fixed persistent mode shared mem fuzzing
MODIFY
examples/persistent_demo/Makefile
examples/persistent_demo/Makefile
all:
afl-clang-fast -o persistent_demo persistent_demo.c
afl-clang-fast -o persistent_demo_new persistent_demo_new.c
+ afl-clang-fast -o test-instr test-instr.c
+
+document:
+ afl-clang-fast -D_AFL_DOCUMENT_MUTATIONS -o test-instr test-instr.c
clean:
- rm -f persistent_demo persistent_demo_new
+ rm -f persistent_demo persistent_demo_new test-instr

MODIFY
examples/persistent_demo/persistent_demo.c
examples/persistent_demo/persistent_demo.c
@@ -41,6 +41,7 @@ int main(int argc, char **argv) {
terminate normally. This limits the impact of accidental memory leaks
and similar hiccups. */
+ __AFL_INIT();
while (__AFL_LOOP(1000)) {
/*** PLACEHOLDER CODE ***/

MODIFY
examples/persistent_demo/persistent_demo_new.c
examples/persistent_demo/persistent_demo_new.c
@@ -42,6 +42,7 @@ int main(int argc, char **argv) {
terminate normally. This limits the impact of accidental memory leaks
and similar hiccups. */
+ __AFL_INIT();
buf = __AFL_FUZZ_TESTCASE_BUF;
while (__AFL_LOOP(1000)) {

ADD
examples/persistent_demo/test-instr.c
+/*
+ american fuzzy lop++ - a trivial program to test the build
+ --------------------------------------------------------
+ Originally written by Michal Zalewski
+ Copyright 2014 Google Inc. All rights reserved.
+ Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at:
+ http://www.apache.org/licenses/LICENSE-2.0
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+__AFL_FUZZ_INIT();
+
+int main(int argc, char **argv) {
+
+ __AFL_INIT();
+ unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;
+
+ while(__AFL_LOOP(2147483647)) {
+
+ unsigned int len = __AFL_FUZZ_TESTCASE_LEN;
+
+#ifdef _AFL_DOCUMENT_MUTATIONS
+ static unsigned int counter = 0;
+ char fn[32];
+ sprintf(fn, "%09u:test-instr", counter);
+ int fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+ if (fd_doc >= 0) {
+ if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) {
+ fprintf(stderr, "write of mutation file failed: %s\n", fn);
+ unlink(fn);
+ }
+ close(fd_doc);
+ }
+ counter++;
+#endif
+
+ if (!len) continue;
+
+ if (buf[0] == '0')
+ printf("Looks like a zero to me!\n");
+ else if (buf[0] == '1')
+ printf("Pretty sure that is a one!\n");
+ else
+ printf("Neither one or zero? How quaint!\n");
+ }
+
+ return 0;
+
+}
+

MODIFY
llvm_mode/GNUmakefile
llvm_mode/GNUmakefile
@@ -354,16 +354,21 @@ endif
../cmplog-instructions-pass.so: cmplog-instructions-pass.cc afl-llvm-common.o | test_deps
$(CXX) $(CLANG_CFL) -shared $< -o $@ $(CLANG_LFL) afl-llvm-common.o
+document:
+ $(CLANG_BIN) -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS) -Wno-unused-result -fPIC -c afl-llvm-rt.o.c -o ../afl-llvm-rt.o
+ @$(CLANG_BIN) -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS) -Wno-unused-result -m32 -fPIC -c afl-llvm-rt.o.c -o ../afl-llvm-rt-32.o 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
+ @$(CLANG_BIN) -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS) -Wno-unused-result -m64 -fPIC -c afl-llvm-rt.o.c -o ../afl-llvm-rt-64.o 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
+
../afl-llvm-rt.o: afl-llvm-rt.o.c | test_deps
$(CLANG_BIN) $(CFLAGS) -Wno-unused-result -fPIC -c $< -o $@
../afl-llvm-rt-32.o: afl-llvm-rt.o.c | test_deps
@printf "[*] Building 32-bit variant of the runtime (-m32)... "
- @$(CC_SAVE) $(CFLAGS) -Wno-unused-result -m32 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
+ @$(CLANG_BIN) $(CFLAGS) -Wno-unused-result -m32 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
../afl-llvm-rt-64.o: afl-llvm-rt.o.c | test_deps
@printf "[*] Building 64-bit variant of the runtime (-m64)... "
- @$(CC_SAVE) $(CFLAGS) -Wno-unused-result -m64 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
+ @$(CLANG_BIN) $(CFLAGS) -Wno-unused-result -m64 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
test_build: $(PROGS)
@echo "[*] Testing the CC wrapper and instrumentation output..."

MODIFY
llvm_mode/afl-llvm-rt.o.c
llvm_mode/afl-llvm-rt.o.c
@@ -78,6 +78,8 @@ u8 *__afl_area_ptr = __afl_area_initial;
u8 *__afl_dictionary;
u8 *__afl_fuzz_ptr;
u32 __afl_fuzz_len;
+u32 __afl_fuzz_len_dummy;
+u32 *__afl_fuzz_len_shmem = &__afl_fuzz_len_dummy;
u32 __afl_final_loc;
u32 __afl_map_size = MAP_SIZE;
@@ -164,6 +166,8 @@ static void __afl_map_shm_fuzz() {
}
+ __afl_fuzz_len_shmem = (u32*) mmap(NULL, sizeof(int), PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+
}
/* SHM setup. */
@@ -443,9 +447,26 @@ static void __afl_start_snapshots(void) {
}
- __afl_fuzz_len = (was_killed >> 8);
+ *__afl_fuzz_len_shmem = __afl_fuzz_len = (was_killed >> 8);
was_killed = (was_killed & 0xff);
+#ifdef _AFL_DOCUMENT_MUTATIONS
+ if (__afl_fuzz_ptr) {
+ static uint32_t counter = 0;
+ char fn[32];
+ sprintf(fn, "%09u:forkserver", counter);
+ s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+ if (fd_doc >= 0) {
+ if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) {
+ fprintf(stderr, "write of mutation file failed: %s\n", fn);
+ unlink(fn);
+ }
+ close(fd_doc);
+ }
+ counter++;
+ }
+#endif
+
/* If we stopped the child in persistent mode, but there was a race
condition and afl-fuzz already issued SIGKILL, write off the old
process. */
@@ -620,9 +641,26 @@ static void __afl_start_forkserver(void) {
}
- __afl_fuzz_len = (was_killed >> 8);
+ *__afl_fuzz_len_shmem = __afl_fuzz_len = (was_killed >> 8);
was_killed = (was_killed & 0xff);
+#ifdef _AFL_DOCUMENT_MUTATIONS
+ if (__afl_fuzz_ptr) {
+ static uint32_t counter = 0;
+ char fn[32];
+ sprintf(fn, "%09u:forkserver", counter);
+ s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+ if (fd_doc >= 0) {
+ if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) {
+ fprintf(stderr, "write of mutation file failed: %s\n", fn);
+ unlink(fn);
+ }
+ close(fd_doc);
+ }
+ counter++;
+ }
+#endif
+
/* If we stopped the child in persistent mode, but there was a race
condition and afl-fuzz already issued SIGKILL, write off the old
process. */
@@ -719,6 +757,8 @@ int __afl_persistent_loop(unsigned int max_cnt) {
raise(SIGSTOP);
+ __afl_fuzz_len = *__afl_fuzz_len_shmem;
+
__afl_area_ptr[0] = 1;
memset(__afl_prev_loc, 0, NGRAM_SIZE_MAX * sizeof(PREV_LOC_T));

fixed persistent mode shared mem fuzzing