afl-fuzz.c
static inline u8 has_new_bit_1(struct queue_entry *q) {
  u8 bb_first = 1;
  u8* bb_exit = (u8*)calloc(afl_map_size, sizeof(u8));
  over_bb_list = NULL;
  q->exec_cksum = 0;
  struct bb *bb_cur = NULL;
  q->save_flag = 0;
  q->cmp_const_num = 0;
  q->loop_num = 0;
  q->bit_num = 0;

#ifdef __x86_64__

  u64* current = (u64*)trace_bits;
  u64* virgin  = (u64*)virgin_bits;
  u32  i = (afl_map_size >> 3);
#else
  u32* current = (u32*)trace_bits;
  u32* virgin  = (u32*)virgin_bits;
  u32  i = (afl_map_size >> 2);

#endif /* ^__x86_64__ */

  u8   ret = 0;

  while (i--) {

    /* Optimize for (*current & *virgin) == 0 - i.e., no bits in current bitmap
       that have not been already cleared from the virgin map - since this will
       almost always be the case. */

    if (unlikely(*current) && unlikely(*current & *virgin)) {

      if (likely(ret < 2)) {

        u8* cur = (u8*)current;
        u8* vir = (u8*)virgin;

        /* Looks like we have not found any new bytes yet; see if any non-zero
           bytes in current[] are pristine in virgin[]. */

#ifdef __x86_64__

        if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) ||
            (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff) ||
            (cur[4] && vir[4] == 0xff) || (cur[5] && vir[5] == 0xff) ||
            (cur[6] && vir[6] == 0xff) || (cur[7] && vir[7] == 0xff)) ret = 2;
        else ret = 1;

#else

        if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) ||
            (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff)) ret = 2;
        else ret = 1;

#endif /* ^__x86_64__ */

      }

      *virgin &= ~*current;

    }

    current++;
    virgin++;

  }
  
  if(ret){
#ifdef __x86_64__
    current = (u64*)trace_bits;
    i = (afl_map_size >> 3);
    u64 h1 = HASH_CONST ^ MAP_SIZE;
#else
    current = (u32*)trace_bits;
    i = (afl_map_size >> 2);
    u32 h1 = HASH_CONST ^ MAP_SIZE;
#endif /* ^__x86_64__ */

    while(i){
      u8* cur = (u8*)current;
      u32 index_lh = 0;
#ifdef __x86_64__
      u64 k1 = *current;
      k1 *= 0x87c37b91114253d5ULL;
      k1  = ROL64(k1, 31);
      k1 *= 0x4cf5ad432745937fULL;
      h1 ^= k1;
      h1  = ROL64(h1, 27);
      h1  = h1 * 5 + 0x52dce729;
      while(likely(index_lh < 8)){
        if(cur[index_lh]){
          q->bit_num++;
          if(cur[index_lh] > 1) q->loop_num++;
          if(cmp_edge[index_lh + afl_map_size - (i<<3)]) q->cmp_const_num++;
          struct bb *bb_now = NULL;
          u32 tmp_index = hash_head[index_lh + afl_map_size - (i<<3)];
		      if(bb_exit[tmp_index] == 0){
			      bb_exit[tmp_index] = 1;
			      bb_now = (struct bb *)malloc(sizeof(struct bb));
			      bb_now->bb_id = tmp_index;
			      bb_now->next = NULL;
            if(bb_first) {
              bb_first = 0;
              over_bb_list = bb_now;
              bb_cur = bb_now;
            }else{  
			        bb_cur->next = bb_now;
			        bb_cur = bb_now;
            }     
		      }
        }
        index_lh++;
      }
#else
      u32 k1 = current;
      k1 *= 0xcc9e2d51;
      k1  = ROL32(k1, 15);
      k1 *= 0x1b873593;
      h1 ^= k1;
      h1  = ROL32(h1, 13);
      h1  = h1 * 5 + 0xe6546b64;
      while(likely(index_lh < 4)){
        if(cur[index_lh]){
          q->bit_num++;
          if(cur[index_lh] > 1) q->loop_num++;
          if(cmp_edge[index_lh + afl_map_size - (i<<2)]) q->cmp_const_num++;
          struct bb *bb_now = NULL;
          u32 tmp_index = hash_head[index_lh + afl_map_size - (i<<2)];
		      if(bb_exit[tmp_index] == 0){
			      bb_exit[tmp_index] = 1;
			      bb_now = (struct bb *)malloc(sizeof(struct bb));
			      bb_now->bb_id = tmp_index;
			      bb_now->next = NULL;
            if(bb_first) {
              bb_first = 0;
              over_bb_list = bb_now;
              bb_cur = bb_now;
            }else{  
			        bb_cur->next = bb_now;
			        bb_cur = bb_now;
            }     
		      }
        }
        index_lh++;
      }
#endif /* ^__x86_64__ */
      current++;
      i--;
    }
  
#ifdef __x86_64__
    h1 ^= h1 >> 33;
    h1 *= 0xff51afd7ed558ccdULL;
    h1 ^= h1 >> 33;
    h1 *= 0xc4ceb9fe1a85ec53ULL;
    h1 ^= h1 >> 33;
#else
    h1 ^= h1 >> 16;
    h1 *= 0x85ebca6b;
    h1 ^= h1 >> 13;
    h1 *= 0xc2b2ae35;
    h1 ^= h1 >> 16;
#endif /* ^__x86_64__ */

  q->exec_cksum = h1;
  }
  
  if (ret){
    bitmap_changed = 1;
    q->save_flag = ret>1?2:3;
  } 

  free(bb_exit);
  return ret;
}
/* Determine whether the case triggered a new bit. 
   Build bb_list linked list and calculate the checksum for each case.
   Created by LH. */
Determine whether the case triggered a new bit.
Build bb_list linked list and calculate the checksum for each case.
Created by LH.
Determine whether the case triggered a new bit . Build bb_list linked list and calculate the checksum for each case . Created by LH .
static inline u8 has_new_bit_1(struct queue_entry *q) {
  u8 bb_first = 1;
  u8* bb_exit = (u8*)calloc(afl_map_size, sizeof(u8));
  over_bb_list = NULL;
  q->exec_cksum = 0;
  struct bb *bb_cur = NULL;
  q->save_flag = 0;
  q->cmp_const_num = 0;
  q->loop_num = 0;
  q->bit_num = 0;
#ifdef __x86_64__
  u64* current = (u64*)trace_bits;
  u64* virgin  = (u64*)virgin_bits;
  u32  i = (afl_map_size >> 3);
#else
  u32* current = (u32*)trace_bits;
  u32* virgin  = (u32*)virgin_bits;
  u32  i = (afl_map_size >> 2);
#endif 
  u8   ret = 0;
  while (i--) {
    if (unlikely(*current) && unlikely(*current & *virgin)) {
      if (likely(ret < 2)) {
        u8* cur = (u8*)current;
        u8* vir = (u8*)virgin;
#ifdef __x86_64__
        if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) ||
            (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff) ||
            (cur[4] && vir[4] == 0xff) || (cur[5] && vir[5] == 0xff) ||
            (cur[6] && vir[6] == 0xff) || (cur[7] && vir[7] == 0xff)) ret = 2;
        else ret = 1;
#else
        if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) ||
            (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff)) ret = 2;
        else ret = 1;
#endif 
      }
      *virgin &= ~*current;
    }
    current++;
    virgin++;
  }
  if(ret){
#ifdef __x86_64__
    current = (u64*)trace_bits;
    i = (afl_map_size >> 3);
    u64 h1 = HASH_CONST ^ MAP_SIZE;
#else
    current = (u32*)trace_bits;
    i = (afl_map_size >> 2);
    u32 h1 = HASH_CONST ^ MAP_SIZE;
#endif 
    while(i){
      u8* cur = (u8*)current;
      u32 index_lh = 0;
#ifdef __x86_64__
      u64 k1 = *current;
      k1 *= 0x87c37b91114253d5ULL;
      k1  = ROL64(k1, 31);
      k1 *= 0x4cf5ad432745937fULL;
      h1 ^= k1;
      h1  = ROL64(h1, 27);
      h1  = h1 * 5 + 0x52dce729;
      while(likely(index_lh < 8)){
        if(cur[index_lh]){
          q->bit_num++;
          if(cur[index_lh] > 1) q->loop_num++;
          if(cmp_edge[index_lh + afl_map_size - (i<<3)]) q->cmp_const_num++;
          struct bb *bb_now = NULL;
          u32 tmp_index = hash_head[index_lh + afl_map_size - (i<<3)];
		      if(bb_exit[tmp_index] == 0){
			      bb_exit[tmp_index] = 1;
			      bb_now = (struct bb *)malloc(sizeof(struct bb));
			      bb_now->bb_id = tmp_index;
			      bb_now->next = NULL;
            if(bb_first) {
              bb_first = 0;
              over_bb_list = bb_now;
              bb_cur = bb_now;
            }else{  
			        bb_cur->next = bb_now;
			        bb_cur = bb_now;
            }     
		      }
        }
        index_lh++;
      }
#else
      u32 k1 = current;
      k1 *= 0xcc9e2d51;
      k1  = ROL32(k1, 15);
      k1 *= 0x1b873593;
      h1 ^= k1;
      h1  = ROL32(h1, 13);
      h1  = h1 * 5 + 0xe6546b64;
      while(likely(index_lh < 4)){
        if(cur[index_lh]){
          q->bit_num++;
          if(cur[index_lh] > 1) q->loop_num++;
          if(cmp_edge[index_lh + afl_map_size - (i<<2)]) q->cmp_const_num++;
          struct bb *bb_now = NULL;
          u32 tmp_index = hash_head[index_lh + afl_map_size - (i<<2)];
		      if(bb_exit[tmp_index] == 0){
			      bb_exit[tmp_index] = 1;
			      bb_now = (struct bb *)malloc(sizeof(struct bb));
			      bb_now->bb_id = tmp_index;
			      bb_now->next = NULL;
            if(bb_first) {
              bb_first = 0;
              over_bb_list = bb_now;
              bb_cur = bb_now;
            }else{  
			        bb_cur->next = bb_now;
			        bb_cur = bb_now;
            }     
		      }
        }
        index_lh++;
      }
#endif 
      current++;
      i--;
    }
#ifdef __x86_64__
    h1 ^= h1 >> 33;
    h1 *= 0xff51afd7ed558ccdULL;
    h1 ^= h1 >> 33;
    h1 *= 0xc4ceb9fe1a85ec53ULL;
    h1 ^= h1 >> 33;
#else
    h1 ^= h1 >> 16;
    h1 *= 0x85ebca6b;
    h1 ^= h1 >> 13;
    h1 *= 0xc2b2ae35;
    h1 ^= h1 >> 16;
#endif 
  q->exec_cksum = h1;
  }
  if (ret){
    bitmap_changed = 1;
    q->save_flag = ret>1?2:3;
  } 
  free(bb_exit);
  return ret;
}
static inline u8 has_new_bit_1 ( struct queue_entry * q ) { u8 bb_first = 1 ; u8 * bb_exit = ( u8 * ) calloc ( afl_map_size , sizeof ( u8 ) ) ; over_bb_list = NULL ; q -> exec_cksum = 0 ; struct bb * bb_cur = NULL ; q -> save_flag = 0 ; q -> cmp_const_num = 0 ; q -> loop_num = 0 ; q -> bit_num = 0 ; #ifdef __x86_64__ u64 * current = ( u64 * ) trace_bits ; u64 * virgin = ( u64 * ) virgin_bits ; u32 i = ( afl_map_size >> 3 ) ; #else u32 * current = ( u32 * ) trace_bits ; u32 * virgin = ( u32 * ) virgin_bits ; u32 i = ( afl_map_size >> 2 ) ; #endif u8 ret = 0 ; while ( i -- ) { if ( unlikely ( * current ) && unlikely ( * current & * virgin ) ) { if ( likely ( ret < 2 ) ) { u8 * cur = ( u8 * ) current ; u8 * vir = ( u8 * ) virgin ; #ifdef __x86_64__ if ( ( cur [ 0 ] && vir [ 0 ] == 0xff ) || ( cur [ 1 ] && vir [ 1 ] == 0xff ) || ( cur [ 2 ] && vir [ 2 ] == 0xff ) || ( cur [ 3 ] && vir [ 3 ] == 0xff ) || ( cur [ 4 ] && vir [ 4 ] == 0xff ) || ( cur [ 5 ] && vir [ 5 ] == 0xff ) || ( cur [ 6 ] && vir [ 6 ] == 0xff ) || ( cur [ 7 ] && vir [ 7 ] == 0xff ) ) ret = 2 ; else ret = 1 ; #else if ( ( cur [ 0 ] && vir [ 0 ] == 0xff ) || ( cur [ 1 ] && vir [ 1 ] == 0xff ) || ( cur [ 2 ] && vir [ 2 ] == 0xff ) || ( cur [ 3 ] && vir [ 3 ] == 0xff ) ) ret = 2 ; else ret = 1 ; #endif } * virgin &= ~ * current ; } current ++ ; virgin ++ ; } if ( ret ) { #ifdef __x86_64__ current = ( u64 * ) trace_bits ; i = ( afl_map_size >> 3 ) ; u64 h1 = HASH_CONST ^ MAP_SIZE ; #else current = ( u32 * ) trace_bits ; i = ( afl_map_size >> 2 ) ; u32 h1 = HASH_CONST ^ MAP_SIZE ; #endif while ( i ) { u8 * cur = ( u8 * ) current ; u32 index_lh = 0 ; #ifdef __x86_64__ u64 k1 = * current ; k1 *= 0x87c37b91114253d5ULL ; k1 = ROL64 ( k1 , 31 ) ; k1 *= 0x4cf5ad432745937fULL ; h1 ^= k1 ; h1 = ROL64 ( h1 , 27 ) ; h1 = h1 * 5 + 0x52dce729 ; while ( likely ( index_lh < 8 ) ) { if ( cur [ index_lh ] ) { q -> bit_num ++ ; if ( cur [ index_lh ] > 1 ) q -> loop_num ++ ; if ( cmp_edge [ index_lh + afl_map_size - ( i << 3 ) ] ) q -> cmp_const_num ++ ; struct bb * bb_now = NULL ; u32 tmp_index = hash_head [ index_lh + afl_map_size - ( i << 3 ) ] ; if ( bb_exit [ tmp_index ] == 0 ) { bb_exit [ tmp_index ] = 1 ; bb_now = ( struct bb * ) malloc ( sizeof ( struct bb ) ) ; bb_now -> bb_id = tmp_index ; bb_now -> next = NULL ; if ( bb_first ) { bb_first = 0 ; over_bb_list = bb_now ; bb_cur = bb_now ; } else { bb_cur -> next = bb_now ; bb_cur = bb_now ; } } } index_lh ++ ; } #else u32 k1 = current ; k1 *= 0xcc9e2d51 ; k1 = ROL32 ( k1 , 15 ) ; k1 *= 0x1b873593 ; h1 ^= k1 ; h1 = ROL32 ( h1 , 13 ) ; h1 = h1 * 5 + 0xe6546b64 ; while ( likely ( index_lh < 4 ) ) { if ( cur [ index_lh ] ) { q -> bit_num ++ ; if ( cur [ index_lh ] > 1 ) q -> loop_num ++ ; if ( cmp_edge [ index_lh + afl_map_size - ( i << 2 ) ] ) q -> cmp_const_num ++ ; struct bb * bb_now = NULL ; u32 tmp_index = hash_head [ index_lh + afl_map_size - ( i << 2 ) ] ; if ( bb_exit [ tmp_index ] == 0 ) { bb_exit [ tmp_index ] = 1 ; bb_now = ( struct bb * ) malloc ( sizeof ( struct bb ) ) ; bb_now -> bb_id = tmp_index ; bb_now -> next = NULL ; if ( bb_first ) { bb_first = 0 ; over_bb_list = bb_now ; bb_cur = bb_now ; } else { bb_cur -> next = bb_now ; bb_cur = bb_now ; } } } index_lh ++ ; } #endif current ++ ; i -- ; } #ifdef __x86_64__ h1 ^= h1 >> 33 ; h1 *= 0xff51afd7ed558ccdULL ; h1 ^= h1 >> 33 ; h1 *= 0xc4ceb9fe1a85ec53ULL ; h1 ^= h1 >> 33 ; #else h1 ^= h1 >> 16 ; h1 *= 0x85ebca6b ; h1 ^= h1 >> 13 ; h1 *= 0xc2b2ae35 ; h1 ^= h1 >> 16 ; #endif q -> exec_cksum = h1 ; } if ( ret ) { bitmap_changed = 1 ; q -> save_flag = ret > 1 ? 2 : 3 ; } free ( bb_exit ) ; return ret ; }
Determine whether the case triggered a new bit.
Determine whether the case triggered a new bit .
/* ^__x86_64__ */ /* Optimize for (*current & *virgin) == 0 - i.e., no bits in current bitmap
       that have not been already cleared from the virgin map - since this will
       almost always be the case. */ /* Looks like we have not found any new bytes yet; see if any non-zero
           bytes in current[] are pristine in virgin[]. */ /* ^__x86_64__ */ /* ^__x86_64__ */ /* ^__x86_64__ */ /* ^__x86_64__ */