diff --git a/README.md b/README.md
index 69e2d14a1fefe3ec9669743d37a3822c574525eb..c04dba984812d7640b8578a470b18bbaa0ada9ce 100644
--- a/README.md
+++ b/README.md
@@ -90,6 +90,7 @@ behaviours and defaults:
| Feature/Instrumentation | afl-gcc | llvm | gcc_plugin | frida_mode | qemu_mode |unicorn_mode |
| -------------------------|:-------:|:---------:|:----------:|:----------:|:----------------:|:------------:|
+ | Threadsafe counters | | x(3) | | | | |
| NeverZero | x86[_64]| x(1) | x | x | x | x |
| Persistent Mode | | x | x | x86[_64] | x86[_64]/arm[64] | x |
| LAF-Intel / CompCov | | x | | | x86[_64]/arm[64] | x86[_64]/arm |
@@ -104,7 +105,7 @@ behaviours and defaults:
1. default for LLVM >= 9.0, env var for older version due an efficiency bug in previous llvm versions
2. GCC creates non-performant code, hence it is disabled in gcc_plugin
- 3. (currently unassigned)
+ 3. with `AFL_LLVM_THREADSAFE_INST`, disables NeverZero
4. with pcguard mode and LTO mode for LLVM 11 and newer
5. upcoming, development in the branch
6. not compatible with LTO instrumentation and needs at least LLVM v4.1
diff --git a/custom_mutators/examples/post_library_gif.so.c b/custom_mutators/examples/post_library_gif.so.c
index ac10f40902a891712e2de280a88ae3cfcdf47047..aec057209190dd25a560e059b6ea4aa9d9dca1c5 100644
--- a/custom_mutators/examples/post_library_gif.so.c
+++ b/custom_mutators/examples/post_library_gif.so.c
@@ -45,6 +45,7 @@
1) If you don't want to modify the test case, simply set `*out_buf = in_buf`
and return the original `len`.
+ NOTE: the following is currently NOT true, we abort in this case!
2) If you want to skip this test case altogether and have AFL generate a
new one, return 0 or set `*out_buf = NULL`.
Use this sparingly - it's faster than running the target program
@@ -53,14 +54,14 @@
3) If you want to modify the test case, allocate an appropriately-sized
buffer, move the data into that buffer, make the necessary changes, and
then return the new pointer as out_buf. Return an appropriate len
- afterwards.
+ afterwards.
Note that the buffer will *not* be freed for you. To avoid memory leaks,
you need to free it or reuse it on subsequent calls (as shown below).
*** Feel free to reuse the original 'in_buf' BUFFER and return it. ***
- Aight. The example below shows a simple postprocessor that tries to make
+ Alright. The example below shows a simple postprocessor that tries to make
sure that all input files start with "GIF89a".
PS. If you don't like C, you can try out the unix-based wrapper from
diff --git a/docs/Changelog.md b/docs/Changelog.md
index 298a3998797a7451986c4b41f62c6ee5d1116983..09e46fb680c11601e9c2e98a600409f8cdc3d683 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -22,13 +22,14 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
to allow replay of non-reproducable crashes, see
AFL_PERSISTENT_RECORD in config.h and docs/envs.h
- fixed a bug when trimming for stdin targets
- - default cmplog level (-l) is now 2, better efficiency.
- - cmplog level 3 (-l 3) now performs redqueen on everything.
- use with care.
- - better fuzzing strategy yields for enabled options
+ - cmplog -l: default cmplog level is now 2, better efficiency.
+ level 3 now performs redqueen on everything. use with care.
+ - better fuzzing strategy yield display for enabled options
- ensure one fuzzer sync per cycle
- fix afl_custom_queue_new_entry original file name when syncing
from fuzzers
+ - fixed a crash when more than one custom mutator was used together
+ with afl_custom_post_process
- on a crashing seed potentially the wrong input was disabled
- added AFL_EXIT_ON_SEED_ISSUES env that will exit if a seed in
-i dir crashes the target or results in a timeout. By default
@@ -41,6 +42,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
it fails
- afl-cc:
- We do not support llvm versions prior 6.0 anymore
+ - added thread safe counters to all modes (`AFL_LLVM_THREADSAFE_INST`),
+ note that this disables NeverZero counters.
- Fix for -pie compiled binaries with default afl-clang-fast PCGUARD
- Leak Sanitizer (AFL_USE_LSAN) added by Joshua Rogers, thanks!
- Removed InsTrim instrumentation as it is not as good as PCGUARD
diff --git a/docs/custom_mutators.md b/docs/custom_mutators.md
index 3e3ae01dab59fd4c2ea90f1274f0398235acc180..129d6676ead2f302dfb93d2ae6999c086f9a887a 100644
--- a/docs/custom_mutators.md
+++ b/docs/custom_mutators.md
@@ -123,6 +123,7 @@ def deinit(): # optional for Python
Note that this function is optional - but it makes sense to use it.
You would only skip this if `post_process` is used to fix checksums etc.
so if you are using it e.g. as a post processing library.
+ Note that a length > 0 *must* be returned!
- `describe` (optional):
diff --git a/docs/env_variables.md b/docs/env_variables.md
index 7bbc0fddb8d317e81fb0b5131eff2ba25ecd87fa..38a67bc789e34c1d6133a8c040ccdda14e8fcf74 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -231,6 +231,12 @@ Then there are a few specific features that are only available in instrumentatio
See [instrumentation/README.instrument_list.md](../instrumentation/README.instrument_list.md) for more information.
+### Thread safe instrumentation counters (in all modes)
+
+ - Setting `AFL_LLVM_THREADSAFE_INST` will inject code that implements thread
+ safe counters. The overhead is a little bit higher compared to the older
+ non-thread safe case. Note that this disables neverzero (see below).
+
### NOT_ZERO
- Setting `AFL_LLVM_NOT_ZERO=1` during compilation will use counters
diff --git a/frida_mode/src/instrument/instrument_debug.c b/frida_mode/src/instrument/instrument_debug.c
index be72ef89f7f2301175e9f3560a27ee41f963e82f..f8c1df773a363415d9c14fa2a83ce86fcbc1851b 100644
--- a/frida_mode/src/instrument/instrument_debug.c
+++ b/frida_mode/src/instrument/instrument_debug.c
@@ -17,7 +17,7 @@ static void instrument_debug(char *format, ...) {
va_list ap;
char buffer[4096] = {0};
int ret;
- int len;
+ int len;
va_start(ap, format);
ret = vsnprintf(buffer, sizeof(buffer) - 1, format, ap);
diff --git a/frida_mode/src/persistent/persistent_x64.c b/frida_mode/src/persistent/persistent_x64.c
index 4c495d471680788a5462ae33e737dfc153b89017..4cb960fcfc5d2c6778db5f473d35327260ce8e99 100644
--- a/frida_mode/src/persistent/persistent_x64.c
+++ b/frida_mode/src/persistent/persistent_x64.c
@@ -1,3 +1,4 @@
+#include <unistd.h>
#include "frida-gum.h"
#include "config.h"
diff --git a/frida_mode/src/stats/stats.c b/frida_mode/src/stats/stats.c
index 890a8d6b31d08a905795d4bfbc8f41f6ee207e59..662fb6d571f7b80f67413f8870bf9c28f38c0004 100644
--- a/frida_mode/src/stats/stats.c
+++ b/frida_mode/src/stats/stats.c
@@ -96,10 +96,10 @@ void stats_init(void) {
void stats_vprint(int fd, char *format, va_list ap) {
char buffer[4096] = {0};
- int ret;
+ int ret;
int len;
- if(vsnprintf(buffer, sizeof(buffer) - 1, format, ap) < 0) { return; }
+ if (vsnprintf(buffer, sizeof(buffer) - 1, format, ap) < 0) { return; }
len = strnlen(buffer, sizeof(buffer));
IGNORED_RETURN(write(fd, buffer, len));
diff --git a/include/debug.h b/include/debug.h
index fc1f39cb1a0817b23889ed08d5aa1f17c569ff94..f8df5711ca3fbbaf2de223664fb92d4b448eaefa 100644
--- a/include/debug.h
+++ b/include/debug.h
@@ -362,7 +362,12 @@ static inline const char *colorfilter(const char *x) {
\
s32 _len = (s32)(len); \
s32 _res = write(_fd, (buf), _len); \
- if (_res != _len) RPFATAL(_res, "Short write to %s, fd %d", fn, _fd); \
+ if (_res != _len) { \
+ \
+ RPFATAL(_res, "Short write to %s, fd %d (%d of %d bytes)", fn, _fd, \
+ _res, _len); \
+ \
+ } \
\
} while (0)
diff --git a/include/envs.h b/include/envs.h
index 08b3284a6a8963b8ec187b88cd51a9cbfad6425f..15116fc1a8a0727a55a1a43404823b3445d36973 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -126,6 +126,7 @@ static char *afl_environment_variables[] = {
"AFL_NGRAM_SIZE",
"AFL_LLVM_NOT_ZERO",
"AFL_LLVM_INSTRUMENT_FILE",
+ "AFL_LLVM_THREADSAFE_INST",
"AFL_LLVM_SKIP_NEVERZERO",
"AFL_NO_AFFINITY",
"AFL_TRY_AFFINITY",
diff --git a/instrumentation/README.llvm.md b/instrumentation/README.llvm.md
index cfe537d582190a5aa85f58c3ca9fecf526c55b6c..8ce5afb927956a5070de158ef11c6066c7f38a93 100644
--- a/instrumentation/README.llvm.md
+++ b/instrumentation/README.llvm.md
@@ -144,6 +144,11 @@ is not optimal and was only fixed in llvm 9.
You can set this with AFL_LLVM_NOT_ZERO=1
See [README.neverzero.md](README.neverzero.md)
+Support for thread safe counters has been added for all modes.
+Activate it with `AFL_LLVM_THREADSAFE_INST=1`. The tradeoff is better precision
+in multi threaded apps for a slightly higher instrumentation overhead.
+This also disables the nozero counter default for performance reasons.
+
## 4) Snapshot feature
To speed up fuzzing you can use a linux loadable kernel module which enables
diff --git a/instrumentation/README.neverzero.md b/instrumentation/README.neverzero.md
index 49104e000b386febc7515d4e99ca94465018a3f7..9bcae324d8da27ac050517370666c45df5352a21 100644
--- a/instrumentation/README.neverzero.md
+++ b/instrumentation/README.neverzero.md
@@ -16,11 +16,12 @@ at a very little cost (one instruction per edge).
(The alternative of saturated counters has been tested also and proved to be
inferior in terms of path discovery.)
-This is implemented in afl-gcc and afl-gcc-fast, however for llvm_mode this is optional if
-the llvm version is below 9 - as there is a perfomance bug that is only fixed
-in version 9 and onwards.
+This is implemented in afl-gcc and afl-gcc-fast, however for llvm_mode this is
+optional if multithread safe counters are selected or the llvm version is below
+9 - as there are severe performance costs in these cases.
-If you want to enable this for llvm versions below 9 then set
+If you want to enable this for llvm versions below 9 or thread safe counters
+then set
```
export AFL_LLVM_NOT_ZERO=1
@@ -33,3 +34,8 @@ AFL_LLVM_SKIP_NEVERZERO=1
```
If the target does not have extensive loops or functions that are called
a lot then this can give a small performance boost.
+
+Please note that the default counter implementations are not thread safe!
+
+Support for thread safe counters in mode LLVM CLASSIC can be activated with setting
+`AFL_LLVM_THREADSAFE_INST=1`.
\ No newline at end of file
diff --git a/instrumentation/SanitizerCoverageLTO.so.cc b/instrumentation/SanitizerCoverageLTO.so.cc
index 2f4337eb55a3eea330004d63889349dcbd593445..20f1856e0e128a7782f0b22eb44ebb9ca00e3882 100644
--- a/instrumentation/SanitizerCoverageLTO.so.cc
+++ b/instrumentation/SanitizerCoverageLTO.so.cc
@@ -236,7 +236,8 @@ class ModuleSanitizerCoverage {
uint32_t inst = 0;
uint32_t afl_global_id = 0;
uint64_t map_addr = 0;
- char * skip_nozero = NULL;
+ const char * skip_nozero = NULL;
+ const char * use_threadsafe_counters = nullptr;
std::vector<BasicBlock *> BlockList;
DenseMap<Value *, std::string *> valueMap;
std::vector<std::string> dictionary;
@@ -437,6 +438,7 @@ bool ModuleSanitizerCoverage::instrumentModule(
be_quiet = 1;
skip_nozero = getenv("AFL_LLVM_SKIP_NEVERZERO");
+ use_threadsafe_counters = getenv("AFL_LLVM_THREADSAFE_INST");
if ((ptr = getenv("AFL_LLVM_LTO_STARTID")) != NULL)
if ((afl_global_id = atoi(ptr)) < 0)
@@ -1208,7 +1210,7 @@ void ModuleSanitizerCoverage::instrumentFunction(
return; // Should not instrument sanitizer init functions.
if (F.getName().startswith("__sanitizer_"))
return; // Don't instrument __sanitizer_* callbacks.
- // Don't touch available_externally functions, their actual body is elewhere.
+ // Don't touch available_externally functions, their actual body is elsewhere.
if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage) return;
// Don't instrument MSVC CRT configuration helpers. They may run before normal
// initialization.
@@ -1495,22 +1497,31 @@ void ModuleSanitizerCoverage::InjectCoverageAtBlock(Function &F, BasicBlock &BB,
}
/* Update bitmap */
+ if (use_threadsafe_counters) { /* Atomic */
- LoadInst *Counter = IRB.CreateLoad(MapPtrIdx);
- Counter->setMetadata(Mo->getMDKindID("nosanitize"), MDNode::get(*Ct, None));
+ IRB.CreateAtomicRMW(llvm::AtomicRMWInst::BinOp::Add, MapPtrIdx, One,
+ llvm::AtomicOrdering::Monotonic);
- Value *Incr = IRB.CreateAdd(Counter, One);
+ } else {
- if (skip_nozero == NULL) {
+ LoadInst *Counter = IRB.CreateLoad(MapPtrIdx);
+ Counter->setMetadata(Mo->getMDKindID("nosanitize"),
+ MDNode::get(*Ct, None));
- auto cf = IRB.CreateICmpEQ(Incr, Zero);
- auto carry = IRB.CreateZExt(cf, Int8Tyi);
- Incr = IRB.CreateAdd(Incr, carry);
+ Value *Incr = IRB.CreateAdd(Counter, One);
- }
+ if (skip_nozero == NULL) {
- IRB.CreateStore(Incr, MapPtrIdx)
- ->setMetadata(Mo->getMDKindID("nosanitize"), MDNode::get(*Ct, None));
+ auto cf = IRB.CreateICmpEQ(Incr, Zero);
+ auto carry = IRB.CreateZExt(cf, Int8Tyi);
+ Incr = IRB.CreateAdd(Incr, carry);
+
+ }
+
+ IRB.CreateStore(Incr, MapPtrIdx)
+ ->setMetadata(Mo->getMDKindID("nosanitize"), MDNode::get(*Ct, None));
+
+ }
// done :)
diff --git a/instrumentation/SanitizerCoveragePCGUARD.so.cc b/instrumentation/SanitizerCoveragePCGUARD.so.cc
index 8878d3b14ee1a3b5f09a38d9f1f7f103637d7156..4a8c9e284770c38ee22ca1a0f22b2b49e67c1977 100644
--- a/instrumentation/SanitizerCoveragePCGUARD.so.cc
+++ b/instrumentation/SanitizerCoveragePCGUARD.so.cc
@@ -86,7 +86,8 @@ const char SanCovPCsSectionName[] = "sancov_pcs";
const char SanCovLowestStackName[] = "__sancov_lowest_stack";
-static char *skip_nozero;
+static const char *skip_nozero;
+static const char *use_threadsafe_counters;
namespace {
@@ -386,6 +387,7 @@ bool ModuleSanitizerCoverage::instrumentModule(
be_quiet = 1;
skip_nozero = getenv("AFL_LLVM_SKIP_NEVERZERO");
+ use_threadsafe_counters = getenv("AFL_LLVM_THREADSAFE_INST");
initInstrumentList();
scanForDangerousFunctions(&M);
@@ -1067,22 +1069,31 @@ void ModuleSanitizerCoverage::InjectCoverageAtBlock(Function &F, BasicBlock &BB,
/* Load counter for CurLoc */
- Value * MapPtrIdx = IRB.CreateGEP(MapPtr, CurLoc);
- LoadInst *Counter = IRB.CreateLoad(MapPtrIdx);
+ Value *MapPtrIdx = IRB.CreateGEP(MapPtr, CurLoc);
- /* Update bitmap */
+ if (use_threadsafe_counters) {
- Value *Incr = IRB.CreateAdd(Counter, One);
+ IRB.CreateAtomicRMW(llvm::AtomicRMWInst::BinOp::Add, MapPtrIdx, One,
+ llvm::AtomicOrdering::Monotonic);
- if (skip_nozero == NULL) {
+ } else {
- auto cf = IRB.CreateICmpEQ(Incr, Zero);
- auto carry = IRB.CreateZExt(cf, Int8Ty);
- Incr = IRB.CreateAdd(Incr, carry);
+ LoadInst *Counter = IRB.CreateLoad(MapPtrIdx);
+ /* Update bitmap */
- }
+ Value *Incr = IRB.CreateAdd(Counter, One);
+
+ if (skip_nozero == NULL) {
+
+ auto cf = IRB.CreateICmpEQ(Incr, Zero);
+ auto carry = IRB.CreateZExt(cf, Int8Ty);
+ Incr = IRB.CreateAdd(Incr, carry);
- IRB.CreateStore(Incr, MapPtrIdx);
+ }
+
+ IRB.CreateStore(Incr, MapPtrIdx);
+
+ }
// done :)
diff --git a/instrumentation/afl-llvm-lto-instrumentation.so.cc b/instrumentation/afl-llvm-lto-instrumentation.so.cc
index 68bd2fa512afc5705b2a93c1fd4b8953f1125e4e..fe43fbe5588dc14d7557fc9b538ac3c563599848 100644
--- a/instrumentation/afl-llvm-lto-instrumentation.so.cc
+++ b/instrumentation/afl-llvm-lto-instrumentation.so.cc
@@ -93,7 +93,8 @@ class AFLLTOPass : public ModulePass {
uint32_t function_minimum_size = 1;
uint32_t inst_blocks = 0, inst_funcs = 0, total_instr = 0;
unsigned long long int map_addr = 0x10000;
- char * skip_nozero = NULL;
+ const char * skip_nozero = NULL;
+ const char * use_threadsafe_counters = nullptr;
};
@@ -131,6 +132,8 @@ bool AFLLTOPass::runOnModule(Module &M) {
be_quiet = 1;
+ use_threadsafe_counters = getenv("AFL_LLVM_THREADSAFE_INST");
+
if ((ptr = getenv("AFL_LLVM_DOCUMENT_IDS")) != NULL) {
if ((documentFile = fopen(ptr, "a")) == NULL)
@@ -839,22 +842,32 @@ bool AFLLTOPass::runOnModule(Module &M) {
/* Update bitmap */
- LoadInst *Counter = IRB.CreateLoad(MapPtrIdx);
- Counter->setMetadata(M.getMDKindID("nosanitize"),
- MDNode::get(C, None));
+ if (use_threadsafe_counters) {
+
+ IRB.CreateAtomicRMW(llvm::AtomicRMWInst::BinOp::Add, MapPtrIdx, One,
+ llvm::AtomicOrdering::Monotonic);
- Value *Incr = IRB.CreateAdd(Counter, One);
+ } else {
- if (skip_nozero == NULL) {
+ LoadInst *Counter = IRB.CreateLoad(MapPtrIdx);
+ Counter->setMetadata(M.getMDKindID("nosanitize"),
+ MDNode::get(C, None));
- auto cf = IRB.CreateICmpEQ(Incr, Zero);
- auto carry = IRB.CreateZExt(cf, Int8Ty);
- Incr = IRB.CreateAdd(Incr, carry);
+ Value *Incr = IRB.CreateAdd(Counter, One);
- }
+ if (skip_nozero == NULL) {
- IRB.CreateStore(Incr, MapPtrIdx)
- ->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
+ auto cf = IRB.CreateICmpEQ(Incr, Zero);
+ auto carry = IRB.CreateZExt(cf, Int8Ty);
+ Incr = IRB.CreateAdd(Incr, carry);
+
+ }
+
+ IRB.CreateStore(Incr, MapPtrIdx)
+ ->setMetadata(M.getMDKindID("nosanitize"),
+ MDNode::get(C, None));
+
+ }
// done :)
diff --git a/instrumentation/afl-llvm-pass.so.cc b/instrumentation/afl-llvm-pass.so.cc
index 0f773aba40fa0832bd54bb981e55c412f509d57e..a8f1baffe8fc1ae83beea2705b86a1c9ce616990 100644
--- a/instrumentation/afl-llvm-pass.so.cc
+++ b/instrumentation/afl-llvm-pass.so.cc
@@ -81,11 +81,12 @@ class AFLCoverage : public ModulePass {
bool runOnModule(Module &M) override;
protected:
- uint32_t ngram_size = 0;
- uint32_t ctx_k = 0;
- uint32_t map_size = MAP_SIZE;
- uint32_t function_minimum_size = 1;
- char * ctx_str = NULL, *caller_str = NULL, *skip_nozero = NULL;
+ uint32_t ngram_size = 0;
+ uint32_t ctx_k = 0;
+ uint32_t map_size = MAP_SIZE;
+ uint32_t function_minimum_size = 1;
+ const char *ctx_str = NULL, *caller_str = NULL, *skip_nozero = NULL;
+ const char *use_threadsafe_counters = nullptr;
};
@@ -182,6 +183,38 @@ bool AFLCoverage::runOnModule(Module &M) {
char *neverZero_counters_str = getenv("AFL_LLVM_NOT_ZERO");
#endif
skip_nozero = getenv("AFL_LLVM_SKIP_NEVERZERO");
+ use_threadsafe_counters = getenv("AFL_LLVM_THREADSAFE_INST");
+
+ if ((isatty(2) && !getenv("AFL_QUIET")) || !!getenv("AFL_DEBUG")) {
+
+ if (use_threadsafe_counters) {
+
+ // disabled unless there is support for other modules as well
+ // (increases documentation complexity)
+ /* if (!getenv("AFL_LLVM_NOT_ZERO")) { */
+
+ skip_nozero = "1";
+ SAYF(cCYA "afl-llvm-pass" VERSION cRST " using thread safe counters\n");
+
+ /*
+
+ } else {
+
+ SAYF(cCYA "afl-llvm-pass" VERSION cRST
+ " using thread safe not-zero-counters\n");
+
+ }
+
+ */
+
+ } else {
+
+ SAYF(cCYA "afl-llvm-pass" VERSION cRST
+ " using non-thread safe instrumentation\n");
+
+ }
+
+ }
unsigned PrevLocSize = 0;
unsigned PrevCallerSize = 0;
@@ -388,7 +421,6 @@ bool AFLCoverage::runOnModule(Module &M) {
#endif
// other constants we need
- ConstantInt *Zero = ConstantInt::get(Int8Ty, 0);
ConstantInt *One = ConstantInt::get(Int8Ty, 1);
Value * PrevCtx = NULL; // CTX sensitive coverage
@@ -410,6 +442,7 @@ bool AFLCoverage::runOnModule(Module &M) {
if (F.size() < function_minimum_size) continue;
+ std::list<Value *> todo;
for (auto &BB : F) {
BasicBlock::iterator IP = BB.getFirstInsertionPt();
@@ -628,37 +661,68 @@ bool AFLCoverage::runOnModule(Module &M) {
/* Update bitmap */
- LoadInst *Counter = IRB.CreateLoad(MapPtrIdx);
- Counter->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
+ if (use_threadsafe_counters) { /* Atomic */
+ /*
+ #if LLVM_VERSION_MAJOR < 9
+ if (neverZero_counters_str !=
+ NULL) { // with llvm 9 we make this the default as the bug
+ in llvm
+ // is then fixed
+ #else
+ if (!skip_nozero) {
+
+ #endif
+ // register MapPtrIdx in a todo list
+ todo.push_back(MapPtrIdx);
+
+ } else {
+
+ */
+ IRB.CreateAtomicRMW(llvm::AtomicRMWInst::BinOp::Add, MapPtrIdx, One,
+ llvm::AtomicOrdering::Monotonic);
+ /*
+
+ }
+
+ */
- Value *Incr = IRB.CreateAdd(Counter, One);
+ } else {
+
+ LoadInst *Counter = IRB.CreateLoad(MapPtrIdx);
+ Counter->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
+
+ Value *Incr = IRB.CreateAdd(Counter, One);
#if LLVM_VERSION_MAJOR < 9
- if (neverZero_counters_str !=
- NULL) { // with llvm 9 we make this the default as the bug in llvm is
- // then fixed
+ if (neverZero_counters_str !=
+ NULL) { // with llvm 9 we make this the default as the bug in llvm
+ // is then fixed
#else
- if (!skip_nozero) {
+ if (!skip_nozero) {
#endif
- /* hexcoder: Realize a counter that skips zero during overflow.
- * Once this counter reaches its maximum value, it next increments to 1
- *
- * Instead of
- * Counter + 1 -> Counter
- * we inject now this
- * Counter + 1 -> {Counter, OverflowFlag}
- * Counter + OverflowFlag -> Counter
- */
+ /* hexcoder: Realize a counter that skips zero during overflow.
+ * Once this counter reaches its maximum value, it next increments to
+ * 1
+ *
+ * Instead of
+ * Counter + 1 -> Counter
+ * we inject now this
+ * Counter + 1 -> {Counter, OverflowFlag}
+ * Counter + OverflowFlag -> Counter
+ */
+
+ ConstantInt *Zero = ConstantInt::get(Int8Ty, 0);
+ auto cf = IRB.CreateICmpEQ(Incr, Zero);
+ auto carry = IRB.CreateZExt(cf, Int8Ty);
+ Incr = IRB.CreateAdd(Incr, carry);
- auto cf = IRB.CreateICmpEQ(Incr, Zero);
- auto carry = IRB.CreateZExt(cf, Int8Ty);
- Incr = IRB.CreateAdd(Incr, carry);
+ }
- }
+ IRB.CreateStore(Incr, MapPtrIdx)
+ ->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
- IRB.CreateStore(Incr, MapPtrIdx)
- ->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
+ } /* non atomic case */
/* Update prev_loc history vector (by placing cur_loc at the head of the
vector and shuffle the other elements back by one) */
@@ -715,6 +779,120 @@ bool AFLCoverage::runOnModule(Module &M) {
}
+#if 0
+ if (use_threadsafe_counters) { /*Atomic NeverZero */
+ // handle the list of registered blocks to instrument
+ for (auto val : todo) {
+
+ /* hexcoder: Realize a thread-safe counter that skips zero during
+ * overflow. Once this counter reaches its maximum value, it next
+ * increments to 1
+ *
+ * Instead of
+ * Counter + 1 -> Counter
+ * we inject now this
+ * Counter + 1 -> {Counter, OverflowFlag}
+ * Counter + OverflowFlag -> Counter
+ */
+
+ /* equivalent c code looks like this
+ * Thanks to
+ https://preshing.com/20150402/you-can-do-any-kind-of-atomic-read-modify-write-operation/
+
+ int old = atomic_load_explicit(&Counter, memory_order_relaxed);
+ int new;
+ do {
+
+ if (old == 255) {
+
+ new = 1;
+
+ } else {
+
+ new = old + 1;
+
+ }
+
+ } while (!atomic_compare_exchange_weak_explicit(&Counter, &old, new,
+
+ memory_order_relaxed, memory_order_relaxed));
+
+ */
+
+ Value * MapPtrIdx = val;
+ Instruction * MapPtrIdxInst = cast<Instruction>(val);
+ BasicBlock::iterator it0(&(*MapPtrIdxInst));
+ ++it0;
+ IRBuilder<> IRB(&(*it0));
+
+ // load the old counter value atomically
+ LoadInst *Counter = IRB.CreateLoad(MapPtrIdx);
+ Counter->setAlignment(llvm::Align());
+ Counter->setAtomic(llvm::AtomicOrdering::Monotonic);
+ Counter->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
+
+ BasicBlock *BB = IRB.GetInsertBlock();
+ // insert a basic block with the corpus of a do while loop
+ // the calculation may need to repeat, if atomic compare_exchange is not
+ // successful
+
+ BasicBlock::iterator it(*Counter);
+ it++; // split after load counter
+ BasicBlock *end_bb = BB->splitBasicBlock(it);
+ end_bb->setName("injected");
+
+ // insert the block before the second half of the split
+ BasicBlock *do_while_bb =
+ BasicBlock::Create(C, "injected", end_bb->getParent(), end_bb);
+
+ // set terminator of BB from target end_bb to target do_while_bb
+ auto term = BB->getTerminator();
+ BranchInst::Create(do_while_bb, BB);
+ term->eraseFromParent();
+
+ // continue to fill instructions into the do_while loop
+ IRB.SetInsertPoint(do_while_bb, do_while_bb->getFirstInsertionPt());
+
+ PHINode *PN = IRB.CreatePHI(Int8Ty, 2);
+
+ // compare with maximum value 0xff
+ auto *Cmp = IRB.CreateICmpEQ(Counter, ConstantInt::get(Int8Ty, -1));
+
+ // increment the counter
+ Value *Incr = IRB.CreateAdd(Counter, One);
+
+ // select the counter value or 1
+ auto *Select = IRB.CreateSelect(Cmp, One, Incr);
+
+ // try to save back the new counter value
+ auto *CmpXchg = IRB.CreateAtomicCmpXchg(
+ MapPtrIdx, PN, Select, llvm::AtomicOrdering::Monotonic,
+ llvm::AtomicOrdering::Monotonic);
+ CmpXchg->setAlignment(llvm::Align());
+ CmpXchg->setWeak(true);
+ CmpXchg->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
+
+ // get the result of trying to update the Counter
+ Value *Success =
+ IRB.CreateExtractValue(CmpXchg, ArrayRef<unsigned>({1}));
+ // get the (possibly updated) value of Counter
+ Value *OldVal =
+ IRB.CreateExtractValue(CmpXchg, ArrayRef<unsigned>({0}));
+
+ // initially we use Counter
+ PN->addIncoming(Counter, BB);
+ // on retry, we use the updated value
+ PN->addIncoming(OldVal, do_while_bb);
+
+ // if the cmpXchg was not successful, retry
+ IRB.CreateCondBr(Success, end_bb, do_while_bb);
+
+ }
+
+ }
+
+#endif
+
}
/*
diff --git a/qemu_mode/libqasan/libqasan.c b/qemu_mode/libqasan/libqasan.c
index d4742e3e308492951992728112dea5a4eb169aec..6ea24f085a2130ad15b91b600bf502182275e12f 100644
--- a/qemu_mode/libqasan/libqasan.c
+++ b/qemu_mode/libqasan/libqasan.c
@@ -69,9 +69,8 @@ __attribute__((constructor)) void __libqasan_init() {
__libqasan_is_initialized = 1;
__libqasan_init_hooks();
-
- if (getenv("AFL_INST_LIBS") || getenv("QASAN_HOTPACH"))
- __libqasan_hotpatch();
+
+ if (getenv("AFL_INST_LIBS") || getenv("QASAN_HOTPACH")) __libqasan_hotpatch();
if (getenv("AFL_INST_LIBS") || getenv("QASAN_HOTPACH")) __libqasan_hotpatch();
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 8af8e7b08ba235120dcb572544c11b0ae4ae713b..486f74686cb0145eb3af58eec78da983141d3396 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -1777,6 +1777,8 @@ int main(int argc, char **argv, char **envp) {
SAYF(
"\nLLVM/LTO/afl-clang-fast/afl-clang-lto specific environment "
"variables:\n"
+ " AFL_LLVM_THREADSAFE_INST: instrument with thread safe counters, "
+ "disables neverzero\n"
COUNTER_BEHAVIOUR
diff --git a/src/afl-common.c b/src/afl-common.c
index 8826de70967ced8cbfbff434d6981f62bec93feb..c61ce3d8247f2493a345a563c40f6739eee51e35 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -479,9 +479,17 @@ void print_suggested_envs(char *mispelled_env) {
size_t end = start + strcspn(afl_env + start, "_") + 1;
memcpy(reduced, afl_env, start);
- if (end < afl_env_len)
+ if (end < afl_env_len) {
+
memcpy(reduced + start, afl_env + end, afl_env_len - end);
- reduced[afl_env_len - end + start] = 0;
+
+ }
+
+ if (afl_env_len + start >= end) {
+
+ reduced[afl_env_len - end + start] = 0;
+
+ }
int distance = string_distance_levenshtein(reduced, env_name);
if (distance < ENV_SIMILARITY_TRESHOLD && seen[j] == 0) {
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 4a3e7f33f2c06e91db58bdab4d3e3f360d686e60..c3ce2edd30b7bdd8f9e5ca75463698048f1092d5 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -561,6 +561,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
if (afl->cmplog_lvl == 3 ||
(afl->cmplog_lvl == 2 && afl->queue_cur->tc_ref) ||
+ afl->queue_cur->favored ||
!(afl->fsrv.total_execs % afl->queued_paths) ||
get_cur_time() - afl->last_path_time > 300000) { // 300 seconds
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index cf1e5ea50b3fb81f64ae88f4e725521a5d0398d4..22fd062149c2e57d45ec707f5bbd0226c38c9c52 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -438,7 +438,7 @@ static u8 colorization(afl_state_t *afl, u8 *buf, u32 len,
if (taint) {
if (afl->colorize_success && afl->cmplog_lvl < 3 &&
- (len / positions == 1 && positions > CMPLOG_POSITIONS_MAX &&
+ (positions > CMPLOG_POSITIONS_MAX && len / positions == 1 &&
afl->active_paths / afl->colorize_success > CMPLOG_CORPUS_PERCENT)) {
#ifdef _DEBUG
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 5a4816394d68d71555b653be8b1635acb5268aad..2c3e8a1b5a4bb6f09f5c19ae5631a8f376e078be 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -107,27 +107,21 @@ write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
new_size =
el->afl_custom_post_process(el->data, new_mem, new_size, &new_buf);
- }
-
- new_mem = new_buf;
-
- });
+ if (unlikely(!new_buf && new_size <= 0)) {
- if (unlikely(!new_buf && (new_size <= 0))) {
-
- FATAL("Custom_post_process failed (ret: %lu)", (long unsigned)new_size);
+ FATAL("Custom_post_process failed (ret: %lu)",
+ (long unsigned)new_size);
- } else if (likely(new_buf)) {
+ }
- /* everything as planned. use the new data. */
- afl_fsrv_write_to_testcase(&afl->fsrv, new_buf, new_size);
+ new_mem = new_buf;
- } else {
+ }
- /* custom mutators do not has a custom_post_process function */
- afl_fsrv_write_to_testcase(&afl->fsrv, mem, len);
+ });
- }
+ /* everything as planned. use the potentially new data. */
+ afl_fsrv_write_to_testcase(&afl->fsrv, new_mem, new_size);
} else {
@@ -188,16 +182,16 @@ static void write_with_gap(afl_state_t *afl, u8 *mem, u32 len, u32 skip_at,
new_size =
el->afl_custom_post_process(el->data, new_mem, new_size, &new_buf);
- if (unlikely(!new_buf || (new_size <= 0))) {
+ if (unlikely(!new_buf || new_size <= 0)) {
FATAL("Custom_post_process failed (ret: %lu)",
(long unsigned)new_size);
}
- }
+ new_mem = new_buf;
- new_mem = new_buf;
+ }
});
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index a3a623d9f74d3a593626e947676873def93ee5b1..5bdb4c8d67d6949d927b2f89a0a332a23972242d 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -2066,13 +2066,10 @@ int main(int argc, char **argv_orig, char **envp) {
break;
case 4:
afl->expand_havoc = 5;
- if (afl->cmplog_lvl && afl->cmplog_lvl < 3) afl->cmplog_lvl = 3;
+ // if (afl->cmplog_lvl && afl->cmplog_lvl < 3) afl->cmplog_lvl =
+ // 3;
break;
case 5:
- // if not in sync mode, enable deterministic mode?
- // if (!afl->sync_id) afl->skip_deterministic = 0;
- afl->expand_havoc = 6;
- case 6:
// nothing else currently
break;
diff --git a/test/test-llvm.sh b/test/test-llvm.sh
index 06d0a0f8690f7d59e7e3fbeb4c779f5b6192b0ac..1152cc4edb1d2f69219ef228cf18281e46522184 100755
--- a/test/test-llvm.sh
+++ b/test/test-llvm.sh
@@ -43,6 +43,36 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && {
$ECHO "$RED[!] llvm_mode failed"
CODE=1
}
+ AFL_LLVM_INSTRUMENT=CLASSIC AFL_LLVM_THREADSAFE_INST=1 ../afl-clang-fast -o test-instr.ts ../test-instr.c > /dev/null 2>&1
+ test -e test-instr.ts && {
+ $ECHO "$GREEN[+] llvm_mode threadsafe compilation succeeded"
+ echo 0 | AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.ts.0 -r -- ./test-instr.ts > /dev/null 2>&1
+ AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.ts.1 -r -- ./test-instr.ts < /dev/null > /dev/null 2>&1
+ test -e test-instr.ts.0 -a -e test-instr.ts.1 && {
+ diff test-instr.ts.0 test-instr.ts.1 > /dev/null 2>&1 && {
+ $ECHO "$RED[!] llvm_mode threadsafe instrumentation should be different on different input but is not"
+ CODE=1
+ } || {
+ $ECHO "$GREEN[+] llvm_mode threadsafe instrumentation present and working correctly"
+ TUPLES=`echo 0|AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.ts 2>&1 | grep Captur | awk '{print$3}'`
+ test "$TUPLES" -gt 2 -a "$TUPLES" -lt 8 && {
+ $ECHO "$GREEN[+] llvm_mode run reported $TUPLES threadsafe instrumented locations which is fine"
+ } || {
+ $ECHO "$RED[!] llvm_mode threadsafe instrumentation produces weird numbers: $TUPLES"
+ CODE=1
+ }
+ test "$TUPLES" -lt 3 && SKIP=1
+ true
+ }
+ } || {
+ $ECHO "$RED[!] llvm_mode threadsafe instrumentation failed"
+ CODE=1
+ }
+ rm -f test-instr.ts.0 test-instr.ts.1
+ } || {
+ $ECHO "$RED[!] llvm_mode (threadsafe) failed"
+ CODE=1
+ }
../afl-clang-fast -DTEST_SHARED_OBJECT=1 -z defs -fPIC -shared -o test-instr.so ../test-instr.c > /dev/null 2>&1
test -e test-instr.so && {
$ECHO "$GREEN[+] llvm_mode shared object with -z defs compilation succeeded"