From 27ab84fbf1a0497c363e3f06c7e7d41ab019c191 Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Thu, 13 Jan 2022 16:38:18 +0100 Subject: fix skipping unfavored fuzzed entries --- src/afl-fuzz-one.c | 27 +++++++++------------------ 1 file changed, 9 insertions(+), 18 deletions(-) (limited to 'src') diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c index 26a01948..b28ee80a 100644 --- a/src/afl-fuzz-one.c +++ b/src/afl-fuzz-one.c @@ -413,8 +413,7 @@ u8 fuzz_one_original(afl_state_t *afl) { possibly skip to them at the expense of already-fuzzed or non-favored cases. */ - if (((afl->queue_cur->was_fuzzed > 0 || afl->queue_cur->fuzz_level > 0) || - !afl->queue_cur->favored) && + if ((afl->queue_cur->fuzz_level || !afl->queue_cur->favored) && likely(rand_below(afl, 100) < SKIP_TO_NEW_PROB)) { return 1; @@ -429,8 +428,7 @@ u8 fuzz_one_original(afl_state_t *afl) { The odds of skipping stuff are higher for already-fuzzed inputs and lower for never-fuzzed entries. */ - if (afl->queue_cycle > 1 && - (afl->queue_cur->fuzz_level == 0 || afl->queue_cur->was_fuzzed)) { + if (afl->queue_cycle > 1 && !afl->queue_cur->fuzz_level) { if (likely(rand_below(afl, 100) < SKIP_NFAV_NEW_PROB)) { return 1; } @@ -2961,17 +2959,12 @@ abandon_entry: cycle and have not seen this entry before. */ if (!afl->stop_soon && !afl->queue_cur->cal_failed && - (afl->queue_cur->was_fuzzed == 0 || afl->queue_cur->fuzz_level == 0) && - !afl->queue_cur->disabled) { + !afl->queue_cur->was_fuzzed && !afl->queue_cur->disabled) { - if (!afl->queue_cur->was_fuzzed) { - - --afl->pending_not_fuzzed; - afl->queue_cur->was_fuzzed = 1; - afl->reinit_table = 1; - if (afl->queue_cur->favored) { --afl->pending_favored; } - - } + --afl->pending_not_fuzzed; + afl->queue_cur->was_fuzzed = 1; + afl->reinit_table = 1; + if (afl->queue_cur->favored) { --afl->pending_favored; } } @@ -3024,8 +3017,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) { possibly skip to them at the expense of already-fuzzed or non-favored cases. */ - if (((afl->queue_cur->was_fuzzed > 0 || afl->queue_cur->fuzz_level > 0) || - !afl->queue_cur->favored) && + if ((afl->queue_cur->fuzz_level || !afl->queue_cur->favored) && rand_below(afl, 100) < SKIP_TO_NEW_PROB) { return 1; @@ -3040,8 +3032,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) { The odds of skipping stuff are higher for already-fuzzed inputs and lower for never-fuzzed entries. */ - if (afl->queue_cycle > 1 && - (afl->queue_cur->fuzz_level == 0 || afl->queue_cur->was_fuzzed)) { + if (afl->queue_cycle > 1 && !afl->queue_cur->fuzz_level) { if (likely(rand_below(afl, 100) < SKIP_NFAV_NEW_PROB)) { return 1; } -- cgit 1.4.1 From f42c0047c8c5a988123f7b66bad4e33234680ebc Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Fri, 14 Jan 2022 15:01:05 +0100 Subject: nits --- README.md | 1 + docs/docs.md | 122 -------------------------------------------------- docs/docs2.md | 124 --------------------------------------------------- src/afl-fuzz-queue.c | 7 ++- 4 files changed, 4 insertions(+), 250 deletions(-) delete mode 100644 docs/docs.md delete mode 100644 docs/docs2.md (limited to 'src') diff --git a/README.md b/README.md index 9e41a088..f7d5e40d 100644 --- a/README.md +++ b/README.md @@ -15,6 +15,7 @@ AFL++ is maintained by: * Heiko "hexcoder-" Eißfeldt , * Andrea Fioraldi and * Dominik Maier . +* Documentation: Jana Aydinbas Originally developed by Michał "lcamtuf" Zalewski. diff --git a/docs/docs.md b/docs/docs.md deleted file mode 100644 index aa8a4d48..00000000 --- a/docs/docs.md +++ /dev/null @@ -1,122 +0,0 @@ -# Restructure AFL++'s documentation - -## About us - -We are dedicated to everything around fuzzing, our main and most well known -contribution is the fuzzer `AFL++` which is part of all major Unix -distributions (e.g. Debian, Arch, FreeBSD, etc.) and is deployed on Google's -oss-fuzz and clusterfuzz. It is rated the top fuzzer on Google's fuzzbench. - -We are four individuals from Europe supported by a large community. - -All our tools are open source. - -## About the AFL++ fuzzer project - -AFL++ inherited it's documentation from the original Google AFL project. -Since then it has been massively improved - feature and performance wise - -and although the documenation has likewise been continued it has grown out -of proportion. -The documentation is done by non-natives to the English language, plus -none of us has a writer background. - -We see questions on AFL++ usage on mailing lists (e.g. afl-users), discord -channels, web forums and as issues in our repository. - -This only increases as AFL++ has been on the top of Google's fuzzbench -statistics (which measures the performance of fuzzers) and is now being -integrated in Google's oss-fuzz and clusterfuzz - and is in many Unix -packaging repositories, e.g. Debian, FreeBSD, etc. - -AFL++ now has 44 (!) documentation files with 13k total lines of content. -This is way too much. - -Hence AFL++ needs a complete overhaul of it's documentation, both on a -organisation/structural level as well as the content. - -Overall the following actions have to be performed: - * Create a better structure of documentation so it is easier to find the - information that is being looked for, combining and/or splitting up the - existing documents as needed. - * Rewrite some documentation to remove duplication. Several information is - present several times in the documentation. These should be removed to - where needed so that we have as little bloat as possible. - * The documents have been written and modified by a lot of different people, - most of them non-native English speaker. Hence an overall review where - parts should be rewritten has to be performed and then the rewrite done. - * Create a cheat-sheet for a very short best-setup build and run of AFL++ - * Pictures explain more than 1000 words. We need at least 4 images that - explain the workflow with AFL++: - - the build workflow - - the fuzzing workflow - - the fuzzing campaign management workflow - - the overall workflow that is an overview of the above - - maybe more? where the technical writes seems it necessary for - understanding. - -Requirements: - * Documentation has to be in Markdown format - * Images have to be either in SVG or PNG format. - * All documentation should be (moved) in(to) docs/ - -The project does not require writing new documentation or tutorials beside the -cheat sheet. The technical information for the cheat sheet will be provided by -us. - -## Metrics - -AFL++ is a the highest performant fuzzer publicly available - but is also the -most feature rich and complex. With the publicity of AFL++' success and -deployment in Google projects internally and externally and availability as -a package on most Linux distributions we see more and more issues being -created and help requests on our Discord channel that would not be -necessary if people would have read through all our documentation - which -is unrealistic. - -We expect the the new documenation after this project to be cleaner, easier -accessible and lighter to digest by our users, resulting in much less -help requests. On the other hand the amount of users using AFL++ should -increase as well as it will be more accessible which would also increase -questions again - but overall resulting in a reduction of help requests. - -In numbers: we currently have per week on average 5 issues on Github, -10 questions on discord and 1 on mailing lists that would not be necessary -with perfect documentation and perfect people. - -We would consider this project a success if afterwards we only have -2 issues on Github and 3 questions on discord anymore that would be answered -by reading the documentation. The mailing list is usually used by the most -novice users and we don't expect any less questions there. - -## Project Budget - -We have zero experience with technical writers, so this is very hard for us -to calculate. We expect it to be a lot of work though because of the amount -of documentation we have that needs to be restructured and partially rewritten -(44 documents with 13k total lines of content). - -We assume the daily rate of a very good and experienced technical writer in -times of a pandemic to be ~500$ (according to web research), and calculate -the overall amout of work to be around 20 days for everything incl. the -graphics (but again - this is basically just guessing). - -Technical Writer 10000$ -Volunteer stipends 0$ (waved) -T-Shirts for the top 10 contributors and helpers to this documentation project: - 10 AFL++ logo t-shirts 20$ each 200$ - 10 shipping cost of t-shirts 10$ each 100$ - -Total: 10.300$ -(in the submission form 10.280$ was entered) - -## Additional Information - -We have participated in Google Summer of Code in 2020 and hope to be selected -again in 2021. - -We have no experience with a technical writer, but we will support that person -with video calls, chats, emails and messaging, provide all necessary information -and write technical contents that is required for the success of this project. -It is clear to us that a technical writer knows how to write, but cannot know -the technical details in a complex tooling like in AFL++. This guidance, input, -etc. has to come from us. diff --git a/docs/docs2.md b/docs/docs2.md deleted file mode 100644 index 23ef61c5..00000000 --- a/docs/docs2.md +++ /dev/null @@ -1,124 +0,0 @@ -# Restructure AFL++'s documentation - Case Study - -## Problem statement - -AFL++ inherited it's documentation from the original Google AFL project. -Since then it has been massively improved - feature and performance wise - -and although the documenation has likewise been continued it has grown out -of proportion. -The documentation is done by non-natives to the English language, plus -none of us has a writer background. - -We see questions on AFL++ usage on mailing lists (e.g. afl-users), discord -channels, web forums and as issues in our repository. -Most of them could be answered if people would read through all the -documentation. - -This only increases as AFL++ has been on the top of Google's fuzzbench -statistics (which measures the performance of fuzzers) and has been -integrated in Google's oss-fuzz and clusterfuzz - and is in many Unix -packaging repositories, e.g. Debian, FreeBSD, etc. - -AFL++ had 44 (!) documentation files with 13k total lines of content. -This was way too much. - -## Proposal abstract - -AFL++'s documentatin needs a complete overhaul, both on a -organisation/structural level as well as the content. - -Overall the following actions have to be performed: - * Create a better structure of documentation so it is easier to find the - information that is being looked for, combining and/or splitting up the - existing documents as needed. - * Rewrite some documentation to remove duplication. Several information is - present several times in the documentation. These should be removed to - where needed so that we have as little bloat as possible. - * The documents have been written and modified by a lot of different people, - most of them non-native English speaker. Hence an overall review where - parts should be rewritten has to be performed and then the rewrite done. - * Create a cheat-sheet for a very short best-setup build and run of AFL++ - * Pictures explain more than 1000 words. We need at least 4 images that - explain the workflow with AFL++: - - the build workflow - - the fuzzing workflow - - the fuzzing campaign management workflow - - the overall workflow that is an overview of the above - - maybe more? where the technical writes seems it necessary for - understanding. - -Requirements: - * Documentation has to be in Markdown format - * Images have to be either in SVG or PNG format. - * All documentation should be (moved) in(to) docs/ - -## Project description - -We created our proposal by discussing in the team what the issues are and -what was needed to fix it. -This resulted in the [project proposal](https://github.com/AFLplusplus/AFLplusplus/blob/stable/docs/docs.md). - -We did not want to be selected by a writer but select a writer ourselves, so -we combed through the list and reviewed every single one of them. -We were not looking for coders writing technical documentation, but rather -someone who is an experienced writer and has documented experience with -structuring documentation. -Few fit that profile and we sent out messages to 6 people. -We finally decided on Jana because she had a strong background in technical -documentation and structuring information. -She had no technical experience in fuzzing whatsoever, but we saw that as -a plus - of course this made the whole process longer to explain details, -but overall ensured that the documentation can be read by (mostly) everyone. - -We communicated via video calls every few weeks and she kept a public kanban -board about her todos, additional we used a Signal channel. -Her changes were imported via PRs where we discussed details. - -The project was off to a good start, but then Jana got pregnant with serious -side effects that made working impossible for her for a longer time, hence -the schedule was thrown back. -She offered to rescind the payment and we select a new writer, but we saw -little opportunity in that, as that would mean a new selection of a writer, -someone else with a different vision on how the result should look like so -basically a full restart of the project and a large impact on our own time. -So we agreed on - after discussion with the Google GSoD team - that she -continues the project after the GSoD completion deadline as best as she can. - -End of November she took one week off from work and fully dedicated her time -for the documenation which brought the project a big step forward. - -Originally the project should have been ended begin of October, but now - at -nearing the end of November, we are at about 85% completion, with the end -being expected around mid of December. - -## Metrics - -We merged most of the changes in our development branch and are getting -close to a state where the user documentation part is completed and we -can create a new release. Only then the new documentatin is actually visible -to users. Therefore no metrics could be collected so far. - -We plan on a user-assisted QA review end of November/begin of December. - -The documentation was reviewed by a few test users so far however who gave -it a thumbs up. - -## Summary - -The GSoD project itself is great. It helps to get the documentation back in -line. -It was and is a larger time investment from our side, but we expected that. -When the project is done, the documentation will be more accessible by users -and also need less maintenance by us. -There is still follow-up work to be done by us afterwards (web site for the -docs, etc.). - -Not sure what we would do differently next time. I think we prepared best as -possible and reacted best as possible to the unexpected. - -Recommendations for other organizations who would like to participate in GSoD: - - expect the process to take a larger part of your time. the writer needs - your full support. - - have someone dedicated from the dev/org side to support, educate and - supervice the writer - - set clear goals and expectations diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c index 9ca89944..fc8a0d55 100644 --- a/src/afl-fuzz-queue.c +++ b/src/afl-fuzz-queue.c @@ -769,8 +769,7 @@ void cull_queue(afl_state_t *afl) { afl->top_rated[i]->favored = 1; ++afl->queued_favored; - if (afl->top_rated[i]->fuzz_level == 0 || - !afl->top_rated[i]->was_fuzzed) { + if (!afl->top_rated[i]->was_fuzzed) { ++afl->pending_favored; @@ -936,7 +935,7 @@ u32 calculate_score(afl_state_t *afl, struct queue_entry *q) { n_items = 0; // Don't modify perf_score for unfuzzed seeds - if (q->fuzz_level == 0) break; + if (!q->fuzz_level) break; u32 i; for (i = 0; i < afl->queued_items; i++) { @@ -967,7 +966,7 @@ u32 calculate_score(afl_state_t *afl, struct queue_entry *q) { case FAST: // Don't modify unfuzzed seeds - if (q->fuzz_level == 0) break; + if (!q->fuzz_level) break; switch ((u32)log2(afl->n_fuzz[q->n_fuzz_entry])) { -- cgit 1.4.1 From 4217a6606c92f6a88ab577ae8f91823dd731562d Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Sat, 15 Jan 2022 13:58:17 +0100 Subject: fix classify counts --- include/afl-fuzz.h | 1 + include/coverage-32.h | 33 +++++++++++++++---- include/coverage-64.h | 51 ++++++++++++++++++++++------- instrumentation/afl-llvm-common.h | 16 ++++----- instrumentation/afl-llvm-pass.so.cc | 13 +++++--- instrumentation/cmplog-instructions-pass.cc | 33 ++++++++++--------- src/afl-cc.c | 5 +-- src/afl-fuzz-bitmap.c | 7 ++-- src/afl-fuzz-queue.c | 6 +--- 9 files changed, 108 insertions(+), 57 deletions(-) (limited to 'src') diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index e225211f..1340d9ef 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -1046,6 +1046,7 @@ u32 count_bytes(afl_state_t *, u8 *); u32 count_non_255_bytes(afl_state_t *, u8 *); void simplify_trace(afl_state_t *, u8 *); void classify_counts(afl_forkserver_t *); +void classify_counts_off(afl_forkserver_t *, u32); #ifdef WORD_SIZE_64 void discover_word(u8 *ret, u64 *current, u64 *virgin); #else diff --git a/include/coverage-32.h b/include/coverage-32.h index ca36c29f..d213db12 100644 --- a/include/coverage-32.h +++ b/include/coverage-32.h @@ -62,6 +62,23 @@ inline void classify_counts(afl_forkserver_t *fsrv) { } +inline void classify_counts_off(afl_forkserver_t *fsrv, u32 off) { + + u32 *mem = (u32 *)(fsrv->trace_bits + off); + u32 i = ((fsrv->map_size - off) >> 2); + + while (i--) { + + /* Optimize for sparse bitmaps. */ + + if (unlikely(*mem)) { *mem = classify_word(*mem); } + + mem++; + + } + +} + /* Updates the virgin bits, then reflects whether a new count or a new tuple is * seen in ret. */ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) { @@ -70,7 +87,7 @@ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) { that have not been already cleared from the virgin map - since this will almost always be the case. */ - if (*current & *virgin) { + if (unlikely(*current & *virgin)) { if (likely(*ret < 2)) { @@ -80,8 +97,8 @@ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) { /* Looks like we have not found any new bytes yet; see if any non-zero bytes in current[] are pristine in virgin[]. */ - if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) || - (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff)) + if (unlikely((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) || + (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff))) *ret = 2; else *ret = 1; @@ -97,12 +114,14 @@ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) { #define PACK_SIZE 16 inline u32 skim(const u32 *virgin, const u32 *current, const u32 *current_end) { + u32 *save = (u32*) current; + for (; current < current_end; virgin += 4, current += 4) { - if (current[0] && classify_word(current[0]) & virgin[0]) return 1; - if (current[1] && classify_word(current[1]) & virgin[1]) return 1; - if (current[2] && classify_word(current[2]) & virgin[2]) return 1; - if (current[3] && classify_word(current[3]) & virgin[3]) return 1; + if (unlikely(current[0] && classify_word(current[0]) & virgin[0])) return (u32)(¤t[1] - save); + if (unlikely(current[1] && classify_word(current[1]) & virgin[1])) return (u32)(¤t[2] - save); + if (unlikely(current[2] && classify_word(current[2]) & virgin[2])) return (u32)(¤t[3] - save); + if (unlikely(current[3] && classify_word(current[3]) & virgin[3])) return (u32)(¤t[4] - save); } diff --git a/include/coverage-64.h b/include/coverage-64.h index 54fe9d33..ab29506c 100644 --- a/include/coverage-64.h +++ b/include/coverage-64.h @@ -72,6 +72,23 @@ inline void classify_counts(afl_forkserver_t *fsrv) { } +inline void classify_counts_off(afl_forkserver_t *fsrv, u32 off) { + + u64 *mem = (u64 *)(fsrv->trace_bits + off); + u32 i = ((fsrv->map_size - off) >> 3); + + while (i--) { + + /* Optimize for sparse bitmaps. */ + + if (unlikely(*mem)) { *mem = classify_word(*mem); } + + mem++; + + } + +} + /* Updates the virgin bits, then reflects whether a new count or a new tuple is * seen in ret. */ inline void discover_word(u8 *ret, u64 *current, u64 *virgin) { @@ -110,17 +127,20 @@ inline void discover_word(u8 *ret, u64 *current, u64 *virgin) { #define PACK_SIZE 64 inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { + u64 *save = (u64*) current; + for (; current != current_end; virgin += 8, current += 8) { __m512i value = *(__m512i *)current; __mmask8 mask = _mm512_testn_epi64_mask(value, value); /* All bytes are zero. */ - if (mask == 0xff) continue; + if (likely(mask == 0xff)) continue; /* Look for nonzero bytes and check for new bits. */ - #define UNROLL(x) \ - if (!(mask & (1 << x)) && classify_word(current[x]) & virgin[x]) return 1 + #define UNROLL(x) \ + if (unlikely(!(mask & (1 << x)) && classify_word(current[x]) & virgin[x])) \ + return (u32)(¤t[x + 1] - save) UNROLL(0); UNROLL(1); UNROLL(2); @@ -143,6 +163,7 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { #define PACK_SIZE 32 inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { + u64 *save = (u64*) current; __m256i zeroes = _mm256_setzero_si256(); for (; current < current_end; virgin += 4, current += 4) { @@ -152,13 +173,17 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { u32 mask = _mm256_movemask_epi8(cmp); /* All bytes are zero. */ - if (mask == (u32)-1) continue; + if (likely(mask == (u32)-1)) continue; /* Look for nonzero bytes and check for new bits. */ - if (!(mask & 0xff) && classify_word(current[0]) & virgin[0]) return 1; - if (!(mask & 0xff00) && classify_word(current[1]) & virgin[1]) return 1; - if (!(mask & 0xff0000) && classify_word(current[2]) & virgin[2]) return 1; - if (!(mask & 0xff000000) && classify_word(current[3]) & virgin[3]) return 1; + if (unlikely(!(mask & 0xff) && classify_word(current[0]) & virgin[0])) + return (u32)(¤t[1] - save); + if (unlikely(!(mask & 0xff00) && classify_word(current[1]) & virgin[1])) + return (u32)(¤t[2] - save); + if (unlikely(!(mask & 0xff0000) && classify_word(current[2]) & virgin[2])) + return (u32)(¤t[3] - save); + if (unlikely(!(mask & 0xff000000) && classify_word(current[3]) & virgin[3])) + return (u32)(¤t[4] - save); } @@ -172,12 +197,14 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { #define PACK_SIZE 32 inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { + u64 *save = (u64*) current; + for (; current < current_end; virgin += 4, current += 4) { - if (current[0] && classify_word(current[0]) & virgin[0]) return 1; - if (current[1] && classify_word(current[1]) & virgin[1]) return 1; - if (current[2] && classify_word(current[2]) & virgin[2]) return 1; - if (current[3] && classify_word(current[3]) & virgin[3]) return 1; + if (unlikely(current[0] && classify_word(current[0]) & virgin[0])) return (u32)(¤t[1] - save); + if (unlikely(current[1] && classify_word(current[1]) & virgin[1])) return (u32)(¤t[2] - save); + if (unlikely(current[2] && classify_word(current[2]) & virgin[2])) return (u32)(¤t[3] - save); + if (unlikely(current[3] && classify_word(current[3]) & virgin[3])) return (u32)(¤t[4] - save); } diff --git a/instrumentation/afl-llvm-common.h b/instrumentation/afl-llvm-common.h index bd424e21..dee5f9fc 100644 --- a/instrumentation/afl-llvm-common.h +++ b/instrumentation/afl-llvm-common.h @@ -33,17 +33,17 @@ typedef long double max_align_t; #endif #if LLVM_VERSION_MAJOR >= 11 - #define MNAME M.getSourceFileName() - #define FMNAME F.getParent()->getSourceFileName() + #define MNAME M.getSourceFileName() + #define FMNAME F.getParent()->getSourceFileName() #else - #define MNAME std::string("") - #define FMNAME std::string("") + #define MNAME std::string("") + #define FMNAME std::string("") #endif -char * getBBName(const llvm::BasicBlock *BB); -bool isIgnoreFunction(const llvm::Function *F); -void initInstrumentList(); -bool isInInstrumentList(llvm::Function *F, std::string Filename); +char *getBBName(const llvm::BasicBlock *BB); +bool isIgnoreFunction(const llvm::Function *F); +void initInstrumentList(); +bool isInInstrumentList(llvm::Function *F, std::string Filename); unsigned long long int calculateCollisions(uint32_t edges); void scanForDangerousFunctions(llvm::Module *M); diff --git a/instrumentation/afl-llvm-pass.so.cc b/instrumentation/afl-llvm-pass.so.cc index 899734f8..5246ba08 100644 --- a/instrumentation/afl-llvm-pass.so.cc +++ b/instrumentation/afl-llvm-pass.so.cc @@ -631,18 +631,23 @@ bool AFLCoverage::runOnModule(Module &M) { LoadInst *PrevLoc; if (ngram_size) { + PrevLoc = IRB.CreateLoad( #if LLVM_VERSION_MAJOR >= 14 - PrevLocTy, + PrevLocTy, #endif - AFLPrevLoc); + AFLPrevLoc); + } else { + PrevLoc = IRB.CreateLoad( #if LLVM_VERSION_MAJOR >= 14 - IRB.getInt32Ty(), + IRB.getInt32Ty(), #endif - AFLPrevLoc); + AFLPrevLoc); + } + PrevLoc->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None)); Value *PrevLocTrans; diff --git a/instrumentation/cmplog-instructions-pass.cc b/instrumentation/cmplog-instructions-pass.cc index a0b386d5..310f5585 100644 --- a/instrumentation/cmplog-instructions-pass.cc +++ b/instrumentation/cmplog-instructions-pass.cc @@ -478,27 +478,28 @@ bool CmpLogInstructions::hookInstrs(Module &M) { */ if (is_fp) { -/* - ConstantFP *i0 = dyn_cast(op0); - ConstantFP *i1 = dyn_cast(op1); - // BUG FIXME TODO: this is null ... but why? - // fprintf(stderr, "%p %p\n", i0, i1); - if (i0) { + /* + ConstantFP *i0 = dyn_cast(op0); + ConstantFP *i1 = dyn_cast(op1); + // BUG FIXME TODO: this is null ... but why? + // fprintf(stderr, "%p %p\n", i0, i1); + if (i0) { - cur_val = (uint64_t)i0->getValue().convertToDouble(); - if (last_val0 && last_val0 == cur_val) { skip = 1; } - last_val0 = cur_val; + cur_val = (uint64_t)i0->getValue().convertToDouble(); + if (last_val0 && last_val0 == cur_val) { skip = 1; } + last_val0 = cur_val; - } + } - if (i1) { + if (i1) { - cur_val = (uint64_t)i1->getValue().convertToDouble(); - if (last_val1 && last_val1 == cur_val) { skip = 1; } - last_val1 = cur_val; + cur_val = (uint64_t)i1->getValue().convertToDouble(); + if (last_val1 && last_val1 == cur_val) { skip = 1; } + last_val1 = cur_val; - } -*/ + } + + */ } else { diff --git a/src/afl-cc.c b/src/afl-cc.c index 49000877..974b1d2a 100644 --- a/src/afl-cc.c +++ b/src/afl-cc.c @@ -876,11 +876,12 @@ static void edit_params(u32 argc, char **argv, char **envp) { cc_params[cc_par_cnt++] = "-fsanitize=leak"; cc_params[cc_par_cnt++] = "-includesanitizer/lsan_interface.h"; - cc_params[cc_par_cnt++] = "-D__AFL_LEAK_CHECK()={if(__lsan_do_recoverable_leak_check() > 0) _exit(23); }"; + cc_params[cc_par_cnt++] = + "-D__AFL_LEAK_CHECK()={if(__lsan_do_recoverable_leak_check() > 0) " + "_exit(23); }"; cc_params[cc_par_cnt++] = "-D__AFL_LSAN_OFF()=__lsan_disable();"; cc_params[cc_par_cnt++] = "-D__AFL_LSAN_ON()=__lsan_enable();"; - } if (getenv("AFL_USE_CFISAN")) { diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c index 8d044959..98a705a5 100644 --- a/src/afl-fuzz-bitmap.c +++ b/src/afl-fuzz-bitmap.c @@ -250,20 +250,21 @@ inline u8 has_new_bits(afl_state_t *afl, u8 *virgin_map) { inline u8 has_new_bits_unclassified(afl_state_t *afl, u8 *virgin_map) { /* Handle the hot path first: no new coverage */ + u32 off; u8 *end = afl->fsrv.trace_bits + afl->fsrv.map_size; #ifdef WORD_SIZE_64 - if (!skim((u64 *)virgin_map, (u64 *)afl->fsrv.trace_bits, (u64 *)end)) + if (!(off = skim((u64 *)virgin_map, (u64 *)afl->fsrv.trace_bits, (u64 *)end))) return 0; #else - if (!skim((u32 *)virgin_map, (u32 *)afl->fsrv.trace_bits, (u32 *)end)) + if (!(off = skim((u32 *)virgin_map, (u32 *)afl->fsrv.trace_bits, (u32 *)end))) return 0; #endif /* ^WORD_SIZE_64 */ - classify_counts(&afl->fsrv); + classify_counts_off(&afl->fsrv, off); return has_new_bits(afl, virgin_map); } diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c index fc8a0d55..713c7447 100644 --- a/src/afl-fuzz-queue.c +++ b/src/afl-fuzz-queue.c @@ -769,11 +769,7 @@ void cull_queue(afl_state_t *afl) { afl->top_rated[i]->favored = 1; ++afl->queued_favored; - if (!afl->top_rated[i]->was_fuzzed) { - - ++afl->pending_favored; - - } + if (!afl->top_rated[i]->was_fuzzed) { ++afl->pending_favored; } } -- cgit 1.4.1 From c8061e5b3531498df94524900bcb5e1c6cf8bb59 Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Mon, 17 Jan 2022 17:16:52 +0100 Subject: fix nyx -M --- src/afl-fuzz.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 1030dfdf..207a46af 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -1322,7 +1322,7 @@ int main(int argc, char **argv_orig, char **envp) { if (afl->fsrv.nyx_mode) { if (afl->fsrv.nyx_standalone && - strncmp(afl->sync_id, "default", strlen("default")) != 0) { + strcmp(afl->sync_id, "default") != 0) { FATAL( "distributed fuzzing is not supported in this Nyx mode (use -Y " @@ -1334,7 +1334,7 @@ int main(int argc, char **argv_orig, char **envp) { if (afl->is_main_node) { - if (strncmp("0", afl->sync_id, strlen("0") != 0)) { + if (strcmp("0", afl->sync_id) != 0) { FATAL( "for Nyx -Y mode, the Main (-M) parameter has to be set to 0 (-M " -- cgit 1.4.1 From 4bcb177f62695da4f76f3e74393c8018d52f8a7c Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Wed, 19 Jan 2022 22:17:36 +0100 Subject: Revert "fix classify counts" This reverts commit 4217a6606c92f6a88ab577ae8f91823dd731562d. --- include/afl-fuzz.h | 1 - include/coverage-32.h | 33 ++++--------------- include/coverage-64.h | 51 +++++++---------------------- instrumentation/afl-llvm-common.h | 16 ++++----- instrumentation/afl-llvm-pass.so.cc | 13 +++----- instrumentation/cmplog-instructions-pass.cc | 33 +++++++++---------- src/afl-cc.c | 5 ++- src/afl-fuzz-bitmap.c | 7 ++-- src/afl-fuzz-queue.c | 6 +++- 9 files changed, 57 insertions(+), 108 deletions(-) (limited to 'src') diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index 1340d9ef..e225211f 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -1046,7 +1046,6 @@ u32 count_bytes(afl_state_t *, u8 *); u32 count_non_255_bytes(afl_state_t *, u8 *); void simplify_trace(afl_state_t *, u8 *); void classify_counts(afl_forkserver_t *); -void classify_counts_off(afl_forkserver_t *, u32); #ifdef WORD_SIZE_64 void discover_word(u8 *ret, u64 *current, u64 *virgin); #else diff --git a/include/coverage-32.h b/include/coverage-32.h index d213db12..ca36c29f 100644 --- a/include/coverage-32.h +++ b/include/coverage-32.h @@ -62,23 +62,6 @@ inline void classify_counts(afl_forkserver_t *fsrv) { } -inline void classify_counts_off(afl_forkserver_t *fsrv, u32 off) { - - u32 *mem = (u32 *)(fsrv->trace_bits + off); - u32 i = ((fsrv->map_size - off) >> 2); - - while (i--) { - - /* Optimize for sparse bitmaps. */ - - if (unlikely(*mem)) { *mem = classify_word(*mem); } - - mem++; - - } - -} - /* Updates the virgin bits, then reflects whether a new count or a new tuple is * seen in ret. */ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) { @@ -87,7 +70,7 @@ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) { that have not been already cleared from the virgin map - since this will almost always be the case. */ - if (unlikely(*current & *virgin)) { + if (*current & *virgin) { if (likely(*ret < 2)) { @@ -97,8 +80,8 @@ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) { /* Looks like we have not found any new bytes yet; see if any non-zero bytes in current[] are pristine in virgin[]. */ - if (unlikely((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) || - (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff))) + if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) || + (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff)) *ret = 2; else *ret = 1; @@ -114,14 +97,12 @@ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) { #define PACK_SIZE 16 inline u32 skim(const u32 *virgin, const u32 *current, const u32 *current_end) { - u32 *save = (u32*) current; - for (; current < current_end; virgin += 4, current += 4) { - if (unlikely(current[0] && classify_word(current[0]) & virgin[0])) return (u32)(¤t[1] - save); - if (unlikely(current[1] && classify_word(current[1]) & virgin[1])) return (u32)(¤t[2] - save); - if (unlikely(current[2] && classify_word(current[2]) & virgin[2])) return (u32)(¤t[3] - save); - if (unlikely(current[3] && classify_word(current[3]) & virgin[3])) return (u32)(¤t[4] - save); + if (current[0] && classify_word(current[0]) & virgin[0]) return 1; + if (current[1] && classify_word(current[1]) & virgin[1]) return 1; + if (current[2] && classify_word(current[2]) & virgin[2]) return 1; + if (current[3] && classify_word(current[3]) & virgin[3]) return 1; } diff --git a/include/coverage-64.h b/include/coverage-64.h index ab29506c..54fe9d33 100644 --- a/include/coverage-64.h +++ b/include/coverage-64.h @@ -72,23 +72,6 @@ inline void classify_counts(afl_forkserver_t *fsrv) { } -inline void classify_counts_off(afl_forkserver_t *fsrv, u32 off) { - - u64 *mem = (u64 *)(fsrv->trace_bits + off); - u32 i = ((fsrv->map_size - off) >> 3); - - while (i--) { - - /* Optimize for sparse bitmaps. */ - - if (unlikely(*mem)) { *mem = classify_word(*mem); } - - mem++; - - } - -} - /* Updates the virgin bits, then reflects whether a new count or a new tuple is * seen in ret. */ inline void discover_word(u8 *ret, u64 *current, u64 *virgin) { @@ -127,20 +110,17 @@ inline void discover_word(u8 *ret, u64 *current, u64 *virgin) { #define PACK_SIZE 64 inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { - u64 *save = (u64*) current; - for (; current != current_end; virgin += 8, current += 8) { __m512i value = *(__m512i *)current; __mmask8 mask = _mm512_testn_epi64_mask(value, value); /* All bytes are zero. */ - if (likely(mask == 0xff)) continue; + if (mask == 0xff) continue; /* Look for nonzero bytes and check for new bits. */ - #define UNROLL(x) \ - if (unlikely(!(mask & (1 << x)) && classify_word(current[x]) & virgin[x])) \ - return (u32)(¤t[x + 1] - save) + #define UNROLL(x) \ + if (!(mask & (1 << x)) && classify_word(current[x]) & virgin[x]) return 1 UNROLL(0); UNROLL(1); UNROLL(2); @@ -163,7 +143,6 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { #define PACK_SIZE 32 inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { - u64 *save = (u64*) current; __m256i zeroes = _mm256_setzero_si256(); for (; current < current_end; virgin += 4, current += 4) { @@ -173,17 +152,13 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { u32 mask = _mm256_movemask_epi8(cmp); /* All bytes are zero. */ - if (likely(mask == (u32)-1)) continue; + if (mask == (u32)-1) continue; /* Look for nonzero bytes and check for new bits. */ - if (unlikely(!(mask & 0xff) && classify_word(current[0]) & virgin[0])) - return (u32)(¤t[1] - save); - if (unlikely(!(mask & 0xff00) && classify_word(current[1]) & virgin[1])) - return (u32)(¤t[2] - save); - if (unlikely(!(mask & 0xff0000) && classify_word(current[2]) & virgin[2])) - return (u32)(¤t[3] - save); - if (unlikely(!(mask & 0xff000000) && classify_word(current[3]) & virgin[3])) - return (u32)(¤t[4] - save); + if (!(mask & 0xff) && classify_word(current[0]) & virgin[0]) return 1; + if (!(mask & 0xff00) && classify_word(current[1]) & virgin[1]) return 1; + if (!(mask & 0xff0000) && classify_word(current[2]) & virgin[2]) return 1; + if (!(mask & 0xff000000) && classify_word(current[3]) & virgin[3]) return 1; } @@ -197,14 +172,12 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { #define PACK_SIZE 32 inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { - u64 *save = (u64*) current; - for (; current < current_end; virgin += 4, current += 4) { - if (unlikely(current[0] && classify_word(current[0]) & virgin[0])) return (u32)(¤t[1] - save); - if (unlikely(current[1] && classify_word(current[1]) & virgin[1])) return (u32)(¤t[2] - save); - if (unlikely(current[2] && classify_word(current[2]) & virgin[2])) return (u32)(¤t[3] - save); - if (unlikely(current[3] && classify_word(current[3]) & virgin[3])) return (u32)(¤t[4] - save); + if (current[0] && classify_word(current[0]) & virgin[0]) return 1; + if (current[1] && classify_word(current[1]) & virgin[1]) return 1; + if (current[2] && classify_word(current[2]) & virgin[2]) return 1; + if (current[3] && classify_word(current[3]) & virgin[3]) return 1; } diff --git a/instrumentation/afl-llvm-common.h b/instrumentation/afl-llvm-common.h index dee5f9fc..bd424e21 100644 --- a/instrumentation/afl-llvm-common.h +++ b/instrumentation/afl-llvm-common.h @@ -33,17 +33,17 @@ typedef long double max_align_t; #endif #if LLVM_VERSION_MAJOR >= 11 - #define MNAME M.getSourceFileName() - #define FMNAME F.getParent()->getSourceFileName() + #define MNAME M.getSourceFileName() + #define FMNAME F.getParent()->getSourceFileName() #else - #define MNAME std::string("") - #define FMNAME std::string("") + #define MNAME std::string("") + #define FMNAME std::string("") #endif -char *getBBName(const llvm::BasicBlock *BB); -bool isIgnoreFunction(const llvm::Function *F); -void initInstrumentList(); -bool isInInstrumentList(llvm::Function *F, std::string Filename); +char * getBBName(const llvm::BasicBlock *BB); +bool isIgnoreFunction(const llvm::Function *F); +void initInstrumentList(); +bool isInInstrumentList(llvm::Function *F, std::string Filename); unsigned long long int calculateCollisions(uint32_t edges); void scanForDangerousFunctions(llvm::Module *M); diff --git a/instrumentation/afl-llvm-pass.so.cc b/instrumentation/afl-llvm-pass.so.cc index 5246ba08..899734f8 100644 --- a/instrumentation/afl-llvm-pass.so.cc +++ b/instrumentation/afl-llvm-pass.so.cc @@ -631,23 +631,18 @@ bool AFLCoverage::runOnModule(Module &M) { LoadInst *PrevLoc; if (ngram_size) { - PrevLoc = IRB.CreateLoad( #if LLVM_VERSION_MAJOR >= 14 - PrevLocTy, + PrevLocTy, #endif - AFLPrevLoc); - + AFLPrevLoc); } else { - PrevLoc = IRB.CreateLoad( #if LLVM_VERSION_MAJOR >= 14 - IRB.getInt32Ty(), + IRB.getInt32Ty(), #endif - AFLPrevLoc); - + AFLPrevLoc); } - PrevLoc->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None)); Value *PrevLocTrans; diff --git a/instrumentation/cmplog-instructions-pass.cc b/instrumentation/cmplog-instructions-pass.cc index 310f5585..a0b386d5 100644 --- a/instrumentation/cmplog-instructions-pass.cc +++ b/instrumentation/cmplog-instructions-pass.cc @@ -478,28 +478,27 @@ bool CmpLogInstructions::hookInstrs(Module &M) { */ if (is_fp) { - /* - ConstantFP *i0 = dyn_cast(op0); - ConstantFP *i1 = dyn_cast(op1); - // BUG FIXME TODO: this is null ... but why? - // fprintf(stderr, "%p %p\n", i0, i1); - if (i0) { - - cur_val = (uint64_t)i0->getValue().convertToDouble(); - if (last_val0 && last_val0 == cur_val) { skip = 1; } - last_val0 = cur_val; +/* + ConstantFP *i0 = dyn_cast(op0); + ConstantFP *i1 = dyn_cast(op1); + // BUG FIXME TODO: this is null ... but why? + // fprintf(stderr, "%p %p\n", i0, i1); + if (i0) { - } + cur_val = (uint64_t)i0->getValue().convertToDouble(); + if (last_val0 && last_val0 == cur_val) { skip = 1; } + last_val0 = cur_val; - if (i1) { + } - cur_val = (uint64_t)i1->getValue().convertToDouble(); - if (last_val1 && last_val1 == cur_val) { skip = 1; } - last_val1 = cur_val; + if (i1) { - } + cur_val = (uint64_t)i1->getValue().convertToDouble(); + if (last_val1 && last_val1 == cur_val) { skip = 1; } + last_val1 = cur_val; - */ + } +*/ } else { diff --git a/src/afl-cc.c b/src/afl-cc.c index 974b1d2a..49000877 100644 --- a/src/afl-cc.c +++ b/src/afl-cc.c @@ -876,12 +876,11 @@ static void edit_params(u32 argc, char **argv, char **envp) { cc_params[cc_par_cnt++] = "-fsanitize=leak"; cc_params[cc_par_cnt++] = "-includesanitizer/lsan_interface.h"; - cc_params[cc_par_cnt++] = - "-D__AFL_LEAK_CHECK()={if(__lsan_do_recoverable_leak_check() > 0) " - "_exit(23); }"; + cc_params[cc_par_cnt++] = "-D__AFL_LEAK_CHECK()={if(__lsan_do_recoverable_leak_check() > 0) _exit(23); }"; cc_params[cc_par_cnt++] = "-D__AFL_LSAN_OFF()=__lsan_disable();"; cc_params[cc_par_cnt++] = "-D__AFL_LSAN_ON()=__lsan_enable();"; + } if (getenv("AFL_USE_CFISAN")) { diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c index 98a705a5..8d044959 100644 --- a/src/afl-fuzz-bitmap.c +++ b/src/afl-fuzz-bitmap.c @@ -250,21 +250,20 @@ inline u8 has_new_bits(afl_state_t *afl, u8 *virgin_map) { inline u8 has_new_bits_unclassified(afl_state_t *afl, u8 *virgin_map) { /* Handle the hot path first: no new coverage */ - u32 off; u8 *end = afl->fsrv.trace_bits + afl->fsrv.map_size; #ifdef WORD_SIZE_64 - if (!(off = skim((u64 *)virgin_map, (u64 *)afl->fsrv.trace_bits, (u64 *)end))) + if (!skim((u64 *)virgin_map, (u64 *)afl->fsrv.trace_bits, (u64 *)end)) return 0; #else - if (!(off = skim((u32 *)virgin_map, (u32 *)afl->fsrv.trace_bits, (u32 *)end))) + if (!skim((u32 *)virgin_map, (u32 *)afl->fsrv.trace_bits, (u32 *)end)) return 0; #endif /* ^WORD_SIZE_64 */ - classify_counts_off(&afl->fsrv, off); + classify_counts(&afl->fsrv); return has_new_bits(afl, virgin_map); } diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c index 713c7447..fc8a0d55 100644 --- a/src/afl-fuzz-queue.c +++ b/src/afl-fuzz-queue.c @@ -769,7 +769,11 @@ void cull_queue(afl_state_t *afl) { afl->top_rated[i]->favored = 1; ++afl->queued_favored; - if (!afl->top_rated[i]->was_fuzzed) { ++afl->pending_favored; } + if (!afl->top_rated[i]->was_fuzzed) { + + ++afl->pending_favored; + + } } -- cgit 1.4.1 From 550ba4d77294e61597a5259d00769c61281e0042 Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Wed, 19 Jan 2022 22:26:52 +0100 Subject: nits and code format --- frida_mode/src/instrument/instrument_x64.c | 2 +- include/coverage-32.h | 14 ++++++------ include/coverage-64.h | 29 ++++++++++++++----------- instrumentation/afl-llvm-common.h | 16 +++++++------- instrumentation/afl-llvm-pass.so.cc | 13 ++++++++---- instrumentation/cmplog-instructions-pass.cc | 33 +++++++++++++++-------------- src/afl-cc.c | 5 +++-- src/afl-fuzz-queue.c | 6 +----- src/afl-fuzz.c | 3 +-- unicorn_mode/unicornafl | 2 +- 10 files changed, 65 insertions(+), 58 deletions(-) (limited to 'src') diff --git a/frida_mode/src/instrument/instrument_x64.c b/frida_mode/src/instrument/instrument_x64.c index 217c8c9b..fb84d6d2 100644 --- a/frida_mode/src/instrument/instrument_x64.c +++ b/frida_mode/src/instrument/instrument_x64.c @@ -216,7 +216,7 @@ static gboolean instrument_coverage_find_low(const GumRangeDetails *details, static GumAddress last_limit = (64ULL << 10); gpointer * address = (gpointer *)user_data; - last_limit = GUM_ALIGN_SIZE (last_limit, __afl_map_size); + last_limit = GUM_ALIGN_SIZE(last_limit, __afl_map_size); if ((details->range->base_address - last_limit) > __afl_map_size) { diff --git a/include/coverage-32.h b/include/coverage-32.h index ca36c29f..89c08cdf 100644 --- a/include/coverage-32.h +++ b/include/coverage-32.h @@ -70,7 +70,7 @@ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) { that have not been already cleared from the virgin map - since this will almost always be the case. */ - if (*current & *virgin) { + if (unlikely(*current & *virgin)) { if (likely(*ret < 2)) { @@ -80,8 +80,8 @@ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) { /* Looks like we have not found any new bytes yet; see if any non-zero bytes in current[] are pristine in virgin[]. */ - if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) || - (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff)) + if (unlikely((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) || + (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff))) *ret = 2; else *ret = 1; @@ -99,10 +99,10 @@ inline u32 skim(const u32 *virgin, const u32 *current, const u32 *current_end) { for (; current < current_end; virgin += 4, current += 4) { - if (current[0] && classify_word(current[0]) & virgin[0]) return 1; - if (current[1] && classify_word(current[1]) & virgin[1]) return 1; - if (current[2] && classify_word(current[2]) & virgin[2]) return 1; - if (current[3] && classify_word(current[3]) & virgin[3]) return 1; + if (unlikely(current[0] && classify_word(current[0]) & virgin[0])) return 1; + if (unlikely(current[1] && classify_word(current[1]) & virgin[1])) return 1; + if (unlikely(current[2] && classify_word(current[2]) & virgin[2])) return 1; + if (unlikely(current[3] && classify_word(current[3]) & virgin[3])) return 1; } diff --git a/include/coverage-64.h b/include/coverage-64.h index 54fe9d33..aab79d79 100644 --- a/include/coverage-64.h +++ b/include/coverage-64.h @@ -116,11 +116,12 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { __mmask8 mask = _mm512_testn_epi64_mask(value, value); /* All bytes are zero. */ - if (mask == 0xff) continue; + if (likely(mask == 0xff)) continue; /* Look for nonzero bytes and check for new bits. */ - #define UNROLL(x) \ - if (!(mask & (1 << x)) && classify_word(current[x]) & virgin[x]) return 1 + #define UNROLL(x) \ + if (unlikely(!(mask & (1 << x)) && classify_word(current[x]) & virgin[x])) \ + return 1 UNROLL(0); UNROLL(1); UNROLL(2); @@ -152,13 +153,17 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { u32 mask = _mm256_movemask_epi8(cmp); /* All bytes are zero. */ - if (mask == (u32)-1) continue; + if (likely(mask == (u32)-1)) continue; /* Look for nonzero bytes and check for new bits. */ - if (!(mask & 0xff) && classify_word(current[0]) & virgin[0]) return 1; - if (!(mask & 0xff00) && classify_word(current[1]) & virgin[1]) return 1; - if (!(mask & 0xff0000) && classify_word(current[2]) & virgin[2]) return 1; - if (!(mask & 0xff000000) && classify_word(current[3]) & virgin[3]) return 1; + if (unlikely(!(mask & 0xff) && classify_word(current[0]) & virgin[0])) + return 1; + if (unlikely(!(mask & 0xff00) && classify_word(current[1]) & virgin[1])) + return 1; + if (unlikely(!(mask & 0xff0000) && classify_word(current[2]) & virgin[2])) + return 1; + if (unlikely(!(mask & 0xff000000) && classify_word(current[3]) & virgin[3])) + return 1; } @@ -174,10 +179,10 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { for (; current < current_end; virgin += 4, current += 4) { - if (current[0] && classify_word(current[0]) & virgin[0]) return 1; - if (current[1] && classify_word(current[1]) & virgin[1]) return 1; - if (current[2] && classify_word(current[2]) & virgin[2]) return 1; - if (current[3] && classify_word(current[3]) & virgin[3]) return 1; + if (unlikely(current[0] && classify_word(current[0]) & virgin[0])) return 1; + if (unlikely(current[1] && classify_word(current[1]) & virgin[1])) return 1; + if (unlikely(current[2] && classify_word(current[2]) & virgin[2])) return 1; + if (unlikely(current[3] && classify_word(current[3]) & virgin[3])) return 1; } diff --git a/instrumentation/afl-llvm-common.h b/instrumentation/afl-llvm-common.h index bd424e21..dee5f9fc 100644 --- a/instrumentation/afl-llvm-common.h +++ b/instrumentation/afl-llvm-common.h @@ -33,17 +33,17 @@ typedef long double max_align_t; #endif #if LLVM_VERSION_MAJOR >= 11 - #define MNAME M.getSourceFileName() - #define FMNAME F.getParent()->getSourceFileName() + #define MNAME M.getSourceFileName() + #define FMNAME F.getParent()->getSourceFileName() #else - #define MNAME std::string("") - #define FMNAME std::string("") + #define MNAME std::string("") + #define FMNAME std::string("") #endif -char * getBBName(const llvm::BasicBlock *BB); -bool isIgnoreFunction(const llvm::Function *F); -void initInstrumentList(); -bool isInInstrumentList(llvm::Function *F, std::string Filename); +char *getBBName(const llvm::BasicBlock *BB); +bool isIgnoreFunction(const llvm::Function *F); +void initInstrumentList(); +bool isInInstrumentList(llvm::Function *F, std::string Filename); unsigned long long int calculateCollisions(uint32_t edges); void scanForDangerousFunctions(llvm::Module *M); diff --git a/instrumentation/afl-llvm-pass.so.cc b/instrumentation/afl-llvm-pass.so.cc index 899734f8..5246ba08 100644 --- a/instrumentation/afl-llvm-pass.so.cc +++ b/instrumentation/afl-llvm-pass.so.cc @@ -631,18 +631,23 @@ bool AFLCoverage::runOnModule(Module &M) { LoadInst *PrevLoc; if (ngram_size) { + PrevLoc = IRB.CreateLoad( #if LLVM_VERSION_MAJOR >= 14 - PrevLocTy, + PrevLocTy, #endif - AFLPrevLoc); + AFLPrevLoc); + } else { + PrevLoc = IRB.CreateLoad( #if LLVM_VERSION_MAJOR >= 14 - IRB.getInt32Ty(), + IRB.getInt32Ty(), #endif - AFLPrevLoc); + AFLPrevLoc); + } + PrevLoc->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None)); Value *PrevLocTrans; diff --git a/instrumentation/cmplog-instructions-pass.cc b/instrumentation/cmplog-instructions-pass.cc index a0b386d5..310f5585 100644 --- a/instrumentation/cmplog-instructions-pass.cc +++ b/instrumentation/cmplog-instructions-pass.cc @@ -478,27 +478,28 @@ bool CmpLogInstructions::hookInstrs(Module &M) { */ if (is_fp) { -/* - ConstantFP *i0 = dyn_cast(op0); - ConstantFP *i1 = dyn_cast(op1); - // BUG FIXME TODO: this is null ... but why? - // fprintf(stderr, "%p %p\n", i0, i1); - if (i0) { + /* + ConstantFP *i0 = dyn_cast(op0); + ConstantFP *i1 = dyn_cast(op1); + // BUG FIXME TODO: this is null ... but why? + // fprintf(stderr, "%p %p\n", i0, i1); + if (i0) { - cur_val = (uint64_t)i0->getValue().convertToDouble(); - if (last_val0 && last_val0 == cur_val) { skip = 1; } - last_val0 = cur_val; + cur_val = (uint64_t)i0->getValue().convertToDouble(); + if (last_val0 && last_val0 == cur_val) { skip = 1; } + last_val0 = cur_val; - } + } - if (i1) { + if (i1) { - cur_val = (uint64_t)i1->getValue().convertToDouble(); - if (last_val1 && last_val1 == cur_val) { skip = 1; } - last_val1 = cur_val; + cur_val = (uint64_t)i1->getValue().convertToDouble(); + if (last_val1 && last_val1 == cur_val) { skip = 1; } + last_val1 = cur_val; - } -*/ + } + + */ } else { diff --git a/src/afl-cc.c b/src/afl-cc.c index 49000877..974b1d2a 100644 --- a/src/afl-cc.c +++ b/src/afl-cc.c @@ -876,11 +876,12 @@ static void edit_params(u32 argc, char **argv, char **envp) { cc_params[cc_par_cnt++] = "-fsanitize=leak"; cc_params[cc_par_cnt++] = "-includesanitizer/lsan_interface.h"; - cc_params[cc_par_cnt++] = "-D__AFL_LEAK_CHECK()={if(__lsan_do_recoverable_leak_check() > 0) _exit(23); }"; + cc_params[cc_par_cnt++] = + "-D__AFL_LEAK_CHECK()={if(__lsan_do_recoverable_leak_check() > 0) " + "_exit(23); }"; cc_params[cc_par_cnt++] = "-D__AFL_LSAN_OFF()=__lsan_disable();"; cc_params[cc_par_cnt++] = "-D__AFL_LSAN_ON()=__lsan_enable();"; - } if (getenv("AFL_USE_CFISAN")) { diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c index fc8a0d55..713c7447 100644 --- a/src/afl-fuzz-queue.c +++ b/src/afl-fuzz-queue.c @@ -769,11 +769,7 @@ void cull_queue(afl_state_t *afl) { afl->top_rated[i]->favored = 1; ++afl->queued_favored; - if (!afl->top_rated[i]->was_fuzzed) { - - ++afl->pending_favored; - - } + if (!afl->top_rated[i]->was_fuzzed) { ++afl->pending_favored; } } diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 207a46af..1edf82f4 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -1321,8 +1321,7 @@ int main(int argc, char **argv_orig, char **envp) { #ifdef __linux__ if (afl->fsrv.nyx_mode) { - if (afl->fsrv.nyx_standalone && - strcmp(afl->sync_id, "default") != 0) { + if (afl->fsrv.nyx_standalone && strcmp(afl->sync_id, "default") != 0) { FATAL( "distributed fuzzing is not supported in this Nyx mode (use -Y " diff --git a/unicorn_mode/unicornafl b/unicorn_mode/unicornafl index 6c7392fb..9df92d68 160000 --- a/unicorn_mode/unicornafl +++ b/unicorn_mode/unicornafl @@ -1 +1 @@ -Subproject commit 6c7392fb5a607c0ad53b3082fa6cbfae9720306a +Subproject commit 9df92d6868e8b219886e4b7458e5e134c48ff2c9 -- cgit 1.4.1