From b1822f26022c323e4b47198abbb7d5f5ea6a57e5 Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Fri, 18 Oct 2019 18:01:33 +0200 Subject: reintegrate gcc_plugin --- llvm_mode/README.whitelist.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'llvm_mode') diff --git a/llvm_mode/README.whitelist.md b/llvm_mode/README.whitelist.md index 6a5770c2..72fb5d09 100644 --- a/llvm_mode/README.whitelist.md +++ b/llvm_mode/README.whitelist.md @@ -64,7 +64,7 @@ a2.cpp but it might lead to files being unwantedly instrumented if the same filename exists somewhere else in the project directories. -The created whitelist file is then set to AFL_INST_WHITELIST when you compile +The created whitelist file is then set to AFL_LLVM_WHITELIST when you compile your program. For each file that didn't match the whitelist, the compiler will issue a warning at the end stating that no blocks were instrumented. If you didn't intend to instrument that file, then you can safely ignore that warning. -- cgit 1.4.1 From e7ab8be0cd97f9a18e6ca2f855afa69768322dfb Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Fri, 18 Oct 2019 19:53:10 +0200 Subject: sync afl-fast-gcc with afl-clang-fast, add tests for gcc_plugin --- gcc_plugin/afl-gcc-fast.c | 50 +++++++++++++++++++++---------- gcc_plugin/afl-gcc-pass.so.cc | 4 +-- llvm_mode/afl-clang-fast.c | 4 +-- src/afl-gcc.c | 2 +- test/test.sh | 69 +++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 108 insertions(+), 21 deletions(-) (limited to 'llvm_mode') diff --git a/gcc_plugin/afl-gcc-fast.c b/gcc_plugin/afl-gcc-fast.c index 8be05bb5..25ecf310 100644 --- a/gcc_plugin/afl-gcc-fast.c +++ b/gcc_plugin/afl-gcc-fast.c @@ -104,7 +104,7 @@ static void edit_params(u32 argc, char** argv) { cc_params = ck_alloc((argc + 64) * sizeof(u8*)); name = strrchr(argv[0], '/'); - if (!name) name = argv[0]; else name++; + if (!name) name = argv[0]; else ++name; if (!strcmp(name, "afl-g++-fast")) { u8* alt_cxx = getenv("AFL_CXX"); @@ -114,9 +114,15 @@ static void edit_params(u32 argc, char** argv) { cc_params[0] = alt_cc ? alt_cc : (u8*)"gcc"; } + + char* fplugin_arg = alloc_printf("-fplugin=%s/afl-gcc-pass.so", obj_path); cc_params[cc_par_cnt++] = fplugin_arg; + /* Detect stray -v calls from ./configure scripts. */ + + if (argc == 1 && !strcmp(argv[1], "-v")) maybe_linking = 0; + while (--argc) { u8* cur = *(++argv); @@ -134,6 +140,8 @@ static void edit_params(u32 argc, char** argv) { if (strstr(cur, "FORTIFY_SOURCE")) fortify_set = 1; + if (!strcmp(cur, "-shared")) maybe_linking = 0; + cc_params[cc_par_cnt++] = cur; } @@ -151,17 +159,23 @@ static void edit_params(u32 argc, char** argv) { if (getenv("AFL_USE_ASAN")) { - cc_params[cc_par_cnt++] = "-fsanitize=address"; + if (getenv("AFL_USE_MSAN")) FATAL("ASAN and MSAN are mutually exclusive"); + + if (getenv("AFL_HARDEN")) + FATAL("ASAN and AFL_HARDEN are mutually exclusive"); - if (getenv("AFL_USE_MSAN")) - FATAL("ASAN and MSAN are mutually exclusive"); + cc_params[cc_par_cnt++] = "-U_FORTIFY_SOURCE"; + cc_params[cc_par_cnt++] = "-fsanitize=address"; } else if (getenv("AFL_USE_MSAN")) { - cc_params[cc_par_cnt++] = "-fsanitize=memory"; + if (getenv("AFL_USE_ASAN")) FATAL("ASAN and MSAN are mutually exclusive"); + + if (getenv("AFL_HARDEN")) + FATAL("MSAN and AFL_HARDEN are mutually exclusive"); - if (getenv("AFL_USE_ASAN")) - FATAL("ASAN and MSAN are mutually exclusive"); + cc_params[cc_par_cnt++] = "-U_FORTIFY_SOURCE"; + cc_params[cc_par_cnt++] = "-fsanitize=memory"; } @@ -175,7 +189,13 @@ static void edit_params(u32 argc, char** argv) { } +#ifdef USEMMAP + cc_params[cc_par_cnt++] = "-lrt"; +#endif + cc_params[cc_par_cnt++] = "-D__AFL_HAVE_MANUAL_CONTROL=1"; + cc_params[cc_par_cnt++] = "-D__AFL_COMPILER=1"; + cc_params[cc_par_cnt++] = "-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1"; /* When the user tries to use persistent or deferred forkserver modes by appending a single line to the program, we want to reliably inject a @@ -237,15 +257,10 @@ static void edit_params(u32 argc, char** argv) { int main(int argc, char** argv) { - if (isatty(2) && !getenv("AFL_QUIET")) { - - SAYF(cCYA "afl-gcc-fast " cBRI VERSION cRST " initially by , maintainer: hexcoder-\n"); - - } - - if (argc < 2) { + if (argc < 2 || strcmp(argv[1], "-h") == 0) { - SAYF("\n" + printf(cCYA "afl-gcc-fast" VERSION cRST " initially by , maintainer: hexcoder-\n" + "\n" "This is a helper application for afl-fuzz. It serves as a drop-in replacement\n" "for gcc, letting you recompile third-party code with the required runtime\n" "instrumentation. A common use pattern would be one of the following:\n\n" @@ -263,8 +278,11 @@ int main(int argc, char** argv) { exit(1); - } + } else if (isatty(2) && !getenv("AFL_QUIET")) { + SAYF(cCYA "afl-gcc-fast" VERSION cRST " initially by , maintainer: hexcoder-\n"); + + } find_obj(argv[0]); diff --git a/gcc_plugin/afl-gcc-pass.so.cc b/gcc_plugin/afl-gcc-pass.so.cc index f0f5b30b..a44f5a74 100644 --- a/gcc_plugin/afl-gcc-pass.so.cc +++ b/gcc_plugin/afl-gcc-pass.so.cc @@ -416,7 +416,7 @@ public: /* Either we couldn't figure out our location or the location is * not whitelisted, so we skip instrumentation. */ - if (!instrumentBlock) return 0;; + if (!instrumentBlock) return 0; } return do_ext_call ? ext_call_instrument(fun) : inline_instrument(fun); @@ -464,7 +464,7 @@ int plugin_init(struct plugin_name_args *plugin_info, /* Show a banner */ if (isatty(2) && !getenv("AFL_QUIET")) { - SAYF(G_(cCYA "afl-gcc-pass " cBRI VERSION cRST " initially by , maintainer: hexcoder-\n")); + SAYF(G_(cCYA "afl-gcc-pass" VERSION cRST " initially by , maintainer: hexcoder-\n")); } else be_quiet = 1; diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c index 142d6331..54f9e6e9 100644 --- a/llvm_mode/afl-clang-fast.c +++ b/llvm_mode/afl-clang-fast.c @@ -112,7 +112,7 @@ static void edit_params(u32 argc, char** argv) { if (!name) name = argv[0]; else - name++; + ++name; if (!strcmp(name, "afl-clang-fast++")) { @@ -128,7 +128,7 @@ static void edit_params(u32 argc, char** argv) { /* There are three ways to compile with afl-clang-fast. In the traditional mode, we use afl-llvm-pass.so, then there is libLLVMInsTrim.so which is - much faster but has less coverage. Finally tere is the experimental + much faster but has less coverage. Finally there is the experimental 'trace-pc-guard' mode, we use native LLVM instrumentation callbacks instead. For trace-pc-guard see: http://clang.llvm.org/docs/SanitizerCoverage.html#tracing-pcs-with-guards diff --git a/src/afl-gcc.c b/src/afl-gcc.c index 8982ca97..dd7ba4d6 100644 --- a/src/afl-gcc.c +++ b/src/afl-gcc.c @@ -131,7 +131,7 @@ static void edit_params(u32 argc, char** argv) { if (!name) name = argv[0]; else - name++; + ++name; if (!strncmp(name, "afl-clang", 9)) { diff --git a/test/test.sh b/test/test.sh index ab2985fe..1c5cdda6 100755 --- a/test/test.sh +++ b/test/test.sh @@ -200,6 +200,75 @@ test -e ../afl-clang-fast && { rm -f test-persistent } || $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test" +$ECHO "$BLUE[*] Testing: gcc_plugin" +export AFL_CC=`which gcc` +test -e ../afl-gcc-fast && { + ../afl-gcc-fast -o test-instr.plain.gccpi ../test-instr.c > /dev/null 2>&1 + AFL_HARDEN=1 ../afl-gcc-fast -o test-compcov.harden.gccpi test-compcov.c > /dev/null 2>&1 + test -e test-instr.plain.gccpi && { + $ECHO "$GREEN[+] gcc_plugin compilation succeeded" + echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain.gccpi > /dev/null 2>&1 + ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain.gccpi < /dev/null > /dev/null 2>&1 + test -e test-instr.plain.0 -a -e test-instr.plain.1 && { + diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { + $ECHO "$RED[!] gcc_plugin instrumentation should be different on different input but is not" + } || $ECHO "$GREEN[+] gcc_plugin instrumentation present and working correctly" + } || $ECHO "$RED[!] gcc_plugin instrumentation failed" + rm -f test-instr.plain.0 test-instr.plain.1 + } || $ECHO "$RED[!] gcc_plugin failed" + + test -e test-compcov.harden.gccpi && { + grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden.gccpi > /dev/null 2>&1 && { + $ECHO "$GREEN[+] gcc_plugin hardened mode succeeded and is working" + } || $ECHO "$RED[!] gcc_plugin hardened mode is not hardened" + rm -f test-compcov.harden.gccpi + } || $ECHO "$RED[!] gcc_plugin hardened mode compilation failed" + # now we want to be sure that afl-fuzz is working + (test "$(uname -s)" = "Linux" && test "$(sysctl kernel.core_pattern)" != "kernel.core_pattern = core" && { + $ECHO "$RED[!] we cannot run afl-fuzz with enabled core dumps. Run 'sudo sh afl-system-config'.$RESET" + true + }) || + # make sure crash reporter is disabled on Mac OS X + (test "$(uname -s)" = "Darwin" && test $(launchctl list 2>/dev/null | grep -q '\.ReportCrash$') && { + $ECHO "$RED[!] we cannot run afl-fuzz with enabled crash reporter. Run 'sudo sh afl-system-config'.$RESET" + true + }) || { + mkdir -p in + echo 0 > in/in + $ECHO "$GREY[*] running afl-fuzz for gcc_plugin, this will take approx 10 seconds" + { + ../afl-fuzz -V10 -m ${MEM_LIMIT} -i in -o out -- ./test-instr.plain.gccpi >>errors 2>&1 + } >>errors 2>&1 + test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { + $ECHO "$GREEN[+] afl-fuzz is working correctly with gcc_plugin" + } || { + echo CUT------------------------------------------------------------------CUT + cat errors + echo CUT------------------------------------------------------------------CUT + $ECHO "$RED[!] afl-fuzz is not working correctly with gcc_plugin" + } + rm -rf in out errors + } + rm -f test-instr.plain.gccpi + + # now for the special gcc_plugin things + echo foobar.c > whitelist.txt + AFL_GCC_WHITELIST=whitelist.txt ../afl-gcc-fast -o test-compcov test-compcov.c > /dev/null 2>&1 + test -e test-compcov && { + echo 1 | ../afl-showmap -m ${MEM_LIMIT} -o - -r -- ./test-compcov 2>&1 | grep -q "Captured 1 tuples" && { + $ECHO "$GREEN[+] gcc_plugin whitelist feature works correctly" + } || $ECHO "$RED[!] gcc_plugin whitelist feature failed" + } || $ECHO "$RED[!] gcc_plugin whitelist feature compilation failed" + rm -f test-compcov test.out whitelist.txt + ../afl-gcc-fast -o test-persistent ../experimental/persistent_demo/persistent_demo.c > /dev/null 2>&1 + test -e test-persistent && { + echo foo | ../afl-showmap -o /dev/null -q -r ./test-persistent && { + $ECHO "$GREEN[+] gcc_plugin persistent mode feature works correctly" + } || $ECHO "$RED[!] gcc_plugin persistent mode feature failed to work" + } || $ECHO "$RED[!] gcc_plugin persistent mode feature compilation failed" + rm -f test-persistent +} || $ECHO "$YELLOW[-] gcc_plugin not compiled, cannot test" + $ECHO "$BLUE[*] Testing: shared library extensions" gcc -o test-compcov test-compcov.c > /dev/null 2>&1 test -e ../libtokencap.so && { -- cgit 1.4.1 From 230c135d4e05d810397138f2b6eb1927955f8900 Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Fri, 18 Oct 2019 22:43:30 +0200 Subject: typo in names --- Makefile | 2 +- llvm_mode/Makefile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'llvm_mode') diff --git a/Makefile b/Makefile index 8cf3d4fd..7e3764a8 100644 --- a/Makefile +++ b/Makefile @@ -292,7 +292,7 @@ source-only: all @./$* -h 2>&1 | tail -n +4 >> $@ @echo >> $@ @echo .SH AUTHOR >> $@ - @echo "afl++ was written by Michal \"lcamtuf\" Zalewski and is maintained by Marc \"van Hauser\" Heuse , Heiko \"hexc0der\" Eissfeldt and Andrea Fioraldi " >> $@ + @echo "afl++ was written by Michal \"lcamtuf\" Zalewski and is maintained by Marc \"van Hauser\" Heuse , Heiko \"hexcoder-\" Eissfeldt and Andrea Fioraldi " >> $@ @echo The homepage of afl++ is: https://github.com/vanhauser-thc/AFLplusplus >> $@ @echo >> $@ @echo .SH LICENSE >> $@ diff --git a/llvm_mode/Makefile b/llvm_mode/Makefile index 55bfab59..0360bfbe 100644 --- a/llvm_mode/Makefile +++ b/llvm_mode/Makefile @@ -220,7 +220,7 @@ vpath % .. @../$* -h 2>&1 | tail -n +4 >> ../$@ @echo >> ../$@ @echo .SH AUTHOR >> ../$@ - @echo "afl++ was written by Michal \"lcamtuf\" Zalewski and is maintained by Marc \"van Hauser\" Heuse , Heiko \"hexc0der\" Eissfeldt and Andrea Fioraldi " >> ../$@ + @echo "afl++ was written by Michal \"lcamtuf\" Zalewski and is maintained by Marc \"van Hauser\" Heuse , Heiko \"hexcoder-\" Eissfeldt and Andrea Fioraldi " >> ../$@ @echo The homepage of afl++ is: https://github.com/vanhauser-thc/AFLplusplus >> ../$@ @echo >> ../$@ @echo .SH LICENSE >> ../$@ -- cgit 1.4.1 From c83e8e1e6255374b085292ba8673efdca7388d76 Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Sat, 19 Oct 2019 18:23:01 +0200 Subject: Remove lcamtuf's old email from Google (not valid anymore), also remove maintainance from him. --- Makefile | 2 +- afl-cmin | 4 ++-- afl-plot | 4 ++-- afl-whatsup | 4 ++-- dictionaries/gif.dict | 2 +- dictionaries/html_tags.dict | 2 +- dictionaries/jpeg.dict | 2 +- dictionaries/js.dict | 2 +- dictionaries/png.dict | 2 +- dictionaries/sql.dict | 2 +- dictionaries/tiff.dict | 2 +- dictionaries/webp.dict | 2 +- dictionaries/xml.dict | 2 +- docs/power_schedules.txt | 2 +- experimental/argv_fuzzing/argv-fuzz-inl.h | 2 +- experimental/asan_cgroups/limit_memory.sh | 2 +- experimental/canvas_harness/canvas_harness.html | 2 +- experimental/clang_asm_normalize/as | 2 +- experimental/crash_triage/triage_crashes.sh | 4 ++-- experimental/distributed_fuzzing/sync_script.sh | 2 +- experimental/persistent_demo/persistent_demo.c | 2 +- experimental/post_library/post_library.so.c | 2 +- experimental/post_library/post_library_png.so.c | 2 +- gcc_plugin/Makefile | 2 +- gcc_plugin/afl-gcc-fast.c | 2 +- gcc_plugin/afl-gcc-rt.o.c | 2 +- include/afl-as.h | 2 +- include/afl-fuzz.h | 2 +- include/alloc-inl.h | 2 +- include/android-ashmem.h | 2 +- include/common.h | 2 +- include/config.h | 2 +- include/debug.h | 2 +- include/forkserver.h | 2 +- include/hash.h | 2 +- include/sharedmem.h | 2 +- include/types.h | 2 +- libdislocator/Makefile | 2 +- libdislocator/libdislocator.so.c | 2 +- libtokencap/Makefile | 2 +- libtokencap/libtokencap.so.c | 2 +- llvm_mode/Makefile | 2 +- llvm_mode/afl-clang-fast.c | 2 +- llvm_mode/afl-llvm-pass.so.cc | 2 +- llvm_mode/afl-llvm-rt.o.c | 2 +- qemu_mode/build_qemu_support.sh | 2 +- qemu_mode/patches/afl-qemu-common.h | 2 +- qemu_mode/patches/afl-qemu-cpu-inl.h | 2 +- qemu_mode/patches/afl-qemu-cpu-translate-inl.h | 2 +- qemu_mode/patches/afl-qemu-tcg-inl.h | 2 +- qemu_mode/patches/afl-qemu-translate-inl.h | 2 +- src/afl-analyze.c | 4 ++-- src/afl-as.c | 4 ++-- src/afl-common.c | 2 +- src/afl-forkserver.c | 2 +- src/afl-fuzz-bitmap.c | 2 +- src/afl-fuzz-extras.c | 2 +- src/afl-fuzz-globals.c | 2 +- src/afl-fuzz-init.c | 2 +- src/afl-fuzz-misc.c | 2 +- src/afl-fuzz-one.c | 2 +- src/afl-fuzz-python.c | 2 +- src/afl-fuzz-queue.c | 2 +- src/afl-fuzz-run.c | 2 +- src/afl-fuzz-stats.c | 2 +- src/afl-fuzz.c | 4 ++-- src/afl-gcc.c | 6 +++--- src/afl-gotcpu.c | 8 ++++---- src/afl-sharedmem.c | 2 +- src/afl-showmap.c | 4 ++-- src/afl-tmin.c | 4 ++-- test-instr.c | 2 +- unicorn_mode/build_unicorn_support.sh | 2 +- unicorn_mode/patches/afl-unicorn-common.h | 2 +- unicorn_mode/patches/afl-unicorn-cpu-inl.h | 2 +- unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h | 2 +- unicorn_mode/patches/afl-unicorn-tcg-op-inl.h | 2 +- unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h | 2 +- 78 files changed, 92 insertions(+), 92 deletions(-) (limited to 'llvm_mode') diff --git a/Makefile b/Makefile index ce0d6781..cfcd0890 100644 --- a/Makefile +++ b/Makefile @@ -2,7 +2,7 @@ # american fuzzy lop - makefile # ----------------------------- # -# Written and maintained by Michal Zalewski +# Written by Michal Zalewski # # Copyright 2013, 2014, 2015, 2016, 2017 Google Inc. All rights reserved. # diff --git a/afl-cmin b/afl-cmin index 88635550..e4e0fd85 100755 --- a/afl-cmin +++ b/afl-cmin @@ -3,7 +3,7 @@ # american fuzzy lop - corpus minimization tool # --------------------------------------------- # -# Written and maintained by Michal Zalewski +# Written by Michal Zalewski # # Copyright 2014, 2015 Google Inc. All rights reserved. # @@ -36,7 +36,7 @@ # array sizes. # -echo "corpus minimization tool for afl-fuzz by " +echo "corpus minimization tool for afl-fuzz by Michal Zalewski" echo ######### diff --git a/afl-plot b/afl-plot index bc86fb85..b6108a09 100755 --- a/afl-plot +++ b/afl-plot @@ -3,7 +3,7 @@ # american fuzzy lop - Advanced Persistent Graphing # ------------------------------------------------- # -# Written and maintained by Michal Zalewski +# Written by Michal Zalewski # Based on a design & prototype by Michael Rash. # # Copyright 2014, 2015 Google Inc. All rights reserved. @@ -15,7 +15,7 @@ # http://www.apache.org/licenses/LICENSE-2.0 # -echo "progress plotting utility for afl-fuzz by " +echo "progress plotting utility for afl-fuzz by Michal Zalewski" echo if [ ! "$#" = "2" ]; then diff --git a/afl-whatsup b/afl-whatsup index 505f7eba..2666d208 100755 --- a/afl-whatsup +++ b/afl-whatsup @@ -3,7 +3,7 @@ # american fuzzy lop - status check tool # -------------------------------------- # -# Written and maintained by Michal Zalewski +# Written by Michal Zalewski # # Copyright 2015 Google Inc. All rights reserved. # @@ -17,7 +17,7 @@ # instances of afl-fuzz. # -echo "status check tool for afl-fuzz by " +echo "status check tool for afl-fuzz by Michal Zalewski" echo test "$1" = "-h" && { echo $0 diff --git a/dictionaries/gif.dict b/dictionaries/gif.dict index 71148937..441b3b8d 100644 --- a/dictionaries/gif.dict +++ b/dictionaries/gif.dict @@ -2,7 +2,7 @@ # AFL dictionary for GIF images # ----------------------------- # -# Created by Michal Zalewski +# Created by Michal Zalewski # header_87a="87a" diff --git a/dictionaries/html_tags.dict b/dictionaries/html_tags.dict index ba946df3..2805de90 100644 --- a/dictionaries/html_tags.dict +++ b/dictionaries/html_tags.dict @@ -5,7 +5,7 @@ # A basic collection of HTML tags likely to matter to HTML parsers. Does *not* # include any attributes or attribute values. # -# Created by Michal Zalewski +# Created by Michal Zalewski # tag_a="" diff --git a/dictionaries/jpeg.dict b/dictionaries/jpeg.dict index 15efede7..40282f1a 100644 --- a/dictionaries/jpeg.dict +++ b/dictionaries/jpeg.dict @@ -2,7 +2,7 @@ # AFL dictionary for JPEG images # ------------------------------ # -# Created by Michal Zalewski +# Created by Michal Zalewski # header_jfif="JFIF\x00" diff --git a/dictionaries/js.dict b/dictionaries/js.dict index 9db37bfe..7926364c 100644 --- a/dictionaries/js.dict +++ b/dictionaries/js.dict @@ -4,7 +4,7 @@ # # Contains basic reserved keywords and syntax building blocks. # -# Created by Michal Zalewski +# Created by Michal Zalewski # keyword_arguments="arguments" diff --git a/dictionaries/png.dict b/dictionaries/png.dict index ea12d19e..ad9ea328 100644 --- a/dictionaries/png.dict +++ b/dictionaries/png.dict @@ -5,7 +5,7 @@ # Just the basic, standard-originating sections; does not include vendor # extensions. # -# Created by Michal Zalewski +# Created by Michal Zalewski # header_png="\x89PNG\x0d\x0a\x1a\x0a" diff --git a/dictionaries/sql.dict b/dictionaries/sql.dict index 58342473..efa44ba8 100644 --- a/dictionaries/sql.dict +++ b/dictionaries/sql.dict @@ -11,7 +11,7 @@ # standpoint, because they are usually not allowed in non-privileged # contexts). # -# Created by Michal Zalewski +# Created by Michal Zalewski # function_abs=" abs(1)" diff --git a/dictionaries/tiff.dict b/dictionaries/tiff.dict index 8f04b5af..720e56ce 100644 --- a/dictionaries/tiff.dict +++ b/dictionaries/tiff.dict @@ -5,7 +5,7 @@ # Just the basic, standard-originating sections; does not include vendor # extensions. # -# Created by Michal Zalewski +# Created by Michal Zalewski # header_ii="II*\x00" diff --git a/dictionaries/webp.dict b/dictionaries/webp.dict index 8a70e73b..53aa28c7 100644 --- a/dictionaries/webp.dict +++ b/dictionaries/webp.dict @@ -2,7 +2,7 @@ # AFL dictionary for WebP images # ------------------------------ # -# Created by Michal Zalewski +# Created by Michal Zalewski # header_RIFF="RIFF" diff --git a/dictionaries/xml.dict b/dictionaries/xml.dict index 8127aa28..d8375452 100644 --- a/dictionaries/xml.dict +++ b/dictionaries/xml.dict @@ -4,7 +4,7 @@ # # Several basic syntax elements and attributes, modeled on libxml2. # -# Created by Michal Zalewski +# Created by Michal Zalewski # attr_encoding=" encoding=\"1\"" diff --git a/docs/power_schedules.txt b/docs/power_schedules.txt index f5f66bd6..7b9d34c4 100644 --- a/docs/power_schedules.txt +++ b/docs/power_schedules.txt @@ -2,7 +2,7 @@ afl++'s power schedules based on AFLfast Power schedules implemented by Marcel Böhme \. -AFLFast is an extension of AFL which was written by Michal Zalewski \. +AFLFast is an extension of AFL which was written by Michal Zalewski. AFLfast has helped in the success of Team Codejitsu at the finals of the DARPA Cyber Grand Challenge where their bot Galactica took **2nd place** in terms of #POVs proven (see red bar at https://www.cybergrandchallenge.com/event#results). AFLFast exposed several previously unreported CVEs that could not be exposed by AFL in 24 hours and otherwise exposed vulnerabilities significantly faster than AFL while generating orders of magnitude more unique crashes. diff --git a/experimental/argv_fuzzing/argv-fuzz-inl.h b/experimental/argv_fuzzing/argv-fuzz-inl.h index b042d38c..5d411046 100644 --- a/experimental/argv_fuzzing/argv-fuzz-inl.h +++ b/experimental/argv_fuzzing/argv-fuzz-inl.h @@ -2,7 +2,7 @@ american fuzzy lop - sample argv fuzzing wrapper ------------------------------------------------ - Written by Michal Zalewski + Written by Michal Zalewski Copyright 2015 Google Inc. All rights reserved. diff --git a/experimental/asan_cgroups/limit_memory.sh b/experimental/asan_cgroups/limit_memory.sh index b0c77d15..97950410 100755 --- a/experimental/asan_cgroups/limit_memory.sh +++ b/experimental/asan_cgroups/limit_memory.sh @@ -7,7 +7,7 @@ # David A. Wheeler # # Edits to bring the script in line with afl-cmin and other companion scripts -# by Michal Zalewski . All bugs are my fault. +# by Michal Zalewski. All bugs are my fault. # # Copyright 2015 Institute for Defense Analyses. # diff --git a/experimental/canvas_harness/canvas_harness.html b/experimental/canvas_harness/canvas_harness.html index 19293667..7b31d8b4 100644 --- a/experimental/canvas_harness/canvas_harness.html +++ b/experimental/canvas_harness/canvas_harness.html @@ -4,7 +4,7 @@ american fuzzy lop - harness ------------------------------------- - Written and maintained by Michal Zalewski + Written by Michal Zalewski Copyright 2013, 2014 Google Inc. All rights reserved. diff --git a/experimental/clang_asm_normalize/as b/experimental/clang_asm_normalize/as index 4ee07e69..bd83c4ff 100755 --- a/experimental/clang_asm_normalize/as +++ b/experimental/clang_asm_normalize/as @@ -3,7 +3,7 @@ # american fuzzy lop - clang assembly normalizer # ---------------------------------------------- # -# Written and maintained by Michal Zalewski +# Written by Michal Zalewski # The idea for this wrapper comes from Ryan Govostes. # # Copyright 2013, 2014 Google Inc. All rights reserved. diff --git a/experimental/crash_triage/triage_crashes.sh b/experimental/crash_triage/triage_crashes.sh index 5894a4d6..205bc143 100755 --- a/experimental/crash_triage/triage_crashes.sh +++ b/experimental/crash_triage/triage_crashes.sh @@ -3,7 +3,7 @@ # american fuzzy lop - crash triage utility # ----------------------------------------- # -# Written and maintained by Michal Zalewski +# Written by Michal Zalewski # # Copyright 2013, 2014, 2017 Google Inc. All rights reserved. # @@ -22,7 +22,7 @@ # necessary. # -echo "crash triage utility for afl-fuzz by " +echo "crash triage utility for afl-fuzz by Michal Zalewski" echo ulimit -v 100000 2>/dev/null diff --git a/experimental/distributed_fuzzing/sync_script.sh b/experimental/distributed_fuzzing/sync_script.sh index 2d5e0635..31b0e436 100755 --- a/experimental/distributed_fuzzing/sync_script.sh +++ b/experimental/distributed_fuzzing/sync_script.sh @@ -3,7 +3,7 @@ # american fuzzy lop - fuzzer synchronization tool # ------------------------------------------------ # -# Written and maintained by Michal Zalewski +# Written by Michal Zalewski # # Copyright 2014 Google Inc. All rights reserved. # diff --git a/experimental/persistent_demo/persistent_demo.c b/experimental/persistent_demo/persistent_demo.c index d091febe..a94c8374 100644 --- a/experimental/persistent_demo/persistent_demo.c +++ b/experimental/persistent_demo/persistent_demo.c @@ -2,7 +2,7 @@ american fuzzy lop - persistent mode example -------------------------------------------- - Written and maintained by Michal Zalewski + Written by Michal Zalewski Copyright 2015 Google Inc. All rights reserved. diff --git a/experimental/post_library/post_library.so.c b/experimental/post_library/post_library.so.c index 72620ff0..048eea70 100644 --- a/experimental/post_library/post_library.so.c +++ b/experimental/post_library/post_library.so.c @@ -2,7 +2,7 @@ american fuzzy lop - postprocessor library example -------------------------------------------------- - Written and maintained by Michal Zalewski + Written by Michal Zalewski Copyright 2015 Google Inc. All rights reserved. diff --git a/experimental/post_library/post_library_png.so.c b/experimental/post_library/post_library_png.so.c index 080a6938..6ba95c1a 100644 --- a/experimental/post_library/post_library_png.so.c +++ b/experimental/post_library/post_library_png.so.c @@ -2,7 +2,7 @@ american fuzzy lop - postprocessor for PNG ------------------------------------------ - Written and maintained by Michal Zalewski + Written by Michal Zalewski Copyright 2015 Google Inc. All rights reserved. diff --git a/gcc_plugin/Makefile b/gcc_plugin/Makefile index d10eba49..a603df78 100644 --- a/gcc_plugin/Makefile +++ b/gcc_plugin/Makefile @@ -4,7 +4,7 @@ # # Written by Austin Seipp and # Laszlo Szekeres and -# Michal Zalewski and +# Michal Zalewski and # Heiko Eißfeldt # # GCC integration design is based on the LLVM design, which comes diff --git a/gcc_plugin/afl-gcc-fast.c b/gcc_plugin/afl-gcc-fast.c index 73709321..b0461584 100644 --- a/gcc_plugin/afl-gcc-fast.c +++ b/gcc_plugin/afl-gcc-fast.c @@ -4,7 +4,7 @@ Written by Austin Seipp and Laszlo Szekeres and - Michal Zalewski + Michal Zalewski GCC integration design is based on the LLVM design, which comes from Laszlo Szekeres. diff --git a/gcc_plugin/afl-gcc-rt.o.c b/gcc_plugin/afl-gcc-rt.o.c index f6754bd4..dd79a0ec 100644 --- a/gcc_plugin/afl-gcc-rt.o.c +++ b/gcc_plugin/afl-gcc-rt.o.c @@ -4,7 +4,7 @@ Written by Austin Seipp and Laszlo Szekeres and - Michal Zalewski + Michal Zalewski GCC integration design is based on the LLVM design, which comes from Laszlo Szekeres. diff --git a/include/afl-as.h b/include/afl-as.h index 048866db..f0263312 100644 --- a/include/afl-as.h +++ b/include/afl-as.h @@ -2,7 +2,7 @@ american fuzzy lop++ - injectable parts --------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index 7e9ced46..1e6140dd 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -2,7 +2,7 @@ american fuzzy lop++ - fuzzer header ------------------------------------ - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/include/alloc-inl.h b/include/alloc-inl.h index b0815ab1..f5bb7246 100644 --- a/include/alloc-inl.h +++ b/include/alloc-inl.h @@ -2,7 +2,7 @@ american fuzzy lop++ - error-checking, memory-zeroing alloc routines -------------------------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/include/android-ashmem.h b/include/android-ashmem.h index 6c7a98db..f4d31739 100644 --- a/include/android-ashmem.h +++ b/include/android-ashmem.h @@ -2,7 +2,7 @@ american fuzzy lop++ - android shared memory compatibility layer ---------------------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/include/common.h b/include/common.h index e13bf0a0..7c3d4517 100644 --- a/include/common.h +++ b/include/common.h @@ -2,7 +2,7 @@ american fuzzy lop++ - common routines header --------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/include/config.h b/include/config.h index 396224fb..2e993a42 100644 --- a/include/config.h +++ b/include/config.h @@ -2,7 +2,7 @@ american fuzzy lop++ - vaguely configurable bits ------------------------------------------------ - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/include/debug.h b/include/debug.h index cccfc284..ed6c29e9 100644 --- a/include/debug.h +++ b/include/debug.h @@ -2,7 +2,7 @@ american fuzzy lop++ - debug / error handling macros ---------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/include/forkserver.h b/include/forkserver.h index 9a099888..9cabe58e 100644 --- a/include/forkserver.h +++ b/include/forkserver.h @@ -2,7 +2,7 @@ american fuzzy lop++ - forkserver header ---------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Forkserver design by Jann Horn diff --git a/include/hash.h b/include/hash.h index 7085df32..1a8ac252 100644 --- a/include/hash.h +++ b/include/hash.h @@ -12,7 +12,7 @@ Austin's original code is public domain. - Other code written and maintained by Michal Zalewski + Other code written by Michal Zalewski Copyright 2016 Google Inc. All rights reserved. diff --git a/include/sharedmem.h b/include/sharedmem.h index 18e4ee9f..cec6c025 100644 --- a/include/sharedmem.h +++ b/include/sharedmem.h @@ -2,7 +2,7 @@ american fuzzy lop++ - shared memory related header --------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Forkserver design by Jann Horn diff --git a/include/types.h b/include/types.h index 07fc7e91..c34bf522 100644 --- a/include/types.h +++ b/include/types.h @@ -2,7 +2,7 @@ american fuzzy lop++ - type definitions and minor macros -------------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/libdislocator/Makefile b/libdislocator/Makefile index cbaa05ea..91efba07 100644 --- a/libdislocator/Makefile +++ b/libdislocator/Makefile @@ -2,7 +2,7 @@ # american fuzzy lop - libdislocator # ---------------------------------- # -# Written by Michal Zalewski +# Written by Michal Zalewski # # Copyright 2016 Google Inc. All rights reserved. # diff --git a/libdislocator/libdislocator.so.c b/libdislocator/libdislocator.so.c index 8834a1fc..57607210 100644 --- a/libdislocator/libdislocator.so.c +++ b/libdislocator/libdislocator.so.c @@ -3,7 +3,7 @@ american fuzzy lop - dislocator, an abusive allocator ----------------------------------------------------- - Written and maintained by Michal Zalewski + Written by Michal Zalewski Copyright 2016 Google Inc. All rights reserved. diff --git a/libtokencap/Makefile b/libtokencap/Makefile index 3fd01b2c..91933140 100644 --- a/libtokencap/Makefile +++ b/libtokencap/Makefile @@ -2,7 +2,7 @@ # american fuzzy lop - libtokencap # -------------------------------- # -# Written by Michal Zalewski +# Written by Michal Zalewski # # Copyright 2016 Google Inc. All rights reserved. # diff --git a/libtokencap/libtokencap.so.c b/libtokencap/libtokencap.so.c index 17b6190c..39095beb 100644 --- a/libtokencap/libtokencap.so.c +++ b/libtokencap/libtokencap.so.c @@ -3,7 +3,7 @@ american fuzzy lop - extract tokens passed to strcmp / memcmp ------------------------------------------------------------- - Written and maintained by Michal Zalewski + Written by Michal Zalewski Copyright 2016 Google Inc. All rights reserved. diff --git a/llvm_mode/Makefile b/llvm_mode/Makefile index 0360bfbe..7cfbe92d 100644 --- a/llvm_mode/Makefile +++ b/llvm_mode/Makefile @@ -3,7 +3,7 @@ # ----------------------------------------- # # Written by Laszlo Szekeres and -# Michal Zalewski +# Michal Zalewski # # LLVM integration design comes from Laszlo Szekeres. # diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c index 54f9e6e9..a7f6acdc 100644 --- a/llvm_mode/afl-clang-fast.c +++ b/llvm_mode/afl-clang-fast.c @@ -3,7 +3,7 @@ ------------------------------------------------ Written by Laszlo Szekeres and - Michal Zalewski + Michal Zalewski LLVM integration design comes from Laszlo Szekeres. diff --git a/llvm_mode/afl-llvm-pass.so.cc b/llvm_mode/afl-llvm-pass.so.cc index 3ca5ccc4..475a3f33 100644 --- a/llvm_mode/afl-llvm-pass.so.cc +++ b/llvm_mode/afl-llvm-pass.so.cc @@ -3,7 +3,7 @@ --------------------------------------------------- Written by Laszlo Szekeres and - Michal Zalewski + Michal Zalewski LLVM integration design comes from Laszlo Szekeres. C bits copied-and-pasted from afl-as.c are Michal's fault. diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c index 20b34336..5740fe42 100644 --- a/llvm_mode/afl-llvm-rt.o.c +++ b/llvm_mode/afl-llvm-rt.o.c @@ -3,7 +3,7 @@ --------------------------------------------------- Written by Laszlo Szekeres and - Michal Zalewski + Michal Zalewski LLVM integration design comes from Laszlo Szekeres. diff --git a/qemu_mode/build_qemu_support.sh b/qemu_mode/build_qemu_support.sh index 55d72e0d..f18cbdf3 100755 --- a/qemu_mode/build_qemu_support.sh +++ b/qemu_mode/build_qemu_support.sh @@ -4,7 +4,7 @@ # -------------------------------------- # # Originally written by Andrew Griffiths and -# Michal Zalewski +# Michal Zalewski # # TCG instrumentation and block chaining support by Andrea Biondo # diff --git a/qemu_mode/patches/afl-qemu-common.h b/qemu_mode/patches/afl-qemu-common.h index c86b5b45..1da3359d 100644 --- a/qemu_mode/patches/afl-qemu-common.h +++ b/qemu_mode/patches/afl-qemu-common.h @@ -3,7 +3,7 @@ ------------------------------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski TCG instrumentation and block chaining support by Andrea Biondo diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h index 262a7dab..7358fc3b 100644 --- a/qemu_mode/patches/afl-qemu-cpu-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-inl.h @@ -3,7 +3,7 @@ ------------------------------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski TCG instrumentation and block chaining support by Andrea Biondo diff --git a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h index b6d3da1f..62858724 100644 --- a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h @@ -3,7 +3,7 @@ ------------------------------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski TCG instrumentation and block chaining support by Andrea Biondo diff --git a/qemu_mode/patches/afl-qemu-tcg-inl.h b/qemu_mode/patches/afl-qemu-tcg-inl.h index d7a25695..e3de09d8 100644 --- a/qemu_mode/patches/afl-qemu-tcg-inl.h +++ b/qemu_mode/patches/afl-qemu-tcg-inl.h @@ -3,7 +3,7 @@ ------------------------------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski TCG instrumentation and block chaining support by Andrea Biondo diff --git a/qemu_mode/patches/afl-qemu-translate-inl.h b/qemu_mode/patches/afl-qemu-translate-inl.h index 5f61d7c9..881dbc8d 100644 --- a/qemu_mode/patches/afl-qemu-translate-inl.h +++ b/qemu_mode/patches/afl-qemu-translate-inl.h @@ -3,7 +3,7 @@ ------------------------------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski TCG instrumentation and block chaining support by Andrea Biondo diff --git a/src/afl-analyze.c b/src/afl-analyze.c index 2d13621b..5555a262 100644 --- a/src/afl-analyze.c +++ b/src/afl-analyze.c @@ -2,7 +2,7 @@ american fuzzy lop++ - file format analyzer ------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and @@ -841,7 +841,7 @@ int main(int argc, char** argv) { doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH; - SAYF(cCYA "afl-analyze" VERSION cRST " by \n"); + SAYF(cCYA "afl-analyze" VERSION cRST " by Michal Zalewski\n"); while ((opt = getopt(argc, argv, "+i:f:m:t:eQUWh")) > 0) diff --git a/src/afl-as.c b/src/afl-as.c index b5a5ed58..2b023432 100644 --- a/src/afl-as.c +++ b/src/afl-as.c @@ -2,7 +2,7 @@ american fuzzy lop++ - wrapper for GNU as ----------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and @@ -501,7 +501,7 @@ int main(int argc, char** argv) { if (isatty(2) && !getenv("AFL_QUIET")) { - SAYF(cCYA "afl-as" VERSION cRST " by \n"); + SAYF(cCYA "afl-as" VERSION cRST " by Michal Zalewski\n"); } else diff --git a/src/afl-common.c b/src/afl-common.c index e753e797..ec010c2d 100644 --- a/src/afl-common.c +++ b/src/afl-common.c @@ -2,7 +2,7 @@ american fuzzy lop++ - common routines -------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c index d9f67da5..b11ee5ce 100644 --- a/src/afl-forkserver.c +++ b/src/afl-forkserver.c @@ -2,7 +2,7 @@ american fuzzy lop++ - forkserver code -------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Forkserver design by Jann Horn diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c index d001dbee..22876626 100644 --- a/src/afl-fuzz-bitmap.c +++ b/src/afl-fuzz-bitmap.c @@ -2,7 +2,7 @@ american fuzzy lop++ - bitmap related routines ---------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-extras.c b/src/afl-fuzz-extras.c index 1a0e2eff..23b2c235 100644 --- a/src/afl-fuzz-extras.c +++ b/src/afl-fuzz-extras.c @@ -2,7 +2,7 @@ american fuzzy lop++ - extras relates routines ---------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-globals.c b/src/afl-fuzz-globals.c index 8340394a..36ba6e14 100644 --- a/src/afl-fuzz-globals.c +++ b/src/afl-fuzz-globals.c @@ -2,7 +2,7 @@ american fuzzy lop++ - globals declarations ------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c index a37ce8ba..a77904b5 100644 --- a/src/afl-fuzz-init.c +++ b/src/afl-fuzz-init.c @@ -2,7 +2,7 @@ american fuzzy lop++ - initialization related routines ------------------------------------------------------ - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-misc.c b/src/afl-fuzz-misc.c index a7372b7d..f45642f4 100644 --- a/src/afl-fuzz-misc.c +++ b/src/afl-fuzz-misc.c @@ -2,7 +2,7 @@ american fuzzy lop++ - misc stuffs from Mordor ---------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c index 31d58a10..bed8d254 100644 --- a/src/afl-fuzz-one.c +++ b/src/afl-fuzz-one.c @@ -2,7 +2,7 @@ american fuzzy lop++ - fuzze_one routines in different flavours --------------------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-python.c b/src/afl-fuzz-python.c index 1a28f603..1a8b7f9d 100644 --- a/src/afl-fuzz-python.c +++ b/src/afl-fuzz-python.c @@ -2,7 +2,7 @@ american fuzzy lop++ - python extension routines ------------------------------------------------ - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c index 905fd931..9f036186 100644 --- a/src/afl-fuzz-queue.c +++ b/src/afl-fuzz-queue.c @@ -2,7 +2,7 @@ american fuzzy lop++ - queue relates routines --------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c index 5211921f..e12b06eb 100644 --- a/src/afl-fuzz-run.c +++ b/src/afl-fuzz-run.c @@ -2,7 +2,7 @@ american fuzzy lop++ - target execution related routines -------------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index 7e8639f2..2ea03e94 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -2,7 +2,7 @@ american fuzzy lop++ - stats related routines --------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 44037ce8..bb342112 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -2,7 +2,7 @@ american fuzzy lop - fuzzer code -------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and @@ -127,7 +127,7 @@ int main(int argc, char** argv) { SAYF(cCYA "afl-fuzz" VERSION cRST - " based on afl by and a big online community\n"); + " based on afl by Michal Zalewski and a big online community\n"); doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH; diff --git a/src/afl-gcc.c b/src/afl-gcc.c index dd7ba4d6..740442dc 100644 --- a/src/afl-gcc.c +++ b/src/afl-gcc.c @@ -2,7 +2,7 @@ american fuzzy lop++ - wrapper for GCC and clang ------------------------------------------------ - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and @@ -335,7 +335,7 @@ int main(int argc, char** argv) { if (argc == 2 && strcmp(argv[1], "-h") == 0) { - printf("afl-cc" VERSION " by \n\n"); + printf("afl-cc" VERSION " by Michal Zalewski\n\n"); printf("%s \n\n", argv[0]); printf("afl-gcc has no command line options\n"); printf( @@ -347,7 +347,7 @@ int main(int argc, char** argv) { if (isatty(2) && !getenv("AFL_QUIET")) { - SAYF(cCYA "afl-cc" VERSION cRST " by \n"); + SAYF(cCYA "afl-cc" VERSION cRST " by Michal Zalewski\n"); SAYF(cYEL "[!] " cBRI "NOTE: " cRST "afl-gcc is deprecated, llvm_mode is much faster and has more " "options\n"); diff --git a/src/afl-gotcpu.c b/src/afl-gotcpu.c index dc938b65..850943dd 100644 --- a/src/afl-gotcpu.c +++ b/src/afl-gotcpu.c @@ -2,7 +2,7 @@ american fuzzy lop - free CPU gizmo ----------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and @@ -142,7 +142,7 @@ int main(int argc, char** argv) { if (argc > 1) { - printf("afl-gotcpu" VERSION " by \n"); + printf("afl-gotcpu" VERSION " by Michal Zalewski\n"); printf("\n%s \n\n", argv[0]); printf("afl-gotcpu does not have command line options\n"); printf("afl-gotcpu prints out which CPUs are available\n"); @@ -154,7 +154,7 @@ int main(int argc, char** argv) { u32 cpu_cnt = sysconf(_SC_NPROCESSORS_ONLN), idle_cpus = 0, maybe_cpus = 0, i; - SAYF(cCYA "afl-gotcpu" VERSION cRST " by \n"); + SAYF(cCYA "afl-gotcpu" VERSION cRST " by Michal Zalewski\n"); ACTF("Measuring per-core preemption rate (this will take %0.02f sec)...", ((double)CTEST_CORE_TRG_MS) / 1000); @@ -275,7 +275,7 @@ int main(int argc, char** argv) { u32 util_perc; - SAYF(cCYA "afl-gotcpu" VERSION cRST " by \n"); + SAYF(cCYA "afl-gotcpu" VERSION cRST " by Michal Zalewski\n"); /* Run a busy loop for CTEST_TARGET_MS. */ diff --git a/src/afl-sharedmem.c b/src/afl-sharedmem.c index 0bd1ff2f..d94100a3 100644 --- a/src/afl-sharedmem.c +++ b/src/afl-sharedmem.c @@ -2,7 +2,7 @@ american fuzzy lop++ - shared memory related code ------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Forkserver design by Jann Horn diff --git a/src/afl-showmap.c b/src/afl-showmap.c index 31f12856..b54ac2b0 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -2,7 +2,7 @@ american fuzzy lop++ - map display utility ------------------------------------------ - Originally written by Michal Zalewski + Originally written by Michal Zalewski Forkserver design by Jann Horn @@ -395,7 +395,7 @@ static void setup_signal_handlers(void) { static void show_banner(void) { - SAYF(cCYA "afl-showmap" VERSION cRST " by \n"); + SAYF(cCYA "afl-showmap" VERSION cRST " by Michal Zalewski\n"); } diff --git a/src/afl-tmin.c b/src/afl-tmin.c index 7f354727..a72e1dda 100644 --- a/src/afl-tmin.c +++ b/src/afl-tmin.c @@ -2,7 +2,7 @@ american fuzzy lop++ - test case minimizer ------------------------------------------ - Originally written by Michal Zalewski + Originally written by Michal Zalewski Forkserver design by Jann Horn @@ -1032,7 +1032,7 @@ int main(int argc, char** argv) { doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH; - SAYF(cCYA "afl-tmin" VERSION cRST " by \n"); + SAYF(cCYA "afl-tmin" VERSION cRST " by Michal Zalewski\n"); while ((opt = getopt(argc, argv, "+i:o:f:m:t:B:xeQUWh")) > 0) diff --git a/test-instr.c b/test-instr.c index 2450dbf4..161bdb8e 100644 --- a/test-instr.c +++ b/test-instr.c @@ -2,7 +2,7 @@ american fuzzy lop - a trivial program to test the build -------------------------------------------------------- - Written and maintained by Michal Zalewski + Written by Michal Zalewski Copyright 2014 Google Inc. All rights reserved. diff --git a/unicorn_mode/build_unicorn_support.sh b/unicorn_mode/build_unicorn_support.sh index 1575f66c..3bd404b8 100755 --- a/unicorn_mode/build_unicorn_support.sh +++ b/unicorn_mode/build_unicorn_support.sh @@ -6,7 +6,7 @@ # Originally written by Nathan Voss # # Adapted from code by Andrew Griffiths and -# Michal Zalewski +# Michal Zalewski # # Adapted for AFLplusplus by Dominik Maier # diff --git a/unicorn_mode/patches/afl-unicorn-common.h b/unicorn_mode/patches/afl-unicorn-common.h index fd88e21b..66d03803 100644 --- a/unicorn_mode/patches/afl-unicorn-common.h +++ b/unicorn_mode/patches/afl-unicorn-common.h @@ -3,7 +3,7 @@ ---------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski Adapted for afl-unicorn by Dominik Maier diff --git a/unicorn_mode/patches/afl-unicorn-cpu-inl.h b/unicorn_mode/patches/afl-unicorn-cpu-inl.h index 082d6d68..72092e29 100644 --- a/unicorn_mode/patches/afl-unicorn-cpu-inl.h +++ b/unicorn_mode/patches/afl-unicorn-cpu-inl.h @@ -3,7 +3,7 @@ ---------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski Adapted for afl-unicorn by Dominik Maier diff --git a/unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h b/unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h index 7c84058f..70472a72 100644 --- a/unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h +++ b/unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h @@ -3,7 +3,7 @@ ---------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski Adapted for afl-unicorn by Dominik Maier diff --git a/unicorn_mode/patches/afl-unicorn-tcg-op-inl.h b/unicorn_mode/patches/afl-unicorn-tcg-op-inl.h index d21bbcc7..8f4a8748 100644 --- a/unicorn_mode/patches/afl-unicorn-tcg-op-inl.h +++ b/unicorn_mode/patches/afl-unicorn-tcg-op-inl.h @@ -3,7 +3,7 @@ ---------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski Adapted for afl-unicorn by Dominik Maier diff --git a/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h b/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h index 3031d3a6..53ab654c 100644 --- a/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h +++ b/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h @@ -3,7 +3,7 @@ ---------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski Adapted for afl-unicorn by Dominik Maier -- cgit 1.4.1 From 15c920a6126e3a0b5ac5a7293188c3d7a523bbde Mon Sep 17 00:00:00 2001 From: David Carlier Date: Fri, 25 Oct 2019 14:25:37 +0100 Subject: Little compiler plugins rework regarding block location picked up. --- gcc_plugin/afl-gcc-pass.so.cc | 2 +- include/types.h | 12 ++++++++++++ llvm_mode/afl-llvm-pass.so.cc | 9 +++++++++ 3 files changed, 22 insertions(+), 1 deletion(-) (limited to 'llvm_mode') diff --git a/gcc_plugin/afl-gcc-pass.so.cc b/gcc_plugin/afl-gcc-pass.so.cc index 633dedcb..84e02cb8 100644 --- a/gcc_plugin/afl-gcc-pass.so.cc +++ b/gcc_plugin/afl-gcc-pass.so.cc @@ -490,7 +490,7 @@ int plugin_init(struct plugin_name_args * plugin_info, /* Setup random() so we get Actually Random(TM) outputs from R() */ gettimeofday(&tv, &tz); rand_seed = tv.tv_sec ^ tv.tv_usec ^ getpid(); - srandom(rand_seed); + SR(rand_seed); /* Pass information */ afl_pass_info.pass = make_afl_pass(inst_ext, g); diff --git a/include/types.h b/include/types.h index c34bf522..3f34db66 100644 --- a/include/types.h +++ b/include/types.h @@ -79,9 +79,21 @@ typedef int64_t s64; }) #ifdef AFL_LLVM_PASS +#if defined(__linux__) +#define AFL_SR(s) (srandom(s)) #define AFL_R(x) (random() % (x)) #else +#define AFL_SR(s) +#define AFL_R(x) (arc4random_uniform(x)) +#endif +#else +#if defined(__linux__) +#define SR(s) (srandom(s)) #define R(x) (random() % (x)) +#else +#define SR(s) +#define R(x) (arc4random_uniform(x)) +#endif #endif /* ^AFL_LLVM_PASS */ #define STRINGIFY_INTERNAL(x) #x diff --git a/llvm_mode/afl-llvm-pass.so.cc b/llvm_mode/afl-llvm-pass.so.cc index 475a3f33..e094a0b2 100644 --- a/llvm_mode/afl-llvm-pass.so.cc +++ b/llvm_mode/afl-llvm-pass.so.cc @@ -34,6 +34,7 @@ #include #include #include +#include #include "llvm/IR/DebugInfo.h" #include "llvm/IR/BasicBlock.h" @@ -95,8 +96,16 @@ bool AFLCoverage::runOnModule(Module &M) { IntegerType *Int8Ty = IntegerType::getInt8Ty(C); IntegerType *Int32Ty = IntegerType::getInt32Ty(C); + struct timeval tv; + struct timezone tz; + u32 rand_seed; unsigned int cur_loc = 0; + /* Setup random() so we get Actually Random(TM) outputs from AFL_R() */ + gettimeofday(&tv, &tz); + rand_seed = tv.tv_sec ^ tv.tv_usec ^ getpid(); + AFL_SR(rand_seed); + /* Show a banner */ char be_quiet = 0; -- cgit 1.4.1 From 3eaf5560beaf5b3cb79f9a58bc986027935b7a3b Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Sat, 26 Oct 2019 09:03:46 +0200 Subject: AFL_LLVM_LAF_SPLIT_FLOATS --- llvm_mode/README.laf-intel.md | 3 ++- llvm_mode/split-compares-pass.so.cc | 14 ++++++++++---- 2 files changed, 12 insertions(+), 5 deletions(-) (limited to 'llvm_mode') diff --git a/llvm_mode/README.laf-intel.md b/llvm_mode/README.laf-intel.md index c787744b..462c7bac 100644 --- a/llvm_mode/README.laf-intel.md +++ b/llvm_mode/README.laf-intel.md @@ -35,4 +35,5 @@ bit_width may be 64, 32 or 16. A new experimental feature is splitting floating point comparisons into a series of sign, exponent and mantissa comparisons followed by splitting each of them into 8 bit comparisons when necessary. -It is activated with the `AFL_LLVM_LAF_SPLIT_COMPARES` setting. +It is activated with the `AFL_LLVM_LAF_SPLIT_FLOATS` setting, available only +when `AFL_LLVM_LAF_SPLIT_COMPARES` is set. diff --git a/llvm_mode/split-compares-pass.so.cc b/llvm_mode/split-compares-pass.so.cc index f1a0f94e..4248b238 100644 --- a/llvm_mode/split-compares-pass.so.cc +++ b/llvm_mode/split-compares-pass.so.cc @@ -50,6 +50,8 @@ class SplitComparesTransform : public ModulePass { } private: + int enableFPSplit; + size_t splitIntCompares(Module &M, unsigned bitw); size_t splitFPCompares(Module &M); bool simplifyCompares(Module &M); @@ -101,10 +103,11 @@ bool SplitComparesTransform::simplifyCompares(Module &M) { } - if (selectcmpInst->getPredicate() == CmpInst::FCMP_OGE || + if (enableFPSplit && ( + selectcmpInst->getPredicate() == CmpInst::FCMP_OGE || selectcmpInst->getPredicate() == CmpInst::FCMP_UGE || selectcmpInst->getPredicate() == CmpInst::FCMP_OLE || - selectcmpInst->getPredicate() == CmpInst::FCMP_ULE) { + selectcmpInst->getPredicate() == CmpInst::FCMP_ULE)) { auto op0 = selectcmpInst->getOperand(0); auto op1 = selectcmpInst->getOperand(1); @@ -1039,6 +1042,8 @@ bool SplitComparesTransform::runOnModule(Module &M) { char *bitw_env = getenv("LAF_SPLIT_COMPARES_BITW"); if (!bitw_env) bitw_env = getenv("AFL_LLVM_LAF_SPLIT_COMPARES_BITW"); if (bitw_env) { bitw = atoi(bitw_env); } + + enableFPSplit = getenv("AFL_LLVM_LAF_SPLIT_FLOATS") != NULL; simplifyCompares(M); @@ -1048,8 +1053,9 @@ bool SplitComparesTransform::runOnModule(Module &M) { errs() << "Split-compare-pass by laf.intel@gmail.com, extended by " "heiko@hexco.de\n"; - errs() << "Split-floatingpoint-compare-pass: " << splitFPCompares(M) - << " FP comparisons splitted\n"; + if (enableFPSplit) + errs() << "Split-floatingpoint-compare-pass: " << splitFPCompares(M) + << " FP comparisons splitted\n"; switch (bitw) { -- cgit 1.4.1 From 3ad5316dd1d7a4512b5acc17381a634a82901406 Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Sun, 27 Oct 2019 23:54:44 +0100 Subject: fix issue #86, we exclude floating point vectors from splitting --- llvm_mode/split-compares-pass.so.cc | 2 ++ 1 file changed, 2 insertions(+) (limited to 'llvm_mode') diff --git a/llvm_mode/split-compares-pass.so.cc b/llvm_mode/split-compares-pass.so.cc index 4248b238..06bdeb60 100644 --- a/llvm_mode/split-compares-pass.so.cc +++ b/llvm_mode/split-compares-pass.so.cc @@ -479,6 +479,8 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) { if (TyOp0 != TyOp1) { continue; } + if (TyOp0->isArrayTy() || TyOp0->isVectorTy()) { continue; } + fcomps.push_back(selectcmpInst); } -- cgit 1.4.1 From 38d74f0ad56a74cfed1eec04a8a46b4f8e4ec824 Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Mon, 28 Oct 2019 20:48:45 +0100 Subject: second forgotten place, we need to filter out float vector types --- llvm_mode/split-compares-pass.so.cc | 2 ++ 1 file changed, 2 insertions(+) (limited to 'llvm_mode') diff --git a/llvm_mode/split-compares-pass.so.cc b/llvm_mode/split-compares-pass.so.cc index 06bdeb60..60420f77 100644 --- a/llvm_mode/split-compares-pass.so.cc +++ b/llvm_mode/split-compares-pass.so.cc @@ -118,6 +118,8 @@ bool SplitComparesTransform::simplifyCompares(Module &M) { /* this is probably not needed but we do it anyway */ if (TyOp0 != TyOp1) { continue; } + if (TyOp0->isArrayTy() || TyOp0->isVectorTy()) { continue; } + fcomps.push_back(selectcmpInst); } -- cgit 1.4.1 From c87210820c1566c74bf08ab4345679598cabd71b Mon Sep 17 00:00:00 2001 From: David Carlier Date: Tue, 29 Oct 2019 15:06:20 +0000 Subject: libtokencap update proposal - bcmp interception. - FreeBSD using default argument to get current pid for the mapping data gathering, getpid seems to cause some issues under certain conditions (getenv call). --- libtokencap/libtokencap.so.c | 28 ++++++++++++++++++++++++---- llvm_mode/afl-clang-fast.c | 3 +++ src/afl-gcc.c | 1 + 3 files changed, 28 insertions(+), 4 deletions(-) (limited to 'llvm_mode') diff --git a/libtokencap/libtokencap.so.c b/libtokencap/libtokencap.so.c index 7e55963c..2fe9ae63 100644 --- a/libtokencap/libtokencap.so.c +++ b/libtokencap/libtokencap.so.c @@ -115,7 +115,7 @@ static void __tokencap_load_mappings(void) { #elif defined __FreeBSD__ || defined __OpenBSD__ || defined __NetBSD__ #if defined __FreeBSD__ - int mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_VMMAP, getpid()}; + int mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_VMMAP, -1}; #elif defined __OpenBSD__ int mib[] = {CTL_KERN, KERN_PROC_VMMAP, getpid()}; #elif defined __NetBSD__ @@ -134,9 +134,7 @@ static void __tokencap_load_mappings(void) { #endif buf = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0); - if (!buf) { - return; - } + if (buf == MAP_FAILED) return; if (sysctl(mib, miblen, buf, &len, NULL, 0) == -1) { @@ -354,6 +352,28 @@ int memcmp(const void* mem1, const void* mem2, size_t len) { } +#undef bcmp + +int bcmp(const void* mem1, const void* mem2, size_t len) { + + if (__tokencap_is_ro(mem1)) __tokencap_dump(mem1, len, 0); + if (__tokencap_is_ro(mem2)) __tokencap_dump(mem2, len, 0); + + const char *strmem1 = (const char *)mem1; + const char *strmem2 = (const char *)mem2; + + while (len--) { + + int diff = *strmem1 ^ *strmem2; + if (diff != 0) return 1; + strmem1++; + strmem2++; + + } + + return 0; +} + #undef strstr char* strstr(const char* haystack, const char* needle) { diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c index a7f6acdc..1acf8856 100644 --- a/llvm_mode/afl-clang-fast.c +++ b/llvm_mode/afl-clang-fast.c @@ -273,6 +273,9 @@ static void edit_params(u32 argc, char** argv) { cc_params[cc_par_cnt++] = "-fno-builtin-strcasecmp"; cc_params[cc_par_cnt++] = "-fno-builtin-strncasecmp"; cc_params[cc_par_cnt++] = "-fno-builtin-memcmp"; + cc_params[cc_par_cnt++] = "-fno-builtin-bcmp"; + cc_params[cc_par_cnt++] = "-fno-builtin-strstr"; + cc_params[cc_par_cnt++] = "-fno-builtin-strcasestr"; } diff --git a/src/afl-gcc.c b/src/afl-gcc.c index 740442dc..e0706a5f 100644 --- a/src/afl-gcc.c +++ b/src/afl-gcc.c @@ -320,6 +320,7 @@ static void edit_params(u32 argc, char** argv) { cc_params[cc_par_cnt++] = "-fno-builtin-strcasecmp"; cc_params[cc_par_cnt++] = "-fno-builtin-strncasecmp"; cc_params[cc_par_cnt++] = "-fno-builtin-memcmp"; + cc_params[cc_par_cnt++] = "-fno-builtin-bcmp"; cc_params[cc_par_cnt++] = "-fno-builtin-strstr"; cc_params[cc_par_cnt++] = "-fno-builtin-strcasestr"; -- cgit 1.4.1 From 16953b5cfa040c886d0edfbf2f4da478c3e6014d Mon Sep 17 00:00:00 2001 From: David Carlier Date: Wed, 30 Oct 2019 17:04:43 +0000 Subject: LLVM mode passing the full path of the LLVM config bindir. On FreeBSD the system compiler does not have llvm-config however system packages provides several version of the LLVM toolchain thus forcing to pass AFL_CC/AFL_CXX to make it work fully. --- llvm_mode/Makefile | 2 +- llvm_mode/afl-clang-fast.c | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-) (limited to 'llvm_mode') diff --git a/llvm_mode/Makefile b/llvm_mode/Makefile index 7cfbe92d..033babac 100644 --- a/llvm_mode/Makefile +++ b/llvm_mode/Makefile @@ -52,7 +52,7 @@ endif CFLAGS ?= -O3 -funroll-loops CFLAGS += -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -I ../include/ \ -DAFL_PATH=\"$(HELPER_PATH)\" -DBIN_PATH=\"$(BIN_PATH)\" \ - -DVERSION=\"$(VERSION)\" + -DLLVM_BINDIR=\"$(LLVM_BINDIR)\" -DVERSION=\"$(VERSION)\" ifdef AFL_TRACE_PC CFLAGS += -DUSE_TRACE_PC=1 endif diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c index 1acf8856..e92fb76f 100644 --- a/llvm_mode/afl-clang-fast.c +++ b/llvm_mode/afl-clang-fast.c @@ -32,11 +32,13 @@ #include #include #include +#include #include static u8* obj_path; /* Path to runtime libraries */ static u8** cc_params; /* Parameters passed to the real CC */ static u32 cc_par_cnt = 1; /* Param count, including argv0 */ +static u8 llvm_fullpath[PATH_MAX]; /* Try to find the runtime libraries. If that fails, abort. */ @@ -117,12 +119,14 @@ static void edit_params(u32 argc, char** argv) { if (!strcmp(name, "afl-clang-fast++")) { u8* alt_cxx = getenv("AFL_CXX"); - cc_params[0] = alt_cxx ? alt_cxx : (u8*)"clang++"; + snprintf(llvm_fullpath, sizeof(llvm_fullpath), "%s/clang++", LLVM_BINDIR); + cc_params[0] = alt_cxx ? alt_cxx : (u8*)llvm_fullpath; } else { u8* alt_cc = getenv("AFL_CC"); - cc_params[0] = alt_cc ? alt_cc : (u8*)"clang"; + snprintf(llvm_fullpath, sizeof(llvm_fullpath), "%s/clang", LLVM_BINDIR); + cc_params[0] = alt_cc ? alt_cc : (u8*)llvm_fullpath; } -- cgit 1.4.1 From 070ccae4dd04c5315bf1daba8ee35202b4f30264 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Thu, 31 Oct 2019 09:25:43 +0000 Subject: Little tweaks --- llvm_mode/afl-clang-fast.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'llvm_mode') diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c index e92fb76f..b2243492 100644 --- a/llvm_mode/afl-clang-fast.c +++ b/llvm_mode/afl-clang-fast.c @@ -38,7 +38,7 @@ static u8* obj_path; /* Path to runtime libraries */ static u8** cc_params; /* Parameters passed to the real CC */ static u32 cc_par_cnt = 1; /* Param count, including argv0 */ -static u8 llvm_fullpath[PATH_MAX]; +static u8 llvm_fullpath[PATH_MAX]; /* Try to find the runtime libraries. If that fails, abort. */ @@ -106,6 +106,7 @@ static void find_obj(u8* argv0) { static void edit_params(u32 argc, char** argv) { u8 fortify_set = 0, asan_set = 0, x_set = 0, maybe_linking = 1, bit_mode = 0; + u8 has_llvm_config = 0; u8* name; cc_params = ck_alloc((argc + 128) * sizeof(u8*)); @@ -116,16 +117,20 @@ static void edit_params(u32 argc, char** argv) { else ++name; + has_llvm_config = (strlen(LLVM_BINDIR) > 0); + if (!strcmp(name, "afl-clang-fast++")) { u8* alt_cxx = getenv("AFL_CXX"); - snprintf(llvm_fullpath, sizeof(llvm_fullpath), "%s/clang++", LLVM_BINDIR); + if (has_llvm_config) snprintf(llvm_fullpath, sizeof(llvm_fullpath), "%s/clang++", LLVM_BINDIR); + else sprintf(llvm_fullpath, "clang++"); cc_params[0] = alt_cxx ? alt_cxx : (u8*)llvm_fullpath; } else { u8* alt_cc = getenv("AFL_CC"); - snprintf(llvm_fullpath, sizeof(llvm_fullpath), "%s/clang", LLVM_BINDIR); + if (has_llvm_config) snprintf(llvm_fullpath, sizeof(llvm_fullpath), "%s/clang", LLVM_BINDIR); + else sprintf(llvm_fullpath, "clang"); cc_params[0] = alt_cc ? alt_cc : (u8*)llvm_fullpath; } -- cgit 1.4.1 From 7fdc7e01a5889fba365b8b841ba19602e26b5bd7 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Thu, 31 Oct 2019 11:39:08 +0000 Subject: Fix some silent warnings and put some var to some usage... --- llvm_mode/LLVMInsTrim.so.cc | 15 +++++++++------ llvm_mode/afl-llvm-pass.so.cc | 2 ++ llvm_mode/compare-transform-pass.so.cc | 4 ++++ 3 files changed, 15 insertions(+), 6 deletions(-) (limited to 'llvm_mode') diff --git a/llvm_mode/LLVMInsTrim.so.cc b/llvm_mode/LLVMInsTrim.so.cc index 4b5597e2..89738812 100644 --- a/llvm_mode/LLVMInsTrim.so.cc +++ b/llvm_mode/LLVMInsTrim.so.cc @@ -158,6 +158,7 @@ struct InsTrim : public ModulePass { bool instrumentBlock = false; DebugLoc Loc; StringRef instFilename; + unsigned int instLine = 0; for (auto &BB : F) { @@ -171,7 +172,7 @@ struct InsTrim : public ModulePass { DILocation *cDILoc = dyn_cast(Loc.getAsMDNode()); - unsigned int instLine = cDILoc->getLine(); + instLine = cDILoc->getLine(); instFilename = cDILoc->getFilename(); if (instFilename.str().empty()) { @@ -217,11 +218,13 @@ struct InsTrim : public ModulePass { * not whitelisted, so we skip instrumentation. */ if (!instrumentBlock) { - if (!instFilename.str().empty()) - SAYF(cYEL "[!] " cBRI "Not in whitelist, skipping %s ...\n", - instFilename.str().c_str()); - else - SAYF(cYEL "[!] " cBRI "No filename information found, skipping it"); + if (!be_quiet) { + if (!instFilename.str().empty()) + SAYF(cYEL "[!] " cBRI "Not in whitelist, skipping %s line %u...\n", + instFilename.str().c_str(), instLine); + else + SAYF(cYEL "[!] " cBRI "No filename information found, skipping it"); + } continue; } diff --git a/llvm_mode/afl-llvm-pass.so.cc b/llvm_mode/afl-llvm-pass.so.cc index e094a0b2..0c68136b 100644 --- a/llvm_mode/afl-llvm-pass.so.cc +++ b/llvm_mode/afl-llvm-pass.so.cc @@ -190,6 +190,8 @@ bool AFLCoverage::runOnModule(Module &M) { } + (void)instLine; + /* Continue only if we know where we actually are */ if (!instFilename.str().empty()) { diff --git a/llvm_mode/compare-transform-pass.so.cc b/llvm_mode/compare-transform-pass.so.cc index e1b6e671..0ccce875 100644 --- a/llvm_mode/compare-transform-pass.so.cc +++ b/llvm_mode/compare-transform-pass.so.cc @@ -234,6 +234,10 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp, ConstantInt *ilen = dyn_cast(op2); sizedLen = ilen->getZExtValue(); + } else { + + sizedLen = 0; + } if (HasStr1) { -- cgit 1.4.1