Skip to content
Snippets Groups Projects
Unverified Commit b67905c4 authored by van Hauser's avatar van Hauser Committed by GitHub
Browse files

Merge branch 'stable' into dev

parents 6b98157c 9d5007b1
No related branches found
No related tags found
No related merge requests found
...@@ -253,7 +253,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>. ...@@ -253,7 +253,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
the original script is still present as afl-cmin.bash the original script is still present as afl-cmin.bash
- afl-showmap: -i dir option now allows processing multiple inputs using the - afl-showmap: -i dir option now allows processing multiple inputs using the
forkserver. This is for enhanced speed in afl-cmin. forkserver. This is for enhanced speed in afl-cmin.
- added ignore and instrument_file list function check in all modules of llvm_mode - added blacklist and instrument_filesing function check in all modules of llvm_mode
- added fix from Debian project to compile libdislocator and libtokencap - added fix from Debian project to compile libdislocator and libtokencap
- libdislocator: AFL_ALIGNED_ALLOC to force size alignment to max_align_t - libdislocator: AFL_ALIGNED_ALLOC to force size alignment to max_align_t
...@@ -308,7 +308,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>. ...@@ -308,7 +308,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
performance loss of ~10% performance loss of ~10%
- added test/test-performance.sh script - added test/test-performance.sh script
- (re)added gcc_plugin, fast inline instrumentation is not yet finished, - (re)added gcc_plugin, fast inline instrumentation is not yet finished,
however it includes the instrument_files listing and persistance feature! by hexcoder- however it includes the instrument_filesing and persistance feature! by hexcoder-
- gcc_plugin tests added to testing framework - gcc_plugin tests added to testing framework
...@@ -396,7 +396,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>. ...@@ -396,7 +396,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
- more cpu power for afl-system-config - more cpu power for afl-system-config
- added forkserver patch to afl-tmin, makes it much faster (originally from - added forkserver patch to afl-tmin, makes it much faster (originally from
github.com/nccgroup/TriforceAFL) github.com/nccgroup/TriforceAFL)
- added instrument_files support for llvm_mode via AFL_LLVM_INSTRUMENT_FILE to allow - added instrument_files support for llvm_mode via AFL_LLVM_WHITELIST to allow
only to instrument what is actually interesting. Gives more speed and less only to instrument what is actually interesting. Gives more speed and less
map pollution (originally by choller@mozilla) map pollution (originally by choller@mozilla)
- added Python Module mutator support, python2.7-dev is autodetected. - added Python Module mutator support, python2.7-dev is autodetected.
......
...@@ -66,7 +66,7 @@ then using laf-intel (see llvm_mode/README.laf-intel.md) will help `afl-fuzz` a ...@@ -66,7 +66,7 @@ then using laf-intel (see llvm_mode/README.laf-intel.md) will help `afl-fuzz` a
to get to the important parts in the code. to get to the important parts in the code.
If you are only interested in specific parts of the code being fuzzed, you can If you are only interested in specific parts of the code being fuzzed, you can
list the files that are actually relevant. This improves the speed and instrument_files the files that are actually relevant. This improves the speed and
accuracy of afl. See llvm_mode/README.instrument_file.md accuracy of afl. See llvm_mode/README.instrument_file.md
Also use the InsTrim mode on larger binaries, this improves performance and Also use the InsTrim mode on larger binaries, this improves performance and
......
...@@ -47,7 +47,7 @@ project/feature_b/b1.cpp ...@@ -47,7 +47,7 @@ project/feature_b/b1.cpp
project/feature_b/b2.cpp project/feature_b/b2.cpp
``` ```
and you only want to test feature_a, then create a instrument file list file containing: and you only want to test feature_a, then create a the instrument file list file containing:
``` ```
feature_a/a1.cpp feature_a/a1.cpp
...@@ -64,8 +64,8 @@ a2.cpp ...@@ -64,8 +64,8 @@ a2.cpp
but it might lead to files being unwantedly instrumented if the same filename but it might lead to files being unwantedly instrumented if the same filename
exists somewhere else in the project directories. exists somewhere else in the project directories.
The created instrument file list file is then set to AFL_LLVM_INSTRUMENT_FILE when you compile The created the instrument file list file is then set to AFL_LLVM_INSTRUMENT_FILE when you compile
your program. For each file that didn't match the instrument file list, the compiler will your program. For each file that didn't match the the instrument file list, the compiler will
issue a warning at the end stating that no blocks were instrumented. If you issue a warning at the end stating that no blocks were instrumented. If you
didn't intend to instrument that file, then you can safely ignore that warning. didn't intend to instrument that file, then you can safely ignore that warning.
...@@ -75,5 +75,5 @@ required anymore (and might hurt performance and crash detection, so better not ...@@ -75,5 +75,5 @@ required anymore (and might hurt performance and crash detection, so better not
use -g). use -g).
## 4) UNIX-style filename pattern matching ## 4) UNIX-style filename pattern matching
You can add UNIX-style pattern matching in the instrument file list entries. See `man You can add UNIX-style pattern matching in the the instrument file list entries. See `man
fnmatch` for the syntax. We do not set any of the `fnmatch` flags. fnmatch` for the syntax. We do not set any of the `fnmatch` flags.
...@@ -110,10 +110,10 @@ void initInstrumentList() { ...@@ -110,10 +110,10 @@ void initInstrumentList() {
bool isInInstrumentList(llvm::Function *F) { bool isInInstrumentList(llvm::Function *F) {
// is this a function with code? If it is external we dont instrument it // is this a function with code? If it is external we dont instrument it
// anyway and cant be in the instrument file list. Or if it is ignored. // anyway and cant be in the the instrument file list. Or if it is ignored.
if (!F->size() || isIgnoreFunction(F)) return false; if (!F->size() || isIgnoreFunction(F)) return false;
// if we do not have any instrument file list entries return true // if we do not have a the instrument file list return true
if (myInstrumentList.empty()) return true; if (myInstrumentList.empty()) return true;
// let's try to get the filename for the function // let's try to get the filename for the function
...@@ -218,7 +218,7 @@ bool isInInstrumentList(llvm::Function *F) { ...@@ -218,7 +218,7 @@ bool isInInstrumentList(llvm::Function *F) {
else { else {
// we could not find out the location. in this case we say it is not // we could not find out the location. in this case we say it is not
// in the instrument file list // in the the instrument file list
return false; return false;
......
...@@ -200,7 +200,7 @@ bool AFLcheckIfInstrument::runOnModule(Module &M) { ...@@ -200,7 +200,7 @@ bool AFLcheckIfInstrument::runOnModule(Module &M) {
} }
/* Either we couldn't figure out our location or the location is /* Either we couldn't figure out our location or the location is
* not listed in the instrument file list, so we skip instrumentation. * not the instrument file listed, so we skip instrumentation.
* We do this by renaming the function. */ * We do this by renaming the function. */
if (instrumentFunction == true) { if (instrumentFunction == true) {
......
...@@ -435,7 +435,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) { ...@@ -435,7 +435,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
u32 fails; u32 fails;
u8 found_one = 0; u8 found_one = 0;
/* loop cmps are useless, detect and ignore them */ /* loop cmps are useless, detect and ignores them */
u64 s_v0, s_v1; u64 s_v0, s_v1;
u8 s_v0_fixed = 1, s_v1_fixed = 1; u8 s_v0_fixed = 1, s_v1_fixed = 1;
u8 s_v0_inc = 1, s_v1_inc = 1; u8 s_v0_inc = 1, s_v1_inc = 1;
...@@ -743,7 +743,7 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len, ...@@ -743,7 +743,7 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
afl->pass_stats[k].faileds || afl->pass_stats[k].faileds ||
afl->pass_stats[k].total == 0xff)) { afl->pass_stats[k].total == 0xff)) {
afl->shm.cmp_map->headers[k].hits = 0; // ignore this cmp afl->shm.cmp_map->headers[k].hits = 0; // ignores this cmp
} }
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment