shm debug and fixes
MODIFY
examples/aflpp_driver/GNUmakefile
examples/aflpp_driver/GNUmakefile
@@ -7,7 +7,7 @@ ifneq "" "$(LLVM_BINDIR)"
LLVM_BINDIR := $(LLVM_BINDIR)/
endif
-FLAGS=-O3 -funroll-loops
+FLAGS=-O2 -funroll-loops
all: libAFLDriver.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so
@@ -21,7 +21,6 @@ debug:
$(LLVM_BINDIR)clang++ -I../../include -D_DEBUG=\"1\" $(FLAGS) -stdlib=libc++ -funroll-loops -std=c++11 -c aflpp_driver.cpp
ar ru libAFLDriver.a aflpp_driver.o
-
aflpp_qemu_driver.o: aflpp_qemu_driver.c
$(LLVM_BINDIR)clang $(FLAGS) -O0 -funroll-loops -c aflpp_qemu_driver.c
@@ -35,7 +34,7 @@ aflpp_qemu_driver_hook.o: aflpp_qemu_driver_hook.c
$(LLVM_BINDIR)clang -fPIC $(FLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c
test: libAFLDriver.a aflpp_driver_test.cpp
- afl-clang-fast++ -Wl,--allow-multiple-definition -stdlib=libc++ -funroll-loops -std=c++11 -o aflpp_driver_test aflpp_driver_test.cpp libAFLDriver.a
+ afl-clang-fast++ -I../../include -Wl,--allow-multiple-definition -stdlib=libc++ -funroll-loops -std=c++11 -o aflpp_driver_test aflpp_driver_test.cpp libAFLDriver.a
clean:
rm -f *.o libAFLDriver*.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so *~ core aflpp_driver_test

MODIFY
examples/aflpp_driver/aflpp_driver.cpp
examples/aflpp_driver/aflpp_driver.cpp
@@ -230,6 +230,8 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
}
int main(int argc, char **argv) {
+ unsigned char in_buf[1024000];
+ size_t in_buf_len;
Printf(
"======================= INFO =========================\n"
"This binary is built for AFL-fuzz.\n"
@@ -278,10 +280,16 @@ int main(int argc, char **argv) {
while (__afl_persistent_loop(N)) {
#ifdef _DEBUG
fprintf(stderr, "CLIENT crc: %08x len: %u\n", hash32(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705), *__afl_fuzz_len);
+ fprintf(stderr, "RECV:");
+ for (int i = 0; i < *__afl_fuzz_len; i++)
+ fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
+ fprintf(stderr,"\n");
#endif
if (*__afl_fuzz_len) {
num_runs++;
- LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
+ in_buf_len = *__afl_fuzz_len;
+ memcpy(in_buf, __afl_fuzz_ptr, in_buf_len);
+ LLVMFuzzerTestOneInput(in_buf, in_buf_len);
}
}
Printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);

MODIFY
examples/aflpp_driver/aflpp_driver_test.cpp
examples/aflpp_driver/aflpp_driver_test.cpp
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
+#include "hash.h"
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
- fprintf(stderr, "Received size %lu\n", Size);
+ fprintf(stderr, "FUNC crc: %08x len: %lu\n", hash32(Data, Size, 0xa5b35705), Size);
- if (Size < 4)
+ if (Size < 5)
return 0;
if (Data[0] == 'F')
if (Data[1] == 'A')
if (Data[2] == '$')
if (Data[3] == '$')
+ if (Data[4] == '$')
abort();
return 0;

MODIFY
llvm_mode/afl-llvm-rt.o.c
llvm_mode/afl-llvm-rt.o.c
@@ -139,7 +139,7 @@ static void __afl_map_shm_fuzz() {
}
- map = (u8 *)mmap(0, MAX_FILE, PROT_READ, MAP_SHARED, shm_fd, 0);
+ map = (u8 *)mmap(0, MAX_FILE + sizeof(u32), PROT_READ, MAP_SHARED, shm_fd, 0);
#else
u32 shm_id = atoi(id_str);
@@ -157,7 +157,7 @@ static void __afl_map_shm_fuzz() {
}
__afl_fuzz_len = (u32 *)map;
- __afl_fuzz_ptr = (u8 *)(map + sizeof(u32));
+ __afl_fuzz_ptr = map + sizeof(u32);
if (getenv("AFL_DEBUG")) {

MODIFY
src/afl-forkserver.c
src/afl-forkserver.c
#include "common.h"
#include "list.h"
#include "forkserver.h"
+#include "hash.h"
#include <stdio.h>
#include <unistd.h>
@@ -837,8 +838,17 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
*fsrv->shmem_fuzz_len = len;
memcpy(fsrv->shmem_fuzz, buf, len);
- // fprintf(stderr, "FS crc: %08x len: %u\n", hash32(fsrv->shmem_fuzz,
- // *fsrv->shmem_fuzz_len, 0xa5b35705), *fsrv->shmem_fuzz_len);
+#ifdef _DEBUG
+ fprintf(stderr, "FS crc: %08x len: %u\n", hash32(fsrv->shmem_fuzz,
+ *fsrv->shmem_fuzz_len, 0xa5b35705), *fsrv->shmem_fuzz_len);
+ fprintf(stderr, "SHM :");
+ for (int i = 0; i < *fsrv->shmem_fuzz_len; i++)
+ fprintf(stderr, "%02x", fsrv->shmem_fuzz[i]);
+ fprintf(stderr, "\nORIG:");
+ for (int i = 0; i < *fsrv->shmem_fuzz_len; i++)
+ fprintf(stderr, "%02x", buf[i]);
+ fprintf(stderr, "\n");
+#endif
} else {

shm debug and fixes