Skip to content

Commit c510ba6

Browse files
vanhauser-thcvanhauser-thc
committed
fixes and debug
1 parent bd4c9a5 commit c510ba6

File tree

5 files changed

+46
-19
lines changed

5 files changed

+46
-19
lines changed

‎include/envs.h

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -21,19 +21,20 @@ static char *afl_environment_variables[] = {
2121
"AFL_BENCH_UNTIL_CRASH", "AFL_CAL_FAST", "AFL_CC", "AFL_CC_COMPILER",
2222
"AFL_CMIN_ALLOW_ANY", "AFL_CMIN_CRASHES_ONLY", "AFL_CMPLOG_ONLY_NEW",
2323
"AFL_CODE_END", "AFL_CODE_START", "AFL_COMPCOV_BINNAME",
24-
"AFL_DUMP_CYCLOMATIC_COMPLEXITY", "AFL_DUMP_VULNERABILITY_COMPLEXITY",
25-
"AFL_CMPLOG_MAX_LEN", "AFL_COMPCOV_LEVEL",
26-
"AFL_CRASH_EXITCODE", "AFL_CRASHING_SEEDS_AS_NEW_CRASH",
27-
"AFL_CUSTOM_MUTATOR_LIBRARY", "AFL_CUSTOM_MUTATOR_ONLY",
28-
"AFL_CUSTOM_INFO_PROGRAM", "AFL_CUSTOM_INFO_PROGRAM_ARGV",
29-
"AFL_CUSTOM_INFO_PROGRAM_INPUT", "AFL_CUSTOM_INFO_OUT", "AFL_CXX",
30-
"AFL_CYCLE_SCHEDULES", "AFL_DEBUG", "AFL_DEBUG_CHILD", "AFL_DEBUG_GDB",
31-
"AFL_DEBUG_UNICORN", "AFL_DISABLE_REDUNDANT", "AFL_NO_REDUNDANT",
32-
"AFL_DISABLE_TRIM", "AFL_NO_TRIM", "AFL_DISABLE_LLVM_INSTRUMENTATION",
33-
"AFL_DONT_OPTIMIZE", "AFL_DRIVER_STDERR_DUPLICATE_FILENAME",
34-
"AFL_DUMB_FORKSRV", "AFL_EARLY_FORKSERVER", "AFL_ENTRYPOINT",
35-
"AFL_EXIT_WHEN_DONE", "AFL_EXIT_ON_TIME", "AFL_EXIT_ON_SEED_ISSUES",
36-
"AFL_FAST_CAL", "AFL_FINAL_SYNC", "AFL_FORCE_UI", "AFL_FRIDA_DEBUG_MAPS",
24+
"AFL_DUMP_QUEUE_ON_EXIT", "AFL_DUMP_CYCLOMATIC_COMPLEXITY",
25+
"AFL_DUMP_VULNERABILITY_COMPLEXITY", "AFL_CMPLOG_MAX_LEN",
26+
"AFL_COMPCOV_LEVEL", "AFL_CRASH_EXITCODE",
27+
"AFL_CRASHING_SEEDS_AS_NEW_CRASH", "AFL_CUSTOM_MUTATOR_LIBRARY",
28+
"AFL_CUSTOM_MUTATOR_ONLY", "AFL_CUSTOM_INFO_PROGRAM",
29+
"AFL_CUSTOM_INFO_PROGRAM_ARGV", "AFL_CUSTOM_INFO_PROGRAM_INPUT",
30+
"AFL_CUSTOM_INFO_OUT", "AFL_CXX", "AFL_CYCLE_SCHEDULES", "AFL_DEBUG",
31+
"AFL_DEBUG_CHILD", "AFL_DEBUG_GDB", "AFL_DEBUG_UNICORN",
32+
"AFL_DISABLE_REDUNDANT", "AFL_NO_REDUNDANT", "AFL_DISABLE_TRIM",
33+
"AFL_NO_TRIM", "AFL_DISABLE_LLVM_INSTRUMENTATION", "AFL_DONT_OPTIMIZE",
34+
"AFL_DRIVER_STDERR_DUPLICATE_FILENAME", "AFL_DUMB_FORKSRV",
35+
"AFL_EARLY_FORKSERVER", "AFL_ENTRYPOINT", "AFL_EXIT_WHEN_DONE",
36+
"AFL_EXIT_ON_TIME", "AFL_EXIT_ON_SEED_ISSUES", "AFL_FAST_CAL",
37+
"AFL_FINAL_SYNC", "AFL_FORCE_UI", "AFL_FRIDA_DEBUG_MAPS",
3738
"AFL_FRIDA_DRIVER_NO_HOOK", "AFL_FRIDA_EXCLUDE_RANGES",
3839
"AFL_FRIDA_INST_CACHE_SIZE", "AFL_FRIDA_INST_COVERAGE_ABSOLUTE",
3940
"AFL_FRIDA_INST_COVERAGE_FILE", "AFL_FRIDA_INST_DEBUG_FILE",

‎src/afl-forkserver.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -578,7 +578,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
578578
void *nyx_config = fsrv->nyx_handlers->nyx_config_load(fsrv->target_path);
579579

580580
fsrv->nyx_handlers->nyx_config_set_workdir_path(nyx_config, workdir_path);
581-
fsrv->nyx_handlers->nyx_config_set_input_buffer_size(nyx_config, fsrv->max_length);
581+
fsrv->nyx_handlers->nyx_config_set_input_buffer_size(nyx_config,
582+
fsrv->max_length);
582583
fsrv->nyx_handlers->nyx_config_set_input_buffer_write_protection(nyx_config,
583584
true);
584585

‎src/afl-fuzz-queue.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ double compute_weight(afl_state_t *afl, struct queue_entry *q,
7676
if (likely(afl->schedule < RARE)) { weight *= (avg_exec_us / q->exec_us); }
7777
weight *= (log(q->bitmap_size) / avg_bitmap_size);
7878
weight *= (1 + (q->tc_ref / avg_top_size));
79-
if (avg_score != 0.0) { weight *= (log(q->score) / avg_score); }
79+
if (unlikely(avg_score != 0.0)) { weight *= (log(q->score) / avg_score); }
8080

8181
if (unlikely(weight < 0.1)) { weight = 0.1; }
8282
if (unlikely(q->favored)) { weight *= 5; }
@@ -92,7 +92,7 @@ double compute_weight(afl_state_t *afl, struct queue_entry *q,
9292
void create_alias_table(afl_state_t *afl) {
9393

9494
u32 n = afl->queued_items, i = 0, nSmall = 0, nLarge = n - 1,
95-
explore = afl->fuzz_mode;
95+
exploit = afl->fuzz_mode;
9696
double sum = 0;
9797

9898
double *P = (double *)afl_realloc(AFL_BUF_PARAM(out), n * sizeof(double));
@@ -133,7 +133,7 @@ void create_alias_table(afl_state_t *afl) {
133133
avg_exec_us += q->exec_us;
134134
avg_bitmap_size += log(q->bitmap_size);
135135
avg_top_size += q->tc_ref;
136-
if (!explore) { avg_score += q->score; }
136+
if (exploit) { avg_score += q->score; }
137137
++active;
138138

139139
}
@@ -144,7 +144,7 @@ void create_alias_table(afl_state_t *afl) {
144144
avg_bitmap_size /= active;
145145
avg_top_size /= active;
146146

147-
if (!explore) { avg_score /= active; }
147+
if (exploit) { avg_score /= active; }
148148

149149
for (i = 0; i < n; i++) {
150150

@@ -603,6 +603,7 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
603603
q->testcase_buf = NULL;
604604
q->mother = afl->queue_cur;
605605
q->score = afl->current_score;
606+
if (unlikely(!q->score)) { q->score = 1; }
606607

607608
#ifdef INTROSPECTION
608609
q->bitsmap_size = afl->bitsmap_size;

‎src/afl-fuzz-run.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -606,6 +606,8 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
606606
}
607607

608608
q->exec_us = diff_us / afl->stage_max;
609+
if (unlikely(!q->exec_us)) { q->exec_us = 1; }
610+
609611
q->bitmap_size = count_bytes(afl, afl->fsrv.trace_bits);
610612
q->handicap = handicap;
611613
q->cal_failed = 0;

‎src/afl-fuzz.c

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1806,7 +1806,7 @@ int main(int argc, char **argv_orig, char **envp) {
18061806

18071807
afl->fsrv.use_fauxsrv = afl->non_instrumented_mode == 1 || afl->no_forkserver;
18081808
afl->fsrv.max_length = afl->max_length;
1809-
1809+
18101810
#ifdef __linux__
18111811
if (!afl->fsrv.nyx_mode) {
18121812

@@ -3067,6 +3067,28 @@ int main(int argc, char **argv_orig, char **envp) {
30673067

30683068
}
30693069

3070+
if (getenv("AFL_DUMP_QUEUE_ON_EXIT")) {
3071+
3072+
fprintf(stderr, "\nQUEUE DUMP:\n");
3073+
for (u32 k = 0; k < afl->queued_items; ++k) {
3074+
3075+
struct queue_entry *q = afl->queue_buf[k];
3076+
fprintf(
3077+
stderr,
3078+
"item=%u fname=%s len=%u exec_us=%llu has_new_cov=%u var_behavior=%u "
3079+
"favored=%u fs_redundant=%u disabled=%u bitmap_size=%u fuzz_level=%u "
3080+
"mother=%d perf_score=%.2f weight=%.2f score=%u\n",
3081+
k, q->fname, q->len, q->exec_us, q->has_new_cov, q->var_behavior,
3082+
q->favored, q->fs_redundant, q->disabled, q->bitmap_size,
3083+
q->fuzz_level, q->mother == NULL ? -1 : (int)q->mother->id,
3084+
q->perf_score, q->weight, q->score);
3085+
3086+
}
3087+
3088+
fprintf(stderr, "\n");
3089+
3090+
}
3091+
30703092
if (frida_afl_preload) { ck_free(frida_afl_preload); }
30713093

30723094
fclose(afl->fsrv.plot_file);

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy