split up __afl_manual_init, added internal AFL_DISABLE_LLVM_INSTRUMENTATION, skipping ctor+ifunc functions for all llvm, code-format
MODIFY
TODO.md
TODO.md
- AFL_MAP_SIZE for qemu_mode and unicorn_mode
- CPU affinity for many cores? There seems to be an issue > 96 cores
+ - feature for afl-showmap to generate the coverage for all queue entries
+ - afl-plot to support multiple plot_data
## Further down the road

MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -29,9 +29,9 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
- added neverzero counting to trace-pc/pcgard
- fixes for laf-intel float splitting (thanks to mark-griffin for
reporting)
+ - skipping ctors and ifuncs for instrumentation
- LTO: switch default to the dynamic memory map, set AFL_LLVM_MAP_ADDR
for a fixed map address (eg. 0x10000)
- - LTO: skipping ctors and ifuncs in fix map address instrumentation
- LTO: autodictionary mode is a default
- LTO: instrim instrumentation disabled, only classic support used
as it is always better

MODIFY
examples/aflpp_driver/aflpp_driver.c
examples/aflpp_driver/aflpp_driver.c
@@ -109,7 +109,6 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
int __afl_sharedmem_fuzzing = 1;
extern unsigned int * __afl_fuzz_len;
extern unsigned char *__afl_fuzz_ptr;
-extern unsigned char *__afl_area_ptr;
// extern struct cmp_map *__afl_cmp_map;
// libFuzzer interface is thin, so we don't include any libFuzzer headers.
@@ -248,28 +247,8 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
}
-__attribute__((constructor(1))) void __afl_protect(void) {
-
- setenv("__AFL_DEFER_FORKSRV", "1", 1);
- __afl_area_ptr = (unsigned char *)mmap(
- (void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
- MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
- if ((uint64_t)__afl_area_ptr == -1)
- __afl_area_ptr = (unsigned char *)mmap((void *)0x10000, MAX_DUMMY_SIZE,
- PROT_READ | PROT_WRITE,
- MAP_SHARED | MAP_ANONYMOUS, -1, 0);
- if ((uint64_t)__afl_area_ptr == -1)
- __afl_area_ptr =
- (unsigned char *)mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
- MAP_SHARED | MAP_ANONYMOUS, -1, 0);
- // __afl_cmp_map = (struct cmp_map *)__afl_area_ptr;
-
-}
-
int main(int argc, char **argv) {
- fprintf(stderr, "dummy map is at %p\n", __afl_area_ptr);
-
printf(
"======================= INFO =========================\n"
"This binary is built for afl++.\n"
@@ -307,8 +286,6 @@ int main(int argc, char **argv) {
else if (argc > 1) {
__afl_sharedmem_fuzzing = 0;
- munmap(__afl_area_ptr, MAX_DUMMY_SIZE); // we need to free 0x10000
- __afl_area_ptr = NULL;
__afl_manual_init();
return ExecuteFilesOnyByOne(argc, argv);
@@ -317,8 +294,6 @@ int main(int argc, char **argv) {
assert(N > 0);
// if (!getenv("AFL_DRIVER_DONT_DEFER"))
- munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
- __afl_area_ptr = NULL;
__afl_manual_init();
// Call LLVMFuzzerTestOneInput here so that coverage caused by initialization

MODIFY
examples/aflpp_driver/aflpp_driver_test.c
examples/aflpp_driver/aflpp_driver_test.c
#include "hash.h"
+void __attribute__((noinline)) crashme(const uint8_t *Data, size_t Size) {
+
+ if (Data[0] == 'F')
+ if (Data[1] == 'A')
+ if (Data[2] == '$')
+ if (Data[3] == '$')
+ if (Data[4] == '$') abort();
+
+}
+
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
fprintf(stderr, "FUNC crc: %016llx len: %lu\n",
@@ -13,11 +23,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
if (Size < 5) return 0;
- if (Data[0] == 'F')
- if (Data[1] == 'A')
- if (Data[2] == '$')
- if (Data[3] == '$')
- if (Data[4] == '$') abort();
+ crashme(Data, Size);
return 0;

MODIFY
llvm_mode/LLVMInsTrim.so.cc
llvm_mode/LLVMInsTrim.so.cc
@@ -256,6 +256,8 @@ struct InsTrim : public ModulePass {
u64 total_rs = 0;
u64 total_hs = 0;
+ scanForDangerousFunctions(&M);
+
for (Function &F : M) {
if (debug) {

MODIFY
llvm_mode/afl-llvm-common.cc
llvm_mode/afl-llvm-common.cc
@@ -67,8 +67,11 @@ bool isIgnoreFunction(const llvm::Function *F) {
"__libc_csu",
"__asan",
"__msan",
+ "__cmplog",
+ "__sancov",
"msan.",
"LLVMFuzzer",
+ "__decide_deferred",
"maybe_duplicate_stderr",
"discard_output",
"close_stdout",
@@ -253,21 +256,93 @@ void initInstrumentList() {
}
+void scanForDangerousFunctions(llvm::Module *M) {
+
+ if (!M) return;
+
+ for (GlobalIFunc &IF : M->ifuncs()) {
+
+ StringRef ifunc_name = IF.getName();
+ Constant *r = IF.getResolver();
+ StringRef r_name = cast<Function>(r->getOperand(0))->getName();
+ if (!be_quiet)
+ fprintf(stderr,
+ "Info: Found an ifunc with name %s that points to resolver "
+ "function %s, we will not instrument this, putting it into the "
+ "block list.\n",
+ ifunc_name.str().c_str(), r_name.str().c_str());
+ denyListFunctions.push_back(r_name.str());
+
+ }
+
+ GlobalVariable *GV = M->getNamedGlobal("llvm.global_ctors");
+ if (GV && !GV->isDeclaration() && !GV->hasLocalLinkage()) {
+
+ ConstantArray *InitList = dyn_cast<ConstantArray>(GV->getInitializer());
+
+ if (InitList) {
+
+ for (unsigned i = 0, e = InitList->getNumOperands(); i != e; ++i) {
+
+ if (ConstantStruct *CS =
+ dyn_cast<ConstantStruct>(InitList->getOperand(i))) {
+
+ if (CS->getNumOperands() >= 2) {
+
+ if (CS->getOperand(1)->isNullValue())
+ break; // Found a null terminator, stop here.
+
+ ConstantInt *CI = dyn_cast<ConstantInt>(CS->getOperand(0));
+ int Priority = CI ? CI->getSExtValue() : 0;
+
+ Constant *FP = CS->getOperand(1);
+ if (ConstantExpr *CE = dyn_cast<ConstantExpr>(FP))
+ if (CE->isCast()) FP = CE->getOperand(0);
+ if (Function *F = dyn_cast<Function>(FP)) {
+
+ if (!F->isDeclaration() &&
+ strncmp(F->getName().str().c_str(), "__afl", 5) != 0) {
+
+ if (!be_quiet)
+ fprintf(stderr,
+ "Info: Found constructor function %s with prio "
+ "%u, we will not instrument this, putting it into a "
+ "block list.\n",
+ F->getName().str().c_str(), Priority);
+ denyListFunctions.push_back(F->getName().str());
+
+ }
+
+ }
+
+ }
+
+ }
+
+ }
+
+ }
+
+ }
+
+}
+
bool isInInstrumentList(llvm::Function *F) {
+ bool return_default = true;
+
// is this a function with code? If it is external we dont instrument it
// anyway and cant be in the the instrument file list. Or if it is ignored.
if (!F->size() || isIgnoreFunction(F)) return false;
- // if we do not have a the instrument file list return true
- if (!allowListFiles.empty() || !allowListFunctions.empty()) {
+ if (!denyListFiles.empty() || !denyListFunctions.empty()) {
- if (!allowListFunctions.empty()) {
+ if (!denyListFunctions.empty()) {
std::string instFunction = F->getName().str();
- for (std::list<std::string>::iterator it = allowListFunctions.begin();
- it != allowListFunctions.end(); ++it) {
+ for (std::list<std::string>::iterator it = denyListFunctions.begin();
+ it != denyListFunctions.end(); ++it) {
/* We don't check for filename equality here because
* filenames might actually be full paths. Instead we
@@ -281,10 +356,10 @@ bool isInInstrumentList(llvm::Function *F) {
if (debug)
SAYF(cMGN "[D] " cRST
- "Function %s is in the allow function list, "
- "instrumenting ... \n",
+ "Function %s is in the deny function list, "
+ "not instrumenting ... \n",
instFunction.c_str());
- return true;
+ return false;
}
@@ -294,7 +369,7 @@ bool isInInstrumentList(llvm::Function *F) {
}
- if (!allowListFiles.empty()) {
+ if (!denyListFiles.empty()) {
// let's try to get the filename for the function
auto bb = &F->getEntryBlock();
@@ -328,8 +403,8 @@ bool isInInstrumentList(llvm::Function *F) {
/* Continue only if we know where we actually are */
if (!instFilename.str().empty()) {
- for (std::list<std::string>::iterator it = allowListFiles.begin();
- it != allowListFiles.end(); ++it) {
+ for (std::list<std::string>::iterator it = denyListFiles.begin();
+ it != denyListFiles.end(); ++it) {
/* We don't check for filename equality here because
* filenames might actually be full paths. Instead we
@@ -344,12 +419,10 @@ bool isInInstrumentList(llvm::Function *F) {
if (debug)
SAYF(cMGN "[D] " cRST
- "Function %s is in the allowlist (%s), "
+ "Function %s is in the denylist (%s), not "
"instrumenting ... \n",
F->getName().str().c_str(), instFilename.str().c_str());
- return true;
-
- }
+ return false;
}
@@ -373,8 +446,8 @@ bool isInInstrumentList(llvm::Function *F) {
/* Continue only if we know where we actually are */
if (!instFilename.str().empty()) {
- for (std::list<std::string>::iterator it = allowListFiles.begin();
- it != allowListFiles.end(); ++it) {
+ for (std::list<std::string>::iterator it = denyListFiles.begin();
+ it != denyListFiles.end(); ++it) {
/* We don't check for filename equality here because
* filenames might actually be full paths. Instead we
@@ -387,9 +460,7 @@ bool isInInstrumentList(llvm::Function *F) {
if (fnmatch(("*" + *it).c_str(), instFilename.str().c_str(), 0) ==
0) {
- return true;
-
- }
+ return false;
}
@@ -408,25 +479,27 @@ bool isInInstrumentList(llvm::Function *F) {
// in the the instrument file list
if (!be_quiet)
WARNF(
- "No debug information found for function %s, will not be "
+ "No debug information found for function %s, will be "
"instrumented (recompile with -g -O[1-3]).",
F->getName().str().c_str());
- return false;
}
- return false;
+ }
}
- if (!denyListFiles.empty() || !denyListFunctions.empty()) {
+ // if we do not have a the instrument file list return true
+ if (!allowListFiles.empty() || !allowListFunctions.empty()) {
- if (!denyListFunctions.empty()) {
+ return_default = false;
+
+ if (!allowListFunctions.empty()) {
std::string instFunction = F->getName().str();
- for (std::list<std::string>::iterator it = denyListFunctions.begin();
- it != denyListFunctions.end(); ++it) {
+ for (std::list<std::string>::iterator it = allowListFunctions.begin();
+ it != allowListFunctions.end(); ++it) {
/* We don't check for filename equality here because
* filenames might actually be full paths. Instead we
@@ -440,10 +513,10 @@ bool isInInstrumentList(llvm::Function *F) {
if (debug)
SAYF(cMGN "[D] " cRST
- "Function %s is in the deny function list, "
- "not instrumenting ... \n",
+ "Function %s is in the allow function list, "
+ "instrumenting ... \n",
instFunction.c_str());
- return false;
+ return true;
}
@@ -453,7 +526,7 @@ bool isInInstrumentList(llvm::Function *F) {
}
- if (!denyListFiles.empty()) {
+ if (!allowListFiles.empty()) {
// let's try to get the filename for the function
auto bb = &F->getEntryBlock();
@@ -487,8 +560,8 @@ bool isInInstrumentList(llvm::Function *F) {
/* Continue only if we know where we actually are */
if (!instFilename.str().empty()) {
- for (std::list<std::string>::iterator it = denyListFiles.begin();
- it != denyListFiles.end(); ++it) {
+ for (std::list<std::string>::iterator it = allowListFiles.begin();
+ it != allowListFiles.end(); ++it) {
/* We don't check for filename equality here because
* filenames might actually be full paths. Instead we
@@ -503,12 +576,10 @@ bool isInInstrumentList(llvm::Function *F) {
if (debug)
SAYF(cMGN "[D] " cRST
- "Function %s is in the denylist (%s), not "
+ "Function %s is in the allowlist (%s), "
"instrumenting ... \n",
F->getName().str().c_str(), instFilename.str().c_str());
- return false;
-
- }
+ return true;
}
@@ -532,8 +603,8 @@ bool isInInstrumentList(llvm::Function *F) {
/* Continue only if we know where we actually are */
if (!instFilename.str().empty()) {
- for (std::list<std::string>::iterator it = denyListFiles.begin();
- it != denyListFiles.end(); ++it) {
+ for (std::list<std::string>::iterator it = allowListFiles.begin();
+ it != allowListFiles.end(); ++it) {
/* We don't check for filename equality here because
* filenames might actually be full paths. Instead we
@@ -546,9 +617,7 @@ bool isInInstrumentList(llvm::Function *F) {
if (fnmatch(("*" + *it).c_str(), instFilename.str().c_str(), 0) ==
0) {
- return false;
-
- }
+ return true;
}
@@ -567,18 +636,18 @@ bool isInInstrumentList(llvm::Function *F) {
// in the the instrument file list
if (!be_quiet)
WARNF(
- "No debug information found for function %s, will be "
+ "No debug information found for function %s, will not be "
"instrumented (recompile with -g -O[1-3]).",
F->getName().str().c_str());
- return true;
+ return false;
}
- return true;
+ }
}
- return true; // not reached
+ return return_default;
}

MODIFY
llvm_mode/afl-llvm-common.h
llvm_mode/afl-llvm-common.h
@@ -37,6 +37,7 @@ bool isIgnoreFunction(const llvm::Function *F);
void initInstrumentList();
bool isInInstrumentList(llvm::Function *F);
unsigned long long int calculateCollisions(uint32_t edges);
+void scanForDangerousFunctions(llvm::Module *M);
#ifndef IS_EXTERN
#define IS_EXTERN

MODIFY
llvm_mode/afl-llvm-lto-instrumentation.so.cc
llvm_mode/afl-llvm-lto-instrumentation.so.cc
@@ -219,77 +219,7 @@ bool AFLLTOPass::runOnModule(Module &M) {
*/
- std::vector<std::string> module_block_list;
-
- if (map_addr) {
-
- for (GlobalIFunc &IF : M.ifuncs()) {
-
- StringRef ifunc_name = IF.getName();
- Constant *r = IF.getResolver();
- StringRef r_name = cast<Function>(r->getOperand(0))->getName();
- if (!be_quiet)
- fprintf(stderr,
- "Warning: Found an ifunc with name %s that points to resolver "
- "function %s, we cannot instrument this, putting it into a "
- "block list.\n",
- ifunc_name.str().c_str(), r_name.str().c_str());
- module_block_list.push_back(r_name.str());
-
- }
-
- GlobalVariable *GV = M.getNamedGlobal("llvm.global_ctors");
- if (GV && !GV->isDeclaration() && !GV->hasLocalLinkage()) {
-
- ConstantArray *InitList = dyn_cast<ConstantArray>(GV->getInitializer());
-
- if (InitList) {
-
- for (unsigned i = 0, e = InitList->getNumOperands(); i != e; ++i) {
-
- if (ConstantStruct *CS =
- dyn_cast<ConstantStruct>(InitList->getOperand(i))) {
-
- if (CS->getNumOperands() >= 2) {
-
- if (CS->getOperand(1)->isNullValue())
- break; // Found a null terminator, stop here.
-
- ConstantInt *CI = dyn_cast<ConstantInt>(CS->getOperand(0));
- int Priority = CI ? CI->getSExtValue() : 0;
-
- Constant *FP = CS->getOperand(1);
- if (ConstantExpr *CE = dyn_cast<ConstantExpr>(FP))
- if (CE->isCast()) FP = CE->getOperand(0);
- if (Function *F = dyn_cast<Function>(FP)) {
-
- if (!F->isDeclaration() &&
- strncmp(F->getName().str().c_str(), "__afl", 5) != 0 &&
- Priority <= 5) {
-
- if (!be_quiet)
- fprintf(stderr,
- "Warning: Found constructor function %s with prio "
- "%u, we cannot instrument this, putting it into a "
- "block list.\n",
- F->getName().str().c_str(), Priority);
- module_block_list.push_back(F->getName().str());
-
- }
-
- }
-
- }
-
- }
-
- }
-
- }
-
- }
-
- }
+ scanForDangerousFunctions(&M);
/* Instrument all the things! */
@@ -307,26 +237,6 @@ bool AFLLTOPass::runOnModule(Module &M) {
if (F.size() < function_minimum_size) continue;
if (isIgnoreFunction(&F)) continue;
- if (module_block_list.size()) {
-
- for (auto bname : module_block_list) {
-
- std::string fname = F.getName().str();
-
- if (fname.compare(bname) == 0) {
-
- if (!be_quiet)
- WARNF(
- "Skipping instrumentation of dangerous early running function "
- "%s",
- fname.c_str());
-
- }
-
- }
-
- }
-
// the instrument file list check
AttributeList Attrs = F.getAttributes();
if (Attrs.hasAttribute(-1, StringRef("skipinstrument"))) {

MODIFY
llvm_mode/afl-llvm-pass.so.cc
llvm_mode/afl-llvm-pass.so.cc
@@ -297,6 +297,7 @@ bool AFLCoverage::runOnModule(Module &M) {
/* Instrument all the things! */
int inst_blocks = 0;
+ scanForDangerousFunctions(&M);
for (auto &F : M) {

MODIFY
llvm_mode/afl-llvm-rt.o.c
llvm_mode/afl-llvm-rt.o.c
#include <string.h>
#include <assert.h>
#include <stdint.h>
+#include <stddef.h>
+#include <limits.h>
#include <errno.h>
#include <sys/mman.h>
@@ -842,9 +844,22 @@ void __afl_manual_init(void) {
static u8 init_done;
+ if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
+
+ init_done = 1;
+ is_persistent = 0;
+ __afl_sharedmem_fuzzing = 0;
+ if (__afl_area_ptr == NULL) __afl_area_ptr = __afl_area_initial;
+
+ if (getenv("AFL_DEBUG"))
+ fprintf(stderr,
+ "DEBUG: disabled instrumenation because of "
+ "AFL_DISABLE_LLVM_INSTRUMENTATION\n");
+
+ }
+
if (!init_done) {
- __afl_map_shm();
__afl_start_forkserver();
init_done = 1;
@@ -852,11 +867,11 @@ void __afl_manual_init(void) {
}
-/* Proper initialization routine. */
+/* Initialization of the forkserver - latest possible */
-__attribute__((constructor(CONST_PRIO))) void __afl_auto_init(void) {
+__attribute__((constructor())) void __afl_auto_init(void) {
- is_persistent = !!getenv(PERSIST_ENV_VAR);
+ if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
if (getenv(DEFER_ENV_VAR)) return;
@@ -864,6 +879,18 @@ __attribute__((constructor(CONST_PRIO))) void __afl_auto_init(void) {
}
+/* Initialization of the shmem - earliest possible because of LTO fixed mem. */
+
+__attribute__((constructor(0))) void __afl_auto_early(void) {
+
+ if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
+
+ is_persistent = !!getenv(PERSIST_ENV_VAR);
+
+ __afl_map_shm();
+
+}
+
/* The following stuff deals with supporting -fsanitize-coverage=trace-pc-guard.
It remains non-operational in the traditional, plugin-backed LLVM mode.
For more info about 'trace-pc-guard', see llvm_mode/README.md.
@@ -912,7 +939,8 @@ void __sanitizer_cov_trace_pc_guard(uint32_t *guard) {
#else
- __afl_area_ptr[*guard] = __afl_area_ptr[*guard] + 1 + (__afl_area_ptr[*guard] == 255 ? 1 : 0);
+ __afl_area_ptr[*guard] =
+ __afl_area_ptr[*guard] + 1 + (__afl_area_ptr[*guard] == 255 ? 1 : 0);
#endif

MODIFY
src/afl-forkserver.c
src/afl-forkserver.c
@@ -58,6 +58,8 @@ static list_t fsrv_list = {.element_prealloc_count = 0};
static void fsrv_exec_child(afl_forkserver_t *fsrv, char **argv) {
+ if (fsrv->qemu_mode) setenv("AFL_DISABLE_LLVM_INSTRUMENTATION", "1", 0);
+
execv(fsrv->target_path, argv);
}
@@ -122,8 +124,8 @@ void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from) {
Returns the time passed to read.
If the wait times out, returns timeout_ms + 1;
Returns 0 if an error occurred (fd closed, signal, ...); */
-static u32 __attribute__ ((hot)) read_s32_timed(s32 fd, s32 *buf, u32 timeout_ms,
- volatile u8 *stop_soon_p) {
+static u32 __attribute__((hot))
+read_s32_timed(s32 fd, s32 *buf, u32 timeout_ms, volatile u8 *stop_soon_p) {
fd_set readfds;
FD_ZERO(&readfds);
@@ -322,8 +324,9 @@ static void report_error_and_exit(int error) {
cloning a stopped child. So, we just execute once, and then send commands
through a pipe. The other part of this logic is in afl-as.h / llvm_mode */
-void __attribute__ ((hot)) afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
- volatile u8 *stop_soon_p, u8 debug_child_output) {
+void __attribute__((hot))
+afl_fsrv_start(afl_forkserver_t *fsrv, char **argv, volatile u8 *stop_soon_p,
+ u8 debug_child_output) {
int st_pipe[2], ctl_pipe[2];
s32 status;

MODIFY
src/afl-fuzz-bitmap.c
src/afl-fuzz-bitmap.c
@@ -534,7 +534,8 @@ static void write_crash_readme(afl_state_t *afl) {
save or queue the input test case for further analysis if so. Returns 1 if
entry is saved, 0 otherwise. */
-u8 __attribute__ ((hot)) save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
+u8 __attribute__((hot))
+save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
if (unlikely(len == 0)) { return 0; }

MODIFY
src/afl-fuzz-run.c
src/afl-fuzz-run.c
@@ -38,8 +38,8 @@ u64 time_spent_working = 0;
/* Execute target application, monitoring for timeouts. Return status
information. The called program will update afl->fsrv->trace_bits. */
-fsrv_run_result_t __attribute__ ((hot)) fuzz_run_target(afl_state_t *afl, afl_forkserver_t *fsrv,
- u32 timeout) {
+fsrv_run_result_t __attribute__((hot))
+fuzz_run_target(afl_state_t *afl, afl_forkserver_t *fsrv, u32 timeout) {
#ifdef PROFILING
static u64 time_spent_start = 0;
@@ -72,7 +72,8 @@ fsrv_run_result_t __attribute__ ((hot)) fuzz_run_target(afl_state_t *afl, afl_fo
old file is unlinked and a new one is created. Otherwise, afl->fsrv.out_fd is
rewound and truncated. */
-void __attribute__ ((hot)) write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
+void __attribute__((hot))
+write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
#ifdef _AFL_DOCUMENT_MUTATIONS
s32 doc_fd;
@@ -858,7 +859,8 @@ abort_trimming:
error conditions, returning 1 if it's time to bail out. This is
a helper function for fuzz_one(). */
-u8 __attribute__ ((hot)) common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
+u8 __attribute__((hot))
+common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
u8 fault;

split up __afl_manual_init, added internal AFL_DISABLE_LLVM_INSTRUMENTATION, skipping ctor+ifunc functions for all llvm, code-format