Skip to content

Commit eb765dd

Browse files
vanhauser-thcvanhauser-thc
committed
fix
1 parent 8f4b2e3 commit eb765dd

File tree

5 files changed

+37
-47
lines changed

5 files changed

+37
-47
lines changed

‎accel/tcg/tcg-runtime.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@
3333
#include "tcg/tcg.h"
3434

3535
#include "qemuafl/common.h"
36-
#include "qemuafl/imported/afl_hash.h"
36+
37+
uint32_t afl_hash_ip(uint64_t);
3738

3839
void HELPER(afl_entry_routine)(CPUArchState *env) {
3940

@@ -283,7 +284,7 @@ void HELPER(afl_cmplog_rtn)(CPUArchState *env) {
283284
uintptr_t k = 0;
284285
#endif
285286

286-
k = (uintptr_t)(afl_hash_ip((uint64_t)k, 8));
287+
k = (uintptr_t)(afl_hash_ip((uint64_t)k));
287288
k &= (CMP_MAP_W - 1);
288289

289290
u32 hits = 0;

‎accel/tcg/translate-all.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@
6565

6666
#include "qemuafl/common.h"
6767
#include "tcg/tcg-op.h"
68-
#include "qemuaflimported/afl_hash.h"
68+
#include "qemuafl/imported/afl_hash.h"
6969

7070
#include <math.h>
7171

@@ -107,7 +107,7 @@ static void afl_gen_trace(target_ulong cur_loc) {
107107

108108
// cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
109109
// cur_loc &= MAP_SIZE - 1;
110-
cur_loc = (uintptr_t)(afl_hash_ip((uint64_t)cur_loc, 8));
110+
cur_loc = (uintptr_t)(afl_hash_ip((uint64_t)cur_loc));
111111
cur_loc &= (MAP_SIZE - 1);
112112

113113
/* Implement probabilistic instrumentation by looking at scrambled block

‎qemuafl/cpu-translate.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
#include "tcg/tcg.h"
3636
#include "tcg/tcg-op.h"
3737

38-
#include "imported/afl_hash.h"
38+
uint32_t afl_hash_ip(uint64_t);
3939

4040
#if TARGET_LONG_BITS == 64
4141
#define _DEFAULT_MO MO_64
@@ -50,7 +50,7 @@ static void afl_gen_compcov(target_ulong cur_loc, TCGv arg1, TCGv arg2,
5050

5151
if (__afl_cmp_map) {
5252

53-
cur_loc = (uintptr_t)(afl_hash_ip((uint64_t)cur_loc, 8));
53+
cur_loc = (uintptr_t)(afl_hash_ip((uint64_t)cur_loc));
5454
cur_loc &= (CMP_MAP_W - 1);
5555

5656
TCGv cur_loc_v = tcg_const_tl(cur_loc);
@@ -80,7 +80,7 @@ static void afl_gen_compcov(target_ulong cur_loc, TCGv arg1, TCGv arg2,
8080

8181
if (!is_imm && afl_compcov_level < 2) return;
8282

83-
cur_loc = (uintptr_t)(afl_hash_ip((uint64_t)cur_loc, 8));
83+
cur_loc = (uintptr_t)(afl_hash_ip((uint64_t)cur_loc));
8484
cur_loc &= (MAP_SIZE - 1);
8585

8686
TCGv cur_loc_v = tcg_const_tl(cur_loc);

‎qemuafl/imported/afl_hash.h

Lines changed: 28 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -10,42 +10,12 @@
1010
#include <limits.h>
1111
#include <stdint.h>
1212

13-
uint32_t afl_hash_ip(uint8_t *input, size_t len);
14-
uint32_t AFL_readLE32(const void *memPtr);
13+
uint32_t afl_hash_ip(uint64_t ip);
1514
uint64_t AFL_readLE64(const void *memPtr);
1615
uint64_t AFL_rrmxmx(uint64_t h64, uint64_t len);
1716

18-
const uint8_t AFL_kSecret[] = {
19-
20-
0xb8, 0xfe, 0x6c, 0x39, 0x23, 0xa4, 0x4b, 0xbe, 0x7c, 0x01, 0x81, 0x2c,
21-
0xf7, 0x21, 0xad, 0x1c, 0xde, 0xd4, 0x6d, 0xe9, 0x83, 0x90, 0x97, 0xdb,
22-
0x72, 0x40, 0xa4, 0xa4, 0xb7, 0xb3, 0x67, 0x1f, 0xcb, 0x79, 0xe6, 0x4e,
23-
0xcc, 0xc0, 0xe5, 0x78, 0x82, 0x5a, 0xd0, 0x7d, 0xcc, 0xff, 0x72, 0x21,
24-
0xb8, 0x08, 0x46, 0x74, 0xf7, 0x43, 0x24, 0x8e, 0xe0, 0x35, 0x90, 0xe6,
25-
0x81, 0x3a, 0x26, 0x4c, 0x3c, 0x28, 0x52, 0xbb, 0x91, 0xc3, 0x00, 0xcb,
26-
0x88, 0xd0, 0x65, 0x8b, 0x1b, 0x53, 0x2e, 0xa3, 0x71, 0x64, 0x48, 0x97,
27-
0xa2, 0x0d, 0xf9, 0x4e, 0x38, 0x19, 0xef, 0x46, 0xa9, 0xde, 0xac, 0xd8,
28-
0xa8, 0xfa, 0x76, 0x3f, 0xe3, 0x9c, 0x34, 0x3f, 0xf9, 0xdc, 0xbb, 0xc7,
29-
0xc7, 0x0b, 0x4f, 0x1d, 0x8a, 0x51, 0xe0, 0x4b, 0xcd, 0xb4, 0x59, 0x31,
30-
0xc8, 0x9f, 0x7e, 0xc9, 0xd9, 0x78, 0x73, 0x64, 0xea, 0xc5, 0xac, 0x83,
31-
0x34, 0xd3, 0xeb, 0xc3, 0xc5, 0x81, 0xa0, 0xff, 0xfa, 0x13, 0x63, 0xeb,
32-
0x17, 0x0d, 0xdd, 0x51, 0xb7, 0xf0, 0xda, 0x49, 0xd3, 0x16, 0x55, 0x26,
33-
0x29, 0xd4, 0x68, 0x9e, 0x2b, 0x16, 0xbe, 0x58, 0x7d, 0x47, 0xa1, 0xfc,
34-
0x8f, 0xf8, 0xb8, 0xd1, 0x7a, 0xd0, 0x31, 0xce, 0x45, 0xcb, 0x3a, 0x8f,
35-
0x95, 0x16, 0x04, 0x28, 0xaf, 0xd7, 0xfb, 0xca, 0xbb, 0x4b, 0x40, 0x7e,
36-
37-
};
38-
3917
#define AFL_rotl64(x, r) (((x) << (r)) | ((x) >> (64 - (r))))
4018

41-
inline uint32_t AFL_readLE32(const void *memPtr) {
42-
43-
const uint8_t *bytePtr = (const uint8_t *)memPtr;
44-
return bytePtr[0] | ((uint32_t)bytePtr[1] << 8) | ((uint32_t)bytePtr[2] << 16) |
45-
((uint32_t)bytePtr[3] << 24);
46-
47-
}
48-
4919
inline uint64_t AFL_readLE64(const void *memPtr) {
5020

5121
const uint8_t *bytePtr = (const uint8_t *)memPtr;
@@ -67,17 +37,35 @@ inline uint64_t AFL_rrmxmx(uint64_t h64, uint64_t len) {
6737

6838
}
6939

70-
inline uint32_t afl_hash_ip(uint8_t *input, size_t len) {
40+
inline uint32_t afl_hash_ip(uint64_t ip) {
41+
42+
const uint8_t secret[] = {
43+
44+
0xb8, 0xfe, 0x6c, 0x39, 0x23, 0xa4, 0x4b, 0xbe, 0x7c, 0x01, 0x81, 0x2c,
45+
0xf7, 0x21, 0xad, 0x1c, 0xde, 0xd4, 0x6d, 0xe9, 0x83, 0x90, 0x97, 0xdb,
46+
0x72, 0x40, 0xa4, 0xa4, 0xb7, 0xb3, 0x67, 0x1f, 0xcb, 0x79, 0xe6, 0x4e,
47+
0xcc, 0xc0, 0xe5, 0x78, 0x82, 0x5a, 0xd0, 0x7d, 0xcc, 0xff, 0x72, 0x21,
48+
0xb8, 0x08, 0x46, 0x74, 0xf7, 0x43, 0x24, 0x8e, 0xe0, 0x35, 0x90, 0xe6,
49+
0x81, 0x3a, 0x26, 0x4c, 0x3c, 0x28, 0x52, 0xbb, 0x91, 0xc3, 0x00, 0xcb,
50+
0x88, 0xd0, 0x65, 0x8b, 0x1b, 0x53, 0x2e, 0xa3, 0x71, 0x64, 0x48, 0x97,
51+
0xa2, 0x0d, 0xf9, 0x4e, 0x38, 0x19, 0xef, 0x46, 0xa9, 0xde, 0xac, 0xd8,
52+
0xa8, 0xfa, 0x76, 0x3f, 0xe3, 0x9c, 0x34, 0x3f, 0xf9, 0xdc, 0xbb, 0xc7,
53+
0xc7, 0x0b, 0x4f, 0x1d, 0x8a, 0x51, 0xe0, 0x4b, 0xcd, 0xb4, 0x59, 0x31,
54+
0xc8, 0x9f, 0x7e, 0xc9, 0xd9, 0x78, 0x73, 0x64, 0xea, 0xc5, 0xac, 0x83,
55+
0x34, 0xd3, 0xeb, 0xc3, 0xc5, 0x81, 0xa0, 0xff, 0xfa, 0x13, 0x63, 0xeb,
56+
0x17, 0x0d, 0xdd, 0x51, 0xb7, 0xf0, 0xda, 0x49, 0xd3, 0x16, 0x55, 0x26,
57+
0x29, 0xd4, 0x68, 0x9e, 0x2b, 0x16, 0xbe, 0x58, 0x7d, 0x47, 0xa1, 0xfc,
58+
0x8f, 0xf8, 0xb8, 0xd1, 0x7a, 0xd0, 0x31, 0xce, 0x45, 0xcb, 0x3a, 0x8f,
59+
0x95, 0x16, 0x04, 0x28, 0xaf, 0xd7, 0xfb, 0xca, 0xbb, 0x4b, 0x40, 0x7e,
7160

72-
const uint8_t *secret = AFL_kSecret;
61+
};
7362

74-
uint32_t const input1 = AFL_readLE32(input);
75-
uint32_t const input2 = AFL_readLE32(input + len - 4);
76-
uint64_t const bitflip =
77-
(AFL_readLE64(secret + 8) ^ AFL_readLE64(secret + 16));
78-
uint64_t const input64 = input2 + (((uint64_t)input1) << 32);
79-
uint64_t const keyed = input64 ^ bitflip;
80-
return AFL_rrmxmx(keyed, len);
63+
uint32_t const input1 = (uint32_t)(ip & 0xffffffff);
64+
uint32_t const input2 = (uint32_t)(ip >> 32);
65+
uint64_t const bitflip = (AFL_readLE64(secret + 8) ^ AFL_readLE64(secret + 16));
66+
uint64_t const input64 = input2 + (((uint64_t)input1) << 32);
67+
uint64_t const keyed = input64 ^ bitflip;
68+
return AFL_rrmxmx(keyed, 8);
8169

8270
}
8371

‎qemuafl/imported/types.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ typedef uint128_t u128;
4747
#define FS_ERROR_SHMAT 8
4848
#define FS_ERROR_MMAP 16
4949
#define FS_ERROR_OLD_CMPLOG 32
50+
#define FS_ERROR_OLD_CMPLOG_QEMU 64
5051

5152
/* Reporting options */
5253
#define FS_OPT_ENABLED 0x80000001

0 commit comments

Comments
 (0)