From afd2ea90dfdb9aa7668c482e7c427f95c4847843 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Fri, 20 Jan 2023 22:12:35 +0000 Subject: LLVM plugin 16+ support proposal. - Lifting the standard to C++17. - Beyond the cosmetic changes, it boils down to BasicBlock::getInstList being no longer available (and reading the header it is no accident). --- instrumentation/afl-llvm-common.cc | 1 + 1 file changed, 1 insertion(+) (limited to 'instrumentation/afl-llvm-common.cc') diff --git a/instrumentation/afl-llvm-common.cc b/instrumentation/afl-llvm-common.cc index 5fcf27fb..dc34d191 100644 --- a/instrumentation/afl-llvm-common.cc +++ b/instrumentation/afl-llvm-common.cc @@ -12,6 +12,7 @@ #include #include #include +#include #include -- cgit 1.4.1 From 8bc3fa1df286aac46a0a724f64e2e07010d2497e Mon Sep 17 00:00:00 2001 From: David CARLIER Date: Mon, 13 Feb 2023 23:00:15 +0000 Subject: LLVM cmplog factoring custom Instruction iterator with added restriction --- instrumentation/afl-llvm-common.cc | 18 ++++++++++++++++++ instrumentation/afl-llvm-common.h | 2 ++ instrumentation/cmplog-instructions-pass.cc | 15 --------------- instrumentation/cmplog-switches-pass.cc | 15 --------------- 4 files changed, 20 insertions(+), 30 deletions(-) (limited to 'instrumentation/afl-llvm-common.cc') diff --git a/instrumentation/afl-llvm-common.cc b/instrumentation/afl-llvm-common.cc index dc34d191..b50269fe 100644 --- a/instrumentation/afl-llvm-common.cc +++ b/instrumentation/afl-llvm-common.cc @@ -582,6 +582,24 @@ bool isInInstrumentList(llvm::Function *F, std::string Filename) { } +template +Iterator Unique(Iterator first, Iterator last) { + static_assert(std::is_trivially_copyable< + typename std::iterator_traits + >::value_type, "Invalid underlying type"); + + while (first != last) { + + Iterator next(first); + last = std::remove(++next, last, *first); + first = next; + + } + + return last; + +} + // Calculate the number of average collisions that would occur if all // location IDs would be assigned randomly (like normal afl/afl++). // This uses the "balls in bins" algorithm. diff --git a/instrumentation/afl-llvm-common.h b/instrumentation/afl-llvm-common.h index 0112c325..8b8dc756 100644 --- a/instrumentation/afl-llvm-common.h +++ b/instrumentation/afl-llvm-common.h @@ -9,6 +9,7 @@ #include #include #include +#include #include #include "llvm/Config/llvm-config.h" @@ -53,6 +54,7 @@ void initInstrumentList(); bool isInInstrumentList(llvm::Function *F, std::string Filename); unsigned long long int calculateCollisions(uint32_t edges); void scanForDangerousFunctions(llvm::Module *M); +template Iterator Unique(Iterator, Iterator); #ifndef IS_EXTERN #define IS_EXTERN diff --git a/instrumentation/cmplog-instructions-pass.cc b/instrumentation/cmplog-instructions-pass.cc index bca1f927..c6fd7c56 100644 --- a/instrumentation/cmplog-instructions-pass.cc +++ b/instrumentation/cmplog-instructions-pass.cc @@ -138,21 +138,6 @@ llvmGetPassPluginInfo() { char CmpLogInstructions::ID = 0; #endif -template -Iterator Unique(Iterator first, Iterator last) { - - while (first != last) { - - Iterator next(first); - last = std::remove(++next, last, *first); - first = next; - - } - - return last; - -} - bool CmpLogInstructions::hookInstrs(Module &M) { std::vector icomps; diff --git a/instrumentation/cmplog-switches-pass.cc b/instrumentation/cmplog-switches-pass.cc index cd0ae76d..f4a9fbd7 100644 --- a/instrumentation/cmplog-switches-pass.cc +++ b/instrumentation/cmplog-switches-pass.cc @@ -131,21 +131,6 @@ llvmGetPassPluginInfo() { char CmplogSwitches::ID = 0; #endif -template -Iterator Unique(Iterator first, Iterator last) { - - while (first != last) { - - Iterator next(first); - last = std::remove(++next, last, *first); - first = next; - - } - - return last; - -} - bool CmplogSwitches::hookInstrs(Module &M) { std::vector switches; -- cgit 1.4.1 From b786558dea5fd5dca471a0e36a8b420ff6a65846 Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Mon, 20 Feb 2023 15:43:54 +0100 Subject: Revert "LLVM cmplog factoring custom Instruction iterator with added restriction" This reverts commit 8bc3fa1df286aac46a0a724f64e2e07010d2497e. --- instrumentation/afl-llvm-common.cc | 18 ------------------ instrumentation/afl-llvm-common.h | 2 -- instrumentation/cmplog-instructions-pass.cc | 15 +++++++++++++++ instrumentation/cmplog-switches-pass.cc | 15 +++++++++++++++ 4 files changed, 30 insertions(+), 20 deletions(-) (limited to 'instrumentation/afl-llvm-common.cc') diff --git a/instrumentation/afl-llvm-common.cc b/instrumentation/afl-llvm-common.cc index b50269fe..dc34d191 100644 --- a/instrumentation/afl-llvm-common.cc +++ b/instrumentation/afl-llvm-common.cc @@ -582,24 +582,6 @@ bool isInInstrumentList(llvm::Function *F, std::string Filename) { } -template -Iterator Unique(Iterator first, Iterator last) { - static_assert(std::is_trivially_copyable< - typename std::iterator_traits - >::value_type, "Invalid underlying type"); - - while (first != last) { - - Iterator next(first); - last = std::remove(++next, last, *first); - first = next; - - } - - return last; - -} - // Calculate the number of average collisions that would occur if all // location IDs would be assigned randomly (like normal afl/afl++). // This uses the "balls in bins" algorithm. diff --git a/instrumentation/afl-llvm-common.h b/instrumentation/afl-llvm-common.h index 8b8dc756..0112c325 100644 --- a/instrumentation/afl-llvm-common.h +++ b/instrumentation/afl-llvm-common.h @@ -9,7 +9,6 @@ #include #include #include -#include #include #include "llvm/Config/llvm-config.h" @@ -54,7 +53,6 @@ void initInstrumentList(); bool isInInstrumentList(llvm::Function *F, std::string Filename); unsigned long long int calculateCollisions(uint32_t edges); void scanForDangerousFunctions(llvm::Module *M); -template Iterator Unique(Iterator, Iterator); #ifndef IS_EXTERN #define IS_EXTERN diff --git a/instrumentation/cmplog-instructions-pass.cc b/instrumentation/cmplog-instructions-pass.cc index c6fd7c56..bca1f927 100644 --- a/instrumentation/cmplog-instructions-pass.cc +++ b/instrumentation/cmplog-instructions-pass.cc @@ -138,6 +138,21 @@ llvmGetPassPluginInfo() { char CmpLogInstructions::ID = 0; #endif +template +Iterator Unique(Iterator first, Iterator last) { + + while (first != last) { + + Iterator next(first); + last = std::remove(++next, last, *first); + first = next; + + } + + return last; + +} + bool CmpLogInstructions::hookInstrs(Module &M) { std::vector icomps; diff --git a/instrumentation/cmplog-switches-pass.cc b/instrumentation/cmplog-switches-pass.cc index f4a9fbd7..cd0ae76d 100644 --- a/instrumentation/cmplog-switches-pass.cc +++ b/instrumentation/cmplog-switches-pass.cc @@ -131,6 +131,21 @@ llvmGetPassPluginInfo() { char CmplogSwitches::ID = 0; #endif +template +Iterator Unique(Iterator first, Iterator last) { + + while (first != last) { + + Iterator next(first); + last = std::remove(++next, last, *first); + first = next; + + } + + return last; + +} + bool CmplogSwitches::hookInstrs(Module &M) { std::vector switches; -- cgit 1.4.1 From a01138e1c822b97cf187bfcad9938597bf3edc1e Mon Sep 17 00:00:00 2001 From: nj00001 <42004790+nj00001@users.noreply.github.com> Date: Mon, 3 Apr 2023 15:32:52 +0800 Subject: fix getOperand out of range This commit fixes a sloppy function call that should normally check the number of insn's Operand before calling insn's getOperand method. The fix is that if it is 0 it should continue the loop. I solved problem https://github.com/AFLplusplus/AFLplusplus/issues/1688#issue-1648543691 using this modification --- instrumentation/afl-llvm-common.cc | 3 +++ 1 file changed, 3 insertions(+) (limited to 'instrumentation/afl-llvm-common.cc') diff --git a/instrumentation/afl-llvm-common.cc b/instrumentation/afl-llvm-common.cc index dc34d191..de334fb7 100644 --- a/instrumentation/afl-llvm-common.cc +++ b/instrumentation/afl-llvm-common.cc @@ -289,6 +289,9 @@ void scanForDangerousFunctions(llvm::Module *M) { StringRef ifunc_name = IF.getName(); Constant *r = IF.getResolver(); + if(r->getNumOperands() == 0){ + continue ; + } StringRef r_name = cast(r->getOperand(0))->getName(); if (!be_quiet) fprintf(stderr, -- cgit 1.4.1 From 743ae507756db0707a213cd8272b219b0de0f514 Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Wed, 12 Apr 2023 10:53:23 +0200 Subject: nits --- GNUmakefile | 2 +- instrumentation/afl-llvm-common.cc | 4 +--- utils/aflpp_driver/GNUmakefile | 4 ---- utils/aflpp_driver/aflpp_driver.c | 8 +++++--- 4 files changed, 7 insertions(+), 11 deletions(-) (limited to 'instrumentation/afl-llvm-common.cc') diff --git a/GNUmakefile b/GNUmakefile index 72da14ea..208e965b 100644 --- a/GNUmakefile +++ b/GNUmakefile @@ -196,7 +196,7 @@ ifeq "$(PYTHON_INCLUDE)" "" ifneq "$(shell command -v python3-config 2>/dev/null)" "" PYTHON_INCLUDE ?= $(shell python3-config --includes) PYTHON_VERSION ?= $(strip $(shell python3 --version 2>&1)) - # Starting with python3.8, we need to pass the `embed` flag. Earier versions didn't know this flag. + # Starting with python3.8, we need to pass the `embed` flag. Earlier versions didn't know this flag. ifeq "$(shell python3-config --embed --libs 2>/dev/null | grep -q lpython && echo 1 )" "1" PYTHON_LIB ?= $(shell python3-config --libs --embed --ldflags) else diff --git a/instrumentation/afl-llvm-common.cc b/instrumentation/afl-llvm-common.cc index de334fb7..5d82aa25 100644 --- a/instrumentation/afl-llvm-common.cc +++ b/instrumentation/afl-llvm-common.cc @@ -289,9 +289,7 @@ void scanForDangerousFunctions(llvm::Module *M) { StringRef ifunc_name = IF.getName(); Constant *r = IF.getResolver(); - if(r->getNumOperands() == 0){ - continue ; - } + if (r->getNumOperands() == 0) { continue; } StringRef r_name = cast(r->getOperand(0))->getName(); if (!be_quiet) fprintf(stderr, diff --git a/utils/aflpp_driver/GNUmakefile b/utils/aflpp_driver/GNUmakefile index 409789cb..b973f96a 100644 --- a/utils/aflpp_driver/GNUmakefile +++ b/utils/aflpp_driver/GNUmakefile @@ -20,10 +20,6 @@ endif CFLAGS := -O3 -funroll-loops -g -fPIC -ifdef MAGMA_PATCH - CFLAGS += -DMAGMA_PATCH -endif - all: libAFLDriver.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so aflpp_driver.o: aflpp_driver.c diff --git a/utils/aflpp_driver/aflpp_driver.c b/utils/aflpp_driver/aflpp_driver.c index 5fef4730..ec304c8c 100644 --- a/utils/aflpp_driver/aflpp_driver.c +++ b/utils/aflpp_driver/aflpp_driver.c @@ -1,8 +1,10 @@ // -// afl_driver.cpp - a glue between AFL++ and libFuzzer +// afl_driver.cpp - a glue between AFL++ and LLVMFuzzerTestOneInput harnesses // -/* This file allows to fuzz libFuzzer-style target functions +/* + + This file allows to fuzz libFuzzer-style target functions (LLVMFuzzerTestOneInput) with AFL++ using persistent in-memory fuzzing. Usage: @@ -26,7 +28,7 @@ EOF # Build your target with afl-cc -fsanitize=fuzzer $ afl-c++ -fsanitize=fuzzer -o test_fuzzer test_fuzzer.cc # Run AFL: -$ rm -rf in out; mkdir in out; echo z > in/foo; +$ mkdir -p in ; echo z > in/foo; $ afl-fuzz -i in -o out -- ./test_fuzzer */ -- cgit 1.4.1