From e423e0a0f1cdbb0f3a369030d9c3f791b5ee139f Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sat, 21 Sep 2019 19:00:43 +0200
Subject: make tests

---
 test/test.sh | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100755 test/test.sh

(limited to 'test')

diff --git a/test/test.sh b/test/test.sh
new file mode 100755
index 00000000..3b70509a
--- /dev/null
+++ b/test/test.sh
@@ -0,0 +1,74 @@
+#!/bin/bash
+
+#
+# Ensure we have: test, type, diff -q, echo -e, grep -qE
+#
+test -z "" 2> /dev/null || { echo Error: test command not found ; exit 1 ; }
+GREP=`type grep > /dev/null 2>&1 && echo OK`
+test "$GREP" = OK || { echo Error: grep command not found ; exit 1 ; }
+echo foobar | grep -aqE 'asd|oob' 2> /dev/null || { echo Error: grep command does not support -q, -a and/or -E option ; exit 1 ; }
+echo 1 > test.1
+echo 1 > test.2
+OK=OK
+diff -q test.1 test.2 >/dev/null 2>&1 || OK=
+rm -f test.1 test.2
+test -z "$OK" && { echo Error: diff -q is not working ; exit 1 ; }
+
+ECHO="echo -e"
+$ECHO '\x41' 2>&1 | grep -qE '^A' || {
+  ECHO=
+  test -e /bin/echo && {
+    ECHO="/bin/echo -e"
+    $ECHO '\x41' 2>&1 | grep -qE '^A' || ECHO=
+  }
+}
+test -z "$ECHO" && { echo Error: echo command does not support -e option ; exit 1 ; }
+
+GREY="\\x1b[1;90m"
+GREEN="\\x1b[0;32m"
+RED="\\x1b[0;31m"
+YELLOW="\\x1b[1;93m"
+RESET="\\x1b[0m"
+
+$ECHO "$RESET"
+
+test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && {
+  ../afl-gcc -o test-instr.plain ../test-instr.c > /dev/null 2>&1
+  AFL_HARDEN=1 ../afl-gcc -o test-instr.harden ../test-instr.c > /dev/null 2>&1
+  test -e test-instr.plain && {
+    $ECHO "$GREEN[*] afl-gcc compilation succeeded"
+    echo 0 | ../afl-showmap -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
+    ../afl-showmap -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
+    test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
+      diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
+        $ECHO "$RED[!] afl-gcc instrumentation should be different on different input but is not"
+      } || $ECHO "$GREEN[*] afl-gcc instrumentation present and working correctly"
+    } || $ECHO "$RED[!] afl-gcc instrumentation failed"
+    rm -f test-instr.plain test-instr.plain.0 test-instr.plain.1
+  } || $ECHO "$RED[!] afl-gcc failed"
+  test -e test-instr.harden && {
+    grep -qa fstack-protector-all test-instr.harden > /dev/null 2>&1 && {
+      $ECHO "$GREEN[*] afl-gcc hardened mode succeeded and is working"
+    } || $ECHO "$RED[!] hardened mode is not hardened"
+    rm -f test-instr.harden
+  } || $ECHO "$RED[!] afl-gcc hardened mode compilation failed"
+  
+
+} || $ECHO "$YELLOW[-] afl is not compiled, cannot test"
+
+test -e ../afl-clang-fast && {
+  echo todo: llvm_mode
+
+
+} || $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test"
+
+test -e ../libtokencap.so && {
+  echo todo: libtokencap
+
+} || $ECHO "$YELLOW[-] libtokencap is not compiled, cannot test"
+
+$ECHO "$RESET"
+
+# libdislocator
+# unicorn
+# qemu
\ No newline at end of file
-- 
cgit 1.4.1


From 6488400fbfe94e14f95c9d86d16987e3eac6e273 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sat, 21 Sep 2019 23:38:46 +0200
Subject: more test cases

---
 test/test-compcov.c | 29 +++++++++++++++++++++++
 test/test.sh        | 66 ++++++++++++++++++++++++++++++++++++++++++-----------
 2 files changed, 82 insertions(+), 13 deletions(-)
 create mode 100644 test/test-compcov.c

(limited to 'test')

diff --git a/test/test-compcov.c b/test/test-compcov.c
new file mode 100644
index 00000000..bbad3aed
--- /dev/null
+++ b/test/test-compcov.c
@@ -0,0 +1,29 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+
+int main(int argc, char** argv) {
+
+  char *buf;
+
+  if (argc > 1) {
+  
+    if (strcmp(argv[1], "LIBTOKENCAP") == 0)
+      printf("your string was libtokencap\n");
+    else if (strcmp(argv[1], "BUGMENOT") == 0)
+      printf("your string was bugmenot\n");
+    else if (strcmp(argv[1], "BUFFEROVERFLOW") == 0) {
+      buf = malloc(16);
+      strcpy(buf, "TEST");
+      strcat(buf, argv[1]);
+      printf("This will only crash with libdislocator: %s\n", buf);
+      return 0;
+    } else
+      printf("I do not know your string\n");
+  
+  }
+
+  return 0;
+
+}
diff --git a/test/test.sh b/test/test.sh
index 3b70509a..0e2ba52b 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -1,10 +1,11 @@
 #!/bin/bash
 
 #
-# Ensure we have: test, type, diff -q, echo -e, grep -qE
+# Ensure we have: test, type, diff -q, echo -e, grep -aqE, timeout
 #
 test -z "" 2> /dev/null || { echo Error: test command not found ; exit 1 ; }
 GREP=`type grep > /dev/null 2>&1 && echo OK`
+TIMEOUT=`type timeout > /dev/null 2>&1 && echo OK`
 test "$GREP" = OK || { echo Error: grep command not found ; exit 1 ; }
 echo foobar | grep -aqE 'asd|oob' 2> /dev/null || { echo Error: grep command does not support -q, -a and/or -E option ; exit 1 ; }
 echo 1 > test.1
@@ -24,6 +25,9 @@ $ECHO '\x41' 2>&1 | grep -qE '^A' || {
 }
 test -z "$ECHO" && { echo Error: echo command does not support -e option ; exit 1 ; }
 
+export AFL_EXIT_WHEN_DONE=1
+export AFL_SKIP_CPUFREQ=1
+
 GREY="\\x1b[1;90m"
 GREEN="\\x1b[0;32m"
 RED="\\x1b[0;31m"
@@ -36,39 +40,75 @@ test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && {
   ../afl-gcc -o test-instr.plain ../test-instr.c > /dev/null 2>&1
   AFL_HARDEN=1 ../afl-gcc -o test-instr.harden ../test-instr.c > /dev/null 2>&1
   test -e test-instr.plain && {
-    $ECHO "$GREEN[*] afl-gcc compilation succeeded"
+    $ECHO "$GREEN[+] afl-gcc compilation succeeded"
     echo 0 | ../afl-showmap -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
     ../afl-showmap -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
     test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
       diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
         $ECHO "$RED[!] afl-gcc instrumentation should be different on different input but is not"
-      } || $ECHO "$GREEN[*] afl-gcc instrumentation present and working correctly"
+      } || $ECHO "$GREEN[+] afl-gcc instrumentation present and working correctly"
     } || $ECHO "$RED[!] afl-gcc instrumentation failed"
-    rm -f test-instr.plain test-instr.plain.0 test-instr.plain.1
+    rm -f test-instr.plain.0 test-instr.plain.1
   } || $ECHO "$RED[!] afl-gcc failed"
   test -e test-instr.harden && {
     grep -qa fstack-protector-all test-instr.harden > /dev/null 2>&1 && {
-      $ECHO "$GREEN[*] afl-gcc hardened mode succeeded and is working"
+      $ECHO "$GREEN[+] afl-gcc hardened mode succeeded and is working"
     } || $ECHO "$RED[!] hardened mode is not hardened"
     rm -f test-instr.harden
   } || $ECHO "$RED[!] afl-gcc hardened mode compilation failed"
-  
-
+  # now we want to be sure that afl-fuzz is working  
+  test -n "$TIMEOUT" && {
+    mkdir -p in
+    echo 0 > in/in
+    $ECHO "$GREY[*] running afl-fuzz, this will take approx 10 seconds"
+    {
+      timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1
+    } > /dev/null 2>&1
+    test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
+      $ECHO "$GREEN[+] afl-fuzz is working correctly"
+    } || $ECHO "$RED[!] afl-fuzz is not working correctly"
+    rm -rf in out
+  } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command"
+  rm -f test-instr.plain
 } || $ECHO "$YELLOW[-] afl is not compiled, cannot test"
 
 test -e ../afl-clang-fast && {
-  echo todo: llvm_mode
 
+  echo todo: llvm_mode
 
 } || $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test"
 
-test -e ../libtokencap.so && {
-  echo todo: libtokencap
+gcc -o test-compcov test-compcov.c > /dev/null 2>&1
 
+test -e ../libtokencap.so && {
+  AFL_TOKEN_FILE=token.out LD_PRELOAD=../libtokencap.so ./test-compcov foobar > /dev/null 2>&1
+  grep -q BUGMENOT token.out > /dev/null 2>&1 && {
+    $ECHO "$GREEN[+] libtokencap did successfully capture tokens"
+  } || $ECHO "$RED[!] libtokencap did not capture tokens"
+  rm -f token.out
 } || $ECHO "$YELLOW[-] libtokencap is not compiled, cannot test"
 
+test -e ../libdislocator.so && {
+  {
+    ulimit -c 1
+    LD_PRELOAD=../libdislocator.so ./test-compcov BUFFEROVERFLOW > test.out 2> /dev/null
+  } > /dev/null 2>&1
+  grep -q BUFFEROVERFLOW test.out > /dev/null 2>&1 && {
+    $ECHO "$RED[!] libdislocator did not detect the memory corruption"
+  } || $ECHO "$GREEN[+] libdislocator did successfully detect the memory corruption" 
+  rm -f test.out core test-compcov.core core.test-compcov
+} || $ECHO "$YELLOW[-] libdislocator is not compiled, cannot test"
+
+test -e ../afl-qemu-trace && {
+
+  echo todo: qemu_mode
+  # we will use test-compcov for testing libcompcov
+
+} || $ECHO "$YELLOW[-] qemu_mode is not compiled, cannot test"
+
+rm -f test-compcov
+
+$ECHO "$GREY[*] all tests completed!"
 $ECHO "$RESET"
 
-# libdislocator
-# unicorn
-# qemu
\ No newline at end of file
+# unicorn_mode ?
-- 
cgit 1.4.1


From 7adb7cf7f698b309029d4853b1ec8900fe1baafe Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 22 Sep 2019 10:42:48 +0200
Subject: more tests

---
 Makefile                      |  2 +-
 llvm_mode/afl-llvm-pass.so.cc |  4 +--
 test/test.sh                  | 66 ++++++++++++++++++++++++++++++++++++++++---
 3 files changed, 64 insertions(+), 8 deletions(-)

(limited to 'test')

diff --git a/Makefile b/Makefile
index 5d9a55a6..d7309cff 100644
--- a/Makefile
+++ b/Makefile
@@ -80,7 +80,7 @@ endif
 
 all:	test_x86 test_shm test_python27 ready $(PROGS) afl-as test_build all_done
 
-tests:
+tests:	source-only
 	@cd test ; ./test.sh
 
 help:
diff --git a/llvm_mode/afl-llvm-pass.so.cc b/llvm_mode/afl-llvm-pass.so.cc
index 5d531a87..58acd9be 100644
--- a/llvm_mode/afl-llvm-pass.so.cc
+++ b/llvm_mode/afl-llvm-pass.so.cc
@@ -105,9 +105,7 @@ bool AFLCoverage::runOnModule(Module &M) {
 
     SAYF(cCYA "afl-llvm-pass" VERSION cRST " by <lszekeres@google.com>\n");
 
-  } else
-
-    be_quiet = 1;
+  } else if (getenv("AFL_QUIET")) be_quiet = 1;
 
   /* Decide instrumentation ratio */
 
diff --git a/test/test.sh b/test/test.sh
index 0e2ba52b..6a706ab9 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -34,7 +34,7 @@ RED="\\x1b[0;31m"
 YELLOW="\\x1b[1;93m"
 RESET="\\x1b[0m"
 
-$ECHO "$RESET"
+$ECHO "${RESET}${GREY}[*] starting afl++ test framework ..."
 
 test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && {
   ../afl-gcc -o test-instr.plain ../test-instr.c > /dev/null 2>&1
@@ -65,7 +65,7 @@ test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && {
       timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1
     } > /dev/null 2>&1
     test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
-      $ECHO "$GREEN[+] afl-fuzz is working correctly"
+      $ECHO "$GREEN[+] afl-fuzz is working correctly with afl-gcc"
     } || $ECHO "$RED[!] afl-fuzz is not working correctly"
     rm -rf in out
   } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command"
@@ -74,7 +74,65 @@ test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && {
 
 test -e ../afl-clang-fast && {
 
-  echo todo: llvm_mode
+  ../afl-clang-fast -o test-instr.plain ../test-instr.c > /dev/null 2>&1
+  AFL_HARDEN=1 ../afl-clang-fast -o test-compcov.harden test-compcov.c > /dev/null 2>&1
+  test -e test-instr.plain && {
+    $ECHO "$GREEN[+] llvm_mode compilation succeeded"
+    echo 0 | ../afl-showmap -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
+    ../afl-showmap -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
+    test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
+      diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
+        $ECHO "$RED[!] llvm_mode instrumentation should be different on different input but is not"
+      } || $ECHO "$GREEN[+] llvm_mode instrumentation present and working correctly"
+    } || $ECHO "$RED[!] llvm_mode instrumentation failed"
+    rm -f test-instr.plain.0 test-instr.plain.1
+  } || $ECHO "$RED[!] llvm_mode failed"
+  test -e test-compcov.harden && {
+    grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && {
+      $ECHO "$GREEN[+] llvm_mode hardened mode succeeded and is working"
+    } || $ECHO "$RED[!] hardened mode is not hardened"
+    rm -f test-compcov.harden
+  } || $ECHO "$RED[!] llvm_mode hardened mode compilation failed"
+  # now we want to be sure that afl-fuzz is working  
+  test -n "$TIMEOUT" && {
+    mkdir -p in
+    echo 0 > in/in
+    $ECHO "$GREY[*] running afl-fuzz, this will take approx 10 seconds"
+    {
+      timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1
+    } > /dev/null 2>&1
+    test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
+      $ECHO "$GREEN[+] afl-fuzz is working correctly with llvm_mode"
+    } || $ECHO "$RED[!] afl-fuzz is not working correctly"
+    rm -rf in out
+  } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command"
+  rm -f test-instr.plain
+  # now for the special llvm_mode things
+  AFL_LLVM_INSTRIM=1 AFL_LLVM_INSTRIM_LOOPHEAD=1 ../afl-clang-fast -o test-compcov.instrim test-compcov.c > /dev/null 2> test.out
+  test -e test-compcov.instrim && {
+    grep -q " 1 location" test.out && {
+      $ECHO "$GREEN[+] llvm_mode InsTrim feature works correctly"
+    } || $ECHO "$RED[!] llvm_mode InsTrim feature failed"
+  } || $ECHO "$RED[!] llvm_mode InsTrim feature compilation failed"
+  rm -f test-compcov.instrim test.out
+
+  AFL_LLVM_LAF_SPLIT_SWITCHES=1 AFL_LLVM_LAF_TRANSFORM_COMPARES=1 AFL_LLVM_LAF_SPLIT_COMPARES=1 ../afl-clang-fast -o test-compcov.compcov test-compcov.c > /dev/null 2> test.out
+  test -e test-compcov.compcov && {
+    grep -Eq " [3-9][0-9] location" test.out && {
+      $ECHO "$GREEN[+] llvm_mode laf-intel/compcov feature works correctly"
+    } || $ECHO "$RED[!] llvm_mode laf-intel/compcov feature failed"
+  } || $ECHO "$RED[!] llvm_mode laf-intel/compcov feature compilation failed"
+  rm -f test-compcov.compcov test.out
+  
+  
+  echo foobar.c > whitelist.txt
+  AFL_LLVM_WHITELIST=whitelist.txt ../afl-clang-fast -o test-compcov test-compcov.c > test.out 2>&1
+  test -e test-compcov && {
+    grep -q "No instrumentation targets found" test.out && {
+      $ECHO "$GREEN[+] llvm_mode whitelist feature works correctly"
+    } || $ECHO "$RED[!] llvm_mode whitelist feature failed"
+  } || $ECHO "$RED[!] llvm_mode whitelist feature compilation failed"
+  rm -f test-compcov test.out
 
 } || $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test"
 
@@ -108,7 +166,7 @@ test -e ../afl-qemu-trace && {
 
 rm -f test-compcov
 
-$ECHO "$GREY[*] all tests completed!"
+$ECHO "$GREY[*] all test cases completed.$RESET"
 $ECHO "$RESET"
 
 # unicorn_mode ?
-- 
cgit 1.4.1


From 99be29472657d074d53f7487198acca44a1f5c82 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 22 Sep 2019 10:44:02 +0200
Subject: fix

---
 test/test.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'test')

diff --git a/test/test.sh b/test/test.sh
index 6a706ab9..ad1bdc97 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -132,7 +132,7 @@ test -e ../afl-clang-fast && {
       $ECHO "$GREEN[+] llvm_mode whitelist feature works correctly"
     } || $ECHO "$RED[!] llvm_mode whitelist feature failed"
   } || $ECHO "$RED[!] llvm_mode whitelist feature compilation failed"
-  rm -f test-compcov test.out
+  rm -f test-compcov test.out whitelist.txt
 
 } || $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test"
 
-- 
cgit 1.4.1


From f097f780af8bf30a51d2d462dfe303604e4a6a75 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 22 Sep 2019 11:42:39 +0200
Subject: final tests

---
 test/test-compcov.c | 35 ++++++++++++------------
 test/test.sh        | 76 +++++++++++++++++++++++++++++++++++++++--------------
 2 files changed, 74 insertions(+), 37 deletions(-)

(limited to 'test')

diff --git a/test/test-compcov.c b/test/test-compcov.c
index bbad3aed..978d5551 100644
--- a/test/test-compcov.c
+++ b/test/test-compcov.c
@@ -4,25 +4,26 @@
 #include <string.h>
 
 int main(int argc, char** argv) {
+  char *input = argv[1], *buf, buffer[20];
 
-  char *buf;
-
-  if (argc > 1) {
-  
-    if (strcmp(argv[1], "LIBTOKENCAP") == 0)
-      printf("your string was libtokencap\n");
-    else if (strcmp(argv[1], "BUGMENOT") == 0)
-      printf("your string was bugmenot\n");
-    else if (strcmp(argv[1], "BUFFEROVERFLOW") == 0) {
-      buf = malloc(16);
-      strcpy(buf, "TEST");
-      strcat(buf, argv[1]);
-      printf("This will only crash with libdislocator: %s\n", buf);
-      return 0;
-    } else
-      printf("I do not know your string\n");
-  
+  if (argc < 2) {
+    ssize_t ret = read(0, buffer, sizeof(buffer) - 1);
+    buffer[ret] = 0;
+    input = buffer;
   }
+  
+  if (strcmp(input, "LIBTOKENCAP") == 0)
+    printf("your string was libtokencap\n");
+  else if (strcmp(input, "BUGMENOT") == 0)
+    printf("your string was bugmenot\n");
+  else if (strcmp(input, "BUFFEROVERFLOW") == 0) {
+    buf = malloc(16);
+    strcpy(buf, "TEST");
+    strcat(buf, input);
+    printf("This will only crash with libdislocator: %s\n", buf);
+    return 0;
+  } else
+    printf("I do not know your string\n");
 
   return 0;
 
diff --git a/test/test.sh b/test/test.sh
index ad1bdc97..5d67588a 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -27,8 +27,13 @@ test -z "$ECHO" && { echo Error: echo command does not support -e option ; exit
 
 export AFL_EXIT_WHEN_DONE=1
 export AFL_SKIP_CPUFREQ=1
+unset AFL_DEBUG
+unset AFL_HARDEN
+unset AFL_LLVM_WHITELIST
+unset AFL_LLVM_INSTRIM
 
 GREY="\\x1b[1;90m"
+BLUE="\\x1b[1;94m"
 GREEN="\\x1b[0;32m"
 RED="\\x1b[0;31m"
 YELLOW="\\x1b[1;93m"
@@ -36,6 +41,7 @@ RESET="\\x1b[0m"
 
 $ECHO "${RESET}${GREY}[*] starting afl++ test framework ..."
 
+$ECHO "$BLUE[*] Testing: afl-gcc, afl-showmap and afl-fuzz"
 test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && {
   ../afl-gcc -o test-instr.plain ../test-instr.c > /dev/null 2>&1
   AFL_HARDEN=1 ../afl-gcc -o test-instr.harden ../test-instr.c > /dev/null 2>&1
@@ -53,27 +59,27 @@ test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && {
   test -e test-instr.harden && {
     grep -qa fstack-protector-all test-instr.harden > /dev/null 2>&1 && {
       $ECHO "$GREEN[+] afl-gcc hardened mode succeeded and is working"
-    } || $ECHO "$RED[!] hardened mode is not hardened"
+    } || $ECHO "$RED[!] afl-gcc hardened mode is not hardened"
     rm -f test-instr.harden
   } || $ECHO "$RED[!] afl-gcc hardened mode compilation failed"
   # now we want to be sure that afl-fuzz is working  
   test -n "$TIMEOUT" && {
     mkdir -p in
     echo 0 > in/in
-    $ECHO "$GREY[*] running afl-fuzz, this will take approx 10 seconds"
+    $ECHO "$GREY[*] running afl-fuzz for afl-gcc, this will take approx 10 seconds"
     {
       timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1
     } > /dev/null 2>&1
     test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
       $ECHO "$GREEN[+] afl-fuzz is working correctly with afl-gcc"
-    } || $ECHO "$RED[!] afl-fuzz is not working correctly"
+    } || $ECHO "$RED[!] afl-fuzz is not working correctly with afl-gcc"
     rm -rf in out
   } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command"
   rm -f test-instr.plain
 } || $ECHO "$YELLOW[-] afl is not compiled, cannot test"
 
+$ECHO "$BLUE[*] Testing: llvm_mode"
 test -e ../afl-clang-fast && {
-
   ../afl-clang-fast -o test-instr.plain ../test-instr.c > /dev/null 2>&1
   AFL_HARDEN=1 ../afl-clang-fast -o test-compcov.harden test-compcov.c > /dev/null 2>&1
   test -e test-instr.plain && {
@@ -90,32 +96,32 @@ test -e ../afl-clang-fast && {
   test -e test-compcov.harden && {
     grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && {
       $ECHO "$GREEN[+] llvm_mode hardened mode succeeded and is working"
-    } || $ECHO "$RED[!] hardened mode is not hardened"
+    } || $ECHO "$RED[!] llvm_mode hardened mode is not hardened"
     rm -f test-compcov.harden
   } || $ECHO "$RED[!] llvm_mode hardened mode compilation failed"
   # now we want to be sure that afl-fuzz is working  
   test -n "$TIMEOUT" && {
     mkdir -p in
     echo 0 > in/in
-    $ECHO "$GREY[*] running afl-fuzz, this will take approx 10 seconds"
+    $ECHO "$GREY[*] running afl-fuzz for llvm_mode, this will take approx 10 seconds"
     {
       timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1
     } > /dev/null 2>&1
     test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
       $ECHO "$GREEN[+] afl-fuzz is working correctly with llvm_mode"
-    } || $ECHO "$RED[!] afl-fuzz is not working correctly"
+    } || $ECHO "$RED[!] afl-fuzz is not working correctly with llvm_mode"
     rm -rf in out
   } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command"
   rm -f test-instr.plain
+
   # now for the special llvm_mode things
   AFL_LLVM_INSTRIM=1 AFL_LLVM_INSTRIM_LOOPHEAD=1 ../afl-clang-fast -o test-compcov.instrim test-compcov.c > /dev/null 2> test.out
   test -e test-compcov.instrim && {
-    grep -q " 1 location" test.out && {
+    grep -Eq " [1-3] location" test.out && {
       $ECHO "$GREEN[+] llvm_mode InsTrim feature works correctly"
     } || $ECHO "$RED[!] llvm_mode InsTrim feature failed"
   } || $ECHO "$RED[!] llvm_mode InsTrim feature compilation failed"
   rm -f test-compcov.instrim test.out
-
   AFL_LLVM_LAF_SPLIT_SWITCHES=1 AFL_LLVM_LAF_TRANSFORM_COMPARES=1 AFL_LLVM_LAF_SPLIT_COMPARES=1 ../afl-clang-fast -o test-compcov.compcov test-compcov.c > /dev/null 2> test.out
   test -e test-compcov.compcov && {
     grep -Eq " [3-9][0-9] location" test.out && {
@@ -123,8 +129,6 @@ test -e ../afl-clang-fast && {
     } || $ECHO "$RED[!] llvm_mode laf-intel/compcov feature failed"
   } || $ECHO "$RED[!] llvm_mode laf-intel/compcov feature compilation failed"
   rm -f test-compcov.compcov test.out
-  
-  
   echo foobar.c > whitelist.txt
   AFL_LLVM_WHITELIST=whitelist.txt ../afl-clang-fast -o test-compcov test-compcov.c > test.out 2>&1
   test -e test-compcov && {
@@ -133,11 +137,17 @@ test -e ../afl-clang-fast && {
     } || $ECHO "$RED[!] llvm_mode whitelist feature failed"
   } || $ECHO "$RED[!] llvm_mode whitelist feature compilation failed"
   rm -f test-compcov test.out whitelist.txt
-
+  ../afl-clang-fast -o test-persistent ../experimental/persistent_demo/persistent_demo.c > /dev/null 2>&1
+  test -e test-persistent && {
+    echo foo | ../afl-showmap -o /dev/null -q -r ./test-persistent && {
+      $ECHO "$GREEN[+] lvm_mode persistent mode feature works correctly"
+    } || $ECHO "$RED[!] llvm_mode persistent mode feature failed to work"
+  } || $ECHO "$RED[!] llvm_mode persistent mode feature compilation failed"
+  rm -f test-persistent
 } || $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test"
 
+$ECHO "$BLUE[*] Testing: shared library extensions"
 gcc -o test-compcov test-compcov.c > /dev/null 2>&1
-
 test -e ../libtokencap.so && {
   AFL_TOKEN_FILE=token.out LD_PRELOAD=../libtokencap.so ./test-compcov foobar > /dev/null 2>&1
   grep -q BUGMENOT token.out > /dev/null 2>&1 && {
@@ -145,7 +155,6 @@ test -e ../libtokencap.so && {
   } || $ECHO "$RED[!] libtokencap did not capture tokens"
   rm -f token.out
 } || $ECHO "$YELLOW[-] libtokencap is not compiled, cannot test"
-
 test -e ../libdislocator.so && {
   {
     ulimit -c 1
@@ -156,17 +165,44 @@ test -e ../libdislocator.so && {
   } || $ECHO "$GREEN[+] libdislocator did successfully detect the memory corruption" 
   rm -f test.out core test-compcov.core core.test-compcov
 } || $ECHO "$YELLOW[-] libdislocator is not compiled, cannot test"
+rm -f test-compcov
 
+$ECHO "$BLUE[*] Testing: qemu_mode"
 test -e ../afl-qemu-trace && {
+  gcc -o test-instr ../test-instr.c
+  gcc -o test-compcov test-compcov.c
+  test -e test-instr -a -e test-compcov && {
+    test -n "$TIMEOUT" && {
+      mkdir -p in
+      echo 0 > in/in
+      $ECHO "$GREY[*] running afl-fuzz for qemu_mode, this will take approx 10 seconds"
+      {
+        timeout -s KILL 10 ../afl-fuzz -Q -i in -o out -- ./test-instr > /dev/null 2>&1
+      } > /dev/null 2>&1
+      test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
+        $ECHO "$GREEN[+] afl-fuzz is working correctly with qemu_mode"
+      } || $ECHO "$RED[!] afl-fuzz is not working correctly with qemu_mode"
+
+      test -e ../libcompcov.so && {
+        $ECHO "$GREY[*] running afl-fuzz for qemu_mode libcompcov, this will take approx 10 seconds"
+        {
+          export AFL_PRELOAD=../libcompcov.so 
+          export AFL_COMPCOV_LEVEL=2
+          timeout -s KILL 10 ../afl-fuzz -Q -i in -o out -- ./test-compcov > /dev/null 2>&1
+        } > /dev/null 2>&1
+        test -n "$( ls out/queue/id:000002* 2> /dev/null )" && {
+          $ECHO "$GREEN[+] afl-fuzz is working correctly with qemu_mode libcompcov"
+        } || $ECHO "$RED[!] afl-fuzz is not working correctly with qemu_mode libcompcov"
+      } || $ECHO "$YELLOW[-] we cannot test qemu_mode libcompcov because it is not present"
+      rm -rf in out
+    } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command"
+  } || $ECHO "$RED[-] gcc compilation of test targets failed - what is going on??"
+  
+  $ECHO "$YELLOW[?] we need a test case for qemu_mode persistent mode"
 
-  echo todo: qemu_mode
-  # we will use test-compcov for testing libcompcov
-
+  rm -f test-instr test-compcov
 } || $ECHO "$YELLOW[-] qemu_mode is not compiled, cannot test"
 
-rm -f test-compcov
-
 $ECHO "$GREY[*] all test cases completed.$RESET"
-$ECHO "$RESET"
 
 # unicorn_mode ?
-- 
cgit 1.4.1


From b4ca95a9fafccd0506285000595ada5ed47f9ca3 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 22 Sep 2019 13:21:15 +0200
Subject: afl-fuzz mutation documentation feature

---
 Makefile               |  7 +++++++
 docs/ChangeLog         |  2 ++
 include/afl-fuzz.h     |  5 +++++
 src/afl-fuzz-globals.c |  4 ++++
 src/afl-fuzz-one.c     | 17 +++++++++++++++++
 src/afl-fuzz-run.c     | 12 ++++++++++++
 test/test.sh           |  8 ++++++++
 7 files changed, 55 insertions(+)

(limited to 'test')

diff --git a/Makefile b/Makefile
index d7309cff..35f58ac5 100644
--- a/Makefile
+++ b/Makefile
@@ -92,6 +92,8 @@ help:
 	@echo "distrib: everything (for both binary-only and source code fuzzing)"
 	@echo "install: installs everything you have compiled with the build option above"
 	@echo "clean: cleans everything. for qemu_mode and unicorn_mode it means it deletes all downloads as well"
+	@echo "tests: this runs the test framework. It is more catered for the developers, but if you run into problems this helps pinpointing the problem"
+	@echo "document: creates afl-fuzz-document which will only do one run and save all manipulated inputs into out/queue/mutations"
 	@echo "help: shows these build options :-)"
 	@echo "=========================================="
 	@echo "Recommended: \"distrib\" or \"source-only\", then \"install\""
@@ -176,6 +178,11 @@ afl-gotcpu: src/afl-gotcpu.c $(COMM_HDR) | test_x86
 	$(CC) $(CFLAGS) src/$@.c -o $@ $(LDFLAGS)
 
 
+# document all mutations and only do one run (use with only one input file!)
+document: include/afl-fuzz.h $(AFL_FUZZ_FILES) afl-common.o afl-sharedmem.o afl-forkserver.o $(COMM_HDR) | test_x86
+	$(CC) $(CFLAGS) $(AFL_FUZZ_FILES) -D_AFL_DOCUMENT_MUTATIONS afl-common.o afl-sharedmem.o afl-forkserver.o -o afl-fuzz-document $(LDFLAGS) $(PYFLAGS)
+
+
 code-format:
 	./.custom-format.py -i src/*.c
 	./.custom-format.py -i include/*.h
diff --git a/docs/ChangeLog b/docs/ChangeLog
index 7beb32c3..0f5bb99c 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -27,6 +27,8 @@ Version ++2.54d (dev):
   - fuzzing strategy yields for custom mutator were missing from the UI, added them :)
   - added "make tests" which will perform checks to see that all functionality
     is working as expected. this is currently the starting point, its not complete :)
+  - added mutation documentation feature ("make document"), creates afl-fuzz-document
+    and saves all mutations of the first run on the first file into out/queue/mutations
   - libtokencap and libdislocator now compile to the afl_root directory and are
     installed to the .../lib/afl directory when present during make install
   - reducing duplicate code in afl-fuzz
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 9536e06a..4912b3f0 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -682,5 +682,10 @@ static u64 get_cur_time_us(void) {
 
 }
 
+#ifdef _AFL_DOCUMENT_MUTATIONS
+  extern u8 do_document;
+  extern u32 document_counter;
+#endif
+
 #endif
 
diff --git a/src/afl-fuzz-globals.c b/src/afl-fuzz-globals.c
index 1358a1fb..01b242b8 100644
--- a/src/afl-fuzz-globals.c
+++ b/src/afl-fuzz-globals.c
@@ -259,3 +259,7 @@ PyObject *py_functions[PY_FUNC_COUNT];
 
 #endif
 
+#ifdef _AFL_DOCUMENT_MUTATIONS
+  u8 do_document;
+  u32 document_counter;
+#endif
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 59483b8f..1824f0b2 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -4231,6 +4231,7 @@ pacemaker_fuzzing:
 
 #define core_fuzzing(a) common_fuzzing((a), MOpt_globals_core)
 
+
 void pso_updating(void) {
 
   g_now += 1;
@@ -4310,6 +4311,22 @@ void pso_updating(void) {
 u8 fuzz_one(char** argv) {
 
   int key_val_lv = 0;
+
+#ifdef _AFL_DOCUMENT_MUTATIONS
+  if (do_document == 0) {
+    char *fn = alloc_printf("%s/mutations", out_dir);
+    if (fn) {
+      do_document = mkdir(fn, 0700); // if it exists we do not care
+      do_document = 1;
+      ck_free(fn);
+    } else
+      PFATAL("malloc()");
+  } else {
+    do_document = 2;
+    stop_soon = 2;
+  }
+#endif
+
   if (limit_time_sig == 0) {
 
     key_val_lv = fuzz_one_original(argv);
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index f2f663dc..220433fc 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -251,6 +251,18 @@ void write_to_testcase(void* mem, u32 len) {
 
   s32 fd = out_fd;
 
+#ifdef _AFL_DOCUMENT_MUTATIONS
+  s32 doc_fd;
+  char *fn = alloc_printf("%s/mutations/%09u:%s", out_dir, document_counter++, describe_op(0));
+  if (fn != NULL) {
+    if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600)) >= 0) {
+      if (write(doc_fd, mem, len) != len) PFATAL("write to mutation file failed: %s", fn);
+      close(doc_fd);
+    }
+    ck_free(fn);
+  }
+#endif
+
   if (out_file) {
 
     // unlink(out_file);                                     /* Ignore errors.
diff --git a/test/test.sh b/test/test.sh
index 5d67588a..d230cf71 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -27,10 +27,18 @@ test -z "$ECHO" && { echo Error: echo command does not support -e option ; exit
 
 export AFL_EXIT_WHEN_DONE=1
 export AFL_SKIP_CPUFREQ=1
+unset AFL_QUIET
 unset AFL_DEBUG
 unset AFL_HARDEN
+unset AFL_USE_ASAN
+unset AFL_USE_MSAN
+unset AFL_CC
+unset AFL_PRELOAD
 unset AFL_LLVM_WHITELIST
 unset AFL_LLVM_INSTRIM
+unset AFL_LLVM_LAF_SPLIT_SWITCHES
+unset AFL_LLVM_LAF_TRANSFORM_COMPARES
+unset AFL_LLVM_LAF_SPLIT_COMPARES
 
 GREY="\\x1b[1;90m"
 BLUE="\\x1b[1;94m"
-- 
cgit 1.4.1