Skip to content

Commit c4b1566

Browse files
vanhauser-thcfxlbnick-potenskichollerwtdcode
authored
push to stable (AFLplusplus#1734)
* afl++ -> AFL++ * update readme * more debug * slightly different weighting algo (AFLplusplus#1719) * better seed selection * slightly different weighting calculation * remove unnecessary memset * Add "Hangs saved" to afl-whatsup (AFLplusplus#1717) The hangs could show long or infinite loops. This is important. Co-authored-by: van Hauser <[email protected]> * nits * afl-showmap: Start a only a single fork server (AFLplusplus#1718) A forkserver is started by afl_fsrv_get_mapsize() when dynamically finding the map size. When an input directory option is specified a second fork server was also started. This commit re-arranges the inits for several forkserver struct members so that we can re-use the server started by the get_mapsize() call when not in coresight/qemu/unicorn modes and just start the server otherwise. * Source Code Coverage support for Nyx (Part 1) (AFLplusplus#1720) * Additional source code reformatting in afl-compiler-rt * Add source code coverage support to afl-compiler-rt (for use with Nyx) * doc, code format * llvm 17 changes * more llvm 17 * add frida mode tutorial * fix effector map * docs * Should memset EFF_ALEN(len) of eff_map (AFLplusplus#1722) * fix reallocs * fix afl-system-config for macos * afl-fuzz.c: Document -i - in --help (AFLplusplus#1725) afl-fuzz.c: Document `-i -` in `--help`, to write that `-i` can be passed '-' to resume the prior fuzzing job. Also reference AFL_AUTORESUME so users know they can set that parameter to sidestep the issue entirely. * tritondse custom mutator attempt * tritondse fixes * update libnyx (AFLplusplus#1727) * GNUmakefile: Update LLVM instructions (AFLplusplus#1728) Update LLVM instructions, because versions higher than 14 are supported and to be explicit that LLD is also required * disable macos in the ci, works fine for me * fix makefile * better tritondse support * next steps for tritondse * qemuafl: Persistent mode for PPC32 targets * update qemu_mode * afl-clang-lto incomptable with -flto=thin * add @responsefile support for afl-cc --------- Co-authored-by: fxlb <[email protected]> Co-authored-by: Nick Potenski <[email protected]> Co-authored-by: Christian Holler (:decoder) <[email protected]> Co-authored-by: lazymio <[email protected]> Co-authored-by: Moshe Kaplan <[email protected]> Co-authored-by: Sergej Schumilo <[email protected]> Co-authored-by: Dominik Maier <[email protected]>
1 parent 74be9ab commit c4b1566

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+1164
-330
lines changed

‎.github/workflows/ci.yml

+20-20
Original file line numberDiff line numberDiff line change
@@ -36,23 +36,23 @@ jobs:
3636
run: make distrib ASAN_BUILD=1 NO_NYX=1
3737
- name: run tests
3838
run: sudo -E ./afl-system-config; make tests
39-
macos:
40-
runs-on: macOS-latest
41-
env:
42-
AFL_MAP_SIZE: 65536
43-
AFL_SKIP_CPUFREQ: 1
44-
AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES: 1
45-
steps:
46-
- uses: actions/checkout@v3
47-
- name: install
48-
run: brew install make gcc llvm
49-
- name: fix install
50-
run: cd /usr/local/bin; ln -s gcc-11 gcc; ln -s g++-11 g++; which gcc; gcc -v
51-
- name: build
52-
run: export PATH=/usr/local/Cellar/llvm/*/":$PATH"; export CC=/usr/local/Cellar/llvm/*/bin/clang; export CXX="$CC"++; export LLVM_CONFIG=/usr/local/Cellar/llvm/*/bin/llvm-config; sudo -E ./afl-system-config; gmake ASAN_BUILD=1
53-
- name: frida
54-
run: export CC=/usr/local/Cellar/llvm/*/bin/clang; export CXX="$CC"++; cd frida_mode; gmake
55-
- name: run tests
56-
run: sudo -E ./afl-system-config; export CC=/usr/local/Cellar/llvm/*/bin/clang; export CXX="$CC"++; export PATH=/usr/local/Cellar/llvm/*/":/usr/local/bin:$PATH"; export LLVM_CONFIG=/usr/local/Cellar/llvm/*/bin/llvm-config; gmake tests
57-
- name: force frida test for MacOS
58-
run: export AFL_PATH=`pwd`; /usr/local/bin/gcc -o test-instr test-instr.c; mkdir in; echo > in/in; AFL_NO_UI=1 ./afl-fuzz -O -i in -o out -V 5 -- ./test-instr
39+
# macos:
40+
# runs-on: macOS-latest
41+
# env:
42+
# AFL_MAP_SIZE: 65536
43+
# AFL_SKIP_CPUFREQ: 1
44+
# AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES: 1
45+
# steps:
46+
# - uses: actions/checkout@v3
47+
# - name: install
48+
# run: brew install make gcc llvm
49+
# - name: fix install
50+
# run: cd /usr/local/bin; ln -s gcc-11 gcc; ln -s g++-11 g++; which gcc; gcc -v
51+
# - name: build
52+
# run: export PATH=/usr/local/Cellar/llvm/*/":$PATH"; export CC=/usr/local/Cellar/llvm/*/bin/clang; export CXX="$CC"++; export LLVM_CONFIG=/usr/local/Cellar/llvm/*/bin/llvm-config; sudo -E ./afl-system-config; gmake ASAN_BUILD=1
53+
# - name: frida
54+
# run: export CC=/usr/local/Cellar/llvm/*/bin/clang; export CXX="$CC"++; cd frida_mode; gmake
55+
# - name: run tests
56+
# run: sudo -E ./afl-system-config; export CC=/usr/local/Cellar/llvm/*/bin/clang; export CXX="$CC"++; export PATH=/usr/local/Cellar/llvm/*/":/usr/local/bin:$PATH"; export LLVM_CONFIG=/usr/local/Cellar/llvm/*/bin/llvm-config; gmake tests
57+
# - name: force frida test for MacOS
58+
# run: export AFL_PATH=`pwd`; /usr/local/bin/gcc -o test-instr test-instr.c; mkdir in; echo > in/in; AFL_NO_UI=1 ./afl-fuzz -O -i in -o out -V 5 -- ./test-instr

‎Dockerfile

+2-2
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
#
77

88
FROM ubuntu:22.04 AS aflplusplus
9-
LABEL "maintainer"="afl++ team <[email protected]>"
9+
LABEL "maintainer"="AFL++ team <[email protected]>"
1010
LABEL "about"="AFLplusplus container image"
1111

1212
### Comment out to enable these features
@@ -94,4 +94,4 @@ RUN sed -i.bak 's/^ -/ /g' GNUmakefile && \
9494
RUN echo "set encoding=utf-8" > /root/.vimrc && \
9595
echo ". /etc/bash_completion" >> ~/.bashrc && \
9696
echo 'alias joe="joe --wordwrap --joe_state -nobackup"' >> ~/.bashrc && \
97-
echo "export PS1='"'[afl++ \h] \w \$ '"'" >> ~/.bashrc
97+
echo "export PS1='"'[AFL++ \h] \w \$ '"'" >> ~/.bashrc

‎GNUmakefile

+9-8
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ ASAN_OPTIONS=detect_leaks=0
3939
SYS = $(shell uname -s)
4040
ARCH = $(shell uname -m)
4141

42-
$(info [*] Compiling afl++ for OS $(SYS) on ARCH $(ARCH))
42+
$(info [*] Compiling AFL++ for OS $(SYS) on ARCH $(ARCH))
4343

4444
ifdef NO_SPLICING
4545
override CFLAGS_OPT += -DNO_SPLICING
@@ -316,7 +316,7 @@ all: test_x86 test_shm test_python ready $(PROGS) afl-as llvm gcc_plugin test_bu
316316
@test -e afl-fuzz && echo "[+] afl-fuzz and supporting tools successfully built" || echo "[-] afl-fuzz could not be built, please set CC to a working compiler"
317317
@test -e afl-llvm-pass.so && echo "[+] LLVM basic mode successfully built" || echo "[-] LLVM mode could not be built, please install at least llvm-11 and clang-11 or newer, see docs/INSTALL.md"
318318
@test -e SanitizerCoveragePCGUARD.so && echo "[+] LLVM mode successfully built" || echo "[-] LLVM mode could not be built, please install at least llvm-11 and clang-11 or newer, see docs/INSTALL.md"
319-
@test -e SanitizerCoverageLTO.so && echo "[+] LLVM LTO mode successfully built" || echo "[-] LLVM LTO mode could not be built, it is optional, if you want it, please install LLVM 11-14. More information at instrumentation/README.lto.md on how to build it"
319+
@test -e SanitizerCoverageLTO.so && echo "[+] LLVM LTO mode successfully built" || echo "[-] LLVM LTO mode could not be built, it is optional, if you want it, please install LLVM and LLD 11+. More information at instrumentation/README.lto.md on how to build it"
320320
ifneq "$(SYS)" "Darwin"
321321
@test -e afl-gcc-pass.so && echo "[+] gcc_mode successfully built" || echo "[-] gcc_mode could not be built, it is optional, install gcc-VERSION-plugin-dev to enable this"
322322
endif
@@ -359,15 +359,15 @@ performance-test: source-only
359359
help:
360360
@echo "HELP --- the following make targets exist:"
361361
@echo "=========================================="
362-
@echo "all: the main afl++ binaries and llvm/gcc instrumentation"
362+
@echo "all: the main AFL++ binaries and llvm/gcc instrumentation"
363363
@echo "binary-only: everything for binary-only fuzzing: frida_mode, nyx_mode, qemu_mode, frida_mode, unicorn_mode, coresight_mode, libdislocator, libtokencap"
364364
@echo "source-only: everything for source code fuzzing: nyx_mode, libdislocator, libtokencap"
365365
@echo "distrib: everything (for both binary-only and source code fuzzing)"
366366
@echo "man: creates simple man pages from the help option of the programs"
367367
@echo "install: installs everything you have compiled with the build option above"
368368
@echo "clean: cleans everything compiled (not downloads when on a checkout)"
369369
@echo "deepclean: cleans everything including downloads"
370-
@echo "uninstall: uninstall afl++ from the system"
370+
@echo "uninstall: uninstall AFL++ from the system"
371371
@echo "code-format: format the code, do this before you commit and send a PR please!"
372372
@echo "tests: this runs the test framework. It is more catered for the developers, but if you run into problems this helps pinpointing the problem"
373373
@echo "unit: perform unit tests (based on cmocka and GNU linker)"
@@ -379,6 +379,7 @@ help:
379379
@echo Known build environment options:
380380
@echo "=========================================="
381381
@echo STATIC - compile AFL++ static
382+
@echo "CODE_COVERAGE - compile the target for code coverage (see docs/instrumentation/README.llvm.md)"
382383
@echo ASAN_BUILD - compiles AFL++ with memory sanitizer for debug purposes
383384
@echo UBSAN_BUILD - compiles AFL++ tools with undefined behaviour sanitizer for debug purposes
384385
@echo DEBUG - no optimization, -ggdb3, all warnings and -Werror
@@ -394,7 +395,7 @@ help:
394395
@echo AFL_NO_X86 - if compiling on non-intel/amd platforms
395396
@echo "LLVM_CONFIG - if your distro doesn't use the standard name for llvm-config (e.g., Debian)"
396397
@echo "=========================================="
397-
@echo e.g.: make ASAN_BUILD=1
398+
@echo e.g.: make LLVM_CONFIG=llvm-config-16
398399

399400
.PHONY: test_x86
400401
ifndef AFL_NO_X86
@@ -749,7 +750,7 @@ endif
749750
@echo
750751

751752
%.8: %
752-
@echo .TH $* 8 $(BUILD_DATE) "afl++" > $@
753+
@echo .TH $* 8 $(BUILD_DATE) "AFL++" > $@
753754
@echo .SH NAME >> $@
754755
@echo .B $* >> $@
755756
@echo >> $@
@@ -761,8 +762,8 @@ endif
761762
@./$* -hh 2>&1 | tail -n +4 >> $@
762763
@echo >> $@
763764
@echo .SH AUTHOR >> $@
764-
@echo "afl++ was written by Michal \"lcamtuf\" Zalewski and is maintained by Marc \"van Hauser\" Heuse <[email protected]>, Heiko \"hexcoder-\" Eissfeldt <[email protected]>, Andrea Fioraldi <[email protected]> and Dominik Maier <[email protected]>" >> $@
765-
@echo The homepage of afl++ is: https://github.com/AFLplusplus/AFLplusplus >> $@
765+
@echo "AFL++ was written by Michal \"lcamtuf\" Zalewski and is maintained by Marc \"van Hauser\" Heuse <[email protected]>, Dominik Maier <[email protected]>, Andrea Fioraldi <[email protected]> and Heiko \"hexcoder-\" Eissfeldt <[email protected]>" >> $@
766+
@echo The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus >> $@
766767
@echo >> $@
767768
@echo .SH LICENSE >> $@
768769
@echo Apache License Version 2.0, January 2004 >> $@

‎GNUmakefile.gcc_plugin

+3-3
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,7 @@ all_done: test_build
175175
.NOTPARALLEL: clean
176176

177177
%.8: %
178-
@echo .TH $* 8 `date "+%Y-%m-%d"` "afl++" > ./$@
178+
@echo .TH $* 8 `date "+%Y-%m-%d"` "AFL++" > ./$@
179179
@echo .SH NAME >> ./$@
180180
@echo .B $* >> ./$@
181181
@echo >> ./$@
@@ -187,8 +187,8 @@ all_done: test_build
187187
@./$* -h 2>&1 | tail -n +4 >> ./$@
188188
@echo >> ./$@
189189
@echo .SH AUTHOR >> ./$@
190-
@echo "afl++ was written by Michal \"lcamtuf\" Zalewski and is maintained by Marc \"van Hauser\" Heuse <[email protected]>, Heiko \"hexcoder-\" Eissfeldt <[email protected]>, Andrea Fioraldi <[email protected]> and Dominik Maier <[email protected]>" >> ./$@
191-
@echo The homepage of afl++ is: https://github.com/AFLplusplus/AFLplusplus >> ./$@
190+
@echo "AFL++ was written by Michal \"lcamtuf\" Zalewski and is maintained by Marc \"van Hauser\" Heuse <[email protected]>, Dominik Maier <[email protected]>, Andrea Fioraldi <[email protected]> and Heiko \"hexcoder-\" Eissfeldt <[email protected]>" >> ./$@
191+
@echo The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus >> ./$@
192192
@echo >> ./$@
193193
@echo .SH LICENSE >> ./$@
194194
@echo Apache License Version 2.0, January 2004 >> ./$@

‎GNUmakefile.llvm

+8-3
Original file line numberDiff line numberDiff line change
@@ -274,6 +274,11 @@ ifndef LLVM_DEBUG
274274
CFLAGS_SAFE += -Wno-deprecated
275275
endif
276276

277+
ifdef CODE_COVERAGE
278+
override CFLAGS_SAFE += -D__AFL_CODE_COVERAGE=1
279+
override LDFLAGS += -ldl
280+
endif
281+
277282
override CFLAGS += $(CFLAGS_SAFE)
278283

279284
ifdef AFL_TRACE_PC
@@ -510,7 +515,7 @@ install: all
510515
install -m 644 instrumentation/README.*.md $${DESTDIR}$(DOC_PATH)/
511516

512517
%.8: %
513-
@echo .TH $* 8 $(BUILD_DATE) "afl++" > ./$@
518+
@echo .TH $* 8 $(BUILD_DATE) "AFL++" > ./$@
514519
@echo .SH NAME >> ./$@
515520
@printf "%s" ".B $* \- " >> ./$@
516521
@./$* -h 2>&1 | head -n 1 | sed -e "s/$$(printf '\e')[^m]*m//g" >> ./$@
@@ -524,8 +529,8 @@ install: all
524529
@./$* -h 2>&1 | tail -n +4 >> ./$@
525530
@echo >> ./$@
526531
@echo .SH AUTHOR >> ./$@
527-
@echo "afl++ was written by Michal \"lcamtuf\" Zalewski and is maintained by Marc \"van Hauser\" Heuse <[email protected]>, Heiko \"hexcoder-\" Eissfeldt <[email protected]>, Andrea Fioraldi <[email protected]> and Dominik Maier <[email protected]>" >> ./$@
528-
@echo The homepage of afl++ is: https://github.com/AFLplusplus/AFLplusplus >> ./$@
532+
@echo "AFL++ was written by Michal \"lcamtuf\" Zalewski and is maintained by Marc \"van Hauser\" Heuse <[email protected]>, Dominik Maier <[email protected]>, Andrea Fioraldi <[email protected]> and Heiko \"hexcoder-\" Eissfeldt <[email protected]>" >> ./$@
533+
@echo The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus >> ./$@
529534
@echo >> ./$@
530535
@echo .SH LICENSE >> ./$@
531536
@echo Apache License Version 2.0, January 2004 >> ./$@

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@ Repository:
1212
AFL++ is maintained by:
1313

1414
* Marc "van Hauser" Heuse <[email protected]>
15-
* Heiko "hexcoder-" Eißfeldt <[email protected]>
1615
* Andrea Fioraldi <[email protected]>
1716
* Dominik Maier <[email protected]>
17+
* Heiko "hexcoder-" Eißfeldt <[email protected]>
1818
* Documentation: Jana Aydinbas <[email protected]>
1919

2020
Originally developed by Michał "lcamtuf" Zalewski.

‎afl-cmin

+1-1
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ BEGIN {
149149
redirected = 0
150150
}
151151
152-
print "corpus minimization tool for afl++ (awk version)\n"
152+
print "corpus minimization tool for AFL++ (awk version)\n"
153153
154154
# defaults
155155
extra_par = ""

‎afl-system-config

+2-1
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ if [ "$PLATFORM" = "Darwin" ] ; then
110110
sysctl kern.sysv.shmall=131072000
111111
echo Settings applied.
112112
echo
113-
if [ $(launchctl list 2>/dev/null | grep -q '\.ReportCrash$') ] ; then
113+
if $(launchctl list 2>/dev/null | grep -q '\.ReportCrash$') ; then
114114
echo
115115
echo Unloading the default crash reporter
116116
SL=/System/Library; PL=com.apple.ReportCrash
@@ -119,6 +119,7 @@ if [ "$PLATFORM" = "Darwin" ] ; then
119119
echo
120120
fi
121121
echo It is recommended to disable System Integrity Protection for increased performance.
122+
echo See: https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection
122123
echo
123124
DONE=1
124125
fi

‎afl-whatsup

+3
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@ TOTAL_TIME=0
8888
TOTAL_EXECS=0
8989
TOTAL_EPS=0
9090
TOTAL_CRASHES=0
91+
TOTAL_HANGS=0
9192
TOTAL_PFAV=0
9293
TOTAL_PENDING=0
9394

@@ -190,6 +191,7 @@ for i in `find . -maxdepth 2 -iname fuzzer_stats | sort`; do
190191
TOTAL_EPS=$((TOTAL_EPS + EXEC_SEC))
191192
TOTAL_EXECS=$((TOTAL_EXECS + execs_done))
192193
TOTAL_CRASHES=$((TOTAL_CRASHES + saved_crashes))
194+
TOTAL_HANGS=$((TOTAL_HANGS + saved_hangs))
193195
TOTAL_PENDING=$((TOTAL_PENDING + pending_total))
194196
TOTAL_PFAV=$((TOTAL_PFAV + pending_favs))
195197

@@ -301,6 +303,7 @@ if [ "$ALIVE_CNT" -gt "1" ]; then
301303
fi
302304

303305
echo " Crashes saved : $TOTAL_CRASHES"
306+
echo " Hangs saved : $TOTAL_HANGS"
304307
echo "Cycles without finds : $TOTAL_WCOP"
305308
echo " Time without finds : $TOTAL_LAST_FIND"
306309
echo

‎custom_mutators/aflpp_tritondse/README.md

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# An AFL++ custom mutator using TritonDSE
2+
3+
## Installing the requirements
4+
5+
`pip3 install tritondse`
6+
7+
## How to run with an example
8+
9+
```
10+
../../afl-cc -o ../../test-instr ../../test-instr.c
11+
mkdir -p in
12+
echo aaaa > in/in
13+
TRITON_DSE_TARGET=../../test-instr AFL_CUSTOM_MUTATOR_ONLY=1 AFL_SYNC_TIME=1 AFL_PYTHON_MODULE=aflpp_tritondse PYTHONPATH=. ../../afl-fuzz -i in -o out -- ../../test-instr
14+
```
15+
16+
Note that this custom mutator works differently, new finds are synced
17+
after 10-60 seconds to the fuzzing instance.

0 commit comments

Comments
 (0)