From 51a346bcbeb66d159b01c6fd37616824c32ee569 Mon Sep 17 00:00:00 2001 From: Dominik Maier Date: Thu, 19 Mar 2020 19:22:57 +0100 Subject: 50% less globals --- src/afl-fuzz-stats.c | 109 ++++++++++++++++++++++++--------------------------- 1 file changed, 52 insertions(+), 57 deletions(-) (limited to 'src/afl-fuzz-stats.c') diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index 63cca14d..d4b27625 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -30,8 +30,7 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability, double eps) { - static double last_bcvg, last_stab, last_eps; - static struct rusage rus; + struct rusage rus; u8 * fn = alloc_printf("%s/fuzzer_stats", afl->out_dir); s32 fd; @@ -52,15 +51,15 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability, if (!bitmap_cvg && !stability && !eps) { - bitmap_cvg = last_bcvg; - stability = last_stab; - eps = last_eps; + bitmap_cvg = afl->last_bitmap_cvg; + stability = afl->last_stability; + eps = afl->last_eps; } else { - last_bcvg = bitmap_cvg; - last_stab = stability; - last_eps = eps; + afl->last_bitmap_cvg = bitmap_cvg; + afl->last_stability = stability; + afl->last_eps = eps; } @@ -137,23 +136,24 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability, void maybe_update_plot_file(afl_state_t *afl, double bitmap_cvg, double eps) { - static u32 prev_qp, prev_pf, prev_pnf, prev_ce, prev_md; - static u64 prev_qc, prev_uc, prev_uh; - - if (prev_qp == afl->queued_paths && prev_pf == afl->pending_favored && - prev_pnf == afl->pending_not_fuzzed && prev_ce == afl->current_entry && - prev_qc == afl->queue_cycle && prev_uc == afl->unique_crashes && - prev_uh == afl->unique_hangs && prev_md == afl->max_depth) + if (afl->plot_prev_qp == afl->queued_paths && + afl->plot_prev_pf == afl->pending_favored && + afl->plot_prev_pnf == afl->pending_not_fuzzed && + afl->plot_prev_ce == afl->current_entry && + afl->plot_prev_qc == afl->queue_cycle && + afl->plot_prev_uc == afl->unique_crashes && + afl->plot_prev_uh == afl->unique_hangs && + afl->plot_prev_md == afl->max_depth) return; - prev_qp = afl->queued_paths; - prev_pf = afl->pending_favored; - prev_pnf = afl->pending_not_fuzzed; - prev_ce = afl->current_entry; - prev_qc = afl->queue_cycle; - prev_uc = afl->unique_crashes; - prev_uh = afl->unique_hangs; - prev_md = afl->max_depth; + afl->plot_prev_qp = afl->queued_paths; + afl->plot_prev_pf = afl->pending_favored; + afl->plot_prev_pnf = afl->pending_not_fuzzed; + afl->plot_prev_ce = afl->current_entry; + afl->plot_prev_qc = afl->queue_cycle; + afl->plot_prev_uc = afl->unique_crashes; + afl->plot_prev_uh = afl->unique_hangs; + afl->plot_prev_md = afl->max_depth; /* Fields in the file: @@ -192,8 +192,6 @@ static void check_term_size(afl_state_t *afl) { void show_stats(afl_state_t *afl) { - static u64 last_stats_ms, last_plot_ms, last_ms, last_execs; - static double avg_exec; double t_byte_ratio, stab_ratio; u64 cur_ms; @@ -201,12 +199,13 @@ void show_stats(afl_state_t *afl) { u32 banner_len, banner_pad; u8 tmp[256]; + u8 time_tmp[64]; cur_ms = get_cur_time(); /* If not enough time has passed since last UI update, bail out. */ - if (cur_ms - last_ms < 1000 / UI_TARGET_HZ && !afl->force_ui_update) return; + if (cur_ms - afl->stats_last_ms < 1000 / UI_TARGET_HZ && !afl->force_ui_update) return; /* Check if we're past the 10 minute mark. */ @@ -214,31 +213,29 @@ void show_stats(afl_state_t *afl) { /* Calculate smoothed exec speed stats. */ - if (!last_execs) { + if (!afl->stats_last_execs) { - avg_exec = ((double)afl->total_execs) * 1000 / (cur_ms - afl->start_time); + afl->stats_avg_exec = ((double)afl->total_execs) * 1000 / (cur_ms - afl->start_time); } else { - double cur_avg = - ((double)(afl->total_execs - last_execs)) * 1000 / (cur_ms - last_ms); + double cur_avg = ((double)(afl->total_execs - afl->stats_last_execs)) * 1000 / (cur_ms - afl->stats_last_ms); /* If there is a dramatic (5x+) jump in speed, reset the indicator more quickly. */ - if (cur_avg * 5 < avg_exec || cur_avg / 5 > avg_exec) avg_exec = cur_avg; + if (cur_avg * 5 < afl->stats_avg_exec || cur_avg / 5 > afl->stats_avg_exec) afl->stats_avg_exec = cur_avg; - avg_exec = avg_exec * (1.0 - 1.0 / AVG_SMOOTHING) + - cur_avg * (1.0 / AVG_SMOOTHING); + afl->stats_avg_exec = afl->stats_avg_exec * (1.0 - 1.0 / AVG_SMOOTHING) + cur_avg * (1.0 / AVG_SMOOTHING); } - last_ms = cur_ms; - last_execs = afl->total_execs; + afl->stats_last_ms = cur_ms; + afl->stats_last_execs = afl->total_execs; /* Tell the callers when to contact us (as measured in execs). */ - afl->stats_update_freq = avg_exec / (UI_TARGET_HZ * 10); + afl->stats_update_freq = afl->stats_avg_exec / (UI_TARGET_HZ * 10); if (!afl->stats_update_freq) afl->stats_update_freq = 1; /* Do some bitmap stats. */ @@ -253,10 +250,10 @@ void show_stats(afl_state_t *afl) { /* Roughly every minute, update fuzzer stats and save auto tokens. */ - if (cur_ms - last_stats_ms > STATS_UPDATE_SEC * 1000) { + if (cur_ms - afl->stats_last_stats_ms > STATS_UPDATE_SEC * 1000) { - last_stats_ms = cur_ms; - write_stats_file(afl, t_byte_ratio, stab_ratio, avg_exec); + afl->stats_last_stats_ms = cur_ms; + write_stats_file(afl, t_byte_ratio, stab_ratio, afl->stats_avg_exec); save_auto(afl); write_bitmap(afl); @@ -264,10 +261,10 @@ void show_stats(afl_state_t *afl) { /* Every now and then, write plot data. */ - if (cur_ms - last_plot_ms > PLOT_UPDATE_SEC * 1000) { + if (cur_ms - afl->stats_last_plot_ms > PLOT_UPDATE_SEC * 1000) { - last_plot_ms = cur_ms; - maybe_update_plot_file(afl, t_byte_ratio, avg_exec); + afl->stats_last_plot_ms = cur_ms; + maybe_update_plot_file(afl, t_byte_ratio, afl->stats_avg_exec); } @@ -384,9 +381,9 @@ void show_stats(afl_state_t *afl) { } + DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->start_time); SAYF(bV bSTOP " run time : " cRST "%-33s " bSTG bV bSTOP - " cycles done : %s%-5s " bSTG bV "\n", - DTD(cur_ms, afl->start_time), tmp, DI(afl->queue_cycle - 1)); + " cycles done : %s%-5s " bSTG bV "\n", time_tmp, tmp, DI(afl->queue_cycle - 1)); /* We want to warn people about not seeing new paths after a full cycle, except when resuming fuzzing or running in non-instrumented mode. */ @@ -395,8 +392,8 @@ void show_stats(afl_state_t *afl) { (afl->last_path_time || afl->resuming_fuzz || afl->queue_cycle == 1 || afl->in_bitmap || afl->crash_mode)) { - SAYF(bV bSTOP " last new path : " cRST "%-33s ", - DTD(cur_ms, afl->last_path_time)); + DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_path_time); + SAYF(bV bSTOP " last new path : " cRST "%-33s ", time_tmp); } else { @@ -421,17 +418,16 @@ void show_stats(afl_state_t *afl) { sprintf(tmp, "%s%s", DI(afl->unique_crashes), (afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : ""); + DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_crash_time); SAYF(bV bSTOP " last uniq crash : " cRST "%-33s " bSTG bV bSTOP - " uniq crashes : %s%-6s" bSTG bV "\n", - DTD(cur_ms, afl->last_crash_time), afl->unique_crashes ? cLRD : cRST, - tmp); + " uniq crashes : %s%-6s" bSTG bV "\n", time_tmp, afl->unique_crashes ? cLRD : cRST, tmp); sprintf(tmp, "%s%s", DI(afl->unique_hangs), (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : ""); + DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_hang_time); SAYF(bV bSTOP " last uniq hang : " cRST "%-33s " bSTG bV bSTOP - " uniq hangs : " cRST "%-6s" bSTG bV "\n", - DTD(cur_ms, afl->last_hang_time), tmp); + " uniq hangs : " cRST "%-6s" bSTG bV "\n", time_tmp, tmp); SAYF(bVR bH bSTOP cCYA " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA @@ -515,23 +511,22 @@ void show_stats(afl_state_t *afl) { /* Show a warning about slow execution. */ - if (avg_exec < 100) { + if (afl->stats_avg_exec < 100) { - sprintf(tmp, "%s/sec (%s)", DF(avg_exec), - avg_exec < 20 ? "zzzz..." : "slow!"); + sprintf(tmp, "%s/sec (%s)", DF(afl->stats_avg_exec), + afl->stats_avg_exec < 20 ? "zzzz..." : "slow!"); SAYF(bV bSTOP " exec speed : " cLRD "%-20s ", tmp); } else { - sprintf(tmp, "%s/sec", DF(avg_exec)); + sprintf(tmp, "%s/sec", DF(afl->stats_avg_exec)); SAYF(bV bSTOP " exec speed : " cRST "%-20s ", tmp); } sprintf(tmp, "%s (%s%s unique)", DI(afl->total_tmouts), - DI(afl->unique_tmouts), - (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : ""); + DI(afl->unique_tmouts), (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : ""); SAYF(bSTG bV bSTOP " total tmouts : " cRST "%-22s" bSTG bV "\n", tmp); -- cgit 1.4.1 From b6fa63abdfb62fba1a00d9b5401ee69cf1bced1a Mon Sep 17 00:00:00 2001 From: Dominik Maier Date: Thu, 19 Mar 2020 19:23:58 +0100 Subject: code format --- include/afl-fuzz.h | 15 ++++----- qemu_mode/patches/afl-qemu-tcg-runtime-inl.h | 4 +-- src/afl-forkserver.c | 2 +- src/afl-fuzz-cmplog.c | 15 ++++----- src/afl-fuzz-init.c | 4 +-- src/afl-fuzz-misc.c | 4 +-- src/afl-fuzz-mutators.c | 3 +- src/afl-fuzz-one.c | 13 +++++--- src/afl-fuzz-queue.c | 2 +- src/afl-fuzz-run.c | 16 ++++++---- src/afl-fuzz-stats.c | 46 +++++++++++++++++----------- src/afl-showmap.c | 2 +- src/afl-tmin.c | 2 +- 13 files changed, 74 insertions(+), 54 deletions(-) (limited to 'src/afl-fuzz-stats.c') diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index 913b08e6..28156268 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -109,7 +109,8 @@ #define CASE_PREFIX "id_" #endif /* ^!SIMPLE_FILES */ -#define STAGE_BUF_SIZE (64) /* usable size of the stage name buf in afl_state */ +#define STAGE_BUF_SIZE (64) /* usable size of the stage name buf in afl_state \ + */ extern s8 interesting_8[INTERESTING_8_LEN]; extern s16 interesting_16[INTERESTING_8_LEN + INTERESTING_16_LEN]; @@ -542,7 +543,7 @@ typedef struct afl_state { /* cmplog forkserver ids */ s32 cmplog_fsrv_ctl_fd, cmplog_fsrv_st_fd; - u32 cmplog_prev_timed_out; + u32 cmplog_prev_timed_out; u8 describe_op_buf_256[256]; /* describe_op will use this to return a string up to 256 */ @@ -559,13 +560,13 @@ typedef struct afl_state { #endif /* statis file */ - double last_bitmap_cvg, last_stability, last_eps; + double last_bitmap_cvg, last_stability, last_eps; /* plot file saves from last run */ u32 plot_prev_qp, plot_prev_pf, plot_prev_pnf, plot_prev_ce, plot_prev_md; u64 plot_prev_qc, plot_prev_uc, plot_prev_uh; - u64 stats_last_stats_ms, stats_last_plot_ms, stats_last_ms, stats_last_execs; + u64 stats_last_stats_ms, stats_last_plot_ms, stats_last_ms, stats_last_execs; double stats_avg_exec; u8 clean_trace[MAP_SIZE]; @@ -800,9 +801,9 @@ u8 has_new_bits(afl_state_t *, u8 *); /* Misc */ -u8 *DI(u64); -u8 *DF(double); -u8 *DMS(u64); +u8 * DI(u64); +u8 * DF(double); +u8 * DMS(u64); void DTD(u8 *, size_t, u64, u64); /* Extras */ diff --git a/qemu_mode/patches/afl-qemu-tcg-runtime-inl.h b/qemu_mode/patches/afl-qemu-tcg-runtime-inl.h index b7cd71bb..1526f09c 100644 --- a/qemu_mode/patches/afl-qemu-tcg-runtime-inl.h +++ b/qemu_mode/patches/afl-qemu-tcg-runtime-inl.h @@ -185,8 +185,8 @@ void HELPER(afl_cmplog_rtn)(CPUArchState *env) { if (!area_is_mapped(stack, sizeof(target_ulong) * 2)) return; // when this hook is executed, the retaddr is not on stack yet - void *ptr1 = g2h(stack[0]); - void *ptr2 = g2h(stack[1]); + void * ptr1 = g2h(stack[0]); + void * ptr2 = g2h(stack[1]); #else diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c index a77684a7..68ffe28d 100644 --- a/src/afl-forkserver.c +++ b/src/afl-forkserver.c @@ -168,7 +168,7 @@ void afl_fsrv_init(afl_forkserver_t *fsrv) { static void afl_fauxsrv_execv(afl_forkserver_t *fsrv, char **argv) { unsigned char tmp[4] = {0}; - pid_t child_pid = -1; + pid_t child_pid = -1; /* Phone home and tell the parent that we're OK. If parent isn't there, assume we're not running in forkserver mode and just execute program. */ diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c index 7af7b84c..6211548b 100644 --- a/src/afl-fuzz-cmplog.c +++ b/src/afl-fuzz-cmplog.c @@ -32,9 +32,9 @@ void init_cmplog_forkserver(afl_state_t *afl) { struct timeval timeout; - int st_pipe[2], ctl_pipe[2]; - int status; - s32 rlen; + int st_pipe[2], ctl_pipe[2]; + int status; + s32 rlen; ACTF("Spinning up the cmplog fork server..."); @@ -373,9 +373,9 @@ void init_cmplog_forkserver(afl_state_t *afl) { u8 run_cmplog_target(afl_state_t *afl, u32 timeout) { struct timeval it; - int status = 0; - int sret; - u64 exec_ms; + int status = 0; + int sret; + u64 exec_ms; u32 tb4; s32 res; @@ -394,7 +394,8 @@ u8 run_cmplog_target(afl_state_t *afl, u32 timeout) { /* Since we always have a forkserver (or a fauxserver) running, we can simply tell them to have at it and read back the pid from it.*/ - if ((res = write(afl->cmplog_fsrv_ctl_fd, &afl->cmplog_prev_timed_out, 4)) != 4) { + if ((res = write(afl->cmplog_fsrv_ctl_fd, &afl->cmplog_prev_timed_out, 4)) != + 4) { if (afl->stop_soon) return 0; RPFATAL(res, diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c index 8acb305c..ab455417 100644 --- a/src/afl-fuzz-init.c +++ b/src/afl-fuzz-init.c @@ -797,7 +797,7 @@ void pivot_inputs(afl_state_t *afl) { u32 find_start_position(afl_state_t *afl) { - u8 tmp[4096] = {0}; /* Ought to be enough for anybody. */ + u8 tmp[4096] = {0}; /* Ought to be enough for anybody. */ u8 *fn, *off; s32 fd, i; @@ -834,7 +834,7 @@ u32 find_start_position(afl_state_t *afl) { void find_timeout(afl_state_t *afl) { - u8 tmp[4096] = {0}; /* Ought to be enough for anybody. */ + u8 tmp[4096] = {0}; /* Ought to be enough for anybody. */ u8 *fn, *off; s32 fd, i; diff --git a/src/afl-fuzz-misc.c b/src/afl-fuzz-misc.c index d0db79d6..90e0ee8a 100644 --- a/src/afl-fuzz-misc.c +++ b/src/afl-fuzz-misc.c @@ -166,8 +166,8 @@ u8 *DMS(u64 val) { void DTD(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) { - u64 delta; - s32 t_d, t_h, t_m, t_s; + u64 delta; + s32 t_d, t_h, t_m, t_s; if (!event_ms) snprintf(buf, len, "none seen yet"); diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c index 5d39c2ee..9788da49 100644 --- a/src/afl-fuzz-mutators.c +++ b/src/afl-fuzz-mutators.c @@ -196,7 +196,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) { u32 trim_exec = 0; u32 orig_len = q->len; - if (afl->stage_name != afl->stage_name_buf) afl->stage_name = afl->stage_name_buf; + if (afl->stage_name != afl->stage_name_buf) + afl->stage_name = afl->stage_name_buf; afl->bytes_trim_in += q->len; /* Initialize trimming in the custom mutator */ diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c index ebb863ca..c1458dbb 100644 --- a/src/afl-fuzz-one.c +++ b/src/afl-fuzz-one.c @@ -1680,7 +1680,8 @@ havoc_stage: perf_score = orig_perf; snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "splice %u", splice_cycle); - if (afl->stage_name != afl->stage_name_buf) afl->stage_name = afl->stage_name_buf; + if (afl->stage_name != afl->stage_name_buf) + afl->stage_name = afl->stage_name_buf; afl->stage_short = "splice"; afl->stage_max = SPLICE_HAVOC * perf_score / afl->havoc_div / 100; @@ -3573,9 +3574,10 @@ pacemaker_fuzzing: perf_score = orig_perf; - snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, MOpt_globals.splice_stageformat, - splice_cycle); - if (afl->stage_name != afl->stage_name_buf) afl->stage_name = afl->stage_name_buf; + snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, + MOpt_globals.splice_stageformat, splice_cycle); + if (afl->stage_name != afl->stage_name_buf) + afl->stage_name = afl->stage_name_buf; afl->stage_short = MOpt_globals.splice_stagenameshort; afl->stage_max = SPLICE_HAVOC * perf_score / afl->havoc_div / 100; @@ -3623,7 +3625,8 @@ pacemaker_fuzzing: } else { perf_score = orig_perf; - snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, MOpt_globals.splice_stageformat, splice_cycle); + snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, + MOpt_globals.splice_stageformat, splice_cycle); afl->stage_name = afl->stage_name_buf; afl->stage_short = MOpt_globals.splice_stagenameshort; afl->stage_max = SPLICE_HAVOC * perf_score / afl->havoc_div / 100; diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c index 00bad48f..8a995727 100644 --- a/src/afl-fuzz-queue.c +++ b/src/afl-fuzz-queue.c @@ -254,7 +254,7 @@ void update_bitmap_score(afl_state_t *afl, struct queue_entry *q) { void cull_queue(afl_state_t *afl) { struct queue_entry *q; - u8 temp_v[MAP_SIZE >> 3]; + u8 temp_v[MAP_SIZE >> 3]; u32 i; if (afl->dumb_mode || !afl->score_changed) return; diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c index c65cdce3..500c5ba2 100644 --- a/src/afl-fuzz-run.c +++ b/src/afl-fuzz-run.c @@ -38,8 +38,8 @@ u8 run_target(afl_state_t *afl, u32 timeout) { fd_set readfds; struct timeval it; - int status = 0; - u32 tb4; + int status = 0; + u32 tb4; afl->fsrv.child_timed_out = 0; @@ -361,7 +361,8 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem, for (i = 0; i < MAP_SIZE; ++i) { - if (!afl->var_bytes[i] && afl->first_trace[i] != afl->fsrv.trace_bits[i]) { + if (!afl->var_bytes[i] && + afl->first_trace[i] != afl->fsrv.trace_bits[i]) { afl->var_bytes[i] = 1; afl->stage_max = CAL_CYCLES_LONG; @@ -500,7 +501,8 @@ void sync_fuzzers(afl_state_t *afl) { snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "sync %u", ++sync_cnt); - if (afl->stage_name != afl->stage_name_buf) afl->stage_name = afl->stage_name_buf; + if (afl->stage_name != afl->stage_name_buf) + afl->stage_name = afl->stage_name_buf; afl->stage_cur = 0; afl->stage_max = 0; @@ -607,7 +609,8 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) { if (q->len < 5) return 0; - if (afl->stage_name != afl->stage_name_buf) afl->stage_name = afl->stage_name_buf; + if (afl->stage_name != afl->stage_name_buf) + afl->stage_name = afl->stage_name_buf; afl->bytes_trim_in += q->len; /* Select initial chunk len, starting with large steps. */ @@ -623,7 +626,8 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) { u32 remove_pos = remove_len; - snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "trim %s/%s", DI(remove_len), DI(remove_len)); + snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "trim %s/%s", DI(remove_len), + DI(remove_len)); afl->stage_cur = 0; afl->stage_max = q->len / remove_len; diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index d4b27625..c89820d8 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -192,20 +192,22 @@ static void check_term_size(afl_state_t *afl) { void show_stats(afl_state_t *afl) { - double t_byte_ratio, stab_ratio; + double t_byte_ratio, stab_ratio; u64 cur_ms; u32 t_bytes, t_bits; u32 banner_len, banner_pad; u8 tmp[256]; - u8 time_tmp[64]; + u8 time_tmp[64]; cur_ms = get_cur_time(); /* If not enough time has passed since last UI update, bail out. */ - if (cur_ms - afl->stats_last_ms < 1000 / UI_TARGET_HZ && !afl->force_ui_update) return; + if (cur_ms - afl->stats_last_ms < 1000 / UI_TARGET_HZ && + !afl->force_ui_update) + return; /* Check if we're past the 10 minute mark. */ @@ -215,18 +217,22 @@ void show_stats(afl_state_t *afl) { if (!afl->stats_last_execs) { - afl->stats_avg_exec = ((double)afl->total_execs) * 1000 / (cur_ms - afl->start_time); + afl->stats_avg_exec = + ((double)afl->total_execs) * 1000 / (cur_ms - afl->start_time); } else { - double cur_avg = ((double)(afl->total_execs - afl->stats_last_execs)) * 1000 / (cur_ms - afl->stats_last_ms); + double cur_avg = ((double)(afl->total_execs - afl->stats_last_execs)) * + 1000 / (cur_ms - afl->stats_last_ms); /* If there is a dramatic (5x+) jump in speed, reset the indicator more quickly. */ - if (cur_avg * 5 < afl->stats_avg_exec || cur_avg / 5 > afl->stats_avg_exec) afl->stats_avg_exec = cur_avg; + if (cur_avg * 5 < afl->stats_avg_exec || cur_avg / 5 > afl->stats_avg_exec) + afl->stats_avg_exec = cur_avg; - afl->stats_avg_exec = afl->stats_avg_exec * (1.0 - 1.0 / AVG_SMOOTHING) + cur_avg * (1.0 / AVG_SMOOTHING); + afl->stats_avg_exec = afl->stats_avg_exec * (1.0 - 1.0 / AVG_SMOOTHING) + + cur_avg * (1.0 / AVG_SMOOTHING); } @@ -348,9 +354,9 @@ void show_stats(afl_state_t *afl) { /* Lord, forgive me this. */ - SAYF(SET_G1 bSTG bLT bH bSTOP cCYA + SAYF(SET_G1 bSTG bLT bH bSTOP cCYA " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA - " overall results " bSTG bH2 bH2 bRT "\n"); + " overall results " bSTG bH2 bH2 bRT "\n"); if (afl->dumb_mode) { @@ -383,7 +389,8 @@ void show_stats(afl_state_t *afl) { DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->start_time); SAYF(bV bSTOP " run time : " cRST "%-33s " bSTG bV bSTOP - " cycles done : %s%-5s " bSTG bV "\n", time_tmp, tmp, DI(afl->queue_cycle - 1)); + " cycles done : %s%-5s " bSTG bV "\n", + time_tmp, tmp, DI(afl->queue_cycle - 1)); /* We want to warn people about not seeing new paths after a full cycle, except when resuming fuzzing or running in non-instrumented mode. */ @@ -420,18 +427,20 @@ void show_stats(afl_state_t *afl) { DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_crash_time); SAYF(bV bSTOP " last uniq crash : " cRST "%-33s " bSTG bV bSTOP - " uniq crashes : %s%-6s" bSTG bV "\n", time_tmp, afl->unique_crashes ? cLRD : cRST, tmp); + " uniq crashes : %s%-6s" bSTG bV "\n", + time_tmp, afl->unique_crashes ? cLRD : cRST, tmp); sprintf(tmp, "%s%s", DI(afl->unique_hangs), (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : ""); DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_hang_time); SAYF(bV bSTOP " last uniq hang : " cRST "%-33s " bSTG bV bSTOP - " uniq hangs : " cRST "%-6s" bSTG bV "\n", time_tmp, tmp); + " uniq hangs : " cRST "%-6s" bSTG bV "\n", + time_tmp, tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA - " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); + " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); /* This gets funny because we want to print several variable-length variables together, but then cram them into a fixed-width field - so we need to @@ -460,9 +469,9 @@ void show_stats(afl_state_t *afl) { SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA - " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); + " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); sprintf(tmp, "%s (%0.02f%%)", DI(afl->queued_favored), ((double)afl->queued_favored) * 100 / afl->queued_paths); @@ -526,13 +535,14 @@ void show_stats(afl_state_t *afl) { } sprintf(tmp, "%s (%s%s unique)", DI(afl->total_tmouts), - DI(afl->unique_tmouts), (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : ""); + DI(afl->unique_tmouts), + (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : ""); SAYF(bSTG bV bSTOP " total tmouts : " cRST "%-22s" bSTG bV "\n", tmp); /* Aaaalmost there... hold on! */ - SAYF(bVR bH cCYA bSTOP + SAYF(bVR bH cCYA bSTOP " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA " path geometry " bSTG bH5 bH2 bVL "\n"); diff --git a/src/afl-showmap.c b/src/afl-showmap.c index cc771c5a..712b50bd 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -264,7 +264,7 @@ static u8 run_target_forkserver(afl_forkserver_t *fsrv, char **argv, u8 *mem, u32 len) { struct itimerval it; - int status = 0; + int status = 0; memset(fsrv->trace_bits, 0, MAP_SIZE); MEM_BARRIER(); diff --git a/src/afl-tmin.c b/src/afl-tmin.c index 9a3a72da..9238abab 100644 --- a/src/afl-tmin.c +++ b/src/afl-tmin.c @@ -399,7 +399,7 @@ static u8 run_target(afl_forkserver_t *fsrv, char **argv, u8 *mem, u32 len, u8 first_run) { struct itimerval it; - int status = 0; + int status = 0; u32 cksum; -- cgit 1.4.1 From 5b9d306cdfac1cb2a32373a0d4028abffb7ce979 Mon Sep 17 00:00:00 2001 From: Dominik Maier Date: Thu, 19 Mar 2020 22:54:09 +0100 Subject: no more (?) statics --- include/afl-fuzz.h | 13 ++-- src/afl-forkserver.c | 26 +++---- src/afl-fuzz-bitmap.c | 6 +- src/afl-fuzz-cmplog.c | 10 ++- src/afl-fuzz-extras.c | 19 ++++-- src/afl-fuzz-init.c | 13 ++-- src/afl-fuzz-misc.c | 88 ++++++++++++------------ src/afl-fuzz-mutators.c | 5 +- src/afl-fuzz-run.c | 7 +- src/afl-fuzz-stats.c | 178 +++++++++++++++++++++++++++--------------------- 10 files changed, 207 insertions(+), 158 deletions(-) (limited to 'src/afl-fuzz-stats.c') diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index 28156268..1a798239 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -109,8 +109,9 @@ #define CASE_PREFIX "id_" #endif /* ^!SIMPLE_FILES */ -#define STAGE_BUF_SIZE (64) /* usable size of the stage name buf in afl_state \ - */ +#define STAGE_BUF_SIZE \ + (64) /* usable size of the stage name buf in afl_state \ + */ extern s8 interesting_8[INTERESTING_8_LEN]; extern s16 interesting_16[INTERESTING_8_LEN + INTERESTING_16_LEN]; @@ -801,10 +802,10 @@ u8 has_new_bits(afl_state_t *, u8 *); /* Misc */ -u8 * DI(u64); -u8 * DF(double); -u8 * DMS(u64); -void DTD(u8 *, size_t, u64, u64); +u8 *DI(u8 *, size_t, u64); +u8 *DF(u8 *, size_t, double); +u8 *DMS(u8 *, size_t, u64); +u8 *DTD(u8 *, size_t, u64, u64); /* Extras */ diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c index 6755a73c..75b69178 100644 --- a/src/afl-forkserver.c +++ b/src/afl-forkserver.c @@ -55,16 +55,16 @@ static void forkserver_stringify_int(u8 *buf, size_t len, u64 val) { u8 cur = 0; -#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \ - do { \ - \ - if (val < (_divisor) * (_limit_mult)) { \ - \ - snprintf(buf, len, _fmt, ((_cast)val) / (_divisor));\ - return; \ - \ - } \ - \ +#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \ + do { \ + \ + if (val < (_divisor) * (_limit_mult)) { \ + \ + snprintf(buf, len, _fmt, ((_cast)val) / (_divisor)); \ + return; \ + \ + } \ + \ } while (0) cur = (cur + 1) % 12; @@ -454,7 +454,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv) { } else { u8 mem_limit_buf[16]; - forkserver_stringify_int(mem_limit_buf, sizeof(mem_limit_buf), fsrv->mem_limit << 20); + forkserver_stringify_int(mem_limit_buf, sizeof(mem_limit_buf), + fsrv->mem_limit << 20); SAYF("\n" cLRD "[-] " cRST "Whoops, the target binary crashed suddenly, " @@ -524,7 +525,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv) { } else { u8 mem_limit_buf[16]; - forkserver_stringify_int(mem_limit_buf, sizeof(mem_limit_buf), fsrv->mem_limit << 20); + forkserver_stringify_int(mem_limit_buf, sizeof(mem_limit_buf), + fsrv->mem_limit << 20); SAYF( "\n" cLRD "[-] " cRST diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c index de5d147e..86474adc 100644 --- a/src/afl-fuzz-bitmap.c +++ b/src/afl-fuzz-bitmap.c @@ -465,6 +465,8 @@ static void write_crash_readme(afl_state_t *afl) { s32 fd; FILE *f; + u8 int_buf[16]; + fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600); ck_free(fn); @@ -501,7 +503,9 @@ static void write_crash_readme(afl_state_t *afl) { " https://github.com/AFLplusplus/AFLplusplus\n\n", - afl->orig_cmdline, DMS(afl->fsrv.mem_limit << 20)); /* ignore errors */ + afl->orig_cmdline, + DMS(int_buf, sizeof(int_buf), + afl->fsrv.mem_limit << 20)); /* ignore errors */ fclose(f); diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c index 6211548b..5f7909cc 100644 --- a/src/afl-fuzz-cmplog.c +++ b/src/afl-fuzz-cmplog.c @@ -264,6 +264,8 @@ void init_cmplog_forkserver(afl_state_t *afl) { } else { + u8 int_buf[16]; + SAYF("\n" cLRD "[-] " cRST "Whoops, the target binary crashed suddenly, " "before receiving any input\n" @@ -296,7 +298,8 @@ void init_cmplog_forkserver(afl_state_t *afl) { "options\n" " fail, poke for troubleshooting " "tips.\n", - DMS(afl->fsrv.mem_limit << 20), afl->fsrv.mem_limit - 1); + DMS(int_buf, sizeof(int_buf), afl->fsrv.mem_limit << 20), + afl->fsrv.mem_limit - 1); } @@ -331,6 +334,8 @@ void init_cmplog_forkserver(afl_state_t *afl) { } else { + u8 int_buf[16]; + SAYF( "\n" cLRD "[-] " cRST "Hmm, looks like the target binary terminated " @@ -362,7 +367,8 @@ void init_cmplog_forkserver(afl_state_t *afl) { "never\n" " reached before the program terminates.\n\n" : "", - DMS(afl->fsrv.mem_limit << 20), afl->fsrv.mem_limit - 1); + DMS(int_buf, sizeof(int_buf), afl->fsrv.mem_limit << 20), + afl->fsrv.mem_limit - 1); } diff --git a/src/afl-fuzz-extras.c b/src/afl-fuzz-extras.c index ff4c0ae2..256489f5 100644 --- a/src/afl-fuzz-extras.c +++ b/src/afl-fuzz-extras.c @@ -55,6 +55,8 @@ void load_extras_file(afl_state_t *afl, u8 *fname, u32 *min_len, u32 *max_len, u8 * lptr; u32 cur_line = 0; + u8 int_bufs[2][16]; + f = fopen(fname, "r"); if (!f) PFATAL("Unable to open '%s'", fname); @@ -170,8 +172,9 @@ void load_extras_file(afl_state_t *afl, u8 *fname, u32 *min_len, u32 *max_len, afl->extras[afl->extras_cnt].len = klen; if (afl->extras[afl->extras_cnt].len > MAX_DICT_FILE) - FATAL("Keyword too big in line %u (%s, limit is %s)", cur_line, DMS(klen), - DMS(MAX_DICT_FILE)); + FATAL("Keyword too big in line %u (%s, limit is %s)", cur_line, + DMS(int_bufs[0], sizeof(int_bufs[0]), klen), + DMS(int_bufs[1], sizeof(int_bufs[1]), MAX_DICT_FILE)); if (*min_len > klen) *min_len = klen; if (*max_len < klen) *max_len = klen; @@ -193,6 +196,8 @@ void load_extras(afl_state_t *afl, u8 *dir) { u32 min_len = MAX_DICT_FILE, max_len = 0, dict_level = 0; u8 * x; + u8 int_bufs[2][16]; + /* If the name ends with @, extract level and continue. */ if ((x = strchr(dir, '@'))) { @@ -238,8 +243,9 @@ void load_extras(afl_state_t *afl, u8 *dir) { } if (st.st_size > MAX_DICT_FILE) - FATAL("Extra '%s' is too big (%s, limit is %s)", fn, DMS(st.st_size), - DMS(MAX_DICT_FILE)); + FATAL("Extra '%s' is too big (%s, limit is %s)", fn, + DMS(int_bufs[0], sizeof(int_bufs[0]), st.st_size), + DMS(int_bufs[1], sizeof(int_bufs[1]), MAX_DICT_FILE)); if (min_len > st.st_size) min_len = st.st_size; if (max_len < st.st_size) max_len = st.st_size; @@ -273,11 +279,12 @@ check_and_sort: compare_extras_len); OKF("Loaded %u extra tokens, size range %s to %s.", afl->extras_cnt, - DMS(min_len), DMS(max_len)); + DMS(int_bufs[0], sizeof(int_bufs[0]), min_len), + DMS(int_bufs[1], sizeof(int_bufs[1]), max_len)); if (max_len > 32) WARNF("Some tokens are relatively large (%s) - consider trimming.", - DMS(max_len)); + DMS(int_bufs[0], sizeof(int_bufs[0]), max_len)); if (afl->extras_cnt > MAX_DET_EXTRAS) WARNF("More than %d tokens - will use them probabilistically.", diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c index 48ccbe9c..4d68ee78 100644 --- a/src/afl-fuzz-init.c +++ b/src/afl-fuzz-init.c @@ -323,6 +323,8 @@ void read_testcases(afl_state_t *afl) { u32 i; u8 * fn1; + u8 int_buf[12][16]; + /* Auto-detect non-in-place resumption attempts. */ fn1 = alloc_printf("%s/queue", afl->in_dir); @@ -389,8 +391,9 @@ void read_testcases(afl_state_t *afl) { } if (st.st_size > MAX_FILE) - FATAL("Test case '%s' is too big (%s, limit is %s)", fn2, DMS(st.st_size), - DMS(MAX_FILE)); + FATAL("Test case '%s' is too big (%s, limit is %s)", fn2, + DMS(int_buf[0], sizeof(int_buf[0]), st.st_size), + DMS(int_buf[1], sizeof(int_buf[1]), MAX_FILE)); /* Check for metadata that indicates that deterministic fuzzing is complete for this entry. We don't want to repeat deterministic @@ -553,6 +556,8 @@ void perform_dry_run(afl_state_t *afl) { if (afl->fsrv.mem_limit) { + u8 int_tmp[16]; + SAYF("\n" cLRD "[-] " cRST "Oops, the program crashed with one of the test cases provided. " "There are\n" @@ -593,8 +598,8 @@ void perform_dry_run(afl_state_t *afl) { "other options\n" " fail, poke for " "troubleshooting tips.\n", - DMS(afl->fsrv.mem_limit << 20), afl->fsrv.mem_limit - 1, - doc_path); + DMS(int_tmp, sizeof(int_tmp), afl->fsrv.mem_limit << 20), + afl->fsrv.mem_limit - 1, doc_path); } else { diff --git a/src/afl-fuzz-misc.c b/src/afl-fuzz-misc.c index 90e0ee8a..c6117bd9 100644 --- a/src/afl-fuzz-misc.c +++ b/src/afl-fuzz-misc.c @@ -25,27 +25,22 @@ #include "afl-fuzz.h" -/* Describe integer. Uses 12 cyclic static buffers for return values. The value - returned should be five characters or less for all the integers we reasonably - expect to see. */ - -u8 *DI(u64 val) { - - static u8 tmp[12][16]; - static u8 cur; - - cur = (cur + 1) % 12; - -#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \ - do { \ - \ - if (val < (_divisor) * (_limit_mult)) { \ - \ - sprintf(tmp[cur], _fmt, ((_cast)val) / (_divisor)); \ - return tmp[cur]; \ - \ - } \ - \ +/* Describe integer. The buf should be + at least 6 bytes to fit all ints we randomly see. + Will return buf for convenience. */ + +u8 *DI(u8 *buf, size_t len, u64 val) { +\ +#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \ + do { \ + \ + if (val < (_divisor) * (_limit_mult)) { \ + \ + snprintf(buf, len, _fmt, ((_cast)val) / (_divisor)); \ + return buf; \ + \ + } \ + \ } while (0) /* 0-9999 */ @@ -82,44 +77,38 @@ u8 *DI(u64 val) { CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 99.95, "%0.01fT", double); /* 100T+ */ - strcpy(tmp[cur], "infty"); - return tmp[cur]; + strncpy(buf, "infty", len); + buf[len - 1] = '\0'; -} + return buf; -/* Describe float. Similar to the above, except with a single - static buffer. */ +} -u8 *DF(double val) { +/* Describe float. Similar as int. */ - static u8 tmp[16]; +u8 *DF(u8 *buf, size_t len, double val) { if (val < 99.995) { - sprintf(tmp, "%0.02f", val); - return tmp; + snprintf(buf, len, "%0.02f", val); - } + } else if (val < 999.95) { + + snprintf(buf, len, "%0.01f", val); - if (val < 999.95) { + } else { - sprintf(tmp, "%0.01f", val); - return tmp; + DI(buf, len, (u64)val); } - return DI((u64)val); + return buf; } /* Describe integer as memory size. */ -u8 *DMS(u64 val) { - - static u8 tmp[12][16]; - static u8 cur; - - cur = (cur + 1) % 12; +u8 *DMS(u8 *buf, size_t len, u64 val) { /* 0-9999 */ CHK_FORMAT(1, 10000, "%llu B", u64); @@ -157,17 +146,21 @@ u8 *DMS(u64 val) { #undef CHK_FORMAT /* 100T+ */ - strcpy(tmp[cur], "infty"); - return tmp[cur]; + strncpy(buf, "infty", len - 1); + buf[len - 1] = '\0'; + + return buf; } -/* Describe time delta as string. */ +/* Describe time delta as string. + Returns a pointer to buf for convenience. */ -void DTD(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) { +u8 *DTD(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) { u64 delta; s32 t_d, t_h, t_m, t_s; + u8 int_buf[16]; if (!event_ms) snprintf(buf, len, "none seen yet"); @@ -178,7 +171,10 @@ void DTD(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) { t_m = (delta / 1000 / 60) % 60; t_s = (delta / 1000) % 60; - snprintf(buf, len, "%s days, %d hrs, %d min, %d sec", DI(t_d), t_h, t_m, t_s); + DI(int_buf, sizeof(int_buf), t_d); + snprintf(buf, len, "%s days, %d hrs, %d min, %d sec", int_buf, t_h, t_m, t_s); + + return buf; } diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c index 9788da49..032c61fe 100644 --- a/src/afl-fuzz-mutators.c +++ b/src/afl-fuzz-mutators.c @@ -196,6 +196,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) { u32 trim_exec = 0; u32 orig_len = q->len; + u8 int_buf[16]; + if (afl->stage_name != afl->stage_name_buf) afl->stage_name = afl->stage_name_buf; afl->bytes_trim_in += q->len; @@ -210,7 +212,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) { while (afl->stage_cur < afl->stage_max) { - snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "ptrim %s", DI(trim_exec)); + snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "ptrim %s", + DI(int_buf, sizeof(int_buf), trim_exec)); u32 cksum; diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c index 500c5ba2..c8153857 100644 --- a/src/afl-fuzz-run.c +++ b/src/afl-fuzz-run.c @@ -603,6 +603,8 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) { u32 remove_len; u32 len_p2; + u8 int_bufs[2][16]; + /* Although the trimmer will be less useful when variable behavior is detected, it will still work to some extent, so we don't check for this. */ @@ -626,8 +628,9 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) { u32 remove_pos = remove_len; - snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "trim %s/%s", DI(remove_len), - DI(remove_len)); + snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "trim %s/%s", + DI(int_bufs[0], sizeof(int_bufs[0]), remove_len), + DI(int_bufs[1], sizeof(int_bufs[1]), remove_len)); afl->stage_cur = 0; afl->stage_max = q->len / remove_len; diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index c89820d8..dcd4f542 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -201,6 +201,9 @@ void show_stats(afl_state_t *afl) { u8 tmp[256]; u8 time_tmp[64]; + u8 int_buf[16][16]; +#define IB(i) int_buf[(i)], sizeof(int_buf[(i)]) + cur_ms = get_cur_time(); /* If not enough time has passed since last UI update, bail out. */ @@ -390,7 +393,7 @@ void show_stats(afl_state_t *afl) { DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->start_time); SAYF(bV bSTOP " run time : " cRST "%-33s " bSTG bV bSTOP " cycles done : %s%-5s " bSTG bV "\n", - time_tmp, tmp, DI(afl->queue_cycle - 1)); + time_tmp, tmp, DI(IB(0), afl->queue_cycle - 1)); /* We want to warn people about not seeing new paths after a full cycle, except when resuming fuzzing or running in non-instrumented mode. */ @@ -417,12 +420,12 @@ void show_stats(afl_state_t *afl) { } SAYF(bSTG bV bSTOP " total paths : " cRST "%-5s " bSTG bV "\n", - DI(afl->queued_paths)); + DI(IB(0), afl->queued_paths)); /* Highlight crashes in red if found, denote going over the KEEP_UNIQUE_CRASH limit with a '+' appended to the count. */ - sprintf(tmp, "%s%s", DI(afl->unique_crashes), + sprintf(tmp, "%s%s", DI(IB(0), afl->unique_crashes), (afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : ""); DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_crash_time); @@ -430,7 +433,7 @@ void show_stats(afl_state_t *afl) { " uniq crashes : %s%-6s" bSTG bV "\n", time_tmp, afl->unique_crashes ? cLRD : cRST, tmp); - sprintf(tmp, "%s%s", DI(afl->unique_hangs), + sprintf(tmp, "%s%s", DI(IB(0), afl->unique_hangs), (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : ""); DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_hang_time); @@ -446,7 +449,7 @@ void show_stats(afl_state_t *afl) { together, but then cram them into a fixed-width field - so we need to put them in a temporary buffer first. */ - sprintf(tmp, "%s%s%u (%0.01f%%)", DI(afl->current_entry), + sprintf(tmp, "%s%s%u (%0.01f%%)", DI(IB(0), afl->current_entry), afl->queue_cur->favored ? "." : "*", afl->queue_cur->fuzz_level, ((double)afl->current_entry * 100) / afl->queued_paths); @@ -460,7 +463,7 @@ void show_stats(afl_state_t *afl) { : ((t_bytes < 200 && !afl->dumb_mode) ? cPIN : cRST), tmp); - sprintf(tmp, "%s (%0.02f%%)", DI(afl->cur_skipped_paths), + sprintf(tmp, "%s (%0.02f%%)", DI(IB(0), afl->cur_skipped_paths), ((double)afl->cur_skipped_paths * 100) / afl->queued_paths); SAYF(bV bSTOP " paths timed out : " cRST "%-16s " bSTG bV, tmp); @@ -473,7 +476,7 @@ void show_stats(afl_state_t *afl) { " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); - sprintf(tmp, "%s (%0.02f%%)", DI(afl->queued_favored), + sprintf(tmp, "%s (%0.02f%%)", DI(IB(0), afl->queued_favored), ((double)afl->queued_favored) * 100 / afl->queued_paths); /* Yeah... it's still going on... halp? */ @@ -484,37 +487,38 @@ void show_stats(afl_state_t *afl) { if (!afl->stage_max) { - sprintf(tmp, "%s/-", DI(afl->stage_cur)); + sprintf(tmp, "%s/-", DI(IB(0), afl->stage_cur)); } else { - sprintf(tmp, "%s/%s (%0.02f%%)", DI(afl->stage_cur), DI(afl->stage_max), + sprintf(tmp, "%s/%s (%0.02f%%)", DI(IB(0), afl->stage_cur), + DI(IB(1), afl->stage_max), ((double)afl->stage_cur) * 100 / afl->stage_max); } SAYF(bV bSTOP " stage execs : " cRST "%-21s" bSTG bV bSTOP, tmp); - sprintf(tmp, "%s (%0.02f%%)", DI(afl->queued_with_cov), + sprintf(tmp, "%s (%0.02f%%)", DI(IB(0), afl->queued_with_cov), ((double)afl->queued_with_cov) * 100 / afl->queued_paths); SAYF(" new edges on : " cRST "%-22s" bSTG bV "\n", tmp); - sprintf(tmp, "%s (%s%s unique)", DI(afl->total_crashes), - DI(afl->unique_crashes), + sprintf(tmp, "%s (%s%s unique)", DI(IB(0), afl->total_crashes), + DI(IB(1), afl->unique_crashes), (afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : ""); if (afl->crash_mode) { SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP " new crashes : %s%-22s" bSTG bV "\n", - DI(afl->total_execs), afl->unique_crashes ? cLRD : cRST, tmp); + DI(IB(0), afl->total_execs), afl->unique_crashes ? cLRD : cRST, tmp); } else { SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP " total crashes : %s%-22s" bSTG bV "\n", - DI(afl->total_execs), afl->unique_crashes ? cLRD : cRST, tmp); + DI(IB(0), afl->total_execs), afl->unique_crashes ? cLRD : cRST, tmp); } @@ -522,21 +526,21 @@ void show_stats(afl_state_t *afl) { if (afl->stats_avg_exec < 100) { - sprintf(tmp, "%s/sec (%s)", DF(afl->stats_avg_exec), - afl->stats_avg_exec < 20 ? "zzzz..." : "slow!"); + snprintf(tmp, sizeof(tmp), "%s/sec (%s)", DF(IB(0), afl->stats_avg_exec), + afl->stats_avg_exec < 20 ? "zzzz..." : "slow!"); SAYF(bV bSTOP " exec speed : " cLRD "%-20s ", tmp); } else { - sprintf(tmp, "%s/sec", DF(afl->stats_avg_exec)); + snprintf(tmp, sizeof(tmp), "%s/sec", DF(IB(0), afl->stats_avg_exec)); SAYF(bV bSTOP " exec speed : " cRST "%-20s ", tmp); } - sprintf(tmp, "%s (%s%s unique)", DI(afl->total_tmouts), - DI(afl->unique_tmouts), - (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : ""); + snprintf(tmp, sizeof(tmp), "%s (%s%s unique)", DI(IB(0), afl->total_tmouts), + DI(IB(1), afl->unique_tmouts), + (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : ""); SAYF(bSTG bV bSTOP " total tmouts : " cRST "%-22s" bSTG bV "\n", tmp); @@ -548,74 +552,84 @@ void show_stats(afl_state_t *afl) { if (afl->skip_deterministic) { - strcpy(tmp, "n/a, n/a, n/a"); + strncpy(tmp, "n/a, n/a, n/a", sizeof(tmp) - 1); + tmp[sizeof(tmp) - 1] = '\0'; } else { - sprintf( - tmp, "%s/%s, %s/%s, %s/%s", DI(afl->stage_finds[STAGE_FLIP1]), - DI(afl->stage_cycles[STAGE_FLIP1]), DI(afl->stage_finds[STAGE_FLIP2]), - DI(afl->stage_cycles[STAGE_FLIP2]), DI(afl->stage_finds[STAGE_FLIP4]), - DI(afl->stage_cycles[STAGE_FLIP4])); + snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", + DI(IB(0), afl->stage_finds[STAGE_FLIP1]), + DI(IB(1), afl->stage_cycles[STAGE_FLIP1]), + DI(IB(2), afl->stage_finds[STAGE_FLIP2]), + DI(IB(3), afl->stage_cycles[STAGE_FLIP2]), + DI(IB(3), afl->stage_finds[STAGE_FLIP4]), + DI(IB(5), afl->stage_cycles[STAGE_FLIP4])); } SAYF(bV bSTOP " bit flips : " cRST "%-36s " bSTG bV bSTOP " levels : " cRST "%-10s" bSTG bV "\n", - tmp, DI(afl->max_depth)); + tmp, DI(IB(0), afl->max_depth)); if (!afl->skip_deterministic) - sprintf( - tmp, "%s/%s, %s/%s, %s/%s", DI(afl->stage_finds[STAGE_FLIP8]), - DI(afl->stage_cycles[STAGE_FLIP8]), DI(afl->stage_finds[STAGE_FLIP16]), - DI(afl->stage_cycles[STAGE_FLIP16]), DI(afl->stage_finds[STAGE_FLIP32]), - DI(afl->stage_cycles[STAGE_FLIP32])); + snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", + DI(IB(0), afl->stage_finds[STAGE_FLIP8]), + DI(IB(1), afl->stage_cycles[STAGE_FLIP8]), + DI(IB(2), afl->stage_finds[STAGE_FLIP16]), + DI(IB(3), afl->stage_cycles[STAGE_FLIP16]), + DI(IB(4), afl->stage_finds[STAGE_FLIP32]), + DI(IB(5), afl->stage_cycles[STAGE_FLIP32])); SAYF(bV bSTOP " byte flips : " cRST "%-36s " bSTG bV bSTOP " pending : " cRST "%-10s" bSTG bV "\n", - tmp, DI(afl->pending_not_fuzzed)); + tmp, DI(IB(0), afl->pending_not_fuzzed)); if (!afl->skip_deterministic) - sprintf(tmp, "%s/%s, %s/%s, %s/%s", DI(afl->stage_finds[STAGE_ARITH8]), - DI(afl->stage_cycles[STAGE_ARITH8]), - DI(afl->stage_finds[STAGE_ARITH16]), - DI(afl->stage_cycles[STAGE_ARITH16]), - DI(afl->stage_finds[STAGE_ARITH32]), - DI(afl->stage_cycles[STAGE_ARITH32])); + snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", + DI(IB(0), afl->stage_finds[STAGE_ARITH8]), + DI(IB(1), afl->stage_cycles[STAGE_ARITH8]), + DI(IB(2), afl->stage_finds[STAGE_ARITH16]), + DI(IB(3), afl->stage_cycles[STAGE_ARITH16]), + DI(IB(4), afl->stage_finds[STAGE_ARITH32]), + DI(IB(5), afl->stage_cycles[STAGE_ARITH32])); SAYF(bV bSTOP " arithmetics : " cRST "%-36s " bSTG bV bSTOP " pend fav : " cRST "%-10s" bSTG bV "\n", - tmp, DI(afl->pending_favored)); + tmp, DI(IB(0), afl->pending_favored)); if (!afl->skip_deterministic) - sprintf(tmp, "%s/%s, %s/%s, %s/%s", DI(afl->stage_finds[STAGE_INTEREST8]), - DI(afl->stage_cycles[STAGE_INTEREST8]), - DI(afl->stage_finds[STAGE_INTEREST16]), - DI(afl->stage_cycles[STAGE_INTEREST16]), - DI(afl->stage_finds[STAGE_INTEREST32]), - DI(afl->stage_cycles[STAGE_INTEREST32])); + sprintf(tmp, "%s/%s, %s/%s, %s/%s", + DI(IB(0), afl->stage_finds[STAGE_INTEREST8]), + DI(IB(1), afl->stage_cycles[STAGE_INTEREST8]), + DI(IB(2), afl->stage_finds[STAGE_INTEREST16]), + DI(IB(3), afl->stage_cycles[STAGE_INTEREST16]), + DI(IB(4), afl->stage_finds[STAGE_INTEREST32]), + DI(IB(5), afl->stage_cycles[STAGE_INTEREST32])); SAYF(bV bSTOP " known ints : " cRST "%-36s " bSTG bV bSTOP " own finds : " cRST "%-10s" bSTG bV "\n", - tmp, DI(afl->queued_discovered)); + tmp, DI(IB(0), afl->queued_discovered)); if (!afl->skip_deterministic) - sprintf(tmp, "%s/%s, %s/%s, %s/%s", DI(afl->stage_finds[STAGE_EXTRAS_UO]), - DI(afl->stage_cycles[STAGE_EXTRAS_UO]), - DI(afl->stage_finds[STAGE_EXTRAS_UI]), - DI(afl->stage_cycles[STAGE_EXTRAS_UI]), - DI(afl->stage_finds[STAGE_EXTRAS_AO]), - DI(afl->stage_cycles[STAGE_EXTRAS_AO])); + snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", + DI(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]), + DI(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]), + DI(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]), + DI(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]), + DI(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]), + DI(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO])); SAYF(bV bSTOP " dictionary : " cRST "%-36s " bSTG bV bSTOP " imported : " cRST "%-10s" bSTG bV "\n", - tmp, afl->sync_id ? DI(afl->queued_imported) : (u8 *)"n/a"); + tmp, afl->sync_id ? DI(IB(0), afl->queued_imported) : (u8 *)"n/a"); - sprintf( - tmp, "%s/%s, %s/%s, %s/%s", DI(afl->stage_finds[STAGE_HAVOC]), - DI(afl->stage_cycles[STAGE_HAVOC]), DI(afl->stage_finds[STAGE_SPLICE]), - DI(afl->stage_cycles[STAGE_SPLICE]), DI(afl->stage_finds[STAGE_RADAMSA]), - DI(afl->stage_cycles[STAGE_RADAMSA])); + snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", + DI(IB(0), afl->stage_finds[STAGE_HAVOC]), + DI(IB(2), afl->stage_cycles[STAGE_HAVOC]), + DI(IB(3), afl->stage_finds[STAGE_SPLICE]), + DI(IB(4), afl->stage_cycles[STAGE_SPLICE]), + DI(IB(5), afl->stage_finds[STAGE_RADAMSA]), + DI(IB(6), afl->stage_cycles[STAGE_RADAMSA])); SAYF(bV bSTOP " havoc/rad : " cRST "%-36s " bSTG bV bSTOP, tmp); @@ -635,24 +649,26 @@ void show_stats(afl_state_t *afl) { if (afl->shm.cmplog_mode) { - sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s", - DI(afl->stage_finds[STAGE_PYTHON]), - DI(afl->stage_cycles[STAGE_PYTHON]), - DI(afl->stage_finds[STAGE_CUSTOM_MUTATOR]), - DI(afl->stage_cycles[STAGE_CUSTOM_MUTATOR]), - DI(afl->stage_finds[STAGE_COLORIZATION]), - DI(afl->stage_cycles[STAGE_COLORIZATION]), - DI(afl->stage_finds[STAGE_ITS]), DI(afl->stage_cycles[STAGE_ITS])); + snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s, %s/%s", + DI(IB(0), afl->stage_finds[STAGE_PYTHON]), + DI(IB(1), afl->stage_cycles[STAGE_PYTHON]), + DI(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), + DI(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]), + DI(IB(4), afl->stage_finds[STAGE_COLORIZATION]), + DI(IB(5), afl->stage_cycles[STAGE_COLORIZATION]), + DI(IB(6), afl->stage_finds[STAGE_ITS]), + DI(IB(7), afl->stage_cycles[STAGE_ITS])); SAYF(bV bSTOP " custom/rq : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n", tmp); } else { - sprintf(tmp, "%s/%s, %s/%s", DI(afl->stage_finds[STAGE_PYTHON]), - DI(afl->stage_cycles[STAGE_PYTHON]), - DI(afl->stage_finds[STAGE_CUSTOM_MUTATOR]), - DI(afl->stage_cycles[STAGE_CUSTOM_MUTATOR])); + snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s", + DI(IB(0), afl->stage_finds[STAGE_PYTHON]), + DI(IB(1), afl->stage_cycles[STAGE_PYTHON]), + DI(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), + DI(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR])); SAYF(bV bSTOP " py/custom : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n", tmp); @@ -668,7 +684,7 @@ void show_stats(afl_state_t *afl) { sprintf(tmp, "%0.02f%%/%s, ", ((double)(afl->bytes_trim_in - afl->bytes_trim_out)) * 100 / afl->bytes_trim_in, - DI(afl->trim_execs)); + DI(IB(0), afl->trim_execs)); } @@ -693,8 +709,8 @@ void show_stats(afl_state_t *afl) { if (afl->mutator) { - sprintf(tmp, "%s/%s", DI(afl->stage_finds[STAGE_CUSTOM_MUTATOR]), - DI(afl->stage_cycles[STAGE_CUSTOM_MUTATOR])); + sprintf(tmp, "%s/%s", DI(IB(0), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), + DI(IB(1), afl->stage_cycles[STAGE_CUSTOM_MUTATOR])); SAYF(bV bSTOP " custom mut. : " cRST "%-36s " bSTG bV RESET_G1, tmp); } else { @@ -749,6 +765,8 @@ void show_stats(afl_state_t *afl) { /* Last line */ SAYF(SET_G1 "\n" bSTG bLB bH30 bH20 bH2 bRB bSTOP cRST RESET_G1); +#undef IB + /* Hallelujah! */ fflush(0); @@ -767,6 +785,9 @@ void show_init_stats(afl_state_t *afl) { u64 avg_us = 0; u32 max_len = 0; + u8 int_buf[12][16]; +#define IB(i) int_buf[(i)], sizeof(int_buf[(i)]) + if (afl->total_cal_cycles) avg_us = afl->total_cal_us / afl->total_cal_cycles; while (q) { @@ -802,10 +823,10 @@ void show_init_stats(afl_state_t *afl) { if (max_len > 50 * 1024) WARNF(cLRD "Some test cases are huge (%s) - see %s/perf_tips.md!", - DMS(max_len), doc_path); + DMS(IB(0), max_len), doc_path); else if (max_len > 10 * 1024) - WARNF("Some test cases are big (%s) - see %s/perf_tips.md.", DMS(max_len), - doc_path); + WARNF("Some test cases are big (%s) - see %s/perf_tips.md.", + DMS(IB(0), max_len), doc_path); if (afl->useless_at_start && !afl->in_bitmap) WARNF(cLRD "Some test cases look useless. Consider using a smaller set."); @@ -829,7 +850,7 @@ void show_init_stats(afl_state_t *afl) { max_bits, ((double)afl->total_bitmap_size) / (afl->total_bitmap_entries ? afl->total_bitmap_entries : 1), - DI(min_us), DI(max_us), DI(avg_us)); + DI(IB(0), min_us), DI(IB(1), max_us), DI(IB(2), avg_us)); if (!afl->timeout_given) { @@ -873,6 +894,7 @@ void show_init_stats(afl_state_t *afl) { afl->hang_tmout = MIN(EXEC_TIMEOUT, afl->fsrv.exec_tmout * 2 + 100); OKF("All set and ready to roll!"); +#undef IB } -- cgit 1.4.1 From 29853549c3c12b4ebd4c2af4f0d728a13f30a727 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Fri, 20 Mar 2020 08:54:09 +0100 Subject: add RARE schedule. also fixes doc_path --- README.md | 5 +++-- docs/Changelog.md | 9 +++++---- docs/power_schedules.md | 1 + include/afl-fuzz.h | 1 + include/android-ashmem.h | 0 src/afl-fuzz-globals.c | 5 +++-- src/afl-fuzz-queue.c | 49 ++++++++++++++++++++++++++++++++++++------------ src/afl-fuzz-stats.c | 25 +++++++++++++----------- src/afl-fuzz.c | 13 +++++++++---- 9 files changed, 73 insertions(+), 35 deletions(-) mode change 100755 => 100644 include/android-ashmem.h (limited to 'src/afl-fuzz-stats.c') diff --git a/README.md b/README.md index ca321f31..5125928e 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,7 @@ * [dev](https://github.com/AFLplusplus/AFLplusplus/tree/dev) : development state of afl++ - bleeding edge and you might catch a checkout which does not compile or has a bug. *We only accept PRs in dev!!* * (any other) : experimental branches to work on specific features or testing - new functionality or changes + new functionality or changes. For releases, please see the [Releases](https://github.com/AFLplusplus/AFLplusplus/releases) tab. @@ -365,7 +365,8 @@ The available schedules are: - quad - lin - exploit - - mmopt + - mmopt (experimental) + - rare (experimental) In parallel mode (-M/-S, several instances with shared queue), we suggest to run the master using the explore or fast schedule (-p explore) and the slaves diff --git a/docs/Changelog.md b/docs/Changelog.md index 1fb78625..3eb5d329 100644 --- a/docs/Changelog.md +++ b/docs/Changelog.md @@ -24,10 +24,11 @@ sending a mail to . - python mutator modules and custom mutator modules now use the same interface and hence the API changed - AFL_AUTORESUME will resume execution without the need to specify `-i -` - - added experimental power schedule -p mmopt that ignores the runtime of - queue entries and gives higher weighting to the last 5 queue entries - it is currently experimental and subject to change but preliminary - results are good + - added experimental power schedules (-p): + - mmopt: ignores runtime of queue entries, gives higher weighting to + the last 5 queue entries + - rare: puts focus on queue entries that hits rare branches, also ignores + runtime - LTO collision free instrumented added in llvm_mode with afl-clang-lto - note that this mode is amazing, but quite some targets won't compile - llvm_mode InsTrim mode: diff --git a/docs/power_schedules.md b/docs/power_schedules.md index cdada0f6..c69c64d2 100644 --- a/docs/power_schedules.md +++ b/docs/power_schedules.md @@ -20,6 +20,7 @@ We find that AFL's exploitation-based constant schedule assigns **too much energ | `-p lin` | ![LIN](http://latex.codecogs.com/gif.latex?p%28i%29%20%3D%20%5Cmin%5Cleft%28%5Cfrac%7B%5Calpha%28i%29%7D%7B%5Cbeta%7D%5Ccdot%5Cfrac%7Bs%28i%29%7D%7Bf%28i%29%7D%2CM%5Cright%29) | | `-p exploit` (AFL) | ![LIN](http://latex.codecogs.com/gif.latex?p%28i%29%20%3D%20%5Calpha%28i%29) | | `-p mmopt` | Experimental: `explore` with no weighting to runtime and increased weighting on the last 5 queue entries | +| `-p rare` | Experimental: `rare` puts focus on queue entries that hit rare edges | where *α(i)* is the performance score that AFL uses to compute for the seed input *i*, *β(i)>1* is a constant, *s(i)* is the number of times that seed *i* has been chosen from the queue, *f(i)* is the number of generated inputs that exercise the same path as seed *i*, and *μ* is the average number of generated inputs exercising a path. More details can be found in the paper that was accepted at the [23rd ACM Conference on Computer and Communications Security (CCS'16)](https://www.sigsac.org/ccs/CCS2016/accepted-papers/). diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index 1a798239..1d83f335 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -235,6 +235,7 @@ enum { /* 04 */ QUAD, /* Quadratic schedule */ /* 05 */ EXPLOIT, /* AFL's exploitation-based const. */ /* 06 */ MMOPT, /* Modified MOPT schedule */ + /* 07 */ RARE, /* Rare edges */ POWER_SCHEDULES_NUM diff --git a/include/android-ashmem.h b/include/android-ashmem.h old mode 100755 new mode 100644 diff --git a/src/afl-fuzz-globals.c b/src/afl-fuzz-globals.c index dbd8c835..88633a1b 100644 --- a/src/afl-fuzz-globals.c +++ b/src/afl-fuzz-globals.c @@ -30,8 +30,9 @@ s8 interesting_8[] = {INTERESTING_8}; s16 interesting_16[] = {INTERESTING_8, INTERESTING_16}; s32 interesting_32[] = {INTERESTING_8, INTERESTING_16, INTERESTING_32}; -char *power_names[POWER_SCHEDULES_NUM] = {"explore", "fast", "coe", "lin", - "quad", "exploit", "mmopt"}; +char *power_names[POWER_SCHEDULES_NUM] = { + + "explore", "fast", "coe", "lin", "quad", "exploit", "mmopt", "rare"}; u8 *doc_path = NULL; /* gath to documentation dir */ diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c index 8a995727..f49e1f1e 100644 --- a/src/afl-fuzz-queue.c +++ b/src/afl-fuzz-queue.c @@ -185,12 +185,16 @@ void destroy_queue(afl_state_t *afl) { void update_bitmap_score(afl_state_t *afl, struct queue_entry *q) { u32 i; - u64 fav_factor = q->exec_us * q->len; + u64 fav_factor; u64 fuzz_p2 = next_p2(q->n_fuzz); + if (afl->schedule == MMOPT || afl->schedule == RARE) + fav_factor = q->len << 2; + else + fav_factor = q->exec_us * q->len; + /* For every byte set in afl->fsrv.trace_bits[], see if there is a previous winner, and how it compares to us. */ - for (i = 0; i < MAP_SIZE; ++i) if (afl->fsrv.trace_bits[i]) { @@ -198,20 +202,20 @@ void update_bitmap_score(afl_state_t *afl, struct queue_entry *q) { if (afl->top_rated[i]) { /* Faster-executing or smaller test cases are favored. */ + u64 top_rated_fav_factor; u64 top_rated_fuzz_p2 = next_p2(afl->top_rated[i]->n_fuzz); - u64 top_rated_fav_factor = - afl->top_rated[i]->exec_us * afl->top_rated[i]->len; - if (fuzz_p2 > top_rated_fuzz_p2) { + if (afl->schedule == MMOPT || afl->schedule == RARE) + top_rated_fav_factor = afl->top_rated[i]->len << 2; + else + top_rated_fav_factor = + afl->top_rated[i]->exec_us * afl->top_rated[i]->len; + if (fuzz_p2 > top_rated_fuzz_p2) continue; - - } else if (fuzz_p2 == top_rated_fuzz_p2) { - + else if (fuzz_p2 == top_rated_fuzz_p2) if (fav_factor > top_rated_fav_factor) continue; - } - if (fav_factor > afl->top_rated[i]->exec_us * afl->top_rated[i]->len) continue; @@ -328,7 +332,7 @@ u32 calculate_score(afl_state_t *afl, struct queue_entry *q) { // Longer execution time means longer work on the input, the deeper in // coverage, the better the fuzzing, right? -mh - if (afl->schedule != MMOPT) { + if (afl->schedule != MMOPT && afl->schedule != RARE) { if (q->exec_us * 0.1 > avg_exec_us) perf_score = 10; @@ -448,8 +452,29 @@ u32 calculate_score(afl_state_t *afl, struct queue_entry *q) { break; case MMOPT: + /* -- this was a more complex setup, which is good, but competed with + -- rare. the simpler algo however is good when rare is not. + // the newer the entry, the higher the pref_score + perf_score *= (1 + (double)((double)q->depth / + (double)afl->queued_paths)); + // with special focus on the last 8 entries + if (afl->max_depth - q->depth < 8) perf_score *= (1 + ((8 - + (afl->max_depth - q->depth)) / 5)); + */ + // put focus on the last 5 entries + if (afl->max_depth - q->depth < 5) perf_score *= 2; + + break; + + case RARE: - if (afl->max_depth - q->depth < 5) perf_score *= 1.5; + // increase the score for every bitmap byte for which this entry + // is the top contender + perf_score += (q->tc_ref * 10); + // the more often fuzz result paths are equal to this queue entry, + // reduce its value + perf_score *= + (1 - (double)((double)q->n_fuzz / (double)afl->total_execs)); break; diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index dcd4f542..6ea6a8e9 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -32,9 +32,10 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability, struct rusage rus; - u8 * fn = alloc_printf("%s/fuzzer_stats", afl->out_dir); - s32 fd; - FILE *f; + unsigned long long int cur_time = get_cur_time(); + u8 * fn = alloc_printf("%s/fuzzer_stats", afl->out_dir); + s32 fd; + FILE * f; fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600); @@ -69,6 +70,7 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability, f, "start_time : %llu\n" "last_update : %llu\n" + "run_time : %llu\n" "fuzzer_pid : %d\n" "cycles_done : %llu\n" "execs_done : %llu\n" @@ -99,7 +101,8 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability, "\n" "target_mode : %s%s%s%s%s%s%s%s\n" "command_line : %s\n", - afl->start_time / 1000, get_cur_time() / 1000, getpid(), + afl->start_time / 1000, cur_time / 1000, + (cur_time - afl->start_time) / 1000, getpid(), afl->queue_cycle ? (afl->queue_cycle - 1) : 0, afl->total_execs, /*eps,*/ afl->total_execs / ((double)(get_cur_time() - afl->start_time) / 1000), @@ -357,9 +360,9 @@ void show_stats(afl_state_t *afl) { /* Lord, forgive me this. */ - SAYF(SET_G1 bSTG bLT bH bSTOP cCYA + SAYF(SET_G1 bSTG bLT bH bSTOP cCYA " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA - " overall results " bSTG bH2 bH2 bRT "\n"); + " overall results " bSTG bH2 bH2 bRT "\n"); if (afl->dumb_mode) { @@ -441,9 +444,9 @@ void show_stats(afl_state_t *afl) { " uniq hangs : " cRST "%-6s" bSTG bV "\n", time_tmp, tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA - " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); + " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); /* This gets funny because we want to print several variable-length variables together, but then cram them into a fixed-width field - so we need to @@ -472,9 +475,9 @@ void show_stats(afl_state_t *afl) { SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA - " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); + " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); sprintf(tmp, "%s (%0.02f%%)", DI(IB(0), afl->queued_favored), ((double)afl->queued_favored) * 100 / afl->queued_paths); @@ -546,7 +549,7 @@ void show_stats(afl_state_t *afl) { /* Aaaalmost there... hold on! */ - SAYF(bVR bH cCYA bSTOP + SAYF(bVR bH cCYA bSTOP " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA " path geometry " bSTG bH5 bH2 bVL "\n"); diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 10fee76c..15caa65f 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -96,8 +96,8 @@ static void usage(afl_state_t *afl, u8 *argv0, int more_help) { "Execution control settings:\n" " -p schedule - power schedules recompute a seed's performance " "score.\n" - " \n" + " \n" " see docs/power_schedules.md\n" " -f file - location read by the fuzzed program (stdin)\n" " -t msec - timeout for each run (auto-scaled, 50-%d ms)\n" @@ -250,7 +250,7 @@ int main(int argc, char **argv_orig, char **envp) { SAYF(cCYA "afl-fuzz" VERSION cRST " based on afl by Michal Zalewski and a big online community\n"); - doc_path = access(DOC_PATH, F_OK) ? (u8 *)"docs" : doc_path; + doc_path = access(DOC_PATH, F_OK) != 0 ? (u8 *)"docs" : (u8 *)DOC_PATH; gettimeofday(&tv, &tz); afl->init_seed = tv.tv_sec ^ tv.tv_usec ^ getpid(); @@ -304,6 +304,10 @@ int main(int argc, char **argv_orig, char **envp) { afl->schedule = MMOPT; + } else if (!stricmp(optarg, "rare")) { + + afl->schedule = RARE; + } else if (!stricmp(optarg, "explore") || !stricmp(optarg, "default") || !stricmp(optarg, "normal") || !stricmp(optarg, "afl")) { @@ -760,8 +764,9 @@ int main(int argc, char **argv_orig, char **envp) { case LIN: OKF("Using linear power schedule (LIN)"); break; case QUAD: OKF("Using quadratic power schedule (QUAD)"); break; case MMOPT: OKF("Using modified MOpt power schedule (MMOPT)"); break; + case RARE: OKF("Using rare edge focus power schedule (RARE)"); break; case EXPLORE: - OKF("Using exploration-based constant power schedule (EXPLORE)"); + OKF("Using exploration-based constant power schedule (EXPLORE, default)"); break; default: FATAL("Unknown power schedule"); break; -- cgit 1.4.1 From 5d932398dfcd11ef12918919181a37a2a96adb42 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Fri, 20 Mar 2020 09:44:51 +0100 Subject: expose cycles_wo_finds in fuzzer_stats --- docs/status_screen.md | 1 + src/afl-fuzz-stats.c | 7 ++++--- 2 files changed, 5 insertions(+), 3 deletions(-) (limited to 'src/afl-fuzz-stats.c') diff --git a/docs/status_screen.md b/docs/status_screen.md index 34ce3a7e..8b3d5bda 100644 --- a/docs/status_screen.md +++ b/docs/status_screen.md @@ -377,6 +377,7 @@ directory. This includes: - `run_time` - run time in seconds to the last update of this file - `fuzzer_pid` - PID of the fuzzer process - `cycles_done` - queue cycles completed so far + - `cycles_wo_finds` - number of cycles without any new paths found - `execs_done` - number of execve() calls attempted - `execs_per_sec` - overall number of execs per second - `paths_total` - total number of entries in the queue diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index 6ea6a8e9..b6e64841 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -73,6 +73,7 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability, "run_time : %llu\n" "fuzzer_pid : %d\n" "cycles_done : %llu\n" + "cycles_wo_finds : %llu\n" "execs_done : %llu\n" "execs_per_sec : %0.02f\n" // "real_execs_per_sec: %0.02f\n" // damn the name is too long @@ -103,9 +104,9 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability, "command_line : %s\n", afl->start_time / 1000, cur_time / 1000, (cur_time - afl->start_time) / 1000, getpid(), - afl->queue_cycle ? (afl->queue_cycle - 1) : 0, afl->total_execs, - /*eps,*/ afl->total_execs / - ((double)(get_cur_time() - afl->start_time) / 1000), + afl->queue_cycle ? (afl->queue_cycle - 1) : 0, afl->cycles_wo_finds, + afl->total_execs, /*eps,*/ + afl->total_execs / ((double)(get_cur_time() - afl->start_time) / 1000), afl->queued_paths, afl->queued_favored, afl->queued_discovered, afl->queued_imported, afl->max_depth, afl->current_entry, afl->pending_favored, afl->pending_not_fuzzed, afl->queued_variable, -- cgit 1.4.1 From 5a74cffa0f22b4e3b3dbc829dfb1c8f7c7a6fb76 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Fri, 20 Mar 2020 17:10:44 +0100 Subject: added llvm_mode ngram coverage --- README.md | 5 ++ docs/Changelog.md | 3 + docs/PATCHES.md | 1 + docs/env_variables.md | 34 ++++++---- llvm_mode/afl-clang-fast.c | 11 +++- llvm_mode/afl-llvm-pass.so.cc | 134 ++++++++++++++++++++++++++++++++++------ llvm_mode/afl-llvm-rt.o.c | 13 ++-- llvm_mode/llvm-ngram-coverage.h | 18 ++++++ src/afl-common.c | 8 +-- src/afl-fuzz-stats.c | 2 +- 10 files changed, 187 insertions(+), 42 deletions(-) create mode 100644 llvm_mode/llvm-ngram-coverage.h (limited to 'src/afl-fuzz-stats.c') diff --git a/README.md b/README.md index 5125928e..1476b440 100644 --- a/README.md +++ b/README.md @@ -73,6 +73,8 @@ * The new CmpLog instrumentation for LLVM and QEMU inspired by [Redqueen](https://www.syssec.ruhr-uni-bochum.de/media/emma/veroeffentlichungen/2018/12/17/NDSS19-Redqueen.pdf) + * llvm_mode ngram coverage by Adrean Herrera [https://github.com/adrianherrera/afl-ngram-pass](https://github.com/adrianherrera/afl-ngram-pass) + A more thorough list is available in the PATCHES file. | Feature/Instrumentation | afl-gcc | llvm_mode | gcc_plugin | qemu_mode | unicorn_mode | @@ -84,6 +86,7 @@ | Whitelist | | x | x | (x)(3) | | | non-colliding coverage | | x(4) | | (x)(5) | | | InsTrim | | x | | | | + | ngram prev_loc coverage | | x(6) | | | | neverZero: @@ -97,6 +100,8 @@ (5) upcoming, development in branch + (6) not compatible with LTO and InsTrim modes + So all in all this is the best-of afl that is currently out there :-) For new versions and additional information, check out: diff --git a/docs/Changelog.md b/docs/Changelog.md index 3eb5d329..ece2c4b5 100644 --- a/docs/Changelog.md +++ b/docs/Changelog.md @@ -31,6 +31,9 @@ sending a mail to . runtime - LTO collision free instrumented added in llvm_mode with afl-clang-lto - note that this mode is amazing, but quite some targets won't compile + - Added llvm_mode NGRAM prev_loc coverage by Adrean Herrera + (https://github.com/adrianherrera/afl-ngram-pass/), activate by setting + AFL_LLVM_NGRAM_SIZE - llvm_mode InsTrim mode: - removed workaround for bug where paths were not instrumented and imported fix by author diff --git a/docs/PATCHES.md b/docs/PATCHES.md index 1dfb6622..a6783523 100644 --- a/docs/PATCHES.md +++ b/docs/PATCHES.md @@ -20,6 +20,7 @@ afl-qemu-speed.diff by abiondo on github afl-qemu-optimize-map.diff by mh(at)mh-sec(dot)de ``` ++ llvm_mode ngram prev_loc coverage (github.com/adrianherrera/afl-ngram-pass) + Custom mutator (native library) (by kyakdan) + unicorn_mode (modernized and updated by domenukk) + instrim (https://github.com/csienslab/instrim) was integrated diff --git a/docs/env_variables.md b/docs/env_variables.md index 8c7510cd..98f27bdf 100644 --- a/docs/env_variables.md +++ b/docs/env_variables.md @@ -93,23 +93,26 @@ Then there are a few specific features that are only available in llvm_mode: ### LTO -This is a different kind way of instrumentation: first it compiles all -code in LTO (link time optimization) and then performs an edge inserting -instrumentation which is 100% collision free (collisions are a big issue -in afl and afl-like instrumentations). This is performed by using -afl-clang-lto/afl-clang-lto++ instead of afl-clang-fast, but is only -built if LLVM 9 or newer is used. - -None of these options are necessary to be used and are rather for manual -use (which only ever the author of this LTO implementation will use ;-) -These are used if several seperated instrumentation are performed which -are then later combined. + This is a different kind way of instrumentation: first it compiles all + code in LTO (link time optimization) and then performs an edge inserting + instrumentation which is 100% collision free (collisions are a big issue + in afl and afl-like instrumentations). This is performed by using + afl-clang-lto/afl-clang-lto++ instead of afl-clang-fast, but is only + built if LLVM 9 or newer is used. + + None of these options are necessary to be used and are rather for manual + use (which only ever the author of this LTO implementation will use ;-) + These are used if several seperated instrumentation are performed which + are then later combined. - AFL_LLVM_LTO_STARTID sets the starting location ID for the instrumentation. This defaults to 1 - AFL_LLVM_LTO_DONTWRITEID prevents that the highest location ID written into the instrumentation is set in a global variable + Instrim, LTO and ngram modes can not be used together. + See llvm_mode/README.LTO.md for more information. + ### LAF-INTEL This great feature will split compares to series of single byte comparisons @@ -149,8 +152,17 @@ are then later combined. functions with a single basic block. This is useful for most C and some C++ targets. + Instrim, LTO and ngram modes can not be used together. See llvm_mode/README.instrim.md +### NGRAM + + - Setting AFL_LLVM_NGRAM_SIZE activates ngram prev_loc coverage, good + values are 2, 4 or 8. + + Instrim, LTO and ngram modes can not be used together. + See llvm_mode/README.ngram.md + ### NOT_ZERO - Setting AFL_LLVM_NOT_ZERO=1 during compilation will use counters diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c index 313a2533..77cb1c0f 100644 --- a/llvm_mode/afl-clang-fast.c +++ b/llvm_mode/afl-clang-fast.c @@ -158,14 +158,20 @@ static void edit_params(u32 argc, char **argv) { #endif if (lto_flag[0] != '-') FATAL( - "afl-clang-lto not possible because Makefile magic did not identify " - "the correct -flto flag"); + "Using afl-clang-lto is not possible because Makefile magic did not " + "identify the correct -flto flag"); if (getenv("AFL_LLVM_INSTRIM") != NULL) FATAL("afl-clang-lto does not work with InsTrim mode"); + if (getenv("AFL_LLVM_NGRAM_SIZE") != NULL) + FATAL("afl-clang-lto does not work with ngram coverage mode"); lto_mode = 1; } + if (getenv("AFL_LLVM_NGRAM_SIZE") != NULL && + getenv("AFL_LLVM_INSTRIM") != NULL) + FATAL("AFL_LLVM_NGRAM_SIZE and AFL_LLVM_INSTRIM can not be used together"); + if (!strcmp(name, "afl-clang-fast++") || !strcmp(name, "afl-clang-lto++")) { u8 *alt_cxx = getenv("AFL_CXX"); @@ -605,6 +611,7 @@ int main(int argc, char **argv, char **envp) { "AFL_LLVM_LAF_SPLIT_COMPARES_BITW: size limit (default 8)\n" "AFL_LLVM_INSTRIM: use light weight instrumentation InsTrim\n" "AFL_LLVM_INSTRIM_LOOPHEAD: optimize loop tracing for speed\n" + "AFL_LLVM_NGRAM_SIZE: use ngram prev_loc coverage\n" "AFL_LLVM_CMPLOG: log operands of comparisons (RedQueen mutator)\n" "\nafl-clang-fast was built for llvm %s with the llvm binary path " "of " diff --git a/llvm_mode/afl-llvm-pass.so.cc b/llvm_mode/afl-llvm-pass.so.cc index 133c64b4..fefd9edd 100644 --- a/llvm_mode/afl-llvm-pass.so.cc +++ b/llvm_mode/afl-llvm-pass.so.cc @@ -2,12 +2,15 @@ american fuzzy lop++ - LLVM-mode instrumentation pass --------------------------------------------------- - Written by Laszlo Szekeres and + Written by Laszlo Szekeres , + Adrian Herrera , Michal Zalewski LLVM integration design comes from Laszlo Szekeres. C bits copied-and-pasted from afl-as.c are Michal's fault. + NGRAM previous location coverage comes from Adrian Herrera. + Copyright 2015, 2016 Google Inc. All rights reserved. Copyright 2019-2020 AFLplusplus Project. All rights reserved. @@ -27,7 +30,6 @@ #include "config.h" #include "debug.h" - #include #include #include @@ -47,6 +49,7 @@ typedef long double max_align_t; #include "llvm/IR/BasicBlock.h" #include "llvm/IR/Module.h" #include "llvm/Support/Debug.h" +#include "llvm/Support/MathExtras.h" #include "llvm/Transforms/IPO/PassManagerBuilder.h" #if LLVM_VERSION_MAJOR > 3 || \ @@ -58,6 +61,8 @@ typedef long double max_align_t; #include "llvm/Support/CFG.h" #endif +#include "llvm-ngram-coverage.h" + using namespace llvm; namespace { @@ -118,6 +123,7 @@ class AFLCoverage : public ModulePass { protected: std::list myWhitelist; + uint32_t ngram_size = 0; }; @@ -129,8 +135,10 @@ bool AFLCoverage::runOnModule(Module &M) { LLVMContext &C = M.getContext(); - IntegerType * Int8Ty = IntegerType::getInt8Ty(C); - IntegerType * Int32Ty = IntegerType::getInt32Ty(C); + IntegerType *Int8Ty = IntegerType::getInt8Ty(C); + IntegerType *Int32Ty = IntegerType::getInt32Ty(C); + IntegerType *IntLocTy = + IntegerType::getIntNTy(C, sizeof(PREV_LOC_T) * CHAR_BIT); struct timeval tv; struct timezone tz; u32 rand_seed; @@ -147,7 +155,8 @@ bool AFLCoverage::runOnModule(Module &M) { if ((isatty(2) && !getenv("AFL_QUIET")) || getenv("AFL_DEBUG") != NULL) { - SAYF(cCYA "afl-llvm-pass" VERSION cRST " by \n"); + SAYF(cCYA "afl-llvm-pass" VERSION cRST + " by and \n"); } else @@ -170,21 +179,73 @@ bool AFLCoverage::runOnModule(Module &M) { char *neverZero_counters_str = getenv("AFL_LLVM_NOT_ZERO"); #endif + /* Decide previous location vector size (must be a power of two) */ + + char *ngram_size_str = getenv("AFL_LLVM_NGRAM_SIZE"); + if (!ngram_size_str) ngram_size_str = getenv("AFL_NGRAM_SIZE"); + + if (ngram_size_str) + if (sscanf(ngram_size_str, "%u", &ngram_size) != 1 || ngram_size < 2 || + ngram_size > MAX_NGRAM_SIZE) + FATAL( + "Bad value of AFL_NGRAM_SIZE (must be between 2 and MAX_NGRAM_SIZE)"); + + unsigned PrevLocSize; + if (ngram_size == 1) ngram_size = 0; + if (ngram_size) + PrevLocSize = ngram_size - 1; + else + PrevLocSize = 1; + uint64_t PrevLocVecSize = PowerOf2Ceil(PrevLocSize); + VectorType *PrevLocTy; + + if (ngram_size) PrevLocTy = VectorType::get(IntLocTy, PrevLocVecSize); + /* Get globals for the SHM region and the previous location. Note that __afl_prev_loc is thread-local. */ GlobalVariable *AFLMapPtr = new GlobalVariable(M, PointerType::get(Int8Ty, 0), false, GlobalValue::ExternalLinkage, 0, "__afl_area_ptr"); + GlobalVariable *AFLPrevLoc; + if (ngram_size) #ifdef __ANDROID__ - GlobalVariable *AFLPrevLoc = new GlobalVariable( - M, Int32Ty, false, GlobalValue::ExternalLinkage, 0, "__afl_prev_loc"); + AFLPrevLoc = new GlobalVariable( + M, PrevLocTy, /* isConstant */ false, GlobalValue::ExternalLinkage, + /* Initializer */ nullptr, "__afl_prev_loc"); #else - GlobalVariable *AFLPrevLoc = new GlobalVariable( - M, Int32Ty, false, GlobalValue::ExternalLinkage, 0, "__afl_prev_loc", 0, - GlobalVariable::GeneralDynamicTLSModel, 0, false); + AFLPrevLoc = new GlobalVariable( + M, PrevLocTy, /* isConstant */ false, GlobalValue::ExternalLinkage, + /* Initializer */ nullptr, "__afl_prev_loc", + /* InsertBefore */ nullptr, GlobalVariable::GeneralDynamicTLSModel, + /* AddressSpace */ 0, /* IsExternallyInitialized */ false); #endif + else +#ifdef __ANDROID__ + AFLPrevLoc = new GlobalVariable( + M, Int32Ty, false, GlobalValue::ExternalLinkage, 0, "__afl_prev_loc"); +#else + AFLPrevLoc = new GlobalVariable( + M, Int32Ty, false, GlobalValue::ExternalLinkage, 0, "__afl_prev_loc", 0, + GlobalVariable::GeneralDynamicTLSModel, 0, false); +#endif + + /* Create the vector shuffle mask for updating the previous block history. + Note that the first element of the vector will store cur_loc, so just set + it to undef to allow the optimizer to do its thing. */ + + SmallVector PrevLocShuffle = {UndefValue::get(Int32Ty)}; + + for (unsigned I = 0; I < PrevLocSize - 1; ++I) + PrevLocShuffle.push_back(ConstantInt::get(Int32Ty, I)); + + for (unsigned I = PrevLocSize; I < PrevLocVecSize; ++I) + PrevLocShuffle.push_back(ConstantInt::get(Int32Ty, PrevLocSize)); + + Constant *PrevLocShuffleMask = ConstantVector::get(PrevLocShuffle); + + // other constants we need ConstantInt *Zero = ConstantInt::get(Int8Ty, 0); ConstantInt *One = ConstantInt::get(Int8Ty, 1); @@ -356,20 +417,41 @@ bool AFLCoverage::runOnModule(Module &M) { // fprintf(stderr, " == %d\n", more_than_one); if (more_than_one != 1) continue; #endif - ConstantInt *CurLoc = ConstantInt::get(Int32Ty, cur_loc); + + ConstantInt *CurLoc; + + if (ngram_size) + CurLoc = ConstantInt::get(IntLocTy, cur_loc); + else + CurLoc = ConstantInt::get(Int32Ty, cur_loc); /* Load prev_loc */ LoadInst *PrevLoc = IRB.CreateLoad(AFLPrevLoc); PrevLoc->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None)); - Value *PrevLocCasted = IRB.CreateZExt(PrevLoc, IRB.getInt32Ty()); + Value *PrevLocTrans; + + /* "For efficiency, we propose to hash the tuple as a key into the + hit_count map as (prev_block_trans << 1) ^ curr_block_trans, where + prev_block_trans = (block_trans_1 ^ ... ^ block_trans_(n-1)" */ + + if (ngram_size) + PrevLocTrans = IRB.CreateXorReduce(PrevLoc); + else + PrevLocTrans = IRB.CreateZExt(PrevLoc, IRB.getInt32Ty()); /* Load SHM pointer */ LoadInst *MapPtr = IRB.CreateLoad(AFLMapPtr); MapPtr->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None)); - Value *MapPtrIdx = - IRB.CreateGEP(MapPtr, IRB.CreateXor(PrevLocCasted, CurLoc)); + + Value *MapPtrIdx; + if (ngram_size) + MapPtrIdx = IRB.CreateGEP( + MapPtr, + IRB.CreateZExt(IRB.CreateXor(PrevLocTrans, CurLoc), Int32Ty)); + else + MapPtrIdx = IRB.CreateGEP(MapPtr, IRB.CreateXor(PrevLocTrans, CurLoc)); /* Update bitmap */ @@ -449,11 +531,27 @@ bool AFLCoverage::runOnModule(Module &M) { IRB.CreateStore(Incr, MapPtrIdx) ->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None)); - /* Set prev_loc to cur_loc >> 1 */ + /* Update prev_loc history vector (by placing cur_loc at the head of the + vector and shuffle the other elements back by one) */ - StoreInst *Store = - IRB.CreateStore(ConstantInt::get(Int32Ty, cur_loc >> 1), AFLPrevLoc); - Store->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None)); + StoreInst *Store; + + if (ngram_size) { + + Value *ShuffledPrevLoc = IRB.CreateShuffleVector( + PrevLoc, UndefValue::get(PrevLocTy), PrevLocShuffleMask); + Value *UpdatedPrevLoc = IRB.CreateInsertElement( + ShuffledPrevLoc, IRB.CreateLShr(CurLoc, (uint64_t)1), (uint64_t)0); + + Store = IRB.CreateStore(UpdatedPrevLoc, AFLPrevLoc); + Store->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None)); + + } else { + + Store = IRB.CreateStore(ConstantInt::get(Int32Ty, cur_loc >> 1), + AFLPrevLoc); + + } inst_blocks++; diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c index 5f9a5534..8fad0fbb 100644 --- a/llvm_mode/afl-llvm-rt.o.c +++ b/llvm_mode/afl-llvm-rt.o.c @@ -26,6 +26,7 @@ #include "config.h" #include "types.h" #include "cmplog.h" +#include "llvm-ngram-coverage.h" #include #include @@ -62,11 +63,11 @@ u8 __afl_area_initial[MAP_SIZE]; u8 *__afl_area_ptr = __afl_area_initial; #ifdef __ANDROID__ -u32 __afl_prev_loc; -u32 __afl_final_loc; +PREV_LOC_T __afl_prev_loc[MAX_NGRAM_SIZE]; +u32 __afl_final_loc; #else -__thread u32 __afl_prev_loc; -__thread u32 __afl_final_loc; +__thread PREV_LOC_T __afl_prev_loc[MAX_NGRAM_SIZE]; +__thread u32 __afl_final_loc; #endif struct cmp_map *__afl_cmp_map; @@ -281,7 +282,7 @@ int __afl_persistent_loop(unsigned int max_cnt) { memset(__afl_area_ptr, 0, MAP_SIZE); __afl_area_ptr[0] = 1; - __afl_prev_loc = 0; + memset(__afl_prev_loc, 0, MAX_NGRAM_SIZE * sizeof(PREV_LOC_T)); } @@ -298,7 +299,7 @@ int __afl_persistent_loop(unsigned int max_cnt) { raise(SIGSTOP); __afl_area_ptr[0] = 1; - __afl_prev_loc = 0; + memset(__afl_prev_loc, 0, MAX_NGRAM_SIZE * sizeof(PREV_LOC_T)); return 1; diff --git a/llvm_mode/llvm-ngram-coverage.h b/llvm_mode/llvm-ngram-coverage.h new file mode 100644 index 00000000..4459bcd7 --- /dev/null +++ b/llvm_mode/llvm-ngram-coverage.h @@ -0,0 +1,18 @@ +#ifndef AFL_NGRAM_CONFIG_H +#define AFL_NGRAM_CONFIG_H + +#include "../config.h" + +#if (MAP_SIZE_POW2 <= 16) +typedef u16 PREV_LOC_T; +#elif (MAP_SIZE_POW2 <= 32) +typedef u32 PREV_LOC_T; +#else +typedef u64 PREV_LOC_T; +#endif + +/* Maximum ngram size */ +#define MAX_NGRAM_SIZE 128 + +#endif + diff --git a/src/afl-common.c b/src/afl-common.c index 1aa15442..8c4d53e8 100644 --- a/src/afl-common.c +++ b/src/afl-common.c @@ -57,10 +57,10 @@ char * afl_environment_variables[] = { "AFL_LLVM_INSTRIM_LOOPHEAD", "AFL_LLVM_INSTRIM_SKIPSINGLEBLOCK", "AFL_LLVM_LAF_SPLIT_COMPARES", "AFL_LLVM_LAF_SPLIT_COMPARES_BITW", "AFL_LLVM_LAF_SPLIT_FLOATS", "AFL_LLVM_LAF_SPLIT_SWITCHES", - "AFL_LLVM_LAF_TRANSFORM_COMPARES", "AFL_LLVM_NOT_ZERO", - "AFL_LLVM_WHITELIST", "AFL_NO_AFFINITY", "AFL_LLVM_LTO_STARTID", - "AFL_LLVM_LTO_DONTWRITEID", "AFL_NO_ARITH", "AFL_NO_BUILTIN", - "AFL_NO_CPU_RED", "AFL_NO_FORKSRV", "AFL_NO_UI", + "AFL_LLVM_LAF_TRANSFORM_COMPARES", "AFL_LLVM_NGRAM_SIZE", "AFL_NGRAM_SIZE", + "AFL_LLVM_NOT_ZERO", "AFL_LLVM_WHITELIST", "AFL_NO_AFFINITY", + "AFL_LLVM_LTO_STARTID", "AFL_LLVM_LTO_DONTWRITEID", "AFL_NO_ARITH", + "AFL_NO_BUILTIN", "AFL_NO_CPU_RED", "AFL_NO_FORKSRV", "AFL_NO_UI", "AFL_NO_X86", // not really an env but we dont want to warn on it "AFL_PATH", "AFL_PERFORMANCE_FILE", //"AFL_PERSISTENT", // not implemented anymore, so warn additionally diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index b6e64841..34fdea25 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -105,7 +105,7 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability, afl->start_time / 1000, cur_time / 1000, (cur_time - afl->start_time) / 1000, getpid(), afl->queue_cycle ? (afl->queue_cycle - 1) : 0, afl->cycles_wo_finds, - afl->total_execs, /*eps,*/ + afl->total_execs, afl->total_execs / ((double)(get_cur_time() - afl->start_time) / 1000), afl->queued_paths, afl->queued_favored, afl->queued_discovered, afl->queued_imported, afl->max_depth, afl->current_entry, -- cgit 1.4.1 From 6f78b67f033f430b2b71f88b9f596847d7cbedb1 Mon Sep 17 00:00:00 2001 From: Dominik Maier Date: Sat, 21 Mar 2020 20:28:01 +0100 Subject: adjusted int_bufs --- src/afl-fuzz-init.c | 6 +++--- src/afl-fuzz-stats.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) (limited to 'src/afl-fuzz-stats.c') diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c index e12b1e07..c3f3fac0 100644 --- a/src/afl-fuzz-init.c +++ b/src/afl-fuzz-init.c @@ -323,7 +323,7 @@ void read_testcases(afl_state_t *afl) { u32 i; u8 * fn1; - u8 int_buf[12][16]; + u8 int_buf[2][16]; /* Auto-detect non-in-place resumption attempts. */ @@ -556,7 +556,7 @@ void perform_dry_run(afl_state_t *afl) { if (afl->fsrv.mem_limit) { - u8 int_tmp[16]; + u8 int_buf[16]; SAYF("\n" cLRD "[-] " cRST "Oops, the program crashed with one of the test cases provided. " @@ -598,7 +598,7 @@ void perform_dry_run(afl_state_t *afl) { "other options\n" " fail, poke for " "troubleshooting tips.\n", - DMS(int_tmp, sizeof(int_tmp), afl->fsrv.mem_limit << 20), + DMS(int_buf, sizeof(int_buf), afl->fsrv.mem_limit << 20), afl->fsrv.mem_limit - 1, doc_path); } else { diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index 34fdea25..55b60408 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -205,7 +205,7 @@ void show_stats(afl_state_t *afl) { u8 tmp[256]; u8 time_tmp[64]; - u8 int_buf[16][16]; + u8 int_buf[8][16]; #define IB(i) int_buf[(i)], sizeof(int_buf[(i)]) cur_ms = get_cur_time(); @@ -789,8 +789,8 @@ void show_init_stats(afl_state_t *afl) { u64 avg_us = 0; u32 max_len = 0; - u8 int_buf[12][16]; -#define IB(i) int_buf[(i)], sizeof(int_buf[(i)]) + u8 int_bufs[4][16]; +#define IB(i) int_bufs[(i)], sizeof(int_bufs[(i)]) if (afl->total_cal_cycles) avg_us = afl->total_cal_us / afl->total_cal_cycles; -- cgit 1.4.1 From 54d01fec43c8b649fdc04350262d5982f1e4ae85 Mon Sep 17 00:00:00 2001 From: Dominik Maier Date: Sat, 21 Mar 2020 21:43:58 +0100 Subject: moved string formatting to header --- include/afl-fuzz.h | 7 -- include/common.h | 167 +++++++++++++++++++++++++++++++++++++++++ src/afl-forkserver.c | 73 ++---------------- src/afl-fuzz-bitmap.c | 6 +- src/afl-fuzz-cmplog.c | 9 ++- src/afl-fuzz-extras.c | 24 +++--- src/afl-fuzz-init.c | 11 +-- src/afl-fuzz-misc.c | 187 ---------------------------------------------- src/afl-fuzz-mutators.c | 4 +- src/afl-fuzz-run.c | 6 +- src/afl-fuzz-stats.c | 195 +++++++++++++++++++++++++----------------------- 11 files changed, 307 insertions(+), 382 deletions(-) delete mode 100644 src/afl-fuzz-misc.c (limited to 'src/afl-fuzz-stats.c') diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index ef68ba5d..643d58bd 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -804,13 +804,6 @@ u8 *describe_op(afl_state_t *, u8); u8 save_if_interesting(afl_state_t *, void *, u32, u8); u8 has_new_bits(afl_state_t *, u8 *); -/* Misc */ - -u8 *DI(u8 *, size_t, u64); -u8 *DF(u8 *, size_t, double); -u8 *DMS(u8 *, size_t, u64); -u8 *DTD(u8 *, size_t, u64, u64); - /* Extras */ void load_extras_file(afl_state_t *, u8 *, u32 *, u32 *, u32); diff --git a/include/common.h b/include/common.h index 28c11049..11ae1e66 100644 --- a/include/common.h +++ b/include/common.h @@ -27,10 +27,16 @@ #ifndef __AFLCOMMON_H #define __AFLCOMMON_H +#include +#include #include #include "types.h" #include "stdbool.h" +/* STRINGIFY_VAL_SIZE_MAX will fit all stringify_ strings. */ + +#define STRINGIFY_VAL_SIZE_MAX (16) + void detect_file_args(char **argv, u8 *prog_in, u8 *use_stdin); void check_environment_vars(char **env); @@ -67,5 +73,166 @@ static u64 get_cur_time_us(void) { } +/* Describe integer. The buf should be + at least 6 bytes to fit all ints we randomly see. + Will return buf for convenience. */ + +static u8 *stringify_int(u8 *buf, size_t len, u64 val) { + +#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \ + do { \ + \ + if (val < (_divisor) * (_limit_mult)) { \ + \ + snprintf(buf, len, _fmt, ((_cast)val) / (_divisor)); \ + return buf; \ + \ + } \ + \ + } while (0) + + /* 0-9999 */ + CHK_FORMAT(1, 10000, "%llu", u64); + + /* 10.0k - 99.9k */ + CHK_FORMAT(1000, 99.95, "%0.01fk", double); + + /* 100k - 999k */ + CHK_FORMAT(1000, 1000, "%lluk", u64); + + /* 1.00M - 9.99M */ + CHK_FORMAT(1000 * 1000, 9.995, "%0.02fM", double); + + /* 10.0M - 99.9M */ + CHK_FORMAT(1000 * 1000, 99.95, "%0.01fM", double); + + /* 100M - 999M */ + CHK_FORMAT(1000 * 1000, 1000, "%lluM", u64); + + /* 1.00G - 9.99G */ + CHK_FORMAT(1000LL * 1000 * 1000, 9.995, "%0.02fG", double); + + /* 10.0G - 99.9G */ + CHK_FORMAT(1000LL * 1000 * 1000, 99.95, "%0.01fG", double); + + /* 100G - 999G */ + CHK_FORMAT(1000LL * 1000 * 1000, 1000, "%lluG", u64); + + /* 1.00T - 9.99G */ + CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 9.995, "%0.02fT", double); + + /* 10.0T - 99.9T */ + CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 99.95, "%0.01fT", double); + + /* 100T+ */ + strncpy(buf, "infty", len); + buf[len - 1] = '\0'; + + return buf; + +} + +/* Describe float. Similar as int. */ + +static u8 *stringify_float(u8 *buf, size_t len, double val) { + + if (val < 99.995) { + + snprintf(buf, len, "%0.02f", val); + + } else if (val < 999.95) { + + snprintf(buf, len, "%0.01f", val); + + } else { + + stringify_int(buf, len, (u64)val); + + } + + return buf; + +} + +/* Describe integer as memory size. */ + +static u8 *stringify_mem_size(u8 *buf, size_t len, u64 val) { + + /* 0-9999 */ + CHK_FORMAT(1, 10000, "%llu B", u64); + + /* 10.0k - 99.9k */ + CHK_FORMAT(1024, 99.95, "%0.01f kB", double); + + /* 100k - 999k */ + CHK_FORMAT(1024, 1000, "%llu kB", u64); + + /* 1.00M - 9.99M */ + CHK_FORMAT(1024 * 1024, 9.995, "%0.02f MB", double); + + /* 10.0M - 99.9M */ + CHK_FORMAT(1024 * 1024, 99.95, "%0.01f MB", double); + + /* 100M - 999M */ + CHK_FORMAT(1024 * 1024, 1000, "%llu MB", u64); + + /* 1.00G - 9.99G */ + CHK_FORMAT(1024LL * 1024 * 1024, 9.995, "%0.02f GB", double); + + /* 10.0G - 99.9G */ + CHK_FORMAT(1024LL * 1024 * 1024, 99.95, "%0.01f GB", double); + + /* 100G - 999G */ + CHK_FORMAT(1024LL * 1024 * 1024, 1000, "%llu GB", u64); + + /* 1.00T - 9.99G */ + CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 9.995, "%0.02f TB", double); + + /* 10.0T - 99.9T */ + CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 99.95, "%0.01f TB", double); + +#undef CHK_FORMAT + + /* 100T+ */ + strncpy(buf, "infty", len - 1); + buf[len - 1] = '\0'; + + return buf; + +} + +/* Describe time delta as string. + Returns a pointer to buf for convenience. */ + +static u8 *stringify_time_diff(u8 *buf, size_t len, u64 cur_ms, + u64 event_ms) { + + u64 delta; + s32 t_d, t_h, t_m, t_s; + u8 val_buf[STRINGIFY_VAL_SIZE_MAX]; + + if (!event_ms) { + + snprintf(buf, len, "none seen yet"); + + } else { + + delta = cur_ms - event_ms; + + t_d = delta / 1000 / 60 / 60 / 24; + t_h = (delta / 1000 / 60 / 60) % 24; + t_m = (delta / 1000 / 60) % 60; + t_s = (delta / 1000) % 60; + + stringify_int(val_buf, sizeof(val_buf), t_d); + snprintf(buf, len, "%s days, %d hrs, %d min, %d sec", val_buf, t_h, t_m, + t_s); + + } + + return buf; + +} + #endif diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c index 75b69178..2dd7a9f0 100644 --- a/src/afl-forkserver.c +++ b/src/afl-forkserver.c @@ -51,65 +51,6 @@ extern u8 *doc_path; -static void forkserver_stringify_int(u8 *buf, size_t len, u64 val) { - - u8 cur = 0; - -#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \ - do { \ - \ - if (val < (_divisor) * (_limit_mult)) { \ - \ - snprintf(buf, len, _fmt, ((_cast)val) / (_divisor)); \ - return; \ - \ - } \ - \ - } while (0) - - cur = (cur + 1) % 12; - - /* 0-9999 */ - CHK_FORMAT(1, 10000, "%llu B", u64); - - /* 10.0k - 99.9k */ - CHK_FORMAT(1024, 99.95, "%0.01f kB", double); - - /* 100k - 999k */ - CHK_FORMAT(1024, 1000, "%llu kB", u64); - - /* 1.00M - 9.99M */ - CHK_FORMAT(1024 * 1024, 9.995, "%0.02f MB", double); - - /* 10.0M - 99.9M */ - CHK_FORMAT(1024 * 1024, 99.95, "%0.01f MB", double); - - /* 100M - 999M */ - CHK_FORMAT(1024 * 1024, 1000, "%llu MB", u64); - - /* 1.00G - 9.99G */ - CHK_FORMAT(1024LL * 1024 * 1024, 9.995, "%0.02f GB", double); - - /* 10.0G - 99.9G */ - CHK_FORMAT(1024LL * 1024 * 1024, 99.95, "%0.01f GB", double); - - /* 100G - 999G */ - CHK_FORMAT(1024LL * 1024 * 1024, 1000, "%llu GB", u64); - - /* 1.00T - 9.99G */ - CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 9.995, "%0.02f TB", double); - - /* 10.0T - 99.9T */ - CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 99.95, "%0.01f TB", double); - -#undef CHK_FORMAT - - /* 100T+ */ - strncpy(buf, "infty", len - 1); - buf[len - 1] = '\0'; - -} - list_t fsrv_list = {.element_prealloc_count = 0}; /* Initializes the struct */ @@ -453,9 +394,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv) { } else { - u8 mem_limit_buf[16]; - forkserver_stringify_int(mem_limit_buf, sizeof(mem_limit_buf), - fsrv->mem_limit << 20); + u8 val_buf[STRINGIFY_VAL_SIZE_MAX]; SAYF("\n" cLRD "[-] " cRST "Whoops, the target binary crashed suddenly, " @@ -489,7 +428,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv) { "options\n" " fail, poke for troubleshooting " "tips.\n", - mem_limit_buf, fsrv->mem_limit - 1); + stringify_mem_size(val_buf, sizeof(val_buf), fsrv->mem_limit << 20), + fsrv->mem_limit - 1); } @@ -524,9 +464,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv) { } else { - u8 mem_limit_buf[16]; - forkserver_stringify_int(mem_limit_buf, sizeof(mem_limit_buf), - fsrv->mem_limit << 20); + u8 val_buf[STRINGIFY_VAL_SIZE_MAX]; SAYF( "\n" cLRD "[-] " cRST @@ -559,7 +497,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv) { "never\n" " reached before the program terminates.\n\n" : "", - mem_limit_buf, fsrv->mem_limit - 1); + stringify_int(val_buf, sizeof(val_buf), fsrv->mem_limit << 20), + fsrv->mem_limit - 1); } diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c index 06078fc2..6375cb57 100644 --- a/src/afl-fuzz-bitmap.c +++ b/src/afl-fuzz-bitmap.c @@ -465,7 +465,7 @@ static void write_crash_readme(afl_state_t *afl) { s32 fd; FILE *f; - u8 int_buf[16]; + u8 val_buf[STRINGIFY_VAL_SIZE_MAX]; fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600); ck_free(fn); @@ -504,8 +504,8 @@ static void write_crash_readme(afl_state_t *afl) { " https://github.com/AFLplusplus/AFLplusplus\n\n", afl->orig_cmdline, - DMS(int_buf, sizeof(int_buf), - afl->fsrv.mem_limit << 20)); /* ignore errors */ + stringify_mem_size(val_buf, sizeof(val_buf), + afl->fsrv.mem_limit << 20)); /* ignore errors */ fclose(f); diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c index 5f7909cc..6c6f05ac 100644 --- a/src/afl-fuzz-cmplog.c +++ b/src/afl-fuzz-cmplog.c @@ -264,7 +264,7 @@ void init_cmplog_forkserver(afl_state_t *afl) { } else { - u8 int_buf[16]; + u8 val_buf[STRINGIFY_VAL_SIZE_MAX]; SAYF("\n" cLRD "[-] " cRST "Whoops, the target binary crashed suddenly, " @@ -298,7 +298,8 @@ void init_cmplog_forkserver(afl_state_t *afl) { "options\n" " fail, poke for troubleshooting " "tips.\n", - DMS(int_buf, sizeof(int_buf), afl->fsrv.mem_limit << 20), + stringify_mem_size(val_buf, sizeof(val_buf), + afl->fsrv.mem_limit << 20), afl->fsrv.mem_limit - 1); } @@ -334,7 +335,7 @@ void init_cmplog_forkserver(afl_state_t *afl) { } else { - u8 int_buf[16]; + u8 val_buf[STRINGIFY_VAL_SIZE_MAX]; SAYF( "\n" cLRD "[-] " cRST @@ -367,7 +368,7 @@ void init_cmplog_forkserver(afl_state_t *afl) { "never\n" " reached before the program terminates.\n\n" : "", - DMS(int_buf, sizeof(int_buf), afl->fsrv.mem_limit << 20), + stringify_mem_size(val_buf, sizeof(val_buf), afl->fsrv.mem_limit << 20), afl->fsrv.mem_limit - 1); } diff --git a/src/afl-fuzz-extras.c b/src/afl-fuzz-extras.c index 256489f5..e9995d08 100644 --- a/src/afl-fuzz-extras.c +++ b/src/afl-fuzz-extras.c @@ -55,7 +55,7 @@ void load_extras_file(afl_state_t *afl, u8 *fname, u32 *min_len, u32 *max_len, u8 * lptr; u32 cur_line = 0; - u8 int_bufs[2][16]; + u8 val_bufs[2][STRINGIFY_VAL_SIZE_MAX]; f = fopen(fname, "r"); @@ -172,9 +172,10 @@ void load_extras_file(afl_state_t *afl, u8 *fname, u32 *min_len, u32 *max_len, afl->extras[afl->extras_cnt].len = klen; if (afl->extras[afl->extras_cnt].len > MAX_DICT_FILE) - FATAL("Keyword too big in line %u (%s, limit is %s)", cur_line, - DMS(int_bufs[0], sizeof(int_bufs[0]), klen), - DMS(int_bufs[1], sizeof(int_bufs[1]), MAX_DICT_FILE)); + FATAL( + "Keyword too big in line %u (%s, limit is %s)", cur_line, + stringify_mem_size(val_bufs[0], sizeof(val_bufs[0]), klen), + stringify_mem_size(val_bufs[1], sizeof(val_bufs[1]), MAX_DICT_FILE)); if (*min_len > klen) *min_len = klen; if (*max_len < klen) *max_len = klen; @@ -196,7 +197,7 @@ void load_extras(afl_state_t *afl, u8 *dir) { u32 min_len = MAX_DICT_FILE, max_len = 0, dict_level = 0; u8 * x; - u8 int_bufs[2][16]; + u8 val_bufs[2][STRINGIFY_VAL_SIZE_MAX]; /* If the name ends with @, extract level and continue. */ @@ -243,9 +244,10 @@ void load_extras(afl_state_t *afl, u8 *dir) { } if (st.st_size > MAX_DICT_FILE) - FATAL("Extra '%s' is too big (%s, limit is %s)", fn, - DMS(int_bufs[0], sizeof(int_bufs[0]), st.st_size), - DMS(int_bufs[1], sizeof(int_bufs[1]), MAX_DICT_FILE)); + FATAL( + "Extra '%s' is too big (%s, limit is %s)", fn, + stringify_mem_size(val_bufs[0], sizeof(val_bufs[0]), st.st_size), + stringify_mem_size(val_bufs[1], sizeof(val_bufs[1]), MAX_DICT_FILE)); if (min_len > st.st_size) min_len = st.st_size; if (max_len < st.st_size) max_len = st.st_size; @@ -279,12 +281,12 @@ check_and_sort: compare_extras_len); OKF("Loaded %u extra tokens, size range %s to %s.", afl->extras_cnt, - DMS(int_bufs[0], sizeof(int_bufs[0]), min_len), - DMS(int_bufs[1], sizeof(int_bufs[1]), max_len)); + stringify_mem_size(val_bufs[0], sizeof(val_bufs[0]), min_len), + stringify_mem_size(val_bufs[1], sizeof(val_bufs[1]), max_len)); if (max_len > 32) WARNF("Some tokens are relatively large (%s) - consider trimming.", - DMS(int_bufs[0], sizeof(int_bufs[0]), max_len)); + stringify_mem_size(val_bufs[0], sizeof(val_bufs[0]), max_len)); if (afl->extras_cnt > MAX_DET_EXTRAS) WARNF("More than %d tokens - will use them probabilistically.", diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c index 456415f9..918801d0 100644 --- a/src/afl-fuzz-init.c +++ b/src/afl-fuzz-init.c @@ -323,7 +323,7 @@ void read_testcases(afl_state_t *afl) { u32 i; u8 * fn1; - u8 int_buf[2][16]; + u8 val_buf[2][STRINGIFY_VAL_SIZE_MAX]; /* Auto-detect non-in-place resumption attempts. */ @@ -392,8 +392,8 @@ void read_testcases(afl_state_t *afl) { if (st.st_size > MAX_FILE) FATAL("Test case '%s' is too big (%s, limit is %s)", fn2, - DMS(int_buf[0], sizeof(int_buf[0]), st.st_size), - DMS(int_buf[1], sizeof(int_buf[1]), MAX_FILE)); + stringify_mem_size(val_buf[0], sizeof(val_buf[0]), st.st_size), + stringify_mem_size(val_buf[1], sizeof(val_buf[1]), MAX_FILE)); /* Check for metadata that indicates that deterministic fuzzing is complete for this entry. We don't want to repeat deterministic @@ -557,7 +557,7 @@ void perform_dry_run(afl_state_t *afl) { if (afl->fsrv.mem_limit) { - u8 int_buf[16]; + u8 val_buf[STRINGIFY_VAL_SIZE_MAX]; SAYF("\n" cLRD "[-] " cRST "Oops, the program crashed with one of the test cases provided. " @@ -599,7 +599,8 @@ void perform_dry_run(afl_state_t *afl) { "other options\n" " fail, poke for " "troubleshooting tips.\n", - DMS(int_buf, sizeof(int_buf), afl->fsrv.mem_limit << 20), + stringify_mem_size(val_buf, sizeof(val_buf), + afl->fsrv.mem_limit << 20), afl->fsrv.mem_limit - 1, doc_path); } else { diff --git a/src/afl-fuzz-misc.c b/src/afl-fuzz-misc.c deleted file mode 100644 index 20a7c6d0..00000000 --- a/src/afl-fuzz-misc.c +++ /dev/null @@ -1,187 +0,0 @@ -/* - american fuzzy lop++ - misc stuffs from Mordor - ---------------------------------------------- - - Originally written by Michal Zalewski - - Now maintained by Marc Heuse , - Heiko Eißfeldt and - Andrea Fioraldi - - Copyright 2016, 2017 Google Inc. All rights reserved. - Copyright 2019-2020 AFLplusplus Project. All rights reserved. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at: - - http://www.apache.org/licenses/LICENSE-2.0 - - This is the real deal: the program takes an instrumented binary and - attempts a variety of basic fuzzing tricks, paying close attention to - how they affect the execution path. - - */ - -#include "afl-fuzz.h" - -/* Describe integer. The buf should be - at least 6 bytes to fit all ints we randomly see. - Will return buf for convenience. */ - -u8 *DI(u8 *buf, size_t len, u64 val) { -\ -#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \ - do { \ - \ - if (val < (_divisor) * (_limit_mult)) { \ - \ - snprintf(buf, len, _fmt, ((_cast)val) / (_divisor)); \ - return buf; \ - \ - } \ - \ - } while (0) - - /* 0-9999 */ - CHK_FORMAT(1, 10000, "%llu", u64); - - /* 10.0k - 99.9k */ - CHK_FORMAT(1000, 99.95, "%0.01fk", double); - - /* 100k - 999k */ - CHK_FORMAT(1000, 1000, "%lluk", u64); - - /* 1.00M - 9.99M */ - CHK_FORMAT(1000 * 1000, 9.995, "%0.02fM", double); - - /* 10.0M - 99.9M */ - CHK_FORMAT(1000 * 1000, 99.95, "%0.01fM", double); - - /* 100M - 999M */ - CHK_FORMAT(1000 * 1000, 1000, "%lluM", u64); - - /* 1.00G - 9.99G */ - CHK_FORMAT(1000LL * 1000 * 1000, 9.995, "%0.02fG", double); - - /* 10.0G - 99.9G */ - CHK_FORMAT(1000LL * 1000 * 1000, 99.95, "%0.01fG", double); - - /* 100G - 999G */ - CHK_FORMAT(1000LL * 1000 * 1000, 1000, "%lluG", u64); - - /* 1.00T - 9.99G */ - CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 9.995, "%0.02fT", double); - - /* 10.0T - 99.9T */ - CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 99.95, "%0.01fT", double); - - /* 100T+ */ - strncpy(buf, "infty", len); - buf[len - 1] = '\0'; - - return buf; - -} - -/* Describe float. Similar as int. */ - -u8 *DF(u8 *buf, size_t len, double val) { - - if (val < 99.995) { - - snprintf(buf, len, "%0.02f", val); - - } else if (val < 999.95) { - - snprintf(buf, len, "%0.01f", val); - - } else { - - DI(buf, len, (u64)val); - - } - - return buf; - -} - -/* Describe integer as memory size. */ - -u8 *DMS(u8 *buf, size_t len, u64 val) { - - /* 0-9999 */ - CHK_FORMAT(1, 10000, "%llu B", u64); - - /* 10.0k - 99.9k */ - CHK_FORMAT(1024, 99.95, "%0.01f kB", double); - - /* 100k - 999k */ - CHK_FORMAT(1024, 1000, "%llu kB", u64); - - /* 1.00M - 9.99M */ - CHK_FORMAT(1024 * 1024, 9.995, "%0.02f MB", double); - - /* 10.0M - 99.9M */ - CHK_FORMAT(1024 * 1024, 99.95, "%0.01f MB", double); - - /* 100M - 999M */ - CHK_FORMAT(1024 * 1024, 1000, "%llu MB", u64); - - /* 1.00G - 9.99G */ - CHK_FORMAT(1024LL * 1024 * 1024, 9.995, "%0.02f GB", double); - - /* 10.0G - 99.9G */ - CHK_FORMAT(1024LL * 1024 * 1024, 99.95, "%0.01f GB", double); - - /* 100G - 999G */ - CHK_FORMAT(1024LL * 1024 * 1024, 1000, "%llu GB", u64); - - /* 1.00T - 9.99G */ - CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 9.995, "%0.02f TB", double); - - /* 10.0T - 99.9T */ - CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 99.95, "%0.01f TB", double); - -#undef CHK_FORMAT - - /* 100T+ */ - strncpy(buf, "infty", len - 1); - buf[len - 1] = '\0'; - - return buf; - -} - -/* Describe time delta as string. - Returns a pointer to buf for convenience. */ - -u8 *DTD(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) { - - u64 delta; - s32 t_d, t_h, t_m, t_s; - u8 int_buf[16]; - - if (!event_ms) { - - snprintf(buf, len, "none seen yet"); - - } else { - - delta = cur_ms - event_ms; - - t_d = delta / 1000 / 60 / 60 / 24; - t_h = (delta / 1000 / 60 / 60) % 24; - t_m = (delta / 1000 / 60) % 60; - t_s = (delta / 1000) % 60; - - DI(int_buf, sizeof(int_buf), t_d); - snprintf(buf, len, "%s days, %d hrs, %d min, %d sec", int_buf, t_h, t_m, - t_s); - - } - - return buf; - -} - diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c index 032c61fe..5312aec9 100644 --- a/src/afl-fuzz-mutators.c +++ b/src/afl-fuzz-mutators.c @@ -196,7 +196,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) { u32 trim_exec = 0; u32 orig_len = q->len; - u8 int_buf[16]; + u8 val_buf[STRINGIFY_VAL_SIZE_MAX]; if (afl->stage_name != afl->stage_name_buf) afl->stage_name = afl->stage_name_buf; @@ -213,7 +213,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) { while (afl->stage_cur < afl->stage_max) { snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "ptrim %s", - DI(int_buf, sizeof(int_buf), trim_exec)); + stringify_int(val_buf, sizeof(val_buf), trim_exec)); u32 cksum; diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c index 7a789cfb..3f0a5962 100644 --- a/src/afl-fuzz-run.c +++ b/src/afl-fuzz-run.c @@ -605,7 +605,7 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) { u32 remove_len; u32 len_p2; - u8 int_bufs[2][16]; + u8 val_bufs[2][STRINGIFY_VAL_SIZE_MAX]; /* Although the trimmer will be less useful when variable behavior is detected, it will still work to some extent, so we don't check for @@ -631,8 +631,8 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) { u32 remove_pos = remove_len; snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "trim %s/%s", - DI(int_bufs[0], sizeof(int_bufs[0]), remove_len), - DI(int_bufs[1], sizeof(int_bufs[1]), remove_len)); + stringify_int(val_bufs[0], sizeof(val_bufs[0]), remove_len), + stringify_int(val_bufs[1], sizeof(val_bufs[1]), remove_len)); afl->stage_cur = 0; afl->stage_max = q->len / remove_len; diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index 55b60408..5b5c93bf 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -205,8 +205,8 @@ void show_stats(afl_state_t *afl) { u8 tmp[256]; u8 time_tmp[64]; - u8 int_buf[8][16]; -#define IB(i) int_buf[(i)], sizeof(int_buf[(i)]) + u8 val_buf[8][STRINGIFY_VAL_SIZE_MAX]; +#define IB(i) val_buf[(i)], sizeof(val_buf[(i)]) cur_ms = get_cur_time(); @@ -361,9 +361,9 @@ void show_stats(afl_state_t *afl) { /* Lord, forgive me this. */ - SAYF(SET_G1 bSTG bLT bH bSTOP cCYA + SAYF(SET_G1 bSTG bLT bH bSTOP cCYA " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA - " overall results " bSTG bH2 bH2 bRT "\n"); + " overall results " bSTG bH2 bH2 bRT "\n"); if (afl->dumb_mode) { @@ -394,10 +394,10 @@ void show_stats(afl_state_t *afl) { } - DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->start_time); + stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, afl->start_time); SAYF(bV bSTOP " run time : " cRST "%-33s " bSTG bV bSTOP " cycles done : %s%-5s " bSTG bV "\n", - time_tmp, tmp, DI(IB(0), afl->queue_cycle - 1)); + time_tmp, tmp, stringify_int(IB(0), afl->queue_cycle - 1)); /* We want to warn people about not seeing new paths after a full cycle, except when resuming fuzzing or running in non-instrumented mode. */ @@ -406,7 +406,8 @@ void show_stats(afl_state_t *afl) { (afl->last_path_time || afl->resuming_fuzz || afl->queue_cycle == 1 || afl->in_bitmap || afl->crash_mode)) { - DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_path_time); + stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, + afl->last_path_time); SAYF(bV bSTOP " last new path : " cRST "%-33s ", time_tmp); } else { @@ -424,36 +425,36 @@ void show_stats(afl_state_t *afl) { } SAYF(bSTG bV bSTOP " total paths : " cRST "%-5s " bSTG bV "\n", - DI(IB(0), afl->queued_paths)); + stringify_int(IB(0), afl->queued_paths)); /* Highlight crashes in red if found, denote going over the KEEP_UNIQUE_CRASH limit with a '+' appended to the count. */ - sprintf(tmp, "%s%s", DI(IB(0), afl->unique_crashes), + sprintf(tmp, "%s%s", stringify_int(IB(0), afl->unique_crashes), (afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : ""); - DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_crash_time); + stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, afl->last_crash_time); SAYF(bV bSTOP " last uniq crash : " cRST "%-33s " bSTG bV bSTOP " uniq crashes : %s%-6s" bSTG bV "\n", time_tmp, afl->unique_crashes ? cLRD : cRST, tmp); - sprintf(tmp, "%s%s", DI(IB(0), afl->unique_hangs), + sprintf(tmp, "%s%s", stringify_int(IB(0), afl->unique_hangs), (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : ""); - DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_hang_time); + stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, afl->last_hang_time); SAYF(bV bSTOP " last uniq hang : " cRST "%-33s " bSTG bV bSTOP " uniq hangs : " cRST "%-6s" bSTG bV "\n", time_tmp, tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA - " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); + " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); /* This gets funny because we want to print several variable-length variables together, but then cram them into a fixed-width field - so we need to put them in a temporary buffer first. */ - sprintf(tmp, "%s%s%u (%0.01f%%)", DI(IB(0), afl->current_entry), + sprintf(tmp, "%s%s%u (%0.01f%%)", stringify_int(IB(0), afl->current_entry), afl->queue_cur->favored ? "." : "*", afl->queue_cur->fuzz_level, ((double)afl->current_entry * 100) / afl->queued_paths); @@ -467,7 +468,7 @@ void show_stats(afl_state_t *afl) { : ((t_bytes < 200 && !afl->dumb_mode) ? cPIN : cRST), tmp); - sprintf(tmp, "%s (%0.02f%%)", DI(IB(0), afl->cur_skipped_paths), + sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->cur_skipped_paths), ((double)afl->cur_skipped_paths * 100) / afl->queued_paths); SAYF(bV bSTOP " paths timed out : " cRST "%-16s " bSTG bV, tmp); @@ -476,11 +477,11 @@ void show_stats(afl_state_t *afl) { SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA - " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); + " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); - sprintf(tmp, "%s (%0.02f%%)", DI(IB(0), afl->queued_favored), + sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->queued_favored), ((double)afl->queued_favored) * 100 / afl->queued_paths); /* Yeah... it's still going on... halp? */ @@ -491,38 +492,40 @@ void show_stats(afl_state_t *afl) { if (!afl->stage_max) { - sprintf(tmp, "%s/-", DI(IB(0), afl->stage_cur)); + sprintf(tmp, "%s/-", stringify_int(IB(0), afl->stage_cur)); } else { - sprintf(tmp, "%s/%s (%0.02f%%)", DI(IB(0), afl->stage_cur), - DI(IB(1), afl->stage_max), + sprintf(tmp, "%s/%s (%0.02f%%)", stringify_int(IB(0), afl->stage_cur), + stringify_int(IB(1), afl->stage_max), ((double)afl->stage_cur) * 100 / afl->stage_max); } SAYF(bV bSTOP " stage execs : " cRST "%-21s" bSTG bV bSTOP, tmp); - sprintf(tmp, "%s (%0.02f%%)", DI(IB(0), afl->queued_with_cov), + sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->queued_with_cov), ((double)afl->queued_with_cov) * 100 / afl->queued_paths); SAYF(" new edges on : " cRST "%-22s" bSTG bV "\n", tmp); - sprintf(tmp, "%s (%s%s unique)", DI(IB(0), afl->total_crashes), - DI(IB(1), afl->unique_crashes), + sprintf(tmp, "%s (%s%s unique)", stringify_int(IB(0), afl->total_crashes), + stringify_int(IB(1), afl->unique_crashes), (afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : ""); if (afl->crash_mode) { SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP " new crashes : %s%-22s" bSTG bV "\n", - DI(IB(0), afl->total_execs), afl->unique_crashes ? cLRD : cRST, tmp); + stringify_int(IB(0), afl->total_execs), + afl->unique_crashes ? cLRD : cRST, tmp); } else { SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP " total crashes : %s%-22s" bSTG bV "\n", - DI(IB(0), afl->total_execs), afl->unique_crashes ? cLRD : cRST, tmp); + stringify_int(IB(0), afl->total_execs), + afl->unique_crashes ? cLRD : cRST, tmp); } @@ -530,27 +533,30 @@ void show_stats(afl_state_t *afl) { if (afl->stats_avg_exec < 100) { - snprintf(tmp, sizeof(tmp), "%s/sec (%s)", DF(IB(0), afl->stats_avg_exec), + snprintf(tmp, sizeof(tmp), "%s/sec (%s)", + stringify_float(IB(0), afl->stats_avg_exec), afl->stats_avg_exec < 20 ? "zzzz..." : "slow!"); SAYF(bV bSTOP " exec speed : " cLRD "%-20s ", tmp); } else { - snprintf(tmp, sizeof(tmp), "%s/sec", DF(IB(0), afl->stats_avg_exec)); + snprintf(tmp, sizeof(tmp), "%s/sec", + stringify_float(IB(0), afl->stats_avg_exec)); SAYF(bV bSTOP " exec speed : " cRST "%-20s ", tmp); } - snprintf(tmp, sizeof(tmp), "%s (%s%s unique)", DI(IB(0), afl->total_tmouts), - DI(IB(1), afl->unique_tmouts), + snprintf(tmp, sizeof(tmp), "%s (%s%s unique)", + stringify_int(IB(0), afl->total_tmouts), + stringify_int(IB(1), afl->unique_tmouts), (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : ""); SAYF(bSTG bV bSTOP " total tmouts : " cRST "%-22s" bSTG bV "\n", tmp); /* Aaaalmost there... hold on! */ - SAYF(bVR bH cCYA bSTOP + SAYF(bVR bH cCYA bSTOP " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA " path geometry " bSTG bH5 bH2 bVL "\n"); @@ -562,78 +568,79 @@ void show_stats(afl_state_t *afl) { } else { snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", - DI(IB(0), afl->stage_finds[STAGE_FLIP1]), - DI(IB(1), afl->stage_cycles[STAGE_FLIP1]), - DI(IB(2), afl->stage_finds[STAGE_FLIP2]), - DI(IB(3), afl->stage_cycles[STAGE_FLIP2]), - DI(IB(3), afl->stage_finds[STAGE_FLIP4]), - DI(IB(5), afl->stage_cycles[STAGE_FLIP4])); + stringify_int(IB(0), afl->stage_finds[STAGE_FLIP1]), + stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP1]), + stringify_int(IB(2), afl->stage_finds[STAGE_FLIP2]), + stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP2]), + stringify_int(IB(3), afl->stage_finds[STAGE_FLIP4]), + stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP4])); } SAYF(bV bSTOP " bit flips : " cRST "%-36s " bSTG bV bSTOP " levels : " cRST "%-10s" bSTG bV "\n", - tmp, DI(IB(0), afl->max_depth)); + tmp, stringify_int(IB(0), afl->max_depth)); if (!afl->skip_deterministic) snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", - DI(IB(0), afl->stage_finds[STAGE_FLIP8]), - DI(IB(1), afl->stage_cycles[STAGE_FLIP8]), - DI(IB(2), afl->stage_finds[STAGE_FLIP16]), - DI(IB(3), afl->stage_cycles[STAGE_FLIP16]), - DI(IB(4), afl->stage_finds[STAGE_FLIP32]), - DI(IB(5), afl->stage_cycles[STAGE_FLIP32])); + stringify_int(IB(0), afl->stage_finds[STAGE_FLIP8]), + stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP8]), + stringify_int(IB(2), afl->stage_finds[STAGE_FLIP16]), + stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP16]), + stringify_int(IB(4), afl->stage_finds[STAGE_FLIP32]), + stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP32])); SAYF(bV bSTOP " byte flips : " cRST "%-36s " bSTG bV bSTOP " pending : " cRST "%-10s" bSTG bV "\n", - tmp, DI(IB(0), afl->pending_not_fuzzed)); + tmp, stringify_int(IB(0), afl->pending_not_fuzzed)); if (!afl->skip_deterministic) snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", - DI(IB(0), afl->stage_finds[STAGE_ARITH8]), - DI(IB(1), afl->stage_cycles[STAGE_ARITH8]), - DI(IB(2), afl->stage_finds[STAGE_ARITH16]), - DI(IB(3), afl->stage_cycles[STAGE_ARITH16]), - DI(IB(4), afl->stage_finds[STAGE_ARITH32]), - DI(IB(5), afl->stage_cycles[STAGE_ARITH32])); + stringify_int(IB(0), afl->stage_finds[STAGE_ARITH8]), + stringify_int(IB(1), afl->stage_cycles[STAGE_ARITH8]), + stringify_int(IB(2), afl->stage_finds[STAGE_ARITH16]), + stringify_int(IB(3), afl->stage_cycles[STAGE_ARITH16]), + stringify_int(IB(4), afl->stage_finds[STAGE_ARITH32]), + stringify_int(IB(5), afl->stage_cycles[STAGE_ARITH32])); SAYF(bV bSTOP " arithmetics : " cRST "%-36s " bSTG bV bSTOP " pend fav : " cRST "%-10s" bSTG bV "\n", - tmp, DI(IB(0), afl->pending_favored)); + tmp, stringify_int(IB(0), afl->pending_favored)); if (!afl->skip_deterministic) sprintf(tmp, "%s/%s, %s/%s, %s/%s", - DI(IB(0), afl->stage_finds[STAGE_INTEREST8]), - DI(IB(1), afl->stage_cycles[STAGE_INTEREST8]), - DI(IB(2), afl->stage_finds[STAGE_INTEREST16]), - DI(IB(3), afl->stage_cycles[STAGE_INTEREST16]), - DI(IB(4), afl->stage_finds[STAGE_INTEREST32]), - DI(IB(5), afl->stage_cycles[STAGE_INTEREST32])); + stringify_int(IB(0), afl->stage_finds[STAGE_INTEREST8]), + stringify_int(IB(1), afl->stage_cycles[STAGE_INTEREST8]), + stringify_int(IB(2), afl->stage_finds[STAGE_INTEREST16]), + stringify_int(IB(3), afl->stage_cycles[STAGE_INTEREST16]), + stringify_int(IB(4), afl->stage_finds[STAGE_INTEREST32]), + stringify_int(IB(5), afl->stage_cycles[STAGE_INTEREST32])); SAYF(bV bSTOP " known ints : " cRST "%-36s " bSTG bV bSTOP " own finds : " cRST "%-10s" bSTG bV "\n", - tmp, DI(IB(0), afl->queued_discovered)); + tmp, stringify_int(IB(0), afl->queued_discovered)); if (!afl->skip_deterministic) snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", - DI(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]), - DI(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]), - DI(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]), - DI(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]), - DI(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]), - DI(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO])); + stringify_int(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]), + stringify_int(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]), + stringify_int(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]), + stringify_int(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]), + stringify_int(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]), + stringify_int(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO])); SAYF(bV bSTOP " dictionary : " cRST "%-36s " bSTG bV bSTOP " imported : " cRST "%-10s" bSTG bV "\n", - tmp, afl->sync_id ? DI(IB(0), afl->queued_imported) : (u8 *)"n/a"); + tmp, + afl->sync_id ? stringify_int(IB(0), afl->queued_imported) : (u8 *)"n/a"); snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", - DI(IB(0), afl->stage_finds[STAGE_HAVOC]), - DI(IB(2), afl->stage_cycles[STAGE_HAVOC]), - DI(IB(3), afl->stage_finds[STAGE_SPLICE]), - DI(IB(4), afl->stage_cycles[STAGE_SPLICE]), - DI(IB(5), afl->stage_finds[STAGE_RADAMSA]), - DI(IB(6), afl->stage_cycles[STAGE_RADAMSA])); + stringify_int(IB(0), afl->stage_finds[STAGE_HAVOC]), + stringify_int(IB(2), afl->stage_cycles[STAGE_HAVOC]), + stringify_int(IB(3), afl->stage_finds[STAGE_SPLICE]), + stringify_int(IB(4), afl->stage_cycles[STAGE_SPLICE]), + stringify_int(IB(5), afl->stage_finds[STAGE_RADAMSA]), + stringify_int(IB(6), afl->stage_cycles[STAGE_RADAMSA])); SAYF(bV bSTOP " havoc/rad : " cRST "%-36s " bSTG bV bSTOP, tmp); @@ -654,14 +661,14 @@ void show_stats(afl_state_t *afl) { if (afl->shm.cmplog_mode) { snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s, %s/%s", - DI(IB(0), afl->stage_finds[STAGE_PYTHON]), - DI(IB(1), afl->stage_cycles[STAGE_PYTHON]), - DI(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), - DI(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]), - DI(IB(4), afl->stage_finds[STAGE_COLORIZATION]), - DI(IB(5), afl->stage_cycles[STAGE_COLORIZATION]), - DI(IB(6), afl->stage_finds[STAGE_ITS]), - DI(IB(7), afl->stage_cycles[STAGE_ITS])); + stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]), + stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]), + stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), + stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]), + stringify_int(IB(4), afl->stage_finds[STAGE_COLORIZATION]), + stringify_int(IB(5), afl->stage_cycles[STAGE_COLORIZATION]), + stringify_int(IB(6), afl->stage_finds[STAGE_ITS]), + stringify_int(IB(7), afl->stage_cycles[STAGE_ITS])); SAYF(bV bSTOP " custom/rq : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n", tmp); @@ -669,10 +676,10 @@ void show_stats(afl_state_t *afl) { } else { snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s", - DI(IB(0), afl->stage_finds[STAGE_PYTHON]), - DI(IB(1), afl->stage_cycles[STAGE_PYTHON]), - DI(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), - DI(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR])); + stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]), + stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]), + stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), + stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR])); SAYF(bV bSTOP " py/custom : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n", tmp); @@ -688,7 +695,7 @@ void show_stats(afl_state_t *afl) { sprintf(tmp, "%0.02f%%/%s, ", ((double)(afl->bytes_trim_in - afl->bytes_trim_out)) * 100 / afl->bytes_trim_in, - DI(IB(0), afl->trim_execs)); + stringify_int(IB(0), afl->trim_execs)); } @@ -713,8 +720,9 @@ void show_stats(afl_state_t *afl) { if (afl->mutator) { - sprintf(tmp, "%s/%s", DI(IB(0), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), - DI(IB(1), afl->stage_cycles[STAGE_CUSTOM_MUTATOR])); + sprintf(tmp, "%s/%s", + stringify_int(IB(0), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), + stringify_int(IB(1), afl->stage_cycles[STAGE_CUSTOM_MUTATOR])); SAYF(bV bSTOP " custom mut. : " cRST "%-36s " bSTG bV RESET_G1, tmp); } else { @@ -789,8 +797,8 @@ void show_init_stats(afl_state_t *afl) { u64 avg_us = 0; u32 max_len = 0; - u8 int_bufs[4][16]; -#define IB(i) int_bufs[(i)], sizeof(int_bufs[(i)]) + u8 val_bufs[4][STRINGIFY_VAL_SIZE_MAX]; +#define IB(i) val_bufs[(i)], sizeof(val_bufs[(i)]) if (afl->total_cal_cycles) avg_us = afl->total_cal_us / afl->total_cal_cycles; @@ -827,10 +835,10 @@ void show_init_stats(afl_state_t *afl) { if (max_len > 50 * 1024) WARNF(cLRD "Some test cases are huge (%s) - see %s/perf_tips.md!", - DMS(IB(0), max_len), doc_path); + stringify_mem_size(IB(0), max_len), doc_path); else if (max_len > 10 * 1024) WARNF("Some test cases are big (%s) - see %s/perf_tips.md.", - DMS(IB(0), max_len), doc_path); + stringify_mem_size(IB(0), max_len), doc_path); if (afl->useless_at_start && !afl->in_bitmap) WARNF(cLRD "Some test cases look useless. Consider using a smaller set."); @@ -854,7 +862,8 @@ void show_init_stats(afl_state_t *afl) { max_bits, ((double)afl->total_bitmap_size) / (afl->total_bitmap_entries ? afl->total_bitmap_entries : 1), - DI(IB(0), min_us), DI(IB(1), max_us), DI(IB(2), avg_us)); + stringify_int(IB(0), min_us), stringify_int(IB(1), max_us), + stringify_int(IB(2), avg_us)); if (!afl->timeout_given) { -- cgit 1.4.1 From d39e9ea11c75012023a32bef813de837f4aa7325 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Sun, 22 Mar 2020 19:06:39 +0100 Subject: little performance enhancements --- include/common.h | 5 ++- src/afl-fuzz-bitmap.c | 34 ++++++++++--------- src/afl-fuzz-one.c | 94 ++++++++++++++++++++++++++++++--------------------- src/afl-fuzz-stats.c | 14 ++++---- src/afl-fuzz.c | 4 +-- 5 files changed, 84 insertions(+), 67 deletions(-) (limited to 'src/afl-fuzz-stats.c') diff --git a/include/common.h b/include/common.h index 11ae1e66..1bfafc8b 100644 --- a/include/common.h +++ b/include/common.h @@ -78,7 +78,7 @@ static u64 get_cur_time_us(void) { Will return buf for convenience. */ static u8 *stringify_int(u8 *buf, size_t len, u64 val) { - +\ #define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \ do { \ \ @@ -204,8 +204,7 @@ static u8 *stringify_mem_size(u8 *buf, size_t len, u64 val) { /* Describe time delta as string. Returns a pointer to buf for convenience. */ -static u8 *stringify_time_diff(u8 *buf, size_t len, u64 cur_ms, - u64 event_ms) { +static u8 *stringify_time_diff(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) { u64 delta; s32 t_d, t_h, t_m, t_s; diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c index d4318725..0d5b542d 100644 --- a/src/afl-fuzz-bitmap.c +++ b/src/afl-fuzz-bitmap.c @@ -138,7 +138,8 @@ u8 has_new_bits(afl_state_t *afl, u8 *virgin_map) { } - if (ret && virgin_map == afl->virgin_bits) afl->bitmap_changed = 1; + if (unlikely(ret) && unlikely(virgin_map == afl->virgin_bits)) + afl->bitmap_changed = 1; return ret; @@ -419,7 +420,7 @@ u8 *describe_op(afl_state_t *afl, u8 hnb) { u8 *ret = afl->describe_op_buf_256; - if (afl->syncing_party) { + if (unlikely(afl->syncing_party)) { sprintf(ret, "sync:%s,src:%06u", afl->syncing_party, afl->syncing_case); @@ -472,11 +473,11 @@ static void write_crash_readme(afl_state_t *afl) { /* Do not die on errors here - that would be impolite. */ - if (fd < 0) return; + if (unlikely(fd < 0)) return; f = fdopen(fd, "w"); - if (!f) { + if (unlikely(!f)) { close(fd); return; @@ -517,7 +518,7 @@ static void write_crash_readme(afl_state_t *afl) { u8 save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) { - if (len == 0) return 0; + if (unlikely(len == 0)) return 0; u8 *fn = ""; u8 hnb; @@ -541,14 +542,14 @@ u8 save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) { } - if (fault == afl->crash_mode) { + if (unlikely(fault == afl->crash_mode)) { /* Keep only if there are new bits in the map, add to queue for future fuzzing, etc. */ if (!(hnb = has_new_bits(afl, afl->virgin_bits))) { - if (afl->crash_mode) ++afl->total_crashes; + if (unlikely(afl->crash_mode)) ++afl->total_crashes; return 0; } @@ -580,10 +581,11 @@ u8 save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) { res = calibrate_case(afl, afl->queue_top, mem, afl->queue_cycle - 1, 0); - if (res == FAULT_ERROR) FATAL("Unable to execute target application"); + if (unlikely(res == FAULT_ERROR)) + FATAL("Unable to execute target application"); fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600); - if (fd < 0) PFATAL("Unable to create '%s'", fn); + if (unlikely(fd < 0)) PFATAL("Unable to create '%s'", fn); ck_write(fd, mem, len, fn); close(fd); @@ -604,7 +606,7 @@ u8 save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) { if (afl->unique_hangs >= KEEP_UNIQUE_HANG) return keeping; - if (!afl->dumb_mode) { + if (likely(!afl->dumb_mode)) { #ifdef WORD_SIZE_64 simplify_trace((u64 *)afl->fsrv.trace_bits); @@ -667,7 +669,7 @@ u8 save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) { if (afl->unique_crashes >= KEEP_UNIQUE_CRASH) return keeping; - if (!afl->dumb_mode) { + if (likely(!afl->dumb_mode)) { #ifdef WORD_SIZE_64 simplify_trace((u64 *)afl->fsrv.trace_bits); @@ -679,7 +681,7 @@ u8 save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) { } - if (!afl->unique_crashes) write_crash_readme(afl); + if (unlikely(!afl->unique_crashes)) write_crash_readme(afl); #ifndef SIMPLE_FILES @@ -695,10 +697,10 @@ u8 save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) { #endif /* ^!SIMPLE_FILES */ ++afl->unique_crashes; - if (afl->infoexec) { // if the user wants to be informed on new crashes - - // do + if (unlikely(afl->infoexec)) { + + // if the user wants to be informed on new crashes - do that #if !TARGET_OS_IPHONE - // that if (system(afl->infoexec) == -1) hnb += 0; // we dont care if system errors, but we dont want a // compiler warning either @@ -723,7 +725,7 @@ u8 save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) { test case, too. */ fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600); - if (fd < 0) PFATAL("Unable to create '%s'", fn); + if (unlikely(fd < 0)) PFATAL("Unable to create '%s'", fn); ck_write(fd, mem, len, fn); close(fd); diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c index 1a0c78a8..4dea5e45 100644 --- a/src/afl-fuzz-one.c +++ b/src/afl-fuzz-one.c @@ -67,7 +67,7 @@ static u32 choose_block_len(afl_state_t *afl, u32 limit) { u32 min_value, max_value; u32 rlim = MIN(afl->queue_cycle, 3); - if (!afl->run_over10m) rlim = 1; + if (unlikely(!afl->run_over10m)) rlim = 1; switch (rand_below(afl, rlim)) { @@ -356,7 +356,7 @@ u8 fuzz_one_original(afl_state_t *afl) { #else - if (afl->mutator && afl->mutator->afl_custom_queue_get) { + if (unlikely(afl->mutator) && unlikely(afl->mutator->afl_custom_queue_get)) { /* The custom mutator will decide to skip this test case or not. */ @@ -365,7 +365,7 @@ u8 fuzz_one_original(afl_state_t *afl) { } - if (afl->pending_favored) { + if (likely(afl->pending_favored)) { /* If we have any favored, non-fuzzed new arrivals in the queue, possibly skip to them at the expense of already-fuzzed or non-favored @@ -399,7 +399,7 @@ u8 fuzz_one_original(afl_state_t *afl) { #endif /* ^IGNORE_FINDS */ - if (afl->not_on_tty) { + if (unlikely(afl->not_on_tty)) { ACTF("Fuzzing test case #%u (%u total, %llu uniq crashes found)...", afl->current_entry, afl->queued_paths, afl->unique_crashes); @@ -411,13 +411,13 @@ u8 fuzz_one_original(afl_state_t *afl) { fd = open(afl->queue_cur->fname, O_RDONLY); - if (fd < 0) PFATAL("Unable to open '%s'", afl->queue_cur->fname); + if (unlikely(fd < 0)) PFATAL("Unable to open '%s'", afl->queue_cur->fname); len = afl->queue_cur->len; orig_in = in_buf = mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0); - if (orig_in == MAP_FAILED) + if (unlikely(orig_in == MAP_FAILED)) PFATAL("Unable to mmap '%s' with len %d", afl->queue_cur->fname, len); close(fd); @@ -436,7 +436,7 @@ u8 fuzz_one_original(afl_state_t *afl) { * CALIBRATION (only if failed earlier on) * *******************************************/ - if (afl->queue_cur->cal_failed) { + if (unlikely(afl->queue_cur->cal_failed)) { u8 res = FAULT_TMOUT; @@ -445,11 +445,12 @@ u8 fuzz_one_original(afl_state_t *afl) { res = calibrate_case(afl, afl->queue_cur, in_buf, afl->queue_cycle - 1, 0); - if (res == FAULT_ERROR) FATAL("Unable to execute target application"); + if (unlikely(res == FAULT_ERROR)) + FATAL("Unable to execute target application"); } - if (afl->stop_soon || res != afl->crash_mode) { + if (unlikely(afl->stop_soon) || res != afl->crash_mode) { ++afl->cur_skipped_paths; goto abandon_entry; @@ -466,9 +467,10 @@ u8 fuzz_one_original(afl_state_t *afl) { u8 res = trim_case(afl, afl->queue_cur, in_buf); - if (res == FAULT_ERROR) FATAL("Unable to execute target application"); + if (unlikely(res == FAULT_ERROR)) + FATAL("Unable to execute target application"); - if (afl->stop_soon) { + if (unlikely(afl->stop_soon)) { ++afl->cur_skipped_paths; goto abandon_entry; @@ -491,9 +493,9 @@ u8 fuzz_one_original(afl_state_t *afl) { orig_perf = perf_score = calculate_score(afl, afl->queue_cur); - if (perf_score == 0) goto abandon_entry; + if (unlikely(perf_score == 0)) goto abandon_entry; - if (afl->use_radamsa > 1) goto radamsa_stage; + if (unlikely(afl->use_radamsa > 1)) goto radamsa_stage; if (afl->shm.cmplog_mode) { @@ -1549,8 +1551,8 @@ custom_mutator_stage: * CUSTOM MUTATORS * *******************/ - if (!afl->mutator) goto havoc_stage; - if (!afl->mutator->afl_custom_fuzz) goto havoc_stage; + if (likely(!afl->mutator)) goto havoc_stage; + if (likely(!afl->mutator->afl_custom_fuzz)) goto havoc_stage; afl->stage_name = "custom mutator"; afl->stage_short = "custom"; @@ -1603,7 +1605,7 @@ custom_mutator_stage: /* Read the additional testcase into a new buffer. */ fd = open(target->fname, O_RDONLY); - if (fd < 0) PFATAL("Unable to open '%s'", target->fname); + if (unlikely(fd < 0)) PFATAL("Unable to open '%s'", target->fname); new_buf = ck_alloc_nozero(target->len); ck_read(fd, new_buf, target->len, target->fname); close(fd); @@ -1649,7 +1651,7 @@ custom_mutator_stage: afl->stage_finds[STAGE_CUSTOM_MUTATOR] += new_hit_cnt - orig_hit_cnt; afl->stage_cycles[STAGE_CUSTOM_MUTATOR] += afl->stage_max; - if (afl->custom_only) { + if (likely(afl->custom_only)) { /* Skip other stages */ ret_val = 0; @@ -1680,7 +1682,7 @@ havoc_stage: perf_score = orig_perf; snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "splice %u", splice_cycle); - if (afl->stage_name != afl->stage_name_buf) + if (unlikely(afl->stage_name != afl->stage_name_buf)) afl->stage_name = afl->stage_name_buf; afl->stage_short = "splice"; afl->stage_max = SPLICE_HAVOC * perf_score / afl->havoc_div / 100; @@ -1727,7 +1729,8 @@ havoc_stage: } - switch (rand_below(afl, 15 + ((afl->extras_cnt + afl->a_extras_cnt) ? 2 : 0))) { + switch (rand_below( + afl, 15 + ((afl->extras_cnt + afl->a_extras_cnt) ? 2 : 0))) { case 0: @@ -1757,8 +1760,8 @@ havoc_stage: } else { - *(u16 *)(out_buf + rand_below(afl, temp_len - 1)) = - SWAP16(interesting_16[rand_below(afl, sizeof(interesting_16) >> 1)]); + *(u16 *)(out_buf + rand_below(afl, temp_len - 1)) = SWAP16( + interesting_16[rand_below(afl, sizeof(interesting_16) >> 1)]); } @@ -1777,8 +1780,8 @@ havoc_stage: } else { - *(u32 *)(out_buf + rand_below(afl, temp_len - 3)) = - SWAP32(interesting_32[rand_below(afl, sizeof(interesting_32) >> 2)]); + *(u32 *)(out_buf + rand_below(afl, temp_len - 3)) = SWAP32( + interesting_32[rand_below(afl, sizeof(interesting_32) >> 2)]); } @@ -1964,7 +1967,8 @@ havoc_stage: memcpy(new_buf + clone_to, out_buf + clone_from, clone_len); else memset(new_buf + clone_to, - rand_below(afl, 2) ? rand_below(afl, 256) : out_buf[rand_below(afl, temp_len)], + rand_below(afl, 2) ? rand_below(afl, 256) + : out_buf[rand_below(afl, temp_len)], clone_len); /* Tail */ @@ -2001,7 +2005,8 @@ havoc_stage: } else memset(out_buf + copy_to, - rand_below(afl, 2) ? rand_below(afl, 256) : out_buf[rand_below(afl, temp_len)], + rand_below(afl, 2) ? rand_below(afl, 256) + : out_buf[rand_below(afl, temp_len)], copy_len); break; @@ -2215,7 +2220,7 @@ retry_splicing: fd = open(target->fname, O_RDONLY); - if (fd < 0) PFATAL("Unable to open '%s'", target->fname); + if (unlikely(fd < 0)) PFATAL("Unable to open '%s'", target->fname); new_buf = ck_alloc_nozero(target->len); @@ -2264,7 +2269,7 @@ retry_splicing: radamsa_stage: - if (!afl->use_radamsa || !afl->radamsa_mutate_ptr) goto abandon_entry; + if (likely(!afl->use_radamsa || !afl->radamsa_mutate_ptr)) goto abandon_entry; afl->stage_name = "radamsa"; afl->stage_short = "radamsa"; @@ -3596,7 +3601,8 @@ pacemaker_fuzzing: afl->orig_hit_cnt_puppet = afl->queued_paths + afl->unique_crashes; afl->last_limit_time_start = get_cur_time(); afl->SPLICE_CYCLES_puppet = - (rand_below(afl, SPLICE_CYCLES_puppet_up - SPLICE_CYCLES_puppet_low + 1) + + (rand_below( + afl, SPLICE_CYCLES_puppet_up - SPLICE_CYCLES_puppet_low + 1) + SPLICE_CYCLES_puppet_low); } @@ -3701,8 +3707,10 @@ pacemaker_fuzzing: break; case 6: - out_buf[rand_below(afl, temp_len)] -= 1 + rand_below(afl, ARITH_MAX); - out_buf[rand_below(afl, temp_len)] += 1 + rand_below(afl, ARITH_MAX); + out_buf[rand_below(afl, temp_len)] -= + 1 + rand_below(afl, ARITH_MAX); + out_buf[rand_below(afl, temp_len)] += + 1 + rand_below(afl, ARITH_MAX); MOpt_globals.cycles_v2[STAGE_ARITH8] += 1; break; @@ -3791,12 +3799,14 @@ pacemaker_fuzzing: if (rand_below(afl, 2)) { *(u16 *)(out_buf + rand_below(afl, temp_len - 1)) = - interesting_16[rand_below(afl, sizeof(interesting_16) >> 1)]; + interesting_16[rand_below(afl, + sizeof(interesting_16) >> 1)]; } else { - *(u16 *)(out_buf + rand_below(afl, temp_len - 1)) = SWAP16( - interesting_16[rand_below(afl, sizeof(interesting_16) >> 1)]); + *(u16 *)(out_buf + rand_below(afl, temp_len - 1)) = + SWAP16(interesting_16[rand_below( + afl, sizeof(interesting_16) >> 1)]); } @@ -3811,12 +3821,14 @@ pacemaker_fuzzing: if (rand_below(afl, 2)) { *(u32 *)(out_buf + rand_below(afl, temp_len - 3)) = - interesting_32[rand_below(afl, sizeof(interesting_32) >> 2)]; + interesting_32[rand_below(afl, + sizeof(interesting_32) >> 2)]; } else { - *(u32 *)(out_buf + rand_below(afl, temp_len - 3)) = SWAP32( - interesting_32[rand_below(afl, sizeof(interesting_32) >> 2)]); + *(u32 *)(out_buf + rand_below(afl, temp_len - 3)) = + SWAP32(interesting_32[rand_below( + afl, sizeof(interesting_32) >> 2)]); } @@ -3895,7 +3907,9 @@ pacemaker_fuzzing: memcpy(new_buf + clone_to, out_buf + clone_from, clone_len); else memset(new_buf + clone_to, - rand_below(afl, 2) ? rand_below(afl, 256) : out_buf[rand_below(afl, temp_len)], + rand_below(afl, 2) + ? rand_below(afl, 256) + : out_buf[rand_below(afl, temp_len)], clone_len); /* Tail */ @@ -3933,7 +3947,8 @@ pacemaker_fuzzing: } else memset(out_buf + copy_to, - rand_below(afl, 2) ? rand_below(afl, 256) : out_buf[rand_below(afl, temp_len)], + rand_below(afl, 2) ? rand_below(afl, 256) + : out_buf[rand_below(afl, temp_len)], copy_len); MOpt_globals.cycles_v2[STAGE_OverWrite75] += 1; break; @@ -4122,7 +4137,8 @@ pacemaker_fuzzing: if (splice_cycle >= afl->SPLICE_CYCLES_puppet) afl->SPLICE_CYCLES_puppet = - (rand_below(afl, SPLICE_CYCLES_puppet_up - SPLICE_CYCLES_puppet_low + 1) + + (rand_below( + afl, SPLICE_CYCLES_puppet_up - SPLICE_CYCLES_puppet_low + 1) + SPLICE_CYCLES_puppet_low); afl->splicing_with = -1; diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index 5b5c93bf..ab2b83c6 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -361,9 +361,9 @@ void show_stats(afl_state_t *afl) { /* Lord, forgive me this. */ - SAYF(SET_G1 bSTG bLT bH bSTOP cCYA + SAYF(SET_G1 bSTG bLT bH bSTOP cCYA " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA - " overall results " bSTG bH2 bH2 bRT "\n"); + " overall results " bSTG bH2 bH2 bRT "\n"); if (afl->dumb_mode) { @@ -446,9 +446,9 @@ void show_stats(afl_state_t *afl) { " uniq hangs : " cRST "%-6s" bSTG bV "\n", time_tmp, tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA - " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); + " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); /* This gets funny because we want to print several variable-length variables together, but then cram them into a fixed-width field - so we need to @@ -477,9 +477,9 @@ void show_stats(afl_state_t *afl) { SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA - " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); + " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->queued_favored), ((double)afl->queued_favored) * 100 / afl->queued_paths); @@ -556,7 +556,7 @@ void show_stats(afl_state_t *afl) { /* Aaaalmost there... hold on! */ - SAYF(bVR bH cCYA bSTOP + SAYF(bVR bH cCYA bSTOP " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA " path geometry " bSTG bH5 bH2 bVL "\n"); diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 550bd255..ba56ff67 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -1051,7 +1051,7 @@ int main(int argc, char **argv_orig, char **envp) { } - //show_stats(afl); + // show_stats(afl); if (unlikely(afl->not_on_tty)) { @@ -1124,7 +1124,7 @@ int main(int argc, char **argv_orig, char **envp) { } - //if (afl->queue_cur) show_stats(afl); + // if (afl->queue_cur) show_stats(afl); /* * ATTENTION - the following 10 lines were copied from a PR to Google's afl -- cgit 1.4.1 From cbde30e9d46a0fdd5fc53d46c31c76ca2c715520 Mon Sep 17 00:00:00 2001 From: Dominik Maier Date: Mon, 23 Mar 2020 00:14:03 +0100 Subject: less branches, cleanup --- include/afl-fuzz.h | 4 +--- src/afl-fuzz-mutators.c | 3 +-- src/afl-fuzz-one.c | 6 ++---- src/afl-fuzz-run.c | 6 ++---- src/afl-fuzz-stats.c | 14 +++++++------- 5 files changed, 13 insertions(+), 20 deletions(-) (limited to 'src/afl-fuzz-stats.c') diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index 5e6b3d9e..1a621625 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -109,9 +109,7 @@ #define CASE_PREFIX "id_" #endif /* ^!SIMPLE_FILES */ -#define STAGE_BUF_SIZE \ - (64) /* usable size of the stage name buf in afl_state \ - */ +#define STAGE_BUF_SIZE (64) /* usable size for stage name buf in afl_state */ extern s8 interesting_8[INTERESTING_8_LEN]; extern s16 interesting_16[INTERESTING_8_LEN + INTERESTING_16_LEN]; diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c index 0d9d2a6f..b70344c6 100644 --- a/src/afl-fuzz-mutators.c +++ b/src/afl-fuzz-mutators.c @@ -198,8 +198,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) { u8 val_buf[STRINGIFY_VAL_SIZE_MAX]; - if (afl->stage_name != afl->stage_name_buf) - afl->stage_name = afl->stage_name_buf; + afl->stage_name = afl->stage_name_buf; afl->bytes_trim_in += q->len; /* Initialize trimming in the custom mutator */ diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c index 4dea5e45..cc150cfe 100644 --- a/src/afl-fuzz-one.c +++ b/src/afl-fuzz-one.c @@ -1682,8 +1682,7 @@ havoc_stage: perf_score = orig_perf; snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "splice %u", splice_cycle); - if (unlikely(afl->stage_name != afl->stage_name_buf)) - afl->stage_name = afl->stage_name_buf; + afl->stage_name = afl->stage_name_buf; afl->stage_short = "splice"; afl->stage_max = SPLICE_HAVOC * perf_score / afl->havoc_div / 100; @@ -3581,8 +3580,7 @@ pacemaker_fuzzing: snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, MOpt_globals.splice_stageformat, splice_cycle); - if (afl->stage_name != afl->stage_name_buf) - afl->stage_name = afl->stage_name_buf; + afl->stage_name = afl->stage_name_buf; afl->stage_short = MOpt_globals.splice_stagenameshort; afl->stage_max = SPLICE_HAVOC * perf_score / afl->havoc_div / 100; diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c index 8c075bdb..11b101be 100644 --- a/src/afl-fuzz-run.c +++ b/src/afl-fuzz-run.c @@ -501,8 +501,7 @@ void sync_fuzzers(afl_state_t *afl) { snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "sync %u", ++sync_cnt); - if (afl->stage_name != afl->stage_name_buf) - afl->stage_name = afl->stage_name_buf; + afl->stage_name = afl->stage_name_buf; afl->stage_cur = 0; afl->stage_max = 0; @@ -611,8 +610,7 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) { if (q->len < 5) return 0; - if (afl->stage_name != afl->stage_name_buf) - afl->stage_name = afl->stage_name_buf; + afl->stage_name = afl->stage_name_buf; afl->bytes_trim_in += q->len; /* Select initial chunk len, starting with large steps. */ diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index ab2b83c6..5b5c93bf 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -361,9 +361,9 @@ void show_stats(afl_state_t *afl) { /* Lord, forgive me this. */ - SAYF(SET_G1 bSTG bLT bH bSTOP cCYA + SAYF(SET_G1 bSTG bLT bH bSTOP cCYA " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA - " overall results " bSTG bH2 bH2 bRT "\n"); + " overall results " bSTG bH2 bH2 bRT "\n"); if (afl->dumb_mode) { @@ -446,9 +446,9 @@ void show_stats(afl_state_t *afl) { " uniq hangs : " cRST "%-6s" bSTG bV "\n", time_tmp, tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA - " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); + " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); /* This gets funny because we want to print several variable-length variables together, but then cram them into a fixed-width field - so we need to @@ -477,9 +477,9 @@ void show_stats(afl_state_t *afl) { SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA - " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); + " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->queued_favored), ((double)afl->queued_favored) * 100 / afl->queued_paths); @@ -556,7 +556,7 @@ void show_stats(afl_state_t *afl) { /* Aaaalmost there... hold on! */ - SAYF(bVR bH cCYA bSTOP + SAYF(bVR bH cCYA bSTOP " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA " path geometry " bSTG bH5 bH2 bVL "\n"); -- cgit 1.4.1 From 37603272bec7abb5f6898f1737f588484ec93fd7 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Mon, 23 Mar 2020 08:58:17 +0100 Subject: more fixes and code-format --- llvm_mode/Makefile | 2 +- llvm_mode/afl-clang-fast.c | 34 ++++++++++++++++++++++------------ src/afl-fuzz-stats.c | 14 +++++++------- 3 files changed, 30 insertions(+), 20 deletions(-) (limited to 'src/afl-fuzz-stats.c') diff --git a/llvm_mode/Makefile b/llvm_mode/Makefile index 5f808729..49e0076a 100644 --- a/llvm_mode/Makefile +++ b/llvm_mode/Makefile @@ -335,7 +335,7 @@ endif if [ -f ../split-switches-pass.so ]; then set -e; install -m 755 ../split-switches-pass.so $${DESTDIR}$(HELPER_PATH); fi if [ -f ../cmplog-instructions-pass.so ]; then set -e; install -m 755 ../cmplog-*-pass.so $${DESTDIR}$(HELPER_PATH); fi set -e; if [ -f ../afl-clang-fast ] ; then ln -sf ../afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang ; ln -sf ../afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang++ ; else ln -sf ../afl-gcc $${DESTDIR}$(BIN_PATH)/afl-clang ; ln -sf ../afl-gcc $${DESTDIR}$(BIN_PATH)/afl-clang++; fi - install -m 644 -T README.*.md $${DESTDIR}$(DOC_PATH)/ + install -m 644 README.*.md $${DESTDIR}$(DOC_PATH)/ install -m 644 -T README.md $${DESTDIR}$(DOC_PATH)/README.llvm_mode.md vpath % .. diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c index 55f1f8ca..edd4d95c 100644 --- a/llvm_mode/afl-clang-fast.c +++ b/llvm_mode/afl-clang-fast.c @@ -556,7 +556,7 @@ int main(int argc, char **argv, char **envp) { else { printf("afl-clang-lto" VERSION - " by Marc \"vanHauser\" Heuse \n"); + " by Marc \"vanHauser\" Heuse \n"); } @@ -608,21 +608,31 @@ int main(int argc, char **argv, char **envp) { "AFL_LLVM_LAF_SPLIT_FLOATS: transform floating point comp. to " "cascaded " "comp.\n" - "AFL_LLVM_LAF_SPLIT_COMPARES_BITW: size limit (default 8)\n" - "AFL_LLVM_INSTRIM: use light weight instrumentation InsTrim\n" - "AFL_LLVM_INSTRIM_LOOPHEAD: optimize loop tracing for speed\n" - "AFL_LLVM_NGRAM_SIZE: use ngram prev_loc coverage\n" - "AFL_LLVM_CMPLOG: log operands of comparisons (RedQueen mutator)\n" - "\nafl-clang-fast was built for llvm %s with the llvm binary path " - "of " - "\"%s\".\n", - callname, BIN_PATH, BIN_PATH, LLVM_VERSION, LLVM_BINDIR); + "AFL_LLVM_LAF_SPLIT_COMPARES_BITW: size limit (default 8)\n", + callname, BIN_PATH, BIN_PATH); if (strcmp(callname, "afl-clang-lto") == 0) SAYF( - "Compiled with linker target \"%s\" and LTO flags \"%s\"\n\n" + "AFL_LLVM_LTO_STARTID: from which ID to start counting from for a " + "bb\n" + "AFL_LLVM_LTO_DONTWRITEID: don't write the highest ID used to a " + "global var\n" + "AFL_REAL_LD: use this linker instead of the compiled in path\n" + "AFL_LD_PASSTHROUGH: do not perform instrumentation (for configure " + "scripts)\n" + "\nafl-clang-lto was built for llvm %s with the llvm binary path " + "of \"%s\"; linker target \"%s\" and LTO flags \"%s\"\n" "If anything fails - be sure to read README.lto.md!\n\n", - AFL_REAL_LD, AFL_CLANG_FLTO); + LLVM_VERSION, LLVM_BINDIR, AFL_REAL_LD, AFL_CLANG_FLTO); + else + SAYF( + "AFL_LLVM_INSTRIM: use light weight instrumentation InsTrim\n" + "AFL_LLVM_INSTRIM_LOOPHEAD: optimize loop tracing for speed\n" + "AFL_LLVM_NGRAM_SIZE: use ngram prev_loc coverage\n" + "AFL_LLVM_CMPLOG: log operands of comparisons (RedQueen mutator)\n" + "\nafl-clang-fast was built for llvm %s with the llvm binary path " + "of \"%s\".\n", + LLVM_VERSION, LLVM_BINDIR); SAYF("\n"); diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index 5b5c93bf..ab2b83c6 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -361,9 +361,9 @@ void show_stats(afl_state_t *afl) { /* Lord, forgive me this. */ - SAYF(SET_G1 bSTG bLT bH bSTOP cCYA + SAYF(SET_G1 bSTG bLT bH bSTOP cCYA " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA - " overall results " bSTG bH2 bH2 bRT "\n"); + " overall results " bSTG bH2 bH2 bRT "\n"); if (afl->dumb_mode) { @@ -446,9 +446,9 @@ void show_stats(afl_state_t *afl) { " uniq hangs : " cRST "%-6s" bSTG bV "\n", time_tmp, tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA - " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); + " map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); /* This gets funny because we want to print several variable-length variables together, but then cram them into a fixed-width field - so we need to @@ -477,9 +477,9 @@ void show_stats(afl_state_t *afl) { SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp); - SAYF(bVR bH bSTOP cCYA + SAYF(bVR bH bSTOP cCYA " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA - " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); + " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->queued_favored), ((double)afl->queued_favored) * 100 / afl->queued_paths); @@ -556,7 +556,7 @@ void show_stats(afl_state_t *afl) { /* Aaaalmost there... hold on! */ - SAYF(bVR bH cCYA bSTOP + SAYF(bVR bH cCYA bSTOP " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA " path geometry " bSTG bH5 bH2 bVL "\n"); -- cgit 1.4.1 From 83f925ccc9c871998f9d7a905387fd83f8e3f4af Mon Sep 17 00:00:00 2001 From: Dominik Maier Date: Mon, 23 Mar 2020 15:02:26 +0100 Subject: unsafer --- include/common.h | 160 +++++++++++++++++++++++++++++++++++++++++- src/afl-fuzz-mutators.c | 3 +- src/afl-fuzz-run.c | 6 +- src/afl-fuzz-stats.c | 183 ++++++++++++++++++++++++------------------------ 4 files changed, 254 insertions(+), 98 deletions(-) (limited to 'src/afl-fuzz-stats.c') diff --git a/include/common.h b/include/common.h index 1bfafc8b..97076004 100644 --- a/include/common.h +++ b/include/common.h @@ -78,7 +78,7 @@ static u64 get_cur_time_us(void) { Will return buf for convenience. */ static u8 *stringify_int(u8 *buf, size_t len, u64 val) { -\ + #define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \ do { \ \ @@ -233,5 +233,163 @@ static u8 *stringify_time_diff(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) { } + +/* Unsafe Describe integer. The buf sizes are not checked. + This is unsafe but fast. + Will return buf for convenience. */ + +static u8 *u_stringify_int(u8 *buf, u64 val) { + +#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \ + do { \ + \ + if (val < (_divisor) * (_limit_mult)) { \ + \ + sprintf(buf, _fmt, ((_cast)val) / (_divisor)); \ + return buf; \ + \ + } \ + \ + } while (0) + + /* 0-9999 */ + CHK_FORMAT(1, 10000, "%llu", u64); + + /* 10.0k - 99.9k */ + CHK_FORMAT(1000, 99.95, "%0.01fk", double); + + /* 100k - 999k */ + CHK_FORMAT(1000, 1000, "%lluk", u64); + + /* 1.00M - 9.99M */ + CHK_FORMAT(1000 * 1000, 9.995, "%0.02fM", double); + + /* 10.0M - 99.9M */ + CHK_FORMAT(1000 * 1000, 99.95, "%0.01fM", double); + + /* 100M - 999M */ + CHK_FORMAT(1000 * 1000, 1000, "%lluM", u64); + + /* 1.00G - 9.99G */ + CHK_FORMAT(1000LL * 1000 * 1000, 9.995, "%0.02fG", double); + + /* 10.0G - 99.9G */ + CHK_FORMAT(1000LL * 1000 * 1000, 99.95, "%0.01fG", double); + + /* 100G - 999G */ + CHK_FORMAT(1000LL * 1000 * 1000, 1000, "%lluG", u64); + + /* 1.00T - 9.99G */ + CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 9.995, "%0.02fT", double); + + /* 10.0T - 99.9T */ + CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 99.95, "%0.01fT", double); + + /* 100T+ */ + strcpy(buf, "infty"); + + return buf; + +} + +/* Unsafe describe float. Similar as unsafe int. */ + +static u8 *u_stringify_float(u8 *buf, double val) { + + if (val < 99.995) { + + sprintf(buf, "%0.02f", val); + + } else if (val < 999.95) { + + sprintf(buf, "%0.01f", val); + + } else { + + return u_stringify_int(buf, (u64)val); + + } + + return buf; + +} + +/* Unsafe describe integer as memory size. */ + +static u8 *u_stringify_mem_size(u8 *buf, u64 val) { + + /* 0-9999 */ + CHK_FORMAT(1, 10000, "%llu B", u64); + + /* 10.0k - 99.9k */ + CHK_FORMAT(1024, 99.95, "%0.01f kB", double); + + /* 100k - 999k */ + CHK_FORMAT(1024, 1000, "%llu kB", u64); + + /* 1.00M - 9.99M */ + CHK_FORMAT(1024 * 1024, 9.995, "%0.02f MB", double); + + /* 10.0M - 99.9M */ + CHK_FORMAT(1024 * 1024, 99.95, "%0.01f MB", double); + + /* 100M - 999M */ + CHK_FORMAT(1024 * 1024, 1000, "%llu MB", u64); + + /* 1.00G - 9.99G */ + CHK_FORMAT(1024LL * 1024 * 1024, 9.995, "%0.02f GB", double); + + /* 10.0G - 99.9G */ + CHK_FORMAT(1024LL * 1024 * 1024, 99.95, "%0.01f GB", double); + + /* 100G - 999G */ + CHK_FORMAT(1024LL * 1024 * 1024, 1000, "%llu GB", u64); + + /* 1.00T - 9.99G */ + CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 9.995, "%0.02f TB", double); + + /* 10.0T - 99.9T */ + CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 99.95, "%0.01f TB", double); + +#undef CHK_FORMAT + + /* 100T+ */ + strcpy(buf, "infty"); + + return buf; + +} + +/* Unsafe describe time delta as string. + Returns a pointer to buf for convenience. */ + +static u8 *u_stringify_time_diff(u8 *buf, u64 cur_ms, u64 event_ms) { + + u64 delta; + s32 t_d, t_h, t_m, t_s; + u8 val_buf[STRINGIFY_VAL_SIZE_MAX]; + + if (!event_ms) { + + sprintf(buf, "none seen yet"); + + } else { + + delta = cur_ms - event_ms; + + t_d = delta / 1000 / 60 / 60 / 24; + t_h = (delta / 1000 / 60 / 60) % 24; + t_m = (delta / 1000 / 60) % 60; + t_s = (delta / 1000) % 60; + + u_stringify_int(val_buf, t_d); + sprintf(buf, "%s days, %d hrs, %d min, %d sec", val_buf, t_h, t_m, t_s); + + } + + return buf; + +} + #endif diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c index b70344c6..c158aa6f 100644 --- a/src/afl-fuzz-mutators.c +++ b/src/afl-fuzz-mutators.c @@ -211,8 +211,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) { while (afl->stage_cur < afl->stage_max) { - snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "ptrim %s", - stringify_int(val_buf, sizeof(val_buf), trim_exec)); + sprintf(afl->stage_name_buf, "ptrim %s", u_stringify_int(val_buf, trim_exec)); u32 cksum; diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c index 11b101be..8c4b5941 100644 --- a/src/afl-fuzz-run.c +++ b/src/afl-fuzz-run.c @@ -626,9 +626,9 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) { u32 remove_pos = remove_len; - snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "trim %s/%s", - stringify_int(val_bufs[0], sizeof(val_bufs[0]), remove_len), - stringify_int(val_bufs[1], sizeof(val_bufs[1]), remove_len)); + sprintf(afl->stage_name_buf, "trim %s/%s", + u_stringify_int(val_bufs[0], remove_len), + u_stringify_int(val_bufs[1], remove_len)); afl->stage_cur = 0; afl->stage_max = q->len / remove_len; diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index ab2b83c6..dc16df8f 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -206,7 +206,7 @@ void show_stats(afl_state_t *afl) { u8 time_tmp[64]; u8 val_buf[8][STRINGIFY_VAL_SIZE_MAX]; -#define IB(i) val_buf[(i)], sizeof(val_buf[(i)]) +#define IB(i) (val_buf[(i)]) cur_ms = get_cur_time(); @@ -394,10 +394,10 @@ void show_stats(afl_state_t *afl) { } - stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, afl->start_time); + u_stringify_time_diff(time_tmp, cur_ms, afl->start_time); SAYF(bV bSTOP " run time : " cRST "%-33s " bSTG bV bSTOP " cycles done : %s%-5s " bSTG bV "\n", - time_tmp, tmp, stringify_int(IB(0), afl->queue_cycle - 1)); + time_tmp, tmp, u_stringify_int(IB(0), afl->queue_cycle - 1)); /* We want to warn people about not seeing new paths after a full cycle, except when resuming fuzzing or running in non-instrumented mode. */ @@ -406,7 +406,7 @@ void show_stats(afl_state_t *afl) { (afl->last_path_time || afl->resuming_fuzz || afl->queue_cycle == 1 || afl->in_bitmap || afl->crash_mode)) { - stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, + u_stringify_time_diff(time_tmp, cur_ms, afl->last_path_time); SAYF(bV bSTOP " last new path : " cRST "%-33s ", time_tmp); @@ -425,23 +425,23 @@ void show_stats(afl_state_t *afl) { } SAYF(bSTG bV bSTOP " total paths : " cRST "%-5s " bSTG bV "\n", - stringify_int(IB(0), afl->queued_paths)); + u_stringify_int(IB(0), afl->queued_paths)); /* Highlight crashes in red if found, denote going over the KEEP_UNIQUE_CRASH limit with a '+' appended to the count. */ - sprintf(tmp, "%s%s", stringify_int(IB(0), afl->unique_crashes), + sprintf(tmp, "%s%s", u_stringify_int(IB(0), afl->unique_crashes), (afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : ""); - stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, afl->last_crash_time); + u_stringify_time_diff(time_tmp, cur_ms, afl->last_crash_time); SAYF(bV bSTOP " last uniq crash : " cRST "%-33s " bSTG bV bSTOP " uniq crashes : %s%-6s" bSTG bV "\n", time_tmp, afl->unique_crashes ? cLRD : cRST, tmp); - sprintf(tmp, "%s%s", stringify_int(IB(0), afl->unique_hangs), + sprintf(tmp, "%s%s", u_stringify_int(IB(0), afl->unique_hangs), (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : ""); - stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, afl->last_hang_time); + u_stringify_time_diff(time_tmp, cur_ms, afl->last_hang_time); SAYF(bV bSTOP " last uniq hang : " cRST "%-33s " bSTG bV bSTOP " uniq hangs : " cRST "%-6s" bSTG bV "\n", time_tmp, tmp); @@ -454,7 +454,7 @@ void show_stats(afl_state_t *afl) { together, but then cram them into a fixed-width field - so we need to put them in a temporary buffer first. */ - sprintf(tmp, "%s%s%u (%0.01f%%)", stringify_int(IB(0), afl->current_entry), + sprintf(tmp, "%s%s%u (%0.01f%%)", u_stringify_int(IB(0), afl->current_entry), afl->queue_cur->favored ? "." : "*", afl->queue_cur->fuzz_level, ((double)afl->current_entry * 100) / afl->queued_paths); @@ -468,7 +468,7 @@ void show_stats(afl_state_t *afl) { : ((t_bytes < 200 && !afl->dumb_mode) ? cPIN : cRST), tmp); - sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->cur_skipped_paths), + sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->cur_skipped_paths), ((double)afl->cur_skipped_paths * 100) / afl->queued_paths); SAYF(bV bSTOP " paths timed out : " cRST "%-16s " bSTG bV, tmp); @@ -481,7 +481,7 @@ void show_stats(afl_state_t *afl) { " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); - sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->queued_favored), + sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_favored), ((double)afl->queued_favored) * 100 / afl->queued_paths); /* Yeah... it's still going on... halp? */ @@ -492,39 +492,39 @@ void show_stats(afl_state_t *afl) { if (!afl->stage_max) { - sprintf(tmp, "%s/-", stringify_int(IB(0), afl->stage_cur)); + sprintf(tmp, "%s/-", u_stringify_int(IB(0), afl->stage_cur)); } else { - sprintf(tmp, "%s/%s (%0.02f%%)", stringify_int(IB(0), afl->stage_cur), - stringify_int(IB(1), afl->stage_max), + sprintf(tmp, "%s/%s (%0.02f%%)", u_stringify_int(IB(0), afl->stage_cur), + u_stringify_int(IB(1), afl->stage_max), ((double)afl->stage_cur) * 100 / afl->stage_max); } SAYF(bV bSTOP " stage execs : " cRST "%-21s" bSTG bV bSTOP, tmp); - sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->queued_with_cov), + sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_with_cov), ((double)afl->queued_with_cov) * 100 / afl->queued_paths); SAYF(" new edges on : " cRST "%-22s" bSTG bV "\n", tmp); - sprintf(tmp, "%s (%s%s unique)", stringify_int(IB(0), afl->total_crashes), - stringify_int(IB(1), afl->unique_crashes), + sprintf(tmp, "%s (%s%s unique)", u_stringify_int(IB(0), afl->total_crashes), + u_stringify_int(IB(1), afl->unique_crashes), (afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : ""); if (afl->crash_mode) { SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP " new crashes : %s%-22s" bSTG bV "\n", - stringify_int(IB(0), afl->total_execs), + u_stringify_int(IB(0), afl->total_execs), afl->unique_crashes ? cLRD : cRST, tmp); } else { SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP " total crashes : %s%-22s" bSTG bV "\n", - stringify_int(IB(0), afl->total_execs), + u_stringify_int(IB(0), afl->total_execs), afl->unique_crashes ? cLRD : cRST, tmp); } @@ -533,23 +533,23 @@ void show_stats(afl_state_t *afl) { if (afl->stats_avg_exec < 100) { - snprintf(tmp, sizeof(tmp), "%s/sec (%s)", - stringify_float(IB(0), afl->stats_avg_exec), + sprintf(tmp, "%s/sec (%s)", + u_stringify_float(IB(0), afl->stats_avg_exec), afl->stats_avg_exec < 20 ? "zzzz..." : "slow!"); SAYF(bV bSTOP " exec speed : " cLRD "%-20s ", tmp); } else { - snprintf(tmp, sizeof(tmp), "%s/sec", - stringify_float(IB(0), afl->stats_avg_exec)); + sprintf(tmp, "%s/sec", + u_stringify_float(IB(0), afl->stats_avg_exec)); SAYF(bV bSTOP " exec speed : " cRST "%-20s ", tmp); } - snprintf(tmp, sizeof(tmp), "%s (%s%s unique)", - stringify_int(IB(0), afl->total_tmouts), - stringify_int(IB(1), afl->unique_tmouts), + sprintf(tmp, "%s (%s%s unique)", + u_stringify_int(IB(0), afl->total_tmouts), + u_stringify_int(IB(1), afl->unique_tmouts), (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : ""); SAYF(bSTG bV bSTOP " total tmouts : " cRST "%-22s" bSTG bV "\n", tmp); @@ -562,85 +562,84 @@ void show_stats(afl_state_t *afl) { if (afl->skip_deterministic) { - strncpy(tmp, "n/a, n/a, n/a", sizeof(tmp) - 1); - tmp[sizeof(tmp) - 1] = '\0'; + strcpy(tmp, "n/a, n/a, n/a"); } else { - snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", - stringify_int(IB(0), afl->stage_finds[STAGE_FLIP1]), - stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP1]), - stringify_int(IB(2), afl->stage_finds[STAGE_FLIP2]), - stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP2]), - stringify_int(IB(3), afl->stage_finds[STAGE_FLIP4]), - stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP4])); + sprintf(tmp, "%s/%s, %s/%s, %s/%s", + u_stringify_int(IB(0), afl->stage_finds[STAGE_FLIP1]), + u_stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP1]), + u_stringify_int(IB(2), afl->stage_finds[STAGE_FLIP2]), + u_stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP2]), + u_stringify_int(IB(3), afl->stage_finds[STAGE_FLIP4]), + u_stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP4])); } SAYF(bV bSTOP " bit flips : " cRST "%-36s " bSTG bV bSTOP " levels : " cRST "%-10s" bSTG bV "\n", - tmp, stringify_int(IB(0), afl->max_depth)); + tmp, u_stringify_int(IB(0), afl->max_depth)); if (!afl->skip_deterministic) - snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", - stringify_int(IB(0), afl->stage_finds[STAGE_FLIP8]), - stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP8]), - stringify_int(IB(2), afl->stage_finds[STAGE_FLIP16]), - stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP16]), - stringify_int(IB(4), afl->stage_finds[STAGE_FLIP32]), - stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP32])); + sprintf(tmp, "%s/%s, %s/%s, %s/%s", + u_stringify_int(IB(0), afl->stage_finds[STAGE_FLIP8]), + u_stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP8]), + u_stringify_int(IB(2), afl->stage_finds[STAGE_FLIP16]), + u_stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP16]), + u_stringify_int(IB(4), afl->stage_finds[STAGE_FLIP32]), + u_stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP32])); SAYF(bV bSTOP " byte flips : " cRST "%-36s " bSTG bV bSTOP " pending : " cRST "%-10s" bSTG bV "\n", - tmp, stringify_int(IB(0), afl->pending_not_fuzzed)); + tmp, u_stringify_int(IB(0), afl->pending_not_fuzzed)); if (!afl->skip_deterministic) - snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", - stringify_int(IB(0), afl->stage_finds[STAGE_ARITH8]), - stringify_int(IB(1), afl->stage_cycles[STAGE_ARITH8]), - stringify_int(IB(2), afl->stage_finds[STAGE_ARITH16]), - stringify_int(IB(3), afl->stage_cycles[STAGE_ARITH16]), - stringify_int(IB(4), afl->stage_finds[STAGE_ARITH32]), - stringify_int(IB(5), afl->stage_cycles[STAGE_ARITH32])); + sprintf(tmp, "%s/%s, %s/%s, %s/%s", + u_stringify_int(IB(0), afl->stage_finds[STAGE_ARITH8]), + u_stringify_int(IB(1), afl->stage_cycles[STAGE_ARITH8]), + u_stringify_int(IB(2), afl->stage_finds[STAGE_ARITH16]), + u_stringify_int(IB(3), afl->stage_cycles[STAGE_ARITH16]), + u_stringify_int(IB(4), afl->stage_finds[STAGE_ARITH32]), + u_stringify_int(IB(5), afl->stage_cycles[STAGE_ARITH32])); SAYF(bV bSTOP " arithmetics : " cRST "%-36s " bSTG bV bSTOP " pend fav : " cRST "%-10s" bSTG bV "\n", - tmp, stringify_int(IB(0), afl->pending_favored)); + tmp, u_stringify_int(IB(0), afl->pending_favored)); if (!afl->skip_deterministic) sprintf(tmp, "%s/%s, %s/%s, %s/%s", - stringify_int(IB(0), afl->stage_finds[STAGE_INTEREST8]), - stringify_int(IB(1), afl->stage_cycles[STAGE_INTEREST8]), - stringify_int(IB(2), afl->stage_finds[STAGE_INTEREST16]), - stringify_int(IB(3), afl->stage_cycles[STAGE_INTEREST16]), - stringify_int(IB(4), afl->stage_finds[STAGE_INTEREST32]), - stringify_int(IB(5), afl->stage_cycles[STAGE_INTEREST32])); + u_stringify_int(IB(0), afl->stage_finds[STAGE_INTEREST8]), + u_stringify_int(IB(1), afl->stage_cycles[STAGE_INTEREST8]), + u_stringify_int(IB(2), afl->stage_finds[STAGE_INTEREST16]), + u_stringify_int(IB(3), afl->stage_cycles[STAGE_INTEREST16]), + u_stringify_int(IB(4), afl->stage_finds[STAGE_INTEREST32]), + u_stringify_int(IB(5), afl->stage_cycles[STAGE_INTEREST32])); SAYF(bV bSTOP " known ints : " cRST "%-36s " bSTG bV bSTOP " own finds : " cRST "%-10s" bSTG bV "\n", - tmp, stringify_int(IB(0), afl->queued_discovered)); + tmp, u_stringify_int(IB(0), afl->queued_discovered)); if (!afl->skip_deterministic) - snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", - stringify_int(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]), - stringify_int(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]), - stringify_int(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]), - stringify_int(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]), - stringify_int(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]), - stringify_int(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO])); + sprintf(tmp, "%s/%s, %s/%s, %s/%s", + u_stringify_int(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]), + u_stringify_int(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]), + u_stringify_int(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]), + u_stringify_int(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]), + u_stringify_int(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]), + u_stringify_int(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO])); SAYF(bV bSTOP " dictionary : " cRST "%-36s " bSTG bV bSTOP " imported : " cRST "%-10s" bSTG bV "\n", tmp, - afl->sync_id ? stringify_int(IB(0), afl->queued_imported) : (u8 *)"n/a"); + afl->sync_id ? u_stringify_int(IB(0), afl->queued_imported) : (u8 *)"n/a"); - snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s", - stringify_int(IB(0), afl->stage_finds[STAGE_HAVOC]), - stringify_int(IB(2), afl->stage_cycles[STAGE_HAVOC]), - stringify_int(IB(3), afl->stage_finds[STAGE_SPLICE]), - stringify_int(IB(4), afl->stage_cycles[STAGE_SPLICE]), - stringify_int(IB(5), afl->stage_finds[STAGE_RADAMSA]), - stringify_int(IB(6), afl->stage_cycles[STAGE_RADAMSA])); + sprintf(tmp, "%s/%s, %s/%s, %s/%s", + u_stringify_int(IB(0), afl->stage_finds[STAGE_HAVOC]), + u_stringify_int(IB(2), afl->stage_cycles[STAGE_HAVOC]), + u_stringify_int(IB(3), afl->stage_finds[STAGE_SPLICE]), + u_stringify_int(IB(4), afl->stage_cycles[STAGE_SPLICE]), + u_stringify_int(IB(5), afl->stage_finds[STAGE_RADAMSA]), + u_stringify_int(IB(6), afl->stage_cycles[STAGE_RADAMSA])); SAYF(bV bSTOP " havoc/rad : " cRST "%-36s " bSTG bV bSTOP, tmp); @@ -660,26 +659,26 @@ void show_stats(afl_state_t *afl) { if (afl->shm.cmplog_mode) { - snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s, %s/%s", - stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]), - stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]), - stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), - stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]), - stringify_int(IB(4), afl->stage_finds[STAGE_COLORIZATION]), - stringify_int(IB(5), afl->stage_cycles[STAGE_COLORIZATION]), - stringify_int(IB(6), afl->stage_finds[STAGE_ITS]), - stringify_int(IB(7), afl->stage_cycles[STAGE_ITS])); + sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s", + u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]), + u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]), + u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), + u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]), + u_stringify_int(IB(4), afl->stage_finds[STAGE_COLORIZATION]), + u_stringify_int(IB(5), afl->stage_cycles[STAGE_COLORIZATION]), + u_stringify_int(IB(6), afl->stage_finds[STAGE_ITS]), + u_stringify_int(IB(7), afl->stage_cycles[STAGE_ITS])); SAYF(bV bSTOP " custom/rq : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n", tmp); } else { - snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s", - stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]), - stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]), - stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), - stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR])); + sprintf(tmp, "%s/%s, %s/%s", + u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]), + u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]), + u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), + u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR])); SAYF(bV bSTOP " py/custom : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n", tmp); @@ -695,7 +694,7 @@ void show_stats(afl_state_t *afl) { sprintf(tmp, "%0.02f%%/%s, ", ((double)(afl->bytes_trim_in - afl->bytes_trim_out)) * 100 / afl->bytes_trim_in, - stringify_int(IB(0), afl->trim_execs)); + u_stringify_int(IB(0), afl->trim_execs)); } @@ -721,8 +720,8 @@ void show_stats(afl_state_t *afl) { if (afl->mutator) { sprintf(tmp, "%s/%s", - stringify_int(IB(0), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), - stringify_int(IB(1), afl->stage_cycles[STAGE_CUSTOM_MUTATOR])); + u_stringify_int(IB(0), afl->stage_finds[STAGE_CUSTOM_MUTATOR]), + u_stringify_int(IB(1), afl->stage_cycles[STAGE_CUSTOM_MUTATOR])); SAYF(bV bSTOP " custom mut. : " cRST "%-36s " bSTG bV RESET_G1, tmp); } else { -- cgit 1.4.1