better forkserver error help and code format
MODIFY
src/afl-forkserver.c
src/afl-forkserver.c
@@ -809,7 +809,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
"have a\n"
" restrictive memory limit configured, this is expected; please "
"read\n"
- " %s/notes_for_asan.md for help.\n",
+ " %s/notes_for_asan.md for help and run with '-m 0'.\n",
doc_path);
} else if (!fsrv->mem_limit) {
@@ -817,18 +817,21 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
SAYF("\n" cLRD "[-] " cRST
"Whoops, the target binary crashed suddenly, "
"before receiving any input\n"
- " from the fuzzer! There are several probable explanations:\n\n"
-
- " - The target binary requires a large map and crashes before "
- "reporting.\n"
- " Set a high value (e.g. AFL_MAP_SIZE=8000000) or use "
- "AFL_DEBUG=1 to see the\n"
- " message from the target binary\n\n"
-
- " - The binary is just buggy and explodes entirely on its own. "
- "If so, you\n"
- " need to fix the underlying problem or find a better "
- "replacement.\n\n"
+ " from the fuzzer! You can try the following:\n\n"
+
+ " - The target binary crashes because necessary runtime "
+ "conditions it needs\n"
+ " are not met. Try to:\n"
+ " 1. Run again with AFL_DEBUG=1 set and check the output of "
+ "the target\n"
+ " binary for clues.\n"
+ " 2. Run again with AFL_DEBUG=1 and 'ulimit -c unlimited' and "
+ "analyze the\n"
+ " generated core dump.\n\n"
+
+ " - Possibly the target requires a huge coverage map and has "
+ "CTORS.\n"
+ " Retry with setting AFL_MAP_SIZE=10000000.\n\n"
MSG_FORK_ON_APPLE
@@ -844,13 +847,17 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
SAYF("\n" cLRD "[-] " cRST
"Whoops, the target binary crashed suddenly, "
"before receiving any input\n"
- " from the fuzzer! There are several probable explanations:\n\n"
-
- " - The target binary requires a large map and crashes before "
- "reporting.\n"
- " Set a high value (e.g. AFL_MAP_SIZE=8000000) or use "
- "AFL_DEBUG=1 to see the\n"
- " message from the target binary\n\n"
+ " from the fuzzer! You can try the following:\n\n"
+
+ " - The target binary crashes because necessary runtime "
+ "conditions it needs\n"
+ " are not met. Try to:\n"
+ " 1. Run again with AFL_DEBUG=1 set and check the output of "
+ "the target\n"
+ " binary for clues.\n"
+ " 2. Run again with AFL_DEBUG=1 and 'ulimit -c unlimited' and "
+ "analyze the\n"
+ " generated core dump.\n\n"
" - The current memory limit (%s) is too restrictive, causing "
"the\n"
@@ -868,13 +875,12 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
" estimate the required amount of virtual memory for the "
"binary.\n\n"
- " - The binary is just buggy and explodes entirely on its own. "
- "If so, you\n"
- " need to fix the underlying problem or find a better "
- "replacement.\n\n"
-
MSG_FORK_ON_APPLE
+ " - Possibly the target requires a huge coverage map and has "
+ "CTORS.\n"
+ " Retry with setting AFL_MAP_SIZE=10000000.\n\n"
+
" - Less likely, there is a horrible bug in the fuzzer. If other "
"options\n"
" fail, poke <afl-users@googlegroups.com> for troubleshooting "
@@ -903,7 +909,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
"with ASAN and\n"
" you have a restrictive memory limit configured, this is "
"expected; please\n"
- " read %s/notes_for_asan.md for help.\n",
+ " read %s/notes_for_asan.md for help and run with '-m 0'.\n",
doc_path);
} else if (!fsrv->mem_limit) {
@@ -911,10 +917,22 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
SAYF("\n" cLRD "[-] " cRST
"Hmm, looks like the target binary terminated before we could complete"
" a\n"
- "handshake with the injected code.\n"
- "Most likely the target has a huge coverage map, retry with setting"
- " the\n"
- "environment variable AFL_MAP_SIZE=8000000\n"
+ "handshake with the injected code. You can try the following:\n\n"
+
+ " - The target binary crashes because necessary runtime conditions "
+ "it needs\n"
+ " are not met. Try to:\n"
+ " 1. Run again with AFL_DEBUG=1 set and check the output of the "
+ "target\n"
+ " binary for clues.\n"
+ " 2. Run again with AFL_DEBUG=1 and 'ulimit -c unlimited' and "
+ "analyze the\n"
+ " generated core dump.\n\n"
+
+ " - Possibly the target requires a huge coverage map and has "
+ "CTORS.\n"
+ " Retry with setting AFL_MAP_SIZE=10000000.\n\n"
+
"Otherwise there is a horrible bug in the fuzzer.\n"
"Poke <afl-users@googlegroups.com> for troubleshooting tips.\n");
@@ -926,14 +944,23 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
"\n" cLRD "[-] " cRST
"Hmm, looks like the target binary terminated "
"before we could complete a\n"
- " handshake with the injected code. There are %s probable "
- "explanations:\n\n"
+ " handshake with the injected code. You can try the following:\n\n"
"%s"
- " - Most likely the target has a huge coverage map, retry with "
- "setting the\n"
- " environment variable AFL_MAP_SIZE=8000000\n\n"
+ " - The target binary crashes because necessary runtime conditions "
+ "it needs\n"
+ " are not met. Try to:\n"
+ " 1. Run again with AFL_DEBUG=1 set and check the output of the "
+ "target\n"
+ " binary for clues.\n"
+ " 2. Run again with AFL_DEBUG=1 and 'ulimit -c unlimited' and "
+ "analyze the\n"
+ " generated core dump.\n\n"
+
+ " - Possibly the target requires a huge coverage map and has "
+ "CTORS.\n"
+ " Retry with setting AFL_MAP_SIZE=10000000.\n\n"
" - The current memory limit (%s) is too restrictive, causing an "
"OOM\n"
@@ -958,7 +985,6 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
"options\n"
" fail, poke <afl-users@googlegroups.com> for troubleshooting "
"tips.\n",
- getenv(DEFER_ENV_VAR) ? "three" : "two",
getenv(DEFER_ENV_VAR)
? " - You are using deferred forkserver, but __AFL_INIT() is "
"never\n"
@@ -1038,12 +1064,14 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
if (unlikely(fsrv->no_unlink)) {
- fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
+ fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_TRUNC,
+ DEFAULT_PERMISSION);
} else {
unlink(fsrv->out_file); /* Ignore errors. */
- fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
+ fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_EXCL,
+ DEFAULT_PERMISSION);
}

MODIFY
src/afl-fuzz-init.c
src/afl-fuzz-init.c
@@ -152,7 +152,8 @@ void bind_to_free_cpu(afl_state_t *afl) {
do {
- if ((lockfd = open(lockfile, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION)) < 0) {
+ if ((lockfd = open(lockfile, O_RDWR | O_CREAT | O_EXCL,
+ DEFAULT_PERMISSION)) < 0) {
if (first) {
@@ -2092,7 +2093,8 @@ void setup_stdio_file(afl_state_t *afl) {
unlink(afl->fsrv.out_file); /* Ignore errors */
- afl->fsrv.out_fd = open(afl->fsrv.out_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
+ afl->fsrv.out_fd =
+ open(afl->fsrv.out_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
if (afl->fsrv.out_fd < 0) {

MODIFY
src/afl-fuzz-run.c
src/afl-fuzz-run.c
@@ -83,7 +83,8 @@ write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
afl->document_counter++,
describe_op(afl, 0, NAME_MAX - strlen("000000000:")));
- if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION)) >= 0) {
+ if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION)) >=
+ 0) {
if (write(doc_fd, mem, len) != len)
PFATAL("write to mutation file failed: %s", fn);
@@ -247,12 +248,14 @@ static void write_with_gap(afl_state_t *afl, u8 *mem, u32 len, u32 skip_at,
if (unlikely(afl->no_unlink)) {
- fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
+ fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_TRUNC,
+ DEFAULT_PERMISSION);
} else {
unlink(afl->fsrv.out_file); /* Ignore errors. */
- fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
+ fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_EXCL,
+ DEFAULT_PERMISSION);
}
@@ -564,7 +567,8 @@ void sync_fuzzers(afl_state_t *afl) {
/* document the attempt to sync to this instance */
sprintf(qd_synced_path, "%s/.synced/%s.last", afl->out_dir, sd_ent->d_name);
- id_fd = open(qd_synced_path, O_RDWR | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
+ id_fd =
+ open(qd_synced_path, O_RDWR | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
if (id_fd >= 0) close(id_fd);
/* Skip anything that doesn't have a queue/ subdirectory. */

MODIFY
src/afl-sharedmem.c
src/afl-sharedmem.c
@@ -162,8 +162,8 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
snprintf(shm->g_shm_file_path, L_tmpnam, "/afl_%d_%ld", getpid(), random());
/* create the shared memory segment as if it was a file */
- shm->g_shm_fd =
- shm_open(shm->g_shm_file_path, O_CREAT | O_RDWR | O_EXCL, DEFAULT_PERMISSION);
+ shm->g_shm_fd = shm_open(shm->g_shm_file_path, O_CREAT | O_RDWR | O_EXCL,
+ DEFAULT_PERMISSION);
if (shm->g_shm_fd == -1) { PFATAL("shm_open() failed"); }
/* configure the size of the shared memory segment */
@@ -202,7 +202,8 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
/* create the shared memory segment as if it was a file */
shm->cmplog_g_shm_fd =
- shm_open(shm->cmplog_g_shm_file_path, O_CREAT | O_RDWR | O_EXCL, DEFAULT_PERMISSION);
+ shm_open(shm->cmplog_g_shm_file_path, O_CREAT | O_RDWR | O_EXCL,
+ DEFAULT_PERMISSION);
if (shm->cmplog_g_shm_fd == -1) { PFATAL("shm_open() failed"); }
/* configure the size of the shared memory segment */
@@ -241,7 +242,8 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
#else
u8 *shm_str;
- shm->shm_id = shmget(IPC_PRIVATE, map_size, IPC_CREAT | IPC_EXCL | DEFAULT_PERMISSION);
+ shm->shm_id =
+ shmget(IPC_PRIVATE, map_size, IPC_CREAT | IPC_EXCL | DEFAULT_PERMISSION);
if (shm->shm_id < 0) { PFATAL("shmget() failed"); }
if (shm->cmplog_mode) {

MODIFY
src/afl-showmap.c
src/afl-showmap.c
@@ -1119,7 +1119,8 @@ int main(int argc, char **argv_orig, char **envp) {
unlink(stdin_file);
atexit(at_exit_handler);
fsrv->out_file = stdin_file;
- fsrv->out_fd = open(stdin_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
+ fsrv->out_fd =
+ open(stdin_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
if (fsrv->out_fd < 0) { PFATAL("Unable to create '%s'", out_file); }
if (arg_offset && use_argv[arg_offset] != stdin_file) {

better forkserver error help and code format