added afl-fuzz -I cmdline option
MODIFY
docs/ChangeLog
docs/ChangeLog
@@ -21,10 +21,11 @@ Version ++2.54d (dev):
- custom mutator library is now a standard mutator, to exclusivly use it
add AFL_CUSTOM_MUTATOR_ONLY (that will trigger the previous behaviour)
- new library qemu_mode/unsigaction which filters sigaction events
+ - afl-fuzz: new command line option -I to execute a command on a new crash
- no more unlinking the input file, this way the input file can also be a
FIFO or disk partition
- setting LLVM_CONFIG for llvm_mode will now again switch to the selected
- llvm version. If you setup is correct.
+ llvm version. If your setup is correct.
- fuzzing strategy yields for custom mutator were missing from the UI, added them :)
- added "make tests" which will perform checks to see that all functionality
is working as expected. this is currently the starting point, its not complete :)

MODIFY
include/afl-fuzz.h
include/afl-fuzz.h
@@ -250,6 +250,7 @@ extern u8 *in_dir, /* Input directory with test cases */
*file_extension, /* File extension */
*orig_cmdline, /* Original command line */
*doc_path, /* Path to documentation dir */
+ *infoexec, /* Command to execute on a new crash */
*out_file; /* File to fuzz, if any */
extern u32 exec_tmout; /* Configurable exec timeout (ms) */

MODIFY
src/afl-fuzz-bitmap.c
src/afl-fuzz-bitmap.c
@@ -684,6 +684,10 @@ u8 save_if_interesting(char** argv, void* mem, u32 len, u8 fault) {
++unique_crashes;
+ if (infoexec) // if the user wants to be informed on new crashes - do that
+ if (system(infoexec) == -1)
+ hnb += 0; // we dont care if system errors, but we dont want a compiler warning either
+
last_crash_time = get_cur_time();
last_crash_execs = total_execs;

MODIFY
src/afl-fuzz-globals.c
src/afl-fuzz-globals.c
@@ -74,6 +74,7 @@ u8 *in_dir, /* Input directory with test cases */
*file_extension, /* File extension */
*orig_cmdline; /* Original command line */
u8 *doc_path, /* Path to documentation dir */
+ *infoexec, /* Command to execute on a new crash */
*out_file; /* File to fuzz, if any */
u32 exec_tmout = EXEC_TIMEOUT; /* Configurable exec timeout (ms) */

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -76,6 +76,7 @@ static void usage(u8* argv0) {
"Other stuff:\n"
" -T text - text banner to show on the screen\n"
" -M / -S id - distributed mode (see parallel_fuzzing.txt)\n"
+ " -I command - execute this command/script when a new crash is found\n"
" -B bitmap.txt - mutate a specific test case, use the out/fuzz_bitmap "
"file\n"
" -C - crash exploration mode (the peruvian rabbit thing)\n"
@@ -133,10 +134,15 @@ int main(int argc, char** argv) {
init_seed = tv.tv_sec ^ tv.tv_usec ^ getpid();
while ((opt = getopt(argc, argv,
- "+i:o:f:m:t:T:dnCB:S:M:x:QUWe:p:s:V:E:L:h")) > 0)
+ "+i:I:o:f:m:t:T:dnCB:S:M:x:QUWe:p:s:V:E:L:h")) > 0)
switch (opt) {
+ case 'I':
+
+ infoexec = optarg;
+ break;
+
case 's': {
init_seed = strtoul(optarg, 0L, 10);

MODIFY
test/test.sh
test/test.sh
@@ -238,6 +238,7 @@ test -e ../afl-qemu-trace && {
} || $ECHO "$RED[-] gcc compilation of test targets failed - what is going on??"
$ECHO "$YELLOW[?] we need a test case for qemu_mode persistent mode"
+ $ECHO "$YELLOW[?] we need a test case for qemu_mode unsigaction library"
# This works but there are already problems with persistent (e.g. stability)
#$ECHO "$GREY[*] running afl-fuzz for persistent qemu_mode, this will take approx 10 seconds"
#{

added afl-fuzz -I cmdline option