From 591d6c59c758d1043f8690e4e9dda22dbbefbc1c Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Thu, 19 Aug 2021 17:02:17 +0200 Subject: fix shared linking on macos --- instrumentation/afl-compiler-rt.o.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'instrumentation') diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c index 18b0a55b..9acab4e7 100644 --- a/instrumentation/afl-compiler-rt.o.c +++ b/instrumentation/afl-compiler-rt.o.c @@ -1273,7 +1273,12 @@ __attribute__((constructor(1))) void __afl_auto_second(void) { if (__afl_already_initialized_second) return; __afl_already_initialized_second = 1; - if (getenv("AFL_DEBUG")) { __afl_debug = 1; } + if (getenv("AFL_DEBUG")) { + + __afl_debug = 1; + fprintf(stderr, "DEBUG: debug enabled\n"); + + } if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return; u8 *ptr; -- cgit 1.4.1 From 41a4c99d01ddce1ef3db51077477a51411911705 Mon Sep 17 00:00:00 2001 From: hexcoder Date: Fri, 20 Aug 2021 12:37:47 +0200 Subject: typos / wording --- instrumentation/README.lto.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'instrumentation') diff --git a/instrumentation/README.lto.md b/instrumentation/README.lto.md index 38252308..3e9d7585 100644 --- a/instrumentation/README.lto.md +++ b/instrumentation/README.lto.md @@ -146,22 +146,22 @@ afl-clang-lto instead of shared libraries! To make instrumented shared libraries work with afl-clang-lto you have to do quite some extra steps. -Every shared library you want to instrument has to be individually compiled- +Every shared library you want to instrument has to be individually compiled. The environment variable `AFL_LLVM_LTO_DONTWRITEID=1` has to be set during compilation. Additionally the environment variable `AFL_LLVM_LTO_STARTID` has to be set to -the combined edge values of all previous compiled instrumented shared +the added edge count values of all previous compiled instrumented shared libraries for that target. E.g. for the first shared library this would be `AFL_LLVM_LTO_STARTID=0` and afl-clang-lto will then report how many edges have been instrumented (let's say it reported 1000 instrumented edges). The second shared library then has to be set to that value -(`AFL_LLVM_LTO_STARTID=1000` in our example), the third to all previous -combined, etc. +(`AFL_LLVM_LTO_STARTID=1000` in our example), for the third to all previous +counts added, etc. The final program compilation step then may *not* have `AFL_LLVM_LTO_DONTWRITEID` -set, and `AFL_LLVM_LTO_STARTID` must be set to all combined edges of all shared -libaries it will be linked to. +set, and `AFL_LLVM_LTO_STARTID` must be set to all edge counts added of all shared +libraries it will be linked to. This is quite some hands-on work, so better stay away from instrumenting shared libraries :-) -- cgit 1.4.1 From 5ba3601697769fd51e26a3504c165bb7be71bc69 Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Fri, 20 Aug 2021 13:51:59 +0200 Subject: revise paragraph --- instrumentation/README.persistent_mode.md | 17 +++++++++-------- unicorn_mode/unicornafl | 2 +- 2 files changed, 10 insertions(+), 9 deletions(-) (limited to 'instrumentation') diff --git a/instrumentation/README.persistent_mode.md b/instrumentation/README.persistent_mode.md index 0517886b..c6ba2103 100644 --- a/instrumentation/README.persistent_mode.md +++ b/instrumentation/README.persistent_mode.md @@ -2,17 +2,18 @@ ## 1) Introduction -In persistent mode, AFL++ fuzzes a target multiple times -in a single process, instead of forking a new process for each fuzz execution. -This is the most effective way to fuzz, as the speed can easily -be x10 or x20 times faster without any disadvanges. +In persistent mode, AFL++ fuzzes a target multiple times in a single forked +process, instead of forking a new process for each fuzz execution. +This is the most effective way to fuzz, as the speed can easily be x10 or x20 +times faster without any disadvanges. *All professional fuzzing uses this mode.* - Persistent mode requires that the target can be called in one or more functions, -and that its state can be reset so that multiple calls can be performed -without resource leaks and earlier runs will have no impact on future runs -(this can be seen by the `stability` indicator in the `afl-fuzz` UI). +and that it's state can be completely reset so that multiple calls can be +performed without resource leaks, and that earlier runs will have no impact on +future runs (an indicator for this is the `stability` value in the `afl-fuzz` +UI, if this decreases to lower values in persistent mode compared to +non-persistent mode, that the fuzz target keeps state). Examples can be found in [utils/persistent_mode](../utils/persistent_mode). diff --git a/unicorn_mode/unicornafl b/unicorn_mode/unicornafl index 9064bca9..019b8715 160000 --- a/unicorn_mode/unicornafl +++ b/unicorn_mode/unicornafl @@ -1 +1 @@ -Subproject commit 9064bca9ba875d868742cdb9251edfaa2d7d294b +Subproject commit 019b871539fe9ed3f41d882385a8b02c243d49ad -- cgit 1.4.1 From e25f7cefdc796e2e52f53388492d476c52d3e251 Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Wed, 25 Aug 2021 12:29:35 +0200 Subject: announce llvm 13 support --- GNUmakefile.llvm | 4 ++-- README.md | 2 +- docs/Changelog.md | 1 + instrumentation/README.llvm.md | 2 +- instrumentation/README.lto.md | 8 ++++---- 5 files changed, 9 insertions(+), 8 deletions(-) (limited to 'instrumentation') diff --git a/GNUmakefile.llvm b/GNUmakefile.llvm index a6f646f3..b802ef16 100644 --- a/GNUmakefile.llvm +++ b/GNUmakefile.llvm @@ -36,7 +36,7 @@ ifeq "$(SYS)" "OpenBSD" LLVM_CONFIG ?= $(BIN_PATH)/llvm-config HAS_OPT = $(shell test -x $(BIN_PATH)/opt && echo 0 || echo 1) ifeq "$(HAS_OPT)" "1" - $(warning llvm_mode needs a complete llvm installation (versions 6.0 up to 12) -> e.g. "pkg_add llvm-7.0.1p9") + $(warning llvm_mode needs a complete llvm installation (versions 6.0 up to 13) -> e.g. "pkg_add llvm-7.0.1p9") endif else LLVM_CONFIG ?= llvm-config @@ -46,7 +46,7 @@ LLVMVER = $(shell $(LLVM_CONFIG) --version 2>/dev/null | sed 's/git//' | sed 's LLVM_MAJOR = $(shell $(LLVM_CONFIG) --version 2>/dev/null | sed 's/\..*//' ) LLVM_MINOR = $(shell $(LLVM_CONFIG) --version 2>/dev/null | sed 's/.*\.//' | sed 's/git//' | sed 's/svn//' | sed 's/ .*//' ) LLVM_UNSUPPORTED = $(shell $(LLVM_CONFIG) --version 2>/dev/null | egrep -q '^[0-2]\.|^3.[0-7]\.' && echo 1 || echo 0 ) -LLVM_TOO_NEW = $(shell $(LLVM_CONFIG) --version 2>/dev/null | egrep -q '^1[3-9]' && echo 1 || echo 0 ) +LLVM_TOO_NEW = $(shell $(LLVM_CONFIG) --version 2>/dev/null | egrep -q '^1[4-9]' && echo 1 || echo 0 ) LLVM_NEW_API = $(shell $(LLVM_CONFIG) --version 2>/dev/null | egrep -q '^1[0-9]' && echo 1 || echo 0 ) LLVM_10_OK = $(shell $(LLVM_CONFIG) --version 2>/dev/null | egrep -q '^1[1-9]|^10\.[1-9]|^10\.0.[1-9]' && echo 1 || echo 0 ) LLVM_HAVE_LTO = $(shell $(LLVM_CONFIG) --version 2>/dev/null | egrep -q '^1[1-9]' && echo 1 || echo 0 ) diff --git a/README.md b/README.md index 19d3a866..1f1fd3b2 100644 --- a/README.md +++ b/README.md @@ -93,7 +93,7 @@ behaviours and defaults: ## Important features of AFL++ - AFL++ supports llvm from 3.8 up to version 12, very fast binary fuzzing with QEMU 5.1 + AFL++ supports llvm from 3.8 up to version 13, very fast binary fuzzing with QEMU 5.1 with laf-intel and redqueen, frida mode, unicorn mode, gcc plugin, full *BSD, Mac OS, Solaris and Android support and much, much, much more. diff --git a/docs/Changelog.md b/docs/Changelog.md index 7ccae7c2..7d72b2df 100644 --- a/docs/Changelog.md +++ b/docs/Changelog.md @@ -15,6 +15,7 @@ sending a mail to . information on how to deal with instrumenting libraries - afl-cc: - fix for shared linking on MacOS + - llvm and LTO mode verified to work with new llvm 14-dev - added the very good grammar mutator "GramaTron" to the custom_mutators - added optimin, a faster and better corpus minimizer by diff --git a/instrumentation/README.llvm.md b/instrumentation/README.llvm.md index 2d428e6d..6e210a7c 100644 --- a/instrumentation/README.llvm.md +++ b/instrumentation/README.llvm.md @@ -6,7 +6,7 @@ ## 1) Introduction -! llvm_mode works with llvm versions 3.8 up to 12 ! +! llvm_mode works with llvm versions 3.8 up to 13 ! The code in this directory allows you to instrument programs for AFL using true compiler-level instrumentation, instead of the more crude diff --git a/instrumentation/README.lto.md b/instrumentation/README.lto.md index 3e9d7585..6174cdc0 100644 --- a/instrumentation/README.lto.md +++ b/instrumentation/README.lto.md @@ -60,12 +60,12 @@ AUTODICTIONARY: 11 strings found ## Getting llvm 11+ -### Installing llvm version 11 +### Installing llvm version 11 or 12 -llvm 11 should be available in all current Linux repositories. +llvm 11 or even 12 should be available in all current Linux repositories. If you use an outdated Linux distribution read the next section. -### Installing llvm from the llvm repository (version 12) +### Installing llvm from the llvm repository (version 12+) Installing the llvm snapshot builds is easy and mostly painless: @@ -85,7 +85,7 @@ apt-get install -y clang-12 clang-tools-12 libc++1-12 libc++-12-dev \ libomp5-12 lld-12 lldb-12 llvm-12 llvm-12-dev llvm-12-runtime llvm-12-tools ``` -### Building llvm yourself (version 12) +### Building llvm yourself (version 12+) Building llvm from github takes quite some long time and is not painless: ```sh -- cgit 1.4.1