cmplog for qemu mode
MODIFY
qemu_mode/patches/afl-qemu-common.h
qemu_mode/patches/afl-qemu-common.h
#define __AFL_QEMU_COMMON
#include "../../config.h"
+#include "../../include/cmplog.h"
+
+#define PERSISTENT_DEFAULT_MAX_CNT 1000
#ifndef CPU_NB_REGS
#define AFL_REGS_NUM 1000
@@ -74,6 +77,9 @@ extern int persisent_retaddr_offset;
extern __thread abi_ulong afl_prev_loc;
+extern struct cmp_map* __afl_cmp_map;
+extern __thread u32 __afl_cmp_counter;
+
void afl_debug_dump_saved_regs();
void afl_persistent_loop();

MODIFY
qemu_mode/patches/afl-qemu-cpu-inl.h
qemu_mode/patches/afl-qemu-cpu-inl.h
*/
#include <sys/shm.h>
-#include "../../config.h"
#include "afl-qemu-common.h"
-#define PERSISTENT_DEFAULT_MAX_CNT 1000
-
/***************************
* VARIOUS AUXILIARY STUFF *
***************************/
@@ -81,6 +78,9 @@ u8 afl_compcov_level;
__thread abi_ulong afl_prev_loc;
+struct cmp_map* __afl_cmp_map;
+__thread u32 __afl_cmp_counter;
+
/* Set in the child process in forkserver mode: */
static int forkserver_installed = 0;
@@ -182,6 +182,22 @@ static void afl_setup(void) {
}
+ if (getenv("___AFL_EINS_ZWEI_POLIZEI___")) { // CmpLog forkserver
+
+ id_str = getenv(CMPLOG_SHM_ENV_VAR);
+
+ if (id_str) {
+
+ u32 shm_id = atoi(id_str);
+
+ __afl_cmp_map = shmat(shm_id, NULL, 0);
+
+ if (__afl_cmp_map == (void*)-1) _exit(1);
+
+ }
+
+ }
+
if (getenv("AFL_INST_LIBS")) {
afl_start_code = 0;

MODIFY
qemu_mode/patches/afl-qemu-cpu-translate-inl.h
qemu_mode/patches/afl-qemu-cpu-translate-inl.h
@@ -102,34 +102,106 @@ static void afl_compcov_log_64(target_ulong cur_loc, target_ulong arg1,
}
+static void afl_cmplog_16(target_ulong cur_loc, target_ulong arg1,
+ target_ulong arg2) {
+
+ register uintptr_t k = (uintptr_t)cur_loc;
+
+ u32 hits = __afl_cmp_map->headers[k].hits;
+ __afl_cmp_map->headers[k].hits = hits + 1;
+ // if (!__afl_cmp_map->headers[k].cnt)
+ // __afl_cmp_map->headers[k].cnt = __afl_cmp_counter++;
+
+ __afl_cmp_map->headers[k].shape = 1;
+ //__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+
+ hits &= CMP_MAP_H - 1;
+ __afl_cmp_map->log[k][hits].v0 = arg1;
+ __afl_cmp_map->log[k][hits].v1 = arg2;
+
+}
+
+static void afl_cmplog_32(target_ulong cur_loc, target_ulong arg1,
+ target_ulong arg2) {
+
+ register uintptr_t k = (uintptr_t)cur_loc;
+
+ u32 hits = __afl_cmp_map->headers[k].hits;
+ __afl_cmp_map->headers[k].hits = hits + 1;
+
+ __afl_cmp_map->headers[k].shape = 3;
+
+ hits &= CMP_MAP_H - 1;
+ __afl_cmp_map->log[k][hits].v0 = arg1;
+ __afl_cmp_map->log[k][hits].v1 = arg2;
+
+}
+
+static void afl_cmplog_64(target_ulong cur_loc, target_ulong arg1,
+ target_ulong arg2) {
+
+ register uintptr_t k = (uintptr_t)cur_loc;
+
+ u32 hits = __afl_cmp_map->headers[k].hits;
+ __afl_cmp_map->headers[k].hits = hits + 1;
+
+ __afl_cmp_map->headers[k].shape = 7;
+
+ hits &= CMP_MAP_H - 1;
+ __afl_cmp_map->log[k][hits].v0 = arg1;
+ __afl_cmp_map->log[k][hits].v1 = arg2;
+
+}
+
+
static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2,
TCGMemOp ot, int is_imm) {
void *func;
- if (!afl_compcov_level || cur_loc > afl_end_code || cur_loc < afl_start_code)
+ if (cur_loc > afl_end_code || cur_loc < afl_start_code)
return;
- if (!is_imm && afl_compcov_level < 2) return;
+ if (__afl_cmp_map) {
+
+ cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
+ cur_loc &= CMP_MAP_W - 1;
switch (ot) {
- case MO_64: func = &afl_compcov_log_64; break;
- case MO_32: func = &afl_compcov_log_32; break;
- case MO_16: func = &afl_compcov_log_16; break;
+ case MO_64: func = &afl_cmplog_64; break;
+ case MO_32: func = &afl_cmplog_32; break;
+ case MO_16: func = &afl_cmplog_16; break;
default: return;
}
+ tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2);
+
+ } else if (afl_compcov_level) {
+
+ if (!is_imm && afl_compcov_level < 2) return;
+
cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
cur_loc &= MAP_SIZE - 7;
if (cur_loc >= afl_inst_rms) return;
+ switch (ot) {
+
+ case MO_64: func = &afl_compcov_log_64; break;
+ case MO_32: func = &afl_compcov_log_32; break;
+ case MO_16: func = &afl_compcov_log_16; break;
+ default: return;
+
+ }
+
tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2);
}
+}
+
/* Routines for debug */
/*
static void log_x86_saved_gpr(void) {

MODIFY
src/afl-fuzz-cmplog.c
src/afl-fuzz-cmplog.c
@@ -150,8 +150,10 @@ void init_cmplog_forkserver(char** argv) {
"msan_track_origins=0",
0);
- argv[0] = cmplog_binary;
- execv(cmplog_binary, argv);
+ setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1);
+
+ if (!qemu_mode) argv[0] = cmplog_binary;
+ execv(argv[0], argv);
/* Use a distinctive bitmap signature to tell the parent about execv()
falling through. */
@@ -441,8 +443,10 @@ u8 run_cmplog_target(char** argv, u32 timeout) {
"symbolize=0:"
"msan_track_origins=0", 0);
- argv[0] = cmplog_binary;
- execv(cmplog_binary, argv);
+ setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1);
+
+ if (!qemu_mode) argv[0] = cmplog_binary;
+ execv(argv[0], argv);
/* Use a distinctive bitmap value to tell the parent about execv()
falling through. */

cmplog for qemu mode