Skip to content

Commit 4eb8c66

Browse files
vanhauser-thcvanhauser-thc
committed
make compatible to new cmplog
1 parent 71ed0d2 commit 4eb8c66

File tree

4 files changed

+131
-40
lines changed

4 files changed

+131
-40
lines changed

‎accel/tcg/cpu-exec.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -629,7 +629,7 @@ void afl_forkserver(CPUState *cpu) {
629629
status |= (FS_OPT_SET_MAPSIZE(MAP_SIZE) | FS_OPT_MAPSIZE);
630630
if (lkm_snapshot) status |= FS_OPT_SNAPSHOT;
631631
if (sharedmem_fuzzing != 0) status |= FS_OPT_SHDMEM_FUZZ;
632-
if (status) status |= (FS_OPT_ENABLED);
632+
if (status) status |= (FS_OPT_ENABLED | FS_OPT_NEWCMPLOG);
633633
if (getenv("AFL_DEBUG"))
634634
fprintf(stderr, "Debug: Sending status %08x\n", status);
635635
memcpy(tmp, &status, 4);

‎accel/tcg/tcg-runtime.c

Lines changed: 69 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -117,13 +117,23 @@ void HELPER(afl_cmplog_8)(target_ulong cur_loc, target_ulong arg1,
117117
target_ulong arg2) {
118118

119119
register uintptr_t k = (uintptr_t)cur_loc;
120+
u32 hits = 0;
120121

121-
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
122+
if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS)
123+
__afl_cmp_map->headers[k].hits = 0;
122124

123-
u32 hits = __afl_cmp_map->headers[k].hits;
124-
__afl_cmp_map->headers[k].hits = hits + 1;
125+
if (__afl_cmp_map->headers[k].hits == 0) {
126+
127+
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
128+
__afl_cmp_map->headers[k].shape = 0;
125129

126-
__afl_cmp_map->headers[k].shape = 0;
130+
} else {
131+
132+
hits = __afl_cmp_map->headers[k].hits;
133+
134+
}
135+
136+
__afl_cmp_map->headers[k].hits = hits + 1;
127137

128138
hits &= CMP_MAP_H - 1;
129139
__afl_cmp_map->log[k][hits].v0 = arg1;
@@ -135,13 +145,23 @@ void HELPER(afl_cmplog_16)(target_ulong cur_loc, target_ulong arg1,
135145
target_ulong arg2) {
136146

137147
register uintptr_t k = (uintptr_t)cur_loc;
148+
u32 hits = 0;
138149

139-
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
150+
if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS)
151+
__afl_cmp_map->headers[k].hits = 0;
140152

141-
u32 hits = __afl_cmp_map->headers[k].hits;
142-
__afl_cmp_map->headers[k].hits = hits + 1;
153+
if (__afl_cmp_map->headers[k].hits == 0) {
143154

144-
__afl_cmp_map->headers[k].shape = 1;
155+
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
156+
__afl_cmp_map->headers[k].shape = 1;
157+
158+
} else {
159+
160+
hits = __afl_cmp_map->headers[k].hits;
161+
162+
}
163+
164+
__afl_cmp_map->headers[k].hits = hits + 1;
145165

146166
hits &= CMP_MAP_H - 1;
147167
__afl_cmp_map->log[k][hits].v0 = arg1;
@@ -153,13 +173,23 @@ void HELPER(afl_cmplog_32)(target_ulong cur_loc, target_ulong arg1,
153173
target_ulong arg2) {
154174

155175
register uintptr_t k = (uintptr_t)cur_loc;
176+
u32 hits = 0;
156177

157-
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
178+
if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS)
179+
__afl_cmp_map->headers[k].hits = 0;
158180

159-
u32 hits = __afl_cmp_map->headers[k].hits;
160-
__afl_cmp_map->headers[k].hits = hits + 1;
181+
if (__afl_cmp_map->headers[k].hits == 0) {
161182

162-
__afl_cmp_map->headers[k].shape = 3;
183+
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
184+
__afl_cmp_map->headers[k].shape = 3;
185+
186+
} else {
187+
188+
hits = __afl_cmp_map->headers[k].hits;
189+
190+
}
191+
192+
__afl_cmp_map->headers[k].hits = hits + 1;
163193

164194
hits &= CMP_MAP_H - 1;
165195
__afl_cmp_map->log[k][hits].v0 = arg1;
@@ -171,13 +201,23 @@ void HELPER(afl_cmplog_64)(target_ulong cur_loc, target_ulong arg1,
171201
target_ulong arg2) {
172202

173203
register uintptr_t k = (uintptr_t)cur_loc;
204+
u32 hits = 0;
174205

175-
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
206+
if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS)
207+
__afl_cmp_map->headers[k].hits = 0;
176208

177-
u32 hits = __afl_cmp_map->headers[k].hits;
178-
__afl_cmp_map->headers[k].hits = hits + 1;
209+
if (__afl_cmp_map->headers[k].hits == 0) {
179210

180-
__afl_cmp_map->headers[k].shape = 7;
211+
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
212+
__afl_cmp_map->headers[k].shape = 7;
213+
214+
} else {
215+
216+
hits = __afl_cmp_map->headers[k].hits;
217+
218+
}
219+
220+
__afl_cmp_map->headers[k].hits = hits + 1;
181221

182222
hits &= CMP_MAP_H - 1;
183223
__afl_cmp_map->log[k][hits].v0 = arg1;
@@ -245,18 +285,25 @@ void HELPER(afl_cmplog_rtn)(CPUArchState *env) {
245285
k = (k >> 4) ^ (k << 8);
246286
k &= CMP_MAP_W - 1;
247287

248-
__afl_cmp_map->headers[k].type = CMP_TYPE_RTN;
288+
u32 hits = 0;
249289

250-
u32 hits = __afl_cmp_map->headers[k].hits;
251-
__afl_cmp_map->headers[k].hits = hits + 1;
290+
if (__afl_cmp_map->headers[k].type != CMP_TYPE_RTN) {
291+
__afl_cmp_map->headers[k].type = CMP_TYPE_RTN;
292+
__afl_cmp_map->headers[k].hits = 0;
293+
__afl_cmp_map->headers[k].shape = 30;
294+
} else {
295+
hits = __afl_cmp_map->headers[k].hits;
296+
}
252297

253-
__afl_cmp_map->headers[k].shape = 31;
298+
__afl_cmp_map->headers[k].hits += 1;
254299

255300
hits &= CMP_MAP_RTN_H - 1;
301+
((struct cmpfn_operands *)__afl_cmp_map->log[k])[hits].v0_len = 31;
302+
((struct cmpfn_operands *)__afl_cmp_map->log[k])[hits].v1_len = 31;
256303
__builtin_memcpy(((struct cmpfn_operands *)__afl_cmp_map->log[k])[hits].v0,
257-
ptr1, 32);
304+
ptr1, 31);
258305
__builtin_memcpy(((struct cmpfn_operands *)__afl_cmp_map->log[k])[hits].v1,
259-
ptr2, 32);
306+
ptr2, 31);
260307

261308
}
262309

‎qemuafl/imported/cmplog.h

Lines changed: 22 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -29,42 +29,47 @@
2929
#define _AFL_CMPLOG_H
3030

3131
#include "config.h"
32-
//#include "forkserver.h"
32+
33+
#define CMPLOG_LVL_MAX 3
3334

3435
#define CMP_MAP_W 65536
35-
#define CMP_MAP_H 256
36+
#define CMP_MAP_H 32
3637
#define CMP_MAP_RTN_H (CMP_MAP_H / 4)
3738

3839
#define SHAPE_BYTES(x) (x + 1)
3940

40-
#define CMP_TYPE_INS 0
41-
#define CMP_TYPE_RTN 1
41+
#define CMP_TYPE_INS 1
42+
#define CMP_TYPE_RTN 2
4243

4344
struct cmp_header {
4445

45-
unsigned hits : 20;
46-
47-
unsigned cnt : 20;
48-
unsigned id : 16;
49-
50-
unsigned shape : 5; // from 0 to 31
51-
unsigned type : 1;
46+
unsigned hits : 24;
47+
unsigned id : 24;
48+
unsigned shape : 5;
49+
unsigned type : 2;
50+
unsigned attribute : 4;
51+
unsigned overflow : 1;
52+
unsigned reserved : 4;
5253

5354
} __attribute__((packed));
5455

5556
struct cmp_operands {
5657

5758
u64 v0;
5859
u64 v1;
60+
u64 v0_128;
61+
u64 v1_128;
5962

60-
};
63+
} __attribute__((packed));
6164

6265
struct cmpfn_operands {
6366

64-
u8 v0[32];
65-
u8 v1[32];
67+
u8 v0[31];
68+
u8 v0_len;
69+
u8 v1[31];
70+
u8 v1_len;
6671

67-
};
72+
} __attribute__((packed));
6873

6974
typedef struct cmp_operands cmp_map_list[CMP_MAP_H];
7075

@@ -77,7 +82,8 @@ struct cmp_map {
7782

7883
/* Execs the child */
7984

80-
//void cmplog_exec_child(afl_forkserver_t *fsrv, char **argv);
85+
struct afl_forkserver;
86+
void cmplog_exec_child(struct afl_forkserver *fsrv, char **argv);
8187

8288
#endif
8389

‎qemuafl/imported/types.h

Lines changed: 39 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,15 @@
2525

2626
#include <stdint.h>
2727
#include <stdlib.h>
28+
#include "config.h"
2829

2930
typedef uint8_t u8;
3031
typedef uint16_t u16;
3132
typedef uint32_t u32;
33+
#ifdef WORD_SIZE_64
34+
typedef unsigned __int128 uint128_t;
35+
typedef uint128_t u128;
36+
#endif
3237

3338
/* Extended forkserver option values */
3439

@@ -41,16 +46,18 @@ typedef uint32_t u32;
4146
#define FS_ERROR_SHM_OPEN 4
4247
#define FS_ERROR_SHMAT 8
4348
#define FS_ERROR_MMAP 16
49+
#define FS_ERROR_OLD_CMPLOG 32
4450

4551
/* Reporting options */
4652
#define FS_OPT_ENABLED 0x80000001
4753
#define FS_OPT_MAPSIZE 0x40000000
4854
#define FS_OPT_SNAPSHOT 0x20000000
4955
#define FS_OPT_AUTODICT 0x10000000
5056
#define FS_OPT_SHDMEM_FUZZ 0x01000000
57+
#define FS_OPT_NEWCMPLOG 0x02000000
5158
#define FS_OPT_OLD_AFLPP_WORKAROUND 0x0f000000
5259
// FS_OPT_MAX_MAPSIZE is 8388608 = 0x800000 = 2^23 = 1 << 22
53-
#define FS_OPT_MAX_MAPSIZE ((0x00fffffe >> 1) + 1)
60+
#define FS_OPT_MAX_MAPSIZE ((0x00fffffeU >> 1) + 1)
5461
#define FS_OPT_GET_MAPSIZE(x) (((x & 0x00fffffe) >> 1) + 1)
5562
#define FS_OPT_SET_MAPSIZE(x) \
5663
(x <= 1 || x > FS_OPT_MAX_MAPSIZE ? 0 : ((x - 1) << 1))
@@ -61,6 +68,10 @@ typedef int8_t s8;
6168
typedef int16_t s16;
6269
typedef int32_t s32;
6370
typedef int64_t s64;
71+
#ifdef WORD_SIZE_64
72+
typedef __int128 int128_t;
73+
typedef int128_t s128;
74+
#endif
6475

6576
#ifndef MIN
6677
#define MIN(a, b) \
@@ -114,6 +125,33 @@ typedef int64_t s64;
114125
\
115126
})
116127

128+
// It is impossible to define 128 bit constants, so ...
129+
#ifdef WORD_SIZE_64
130+
#define SWAPN(_x, _l) \
131+
({ \
132+
\
133+
u128 _res = (_x), _ret; \
134+
char *d = (char *)&_ret, *s = (char *)&_res; \
135+
int i; \
136+
for (i = 0; i < 16; i++) \
137+
d[15 - i] = s[i]; \
138+
u32 sr = 128U - ((_l) << 3U); \
139+
(_ret >>= sr); \
140+
(u128) _ret; \
141+
\
142+
})
143+
#endif
144+
145+
#define SWAPNN(_x, _y, _l) \
146+
({ \
147+
\
148+
char *d = (char *)(_x), *s = (char *)(_y); \
149+
u32 i, l = (_l)-1; \
150+
for (i = 0; i <= l; i++) \
151+
d[l - i] = s[i]; \
152+
\
153+
})
154+
117155
#ifdef AFL_LLVM_PASS
118156
#if defined(__linux__) || !defined(__ANDROID__)
119157
#define AFL_SR(s) (srandom(s))

0 commit comments

Comments
 (0)