AFL_PRELOAD -> QEMU_SET_ENV for afl-fuzz,afl-showmap,afl-analyze,afl-tmin
MODIFY
src/afl-analyze.c
src/afl-analyze.c
@@ -82,6 +82,8 @@ static u8 edges_only, /* Ignore hit counts? */
static volatile u8 stop_soon, /* Ctrl-C pressed? */
child_timed_out; /* Child timed out? */
+static u8 qemu_mode;
+
/* Constants used for describing byte behavior. */
#define RESP_NONE 0x00 /* Changing byte is a no-op. */
@@ -709,6 +711,29 @@ static void set_up_environment(void) {
if (getenv("AFL_PRELOAD")) {
+ if (qemu_mode) {
+
+ u8* qemu_preload = getenv("QEMU_SET_ENV");
+ u8* afl_preload = getenv("AFL_PRELOAD");
+ u8* buf;
+
+ s32 i, afl_preload_size = strlen(afl_preload);
+ for (i = 0; i < afl_preload_size; ++i) {
+ if (afl_preload[i] == ',')
+ PFATAL("Comma (',') is not allowed in AFL_PRELOAD when -Q is specified!");
+ }
+
+ if (qemu_preload)
+ buf = alloc_printf("%s,LD_PRELOAD=%s", qemu_preload, afl_preload);
+ else
+ buf = alloc_printf("LD_PRELOAD=%s", afl_preload);
+
+ setenv("QEMU_SET_ENV", buf, 1);
+
+ ck_free(buf);
+
+ } else {
+
setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
@@ -716,6 +741,8 @@ static void set_up_environment(void) {
}
+}
+
/* Setup signal handlers, duh. */
static void setup_signal_handlers(void) {
@@ -835,7 +862,7 @@ static void find_binary(u8* fname) {
int main(int argc, char** argv) {
s32 opt;
- u8 mem_limit_given = 0, timeout_given = 0, qemu_mode = 0, unicorn_mode = 0,
+ u8 mem_limit_given = 0, timeout_given = 0, unicorn_mode = 0,
use_wine = 0;
char** use_argv;

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -714,22 +714,25 @@ int main(int argc, char** argv) {
if (qemu_mode) {
- char* qemu_preload = getenv("QEMU_SET_ENV");
- char buf[4096];
-
- if (qemu_preload) {
-
- snprintf(buf, sizeof(buf), "%s,LD_PRELOAD=%s", qemu_preload,
- getenv("AFL_PRELOAD"));
-
- } else {
-
- snprintf(buf, sizeof(buf), "LD_PRELOAD=%s", getenv("AFL_PRELOAD"));
-
+ u8* qemu_preload = getenv("QEMU_SET_ENV");
+ u8* afl_preload = getenv("AFL_PRELOAD");
+ u8* buf;
+
+ s32 i, afl_preload_size = strlen(afl_preload);
+ for (i = 0; i < afl_preload_size; ++i) {
+ if (afl_preload[i] == ',')
+ PFATAL("Comma (',') is not allowed in AFL_PRELOAD when -Q is specified!");
}
+ if (qemu_preload)
+ buf = alloc_printf("%s,LD_PRELOAD=%s", qemu_preload, afl_preload);
+ else
+ buf = alloc_printf("LD_PRELOAD=%s", afl_preload);
+
setenv("QEMU_SET_ENV", buf, 1);
+ ck_free(buf);
+
} else {
setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);

MODIFY
src/afl-showmap.c
src/afl-showmap.c
@@ -83,6 +83,8 @@ static volatile u8 stop_soon, /* Ctrl-C pressed? */
child_timed_out, /* Child timed out? */
child_crashed; /* Child crashed? */
+static u8 qemu_mode;
+
/* Classify tuple counts. Instead of mapping to individual bits, as in
afl-fuzz.c, we map to more user-friendly numbers between 1 and 8. */
@@ -358,6 +360,29 @@ static void set_up_environment(void) {
if (getenv("AFL_PRELOAD")) {
+ if (qemu_mode) {
+
+ u8* qemu_preload = getenv("QEMU_SET_ENV");
+ u8* afl_preload = getenv("AFL_PRELOAD");
+ u8* buf;
+
+ s32 i, afl_preload_size = strlen(afl_preload);
+ for (i = 0; i < afl_preload_size; ++i) {
+ if (afl_preload[i] == ',')
+ PFATAL("Comma (',') is not allowed in AFL_PRELOAD when -Q is specified!");
+ }
+
+ if (qemu_preload)
+ buf = alloc_printf("%s,LD_PRELOAD=%s", qemu_preload, afl_preload);
+ else
+ buf = alloc_printf("LD_PRELOAD=%s", afl_preload);
+
+ setenv("QEMU_SET_ENV", buf, 1);
+
+ ck_free(buf);
+
+ } else {
+
setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
@@ -365,6 +390,8 @@ static void set_up_environment(void) {
}
+}
+
/* Setup signal handlers, duh. */
static void setup_signal_handlers(void) {
@@ -498,7 +525,7 @@ static void find_binary(u8* fname) {
int main(int argc, char** argv) {
s32 opt;
- u8 mem_limit_given = 0, timeout_given = 0, qemu_mode = 0, unicorn_mode = 0,
+ u8 mem_limit_given = 0, timeout_given = 0, unicorn_mode = 0,
use_wine = 0;
u32 tcnt = 0;
char** use_argv;

MODIFY
src/afl-tmin.c
src/afl-tmin.c
@@ -96,6 +96,8 @@ static u8 crash_mode, /* Crash-centric mode? */
static volatile u8 stop_soon; /* Ctrl-C pressed? */
+static u8 qemu_mode;
+
/*
* forkserver section
*/
@@ -882,6 +884,29 @@ static void set_up_environment(void) {
if (getenv("AFL_PRELOAD")) {
+ if (qemu_mode) {
+
+ u8* qemu_preload = getenv("QEMU_SET_ENV");
+ u8* afl_preload = getenv("AFL_PRELOAD");
+ u8* buf;
+
+ s32 i, afl_preload_size = strlen(afl_preload);
+ for (i = 0; i < afl_preload_size; ++i) {
+ if (afl_preload[i] == ',')
+ PFATAL("Comma (',') is not allowed in AFL_PRELOAD when -Q is specified!");
+ }
+
+ if (qemu_preload)
+ buf = alloc_printf("%s,LD_PRELOAD=%s", qemu_preload, afl_preload);
+ else
+ buf = alloc_printf("LD_PRELOAD=%s", afl_preload);
+
+ setenv("QEMU_SET_ENV", buf, 1);
+
+ ck_free(buf);
+
+ } else {
+
setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
@@ -889,6 +914,8 @@ static void set_up_environment(void) {
}
+}
+
/* Setup signal handlers, duh. */
static void setup_signal_handlers(void) {
@@ -1026,7 +1053,7 @@ static void read_bitmap(u8* fname) {
int main(int argc, char** argv) {
s32 opt;
- u8 mem_limit_given = 0, timeout_given = 0, qemu_mode = 0, unicorn_mode = 0,
+ u8 mem_limit_given = 0, timeout_given = 0, unicorn_mode = 0,
use_wine = 0;
char** use_argv;

AFL_PRELOAD -> QEMU_SET_ENV for afl-fuzz,afl-showmap,afl-analyze,afl-tmin