| /* Implementation of afl havoc mutation to be used in AFL++ custom mutators and |
| partially in afl-fuzz itself. |
| |
| How to use: |
| |
| #include "afl-mutations.h" // needs afl-fuzz.h |
| |
| u32 afl_mutate(afl_state_t *afl, u8 *buf, u32 len, u32t steps, bool is_text, |
| bool is_exploration, u8 *splice_buf, u32 splice_len, |
| u32 max_len); |
| |
| Returns: |
| u32 - the length of the mutated data return in *buf. 0 = error |
| Parameters: |
| afl_state_t *afl - the *afl state pointer |
| u8 *buf - the input buffer to mutate which will be mutated into. |
| NOTE: must be able to contain a size of at least max_len!! (see below) |
| u32 len - the length of the input |
| u32 steps - how many mutations to perform on the input |
| bool is_text - is the target expecting text inputs |
| bool is_exploration - mutate for exploration mode (instead of exploitation) |
| splice_buf - a buffer from another corpus item to splice with. |
| If NULL then no splicing is done (obviously). |
| splice_len - the length of the splice buffer. If 0 then no splicing. |
| u32 max_len - the maximum size the mutated buffer may grow to |
| */ |
| |
| #ifndef AFL_MUTATIONS_H |
| #define AFL_MUTATIONS_H |
| |
| #include <stdbool.h> |
| #include <inttypes.h> |
| #include "afl-fuzz.h" |
| |
| #define MUT_STRATEGY_ARRAY_SIZE 256 |
| |
| enum { |
| |
| /* 00 */ MUT_FLIPBIT, |
| /* 01 */ MUT_INTERESTING8, |
| /* 02 */ MUT_INTERESTING16, |
| /* 03 */ MUT_INTERESTING16BE, |
| /* 04 */ MUT_INTERESTING32, |
| /* 05 */ MUT_INTERESTING32BE, |
| /* 06 */ MUT_ARITH8_, |
| /* 07 */ MUT_ARITH8, |
| /* 08 */ MUT_ARITH16_, |
| /* 09 */ MUT_ARITH16BE_, |
| /* 10 */ MUT_ARITH16, |
| /* 11 */ MUT_ARITH16BE, |
| /* 12 */ MUT_ARITH32_, |
| /* 13 */ MUT_ARITH32BE_, |
| /* 14 */ MUT_ARITH32, |
| /* 15 */ MUT_ARITH32BE, |
| /* 16 */ MUT_RAND8, |
| /* 17 */ MUT_CLONE_COPY, |
| /* 18 */ MUT_CLONE_FIXED, |
| /* 19 */ MUT_OVERWRITE_COPY, |
| /* 20 */ MUT_OVERWRITE_FIXED, |
| /* 21 */ MUT_BYTEADD, |
| /* 22 */ MUT_BYTESUB, |
| /* 23 */ MUT_FLIP8, |
| /* 24 */ MUT_SWITCH, |
| /* 25 */ MUT_DEL, |
| /* 26 */ MUT_SHUFFLE, |
| /* 27 */ MUT_DELONE, |
| /* 28 */ MUT_INSERTONE, |
| /* 29 */ MUT_ASCIINUM, |
| /* 30 */ MUT_INSERTASCIINUM, |
| /* 31 */ MUT_EXTRA_OVERWRITE, |
| /* 32 */ MUT_EXTRA_INSERT, |
| /* 33 */ MUT_AUTO_EXTRA_OVERWRITE, |
| /* 34 */ MUT_AUTO_EXTRA_INSERT, |
| /* 35 */ MUT_SPLICE_OVERWRITE, |
| /* 36 */ MUT_SPLICE_INSERT, |
| |
| MUT_MAX |
| |
| }; |
| |
| #define MUT_TXT_ARRAY_SIZE 200 |
| u32 text_array[MUT_TXT_ARRAY_SIZE] = {MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT}; |
| |
| #define MUT_BIN_ARRAY_SIZE 256 |
| u32 binary_array[MUT_BIN_ARRAY_SIZE] = {MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT}; |
| |
| #define MUT_NORMAL_ARRAY_SIZE 77 |
| u32 normal_splice_array[MUT_NORMAL_ARRAY_SIZE] = {MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_FIXED, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_FIXED, |
| MUT_BYTEADD, |
| MUT_BYTESUB, |
| MUT_FLIP8, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT}; |
| |
| #define MUT_SPLICE_ARRAY_SIZE 81 |
| u32 full_splice_array[MUT_SPLICE_ARRAY_SIZE] = {MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_FIXED, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_FIXED, |
| MUT_BYTEADD, |
| MUT_BYTESUB, |
| MUT_FLIP8, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT}; |
| |
| u32 mutation_strategy_exploration_text[MUT_STRATEGY_ARRAY_SIZE] = { |
| |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT |
| |
| }; |
| |
| u32 mutation_strategy_exploration_binary[MUT_STRATEGY_ARRAY_SIZE] = { |
| |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT |
| |
| }; |
| |
| u32 mutation_strategy_exploitation_text[MUT_STRATEGY_ARRAY_SIZE] = { |
| |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT |
| |
| }; |
| |
| u32 mutation_strategy_exploitation_binary[MUT_STRATEGY_ARRAY_SIZE] = { |
| |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_FLIPBIT, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING8, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING16BE, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_INTERESTING32BE, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8_, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH8, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16BE_, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH16BE, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32BE_, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_ARITH32BE, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_RAND8, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_COPY, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_CLONE_FIXED, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_COPY, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_OVERWRITE_FIXED, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTEADD, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_BYTESUB, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_FLIP8, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_SWITCH, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_DEL, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_SHUFFLE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_DELONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_INSERTONE, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_ASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_INSERTASCIINUM, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_OVERWRITE, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_OVERWRITE, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_AUTO_EXTRA_INSERT, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_OVERWRITE, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT, |
| MUT_SPLICE_INSERT |
| |
| }; |
| |
| u32 afl_mutate(afl_state_t *, u8 *, u32, u32, bool, bool, u8 *, u32, u32); |
| u32 choose_block_len(afl_state_t *, u32); |
| |
| /* Helper to choose random block len for block operations in fuzz_one(). |
| Doesn't return zero, provided that max_len is > 0. */ |
| |
| inline u32 choose_block_len(afl_state_t *afl, u32 limit) { |
| |
| u32 min_value, max_value; |
| u32 rlim = MIN(afl->queue_cycle, (u32)3); |
| |
| if (unlikely(!afl->run_over10m)) { rlim = 1; } |
| |
| switch (rand_below(afl, rlim)) { |
| |
| case 0: |
| min_value = 1; |
| max_value = HAVOC_BLK_SMALL; |
| break; |
| |
| case 1: |
| min_value = HAVOC_BLK_SMALL; |
| max_value = HAVOC_BLK_MEDIUM; |
| break; |
| |
| default: |
| |
| if (likely(rand_below(afl, 10))) { |
| |
| min_value = HAVOC_BLK_MEDIUM; |
| max_value = HAVOC_BLK_LARGE; |
| |
| } else { |
| |
| min_value = HAVOC_BLK_LARGE; |
| max_value = HAVOC_BLK_XL; |
| |
| } |
| |
| } |
| |
| if (min_value >= limit) { min_value = 1; } |
| |
| return min_value + rand_below(afl, MIN(max_value, limit) - min_value + 1); |
| |
| } |
| |
| inline u32 afl_mutate(afl_state_t *afl, u8 *buf, u32 len, u32 steps, |
| bool is_text, bool is_exploration, u8 *splice_buf, |
| u32 splice_len, u32 max_len) { |
| |
| if (!buf || !len) { return 0; } |
| |
| u32 *mutation_array; |
| static u8 *tmp_buf = NULL; |
| static u32 tmp_buf_size = 0; |
| |
| if (max_len > tmp_buf_size) { |
| |
| if (tmp_buf) { |
| |
| u8 *ptr = realloc(tmp_buf, max_len); |
| |
| if (!ptr) { |
| |
| return 0; |
| |
| } else { |
| |
| tmp_buf = ptr; |
| |
| } |
| |
| } else { |
| |
| if ((tmp_buf = malloc(max_len)) == NULL) { return 0; } |
| |
| } |
| |
| tmp_buf_size = max_len; |
| |
| } |
| |
| if (is_text) { |
| |
| if (is_exploration) { |
| |
| mutation_array = (u32 *)&mutation_strategy_exploration_text; |
| |
| } else { |
| |
| mutation_array = (u32 *)&mutation_strategy_exploitation_text; |
| |
| } |
| |
| } else { |
| |
| if (is_exploration) { |
| |
| mutation_array = (u32 *)&mutation_strategy_exploration_binary; |
| |
| } else { |
| |
| mutation_array = (u32 *)&mutation_strategy_exploitation_binary; |
| |
| } |
| |
| } |
| |
| for (u32 step = 0; step < steps; ++step) { |
| |
| retry_havoc_step: { |
| |
| u32 r = rand_below(afl, MUT_STRATEGY_ARRAY_SIZE), item; |
| |
| switch (mutation_array[r]) { |
| |
| case MUT_FLIPBIT: { |
| |
| /* Flip a single bit somewhere. Spooky! */ |
| u8 bit = rand_below(afl, 8); |
| u32 off = rand_below(afl, len); |
| buf[off] ^= 1 << bit; |
| |
| break; |
| |
| } |
| |
| case MUT_INTERESTING8: { |
| |
| /* Set byte to interesting value. */ |
| |
| item = rand_below(afl, sizeof(interesting_8)); |
| buf[rand_below(afl, len)] = interesting_8[item]; |
| break; |
| |
| } |
| |
| case MUT_INTERESTING16: { |
| |
| /* Set word to interesting value, little endian. */ |
| |
| if (unlikely(len < 2)) { break; } // no retry |
| |
| item = rand_below(afl, sizeof(interesting_16) >> 1); |
| *(u16 *)(buf + rand_below(afl, len - 1)) = interesting_16[item]; |
| |
| break; |
| |
| } |
| |
| case MUT_INTERESTING16BE: { |
| |
| /* Set word to interesting value, big endian. */ |
| |
| if (unlikely(len < 2)) { break; } // no retry |
| |
| item = rand_below(afl, sizeof(interesting_16) >> 1); |
| *(u16 *)(buf + rand_below(afl, len - 1)) = SWAP16(interesting_16[item]); |
| |
| break; |
| |
| } |
| |
| case MUT_INTERESTING32: { |
| |
| /* Set dword to interesting value, little endian. */ |
| |
| if (unlikely(len < 4)) { break; } // no retry |
| |
| item = rand_below(afl, sizeof(interesting_32) >> 2); |
| *(u32 *)(buf + rand_below(afl, len - 3)) = interesting_32[item]; |
| |
| break; |
| |
| } |
| |
| case MUT_INTERESTING32BE: { |
| |
| /* Set dword to interesting value, big endian. */ |
| |
| if (unlikely(len < 4)) { break; } // no retry |
| |
| item = rand_below(afl, sizeof(interesting_32) >> 2); |
| *(u32 *)(buf + rand_below(afl, len - 3)) = SWAP32(interesting_32[item]); |
| |
| break; |
| |
| } |
| |
| case MUT_ARITH8_: { |
| |
| /* Randomly subtract from byte. */ |
| |
| item = 1 + rand_below(afl, ARITH_MAX); |
| buf[rand_below(afl, len)] -= item; |
| break; |
| |
| } |
| |
| case MUT_ARITH8: { |
| |
| /* Randomly add to byte. */ |
| |
| item = 1 + rand_below(afl, ARITH_MAX); |
| buf[rand_below(afl, len)] += item; |
| break; |
| |
| } |
| |
| case MUT_ARITH16_: { |
| |
| /* Randomly subtract from word, little endian. */ |
| |
| if (unlikely(len < 2)) { break; } // no retry |
| |
| u32 pos = rand_below(afl, len - 1); |
| item = 1 + rand_below(afl, ARITH_MAX); |
| *(u16 *)(buf + pos) -= item; |
| |
| break; |
| |
| } |
| |
| case MUT_ARITH16BE_: { |
| |
| /* Randomly subtract from word, big endian. */ |
| |
| if (unlikely(len < 2)) { break; } // no retry |
| |
| u32 pos = rand_below(afl, len - 1); |
| u16 num = 1 + rand_below(afl, ARITH_MAX); |
| *(u16 *)(buf + pos) = SWAP16(SWAP16(*(u16 *)(buf + pos)) - num); |
| |
| break; |
| |
| } |
| |
| case MUT_ARITH16: { |
| |
| /* Randomly add to word, little endian. */ |
| |
| if (unlikely(len < 2)) { break; } // no retry |
| |
| u32 pos = rand_below(afl, len - 1); |
| item = 1 + rand_below(afl, ARITH_MAX); |
| *(u16 *)(buf + pos) += item; |
| |
| break; |
| |
| } |
| |
| case MUT_ARITH16BE: { |
| |
| /* Randomly add to word, big endian. */ |
| |
| if (unlikely(len < 2)) { break; } // no retry |
| |
| u32 pos = rand_below(afl, len - 1); |
| u16 num = 1 + rand_below(afl, ARITH_MAX); |
| *(u16 *)(buf + pos) = SWAP16(SWAP16(*(u16 *)(buf + pos)) + num); |
| |
| break; |
| |
| } |
| |
| case MUT_ARITH32_: { |
| |
| /* Randomly subtract from dword, little endian. */ |
| |
| if (unlikely(len < 4)) { break; } // no retry |
| |
| u32 pos = rand_below(afl, len - 3); |
| item = 1 + rand_below(afl, ARITH_MAX); |
| *(u32 *)(buf + pos) -= item; |
| |
| break; |
| |
| } |
| |
| case MUT_ARITH32BE_: { |
| |
| /* Randomly subtract from dword, big endian. */ |
| |
| if (unlikely(len < 4)) { break; } // no retry |
| |
| u32 pos = rand_below(afl, len - 3); |
| u32 num = 1 + rand_below(afl, ARITH_MAX); |
| *(u32 *)(buf + pos) = SWAP32(SWAP32(*(u32 *)(buf + pos)) - num); |
| |
| break; |
| |
| } |
| |
| case MUT_ARITH32: { |
| |
| /* Randomly add to dword, little endian. */ |
| |
| if (unlikely(len < 4)) { break; } // no retry |
| |
| u32 pos = rand_below(afl, len - 3); |
| item = 1 + rand_below(afl, ARITH_MAX); |
| *(u32 *)(buf + pos) += item; |
| |
| break; |
| |
| } |
| |
| case MUT_ARITH32BE: { |
| |
| /* Randomly add to dword, big endian. */ |
| |
| if (unlikely(len < 4)) { break; } // no retry |
| |
| u32 pos = rand_below(afl, len - 3); |
| u32 num = 1 + rand_below(afl, ARITH_MAX); |
| *(u32 *)(buf + pos) = SWAP32(SWAP32(*(u32 *)(buf + pos)) + num); |
| |
| break; |
| |
| } |
| |
| case MUT_RAND8: { |
| |
| /* Just set a random byte to a random value. Because, |
| why not. We use XOR with 1-255 to eliminate the |
| possibility of a no-op. */ |
| |
| u32 pos = rand_below(afl, len); |
| item = 1 + rand_below(afl, 255); |
| buf[pos] ^= item; |
| break; |
| |
| } |
| |
| case MUT_CLONE_COPY: { |
| |
| if (likely(len + HAVOC_BLK_XL < max_len)) { |
| |
| /* Clone bytes. */ |
| |
| u32 clone_len = choose_block_len(afl, len); |
| u32 clone_from = rand_below(afl, len - clone_len + 1); |
| u32 clone_to = rand_below(afl, len); |
| |
| /* Head */ |
| |
| memcpy(tmp_buf, buf, clone_to); |
| |
| /* Inserted part */ |
| |
| memcpy(tmp_buf + clone_to, buf + clone_from, clone_len); |
| |
| /* Tail */ |
| memcpy(tmp_buf + clone_to + clone_len, buf + clone_to, |
| len - clone_to); |
| |
| len += clone_len; |
| memcpy(buf, tmp_buf, len); |
| |
| } else if (unlikely(len < 8)) { |
| |
| break; |
| |
| } else { |
| |
| goto retry_havoc_step; |
| |
| } |
| |
| break; |
| |
| } |
| |
| case MUT_CLONE_FIXED: { |
| |
| if (likely(len + HAVOC_BLK_XL < max_len)) { |
| |
| /* Insert a block of constant bytes (25%). */ |
| |
| u32 clone_len = choose_block_len(afl, HAVOC_BLK_XL); |
| u32 clone_to = rand_below(afl, len); |
| u32 strat = rand_below(afl, 2); |
| u32 clone_from = clone_to ? clone_to - 1 : 0; |
| item = strat ? rand_below(afl, 256) : buf[clone_from]; |
| |
| /* Head */ |
| |
| memcpy(tmp_buf, buf, clone_to); |
| |
| /* Inserted part */ |
| |
| memset(tmp_buf + clone_to, item, clone_len); |
| |
| /* Tail */ |
| memcpy(tmp_buf + clone_to + clone_len, buf + clone_to, |
| len - clone_to); |
| |
| len += clone_len; |
| memcpy(buf, tmp_buf, len); |
| |
| } else if (unlikely(len < 8)) { |
| |
| break; |
| |
| } else { |
| |
| goto retry_havoc_step; |
| |
| } |
| |
| break; |
| |
| } |
| |
| case MUT_OVERWRITE_COPY: { |
| |
| /* Overwrite bytes with a randomly selected chunk bytes. */ |
| |
| if (unlikely(len < 2)) { break; } // no retry |
| |
| u32 copy_len = choose_block_len(afl, len - 1); |
| u32 copy_from = rand_below(afl, len - copy_len + 1); |
| u32 copy_to = rand_below(afl, len - copy_len + 1); |
| |
| if (likely(copy_from != copy_to)) { |
| |
| memmove(buf + copy_to, buf + copy_from, copy_len); |
| |
| } |
| |
| break; |
| |
| } |
| |
| case MUT_OVERWRITE_FIXED: { |
| |
| /* Overwrite bytes with fixed bytes. */ |
| |
| if (unlikely(len < 2)) { break; } // no retry |
| |
| u32 copy_len = choose_block_len(afl, len - 1); |
| u32 copy_to = rand_below(afl, len - copy_len + 1); |
| u32 strat = rand_below(afl, 2); |
| u32 copy_from = copy_to ? copy_to - 1 : 0; |
| item = strat ? rand_below(afl, 256) : buf[copy_from]; |
| memset(buf + copy_to, item, copy_len); |
| |
| break; |
| |
| } |
| |
| case MUT_BYTEADD: { |
| |
| /* Increase byte by 1. */ |
| |
| buf[rand_below(afl, len)]++; |
| break; |
| |
| } |
| |
| case MUT_BYTESUB: { |
| |
| /* Decrease byte by 1. */ |
| |
| buf[rand_below(afl, len)]--; |
| break; |
| |
| } |
| |
| case MUT_FLIP8: { |
| |
| /* Flip byte. */ |
| |
| buf[rand_below(afl, len)] ^= 0xff; |
| break; |
| |
| } |
| |
| case MUT_SWITCH: { |
| |
| if (unlikely(len < 4)) { break; } // no retry |
| |
| /* Switch bytes. */ |
| |
| u32 to_end, switch_to, switch_len, switch_from; |
| switch_from = rand_below(afl, len); |
| do { |
| |
| switch_to = rand_below(afl, len); |
| |
| } while (unlikely(switch_from == switch_to)); |
| |
| if (switch_from < switch_to) { |
| |
| switch_len = switch_to - switch_from; |
| to_end = len - switch_to; |
| |
| } else { |
| |
| switch_len = switch_from - switch_to; |
| to_end = len - switch_from; |
| |
| } |
| |
| switch_len = choose_block_len(afl, MIN(switch_len, to_end)); |
| |
| /* Backup */ |
| |
| memcpy(tmp_buf, buf + switch_from, switch_len); |
| |
| /* Switch 1 */ |
| |
| memcpy(buf + switch_from, buf + switch_to, switch_len); |
| |
| /* Switch 2 */ |
| |
| memcpy(buf + switch_to, tmp_buf, switch_len); |
| |
| break; |
| |
| } |
| |
| case MUT_DEL: { |
| |
| /* Delete bytes. */ |
| |
| if (unlikely(len < 2)) { break; } // no retry |
| |
| /* Don't delete too much. */ |
| |
| u32 del_len = choose_block_len(afl, len - 1); |
| u32 del_from = rand_below(afl, len - del_len + 1); |
| memmove(buf + del_from, buf + del_from + del_len, |
| len - del_from - del_len); |
| len -= del_len; |
| |
| break; |
| |
| } |
| |
| case MUT_SHUFFLE: { |
| |
| /* Shuffle bytes. */ |
| |
| if (unlikely(len < 4)) { break; } // no retry |
| |
| u32 blen = choose_block_len(afl, len - 1); |
| u32 off = rand_below(afl, len - blen + 1); |
| |
| for (u32 i = blen - 1; i > 0; i--) { |
| |
| u32 j; |
| do { |
| |
| j = rand_below(afl, i + 1); |
| |
| } while (unlikely(i == j)); |
| |
| u8 temp = buf[off + i]; |
| buf[off + i] = buf[off + j]; |
| buf[off + j] = temp; |
| |
| } |
| |
| break; |
| |
| } |
| |
| case MUT_DELONE: { |
| |
| /* Delete bytes. */ |
| |
| if (unlikely(len < 2)) { break; } // no retry |
| |
| /* Don't delete too much. */ |
| |
| u32 del_len = 1; |
| u32 del_from = rand_below(afl, len - del_len + 1); |
| memmove(buf + del_from, buf + del_from + del_len, |
| len - del_from - del_len); |
| |
| len -= del_len; |
| |
| break; |
| |
| } |
| |
| case MUT_INSERTONE: { |
| |
| if (unlikely(len < 2)) { break; } // no retry |
| |
| u32 clone_len = 1; |
| u32 clone_to = rand_below(afl, len); |
| u32 strat = rand_below(afl, 2); |
| u32 clone_from = clone_to ? clone_to - 1 : 0; |
| item = strat ? rand_below(afl, 256) : buf[clone_from]; |
| |
| /* Head */ |
| |
| memcpy(tmp_buf, buf, clone_to); |
| |
| /* Inserted part */ |
| |
| memset(tmp_buf + clone_to, item, clone_len); |
| |
| /* Tail */ |
| memcpy(tmp_buf + clone_to + clone_len, buf + clone_to, len - clone_to); |
| |
| len += clone_len; |
| memcpy(buf, tmp_buf, len); |
| |
| break; |
| |
| } |
| |
| case MUT_ASCIINUM: { |
| |
| if (unlikely(len < 4)) { break; } // no retry |
| |
| u32 off = rand_below(afl, len), off2 = off, cnt = 0; |
| |
| while (off2 + cnt < len && !isdigit(buf[off2 + cnt])) { |
| |
| ++cnt; |
| |
| } |
| |
| // none found, wrap |
| if (off2 + cnt == len) { |
| |
| off2 = 0; |
| cnt = 0; |
| |
| while (cnt < off && !isdigit(buf[off2 + cnt])) { |
| |
| ++cnt; |
| |
| } |
| |
| if (cnt == off) { |
| |
| if (len < 8) { |
| |
| break; |
| |
| } else { |
| |
| goto retry_havoc_step; |
| |
| } |
| |
| } |
| |
| } |
| |
| off = off2 + cnt; |
| off2 = off + 1; |
| |
| while (off2 < len && isdigit(buf[off2])) { |
| |
| ++off2; |
| |
| } |
| |
| s64 val = buf[off] - '0'; |
| for (u32 i = off + 1; i < off2; ++i) { |
| |
| val = (val * 10) + buf[i] - '0'; |
| |
| } |
| |
| if (off && buf[off - 1] == '-') { val = -val; } |
| |
| u32 strat = rand_below(afl, 8); |
| switch (strat) { |
| |
| case 0: |
| val++; |
| break; |
| case 1: |
| val--; |
| break; |
| case 2: |
| val *= 2; |
| break; |
| case 3: |
| val /= 2; |
| break; |
| case 4: |
| if (likely(val && (u64)val < 0x19999999)) { |
| |
| val = (u64)rand_next(afl) % (u64)((u64)val * 10); |
| |
| } else { |
| |
| val = rand_below(afl, 256); |
| |
| } |
| |
| break; |
| case 5: |
| val += rand_below(afl, 256); |
| break; |
| case 6: |
| val -= rand_below(afl, 256); |
| break; |
| case 7: |
| val = ~(val); |
| break; |
| |
| } |
| |
| char numbuf[32]; |
| snprintf(numbuf, sizeof(buf), "%" PRId64, val); |
| u32 old_len = off2 - off; |
| u32 new_len = strlen(numbuf); |
| |
| if (old_len == new_len) { |
| |
| memcpy(buf + off, numbuf, new_len); |
| |
| } else { |
| |
| /* Head */ |
| |
| memcpy(tmp_buf, buf, off); |
| |
| /* Inserted part */ |
| |
| memcpy(tmp_buf + off, numbuf, new_len); |
| |
| /* Tail */ |
| memcpy(tmp_buf + off + new_len, buf + off2, len - off2); |
| |
| len += (new_len - old_len); |
| memcpy(buf, tmp_buf, len); |
| |
| } |
| |
| // fprintf(stderr, "AFTER : %s\n", buf); |
| break; |
| |
| } |
| |
| case MUT_INSERTASCIINUM: { |
| |
| u32 ins_len = 1 + rand_below(afl, 8); |
| u32 pos = rand_below(afl, len); |
| |
| /* Insert ascii number. */ |
| if (unlikely(len < pos + ins_len)) { |
| |
| // no retry if we have a small input |
| if (unlikely(len < 8)) { |
| |
| break; |
| |
| } else { |
| |
| goto retry_havoc_step; |
| |
| } |
| |
| } |
| |
| u64 val = rand_next(afl); |
| char numbuf[32]; |
| snprintf(numbuf, sizeof(numbuf), "%llu", val); |
| size_t val_len = strlen(numbuf), off; |
| |
| if (ins_len > val_len) { |
| |
| ins_len = val_len; |
| off = 0; |
| |
| } else { |
| |
| off = val_len - ins_len; |
| |
| } |
| |
| memcpy(buf + pos, numbuf + off, ins_len); |
| |
| break; |
| |
| } |
| |
| case MUT_EXTRA_OVERWRITE: { |
| |
| if (unlikely(!afl->extras_cnt)) { goto retry_havoc_step; } |
| |
| /* Use the dictionary. */ |
| |
| u32 use_extra = rand_below(afl, afl->extras_cnt); |
| u32 extra_len = afl->extras[use_extra].len; |
| |
| if (unlikely(extra_len > len)) { goto retry_havoc_step; } |
| |
| u32 insert_at = rand_below(afl, len - extra_len + 1); |
| memcpy(buf + insert_at, afl->extras[use_extra].data, extra_len); |
| |
| break; |
| |
| } |
| |
| case MUT_EXTRA_INSERT: { |
| |
| if (unlikely(!afl->extras_cnt)) { goto retry_havoc_step; } |
| |
| u32 use_extra = rand_below(afl, afl->extras_cnt); |
| u32 extra_len = afl->extras[use_extra].len; |
| if (unlikely(len + extra_len >= max_len)) { goto retry_havoc_step; } |
| |
| u8 *ptr = afl->extras[use_extra].data; |
| u32 insert_at = rand_below(afl, len + 1); |
| |
| /* Tail */ |
| memmove(buf + insert_at + extra_len, buf + insert_at, len - insert_at); |
| |
| /* Inserted part */ |
| memcpy(buf + insert_at, ptr, extra_len); |
| len += extra_len; |
| |
| break; |
| |
| } |
| |
| case MUT_AUTO_EXTRA_OVERWRITE: { |
| |
| if (unlikely(!afl->a_extras_cnt)) { goto retry_havoc_step; } |
| |
| /* Use the dictionary. */ |
| |
| u32 use_extra = rand_below(afl, afl->a_extras_cnt); |
| u32 extra_len = afl->a_extras[use_extra].len; |
| |
| if (unlikely(extra_len > len)) { goto retry_havoc_step; } |
| |
| u32 insert_at = rand_below(afl, len - extra_len + 1); |
| memcpy(buf + insert_at, afl->a_extras[use_extra].data, extra_len); |
| |
| break; |
| |
| } |
| |
| case MUT_AUTO_EXTRA_INSERT: { |
| |
| if (unlikely(!afl->a_extras_cnt)) { goto retry_havoc_step; } |
| |
| u32 use_extra = rand_below(afl, afl->a_extras_cnt); |
| u32 extra_len = afl->a_extras[use_extra].len; |
| if (unlikely(len + extra_len >= max_len)) { goto retry_havoc_step; } |
| |
| u8 *ptr = afl->a_extras[use_extra].data; |
| u32 insert_at = rand_below(afl, len + 1); |
| |
| /* Tail */ |
| memmove(buf + insert_at + extra_len, buf + insert_at, len - insert_at); |
| |
| /* Inserted part */ |
| memcpy(buf + insert_at, ptr, extra_len); |
| len += extra_len; |
| |
| break; |
| |
| } |
| |
| case MUT_SPLICE_OVERWRITE: { |
| |
| if (unlikely(!splice_buf || !splice_len)) { goto retry_havoc_step; } |
| |
| /* overwrite mode */ |
| |
| u32 copy_from, copy_to, copy_len; |
| |
| copy_len = choose_block_len(afl, splice_len - 1); |
| |
| if (copy_len > len) copy_len = len; |
| |
| copy_from = rand_below(afl, splice_len - copy_len + 1); |
| copy_to = rand_below(afl, len - copy_len + 1); |
| memmove(buf + copy_to, splice_buf + copy_from, copy_len); |
| |
| break; |
| |
| } |
| |
| case MUT_SPLICE_INSERT: { |
| |
| if (unlikely(!splice_buf || !splice_len)) { goto retry_havoc_step; } |
| |
| if (unlikely(len + HAVOC_BLK_XL >= max_len)) { goto retry_havoc_step; } |
| |
| /* insert mode */ |
| |
| u32 clone_from, clone_to, clone_len; |
| |
| clone_len = choose_block_len(afl, splice_len); |
| clone_from = rand_below(afl, splice_len - clone_len + 1); |
| clone_to = rand_below(afl, len + 1); |
| |
| /* Head */ |
| |
| memcpy(tmp_buf, buf, clone_to); |
| |
| /* Inserted part */ |
| |
| memcpy(tmp_buf + clone_to, splice_buf + clone_from, clone_len); |
| |
| /* Tail */ |
| memcpy(tmp_buf + clone_to + clone_len, buf + clone_to, len - clone_to); |
| |
| len += clone_len; |
| memcpy(buf, tmp_buf, len); |
| |
| break; |
| |
| } |
| |
| } |
| |
| } |
| |
| } |
| |
| return len; |
| |
| } |
| |
| #endif /* !AFL_MUTATIONS_H */ |
| |
