuzzerInitialize(&argc, &argv); // Do any other expensive one-time initialization here. uint8_t dummy_input[1] = {0}; LLVMFuzzerTestOneInput(dummy_input, 1); - + return 0; + } + diff --git a/examples/aflpp_driver/aflpp_qemu_driver_hook.c b/examples/aflpp_driver/aflpp_qemu_driver_hook.c index 17a84668..823cc42d 100644 --- a/examples/aflpp_driver/aflpp_qemu_driver_hook.c +++ b/examples/aflpp_driver/aflpp_qemu_driver_hook.c @@ -7,9 +7,9 @@ #define REGS_RSI 6 void afl_persistent_hook(uint64_t *regs, uint64_t guest_base, - uint8_t* input_buf, uint32_t input_len) { + uint8_t *input_buf, uint32_t input_len) { - memcpy(g2h(regs[REGS_RDI]), input_buf, input_len); + memcpy(g2h(regs[REGS_RDI]), input_buf, input_len); regs[REGS_RSI] = input_len; } @@ -19,3 +19,4 @@ int afl_persistent_hook_init(void) { return 1; } + -- cgit v1.2.3 From f1192b2d16116fb6c8dc2673e37ec426b7792312 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Wed, 3 Jun 2020 11:38:44 +0200 Subject: AFL_QEMU_DRIVER_NO_HOOK --- examples/aflpp_driver/aflpp_qemu_driver.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) (limited to 'examples/aflpp_driver') diff --git a/examples/aflpp_driver/aflpp_qemu_driver.c b/examples/aflpp_driver/aflpp_qemu_driver.c index dd272408..0944148e 100644 --- a/examples/aflpp_driver/aflpp_qemu_driver.c +++ b/examples/aflpp_driver/aflpp_qemu_driver.c @@ -1,17 +1,36 @@ #include #include +#include // libFuzzer interface is thin, so we don't include any libFuzzer headers. int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size); __attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv); +static const size_t kMaxAflInputSize = 1 << 20; +static uint8_t AflInputBuf[kMaxAflInputSize]; + +void afl_qemu_driver_stdin_input(void) { + + size_t l = read(0, AflInputBuf, kMaxAflInputSize); + LLVMFuzzerTestOneInput(AflInputBuf, l); + +} + int main(int argc, char **argv) { if (LLVMFuzzerInitialize) LLVMFuzzerInitialize(&argc, &argv); // Do any other expensive one-time initialization here. - uint8_t dummy_input[1] = {0}; - LLVMFuzzerTestOneInput(dummy_input, 1); + if (getenv("AFL_QEMU_DRIVER_NO_HOOK")) { + + afl_qemu_driver_stdin_input(); + + } else { + + uint8_t dummy_input[1] = {0}; + LLVMFuzzerTestOneInput(dummy_input, 1); + + } return 0; } -- cgit v1.2.3 From 177db9cf7941975d31e2d1ff8304659d14561568 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Wed, 3 Jun 2020 11:51:35 +0200 Subject: no inline in qemu driver --- examples/aflpp_driver/aflpp_qemu_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'examples/aflpp_driver') diff --git a/examples/aflpp_driver/aflpp_qemu_driver.c b/examples/aflpp_driver/aflpp_qemu_driver.c index 404ce84c..ea4dab95 100644 --- a/examples/aflpp_driver/aflpp_qemu_driver.c +++ b/examples/aflpp_driver/aflpp_qemu_driver.c @@ -9,7 +9,7 @@ __attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv); static const size_t kMaxAflInputSize = 1 << 20; static uint8_t AflInputBuf[kMaxAflInputSize]; -void afl_qemu_driver_stdin_input(void) { +void __attribute__ ((noinline)) afl_qemu_driver_stdin_input(void) { size_t l = read(0, AflInputBuf, kMaxAflInputSize); LLVMFuzzerTestOneInput(AflInputBuf, l); -- cgit v1.2.3 From dd0ca7335ff93090def7be7fd0b46e9f71375004 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Wed, 3 Jun 2020 15:49:23 +0200 Subject: switch shmem_len to the map --- examples/aflpp_driver/aflpp_qemu_driver.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'examples/aflpp_driver') diff --git a/examples/aflpp_driver/aflpp_qemu_driver.c b/examples/aflpp_driver/aflpp_qemu_driver.c index ea4dab95..604feb91 100644 --- a/examples/aflpp_driver/aflpp_qemu_driver.c +++ b/examples/aflpp_driver/aflpp_qemu_driver.c @@ -7,9 +7,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size); __attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv); static const size_t kMaxAflInputSize = 1 << 20; -static uint8_t AflInputBuf[kMaxAflInputSize]; +static uint8_t AflInputBuf[kMaxAflInputSize]; -void __attribute__ ((noinline)) afl_qemu_driver_stdin_input(void) { +void __attribute__((noinline)) afl_qemu_driver_stdin_input(void) { size_t l = read(0, AflInputBuf, kMaxAflInputSize); LLVMFuzzerTestOneInput(AflInputBuf, l); @@ -31,7 +31,7 @@ int main(int argc, char **argv) { LLVMFuzzerTestOneInput(dummy_input, 1); } - + return 0; } -- cgit v1.2.3 From 2f73215d4f24d9059546aff2b82d7eef05fbe253 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Thu, 4 Jun 2020 08:53:05 +0200 Subject: update libfuzzer driver --- examples/aflpp_driver/aflpp_driver.cpp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'examples/aflpp_driver') diff --git a/examples/aflpp_driver/aflpp_driver.cpp b/examples/aflpp_driver/aflpp_driver.cpp index f2c604da..e0a90ff9 100644 --- a/examples/aflpp_driver/aflpp_driver.cpp +++ b/examples/aflpp_driver/aflpp_driver.cpp @@ -90,7 +90,7 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both. #endif int __afl_sharedmem_fuzzing = 1; -extern unsigned int __afl_fuzz_len; +extern unsigned int *__afl_fuzz_len; extern unsigned char *__afl_fuzz_ptr; // libFuzzer interface is thin, so we don't include any libFuzzer headers. @@ -272,9 +272,9 @@ int main(int argc, char **argv) { int num_runs = 0; while (__afl_persistent_loop(N)) { - if (__afl_fuzz_len) { + if (*__afl_fuzz_len) { num_runs++; - LLVMFuzzerTestOneInput(__afl_fuzz_ptr, __afl_fuzz_len); + LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len); } } Printf("%s: successfully executed %d input(s)\n", argv[0], num_runs); -- cgit v1.2.3 From f1ad9bdaea754cd08581b7b41bac7f404763fde7 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Thu, 4 Jun 2020 09:10:58 +0200 Subject: fix --- examples/aflpp_driver/GNUmakefile | 2 +- examples/aflpp_driver/aflpp_qemu_driver.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'examples/aflpp_driver') diff --git a/examples/aflpp_driver/GNUmakefile b/examples/aflpp_driver/GNUmakefile index 05ddebb0..988576d5 100644 --- a/examples/aflpp_driver/GNUmakefile +++ b/examples/aflpp_driver/GNUmakefile @@ -18,7 +18,7 @@ libAFLDriver.a: aflpp_driver.o ar ru libAFLDriver.a aflpp_driver.o aflpp_qemu_driver.o: aflpp_qemu_driver.c - $(LLVM_BINDIR)clang $(FLAGS) -funroll-loops -c aflpp_qemu_driver.c + $(LLVM_BINDIR)clang $(FLAGS) -O0 -funroll-loops -c aflpp_qemu_driver.c libAFLQemuDriver.a: aflpp_qemu_driver.o ar ru libAFLQemuDriver.a aflpp_qemu_driver.o diff --git a/examples/aflpp_driver/aflpp_qemu_driver.c b/examples/aflpp_driver/aflpp_qemu_driver.c index 604feb91..ee7dde10 100644 --- a/examples/aflpp_driver/aflpp_qemu_driver.c +++ b/examples/aflpp_driver/aflpp_qemu_driver.c @@ -27,7 +27,7 @@ int main(int argc, char **argv) { } else { - uint8_t dummy_input[1] = {0}; + uint8_t dummy_input[1024000] = {0}; LLVMFuzzerTestOneInput(dummy_input, 1); } -- cgit v1.2.3 From e01cad2f7de77c4704243d7011de2bff95fd59f7 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Fri, 5 Jun 2020 09:42:17 +0200 Subject: qemu debug --- examples/aflpp_driver/aflpp_qemu_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'examples/aflpp_driver') diff --git a/examples/aflpp_driver/aflpp_qemu_driver.c b/examples/aflpp_driver/aflpp_qemu_driver.c index ee7dde10..4f3e5f71 100644 --- a/examples/aflpp_driver/aflpp_qemu_driver.c +++ b/examples/aflpp_driver/aflpp_qemu_driver.c @@ -6,7 +6,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size); __attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv); -static const size_t kMaxAflInputSize = 1 << 20; +static const size_t kMaxAflInputSize = 1 * 1024 * 1024; static uint8_t AflInputBuf[kMaxAflInputSize]; void __attribute__((noinline)) afl_qemu_driver_stdin_input(void) { -- cgit v1.2.3 From 372206e159f4f3d150543411872319fb8fae0b66 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Sat, 6 Jun 2020 11:45:08 +0200 Subject: aflpp_debug --- examples/aflpp_driver/GNUmakefile | 10 +++++++++- examples/aflpp_driver/aflpp_driver.cpp | 7 +++++-- examples/aflpp_driver/aflpp_driver_test.cpp | 20 ++++++++++++++++++++ 3 files changed, 34 insertions(+), 3 deletions(-) create mode 100644 examples/aflpp_driver/aflpp_driver_test.cpp (limited to 'examples/aflpp_driver') diff --git a/examples/aflpp_driver/GNUmakefile b/examples/aflpp_driver/GNUmakefile index 988576d5..7ddfc485 100644 --- a/examples/aflpp_driver/GNUmakefile +++ b/examples/aflpp_driver/GNUmakefile @@ -17,6 +17,11 @@ aflpp_driver.o: aflpp_driver.cpp libAFLDriver.a: aflpp_driver.o ar ru libAFLDriver.a aflpp_driver.o +debug: + $(LLVM_BINDIR)clang++ -D_DEBUG=\"1\" $(FLAGS) -stdlib=libc++ -funroll-loops -std=c++11 -c aflpp_driver.cpp + ar ru libAFLDriver.a aflpp_driver.o + + aflpp_qemu_driver.o: aflpp_qemu_driver.c $(LLVM_BINDIR)clang $(FLAGS) -O0 -funroll-loops -c aflpp_qemu_driver.c @@ -29,5 +34,8 @@ aflpp_qemu_driver_hook.so: aflpp_qemu_driver_hook.o aflpp_qemu_driver_hook.o: aflpp_qemu_driver_hook.c $(LLVM_BINDIR)clang -fPIC $(FLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c +test: libAFLDriver.a aflpp_driver_test.cpp + afl-clang-fast++ -Wl,--allow-multiple-definition -stdlib=libc++ -funroll-loops -std=c++11 -o aflpp_driver_test aflpp_driver_test.cpp libAFLDriver.a + clean: - rm -f *.o libAFLDriver*.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so *~ core + rm -f *.o libAFLDriver*.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so *~ core aflpp_driver_test diff --git a/examples/aflpp_driver/aflpp_driver.cpp b/examples/aflpp_driver/aflpp_driver.cpp index e0a90ff9..a60eb264 100644 --- a/examples/aflpp_driver/aflpp_driver.cpp +++ b/examples/aflpp_driver/aflpp_driver.cpp @@ -246,7 +246,8 @@ int main(int argc, char **argv) { LLVMFuzzerInitialize(&argc, &argv); // Do any other expensive one-time initialization here. - int N = 1000; + uint8_t dummy_input[1] = {0}; + int N = 100000; if (argc == 2 && argv[1][0] == '-') N = atoi(argv[1] + 1); else if(argc == 2 && (N = atoi(argv[1])) > 0) @@ -267,11 +268,13 @@ int main(int argc, char **argv) { // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization // on the first execution of LLVMFuzzerTestOneInput is ignored. - uint8_t dummy_input[1] = {0}; LLVMFuzzerTestOneInput(dummy_input, 1); int num_runs = 0; while (__afl_persistent_loop(N)) { +#ifdef _DEBUG + fprintf(stderr, "len: %u\n", *__afl_fuzz_len); +#endif if (*__afl_fuzz_len) { num_runs++; LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len); diff --git a/examples/aflpp_driver/aflpp_driver_test.cpp b/examples/aflpp_driver/aflpp_driver_test.cpp new file mode 100644 index 00000000..81aa9db4 --- /dev/null +++ b/examples/aflpp_driver/aflpp_driver_test.cpp @@ -0,0 +1,20 @@ +#include +#include +#include + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + + fprintf(stderr, "Received size %lu\n", Size); + + if (Size < 4) + return 0; + + if (Data[0] == 'F') + if (Data[1] == 'A') + if (Data[2] == '$') + if (Data[3] == '$') + abort(); + + return 0; + +} -- cgit v1.2.3