switch shmem_len to the map
MODIFY
include/forkserver.h
include/forkserver.h
@@ -75,13 +75,13 @@ typedef struct afl_forkserver {
u8 use_shdmen_fuzz; /* use shared mem for test cases */
- u8 support_shdmen_fuzz; /* set by afl-fuzz */
+ u8 support_shmem_fuzz; /* set by afl-fuzz */
u8 use_fauxsrv; /* Fauxsrv for non-forking targets? */
u8 qemu_mode; /* if running in qemu mode or not */
- u32 shmem_fuzz_len; /* length of the fuzzing test case */
+ u32 *shmem_fuzz_len; /* length of the fuzzing test case */
u8 *shmem_fuzz; /* allocated memory for fuzzing */

MODIFY
llvm_mode/afl-llvm-rt.o.c
llvm_mode/afl-llvm-rt.o.c
@@ -166,8 +166,7 @@ static void __afl_map_shm_fuzz() {
}
- __afl_fuzz_len_shmem = (u32 *)mmap(NULL, sizeof(int), PROT_READ | PROT_WRITE,
- MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+ __afl_fuzz_len_shmem = (u32 *)(__afl_fuzz_ptr + MAX_FILE);
}
@@ -448,9 +447,6 @@ static void __afl_start_snapshots(void) {
}
- *__afl_fuzz_len_shmem = __afl_fuzz_len = (was_killed >> 8);
- was_killed = (was_killed & 0xff);
-
#ifdef _AFL_DOCUMENT_MUTATIONS
if (__afl_fuzz_ptr) {
@@ -651,9 +647,6 @@ static void __afl_start_forkserver(void) {
}
- *__afl_fuzz_len_shmem = __afl_fuzz_len = (was_killed >> 8);
- was_killed = (was_killed & 0xff);
-
#ifdef _AFL_DOCUMENT_MUTATIONS
if (__afl_fuzz_ptr) {

MODIFY
qemu_mode/patches/afl-qemu-common.h
qemu_mode/patches/afl-qemu-common.h
@@ -84,7 +84,7 @@ extern uint64_t persistent_saved_gpr[AFL_REGS_NUM];
extern int persisent_retaddr_offset;
extern u8 * shared_buf;
-extern u32 shared_buf_len;
+extern u32 *shared_buf_len;
extern u8 sharedmem_fuzzing;
extern afl_persistent_hook_fn afl_persistent_hook_ptr;

MODIFY
qemu_mode/patches/afl-qemu-cpu-inl.h
qemu_mode/patches/afl-qemu-cpu-inl.h
@@ -84,7 +84,7 @@ uint64_t persistent_saved_gpr[AFL_REGS_NUM];
int persisent_retaddr_offset;
u8 * shared_buf;
-u32 shared_buf_len;
+u32 *shared_buf_len;
u8 sharedmem_fuzzing;
afl_persistent_hook_fn afl_persistent_hook_ptr;
@@ -148,6 +148,7 @@ static void afl_map_shm_fuzz(void) {
u32 shm_id = atoi(id_str);
shared_buf = shmat(shm_id, NULL, 0);
+ shared_buf_len = (u32 *)(shared_buf + MAX_FILE);
/* Whooooops. */
@@ -377,9 +378,6 @@ void afl_forkserver(CPUState *cpu) {
if (read(FORKSRV_FD, &was_killed, 4) != 4) exit(2);
- shared_buf_len = (was_killed >> 8);
- was_killed = (was_killed & 0xff);
-
/* If we stopped the child in persistent mode, but there was a race
condition and afl-fuzz already issued SIGKILL, write off the old
process. */

MODIFY
qemu_mode/patches/afl-qemu-cpu-translate-inl.h
qemu_mode/patches/afl-qemu-cpu-translate-inl.h
@@ -162,7 +162,7 @@ static void log_x86_sp_content(void) {
static void callback_to_persistent_hook(void) {
afl_persistent_hook_ptr(persistent_saved_gpr, guest_base, shared_buf,
- shared_buf_len);
+ *shared_buf_len);
}

MODIFY
src/afl-forkserver.c
src/afl-forkserver.c
@@ -506,7 +506,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
if ((status & FS_OPT_SHDMEM_FUZZ) == FS_OPT_SHDMEM_FUZZ) {
- if (fsrv->support_shdmen_fuzz) {
+ if (fsrv->support_shmem_fuzz) {
fsrv->use_shdmen_fuzz = 1;
if (!be_quiet) { ACTF("Using SHARED MEMORY FUZZING feature."); }
@@ -832,7 +832,7 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
if (fsrv->shmem_fuzz) {
memcpy(fsrv->shmem_fuzz, buf, len);
- fsrv->shmem_fuzz_len = len;
+ *fsrv->shmem_fuzz_len = len;
} else {
@@ -894,8 +894,6 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
MEM_BARRIER();
- if (fsrv->shmem_fuzz_len) write_value += (fsrv->shmem_fuzz_len << 8);
-
/* we have the fork server (or faux server) up and running
First, tell it if the previous run timed out. */

MODIFY
src/afl-fuzz-init.c
src/afl-fuzz-init.c
@@ -1960,7 +1960,8 @@ void setup_testcase_shmem(afl_state_t *afl) {
afl->shm_fuzz = ck_alloc(sizeof(sharedmem_t));
// we need to set the non-instrumented mode to not overwrite the SHM_ENV_VAR
- if ((afl->fsrv.shmem_fuzz = afl_shm_init(afl->shm_fuzz, MAX_FILE, 1))) {
+ if ((afl->fsrv.shmem_fuzz =
+ afl_shm_init(afl->shm_fuzz, MAX_FILE + sizeof(int), 1))) {
#ifdef USEMMAP
setenv(SHM_FUZZ_ENV_VAR, afl->shm_fuzz->g_shm_file_path, 1);
@@ -1970,7 +1971,8 @@ void setup_testcase_shmem(afl_state_t *afl) {
setenv(SHM_FUZZ_ENV_VAR, shm_str, 1);
ck_free(shm_str);
#endif
- afl->fsrv.support_shdmen_fuzz = 1;
+ afl->fsrv.support_shmem_fuzz = 1;
+ afl->fsrv.shmem_fuzz_len = (u32 *)(afl->fsrv.shmem_fuzz + MAX_FILE);
} else {

MODIFY
src/afl-fuzz-run.c
src/afl-fuzz-run.c
@@ -232,12 +232,12 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
afl->afl_env.afl_debug_child_output);
- if (afl->fsrv.support_shdmen_fuzz && !afl->fsrv.use_shdmen_fuzz) {
+ if (afl->fsrv.support_shmem_fuzz && !afl->fsrv.use_shdmen_fuzz) {
afl_shm_deinit(afl->shm_fuzz);
ck_free(afl->shm_fuzz);
afl->shm_fuzz = NULL;
- afl->fsrv.support_shdmen_fuzz = 0;
+ afl->fsrv.support_shmem_fuzz = 0;
afl->fsrv.shmem_fuzz = NULL;
}

MODIFY
src/afl-fuzz-stats.c
src/afl-fuzz-stats.c
@@ -138,6 +138,20 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
afl->orig_cmdline);
/* ignore errors */
+ if (afl->debug) {
+
+ fprintf(f, "virgin_bytes :");
+ for (uint32_t i = 0; i < afl->fsrv.map_size; i++)
+ if (afl->virgin_bits[i] != 0xff)
+ fprintf(f, " %d[%02x]", i, afl->virgin_bits[i]);
+ fprintf(f, "\n");
+ fprintf(f, "var_bytes :");
+ for (uint32_t i = 0; i < afl->fsrv.map_size; i++)
+ if (afl->var_bytes[i]) fprintf(f, " %d", i);
+ fprintf(f, "\n");
+
+ }
+
fclose(f);
}

switch shmem_len to the map