From ac5b0a3b34ab63e33bbaa336518f206f8ba8698f Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Sun, 13 Oct 2019 10:38:13 +0200 Subject: moar doc --- qemu_mode/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'qemu_mode') diff --git a/qemu_mode/README.md b/qemu_mode/README.md index 81904cf1..a85407e4 100644 --- a/qemu_mode/README.md +++ b/qemu_mode/README.md @@ -101,7 +101,7 @@ AFL_COMPCOV_LEVEL=1 is to instrument comparisons with only immediate values / read-only memory. AFL_COMPCOV_LEVEL=2 instruments all comparison instructions and memory comparison functions when libcompcov is preloaded. Comparison instructions are currently instrumented only -on the x86 and x86_64 targets. +on the x86, x86_64 and ARM targets. Highly recommended. -- cgit 1.4.1 From c83e8e1e6255374b085292ba8673efdca7388d76 Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Sat, 19 Oct 2019 18:23:01 +0200 Subject: Remove lcamtuf's old email from Google (not valid anymore), also remove maintainance from him. --- Makefile | 2 +- afl-cmin | 4 ++-- afl-plot | 4 ++-- afl-whatsup | 4 ++-- dictionaries/gif.dict | 2 +- dictionaries/html_tags.dict | 2 +- dictionaries/jpeg.dict | 2 +- dictionaries/js.dict | 2 +- dictionaries/png.dict | 2 +- dictionaries/sql.dict | 2 +- dictionaries/tiff.dict | 2 +- dictionaries/webp.dict | 2 +- dictionaries/xml.dict | 2 +- docs/power_schedules.txt | 2 +- experimental/argv_fuzzing/argv-fuzz-inl.h | 2 +- experimental/asan_cgroups/limit_memory.sh | 2 +- experimental/canvas_harness/canvas_harness.html | 2 +- experimental/clang_asm_normalize/as | 2 +- experimental/crash_triage/triage_crashes.sh | 4 ++-- experimental/distributed_fuzzing/sync_script.sh | 2 +- experimental/persistent_demo/persistent_demo.c | 2 +- experimental/post_library/post_library.so.c | 2 +- experimental/post_library/post_library_png.so.c | 2 +- gcc_plugin/Makefile | 2 +- gcc_plugin/afl-gcc-fast.c | 2 +- gcc_plugin/afl-gcc-rt.o.c | 2 +- include/afl-as.h | 2 +- include/afl-fuzz.h | 2 +- include/alloc-inl.h | 2 +- include/android-ashmem.h | 2 +- include/common.h | 2 +- include/config.h | 2 +- include/debug.h | 2 +- include/forkserver.h | 2 +- include/hash.h | 2 +- include/sharedmem.h | 2 +- include/types.h | 2 +- libdislocator/Makefile | 2 +- libdislocator/libdislocator.so.c | 2 +- libtokencap/Makefile | 2 +- libtokencap/libtokencap.so.c | 2 +- llvm_mode/Makefile | 2 +- llvm_mode/afl-clang-fast.c | 2 +- llvm_mode/afl-llvm-pass.so.cc | 2 +- llvm_mode/afl-llvm-rt.o.c | 2 +- qemu_mode/build_qemu_support.sh | 2 +- qemu_mode/patches/afl-qemu-common.h | 2 +- qemu_mode/patches/afl-qemu-cpu-inl.h | 2 +- qemu_mode/patches/afl-qemu-cpu-translate-inl.h | 2 +- qemu_mode/patches/afl-qemu-tcg-inl.h | 2 +- qemu_mode/patches/afl-qemu-translate-inl.h | 2 +- src/afl-analyze.c | 4 ++-- src/afl-as.c | 4 ++-- src/afl-common.c | 2 +- src/afl-forkserver.c | 2 +- src/afl-fuzz-bitmap.c | 2 +- src/afl-fuzz-extras.c | 2 +- src/afl-fuzz-globals.c | 2 +- src/afl-fuzz-init.c | 2 +- src/afl-fuzz-misc.c | 2 +- src/afl-fuzz-one.c | 2 +- src/afl-fuzz-python.c | 2 +- src/afl-fuzz-queue.c | 2 +- src/afl-fuzz-run.c | 2 +- src/afl-fuzz-stats.c | 2 +- src/afl-fuzz.c | 4 ++-- src/afl-gcc.c | 6 +++--- src/afl-gotcpu.c | 8 ++++---- src/afl-sharedmem.c | 2 +- src/afl-showmap.c | 4 ++-- src/afl-tmin.c | 4 ++-- test-instr.c | 2 +- unicorn_mode/build_unicorn_support.sh | 2 +- unicorn_mode/patches/afl-unicorn-common.h | 2 +- unicorn_mode/patches/afl-unicorn-cpu-inl.h | 2 +- unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h | 2 +- unicorn_mode/patches/afl-unicorn-tcg-op-inl.h | 2 +- unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h | 2 +- 78 files changed, 92 insertions(+), 92 deletions(-) (limited to 'qemu_mode') diff --git a/Makefile b/Makefile index ce0d6781..cfcd0890 100644 --- a/Makefile +++ b/Makefile @@ -2,7 +2,7 @@ # american fuzzy lop - makefile # ----------------------------- # -# Written and maintained by Michal Zalewski +# Written by Michal Zalewski # # Copyright 2013, 2014, 2015, 2016, 2017 Google Inc. All rights reserved. # diff --git a/afl-cmin b/afl-cmin index 88635550..e4e0fd85 100755 --- a/afl-cmin +++ b/afl-cmin @@ -3,7 +3,7 @@ # american fuzzy lop - corpus minimization tool # --------------------------------------------- # -# Written and maintained by Michal Zalewski +# Written by Michal Zalewski # # Copyright 2014, 2015 Google Inc. All rights reserved. # @@ -36,7 +36,7 @@ # array sizes. # -echo "corpus minimization tool for afl-fuzz by " +echo "corpus minimization tool for afl-fuzz by Michal Zalewski" echo ######### diff --git a/afl-plot b/afl-plot index bc86fb85..b6108a09 100755 --- a/afl-plot +++ b/afl-plot @@ -3,7 +3,7 @@ # american fuzzy lop - Advanced Persistent Graphing # ------------------------------------------------- # -# Written and maintained by Michal Zalewski +# Written by Michal Zalewski # Based on a design & prototype by Michael Rash. # # Copyright 2014, 2015 Google Inc. All rights reserved. @@ -15,7 +15,7 @@ # http://www.apache.org/licenses/LICENSE-2.0 # -echo "progress plotting utility for afl-fuzz by " +echo "progress plotting utility for afl-fuzz by Michal Zalewski" echo if [ ! "$#" = "2" ]; then diff --git a/afl-whatsup b/afl-whatsup index 505f7eba..2666d208 100755 --- a/afl-whatsup +++ b/afl-whatsup @@ -3,7 +3,7 @@ # american fuzzy lop - status check tool # -------------------------------------- # -# Written and maintained by Michal Zalewski +# Written by Michal Zalewski # # Copyright 2015 Google Inc. All rights reserved. # @@ -17,7 +17,7 @@ # instances of afl-fuzz. # -echo "status check tool for afl-fuzz by " +echo "status check tool for afl-fuzz by Michal Zalewski" echo test "$1" = "-h" && { echo $0 diff --git a/dictionaries/gif.dict b/dictionaries/gif.dict index 71148937..441b3b8d 100644 --- a/dictionaries/gif.dict +++ b/dictionaries/gif.dict @@ -2,7 +2,7 @@ # AFL dictionary for GIF images # ----------------------------- # -# Created by Michal Zalewski +# Created by Michal Zalewski # header_87a="87a" diff --git a/dictionaries/html_tags.dict b/dictionaries/html_tags.dict index ba946df3..2805de90 100644 --- a/dictionaries/html_tags.dict +++ b/dictionaries/html_tags.dict @@ -5,7 +5,7 @@ # A basic collection of HTML tags likely to matter to HTML parsers. Does *not* # include any attributes or attribute values. # -# Created by Michal Zalewski +# Created by Michal Zalewski # tag_a="" diff --git a/dictionaries/jpeg.dict b/dictionaries/jpeg.dict index 15efede7..40282f1a 100644 --- a/dictionaries/jpeg.dict +++ b/dictionaries/jpeg.dict @@ -2,7 +2,7 @@ # AFL dictionary for JPEG images # ------------------------------ # -# Created by Michal Zalewski +# Created by Michal Zalewski # header_jfif="JFIF\x00" diff --git a/dictionaries/js.dict b/dictionaries/js.dict index 9db37bfe..7926364c 100644 --- a/dictionaries/js.dict +++ b/dictionaries/js.dict @@ -4,7 +4,7 @@ # # Contains basic reserved keywords and syntax building blocks. # -# Created by Michal Zalewski +# Created by Michal Zalewski # keyword_arguments="arguments" diff --git a/dictionaries/png.dict b/dictionaries/png.dict index ea12d19e..ad9ea328 100644 --- a/dictionaries/png.dict +++ b/dictionaries/png.dict @@ -5,7 +5,7 @@ # Just the basic, standard-originating sections; does not include vendor # extensions. # -# Created by Michal Zalewski +# Created by Michal Zalewski # header_png="\x89PNG\x0d\x0a\x1a\x0a" diff --git a/dictionaries/sql.dict b/dictionaries/sql.dict index 58342473..efa44ba8 100644 --- a/dictionaries/sql.dict +++ b/dictionaries/sql.dict @@ -11,7 +11,7 @@ # standpoint, because they are usually not allowed in non-privileged # contexts). # -# Created by Michal Zalewski +# Created by Michal Zalewski # function_abs=" abs(1)" diff --git a/dictionaries/tiff.dict b/dictionaries/tiff.dict index 8f04b5af..720e56ce 100644 --- a/dictionaries/tiff.dict +++ b/dictionaries/tiff.dict @@ -5,7 +5,7 @@ # Just the basic, standard-originating sections; does not include vendor # extensions. # -# Created by Michal Zalewski +# Created by Michal Zalewski # header_ii="II*\x00" diff --git a/dictionaries/webp.dict b/dictionaries/webp.dict index 8a70e73b..53aa28c7 100644 --- a/dictionaries/webp.dict +++ b/dictionaries/webp.dict @@ -2,7 +2,7 @@ # AFL dictionary for WebP images # ------------------------------ # -# Created by Michal Zalewski +# Created by Michal Zalewski # header_RIFF="RIFF" diff --git a/dictionaries/xml.dict b/dictionaries/xml.dict index 8127aa28..d8375452 100644 --- a/dictionaries/xml.dict +++ b/dictionaries/xml.dict @@ -4,7 +4,7 @@ # # Several basic syntax elements and attributes, modeled on libxml2. # -# Created by Michal Zalewski +# Created by Michal Zalewski # attr_encoding=" encoding=\"1\"" diff --git a/docs/power_schedules.txt b/docs/power_schedules.txt index f5f66bd6..7b9d34c4 100644 --- a/docs/power_schedules.txt +++ b/docs/power_schedules.txt @@ -2,7 +2,7 @@ afl++'s power schedules based on AFLfast Power schedules implemented by Marcel Böhme \. -AFLFast is an extension of AFL which was written by Michal Zalewski \. +AFLFast is an extension of AFL which was written by Michal Zalewski. AFLfast has helped in the success of Team Codejitsu at the finals of the DARPA Cyber Grand Challenge where their bot Galactica took **2nd place** in terms of #POVs proven (see red bar at https://www.cybergrandchallenge.com/event#results). AFLFast exposed several previously unreported CVEs that could not be exposed by AFL in 24 hours and otherwise exposed vulnerabilities significantly faster than AFL while generating orders of magnitude more unique crashes. diff --git a/experimental/argv_fuzzing/argv-fuzz-inl.h b/experimental/argv_fuzzing/argv-fuzz-inl.h index b042d38c..5d411046 100644 --- a/experimental/argv_fuzzing/argv-fuzz-inl.h +++ b/experimental/argv_fuzzing/argv-fuzz-inl.h @@ -2,7 +2,7 @@ american fuzzy lop - sample argv fuzzing wrapper ------------------------------------------------ - Written by Michal Zalewski + Written by Michal Zalewski Copyright 2015 Google Inc. All rights reserved. diff --git a/experimental/asan_cgroups/limit_memory.sh b/experimental/asan_cgroups/limit_memory.sh index b0c77d15..97950410 100755 --- a/experimental/asan_cgroups/limit_memory.sh +++ b/experimental/asan_cgroups/limit_memory.sh @@ -7,7 +7,7 @@ # David A. Wheeler # # Edits to bring the script in line with afl-cmin and other companion scripts -# by Michal Zalewski . All bugs are my fault. +# by Michal Zalewski. All bugs are my fault. # # Copyright 2015 Institute for Defense Analyses. # diff --git a/experimental/canvas_harness/canvas_harness.html b/experimental/canvas_harness/canvas_harness.html index 19293667..7b31d8b4 100644 --- a/experimental/canvas_harness/canvas_harness.html +++ b/experimental/canvas_harness/canvas_harness.html @@ -4,7 +4,7 @@ american fuzzy lop - harness ------------------------------------- - Written and maintained by Michal Zalewski + Written by Michal Zalewski Copyright 2013, 2014 Google Inc. All rights reserved. diff --git a/experimental/clang_asm_normalize/as b/experimental/clang_asm_normalize/as index 4ee07e69..bd83c4ff 100755 --- a/experimental/clang_asm_normalize/as +++ b/experimental/clang_asm_normalize/as @@ -3,7 +3,7 @@ # american fuzzy lop - clang assembly normalizer # ---------------------------------------------- # -# Written and maintained by Michal Zalewski +# Written by Michal Zalewski # The idea for this wrapper comes from Ryan Govostes. # # Copyright 2013, 2014 Google Inc. All rights reserved. diff --git a/experimental/crash_triage/triage_crashes.sh b/experimental/crash_triage/triage_crashes.sh index 5894a4d6..205bc143 100755 --- a/experimental/crash_triage/triage_crashes.sh +++ b/experimental/crash_triage/triage_crashes.sh @@ -3,7 +3,7 @@ # american fuzzy lop - crash triage utility # ----------------------------------------- # -# Written and maintained by Michal Zalewski +# Written by Michal Zalewski # # Copyright 2013, 2014, 2017 Google Inc. All rights reserved. # @@ -22,7 +22,7 @@ # necessary. # -echo "crash triage utility for afl-fuzz by " +echo "crash triage utility for afl-fuzz by Michal Zalewski" echo ulimit -v 100000 2>/dev/null diff --git a/experimental/distributed_fuzzing/sync_script.sh b/experimental/distributed_fuzzing/sync_script.sh index 2d5e0635..31b0e436 100755 --- a/experimental/distributed_fuzzing/sync_script.sh +++ b/experimental/distributed_fuzzing/sync_script.sh @@ -3,7 +3,7 @@ # american fuzzy lop - fuzzer synchronization tool # ------------------------------------------------ # -# Written and maintained by Michal Zalewski +# Written by Michal Zalewski # # Copyright 2014 Google Inc. All rights reserved. # diff --git a/experimental/persistent_demo/persistent_demo.c b/experimental/persistent_demo/persistent_demo.c index d091febe..a94c8374 100644 --- a/experimental/persistent_demo/persistent_demo.c +++ b/experimental/persistent_demo/persistent_demo.c @@ -2,7 +2,7 @@ american fuzzy lop - persistent mode example -------------------------------------------- - Written and maintained by Michal Zalewski + Written by Michal Zalewski Copyright 2015 Google Inc. All rights reserved. diff --git a/experimental/post_library/post_library.so.c b/experimental/post_library/post_library.so.c index 72620ff0..048eea70 100644 --- a/experimental/post_library/post_library.so.c +++ b/experimental/post_library/post_library.so.c @@ -2,7 +2,7 @@ american fuzzy lop - postprocessor library example -------------------------------------------------- - Written and maintained by Michal Zalewski + Written by Michal Zalewski Copyright 2015 Google Inc. All rights reserved. diff --git a/experimental/post_library/post_library_png.so.c b/experimental/post_library/post_library_png.so.c index 080a6938..6ba95c1a 100644 --- a/experimental/post_library/post_library_png.so.c +++ b/experimental/post_library/post_library_png.so.c @@ -2,7 +2,7 @@ american fuzzy lop - postprocessor for PNG ------------------------------------------ - Written and maintained by Michal Zalewski + Written by Michal Zalewski Copyright 2015 Google Inc. All rights reserved. diff --git a/gcc_plugin/Makefile b/gcc_plugin/Makefile index d10eba49..a603df78 100644 --- a/gcc_plugin/Makefile +++ b/gcc_plugin/Makefile @@ -4,7 +4,7 @@ # # Written by Austin Seipp and # Laszlo Szekeres and -# Michal Zalewski and +# Michal Zalewski and # Heiko Eißfeldt # # GCC integration design is based on the LLVM design, which comes diff --git a/gcc_plugin/afl-gcc-fast.c b/gcc_plugin/afl-gcc-fast.c index 73709321..b0461584 100644 --- a/gcc_plugin/afl-gcc-fast.c +++ b/gcc_plugin/afl-gcc-fast.c @@ -4,7 +4,7 @@ Written by Austin Seipp and Laszlo Szekeres and - Michal Zalewski + Michal Zalewski GCC integration design is based on the LLVM design, which comes from Laszlo Szekeres. diff --git a/gcc_plugin/afl-gcc-rt.o.c b/gcc_plugin/afl-gcc-rt.o.c index f6754bd4..dd79a0ec 100644 --- a/gcc_plugin/afl-gcc-rt.o.c +++ b/gcc_plugin/afl-gcc-rt.o.c @@ -4,7 +4,7 @@ Written by Austin Seipp and Laszlo Szekeres and - Michal Zalewski + Michal Zalewski GCC integration design is based on the LLVM design, which comes from Laszlo Szekeres. diff --git a/include/afl-as.h b/include/afl-as.h index 048866db..f0263312 100644 --- a/include/afl-as.h +++ b/include/afl-as.h @@ -2,7 +2,7 @@ american fuzzy lop++ - injectable parts --------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index 7e9ced46..1e6140dd 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -2,7 +2,7 @@ american fuzzy lop++ - fuzzer header ------------------------------------ - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/include/alloc-inl.h b/include/alloc-inl.h index b0815ab1..f5bb7246 100644 --- a/include/alloc-inl.h +++ b/include/alloc-inl.h @@ -2,7 +2,7 @@ american fuzzy lop++ - error-checking, memory-zeroing alloc routines -------------------------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/include/android-ashmem.h b/include/android-ashmem.h index 6c7a98db..f4d31739 100644 --- a/include/android-ashmem.h +++ b/include/android-ashmem.h @@ -2,7 +2,7 @@ american fuzzy lop++ - android shared memory compatibility layer ---------------------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/include/common.h b/include/common.h index e13bf0a0..7c3d4517 100644 --- a/include/common.h +++ b/include/common.h @@ -2,7 +2,7 @@ american fuzzy lop++ - common routines header --------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/include/config.h b/include/config.h index 396224fb..2e993a42 100644 --- a/include/config.h +++ b/include/config.h @@ -2,7 +2,7 @@ american fuzzy lop++ - vaguely configurable bits ------------------------------------------------ - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/include/debug.h b/include/debug.h index cccfc284..ed6c29e9 100644 --- a/include/debug.h +++ b/include/debug.h @@ -2,7 +2,7 @@ american fuzzy lop++ - debug / error handling macros ---------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/include/forkserver.h b/include/forkserver.h index 9a099888..9cabe58e 100644 --- a/include/forkserver.h +++ b/include/forkserver.h @@ -2,7 +2,7 @@ american fuzzy lop++ - forkserver header ---------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Forkserver design by Jann Horn diff --git a/include/hash.h b/include/hash.h index 7085df32..1a8ac252 100644 --- a/include/hash.h +++ b/include/hash.h @@ -12,7 +12,7 @@ Austin's original code is public domain. - Other code written and maintained by Michal Zalewski + Other code written by Michal Zalewski Copyright 2016 Google Inc. All rights reserved. diff --git a/include/sharedmem.h b/include/sharedmem.h index 18e4ee9f..cec6c025 100644 --- a/include/sharedmem.h +++ b/include/sharedmem.h @@ -2,7 +2,7 @@ american fuzzy lop++ - shared memory related header --------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Forkserver design by Jann Horn diff --git a/include/types.h b/include/types.h index 07fc7e91..c34bf522 100644 --- a/include/types.h +++ b/include/types.h @@ -2,7 +2,7 @@ american fuzzy lop++ - type definitions and minor macros -------------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/libdislocator/Makefile b/libdislocator/Makefile index cbaa05ea..91efba07 100644 --- a/libdislocator/Makefile +++ b/libdislocator/Makefile @@ -2,7 +2,7 @@ # american fuzzy lop - libdislocator # ---------------------------------- # -# Written by Michal Zalewski +# Written by Michal Zalewski # # Copyright 2016 Google Inc. All rights reserved. # diff --git a/libdislocator/libdislocator.so.c b/libdislocator/libdislocator.so.c index 8834a1fc..57607210 100644 --- a/libdislocator/libdislocator.so.c +++ b/libdislocator/libdislocator.so.c @@ -3,7 +3,7 @@ american fuzzy lop - dislocator, an abusive allocator ----------------------------------------------------- - Written and maintained by Michal Zalewski + Written by Michal Zalewski Copyright 2016 Google Inc. All rights reserved. diff --git a/libtokencap/Makefile b/libtokencap/Makefile index 3fd01b2c..91933140 100644 --- a/libtokencap/Makefile +++ b/libtokencap/Makefile @@ -2,7 +2,7 @@ # american fuzzy lop - libtokencap # -------------------------------- # -# Written by Michal Zalewski +# Written by Michal Zalewski # # Copyright 2016 Google Inc. All rights reserved. # diff --git a/libtokencap/libtokencap.so.c b/libtokencap/libtokencap.so.c index 17b6190c..39095beb 100644 --- a/libtokencap/libtokencap.so.c +++ b/libtokencap/libtokencap.so.c @@ -3,7 +3,7 @@ american fuzzy lop - extract tokens passed to strcmp / memcmp ------------------------------------------------------------- - Written and maintained by Michal Zalewski + Written by Michal Zalewski Copyright 2016 Google Inc. All rights reserved. diff --git a/llvm_mode/Makefile b/llvm_mode/Makefile index 0360bfbe..7cfbe92d 100644 --- a/llvm_mode/Makefile +++ b/llvm_mode/Makefile @@ -3,7 +3,7 @@ # ----------------------------------------- # # Written by Laszlo Szekeres and -# Michal Zalewski +# Michal Zalewski # # LLVM integration design comes from Laszlo Szekeres. # diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c index 54f9e6e9..a7f6acdc 100644 --- a/llvm_mode/afl-clang-fast.c +++ b/llvm_mode/afl-clang-fast.c @@ -3,7 +3,7 @@ ------------------------------------------------ Written by Laszlo Szekeres and - Michal Zalewski + Michal Zalewski LLVM integration design comes from Laszlo Szekeres. diff --git a/llvm_mode/afl-llvm-pass.so.cc b/llvm_mode/afl-llvm-pass.so.cc index 3ca5ccc4..475a3f33 100644 --- a/llvm_mode/afl-llvm-pass.so.cc +++ b/llvm_mode/afl-llvm-pass.so.cc @@ -3,7 +3,7 @@ --------------------------------------------------- Written by Laszlo Szekeres and - Michal Zalewski + Michal Zalewski LLVM integration design comes from Laszlo Szekeres. C bits copied-and-pasted from afl-as.c are Michal's fault. diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c index 20b34336..5740fe42 100644 --- a/llvm_mode/afl-llvm-rt.o.c +++ b/llvm_mode/afl-llvm-rt.o.c @@ -3,7 +3,7 @@ --------------------------------------------------- Written by Laszlo Szekeres and - Michal Zalewski + Michal Zalewski LLVM integration design comes from Laszlo Szekeres. diff --git a/qemu_mode/build_qemu_support.sh b/qemu_mode/build_qemu_support.sh index 55d72e0d..f18cbdf3 100755 --- a/qemu_mode/build_qemu_support.sh +++ b/qemu_mode/build_qemu_support.sh @@ -4,7 +4,7 @@ # -------------------------------------- # # Originally written by Andrew Griffiths and -# Michal Zalewski +# Michal Zalewski # # TCG instrumentation and block chaining support by Andrea Biondo # diff --git a/qemu_mode/patches/afl-qemu-common.h b/qemu_mode/patches/afl-qemu-common.h index c86b5b45..1da3359d 100644 --- a/qemu_mode/patches/afl-qemu-common.h +++ b/qemu_mode/patches/afl-qemu-common.h @@ -3,7 +3,7 @@ ------------------------------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski TCG instrumentation and block chaining support by Andrea Biondo diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h index 262a7dab..7358fc3b 100644 --- a/qemu_mode/patches/afl-qemu-cpu-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-inl.h @@ -3,7 +3,7 @@ ------------------------------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski TCG instrumentation and block chaining support by Andrea Biondo diff --git a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h index b6d3da1f..62858724 100644 --- a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h @@ -3,7 +3,7 @@ ------------------------------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski TCG instrumentation and block chaining support by Andrea Biondo diff --git a/qemu_mode/patches/afl-qemu-tcg-inl.h b/qemu_mode/patches/afl-qemu-tcg-inl.h index d7a25695..e3de09d8 100644 --- a/qemu_mode/patches/afl-qemu-tcg-inl.h +++ b/qemu_mode/patches/afl-qemu-tcg-inl.h @@ -3,7 +3,7 @@ ------------------------------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski TCG instrumentation and block chaining support by Andrea Biondo diff --git a/qemu_mode/patches/afl-qemu-translate-inl.h b/qemu_mode/patches/afl-qemu-translate-inl.h index 5f61d7c9..881dbc8d 100644 --- a/qemu_mode/patches/afl-qemu-translate-inl.h +++ b/qemu_mode/patches/afl-qemu-translate-inl.h @@ -3,7 +3,7 @@ ------------------------------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski TCG instrumentation and block chaining support by Andrea Biondo diff --git a/src/afl-analyze.c b/src/afl-analyze.c index 2d13621b..5555a262 100644 --- a/src/afl-analyze.c +++ b/src/afl-analyze.c @@ -2,7 +2,7 @@ american fuzzy lop++ - file format analyzer ------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and @@ -841,7 +841,7 @@ int main(int argc, char** argv) { doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH; - SAYF(cCYA "afl-analyze" VERSION cRST " by \n"); + SAYF(cCYA "afl-analyze" VERSION cRST " by Michal Zalewski\n"); while ((opt = getopt(argc, argv, "+i:f:m:t:eQUWh")) > 0) diff --git a/src/afl-as.c b/src/afl-as.c index b5a5ed58..2b023432 100644 --- a/src/afl-as.c +++ b/src/afl-as.c @@ -2,7 +2,7 @@ american fuzzy lop++ - wrapper for GNU as ----------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and @@ -501,7 +501,7 @@ int main(int argc, char** argv) { if (isatty(2) && !getenv("AFL_QUIET")) { - SAYF(cCYA "afl-as" VERSION cRST " by \n"); + SAYF(cCYA "afl-as" VERSION cRST " by Michal Zalewski\n"); } else diff --git a/src/afl-common.c b/src/afl-common.c index e753e797..ec010c2d 100644 --- a/src/afl-common.c +++ b/src/afl-common.c @@ -2,7 +2,7 @@ american fuzzy lop++ - common routines -------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c index d9f67da5..b11ee5ce 100644 --- a/src/afl-forkserver.c +++ b/src/afl-forkserver.c @@ -2,7 +2,7 @@ american fuzzy lop++ - forkserver code -------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Forkserver design by Jann Horn diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c index d001dbee..22876626 100644 --- a/src/afl-fuzz-bitmap.c +++ b/src/afl-fuzz-bitmap.c @@ -2,7 +2,7 @@ american fuzzy lop++ - bitmap related routines ---------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-extras.c b/src/afl-fuzz-extras.c index 1a0e2eff..23b2c235 100644 --- a/src/afl-fuzz-extras.c +++ b/src/afl-fuzz-extras.c @@ -2,7 +2,7 @@ american fuzzy lop++ - extras relates routines ---------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-globals.c b/src/afl-fuzz-globals.c index 8340394a..36ba6e14 100644 --- a/src/afl-fuzz-globals.c +++ b/src/afl-fuzz-globals.c @@ -2,7 +2,7 @@ american fuzzy lop++ - globals declarations ------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c index a37ce8ba..a77904b5 100644 --- a/src/afl-fuzz-init.c +++ b/src/afl-fuzz-init.c @@ -2,7 +2,7 @@ american fuzzy lop++ - initialization related routines ------------------------------------------------------ - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-misc.c b/src/afl-fuzz-misc.c index a7372b7d..f45642f4 100644 --- a/src/afl-fuzz-misc.c +++ b/src/afl-fuzz-misc.c @@ -2,7 +2,7 @@ american fuzzy lop++ - misc stuffs from Mordor ---------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c index 31d58a10..bed8d254 100644 --- a/src/afl-fuzz-one.c +++ b/src/afl-fuzz-one.c @@ -2,7 +2,7 @@ american fuzzy lop++ - fuzze_one routines in different flavours --------------------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-python.c b/src/afl-fuzz-python.c index 1a28f603..1a8b7f9d 100644 --- a/src/afl-fuzz-python.c +++ b/src/afl-fuzz-python.c @@ -2,7 +2,7 @@ american fuzzy lop++ - python extension routines ------------------------------------------------ - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c index 905fd931..9f036186 100644 --- a/src/afl-fuzz-queue.c +++ b/src/afl-fuzz-queue.c @@ -2,7 +2,7 @@ american fuzzy lop++ - queue relates routines --------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c index 5211921f..e12b06eb 100644 --- a/src/afl-fuzz-run.c +++ b/src/afl-fuzz-run.c @@ -2,7 +2,7 @@ american fuzzy lop++ - target execution related routines -------------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index 7e8639f2..2ea03e94 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -2,7 +2,7 @@ american fuzzy lop++ - stats related routines --------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 44037ce8..bb342112 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -2,7 +2,7 @@ american fuzzy lop - fuzzer code -------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and @@ -127,7 +127,7 @@ int main(int argc, char** argv) { SAYF(cCYA "afl-fuzz" VERSION cRST - " based on afl by and a big online community\n"); + " based on afl by Michal Zalewski and a big online community\n"); doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH; diff --git a/src/afl-gcc.c b/src/afl-gcc.c index dd7ba4d6..740442dc 100644 --- a/src/afl-gcc.c +++ b/src/afl-gcc.c @@ -2,7 +2,7 @@ american fuzzy lop++ - wrapper for GCC and clang ------------------------------------------------ - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and @@ -335,7 +335,7 @@ int main(int argc, char** argv) { if (argc == 2 && strcmp(argv[1], "-h") == 0) { - printf("afl-cc" VERSION " by \n\n"); + printf("afl-cc" VERSION " by Michal Zalewski\n\n"); printf("%s \n\n", argv[0]); printf("afl-gcc has no command line options\n"); printf( @@ -347,7 +347,7 @@ int main(int argc, char** argv) { if (isatty(2) && !getenv("AFL_QUIET")) { - SAYF(cCYA "afl-cc" VERSION cRST " by \n"); + SAYF(cCYA "afl-cc" VERSION cRST " by Michal Zalewski\n"); SAYF(cYEL "[!] " cBRI "NOTE: " cRST "afl-gcc is deprecated, llvm_mode is much faster and has more " "options\n"); diff --git a/src/afl-gotcpu.c b/src/afl-gotcpu.c index dc938b65..850943dd 100644 --- a/src/afl-gotcpu.c +++ b/src/afl-gotcpu.c @@ -2,7 +2,7 @@ american fuzzy lop - free CPU gizmo ----------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and @@ -142,7 +142,7 @@ int main(int argc, char** argv) { if (argc > 1) { - printf("afl-gotcpu" VERSION " by \n"); + printf("afl-gotcpu" VERSION " by Michal Zalewski\n"); printf("\n%s \n\n", argv[0]); printf("afl-gotcpu does not have command line options\n"); printf("afl-gotcpu prints out which CPUs are available\n"); @@ -154,7 +154,7 @@ int main(int argc, char** argv) { u32 cpu_cnt = sysconf(_SC_NPROCESSORS_ONLN), idle_cpus = 0, maybe_cpus = 0, i; - SAYF(cCYA "afl-gotcpu" VERSION cRST " by \n"); + SAYF(cCYA "afl-gotcpu" VERSION cRST " by Michal Zalewski\n"); ACTF("Measuring per-core preemption rate (this will take %0.02f sec)...", ((double)CTEST_CORE_TRG_MS) / 1000); @@ -275,7 +275,7 @@ int main(int argc, char** argv) { u32 util_perc; - SAYF(cCYA "afl-gotcpu" VERSION cRST " by \n"); + SAYF(cCYA "afl-gotcpu" VERSION cRST " by Michal Zalewski\n"); /* Run a busy loop for CTEST_TARGET_MS. */ diff --git a/src/afl-sharedmem.c b/src/afl-sharedmem.c index 0bd1ff2f..d94100a3 100644 --- a/src/afl-sharedmem.c +++ b/src/afl-sharedmem.c @@ -2,7 +2,7 @@ american fuzzy lop++ - shared memory related code ------------------------------------------------- - Originally written by Michal Zalewski + Originally written by Michal Zalewski Forkserver design by Jann Horn diff --git a/src/afl-showmap.c b/src/afl-showmap.c index 31f12856..b54ac2b0 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -2,7 +2,7 @@ american fuzzy lop++ - map display utility ------------------------------------------ - Originally written by Michal Zalewski + Originally written by Michal Zalewski Forkserver design by Jann Horn @@ -395,7 +395,7 @@ static void setup_signal_handlers(void) { static void show_banner(void) { - SAYF(cCYA "afl-showmap" VERSION cRST " by \n"); + SAYF(cCYA "afl-showmap" VERSION cRST " by Michal Zalewski\n"); } diff --git a/src/afl-tmin.c b/src/afl-tmin.c index 7f354727..a72e1dda 100644 --- a/src/afl-tmin.c +++ b/src/afl-tmin.c @@ -2,7 +2,7 @@ american fuzzy lop++ - test case minimizer ------------------------------------------ - Originally written by Michal Zalewski + Originally written by Michal Zalewski Forkserver design by Jann Horn @@ -1032,7 +1032,7 @@ int main(int argc, char** argv) { doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH; - SAYF(cCYA "afl-tmin" VERSION cRST " by \n"); + SAYF(cCYA "afl-tmin" VERSION cRST " by Michal Zalewski\n"); while ((opt = getopt(argc, argv, "+i:o:f:m:t:B:xeQUWh")) > 0) diff --git a/test-instr.c b/test-instr.c index 2450dbf4..161bdb8e 100644 --- a/test-instr.c +++ b/test-instr.c @@ -2,7 +2,7 @@ american fuzzy lop - a trivial program to test the build -------------------------------------------------------- - Written and maintained by Michal Zalewski + Written by Michal Zalewski Copyright 2014 Google Inc. All rights reserved. diff --git a/unicorn_mode/build_unicorn_support.sh b/unicorn_mode/build_unicorn_support.sh index 1575f66c..3bd404b8 100755 --- a/unicorn_mode/build_unicorn_support.sh +++ b/unicorn_mode/build_unicorn_support.sh @@ -6,7 +6,7 @@ # Originally written by Nathan Voss # # Adapted from code by Andrew Griffiths and -# Michal Zalewski +# Michal Zalewski # # Adapted for AFLplusplus by Dominik Maier # diff --git a/unicorn_mode/patches/afl-unicorn-common.h b/unicorn_mode/patches/afl-unicorn-common.h index fd88e21b..66d03803 100644 --- a/unicorn_mode/patches/afl-unicorn-common.h +++ b/unicorn_mode/patches/afl-unicorn-common.h @@ -3,7 +3,7 @@ ---------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski Adapted for afl-unicorn by Dominik Maier diff --git a/unicorn_mode/patches/afl-unicorn-cpu-inl.h b/unicorn_mode/patches/afl-unicorn-cpu-inl.h index 082d6d68..72092e29 100644 --- a/unicorn_mode/patches/afl-unicorn-cpu-inl.h +++ b/unicorn_mode/patches/afl-unicorn-cpu-inl.h @@ -3,7 +3,7 @@ ---------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski Adapted for afl-unicorn by Dominik Maier diff --git a/unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h b/unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h index 7c84058f..70472a72 100644 --- a/unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h +++ b/unicorn_mode/patches/afl-unicorn-cpu-translate-inl.h @@ -3,7 +3,7 @@ ---------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski Adapted for afl-unicorn by Dominik Maier diff --git a/unicorn_mode/patches/afl-unicorn-tcg-op-inl.h b/unicorn_mode/patches/afl-unicorn-tcg-op-inl.h index d21bbcc7..8f4a8748 100644 --- a/unicorn_mode/patches/afl-unicorn-tcg-op-inl.h +++ b/unicorn_mode/patches/afl-unicorn-tcg-op-inl.h @@ -3,7 +3,7 @@ ---------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski Adapted for afl-unicorn by Dominik Maier diff --git a/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h b/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h index 3031d3a6..53ab654c 100644 --- a/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h +++ b/unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h @@ -3,7 +3,7 @@ ---------------------------------------------- Originally written by Andrew Griffiths and - Michal Zalewski + Michal Zalewski Adapted for afl-unicorn by Dominik Maier -- cgit 1.4.1 From 297e9e3cf59540f16b8260a01ef7c6cd01d9e554 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Wed, 23 Oct 2019 19:48:18 +0200 Subject: move is_valid_addr in afl-qemu-common.h --- qemu_mode/patches/afl-qemu-common.h | 18 ++++++++++++++++++ qemu_mode/patches/afl-qemu-cpu-inl.h | 18 ------------------ 2 files changed, 18 insertions(+), 18 deletions(-) (limited to 'qemu_mode') diff --git a/qemu_mode/patches/afl-qemu-common.h b/qemu_mode/patches/afl-qemu-common.h index 1da3359d..409a7eab 100644 --- a/qemu_mode/patches/afl-qemu-common.h +++ b/qemu_mode/patches/afl-qemu-common.h @@ -81,3 +81,21 @@ void tcg_gen_afl_compcov_log_call(void *func, target_ulong cur_loc, void tcg_gen_afl_maybe_log_call(target_ulong cur_loc); + +/* Check if an address is valid in the current mapping */ + +static inline int is_valid_addr(target_ulong addr) { + + int l, flags; + target_ulong page; + void * p; + + page = addr & TARGET_PAGE_MASK; + l = (page + TARGET_PAGE_SIZE) - addr; + + flags = page_get_flags(page); + if (!(flags & PAGE_VALID) || !(flags & PAGE_READ)) return 0; + + return 1; + +} diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h index 7358fc3b..f4c474d8 100644 --- a/qemu_mode/patches/afl-qemu-cpu-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-inl.h @@ -451,24 +451,6 @@ static void afl_request_tsl(target_ulong pc, target_ulong cb, uint32_t flags, } -/* Check if an address is valid in the current mapping */ - -static inline int is_valid_addr(target_ulong addr) { - - int l, flags; - target_ulong page; - void * p; - - page = addr & TARGET_PAGE_MASK; - l = (page + TARGET_PAGE_SIZE) - addr; - - flags = page_get_flags(page); - if (!(flags & PAGE_VALID) || !(flags & PAGE_READ)) return 0; - - return 1; - -} - /* This is the other side of the same channel. Since timeouts are handled by afl-fuzz simply killing the child, we can just wait until the pipe breaks. */ -- cgit 1.4.1 From 4ec4e5b394dfa4e40a26574e3053a9bd7eaa8d37 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Fri, 25 Oct 2019 20:04:16 +0200 Subject: floating point compcov --- qemu_mode/build_qemu_support.sh | 3 + qemu_mode/patches/afl-qemu-common.h | 12 ++ qemu_mode/patches/afl-qemu-floats.h | 217 +++++++++++++++++++++++++++++++++ qemu_mode/patches/i386-fpu_helper.diff | 54 ++++++++ qemu_mode/patches/i386-ops_sse.diff | 61 +++++++++ qemu_mode/patches/softfloat.diff | 10 ++ 6 files changed, 357 insertions(+) create mode 100644 qemu_mode/patches/afl-qemu-floats.h create mode 100644 qemu_mode/patches/i386-fpu_helper.diff create mode 100644 qemu_mode/patches/i386-ops_sse.diff create mode 100644 qemu_mode/patches/softfloat.diff (limited to 'qemu_mode') diff --git a/qemu_mode/build_qemu_support.sh b/qemu_mode/build_qemu_support.sh index f18cbdf3..6b9f91f9 100755 --- a/qemu_mode/build_qemu_support.sh +++ b/qemu_mode/build_qemu_support.sh @@ -150,6 +150,9 @@ patch -p1 <../patches/translate-all.diff || exit 1 patch -p1 <../patches/tcg.diff || exit 1 patch -p1 <../patches/i386-translate.diff || exit 1 patch -p1 <../patches/arm-translate.diff || exit 1 +patch -p1 <../patches/i386-ops_sse.diff || exit 1 +patch -p1 <../patches/i386-fpu_helper.diff || exit 1 +patch -p1 <../patches/softfloat.diff || exit 1 echo "[+] Patching done." diff --git a/qemu_mode/patches/afl-qemu-common.h b/qemu_mode/patches/afl-qemu-common.h index 409a7eab..d4024353 100644 --- a/qemu_mode/patches/afl-qemu-common.h +++ b/qemu_mode/patches/afl-qemu-common.h @@ -31,6 +31,9 @@ */ +#ifndef __AFL_QEMU_COMMON +#define __AFL_QEMU_COMMON + #include "../../config.h" #ifndef CPU_NB_REGS @@ -81,6 +84,12 @@ void tcg_gen_afl_compcov_log_call(void *func, target_ulong cur_loc, void tcg_gen_afl_maybe_log_call(target_ulong cur_loc); +void afl_float_compcov_log_32(target_ulong cur_loc, float32 arg1, float32 arg2, + void *status); +void afl_float_compcov_log_64(target_ulong cur_loc, float64 arg1, float64 arg2, + void *status); +void afl_float_compcov_log_80(target_ulong cur_loc, floatx80 arg1, + floatx80 arg2); /* Check if an address is valid in the current mapping */ @@ -99,3 +108,6 @@ static inline int is_valid_addr(target_ulong addr) { return 1; } + +#endif + diff --git a/qemu_mode/patches/afl-qemu-floats.h b/qemu_mode/patches/afl-qemu-floats.h new file mode 100644 index 00000000..765deb74 --- /dev/null +++ b/qemu_mode/patches/afl-qemu-floats.h @@ -0,0 +1,217 @@ +/* + american fuzzy lop++ - high-performance binary-only instrumentation + ------------------------------------------------------------------- + + Originally written by Andrew Griffiths and + Michal Zalewski + + TCG instrumentation and block chaining support by Andrea Biondo + + + QEMU 3.1.1 port, TCG thread-safety, CompareCoverage and NeverZero + counters by Andrea Fioraldi + + Copyright 2015, 2016, 2017 Google Inc. All rights reserved. + Copyright 2019 AFLplusplus Project. All rights reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at: + + http://www.apache.org/licenses/LICENSE-2.0 + + This code is a shim patched into the separately-distributed source + code of QEMU 3.1.0. It leverages the built-in QEMU tracing functionality + to implement AFL-style instrumentation and to take care of the remaining + parts of the AFL fork server logic. + + The resulting QEMU binary is essentially a standalone instrumentation + tool; for an example of how to leverage it for other purposes, you can + have a look at afl-showmap.c. + + */ + +#include "tcg.h" +#include "afl-qemu-common.h" + +union afl_float32 { + float64 f; + struct { + u64 sign : 1; + u64 exp : 7; + u64 frac : 24; + }; +}; + + +union afl_float64 { + float64 f; + struct { + u64 sign : 1; + u64 exp : 11; + u64 frac : 52; + }; +}; + + +// TODO 16 and 128 bits floats +// TODO figure out why float*_unpack_canonical does not work + +void afl_float_compcov_log_32(target_ulong cur_loc, float32 arg1, float32 arg2, + void* status) { + + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 7; + + if (cur_loc >= afl_inst_rms) return; + + //float_status* s = (float_status*)status; + //FloatParts a = float32_unpack_canonical(arg1, s); + //FloatParts b = float32_unpack_canonical(arg2, s); + union afl_float32 a = { .f = arg1 }; + union afl_float32 b = { .f = arg2 }; + + // if (is_nan(a.cls) || is_nan(b.cls)) return; + + register uintptr_t idx = cur_loc; + + if (a.sign != b.sign) return; + INC_AFL_AREA(idx); + if (a.exp != b.exp) return; + INC_AFL_AREA(idx + 1); + + if ((a.frac & 0xff0000) == (b.frac & 0xff0000)) { + + INC_AFL_AREA(idx + 2); + if ((a.frac & 0xff00) == (b.frac & 0xff00)) { INC_AFL_AREA(idx + 3); } + + } + +} + +void afl_float_compcov_log_64(target_ulong cur_loc, float64 arg1, float64 arg2, + void* status) { + + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 7; + + if (cur_loc >= afl_inst_rms) return; + + //float_status* s = (float_status*)status; + //FloatParts a = float64_unpack_canonical(arg1, s); + //FloatParts b = float64_unpack_canonical(arg2, s); + union afl_float64 a = { .f = arg1 }; + union afl_float64 b = { .f = arg2 }; + + // if (is_nan(a.cls) || is_nan(b.cls)) return; + + register uintptr_t idx = cur_loc; + + if (a.sign == b.sign) INC_AFL_AREA(idx); + if ((a.exp & 0xff00) == (b.exp & 0xff00)) { + + INC_AFL_AREA(idx + 1); + if ((a.exp & 0xff) == (b.exp & 0xff)) INC_AFL_AREA(idx + 2); + + } + + if ((a.frac & 0xff000000000000) == (b.frac & 0xff000000000000)) { + + INC_AFL_AREA(idx + 3); + if ((a.frac & 0xff0000000000) == (b.frac & 0xff0000000000)) { + + INC_AFL_AREA(idx + 4); + if ((a.frac & 0xff00000000) == (b.frac & 0xff00000000)) { + + INC_AFL_AREA(idx + 5); + if ((a.frac & 0xff000000) == (b.frac & 0xff000000)) { + + INC_AFL_AREA(idx + 6); + if ((a.frac & 0xff0000) == (b.frac & 0xff0000)) { + + INC_AFL_AREA(idx + 7); + if ((a.frac & 0xff00) == (b.frac & 0xff00)) INC_AFL_AREA(idx + 8); + + } + + } + + } + + } + + } + +} + +void afl_float_compcov_log_80(target_ulong cur_loc, floatx80 arg1, + floatx80 arg2) { + + cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); + cur_loc &= MAP_SIZE - 7; + + if (cur_loc >= afl_inst_rms) return; + + if (floatx80_invalid_encoding(arg1) || floatx80_invalid_encoding(arg2)) + return; + + flag a_sign = extractFloatx80Sign(arg1); + flag b_sign = extractFloatx80Sign(arg2); + + /*if (((extractFloatx80Exp(arg1) == 0x7fff) && + (extractFloatx80Frac(arg1) << 1)) || + ((extractFloatx80Exp(arg2) == 0x7fff) && + (extractFloatx80Frac(arg2) << 1))) + return;*/ + + register uintptr_t idx = cur_loc; + + if (a_sign == b_sign) INC_AFL_AREA(idx); + + if ((arg1.high & 0x7f00) == (arg2.high & 0x7f00)) { + + INC_AFL_AREA(idx + 1); + if ((arg1.high & 0xff) == (arg2.high & 0xff)) INC_AFL_AREA(idx + 2); + + } + + if ((arg1.low & 0xff00000000000000) == (arg2.low & 0xff00000000000000)) { + + INC_AFL_AREA(idx + 3); + if ((arg1.low & 0xff000000000000) == (arg2.low & 0xff000000000000)) { + + INC_AFL_AREA(idx + 4); + if ((arg1.low & 0xff0000000000) == (arg2.low & 0xff0000000000)) { + + INC_AFL_AREA(idx + 5); + if ((arg1.low & 0xff00000000) == (arg2.low & 0xff00000000)) { + + INC_AFL_AREA(idx + 6); + if ((arg1.low & 0xff000000) == (arg2.low & 0xff000000)) { + + INC_AFL_AREA(idx + 7); + if ((arg1.low & 0xff0000) == (arg2.low & 0xff0000)) { + + INC_AFL_AREA(idx + 8); + if ((arg1.low & 0xff00) == (arg2.low & 0xff00)) { + + INC_AFL_AREA(idx + 9); + //if ((arg1.low & 0xff) == (arg2.low & 0xff)) + // INC_AFL_AREA(idx + 10); + + } + + } + + } + + } + + } + + } + + } + +} + diff --git a/qemu_mode/patches/i386-fpu_helper.diff b/qemu_mode/patches/i386-fpu_helper.diff new file mode 100644 index 00000000..3bd09d9c --- /dev/null +++ b/qemu_mode/patches/i386-fpu_helper.diff @@ -0,0 +1,54 @@ +diff --git a/target/i386/fpu_helper.c b/target/i386/fpu_helper.c +index ea5a0c48..89901315 100644 +--- a/target/i386/fpu_helper.c ++++ b/target/i386/fpu_helper.c +@@ -384,10 +384,16 @@ void helper_fxchg_ST0_STN(CPUX86State *env, int st_index) + + static const int fcom_ccval[4] = {0x0100, 0x4000, 0x0000, 0x4500}; + ++#include "../patches/afl-qemu-common.h" ++ + void helper_fcom_ST0_FT0(CPUX86State *env) + { + int ret; + ++ if (afl_compcov_level > 2 && env->eip < afl_end_code && ++ env->eip >= afl_start_code) ++ afl_float_compcov_log_80(env->eip, ST0, FT0); ++ + ret = floatx80_compare(ST0, FT0, &env->fp_status); + env->fpus = (env->fpus & ~0x4500) | fcom_ccval[ret + 1]; + } +@@ -396,6 +402,10 @@ void helper_fucom_ST0_FT0(CPUX86State *env) + { + int ret; + ++ if (afl_compcov_level > 2 && env->eip < afl_end_code && ++ env->eip >= afl_start_code) ++ afl_float_compcov_log_80(env->eip, ST0, FT0); ++ + ret = floatx80_compare_quiet(ST0, FT0, &env->fp_status); + env->fpus = (env->fpus & ~0x4500) | fcom_ccval[ret + 1]; + } +@@ -407,6 +417,10 @@ void helper_fcomi_ST0_FT0(CPUX86State *env) + int eflags; + int ret; + ++ if (afl_compcov_level > 2 && env->eip < afl_end_code && ++ env->eip >= afl_start_code) ++ afl_float_compcov_log_80(env->eip, ST0, FT0); ++ + ret = floatx80_compare(ST0, FT0, &env->fp_status); + eflags = cpu_cc_compute_all(env, CC_OP); + eflags = (eflags & ~(CC_Z | CC_P | CC_C)) | fcomi_ccval[ret + 1]; +@@ -418,6 +432,10 @@ void helper_fucomi_ST0_FT0(CPUX86State *env) + int eflags; + int ret; + ++ if (afl_compcov_level > 2 && env->eip < afl_end_code && ++ env->eip >= afl_start_code) ++ afl_float_compcov_log_80(env->eip, ST0, FT0); ++ + ret = floatx80_compare_quiet(ST0, FT0, &env->fp_status); + eflags = cpu_cc_compute_all(env, CC_OP); + eflags = (eflags & ~(CC_Z | CC_P | CC_C)) | fcomi_ccval[ret + 1]; diff --git a/qemu_mode/patches/i386-ops_sse.diff b/qemu_mode/patches/i386-ops_sse.diff new file mode 100644 index 00000000..d2779ea8 --- /dev/null +++ b/qemu_mode/patches/i386-ops_sse.diff @@ -0,0 +1,61 @@ +diff --git a/target/i386/ops_sse.h b/target/i386/ops_sse.h +index ed059897..a5296caa 100644 +--- a/target/i386/ops_sse.h ++++ b/target/i386/ops_sse.h +@@ -997,6 +997,8 @@ SSE_HELPER_CMP(cmpord, FPU_CMPORD) + + static const int comis_eflags[4] = {CC_C, CC_Z, 0, CC_Z | CC_P | CC_C}; + ++#include "../patches/afl-qemu-common.h" ++ + void helper_ucomiss(CPUX86State *env, Reg *d, Reg *s) + { + int ret; +@@ -1004,6 +1006,11 @@ void helper_ucomiss(CPUX86State *env, Reg *d, Reg *s) + + s0 = d->ZMM_S(0); + s1 = s->ZMM_S(0); ++ ++ if (afl_compcov_level > 2 && env->eip < afl_end_code && ++ env->eip >= afl_start_code) ++ afl_float_compcov_log_32(env->eip, s0, s1, &env->sse_status); ++ + ret = float32_compare_quiet(s0, s1, &env->sse_status); + CC_SRC = comis_eflags[ret + 1]; + } +@@ -1015,6 +1022,11 @@ void helper_comiss(CPUX86State *env, Reg *d, Reg *s) + + s0 = d->ZMM_S(0); + s1 = s->ZMM_S(0); ++ ++ if (afl_compcov_level > 2 && env->eip < afl_end_code && ++ env->eip >= afl_start_code) ++ afl_float_compcov_log_32(env->eip, s0, s1, &env->sse_status); ++ + ret = float32_compare(s0, s1, &env->sse_status); + CC_SRC = comis_eflags[ret + 1]; + } +@@ -1026,6 +1038,11 @@ void helper_ucomisd(CPUX86State *env, Reg *d, Reg *s) + + d0 = d->ZMM_D(0); + d1 = s->ZMM_D(0); ++ ++ if (afl_compcov_level > 2 && env->eip < afl_end_code && ++ env->eip >= afl_start_code) ++ afl_float_compcov_log_64(env->eip, d0, d1, &env->sse_status); ++ + ret = float64_compare_quiet(d0, d1, &env->sse_status); + CC_SRC = comis_eflags[ret + 1]; + } +@@ -1037,6 +1054,11 @@ void helper_comisd(CPUX86State *env, Reg *d, Reg *s) + + d0 = d->ZMM_D(0); + d1 = s->ZMM_D(0); ++ ++ if (afl_compcov_level > 2 && env->eip < afl_end_code && ++ env->eip >= afl_start_code) ++ afl_float_compcov_log_64(env->eip, d0, d1, &env->sse_status); ++ + ret = float64_compare(d0, d1, &env->sse_status); + CC_SRC = comis_eflags[ret + 1]; + } diff --git a/qemu_mode/patches/softfloat.diff b/qemu_mode/patches/softfloat.diff new file mode 100644 index 00000000..86ffb97f --- /dev/null +++ b/qemu_mode/patches/softfloat.diff @@ -0,0 +1,10 @@ +diff --git a/fpu/softfloat.c b/fpu/softfloat.c +index e1eef954..2f8d0d62 100644 +--- a/fpu/softfloat.c ++++ b/fpu/softfloat.c +@@ -7205,3 +7205,5 @@ float128 float128_scalbn(float128 a, int n, float_status *status) + , status); + + } ++ ++#include "../../patches/afl-qemu-floats.h" -- cgit 1.4.1 From 94548d228444f5f4486bea9253c39900ea27a505 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Fri, 25 Oct 2019 20:12:24 +0200 Subject: float compcov readme --- qemu_mode/README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'qemu_mode') diff --git a/qemu_mode/README.md b/qemu_mode/README.md index a85407e4..c88c1e41 100644 --- a/qemu_mode/README.md +++ b/qemu_mode/README.md @@ -100,7 +100,11 @@ afl-fuzz). AFL_COMPCOV_LEVEL=1 is to instrument comparisons with only immediate values / read-only memory. AFL_COMPCOV_LEVEL=2 instruments all comparison instructions and memory comparison functions when libcompcov -is preloaded. Comparison instructions are currently instrumented only +is preloaded. +AFL_COMPCOV_LEVEL=3 has the same effects of AFL_COMPCOV_LEVEL=2 but enables also +the instrumentation of the floating-point comparisons on x86 and x86_64 (experimental). + +Integer comparison instructions are currently instrumented only on the x86, x86_64 and ARM targets. Highly recommended. -- cgit 1.4.1 From a2f911dbb1ac177f4e633f4e667bbf4f8c578895 Mon Sep 17 00:00:00 2001 From: Andrea Fioraldi Date: Sat, 26 Oct 2019 01:14:39 +0200 Subject: typo --- qemu_mode/patches/afl-qemu-floats.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'qemu_mode') diff --git a/qemu_mode/patches/afl-qemu-floats.h b/qemu_mode/patches/afl-qemu-floats.h index 765deb74..0b2ac2ae 100644 --- a/qemu_mode/patches/afl-qemu-floats.h +++ b/qemu_mode/patches/afl-qemu-floats.h @@ -35,7 +35,7 @@ #include "afl-qemu-common.h" union afl_float32 { - float64 f; + float32 f; struct { u64 sign : 1; u64 exp : 7; -- cgit 1.4.1 From 499f078c3759a22dd5cfd81d2271969f19b75090 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Thu, 7 Nov 2019 11:48:39 +0100 Subject: f*ckin travis --- docs/ChangeLog | 2 ++ qemu_mode/build_qemu_support.sh | 5 ++++- unicorn_mode/build_unicorn_support.sh | 5 ++++- 3 files changed, 10 insertions(+), 2 deletions(-) (limited to 'qemu_mode') diff --git a/docs/ChangeLog b/docs/ChangeLog index 3924226e..7bc6dec4 100644 --- a/docs/ChangeLog +++ b/docs/ChangeLog @@ -25,6 +25,8 @@ Version ++2.58d (dev): - libcompcov floating point splitting support for qemu and unicorn - Dockerfile by courtesy of devnexen - ripped regex.dictionary from Google afl PR + - qemu and unicorn download scripts now try to download until the full + download succeeded. f*ckin travis fails downloading 40% of the time! - removed unnecessary warnings diff --git a/qemu_mode/build_qemu_support.sh b/qemu_mode/build_qemu_support.sh index 6b9f91f9..c3983aa1 100755 --- a/qemu_mode/build_qemu_support.sh +++ b/qemu_mode/build_qemu_support.sh @@ -100,7 +100,10 @@ if [ ! "$CKSUM" = "$QEMU_SHA384" ]; then echo "[*] Downloading QEMU ${VERSION} from the web..." rm -f "$ARCHIVE" - wget -O "$ARCHIVE" -- "$QEMU_URL" || exit 1 + OK= + while [ -z "$OK" ]; do + wget -c -O "$ARCHIVE" -- "$QEMU_URL" && OK=1 + done CKSUM=`sha384sum -- "$ARCHIVE" 2>/dev/null | cut -d' ' -f1` diff --git a/unicorn_mode/build_unicorn_support.sh b/unicorn_mode/build_unicorn_support.sh index 3bd404b8..fdbcda62 100755 --- a/unicorn_mode/build_unicorn_support.sh +++ b/unicorn_mode/build_unicorn_support.sh @@ -106,7 +106,10 @@ if [ ! "$CKSUM" = "$UNICORN_SHA384" ]; then echo "[*] Downloading Unicorn v1.0.1 from the web..." rm -f "$ARCHIVE" - wget -O "$ARCHIVE" -- "$UNICORN_URL" || exit 1 + OK= + while [ -z "$OK" ]; do + wget -c -O "$ARCHIVE" -- "$UNICORN_URL" && OK=1 + done CKSUM=`sha384sum -- "$ARCHIVE" 2>/dev/null | cut -d' ' -f1` -- cgit 1.4.1