surgical_havoc_mutate() in custom mutator helpers
ADD
examples/custom_mutators/Makefile
+all:
+ $(CC) $(CFLAGS) -fPIC -shared -g -I ../../include example.c -o libexamplemutator.so

MODIFY
examples/custom_mutators/README.md
examples/custom_mutators/README.md
@@ -7,7 +7,7 @@ Note that if you compile with python3.7 you must use python3 scripts, and if
you use pyton2.7 to compile python2 scripts!
example.c - this is a simple example written in C and should be compiled to a
- shared library
+ shared library. Use make to compile it and produce libexamplemutator.so
example.py - this is the template you can use, the functions are there but they
are empty

ADD
examples/custom_mutators/custom_mutator_helpers.h
+#ifndef CUSTOM_MUTATOR_HELPERS
+#define CUSTOM_MUTATOR_HELPERS
+
+#include "config.h"
+#include "types.h"
+#include <stdlib.h>
+
+#define LIMIT_RAND(limit) (rand() % (limit))
+
+static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
+
+ static s8 interesting_8[] = {INTERESTING_8};
+ static s16 interesting_16[] = {INTERESTING_8, INTERESTING_16};
+ static s32 interesting_32[] = {INTERESTING_8, INTERESTING_16, INTERESTING_32};
+
+ switch (LIMIT_RAND(12)) {
+
+ case 0: {
+
+ /* Flip a single bit somewhere. Spooky! */
+
+ s32 bit_idx = ((LIMIT_RAND(end - begin) + begin) << 3) + LIMIT_RAND(8);
+
+ out_buf[bit_idx >> 3] ^= 128 >> (bit_idx & 7);
+
+ break;
+
+ }
+
+ case 1: {
+
+ /* Set byte to interesting value. */
+
+ u8 val = interesting_8[LIMIT_RAND(sizeof(interesting_8))];
+ out_buf[(LIMIT_RAND(end - begin) + begin)] = val;
+
+ break;
+
+ }
+
+ case 2: {
+
+ /* Set word to interesting value, randomly choosing endian. */
+
+ if (end - begin < 2) break;
+
+ s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
+
+ if (byte_idx >= end - 1) break;
+
+ switch (LIMIT_RAND(2)) {
+
+ case 0:
+ *(u16 *)(out_buf + byte_idx) =
+ interesting_16[LIMIT_RAND(sizeof(interesting_16) >> 1)];
+ break;
+ case 1:
+ *(u16 *)(out_buf + byte_idx) =
+ SWAP16(interesting_16[LIMIT_RAND(sizeof(interesting_16) >> 1)]);
+ break;
+
+ }
+
+ break;
+
+ }
+
+ case 3: {
+
+ /* Set dword to interesting value, randomly choosing endian. */
+
+ if (end - begin < 4) break;
+
+ s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
+
+ if (byte_idx >= end - 3) break;
+
+ switch (LIMIT_RAND(2)) {
+
+ case 0:
+ *(u32 *)(out_buf + byte_idx) =
+ interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)];
+ break;
+ case 1:
+ *(u32 *)(out_buf + byte_idx) =
+ SWAP32(interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)]);
+ break;
+
+ }
+
+ break;
+
+ }
+
+ case 4: {
+
+ /* Set qword to interesting value, randomly choosing endian. */
+
+ if (end - begin < 8) break;
+
+ s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
+
+ if (byte_idx >= end - 7) break;
+
+ switch (LIMIT_RAND(2)) {
+
+ case 0:
+ *(u64 *)(out_buf + byte_idx) =
+ (s64)interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)];
+ break;
+ case 1:
+ *(u64 *)(out_buf + byte_idx) =
+ SWAP64((s64)interesting_32[LIMIT_RAND(sizeof(interesting_32) >> 2)]);
+ break;
+
+ }
+
+ break;
+
+ }
+
+ case 5: {
+
+ /* Randomly subtract from byte. */
+
+ out_buf[(LIMIT_RAND(end - begin) + begin)] -= 1 + LIMIT_RAND(ARITH_MAX);
+
+ break;
+
+ }
+
+ case 6: {
+
+ /* Randomly add to byte. */
+
+ out_buf[(LIMIT_RAND(end - begin) + begin)] += 1 + LIMIT_RAND(ARITH_MAX);
+
+ break;
+
+ }
+
+ case 7: {
+
+ /* Randomly subtract from word, random endian. */
+
+ if (end - begin < 2) break;
+
+ s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
+
+ if (byte_idx >= end - 1) break;
+
+ if (LIMIT_RAND(2)) {
+
+ *(u16 *)(out_buf + byte_idx) -= 1 + LIMIT_RAND(ARITH_MAX);
+
+ } else {
+
+ u16 num = 1 + LIMIT_RAND(ARITH_MAX);
+
+ *(u16 *)(out_buf + byte_idx) =
+ SWAP16(SWAP16(*(u16 *)(out_buf + byte_idx)) - num);
+
+ }
+
+ break;
+
+ }
+
+ case 8: {
+
+ /* Randomly add to word, random endian. */
+
+ if (end - begin < 2) break;
+
+ s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
+
+ if (byte_idx >= end - 1) break;
+
+ if (LIMIT_RAND(2)) {
+
+ *(u16 *)(out_buf + byte_idx) += 1 + LIMIT_RAND(ARITH_MAX);
+
+ } else {
+
+ u16 num = 1 + LIMIT_RAND(ARITH_MAX);
+
+ *(u16 *)(out_buf + byte_idx) =
+ SWAP16(SWAP16(*(u16 *)(out_buf + byte_idx)) + num);
+
+ }
+
+ break;
+
+ }
+
+ case 9: {
+
+ /* Randomly subtract from dword, random endian. */
+
+ if (end - begin < 4) break;
+
+ s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
+
+ if (byte_idx >= end - 3) break;
+
+ if (LIMIT_RAND(2)) {
+
+ *(u32 *)(out_buf + byte_idx) -= 1 + LIMIT_RAND(ARITH_MAX);
+
+ } else {
+
+ u32 num = 1 + LIMIT_RAND(ARITH_MAX);
+
+ *(u32 *)(out_buf + byte_idx) =
+ SWAP32(SWAP32(*(u32 *)(out_buf + byte_idx)) - num);
+
+ }
+
+ break;
+
+ }
+
+ case 10: {
+
+ /* Randomly add to dword, random endian. */
+
+ if (end - begin < 4) break;
+
+ s32 byte_idx = (LIMIT_RAND(end - begin) + begin);
+
+ if (byte_idx >= end - 3) break;
+
+ if (LIMIT_RAND(2)) {
+
+ *(u32 *)(out_buf + byte_idx) += 1 + LIMIT_RAND(ARITH_MAX);
+
+ } else {
+
+ u32 num = 1 + LIMIT_RAND(ARITH_MAX);
+
+ *(u32 *)(out_buf + byte_idx) =
+ SWAP32(SWAP32(*(u32 *)(out_buf + byte_idx)) + num);
+
+ }
+
+ break;
+
+ }
+
+ case 11: {
+
+ /* Just set a random byte to a random value. Because,
+ why not. We use XOR with 1-255 to eliminate the
+ possibility of a no-op. */
+
+ out_buf[(LIMIT_RAND(end - begin) + begin)] ^= 1 + LIMIT_RAND(255);
+
+ break;
+
+ }
+
+ }
+
+}
+
+#endif

MODIFY
examples/custom_mutators/example.c
examples/custom_mutators/example.c
Shengtuo Hu <h1994st@gmail.com>
*/
+// You need to use -I /path/to/AFLplusplus/include
+#include "custom_mutator_helpers.h"
+
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
@@ -21,7 +24,7 @@ static size_t data_size = 100;
void afl_custom_init(unsigned int seed) {
- srand(seed);
+ srand(seed); // needed also by surgical_havoc_mutate()
}
@@ -54,9 +57,11 @@ size_t afl_custom_fuzz(uint8_t **buf, size_t buf_size, uint8_t *add_buf,
memcpy(mutated_out, commands[rand() % 3], 3);
// Mutate the payload of the packet
- for (int i = 3; i < mutated_size; i++) {
+ int i;
+ for (i = 0; i < 8; ++i) {
- mutated_out[i] = (mutated_out[i] + rand() % 10) & 0xff;
+ // Randomly perform one of the (no len modification) havoc mutations
+ surgical_havoc_mutate(mutated_out, 3, mutated_size);
}

surgical_havoc_mutate() in custom mutator helpers