fix autodict
MODIFY
GNUmakefile
GNUmakefile
@@ -394,8 +394,8 @@ afl-gotcpu: src/afl-gotcpu.c src/afl-common.o $(COMM_HDR) | test_x86
# document all mutations and only do one run (use with only one input file!)
-document: $(COMM_HDR) include/afl-fuzz.h $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o | test_x86
- $(CC) -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS) $(CFLAGS_FLTO) $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o -o afl-fuzz-document $(PYFLAGS) $(LDFLAGS)
+document: $(COMM_HDR) include/afl-fuzz.h $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-performance.o | test_x86
+ $(CC) -D_DEBUG=\"1\" -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS) $(CFLAGS_FLTO) $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.c src/afl-performance.o -o afl-fuzz-document $(PYFLAGS) $(LDFLAGS)
test/unittests/unit_maybe_alloc.o : $(COMM_HDR) include/alloc-inl.h test/unittests/unit_maybe_alloc.c $(AFL_FUZZ_FILES)
@$(CC) $(CFLAGS) $(ASAN_CFLAGS) -c test/unittests/unit_maybe_alloc.c -o test/unittests/unit_maybe_alloc.o

MODIFY
examples/persistent_demo/persistent_demo_new.c
examples/persistent_demo/persistent_demo_new.c
@@ -49,9 +49,13 @@ int main(int argc, char **argv) {
len = __AFL_FUZZ_TESTCASE_LEN;
+ fprintf(stderr, "input: %zd \"%s\"\n", len, buf);
+
/* do we have enough data? */
if (len < 8) continue;
+ if (strcmp((char *)buf, "thisisateststring") == 0) printf("teststring\n");
+
if (buf[0] == 'f') {
printf("one\n");

MODIFY
llvm_mode/afl-llvm-rt.o.c
llvm_mode/afl-llvm-rt.o.c
@@ -395,6 +395,9 @@ static void __afl_start_snapshots(void) {
if (read(FORKSRV_FD, &was_killed, 4) != 4) _exit(1);
+ if (getenv("AFL_DEBUG"))
+ fprintf(stderr, "target forkserver recv: %08x\n", was_killed);
+
if ((was_killed & (FS_OPT_ENABLED | FS_OPT_SHDMEM_FUZZ)) ==
(FS_OPT_ENABLED | FS_OPT_SHDMEM_FUZZ)) {
@@ -594,6 +597,9 @@ static void __afl_start_forkserver(void) {
if (read(FORKSRV_FD, &was_killed, 4) != 4) _exit(1);
+ if (getenv("AFL_DEBUG"))
+ fprintf(stderr, "target forkserver recv: %08x\n", was_killed);
+
if ((was_killed & (FS_OPT_ENABLED | FS_OPT_SHDMEM_FUZZ)) ==
(FS_OPT_ENABLED | FS_OPT_SHDMEM_FUZZ)) {

MODIFY
src/afl-forkserver.c
src/afl-forkserver.c
@@ -596,9 +596,9 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
// this is not afl-fuzz - we deny and return
if (fsrv->use_shmem_fuzz)
- status = (FS_OPT_ENABLED | FS_OPT_AUTODICT | FS_OPT_SHDMEM_FUZZ);
+ status = (FS_OPT_ENABLED | FS_OPT_SHDMEM_FUZZ);
else
- status = (FS_OPT_ENABLED | FS_OPT_AUTODICT);
+ status = (FS_OPT_ENABLED);
if (write(fsrv->fsrv_ctl_fd, &status, 4) != 4) {
FATAL("Writing to forkserver failed.");
@@ -610,7 +610,12 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
}
if (!be_quiet) { ACTF("Using AUTODICT feature."); }
+
+ if (fsrv->use_shmem_fuzz)
+ status = (FS_OPT_ENABLED | FS_OPT_AUTODICT | FS_OPT_SHDMEM_FUZZ);
+ else
status = (FS_OPT_ENABLED | FS_OPT_AUTODICT);
+
if (write(fsrv->fsrv_ctl_fd, &status, 4) != 4) {
FATAL("Writing to forkserver failed.");
@@ -862,7 +867,9 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
*fsrv->shmem_fuzz_len = len;
memcpy(fsrv->shmem_fuzz, buf, len);
#ifdef _DEBUG
- fprintf(stderr, "FS crc: %08x len: %u\n",
+ if (getenv("AFL_DEBUG")) {
+
+ fprintf(stderr, "FS crc: %016llx len: %u\n",
hash64(fsrv->shmem_fuzz, *fsrv->shmem_fuzz_len, 0xa5b35705),
*fsrv->shmem_fuzz_len);
fprintf(stderr, "SHM :");
@@ -872,6 +879,9 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
for (int i = 0; i < *fsrv->shmem_fuzz_len; i++)
fprintf(stderr, "%02x", buf[i]);
fprintf(stderr, "\n");
+
+ }
+
#endif
} else {

MODIFY
src/afl-fuzz-run.c
src/afl-fuzz-run.c
@@ -156,16 +156,22 @@ static void write_with_gap(afl_state_t *afl, void *mem, u32 len, u32 skip_at,
*afl->fsrv.shmem_fuzz_len = len - skip_len;
#ifdef _DEBUG
- fprintf(stderr, "FS crc: %08x len: %u\n",
- hash64(fsrv->shmem_fuzz, *fsrv->shmem_fuzz_len, 0xa5b35705),
- *fsrv->shmem_fuzz_len);
+ if (afl->debug) {
+
+ fprintf(
+ stderr, "FS crc: %16llx len: %u\n",
+ hash64(afl->fsrv.shmem_fuzz, *afl->fsrv.shmem_fuzz_len, 0xa5b35705),
+ *afl->fsrv.shmem_fuzz_len);
fprintf(stderr, "SHM :");
- for (int i = 0; i < *fsrv->shmem_fuzz_len; i++)
- fprintf(stderr, "%02x", fsrv->shmem_fuzz[i]);
+ for (int i = 0; i < *afl->fsrv.shmem_fuzz_len; i++)
+ fprintf(stderr, "%02x", afl->fsrv.shmem_fuzz[i]);
fprintf(stderr, "\nORIG:");
- for (int i = 0; i < *fsrv->shmem_fuzz_len; i++)
- fprintf(stderr, "%02x", buf[i]);
+ for (int i = 0; i < *afl->fsrv.shmem_fuzz_len; i++)
+ fprintf(stderr, "%02x", (u8)((u8 *)mem)[i]);
fprintf(stderr, "\n");
+
+ }
+
#endif
return;

MODIFY
src/afl-performance.c
src/afl-performance.c
@@ -143,8 +143,10 @@ void long_jump(afl_state_t *afl) {
#ifdef _DEBUG
u32 hash32(u8 *key, u32 len, u32 seed) {
+
#else
u32 inline hash32(u8 *key, u32 len, u32 seed) {
+
#endif
return (u32)XXH64(key, len, seed);
@@ -153,8 +155,10 @@ u32 inline hash32(u8 *key, u32 len, u32 seed) {
#ifdef _DEBUG
u64 hash64(u8 *key, u32 len, u64 seed) {
+
#else
u64 inline hash64(u8 *key, u32 len, u64 seed) {
+
#endif
return XXH64(key, len, seed);

MODIFY
src/afl-showmap.c
src/afl-showmap.c
@@ -986,9 +986,11 @@ int main(int argc, char **argv_orig, char **envp) {
if (read_file(infile)) {
if (wait_for_gdb) {
+
fprintf(stderr, "exec: gdb -p %d\n", fsrv->child_pid);
fprintf(stderr, "exec: kill -CONT %d\n", getpid());
kill(0, SIGSTOP);
+
}
showmap_run_target_forkserver(fsrv, use_argv, in_data, in_len);

fix autodict