afl_custom_describe api added
MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -22,18 +22,18 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
a schedule performance score, which is much better that the previous
walk the whole queue approach. Select the old mode with -Z (auto enabled
with -M)
- - rpc.statsd support by Edznux, thanks a lot!
+ - rpc.statsd support, for stats and charts, by Edznux, thanks a lot!
- Marcel Boehme submitted a patch that improves all AFFast schedules :)
- not specifying -M or -S will now auto-set "-S default"
- reading testcases from -i now descends into subdirectories
- - allow up to 4 times the -x command line option
- - loaded extras now have a duplicate protection
+ - allow the -x command line option up to 4 times
+ - loaded extras now have a duplication protection
- If test cases are too large we do a partial read on the maximum
supported size
- longer seeds with the same trace information will now be ignored
for fuzzing but still be used for splicing
- crashing seeds are now not prohibiting a run anymore but are
- skipped. They are used for splicing though.
+ skipped - they are used for splicing, though
- update MOpt for expanded havoc modes
- setting the env var AFL_NO_AUTODICT will not load an LTO autodictionary
- added NO_SPLICING compile option and makefile define
@@ -42,6 +42,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
- print special compile time options used in help output
- when using -c cmplog, one of the childs was not killed, fixed
- somewhere we broke -n dumb fuzzing, fixed
+ - added afl_custom_describe to the custom mutator API to allow for easy
+ mutation reproduction on crashing inputs
- instrumentation
- We received an enhanced gcc_plugin module from AdaCore, thank you
very much!!

MODIFY
include/afl-fuzz.h
include/afl-fuzz.h
@@ -798,6 +798,20 @@ struct custom_mutator {
size_t (*afl_custom_fuzz)(void *data, u8 *buf, size_t buf_size, u8 **out_buf,
u8 *add_buf, size_t add_buf_size, size_t max_size);
+ /**
+ * Describe the current testcase, generated by the last mutation.
+ * This will be called, for example, to give the written testcase a name
+ * after a crash ocurred. It can help to reproduce crashing mutations.
+ *
+ * (Optional)
+ *
+ * @param data pointer returned in afl_custom_init for this fuzz case
+ * @param[in] max_size Maximum size of the mutated output. The mutation must
+ * not produce data larger than max_size.
+ * @return A valid ptr to a 0-terminated string, or NULL on error.
+ */
+ const char *(*afl_custom_describe)(void *data, size_t max_size);
+
/**
* A post-processing function to use right before AFL writes the test case to
* disk in order to execute the target.

MODIFY
src/afl-fuzz-bitmap.c
src/afl-fuzz-bitmap.c
@@ -425,7 +425,7 @@ void minimize_bits(afl_state_t *afl, u8 *dst, u8 *src) {
/* Construct a file name for a new test case, capturing the operation
that led to its discovery. Returns a ptr to afl->describe_op_buf_256. */
-u8 *describe_op(afl_state_t *afl, u8 hnb) {
+u8 *describe_op(afl_state_t *afl, u8 new_bits) {
u8 *ret = afl->describe_op_buf_256;
@@ -445,6 +445,39 @@ u8 *describe_op(afl_state_t *afl, u8 hnb) {
sprintf(ret + strlen(ret), ",time:%llu", get_cur_time() - afl->start_time);
+ if (afl->current_custom_fuzz &&
+ afl->current_custom_fuzz->afl_custom_describe) {
+
+ /* We are currently in a custom mutator that supports afl_custom_describe,
+ * use it! */
+
+ size_t len_current = strlen(ret);
+ ret[len_current++] = ',';
+ ret[len_current++] = '\0';
+
+ size_t size_left =
+ sizeof(afl->describe_op_buf_256) - len_current - strlen(",+cov") - 2;
+ assert(size_left > 0);
+
+ const char *custom_description =
+ afl->current_custom_fuzz->afl_custom_describe(
+ afl->current_custom_fuzz->data, size_left);
+ if (!custom_description || !custom_description[0]) {
+
+ DEBUGF("Error getting a description from afl_custom_describe");
+ /* Take the stage name as description fallback */
+ sprintf(ret + len_current, "op:%s", afl->stage_short);
+
+ } else {
+
+ /* We got a proper custom description, use it */
+ strncat(ret + len_current, custom_description, size_left);
+
+ }
+
+ } else {
+
+ /* Normal testcase descriptions start here */
sprintf(ret + strlen(ret), ",op:%s", afl->stage_short);
if (afl->stage_cur_byte >= 0) {
@@ -467,7 +500,9 @@ u8 *describe_op(afl_state_t *afl, u8 hnb) {
}
- if (hnb == 2) { strcat(ret, ",+cov"); }
+ }
+
+ if (new_bits == 2) { strcat(ret, ",+cov"); }
return ret;
@@ -540,7 +575,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
if (unlikely(len == 0)) { return 0; }
u8 *queue_fn = "";
- u8 hnb = '\0';
+ u8 new_bits = '\0';
s32 fd;
u8 keeping = 0, res;
u64 cksum = 0;
@@ -566,7 +601,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
/* Keep only if there are new bits in the map, add to queue for
future fuzzing, etc. */
- if (!(hnb = has_new_bits(afl, afl->virgin_bits))) {
+ if (!(new_bits = has_new_bits(afl, afl->virgin_bits))) {
if (unlikely(afl->crash_mode)) { ++afl->total_crashes; }
return 0;
@@ -576,7 +611,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
#ifndef SIMPLE_FILES
queue_fn = alloc_printf("%s/queue/id:%06u,%s", afl->out_dir,
- afl->queued_paths, describe_op(afl, hnb));
+ afl->queued_paths, describe_op(afl, new_bits));
#else
@@ -619,7 +654,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
#endif
- if (hnb == 2) {
+ if (new_bits == 2) {
afl->queue_top->has_new_cov = 1;
++afl->queued_with_cov;

MODIFY
src/afl-fuzz-mutators.c
src/afl-fuzz-mutators.c
@@ -151,7 +151,11 @@ struct custom_mutator *load_custom_mutator(afl_state_t *afl, const char *fn) {
/* Mutator */
/* "afl_custom_init", optional for backward compatibility */
mutator->afl_custom_init = dlsym(dh, "afl_custom_init");
- if (!mutator->afl_custom_init) FATAL("Symbol 'afl_custom_init' not found.");
+ if (!mutator->afl_custom_init) {
+
+ FATAL("Symbol 'afl_custom_init' not found.");
+
+ }
/* "afl_custom_fuzz" or "afl_custom_mutator", required */
mutator->afl_custom_fuzz = dlsym(dh, "afl_custom_fuzz");
@@ -161,49 +165,74 @@ struct custom_mutator *load_custom_mutator(afl_state_t *afl, const char *fn) {
WARNF("Symbol 'afl_custom_fuzz' not found. Try 'afl_custom_mutator'.");
mutator->afl_custom_fuzz = dlsym(dh, "afl_custom_mutator");
- if (!mutator->afl_custom_fuzz)
+ if (!mutator->afl_custom_fuzz) {
+
WARNF("Symbol 'afl_custom_mutator' not found.");
}
+ }
+
/* "afl_custom_introspection", optional */
#ifdef INTROSPECTION
mutator->afl_custom_introspection = dlsym(dh, "afl_custom_introspection");
- if (!mutator->afl_custom_introspection)
+ if (!mutator->afl_custom_introspection) {
+
ACTF("optional symbol 'afl_custom_introspection' not found.");
+
+ }
+
#endif
/* "afl_custom_fuzz_count", optional */
mutator->afl_custom_fuzz_count = dlsym(dh, "afl_custom_fuzz_count");
- if (!mutator->afl_custom_fuzz_count)
+ if (!mutator->afl_custom_fuzz_count) {
+
ACTF("optional symbol 'afl_custom_fuzz_count' not found.");
+ }
+
/* "afl_custom_deinit", optional for backward compatibility */
mutator->afl_custom_deinit = dlsym(dh, "afl_custom_deinit");
- if (!mutator->afl_custom_deinit)
+ if (!mutator->afl_custom_deinit) {
+
FATAL("Symbol 'afl_custom_deinit' not found.");
+ }
+
/* "afl_custom_post_process", optional */
mutator->afl_custom_post_process = dlsym(dh, "afl_custom_post_process");
- if (!mutator->afl_custom_post_process)
+ if (!mutator->afl_custom_post_process) {
+
ACTF("optional symbol 'afl_custom_post_process' not found.");
+ }
+
u8 notrim = 0;
/* "afl_custom_init_trim", optional */
mutator->afl_custom_init_trim = dlsym(dh, "afl_custom_init_trim");
- if (!mutator->afl_custom_init_trim)
+ if (!mutator->afl_custom_init_trim) {
+
ACTF("optional symbol 'afl_custom_init_trim' not found.");
+ }
+
/* "afl_custom_trim", optional */
mutator->afl_custom_trim = dlsym(dh, "afl_custom_trim");
- if (!mutator->afl_custom_trim)
+ if (!mutator->afl_custom_trim) {
+
ACTF("optional symbol 'afl_custom_trim' not found.");
+ }
+
/* "afl_custom_post_trim", optional */
mutator->afl_custom_post_trim = dlsym(dh, "afl_custom_post_trim");
- if (!mutator->afl_custom_post_trim)
+ if (!mutator->afl_custom_post_trim) {
+
ACTF("optional symbol 'afl_custom_post_trim' not found.");
+ }
+
if (notrim) {
mutator->afl_custom_init_trim = NULL;
@@ -217,31 +246,54 @@ struct custom_mutator *load_custom_mutator(afl_state_t *afl, const char *fn) {
/* "afl_custom_havoc_mutation", optional */
mutator->afl_custom_havoc_mutation = dlsym(dh, "afl_custom_havoc_mutation");
- if (!mutator->afl_custom_havoc_mutation)
+ if (!mutator->afl_custom_havoc_mutation) {
+
ACTF("optional symbol 'afl_custom_havoc_mutation' not found.");
+ }
+
/* "afl_custom_havoc_mutation", optional */
mutator->afl_custom_havoc_mutation_probability =
dlsym(dh, "afl_custom_havoc_mutation_probability");
- if (!mutator->afl_custom_havoc_mutation_probability)
+ if (!mutator->afl_custom_havoc_mutation_probability) {
+
ACTF("optional symbol 'afl_custom_havoc_mutation_probability' not found.");
+ }
+
/* "afl_custom_queue_get", optional */
mutator->afl_custom_queue_get = dlsym(dh, "afl_custom_queue_get");
- if (!mutator->afl_custom_queue_get)
+ if (!mutator->afl_custom_queue_get) {
+
ACTF("optional symbol 'afl_custom_queue_get' not found.");
+ }
+
/* "afl_custom_queue_new_entry", optional */
mutator->afl_custom_queue_new_entry = dlsym(dh, "afl_custom_queue_new_entry");
- if (!mutator->afl_custom_queue_new_entry)
+ if (!mutator->afl_custom_queue_new_entry) {
+
ACTF("optional symbol 'afl_custom_queue_new_entry' not found");
+ }
+
+ /* "afl_custom_describe", optional */
+ mutator->afl_custom_describe = dlsym(dh, "afl_custom_describe");
+ if (!mutator->afl_custom_describe) {
+
+ ACTF("Symbol 'afl_custom_describe' not found.");
+
+ }
+
OKF("Custom mutator '%s' installed successfully.", fn);
/* Initialize the custom mutator */
- if (mutator->afl_custom_init)
+ if (mutator->afl_custom_init) {
+
mutator->data = mutator->afl_custom_init(afl, rand_below(afl, 0xFFFFFFFF));
+ }
+
mutator->stacked_custom = (mutator && mutator->afl_custom_havoc_mutation);
mutator->stacked_custom_prob =
6; // like one of the default mutations in havoc

MODIFY
src/afl-fuzz-one.c
src/afl-fuzz-one.c
@@ -1790,11 +1790,16 @@ custom_mutator_stage:
afl->current_custom_fuzz = el;
- if (el->afl_custom_fuzz_count)
+ if (el->afl_custom_fuzz_count) {
+
afl->stage_max = el->afl_custom_fuzz_count(el->data, out_buf, len);
- else
+
+ } else {
+
afl->stage_max = saved_max;
+ }
+
has_custom_fuzz = true;
afl->stage_short = el->name_short;

MODIFY
unicorn_mode/unicornafl
unicorn_mode/unicornafl
-Subproject commit f44ec48f8d5929f243522c1152b5b3c0985a5548
+Subproject commit 8cca4801adb767dce7cf72202d7d25bdb420cf7d

afl_custom_describe api added