nyx code format
MODIFY
include/forkserver.h
include/forkserver.h
*/
typedef enum NyxReturnValue {
+
Normal,
Crash,
Asan,
@@ -47,22 +48,23 @@ typedef enum NyxReturnValue {
Error,
IoError,
Abort,
+
} NyxReturnValue;
typedef struct {
- void* (*nyx_new)(const char *sharedir,
- const char *workdir,
- uint32_t worker_id,
- uint32_t cpu_id,
- bool create_snapshot);
+
+ void *(*nyx_new)(const char *sharedir, const char *workdir,
+ uint32_t worker_id, uint32_t cpu_id, bool create_snapshot);
void (*nyx_shutdown)(void *qemu_process);
void (*nyx_option_set_reload_mode)(void *qemu_process, bool enable);
- void (*nyx_option_set_timeout)(void *qemu_process, uint8_t timeout_sec, uint32_t timeout_usec);
+ void (*nyx_option_set_timeout)(void *qemu_process, uint8_t timeout_sec,
+ uint32_t timeout_usec);
void (*nyx_option_apply)(void *qemu_process);
void (*nyx_set_afl_input)(void *qemu_process, uint8_t *buffer, uint32_t size);
enum NyxReturnValue (*nyx_exec)(void *qemu_process);
uint8_t *(*nyx_get_bitmap_buffer)(void *qemu_process);
size_t (*nyx_get_bitmap_buffer_size)(void *qemu_process);
+
} nyx_plugin_handler_t;
#endif

MODIFY
src/afl-forkserver.c
src/afl-forkserver.c
@@ -389,43 +389,47 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
#ifdef __linux__
if (fsrv->nyx_mode) {
- if(fsrv->nyx_runner != NULL){
- return;
- }
+ if (fsrv->nyx_runner != NULL) { return; }
if (!be_quiet) { ACTF("Spinning up the NYX backend..."); }
- if(fsrv->out_dir_path == NULL){
- FATAL("Nyx workdir path not found...");
- }
+ if (fsrv->out_dir_path == NULL) { FATAL("Nyx workdir path not found..."); }
char *x = alloc_printf("%s/workdir", fsrv->out_dir_path);
- if(fsrv->nyx_id == 0xFFFFFFFF){
- FATAL("Nyx ID is not set...");
- }
+ if (fsrv->nyx_id == 0xFFFFFFFF) { FATAL("Nyx ID is not set..."); }
if (fsrv->nyx_bind_cpu_id == 0xFFFFFFFF) {
+
FATAL("Nyx CPU ID is not set...");
+
}
if (fsrv->nyx_parent) {
- fsrv->nyx_runner = fsrv->nyx_handlers->nyx_new(fsrv->target_path, x, fsrv->nyx_id, fsrv->nyx_bind_cpu_id, !fsrv->nyx_standalone);
- }
- else{
- fsrv->nyx_runner = fsrv->nyx_handlers->nyx_new(fsrv->target_path, x, fsrv->nyx_id, fsrv->nyx_bind_cpu_id, true);
- }
- if(fsrv->nyx_runner == NULL){
- FATAL("Something went wrong ...");
+ fsrv->nyx_runner = fsrv->nyx_handlers->nyx_new(
+ fsrv->target_path, x, fsrv->nyx_id, fsrv->nyx_bind_cpu_id,
+ !fsrv->nyx_standalone);
+
+ } else {
+
+ fsrv->nyx_runner = fsrv->nyx_handlers->nyx_new(
+ fsrv->target_path, x, fsrv->nyx_id, fsrv->nyx_bind_cpu_id, true);
+
}
- fsrv->map_size = fsrv->nyx_handlers->nyx_get_bitmap_buffer_size(fsrv->nyx_runner);;
+ if (fsrv->nyx_runner == NULL) { FATAL("Something went wrong ..."); }
+
+ fsrv->map_size =
+ fsrv->nyx_handlers->nyx_get_bitmap_buffer_size(fsrv->nyx_runner);
+ ;
fsrv->real_map_size = fsrv->map_size;
- fsrv->trace_bits = fsrv->nyx_handlers->nyx_get_bitmap_buffer(fsrv->nyx_runner);
+ fsrv->trace_bits =
+ fsrv->nyx_handlers->nyx_get_bitmap_buffer(fsrv->nyx_runner);
- fsrv->nyx_handlers->nyx_option_set_reload_mode(fsrv->nyx_runner, getenv("NYX_DISABLE_SNAPSHOT_MODE") == NULL);
+ fsrv->nyx_handlers->nyx_option_set_reload_mode(
+ fsrv->nyx_runner, getenv("NYX_DISABLE_SNAPSHOT_MODE") == NULL);
fsrv->nyx_handlers->nyx_option_apply(fsrv->nyx_runner);
fsrv->nyx_handlers->nyx_option_set_timeout(fsrv->nyx_runner, 2, 0);
@@ -434,6 +438,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
/* dry run */
fsrv->nyx_handlers->nyx_set_afl_input(fsrv->nyx_runner, "INIT", 4);
switch (fsrv->nyx_handlers->nyx_exec(fsrv->nyx_runner)) {
+
case Abort:
fsrv->nyx_handlers->nyx_shutdown(fsrv->nyx_runner);
FATAL("Error: Nyx abort occured...");
@@ -447,9 +452,13 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
break;
default:
break;
+
}
+
return;
+
}
+
#endif
if (!be_quiet) { ACTF("Spinning up the fork server..."); }
@@ -1163,10 +1172,9 @@ void afl_fsrv_kill(afl_forkserver_t *fsrv) {
fsrv->child_pid = -1;
#ifdef __linux__
- if(fsrv->nyx_mode){
- fsrv->nyx_handlers->nyx_shutdown(fsrv->nyx_runner);
- }
+ if (fsrv->nyx_mode) { fsrv->nyx_handlers->nyx_shutdown(fsrv->nyx_runner); }
#endif
+
}
/* Get the map size from the target forkserver */
@@ -1185,9 +1193,12 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
#ifdef __linux__
if (fsrv->nyx_mode) {
+
fsrv->nyx_handlers->nyx_set_afl_input(fsrv->nyx_runner, buf, len);
return;
+
}
+
#endif
#ifdef AFL_PERSISTENT_RECORD
if (unlikely(fsrv->persistent_record)) {
@@ -1308,16 +1319,21 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
static uint32_t last_timeout_value = 0;
if (last_timeout_value != timeout) {
- fsrv->nyx_handlers->nyx_option_set_timeout(fsrv->nyx_runner, timeout/1000, (timeout%1000) * 1000);
+
+ fsrv->nyx_handlers->nyx_option_set_timeout(
+ fsrv->nyx_runner, timeout / 1000, (timeout % 1000) * 1000);
fsrv->nyx_handlers->nyx_option_apply(fsrv->nyx_runner);
last_timeout_value = timeout;
+
}
- enum NyxReturnValue ret_val = fsrv->nyx_handlers->nyx_exec(fsrv->nyx_runner);
+ enum NyxReturnValue ret_val =
+ fsrv->nyx_handlers->nyx_exec(fsrv->nyx_runner);
fsrv->total_execs++;
switch (ret_val) {
+
case Normal:
return FSRV_RUN_OK;
case Crash:
@@ -1334,18 +1350,26 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
FATAL("Error: Nyx abort occured...");
case IoError:
if (*stop_soon_p) {
+
return 0;
- }
- else{
+
+ } else {
+
FATAL("Error: QEMU-Nyx has died...");
+
}
+
break;
case Error:
FATAL("Error: Nyx runtime error has occured...");
break;
+
}
+
return FSRV_RUN_OK;
+
}
+
#endif
/* After this memset, fsrv->trace_bits[] are effectively volatile, so we
must prevent any earlier operations from venturing into that
@@ -1353,9 +1377,12 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
#ifdef __linux__
if (!fsrv->nyx_mode) {
+
memset(fsrv->trace_bits, 0, fsrv->map_size);
MEM_BARRIER();
+
}
+
#else
memset(fsrv->trace_bits, 0, fsrv->map_size);
MEM_BARRIER();

MODIFY
src/afl-fuzz-init.c
src/afl-fuzz-init.c
@@ -411,10 +411,9 @@ void bind_to_free_cpu(afl_state_t *afl) {
OKF("Found a free CPU core, try binding to #%u.", i);
if (bind_cpu(afl, i)) {
+
#ifdef __linux__
- if(afl->fsrv.nyx_mode){
- afl->fsrv.nyx_bind_cpu_id = i;
- }
+ if (afl->fsrv.nyx_mode) { afl->fsrv.nyx_bind_cpu_id = i; }
#endif
/* Success :) */
break;
@@ -1096,8 +1095,11 @@ void perform_dry_run(afl_state_t *afl) {
case FSRV_RUN_NOINST:
#ifdef __linux__
if (afl->fsrv.nyx_mode && afl->fsrv.nyx_runner != NULL) {
+
afl->fsrv.nyx_handlers->nyx_shutdown(afl->fsrv.nyx_runner);
+
}
+
#endif
FATAL("No instrumentation detected");
@@ -2453,9 +2455,7 @@ void fix_up_sync(afl_state_t *afl) {
x = alloc_printf("%s/%s", afl->out_dir, afl->sync_id);
#ifdef __linux__
- if(afl->fsrv.nyx_mode){
- afl->fsrv.out_dir_path = afl->out_dir;
- }
+ if (afl->fsrv.nyx_mode) { afl->fsrv.out_dir_path = afl->out_dir; }
#endif
afl->sync_dir = afl->out_dir;
afl->out_dir = x;
@@ -2596,16 +2596,25 @@ void check_binary(afl_state_t *afl, u8 *fname) {
afl->fsrv.target_path = ck_strdup(fname);
#ifdef __linux__
if (afl->fsrv.nyx_mode) {
+
/* check if target_path is a nyx sharedir */
if (stat(afl->fsrv.target_path, &st) || S_ISDIR(st.st_mode)) {
+
char *tmp = alloc_printf("%s/config.ron", afl->fsrv.target_path);
if (stat(tmp, &st) || S_ISREG(st.st_mode)) {
+
free(tmp);
return;
+
}
+
}
- FATAL("Directory '%s' not found or is not a nyx share directory", afl->fsrv.target_path);
+
+ FATAL("Directory '%s' not found or is not a nyx share directory",
+ afl->fsrv.target_path);
+
}
+
#endif
if (stat(afl->fsrv.target_path, &st) || !S_ISREG(st.st_mode) ||
!(st.st_mode & 0111) || (f_len = st.st_size) < 4) {

MODIFY
src/afl-fuzz-stats.c
src/afl-fuzz-stats.c
@@ -681,13 +681,15 @@ void show_stats(afl_state_t *afl) {
#ifdef __linux__
if (afl->fsrv.nyx_mode) {
+
sprintf(banner + banner_pad,
"%s " cLCY VERSION cLBL " {%s} " cLGN "(%s) " cPIN "[%s] - Nyx",
afl->crash_mode ? cPIN "peruvian were-rabbit"
: cYEL "american fuzzy lop",
si, afl->use_banner, afl->power_name);
- }
- else{
+
+ } else {
+
#endif
sprintf(banner + banner_pad,
"%s " cLCY VERSION cLBL " {%s} " cLGN "(%s) " cPIN "[%s]",
@@ -696,8 +698,11 @@ void show_stats(afl_state_t *afl) {
si, afl->use_banner, afl->power_name);
#ifdef __linux__
+
}
+
#endif
+
}
SAYF("\n%s\n", banner);

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -393,59 +393,42 @@ static void fasan_check_afl_preload(char *afl_preload) {
#include <dlfcn.h>
nyx_plugin_handler_t *afl_load_libnyx_plugin(u8 *libnyx_binary) {
+
void * handle;
nyx_plugin_handler_t *plugin = calloc(1, sizeof(nyx_plugin_handler_t));
ACTF("Trying to load libnyx.so plugin...");
handle = dlopen((char *)libnyx_binary, RTLD_NOW);
- if (!handle) {
- goto fail;
- }
+ if (!handle) { goto fail; }
plugin->nyx_new = dlsym(handle, "nyx_new");
- if (plugin->nyx_new == NULL){
- goto fail;
- }
+ if (plugin->nyx_new == NULL) { goto fail; }
plugin->nyx_shutdown = dlsym(handle, "nyx_shutdown");
- if (plugin->nyx_shutdown == NULL){
- goto fail;
- }
+ if (plugin->nyx_shutdown == NULL) { goto fail; }
- plugin->nyx_option_set_reload_mode = dlsym(handle, "nyx_option_set_reload_mode");
- if (plugin->nyx_option_set_reload_mode == NULL){
- goto fail;
- }
+ plugin->nyx_option_set_reload_mode =
+ dlsym(handle, "nyx_option_set_reload_mode");
+ if (plugin->nyx_option_set_reload_mode == NULL) { goto fail; }
plugin->nyx_option_set_timeout = dlsym(handle, "nyx_option_set_timeout");
- if (plugin->nyx_option_set_timeout == NULL){
- goto fail;
- }
+ if (plugin->nyx_option_set_timeout == NULL) { goto fail; }
plugin->nyx_option_apply = dlsym(handle, "nyx_option_apply");
- if (plugin->nyx_option_apply == NULL){
- goto fail;
- }
+ if (plugin->nyx_option_apply == NULL) { goto fail; }
plugin->nyx_set_afl_input = dlsym(handle, "nyx_set_afl_input");
- if (plugin->nyx_set_afl_input == NULL){
- goto fail;
- }
+ if (plugin->nyx_set_afl_input == NULL) { goto fail; }
plugin->nyx_exec = dlsym(handle, "nyx_exec");
- if (plugin->nyx_exec == NULL){
- goto fail;
- }
+ if (plugin->nyx_exec == NULL) { goto fail; }
plugin->nyx_get_bitmap_buffer = dlsym(handle, "nyx_get_bitmap_buffer");
- if (plugin->nyx_get_bitmap_buffer == NULL){
- goto fail;
- }
+ if (plugin->nyx_get_bitmap_buffer == NULL) { goto fail; }
- plugin->nyx_get_bitmap_buffer_size = dlsym(handle, "nyx_get_bitmap_buffer_size");
- if (plugin->nyx_get_bitmap_buffer_size == NULL){
- goto fail;
- }
+ plugin->nyx_get_bitmap_buffer_size =
+ dlsym(handle, "nyx_get_bitmap_buffer_size");
+ if (plugin->nyx_get_bitmap_buffer_size == NULL) { goto fail; }
OKF("libnyx plugin is ready!");
return plugin;
@@ -455,7 +438,9 @@ nyx_plugin_handler_t* afl_load_libnyx_plugin(u8* libnyx_binary){
FATAL("failed to load libnyx: %s\n", dlerror());
free(plugin);
return NULL;
+
}
+
#endif
/* Main entry point */
@@ -921,10 +906,7 @@ int main(int argc, char **argv_orig, char **envp) {
#ifdef __linux__
case 'X': /* NYX mode */
- if (afl->fsrv.nyx_mode) {
- FATAL("Multiple -X options not supported");
-
- }
+ if (afl->fsrv.nyx_mode) { FATAL("Multiple -X options not supported"); }
afl->fsrv.nyx_parent = true;
afl->fsrv.nyx_standalone = true;
@@ -934,11 +916,7 @@ int main(int argc, char **argv_orig, char **envp) {
break;
case 'Y': /* NYX distributed mode */
- if (afl->fsrv.nyx_mode) {
-
- FATAL("Multiple -Y options not supported");
-
- }
+ if (afl->fsrv.nyx_mode) { FATAL("Multiple -Y options not supported"); }
afl->fsrv.nyx_mode = 1;
break;
@@ -1290,10 +1268,13 @@ int main(int argc, char **argv_orig, char **envp) {
#ifdef __linux__
if (afl->fsrv.nyx_mode) {
+
OKF("afl++ Nyx mode is enabled (developed and mainted by Sergej Schumilo)");
OKF("Nyx is open source, get it at "
"https://github.com/Nyx-Fuzz");
+
}
+
#endif
if (afl->sync_id && afl->is_main_node &&
afl->afl_env.afl_custom_mutator_only) {
@@ -1340,28 +1321,51 @@ int main(int argc, char **argv_orig, char **envp) {
#ifdef __linux__
if (afl->fsrv.nyx_mode) {
- if (afl->fsrv.nyx_standalone && strncmp(afl->sync_id, "default", strlen("default")) != 0){
- FATAL("distributed fuzzing is not supported in this Nyx mode (use -Y instead)");
+ if (afl->fsrv.nyx_standalone &&
+ strncmp(afl->sync_id, "default", strlen("default")) != 0) {
+
+ FATAL(
+ "distributed fuzzing is not supported in this Nyx mode (use -Y "
+ "instead)");
+
}
if (!afl->fsrv.nyx_standalone) {
+
if (afl->is_main_node) {
+
if (strncmp("0", afl->sync_id, strlen("0") != 0)) {
- FATAL("for Nyx -Y mode, the Main (-M) parameter has to be set to 0 (-M 0)");
+
+ FATAL(
+ "for Nyx -Y mode, the Main (-M) parameter has to be set to 0 (-M "
+ "0)");
+
}
+
afl->fsrv.nyx_id = 0;
+
}
if (afl->is_secondary_node) {
+
long nyx_id = strtol(afl->sync_id, NULL, 10);
if (nyx_id == 0 || nyx_id == LONG_MAX) {
- FATAL("for Nyx -Y mode, the Secondary (-S) parameter has to be a numeric value and >= 1 (e.g. -S 1)");
+
+ FATAL(
+ "for Nyx -Y mode, the Secondary (-S) parameter has to be a "
+ "numeric value and >= 1 (e.g. -S 1)");
+
}
+
afl->fsrv.nyx_id = nyx_id;
+
}
+
}
+
}
+
#endif
if (afl->sync_id) {
@@ -1589,16 +1593,22 @@ int main(int argc, char **argv_orig, char **envp) {
#ifdef __linux__
if (!afl->fsrv.nyx_mode) {
+
check_crash_handling();
check_cpu_governor(afl);
- }
- else{
+
+ } else {
+
u8 *libnyx_binary = find_afl_binary(argv[0], "nyx_mode/libnyx.so");
afl->fsrv.nyx_handlers = afl_load_libnyx_plugin(libnyx_binary);
if (afl->fsrv.nyx_handlers == NULL) {
+
FATAL("failed to initialize libnyx.so...");
+
}
+
}
+
#else
check_crash_handling();
check_cpu_governor(afl);
@@ -2085,10 +2095,14 @@ int main(int argc, char **argv_orig, char **envp) {
if (!afl->queue_buf[entry]->disabled) { ++valid_seeds; }
if (!afl->pending_not_fuzzed || !valid_seeds) {
+
#ifdef __linux__
if (afl->fsrv.nyx_mode) {
+
afl->fsrv.nyx_handlers->nyx_shutdown(afl->fsrv.nyx_runner);
+
}
+
#endif
FATAL("We need at least one valid input seed that does not crash!");

MODIFY
src/afl-showmap.c
src/afl-showmap.c
@@ -105,15 +105,8 @@ static sharedmem_t * shm_fuzz;
static const u8 count_class_human[256] = {
- [0] = 0,
- [1] = 1,
- [2] = 2,
- [3] = 3,
- [4] = 4,
- [8] = 5,
- [16] = 6,
- [32] = 7,
- [128] = 8
+ [0] = 0, [1] = 1, [2] = 2, [3] = 3, [4] = 4,
+ [8] = 5, [16] = 6, [32] = 7, [128] = 8
};

nyx code format