now really fix -n
MODIFY
src/afl-forkserver.c
src/afl-forkserver.c
@@ -116,7 +116,7 @@ void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from) {
fsrv_to->use_fauxsrv = 0;
fsrv_to->last_run_timed_out = 0;
- fsrv_to->init_child_func = fsrv_exec_child;
+ fsrv_to->init_child_func = from->init_child_func;
// Note: do not copy ->add_extra_func
list_append(&fsrv_list, fsrv_to);
@@ -220,7 +220,15 @@ static void afl_fauxsrv_execv(afl_forkserver_t *fsrv, char **argv) {
}
void (*old_sigchld_handler)(int) = signal(SIGCHLD, SIG_DFL);
-
+#if 0
+ WARNF("targetpath=%s", fsrv->target_path);
+ if (argv) {
+ for (char *p = argv[0]; p; ++p) {
+ WARNF(" %s", p);
+ }
+ }
+ WARNF("\n");
+#endif
while (1) {
uint32_t was_killed;
@@ -272,7 +280,8 @@ static void afl_fauxsrv_execv(afl_forkserver_t *fsrv, char **argv) {
*(u32 *)fsrv->trace_bits = EXEC_FAIL_SIG;
- PFATAL("Execv failed in fauxserver.");
+ WARNF("Execv failed in fauxserver.");
+ break;
}
@@ -286,13 +295,13 @@ static void afl_fauxsrv_execv(afl_forkserver_t *fsrv, char **argv) {
if (waitpid(child_pid, &status, 0) < 0) {
// Zombie Child could not be collected. Scary!
- PFATAL("Fauxserver could not determin child's exit code. ");
+ WARNF("Fauxserver could not determine child's exit code. ");
}
/* Relay wait status to AFL pipe, then loop back. */
- if (write(FORKSRV_FD + 1, &status, 4) != 4) { exit(0); }
+ if (write(FORKSRV_FD + 1, &status, 4) != 4) { exit(1); }
}
@@ -330,7 +339,7 @@ static void report_error_and_exit(int error) {
"memory failed.");
break;
default:
- FATAL("unknown error code %u from fuzzing target!", error);
+ FATAL("unknown error code %d from fuzzing target!", error);
}
@@ -355,7 +364,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
if (fsrv->use_fauxsrv) {
- /* TODO: Come up with sone nice way to initialize this all */
+ /* TODO: Come up with some nice way to initialize this all */
if (fsrv->init_child_func != fsrv_exec_child) {
@@ -520,7 +529,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
*(u32 *)fsrv->trace_bits = EXEC_FAIL_SIG;
fprintf(stderr, "Error: execv to target failed\n");
- exit(0);
+ exit(1);
}

MODIFY
src/afl-fuzz-init.c
src/afl-fuzz-init.c
@@ -2497,7 +2497,7 @@ void check_binary(afl_state_t *afl, u8 *fname) {
}
- if (afl->afl_env.afl_skip_bin_check || afl->use_wine || afl->unicorn_mode) {
+ if (afl->afl_env.afl_skip_bin_check || afl->use_wine || afl->unicorn_mode || afl->non_instrumented_mode) {
return;

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -1358,7 +1358,7 @@ int main(int argc, char **argv_orig, char **envp) {
}
- if (!afl->non_instrumented_mode) check_binary(afl, argv[optind]);
+ check_binary(afl, argv[optind]);
if (afl->shmem_testcase_mode) { setup_testcase_shmem(afl); }

now really fix -n