Always enable persistent mode, no env/bincheck needed
MODIFY
dynamic_list.txt
dynamic_list.txt
"__afl_auto_first";
"__afl_auto_init";
"__afl_auto_second";
+ "__afl_connected";
"__afl_coverage_discard";
"__afl_coverage_interesting";
"__afl_coverage_off";

MODIFY
instrumentation/afl-compiler-rt.o.c
instrumentation/afl-compiler-rt.o.c
@@ -105,6 +105,9 @@ u32 __afl_dictionary_len;
u64 __afl_map_addr;
u32 __afl_first_final_loc;
+/* 1 if we are running in afl, and the forkserver was stared, else 0 */
+u32 __afl_connected = 0;
+
// for the __AFL_COVERAGE_ON/__AFL_COVERAGE_OFF features to work:
int __afl_selective_coverage __attribute__((weak));
int __afl_selective_coverage_start_off __attribute__((weak));
@@ -1048,7 +1051,11 @@ static void __afl_start_forkserver(void) {
/* Phone home and tell the parent that we're OK. If parent isn't there,
assume we're not running in forkserver mode and just execute program. */
- if (write(FORKSRV_FD + 1, tmp, 4) != 4) { return; }
+ if (write(FORKSRV_FD + 1, tmp, 4) != 4) {
+ return;
+ }
+
+ __afl_connected = 1;
if (__afl_sharedmem_fuzzing || (__afl_dictionary_len && __afl_dictionary)) {
@@ -1260,25 +1267,17 @@ int __afl_persistent_loop(unsigned int max_cnt) {
iteration, it's our job to erase any trace of whatever happened
before the loop. */
- if (is_persistent) {
-
memset(__afl_area_ptr, 0, __afl_map_size);
__afl_area_ptr[0] = 1;
memset(__afl_prev_loc, 0, NGRAM_SIZE_MAX * sizeof(PREV_LOC_T));
- }
-
cycle_cnt = max_cnt;
first_pass = 0;
__afl_selective_coverage_temp = 1;
return 1;
- }
-
- if (is_persistent) {
-
- if (--cycle_cnt) {
+ } else if (--cycle_cnt) {
raise(SIGSTOP);
@@ -1296,12 +1295,10 @@ int __afl_persistent_loop(unsigned int max_cnt) {
__afl_area_ptr = __afl_area_ptr_dummy;
- }
+ return 0;
}
- return 0;
-
}
/* This one can be called from user code when deferred forkserver mode

MODIFY
src/afl-cc.c
src/afl-cc.c
@@ -1144,14 +1144,16 @@ static void edit_params(u32 argc, char **argv, char **envp) {
"({ static volatile char *_B __attribute__((used,unused)); "
" _B = (char*)\"" PERSIST_SIG
"\"; "
+ "extern int __afl_connected;"
#ifdef __APPLE__
"__attribute__((visibility(\"default\"))) "
"int _L(unsigned int) __asm__(\"___afl_persistent_loop\"); "
#else
"__attribute__((visibility(\"default\"))) "
- "int _L(unsigned int) __asm__(\"__afl_persistent_loop\"); "
+ "int _L(unsigned int) __asm__(\"___afl_persistent_loop\"); "
#endif /* ^__APPLE__ */
- "_L(_A); })";
+ // if afl is connected, we run _A times, else once.
+ "_L(__afl_connected ? _A : 1); })";
cc_params[cc_par_cnt++] =
"-D__AFL_INIT()="

Always enable persistent mode, no env/bincheck needed