remove dead code, code-format
MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -14,6 +14,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
- added -F option to allow -M main fuzzers to sync to foreign fuzzers,
e.g. honggfuzz or libfuzzer
- eliminated CPU affinity race condition for -S/-M runs
+ - expanded havoc mode added, on no cycle finds add extra splicing and
+ MOpt into the mix
- llvm_mode:
- now supports llvm 12!
- fixes for laf-intel float splitting (thanks to mark-griffin for
@@ -21,7 +23,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
- LTO: autodictionary mode is a default
- LTO: instrim instrumentation disabled, only classic support used
as it is always better
- - added honggfuzz mangle as a custom mutator in custom_mutators/honggfuzz :)
+ - added honggfuzz mangle as a custom mutator in custom_mutators/honggfuzz
- added afl-frida gum solution to examples/afl_frida (mostly imported
from https://github.com/meme/hotwax/)
- small fixes to afl-plot, afl-whatsup and man page creation

MODIFY
src/afl-fuzz-one.c
src/afl-fuzz-one.c
#include <string.h>
#include <limits.h>
-/* static u8 *strnstr(const u8 *s, const u8 *find, size_t slen);
-static u32 string_replace(u8 **out_buf, s32 *temp_len, u32 pos, u8 *from,
- u8 *to); */
-
/* MOpt */
static int select_algorithm(afl_state_t *afl) {
@@ -370,524 +366,6 @@ static void locate_diffs(u8 *ptr1, u8 *ptr2, u32 len, s32 *first, s32 *last) {
#define BUF_PARAMS(name) (void **)&afl->name##_buf, &afl->name##_size
-#if 0
-/* search a string */
-
-static u8 *strnstr(const u8 *s, const u8 *find, size_t slen) {
-
- char c, sc;
- size_t len;
-
- if ((c = *find++) != '\0') {
-
- len = strlen(find);
- do {
-
- do {
-
- if (slen-- < 1 || (sc = *s++) == '\0') return (NULL);
-
- } while (sc != c);
-
- if (len > slen) return (NULL);
-
- } while (strncmp(s, find, len) != 0);
-
- s--;
-
- }
-
- return ((u8 *)s);
-
-}
-
-/* replace between deliminators, if rep == NULL, then we will duplicate the
- * target */
-
-static u32 delim_replace(u8 **out_buf, s32 *temp_len, size_t pos,
- const u8 *ldelim, const u8 *rdelim, u8 *rep) {
-
- u8 *end_buf = *out_buf + *temp_len;
- u8 *ldelim_start = strnstr(*out_buf + pos, ldelim, *temp_len - pos);
-
- if (ldelim_start != NULL) {
-
- u32 max = (end_buf - ldelim_start - 1 > AFL_TXT_STRING_MAX_LEN
- ? AFL_TXT_STRING_MAX_LEN
- : end_buf - ldelim_start - 1);
-
- if (max > 0) {
-
- u8 *rdelim_end = strnstr(ldelim_start + 1, rdelim, max);
-
- if (rdelim_end != NULL) {
-
- u32 rep_len, delim_space_len = rdelim_end - ldelim_start - 1, xtra = 0;
-
- if (rep != NULL) {
-
- rep_len = (u32)strlen(rep);
-
- } else { // NULL? then we copy the value in between the delimiters
-
- rep_len = delim_space_len;
- delim_space_len = 0;
- rep = ldelim_start + 1;
- xtra = rep_len;
-
- }
-
- if (rep_len != delim_space_len) {
-
- memmove(ldelim_start + rep_len + xtra + 1, rdelim_end,
- *temp_len - (rdelim_end - *out_buf));
-
- }
-
- memcpy(ldelim_start + 1, rep, rep_len);
- *temp_len = (*temp_len - delim_space_len + rep_len);
-
- return 1;
-
- }
-
- }
-
- }
-
- return 0;
-
-}
-
-static u32 delim_swap(u8 **out_buf, s32 *temp_len, size_t pos, const u8 *ldelim,
- const u8 *mdelim, const u8 *rdelim) {
-
- u8 *out_buf_end = *out_buf + *temp_len;
- u32 max = (*temp_len - pos > AFL_TXT_STRING_MAX_LEN ? AFL_TXT_STRING_MAX_LEN
- : *temp_len - pos);
- u8 *ldelim_start = strnstr(*out_buf + pos, ldelim, max);
-
- if (ldelim_start != NULL) {
-
- max = (out_buf_end - ldelim_start - 1 > AFL_TXT_STRING_MAX_LEN
- ? AFL_TXT_STRING_MAX_LEN
- : out_buf_end - ldelim_start - 1);
- if (max > 1) {
-
- u8 *mdelim_pos = strnstr(ldelim_start + 1, mdelim, max);
-
- if (mdelim_pos != NULL) {
-
- max = (out_buf_end - mdelim_pos - 1 > AFL_TXT_STRING_MAX_LEN
- ? AFL_TXT_STRING_MAX_LEN
- : out_buf_end - mdelim_pos - 1);
- if (max > 0) {
-
- u8 *rdelim_end = strnstr(mdelim + 1, rdelim, max);
-
- if (rdelim_end != NULL) {
-
- u32 first_len = mdelim_pos - ldelim_start - 1;
- u32 second_len = rdelim_end - mdelim_pos - 1;
- u8 scratch[AFL_TXT_STRING_MAX_LEN];
-
- memcpy(scratch, ldelim_start + 1, first_len);
-
- if (first_len != second_len) {
-
- memmove(ldelim_start + second_len + 1, mdelim_pos,
- out_buf_end - mdelim_pos);
-
- }
-
- memcpy(ldelim_start + 1, mdelim_pos + 1, second_len);
-
- if (first_len != second_len) {
-
- memmove(mdelim_pos + first_len + 1, rdelim_end,
- out_buf_end - rdelim_end);
-
- }
-
- memcpy(mdelim_pos + 1, scratch, first_len);
-
- return 1;
-
- }
-
- }
-
- }
-
- }
-
- }
-
- return 0;
-
-}
-
-/* replace a string */
-
-static u32 string_replace(u8 **out_buf, s32 *temp_len, u32 pos, u8 *from,
- u8 *to) {
-
- u8 *start = strnstr(*out_buf + pos, from, *temp_len - pos);
-
- if (start) {
-
- u32 from_len = strlen(from);
- u32 to_len = strlen(to);
-
- if (from_len != to_len) {
-
- memmove(start + to_len, start + from_len,
- *temp_len - from_len - (start - *out_buf));
-
- }
-
- memcpy(start, to, to_len);
- *temp_len = (*temp_len - from_len + to_len);
-
- return 1;
-
- }
-
- return 0;
-
-}
-
-/* Returns 1 if a mutant was generated and placed in out_buf, 0 if none
- * generated. */
-
-static const uint8_t text_mutation_special_chars[] = {
-
- '\t', '\n', '\r', ' ', '!', '"', '$', '%', '&', '\'', '(', ')', '*',
- '+', ',', '-', '.', '/', ':', ';', '<', '=', '>', '?', '@', '[',
- '\\', ']', '^', '_', '`', '{', '|', '}', '~', ' ' // space is here twice
-
-};
-
-static int text_mutation(afl_state_t *afl, u8 **out_buf, s32 *orig_temp_len) {
-
- if (*orig_temp_len < AFL_TXT_MIN_LEN) { return 0; }
-
- s32 temp_len;
- u32 pos, yes = 0,
- mutations = rand_below(afl, AFL_TXT_STRING_MAX_MUTATIONS) + 16;
- u8 *new_buf =
- ck_maybe_grow(BUF_PARAMS(out_scratch),
- *orig_temp_len + AFL_TXT_STRING_MAX_MUTATIONS + 16);
- u8 fromc[2] = {0, 0}, toc[2] = {0, 0};
- temp_len = *orig_temp_len;
- memcpy(new_buf, *out_buf, temp_len);
- new_buf[temp_len] = 0;
-
- for (u32 i = 0; i < mutations; i++) {
-
- if (temp_len < AFL_TXT_MIN_LEN) { return 0; }
-
- pos = rand_below(afl, temp_len - 1);
- int choice = rand_below(afl, 100);
-
- switch (choice) {
-
- /* 50% -> fixed replacements */
-
- case 0: /* Semantic statement deletion */
- yes += string_replace(&new_buf, &temp_len, pos, "\n", "#");
- break;
- case 1:
- yes += string_replace(&new_buf, &temp_len, pos, "(", "(!");
- break;
- case 2:
- yes += string_replace(&new_buf, &temp_len, pos, "==", "!=");
- break;
- case 3:
- yes += string_replace(&new_buf, &temp_len, pos, "!=", "==");
- break;
- case 4:
- yes += string_replace(&new_buf, &temp_len, pos, "==", "<");
- break;
- case 5:
- yes += string_replace(&new_buf, &temp_len, pos, "<", "==");
- break;
- case 6:
- yes += string_replace(&new_buf, &temp_len, pos, "==", ">");
- break;
- case 7:
- yes += string_replace(&new_buf, &temp_len, pos, ">", "==");
- break;
- case 8:
- yes += string_replace(&new_buf, &temp_len, pos, "=", "<");
- break;
- case 9:
- yes += string_replace(&new_buf, &temp_len, pos, "=", ">");
- break;
- case 10:
- yes += string_replace(&new_buf, &temp_len, pos, "<", ">");
- break;
- case 11:
- yes += string_replace(&new_buf, &temp_len, pos, ">", "<");
- break;
- case 12:
- yes += string_replace(&new_buf, &temp_len, pos, "++", "--");
- break;
- case 13:
- yes += string_replace(&new_buf, &temp_len, pos, "--", "++");
- break;
- case 14:
- yes += string_replace(&new_buf, &temp_len, pos, "+", "-");
- break;
- case 15:
- yes += string_replace(&new_buf, &temp_len, pos, "-", "+");
- break;
- case 16:
- yes += string_replace(&new_buf, &temp_len, pos, "0", "1");
- break;
- case 17:
- yes += string_replace(&new_buf, &temp_len, pos, "1", "0");
- break;
- case 18:
- yes += string_replace(&new_buf, &temp_len, pos, "&&", "||");
- break;
- case 19:
- yes += string_replace(&new_buf, &temp_len, pos, "||", "&&");
- break;
- case 20:
- yes += string_replace(&new_buf, &temp_len, pos, "!", "");
- break;
- case 21:
- yes += string_replace(&new_buf, &temp_len, pos, "==", "=");
- break;
- case 22:
- yes += string_replace(&new_buf, &temp_len, pos, "=", "==");
- break;
- case 23:
- yes += string_replace(&new_buf, &temp_len, pos, "--", "");
- break;
- case 24:
- yes += string_replace(&new_buf, &temp_len, pos, "<<", "<");
- break;
- case 25:
- yes += string_replace(&new_buf, &temp_len, pos, ">>", ">");
- break;
- case 26:
- yes += string_replace(&new_buf, &temp_len, pos, "<", "<<");
- break;
- case 27:
- yes += string_replace(&new_buf, &temp_len, pos, ">", ">>");
- break;
- case 28:
- yes += string_replace(&new_buf, &temp_len, pos, "'", "\"");
- break;
- case 29:
- yes += string_replace(&new_buf, &temp_len, pos, "\"", "'");
- break;
- case 30: /* Remove a semicolon delimited statement after a semicolon */
- yes += delim_replace(&new_buf, &temp_len, pos, ";", ";", ";");
- break;
- case 31: /* Remove a semicolon delimited statement after a left curly
- brace */
- yes += delim_replace(&new_buf, &temp_len, pos, "}", ";", "}");
- break;
- case 32: /* Remove a curly brace construct */
- yes += delim_replace(&new_buf, &temp_len, pos, "{", "}", "");
- break;
- case 33: /* Replace a curly brace construct with an empty one */
- yes += delim_replace(&new_buf, &temp_len, pos, "{", "}", "{}");
- break;
- case 34:
- yes += delim_swap(&new_buf, &temp_len, pos, ";", ";", ";");
- break;
- case 35:
- yes += delim_swap(&new_buf, &temp_len, pos, "}", ";", ";");
- break;
- case 36: /* Swap comma delimited things case 1 */
- yes += delim_swap(&new_buf, &temp_len, pos, "(", ",", ")");
- break;
- case 37: /* Swap comma delimited things case 2 */
- yes += delim_swap(&new_buf, &temp_len, pos, "(", ",", ",");
- break;
- case 38: /* Swap comma delimited things case 3 */
- yes += delim_swap(&new_buf, &temp_len, pos, ",", ",", ",");
- break;
- case 39: /* Swap comma delimited things case 4 */
- yes += delim_swap(&new_buf, &temp_len, pos, ",", ",", ")");
- break;
- case 40: /* Just delete a line */
- yes += delim_replace(&new_buf, &temp_len, pos, "\n", "\n", "");
- break;
- case 41: /* Delete something like "const" case 1 */
- yes += delim_replace(&new_buf, &temp_len, pos, " ", " ", "");
- break;
- case 42: /* Delete something like "const" case 2 */
- yes += delim_replace(&new_buf, &temp_len, pos, "\n", " ", "");
- break;
- case 43: /* Delete something like "const" case 3 */
- yes += delim_replace(&new_buf, &temp_len, pos, "(", " ", "");
- break;
- case 44: /* Swap space delimited things case 1 */
- yes += delim_swap(&new_buf, &temp_len, pos, " ", " ", " ");
- break;
- case 45: /* Swap space delimited things case 2 */
- yes += delim_swap(&new_buf, &temp_len, pos, " ", " ", ")");
- break;
- case 46: /* Swap space delimited things case 3 */
- yes += delim_swap(&new_buf, &temp_len, pos, "(", " ", " ");
- break;
- case 47: /* Swap space delimited things case 4 */
- yes += delim_swap(&new_buf, &temp_len, pos, "(", " ", ")");
- break;
- case 48: /* Duplicate a single line of code */
- yes += delim_replace(&new_buf, &temp_len, pos, "\n", "\n", NULL);
- break;
- case 49: /* Duplicate a construct (most often, a non-nested for loop */
- yes += delim_replace(&new_buf, &temp_len, pos, "\n", "}", NULL);
- break;
- default: {
-
- /* 5% is transforming ascii numbers */
-
- if (choice < 55) {
-
- for (u32 j = pos; j < temp_len; ++j) {
-
- if (isdigit(new_buf[j])) {
-
- new_buf[temp_len] =
- 0; // should be safe thanks to the initial grow
-
- u8 * endptr;
- unsigned long long num =
- strtoull(new_buf + j, (char **)&endptr, 0);
-
- switch (rand_below(afl, 8)) {
-
- case 0:
- num = rand_below(afl, INT_MAX);
- break;
- case 1:
- num = rand_next(afl);
- break;
- case 2:
- num += 1 + rand_below(afl, 255);
- break;
- case 3:
- num -= 1 + rand_below(afl, 255);
- break;
- case 4:
- num *= 1 + rand_below(afl, 255);
- break;
- case 5:
- num /= 1 + rand_below(afl, 255);
- break;
- case 6:
- num /= 1 + rand_below(afl, 255);
- break;
- case 7:
- num = ~num;
- break;
-
- }
-
- const char *fmt = "%llu";
- if (rand_below(afl, 5) == 0) // add - sign with 1/5 probability
- fmt = "-%llu";
-
- size_t num_len = snprintf(NULL, 0, fmt, num);
- size_t old_len = endptr - (new_buf + j);
- if (num_len < old_len) {
-
- memmove(new_buf + j + num_len, new_buf + j + old_len,
- temp_len - (j + old_len));
- snprintf(new_buf + j, num_len, fmt, num);
- temp_len -= old_len - num_len;
-
- } else if (num_len == old_len) {
-
- snprintf(new_buf + j, num_len, fmt, num);
-
- } else {
-
- new_buf = ck_maybe_grow(BUF_PARAMS(out_scratch),
- temp_len + (num_len - old_len) +
- AFL_TXT_STRING_MAX_MUTATIONS + 1);
- memmove(new_buf + j + num_len, new_buf + j + old_len,
- temp_len - (j + old_len));
- snprintf(new_buf + j, num_len, fmt, num);
- temp_len += num_len - old_len;
-
- }
-
- yes += 1;
- break;
-
- }
-
- }
-
- } else if (choice < 85) {
-
- /* 30% is special character transform */
-
- fromc[0] = text_mutation_special_chars[rand_below(
- afl, sizeof(text_mutation_special_chars))];
-
- do {
-
- toc[0] = text_mutation_special_chars[rand_below(
- afl, sizeof(text_mutation_special_chars))];
-
- } while (toc[0] == fromc[0]);
-
- yes += string_replace(&new_buf, &temp_len, pos, fromc, toc);
- break;
-
- } else {
-
- /* 15% is random text character transform */
-
- u32 iter, cnt, loc, prev_loc = temp_len;
- if (temp_len > 32) {
-
- cnt = 1 + rand_below(afl, 5);
-
- } else {
-
- cnt = rand_below(afl, 2);
-
- }
-
- for (iter = 0; iter <= cnt; iter++) {
-
- while ((loc = rand_below(afl, temp_len)) == prev_loc)
- ;
- new_buf[loc] = 32 + rand_below(afl, 'z' - ' ' + 1);
- prev_loc = loc;
-
- }
-
- }
-
- }
-
- }
-
- }
-
- if (yes == 0 || temp_len <= 0) { return 0; }
-
- swap_bufs(BUF_PARAMS(out), BUF_PARAMS(out_scratch));
- *out_buf = new_buf;
- *orig_temp_len = temp_len;
-
- return 1;
-
-}
-
-#endif /* if 0 */
-
/* Take the current entry from the queue, fuzz it for a while. This
function is a tad too long... returns 0 if fuzzed successfully, 1 if
skipped or bailed out. */
@@ -2926,15 +2404,7 @@ havoc_stage:
}
- /* default:
-
- // perform ascii mutations
- if (text_mutation(afl, &out_buf, &temp_len) == 0)
- goto retry_havoc;
-
- } // end default: switch(r)
-
- */
+ // end of default:
}

MODIFY
src/afl-fuzz-stats.c
src/afl-fuzz-stats.c
@@ -82,8 +82,7 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
if (getrusage(RUSAGE_CHILDREN, &rus)) { rus.ru_maxrss = 0; }
#endif
- fprintf(
- f,
+ fprintf(f,
"start_time : %llu\n"
"last_update : %llu\n"
"run_time : %llu\n"
@@ -128,14 +127,14 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
afl->fsrv.total_execs,
afl->fsrv.total_execs /
((double)(get_cur_time() - afl->start_time) / 1000),
- afl->last_avg_execs_saved,
- afl->queued_paths, afl->queued_favored, afl->queued_discovered,
- afl->queued_imported, afl->max_depth, afl->current_entry,
- afl->pending_favored, afl->pending_not_fuzzed, afl->queued_variable,
- stability, bitmap_cvg, afl->unique_crashes, afl->unique_hangs,
- afl->last_path_time / 1000, afl->last_crash_time / 1000,
- afl->last_hang_time / 1000, afl->fsrv.total_execs - afl->last_crash_execs,
- afl->fsrv.exec_tmout, afl->slowest_exec_ms,
+ afl->last_avg_execs_saved, afl->queued_paths, afl->queued_favored,
+ afl->queued_discovered, afl->queued_imported, afl->max_depth,
+ afl->current_entry, afl->pending_favored, afl->pending_not_fuzzed,
+ afl->queued_variable, stability, bitmap_cvg, afl->unique_crashes,
+ afl->unique_hangs, afl->last_path_time / 1000,
+ afl->last_crash_time / 1000, afl->last_hang_time / 1000,
+ afl->fsrv.total_execs - afl->last_crash_execs, afl->fsrv.exec_tmout,
+ afl->slowest_exec_ms,
#ifndef __HAIKU__
#ifdef __APPLE__
(unsigned long int)(rus.ru_maxrss >> 20),
@@ -151,15 +150,16 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
-1,
#endif
t_bytes, afl->var_byte_count, afl->expand_havoc, afl->use_banner,
- afl->unicorn_mode ? "unicorn" : "", afl->fsrv.qemu_mode ? "qemu " : "",
+ afl->unicorn_mode ? "unicorn" : "",
+ afl->fsrv.qemu_mode ? "qemu " : "",
afl->non_instrumented_mode ? " non_instrumented " : "",
afl->no_forkserver ? "no_fsrv " : "", afl->crash_mode ? "crash " : "",
afl->persistent_mode ? "persistent " : "",
afl->shmem_testcase_mode ? "shmem_testcase " : "",
afl->deferred_mode ? "deferred " : "",
- (afl->unicorn_mode || afl->fsrv.qemu_mode || afl->non_instrumented_mode ||
- afl->no_forkserver || afl->crash_mode || afl->persistent_mode ||
- afl->deferred_mode)
+ (afl->unicorn_mode || afl->fsrv.qemu_mode ||
+ afl->non_instrumented_mode || afl->no_forkserver ||
+ afl->crash_mode || afl->persistent_mode || afl->deferred_mode)
? ""
: "default",
afl->orig_cmdline);

remove dead code, code-format