Google Git
Sign in
android / platform / external / AFLplusplus / refs/heads/main / . / src / afl-showmap.c
blob: 20ba5a5e9b13fedce17f9aff573caea4fcc95c61 [file] [log] [blame] [edit]
/*
american fuzzy lop++ - map display utility
------------------------------------------
Originally written by Michal Zalewski
Forkserver design by Jann Horn <[email protected]>
Now maintained by Marc Heuse <[email protected]>,
Heiko Eißfeldt <[email protected]> and
Andrea Fioraldi <[email protected]> and
Dominik Maier <[email protected]>
Copyright 2016, 2017 Google Inc. All rights reserved.
Copyright 2019-2024 AFLplusplus Project. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at:
https://www.apache.org/licenses/LICENSE-2.0
A very simple tool that runs the targeted binary and displays
the contents of the trace bitmap in a human-readable form. Useful in
scripts to eliminate redundant inputs and perform other checks.
Exit code is 2 if the target program crashes; 1 if it times out or
there is a problem executing it; or 0 if execution is successful.
*/
#define AFL_MAIN
#define AFL_SHOWMAP
#include "config.h"
#include "afl-fuzz.h"
#include "types.h"
#include "debug.h"
#include "alloc-inl.h"
#include "hash.h"
#include "sharedmem.h"
#include "forkserver.h"
#include "common.h"
#include "hash.h"
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <errno.h>
#include <signal.h>
#include <dirent.h>
#include <fcntl.h>
#include <limits.h>
#include <dirent.h>
#include <sys/wait.h>
#include <sys/time.h>
#ifndef USEMMAP
#include <sys/shm.h>
#endif
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/resource.h>
static afl_state_t *afl;
static char *stdin_file; /* stdin file */
static u8 *in_dir = NULL, /* input folder */
*out_file = NULL, /* output file or directory */
*at_file = NULL, /* Substitution string for @@ */
*in_filelist = NULL; /* input file list */
static u8 outfile[PATH_MAX];
static u8 *in_data, /* Input data */
*coverage_map; /* Coverage map */
static u64 total; /* tuple content information */
static u32 tcnt, highest; /* tuple content information */
static u32 in_len; /* Input data length */
static u32 map_size = MAP_SIZE, timed_out = 0;
static bool quiet_mode, /* Hide non-essential messages? */
edges_only, /* Ignore hit counts? */
raw_instr_output, /* Do not apply AFL filters */
cmin_mode, /* Generate output in afl-cmin mode? */
binary_mode, /* Write output as a binary map */
keep_cores, /* Allow coredumps? */
remove_shm = true, /* remove shmem? */
collect_coverage, /* collect coverage */
have_coverage, /* have coverage? */
no_classify, /* do not classify counts */
debug, /* debug mode */
print_filenames, /* print the current filename */
wait_for_gdb;
static volatile u8 stop_soon, /* Ctrl-C pressed? */
child_crashed; /* Child crashed? */
static sharedmem_t shm;
static afl_forkserver_t *fsrv;
static sharedmem_t *shm_fuzz;
/* Classify tuple counts. Instead of mapping to individual bits, as in
afl-fuzz.c, we map to more user-friendly numbers between 1 and 8. */
static const u8 count_class_human[256] = {
[0] = 0, [1] = 1, [2] = 2, [3] = 3,
[4 ... 7] = 4, [8 ... 15] = 5, [16 ... 31] = 6, [32 ... 127] = 7,
[128 ... 255] = 8
};
static const u8 count_class_binary[256] = {
[0] = 0,
[1] = 1,
[2] = 2,
[3] = 4,
[4 ... 7] = 8,
[8 ... 15] = 16,
[16 ... 31] = 32,
[32 ... 127] = 64,
[128 ... 255] = 128
};
static void kill_child() {
timed_out = 1;
if (fsrv->child_pid > 0) {
kill(fsrv->child_pid, fsrv->child_kill_signal);
fsrv->child_pid = -1;
}
}
/* dummy functions */
u32 write_to_testcase(afl_state_t *afl, void **mem, u32 a, u32 b) {
(void)afl;
(void)mem;
return a + b;
}
void show_stats(afl_state_t *afl) {
(void)afl;
}
void update_bitmap_score(afl_state_t *afl, struct queue_entry *q) {
(void)afl;
(void)q;
}
fsrv_run_result_t fuzz_run_target(afl_state_t *afl, afl_forkserver_t *fsrv,
u32 i) {
(void)afl;
(void)fsrv;
(void)i;
return 0;
}
void classify_counts(afl_forkserver_t *fsrv) {
u8 *mem = fsrv->trace_bits;
const u8 *map = binary_mode ? count_class_binary : count_class_human;
u32 i = map_size;
if (edges_only) {
while (i--) {
if (*mem) { *mem = 1; }
mem++;
}
} else if (!raw_instr_output) {
while (i--) {
*mem = map[*mem];
mem++;
}
}
}
static sharedmem_t *deinit_shmem(afl_forkserver_t *fsrv,
sharedmem_t *shm_fuzz) {
afl_shm_deinit(shm_fuzz);
fsrv->support_shmem_fuzz = 0;
fsrv->shmem_fuzz_len = NULL;
fsrv->shmem_fuzz = NULL;
ck_free(shm_fuzz);
return NULL;
}
/* Get rid of temp files (atexit handler). */
static void at_exit_handler(void) {
if (stdin_file) { unlink(stdin_file); }
if (remove_shm) {
if (shm.map) afl_shm_deinit(&shm);
if (fsrv->use_shmem_fuzz) deinit_shmem(fsrv, shm_fuzz);
}
afl_fsrv_killall();
}
/* Analyze results. */
static void analyze_results(afl_forkserver_t *fsrv) {
u32 i;
for (i = 0; i < map_size; i++) {
if (fsrv->trace_bits[i]) {
total += fsrv->trace_bits[i];
if (fsrv->trace_bits[i] > highest) highest = fsrv->trace_bits[i];
// if (!coverage_map[i]) { coverage_map[i] = 1; }
coverage_map[i] |= fsrv->trace_bits[i];
}
}
}
/* Write results. */
static u32 write_results_to_file(afl_forkserver_t *fsrv, u8 *outfile) {
s32 fd;
u32 i, ret = 0;
u8 cco = !!getenv("AFL_CMIN_CRASHES_ONLY"),
caa = !!getenv("AFL_CMIN_ALLOW_ANY");
if (!outfile || !*outfile) {
FATAL("Output filename not set (Bug in AFL++?)");
}
if (cmin_mode &&
(fsrv->last_run_timed_out || (!caa && child_crashed != cco))) {
if (strcmp(outfile, "-")) {
// create empty file to prevent error messages in afl-cmin
fd = open(outfile, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
close(fd);
}
return ret;
}
if (!strncmp(outfile, "/dev/", 5)) {
fd = open(outfile, O_WRONLY);
if (fd < 0) { PFATAL("Unable to open '%s'", out_file); }
} else if (!strcmp(outfile, "-")) {
fd = dup(1);
if (fd < 0) { PFATAL("Unable to open stdout"); }
} else {
unlink(outfile); /* Ignore errors */
fd = open(outfile, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
if (fd < 0) { PFATAL("Unable to create '%s'", outfile); }
}
if (binary_mode) {
for (i = 0; i < map_size; i++) {
if (fsrv->trace_bits[i]) { ret++; }
}
ck_write(fd, fsrv->trace_bits, map_size, outfile);
close(fd);
} else {
FILE *f = fdopen(fd, "w");
if (!f) { PFATAL("fdopen() failed"); }
for (i = 0; i < map_size; i++) {
if (!fsrv->trace_bits[i]) { continue; }
ret++;
total += fsrv->trace_bits[i];
if (highest < fsrv->trace_bits[i]) { highest = fsrv->trace_bits[i]; }
if (cmin_mode) {
fprintf(f, "%u%03u\n", i, fsrv->trace_bits[i]);
} else {
fprintf(f, "%06u:%u\n", i, fsrv->trace_bits[i]);
}
}
fclose(f);
}
return ret;
}
void pre_afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *mem, u32 len) {
static u8 buf[MAX_FILE];
u32 sent = 0;
if (unlikely(afl->custom_mutators_count)) {
ssize_t new_size = len;
u8 *new_mem = mem;
u8 *new_buf = NULL;
LIST_FOREACH(&afl->custom_mutator_list, struct custom_mutator, {
if (el->afl_custom_post_process) {
new_size =
el->afl_custom_post_process(el->data, new_mem, new_size, &new_buf);
if (unlikely(!new_buf || new_size <= 0)) {
return;
} else {
new_mem = new_buf;
len = new_size;
}
}
});
if (new_mem != mem && new_mem != NULL) {
mem = buf;
memcpy(mem, new_mem, new_size);
}
if (unlikely(afl->custom_mutators_count)) {
LIST_FOREACH(&afl->custom_mutator_list, struct custom_mutator, {
if (el->afl_custom_fuzz_send) {
el->afl_custom_fuzz_send(el->data, mem, len);
sent = 1;
}
});
}
}
if (likely(!sent)) { afl_fsrv_write_to_testcase(fsrv, mem, len); }
}
/* Execute target application. */
static void showmap_run_target_forkserver(afl_forkserver_t *fsrv, u8 *mem,
u32 len) {
pre_afl_fsrv_write_to_testcase(fsrv, mem, len);
if (!quiet_mode) { SAYF("-- Program output begins --\n" cRST); }
if (afl_fsrv_run_target(fsrv, fsrv->exec_tmout, &stop_soon) ==
FSRV_RUN_ERROR) {
FATAL("Error running target");
}
if (fsrv->trace_bits[0]) {
fsrv->trace_bits[0] -= 1;
have_coverage = true;
} else {
have_coverage = false;
}
if (!no_classify) { classify_counts(fsrv); }
if (!quiet_mode) { SAYF(cRST "-- Program output ends --\n"); }
if (!fsrv->last_run_timed_out && !stop_soon &&
WIFSIGNALED(fsrv->child_status)) {
child_crashed = true;
} else {
child_crashed = false;
}
if (!quiet_mode) {
if (timed_out || fsrv->last_run_timed_out) {
SAYF(cLRD "\n+++ Program timed off +++\n" cRST);
timed_out = 0;
} else if (stop_soon) {
SAYF(cLRD "\n+++ Program aborted by user +++\n" cRST);
} else if (child_crashed) {
SAYF(cLRD "\n+++ Program killed by signal %u +++\n" cRST,
WTERMSIG(fsrv->child_status));
}
}
if (stop_soon) {
SAYF(cRST cLRD "\n+++ afl-showmap folder mode aborted by user +++\n" cRST);
exit(1);
}
}
/* Read initial file. */
static u32 read_file(u8 *in_file) {
if (print_filenames) {
SAYF("Processing %s\n", in_file);
fflush(stdout);
}
struct stat st;
s32 fd = open(in_file, O_RDONLY);
if (fd < 0) { WARNF("Unable to open '%s'", in_file); }
if (fstat(fd, &st) || !st.st_size) {
if (!be_quiet && !quiet_mode) {
WARNF("Zero-sized input file '%s'.", in_file);
}
}
if (st.st_size > MAX_FILE) {
if (!be_quiet && !quiet_mode) {
WARNF("Input file '%s' is too large, only reading %ld bytes.", in_file,
MAX_FILE);
}
in_len = MAX_FILE;
} else {
in_len = st.st_size;
}
in_data = ck_alloc_nozero(in_len);
ck_read(fd, in_data, in_len, in_file);
close(fd);
// OKF("Read %u byte%s from '%s'.", in_len, in_len == 1 ? "" : "s", in_file);
return in_len;
}
#ifdef __linux__
/* Execute the target application with an empty input (in Nyx mode). */
static void showmap_run_target_nyx_mode(afl_forkserver_t *fsrv) {
afl_fsrv_write_to_testcase(fsrv, NULL, 0);
if (afl_fsrv_run_target(fsrv, fsrv->exec_tmout, &stop_soon) ==
FSRV_RUN_ERROR) {
FATAL("Error running target in Nyx mode");
}
}
#endif
/* Execute target application. */
static void showmap_run_target(afl_forkserver_t *fsrv, char **argv) {
static struct itimerval it;
int status = 0;
if (!quiet_mode) { SAYF("-- Program output begins --\n" cRST); }
MEM_BARRIER();
fsrv->child_pid = fork();
if (fsrv->child_pid < 0) { PFATAL("fork() failed"); }
if (!fsrv->child_pid) {
struct rlimit r;
if (quiet_mode) {
s32 fd = open("/dev/null", O_RDWR);
if (fd < 0 || dup2(fd, 1) < 0 || dup2(fd, 2) < 0) {
*(u32 *)fsrv->trace_bits = EXEC_FAIL_SIG;
PFATAL("Descriptor initialization failed");
}
close(fd);
}
if (fsrv->mem_limit) {
r.rlim_max = r.rlim_cur = ((rlim_t)fsrv->mem_limit) << 20;
#ifdef RLIMIT_AS
setrlimit(RLIMIT_AS, &r); /* Ignore errors */
#else
setrlimit(RLIMIT_DATA, &r); /* Ignore errors */
#endif /* ^RLIMIT_AS */
}
if (!keep_cores) {
r.rlim_max = r.rlim_cur = 0;
} else {
r.rlim_max = r.rlim_cur = RLIM_INFINITY;
}
setrlimit(RLIMIT_CORE, &r); /* Ignore errors */
if (!getenv("LD_BIND_LAZY")) { setenv("LD_BIND_NOW", "1", 0); }
setsid();
execv(fsrv->target_path, argv);
*(u32 *)fsrv->trace_bits = EXEC_FAIL_SIG;
exit(0);
}
/* Configure timeout, wait for child, cancel timeout. */
if (fsrv->exec_tmout) {
fsrv->last_run_timed_out = 0;
it.it_value.tv_sec = (fsrv->exec_tmout / 1000);
it.it_value.tv_usec = (fsrv->exec_tmout % 1000) * 1000;
signal(SIGALRM, kill_child);
setitimer(ITIMER_REAL, &it, NULL);
}
if (waitpid(fsrv->child_pid, &status, 0) <= 0) { FATAL("waitpid() failed"); }
fsrv->child_pid = 0;
it.it_value.tv_sec = 0;
it.it_value.tv_usec = 0;
setitimer(ITIMER_REAL, &it, NULL);
MEM_BARRIER();
/* Clean up bitmap, analyze exit condition, etc. */
if (*(u32 *)fsrv->trace_bits == EXEC_FAIL_SIG) {
FATAL("Unable to execute '%s'", argv[0]);
}
if (fsrv->trace_bits[0]) {
fsrv->trace_bits[0] -= 1;
have_coverage = true;
} else {
have_coverage = false;
}
if (!no_classify) { classify_counts(fsrv); }
if (!quiet_mode) { SAYF(cRST "-- Program output ends --\n"); }
if (!fsrv->last_run_timed_out && !stop_soon && WIFSIGNALED(status)) {
child_crashed = true;
}
if (!quiet_mode) {
if (timed_out || fsrv->last_run_timed_out) {
SAYF(cLRD "\n+++ Program timed off +++\n" cRST);
timed_out = 0;
} else if (stop_soon) {
SAYF(cLRD "\n+++ Program aborted by user +++\n" cRST);
} else if (child_crashed) {
SAYF(cLRD "\n+++ Program killed by signal %u +++\n" cRST,
WTERMSIG(status));
}
}
}
/* Handle Ctrl-C and the like. */
static void handle_stop_sig(int sig) {
(void)sig;
stop_soon = true;
afl_fsrv_killall();
}
/* Do basic preparations - persistent fds, filenames, etc. */
static void set_up_environment(afl_forkserver_t *fsrv, char **argv) {
char *afl_preload;
char *frida_afl_preload = NULL;
set_sanitizer_defaults();
if (get_afl_env("AFL_PRELOAD")) {
if (fsrv->qemu_mode) {
/* afl-qemu-trace takes care of converting AFL_PRELOAD. */
} else if (fsrv->frida_mode) {
afl_preload = getenv("AFL_PRELOAD");
u8 *frida_binary = find_afl_binary(argv[0], "afl-frida-trace.so");
if (afl_preload) {
frida_afl_preload = alloc_printf("%s:%s", afl_preload, frida_binary);
} else {
frida_afl_preload = alloc_printf("%s", frida_binary);
}
ck_free(frida_binary);
setenv("LD_PRELOAD", frida_afl_preload, 1);
setenv("DYLD_INSERT_LIBRARIES", frida_afl_preload, 1);
} else {
/* CoreSight mode uses the default behavior. */
setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
}
} else if (fsrv->frida_mode) {
u8 *frida_binary = find_afl_binary(argv[0], "afl-frida-trace.so");
setenv("LD_PRELOAD", frida_binary, 1);
setenv("DYLD_INSERT_LIBRARIES", frida_binary, 1);
ck_free(frida_binary);
}
if (frida_afl_preload) { ck_free(frida_afl_preload); }
}
/* Setup signal handlers, duh. */
static void setup_signal_handlers(void) {
struct sigaction sa;
sa.sa_handler = NULL;
#ifdef SA_RESTART
sa.sa_flags = SA_RESTART;
#else
sa.sa_flags = 0;
#endif
sa.sa_sigaction = NULL;
sigemptyset(&sa.sa_mask);
/* Various ways of saying "stop". */
sa.sa_handler = handle_stop_sig;
sigaction(SIGHUP, &sa, NULL);
sigaction(SIGINT, &sa, NULL);
sigaction(SIGTERM, &sa, NULL);
}
u32 execute_testcases(u8 *dir) {
struct dirent **nl;
s32 nl_cnt, subdirs = 1;
u32 i, done = 0;
u8 val_buf[2][STRINGIFY_VAL_SIZE_MAX];
if (!be_quiet) { ACTF("Scanning '%s'...", dir); }
/* We use scandir() + alphasort() rather than readdir() because otherwise,
the ordering of test cases would vary somewhat randomly and would be
difficult to control. */
nl_cnt = scandir(dir, &nl, NULL, alphasort);
if (nl_cnt < 0) { return 0; }
for (i = 0; i < (u32)nl_cnt; ++i) {
struct stat st;
u8 *fn2 = alloc_printf("%s/%s", dir, nl[i]->d_name);
if (lstat(fn2, &st) || access(fn2, R_OK)) {
PFATAL("Unable to access '%s'", fn2);
}
/* obviously we want to skip "descending" into . and .. directories,
however it is a good idea to skip also directories that start with
a dot */
if (subdirs && S_ISDIR(st.st_mode) && nl[i]->d_name[0] != '.') {
free(nl[i]); /* not tracked */
done += execute_testcases(fn2);
ck_free(fn2);
continue;
}
if (!S_ISREG(st.st_mode) || !st.st_size) {
free(nl[i]);
ck_free(fn2);
continue;
}
if (st.st_size > MAX_FILE && !be_quiet && !quiet_mode) {
WARNF("Test case '%s' is too big (%s, limit is %s), partial reading", fn2,
stringify_mem_size(val_buf[0], sizeof(val_buf[0]), st.st_size),
stringify_mem_size(val_buf[1], sizeof(val_buf[1]), MAX_FILE));
}
if (!collect_coverage)
snprintf(outfile, sizeof(outfile), "%s/%s", out_file, nl[i]->d_name);
free(nl[i]);
if (read_file(fn2)) {
if (wait_for_gdb) {
fprintf(stderr, "exec: gdb -p %d\n", fsrv->child_pid);
fprintf(stderr, "exec: kill -CONT %d\n", getpid());
kill(0, SIGSTOP);
}
showmap_run_target_forkserver(fsrv, in_data, in_len);
ck_free(in_data);
++done;
if (child_crashed && debug) { WARNF("crashed: %s", fn2); }
if (collect_coverage)
analyze_results(fsrv);
else
tcnt = write_results_to_file(fsrv, outfile);
}
}
free(nl); /* not tracked */
return done;
}
u32 execute_testcases_filelist(u8 *fn) {
u32 done = 0;
u8 buf[4096];
u8 val_buf[2][STRINGIFY_VAL_SIZE_MAX];
FILE *f;
if (!be_quiet) { ACTF("Reading from '%s'...", fn); }
if ((f = fopen(fn, "r")) == NULL) { FATAL("could not open '%s'", fn); }
while (fgets(buf, sizeof(buf), f) != NULL) {
struct stat st;
u8 *fn2 = buf, *fn3;
while (*fn2 == ' ') {
++fn2;
}
while (*fn2 &&
(fn2[strlen(fn2) - 1] == '\r' || fn2[strlen(fn2) - 1] == '\n' ||
fn2[strlen(fn2) - 1] == ' ')) {
fn2[strlen(fn2) - 1] = 0;
}
if (debug) { printf("Getting coverage for '%s'\n", fn2); }
if (!*fn2) { continue; }
if (lstat(fn2, &st) || access(fn2, R_OK)) {
WARNF("Unable to access '%s'", fn2);
continue;
}
++done;
if (!S_ISREG(st.st_mode) || !st.st_size) { continue; }
if ((fn3 = strrchr(fn2, '/'))) {
++fn3;
} else {
fn3 = fn2;
}
if (st.st_size > MAX_FILE && !be_quiet && !quiet_mode) {
WARNF("Test case '%s' is too big (%s, limit is %s), partial reading", fn2,
stringify_mem_size(val_buf[0], sizeof(val_buf[0]), st.st_size),
stringify_mem_size(val_buf[1], sizeof(val_buf[1]), MAX_FILE));
}
if (!collect_coverage) {
snprintf(outfile, sizeof(outfile), "%s/%s", out_file, fn3);
}
if (read_file(fn2)) {
if (wait_for_gdb) {
fprintf(stderr, "exec: gdb -p %d\n", fsrv->child_pid);
fprintf(stderr, "exec: kill -CONT %d\n", getpid());
kill(0, SIGSTOP);
}
showmap_run_target_forkserver(fsrv, in_data, in_len);
ck_free(in_data);
if (child_crashed && debug) { WARNF("crashed: %s", fn2); }
if (collect_coverage)
analyze_results(fsrv);
else
tcnt = write_results_to_file(fsrv, outfile);
}
}
return done;
}
/* Show banner. */
static void show_banner(void) {
SAYF(cCYA "afl-showmap" VERSION cRST " by Michal Zalewski\n");
}
/* Display usage hints. */
static void usage(u8 *argv0) {
show_banner();
SAYF(
"\n%s [ options ] -- /path/to/target_app [ ... ]\n\n"
"Required parameters:\n"
" -o file - file to write the trace data to\n\n"
"Execution control settings:\n"
" -t msec - timeout for each run (default: 1000ms)\n"
" -m megs - memory limit for child process (default: none)\n"
#if defined(__linux__) && defined(__aarch64__)
" -A - use binary-only instrumentation (ARM CoreSight mode)\n"
#endif
" -O - use binary-only instrumentation (FRIDA mode)\n"
#if defined(__linux__)
" -Q - use binary-only instrumentation (QEMU mode)\n"
" -U - use Unicorn-based instrumentation (Unicorn mode)\n"
" -W - use qemu-based instrumentation with Wine (Wine mode)\n"
" (Not necessary, here for consistency with other afl-* "
"tools)\n"
" -X - use Nyx mode\n"
#endif
"\n"
"Other settings:\n"
" -i dir - process all files below this directory, must be combined "
"with -o.\n"
" With -C, -o is a file, without -C it must be a "
"directory\n"
" and each bitmap will be written there individually.\n"
" -I filelist - alternatively to -i, -I is a list of files\n"
" -C - collect coverage, writes all edges to -o and gives a "
"summary\n"
" Must be combined with -i.\n"
" -q - sink program's output and don't show messages\n"
" -e - show edge coverage only, ignore hit counts\n"
" -r - show real tuple values instead of AFL filter values\n"
" -s - do not classify the map\n"
" -c - allow core dumps\n\n"
"This tool displays raw tuple data captured by AFL instrumentation.\n"
"For additional help, consult %s/README.md.\n\n"
"If you use -i/-I mode, then custom mutator post_process send send "
"functionality\n"
"is supported.\n\n"
"Environment variables used:\n"
"LD_BIND_LAZY: do not set LD_BIND_NOW env var for target\n"
"AFL_CMIN_CRASHES_ONLY: (cmin_mode) only write tuples for crashing "
"inputs\n"
"AFL_CMIN_ALLOW_ANY: (cmin_mode) write tuples for crashing inputs also\n"
"AFL_CRASH_EXITCODE: optional child exit code to be interpreted as "
"crash\n"
"AFL_DEBUG: enable extra developer output\n"
"AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during "
"startup (in milliseconds)\n"
"AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, "
"etc.\n"
" (default: SIGKILL)\n"
"AFL_FORK_SERVER_KILL_SIGNAL: Kill signal for the fork server on "
"termination\n"
" (default: SIGTERM). If unset and "
"AFL_KILL_SIGNAL is\n"
" set, that value will be used.\n"
"AFL_MAP_SIZE: the shared memory size for that target. must be >= the "
"size the\n"
" target was compiled for\n"
"AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
"AFL_PRINT_FILENAMES: Print the queue entry currently processed will to "
"stdout\n"
"AFL_QUIET: do not print extra informational output\n"
"AFL_NO_FORKSRV: run target via execve instead of using the forkserver\n",
argv0, doc_path);
exit(1);
}
/* Main entry point */
int main(int argc, char **argv_orig, char **envp) {
// TODO: u64 mem_limit = MEM_LIMIT; /* Memory limit (MB) */
s32 opt, i;
bool mem_limit_given = false, timeout_given = false, unicorn_mode = false,
use_wine = false;
char **use_argv;
char **argv = argv_cpy_dup(argc, argv_orig);
afl_forkserver_t fsrv_var = {0};
if (getenv("AFL_DEBUG")) { debug = true; }
if (get_afl_env("AFL_PRINT_FILENAMES")) { print_filenames = true; }
fsrv = &fsrv_var;
afl_fsrv_init(fsrv);
map_size = get_map_size();
fsrv->map_size = map_size;
doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH;
if (getenv("AFL_QUIET") != NULL) { be_quiet = true; }
while ((opt = getopt(argc, argv, "+i:I:o:f:m:t:AeqCZOH:QUWbcrshXY")) > 0) {
switch (opt) {
case 's':
no_classify = true;
break;
case 'C':
collect_coverage = true;
quiet_mode = true;
break;
case 'i':
if (in_dir) { FATAL("Multiple -i options not supported"); }
in_dir = optarg;
break;
case 'I':
if (in_filelist) { FATAL("Multiple -I options not supported"); }
in_filelist = optarg;
break;
case 'o':
if (out_file) { FATAL("Multiple -o options not supported"); }
out_file = optarg;
break;
case 'm': {
u8 suffix = 'M';
if (mem_limit_given) { FATAL("Multiple -m options not supported"); }
mem_limit_given = true;
if (!optarg) { FATAL("Wrong usage of -m"); }
if (!strcmp(optarg, "none")) {
fsrv->mem_limit = 0;
break;
}
if (sscanf(optarg, "%llu%c", &fsrv->mem_limit, &suffix) < 1 ||
optarg[0] == '-') {
FATAL("Bad syntax used for -m");
}
switch (suffix) {
case 'T':
fsrv->mem_limit *= 1024 * 1024;
break;
case 'G':
fsrv->mem_limit *= 1024;
break;
case 'k':
fsrv->mem_limit /= 1024;
break;
case 'M':
break;
default:
FATAL("Unsupported suffix or bad syntax for -m");
}
if (fsrv->mem_limit < 5) { FATAL("Dangerously low value of -m"); }
if (sizeof(rlim_t) == 4 && fsrv->mem_limit > 2000) {
FATAL("Value of -m out of range on 32-bit systems");
}
}
break;
case 'f': // only in here to avoid a compiler warning for use_stdin
FATAL("Option -f is not supported in afl-showmap");
// currently not reached:
fsrv->use_stdin = 0;
fsrv->out_file = strdup(optarg);
break;
case 't':
if (timeout_given) { FATAL("Multiple -t options not supported"); }
timeout_given = true;
if (!optarg) { FATAL("Wrong usage of -t"); }
if (strcmp(optarg, "none")) {
fsrv->exec_tmout = atoi(optarg);
if (fsrv->exec_tmout < 20 || optarg[0] == '-') {
FATAL("Dangerously low value of -t");
}
} else {
// The forkserver code does not have a way to completely
// disable the timeout, so we'll use a very, very long
// timeout instead.
WARNF(
"Setting an execution timeout of 120 seconds ('none' is not "
"allowed).");
fsrv->exec_tmout = 120 * 1000;
}
break;
case 'e':
if (edges_only) { FATAL("Multiple -e options not supported"); }
if (raw_instr_output) { FATAL("-e and -r are mutually exclusive"); }
edges_only = true;
break;
case 'q':
quiet_mode = true;
break;
case 'Z':
/* This is an undocumented option to write data in the syntax expected
by afl-cmin. Nobody else should have any use for this. */
cmin_mode = true;
quiet_mode = true;
break;
case 'H':
/* Another afl-cmin specific feature. */
at_file = optarg;
break;
case 'O': /* FRIDA mode */
if (fsrv->frida_mode) { FATAL("Multiple -O options not supported"); }
fsrv->frida_mode = true;
setenv("AFL_FRIDA_INST_SEED", "1", 1);
break;
/* FIXME: We want to use -P for consistency, but it is already unsed for
* undocumenetd feature "Another afl-cmin specific feature." */
case 'A': /* CoreSight mode */
#if !defined(__aarch64__) || !defined(__linux__)
FATAL("-A option is not supported on this platform");
#endif
if (fsrv->cs_mode) { FATAL("Multiple -A options not supported"); }
fsrv->cs_mode = true;
break;
case 'Q':
if (fsrv->qemu_mode) { FATAL("Multiple -Q options not supported"); }
fsrv->qemu_mode = true;
break;
case 'U':
if (unicorn_mode) { FATAL("Multiple -U options not supported"); }
unicorn_mode = true;
break;
case 'W': /* Wine+QEMU mode */
if (use_wine) { FATAL("Multiple -W options not supported"); }
fsrv->qemu_mode = true;
use_wine = true;
break;
case 'Y': // fallthrough
#ifdef __linux__
case 'X': /* NYX mode */
if (fsrv->nyx_mode) { FATAL("Multiple -X options not supported"); }
fsrv->nyx_mode = 1;
fsrv->nyx_parent = true;
fsrv->nyx_standalone = true;
break;
#else
case 'X':
FATAL("Nyx mode is only availabe on linux...");
break;
#endif
case 'b':
/* Secret undocumented mode. Writes output in raw binary format
similar to that dumped by afl-fuzz in <out_dir/queue/fuzz_bitmap. */
binary_mode = true;
break;
case 'c':
if (keep_cores) { FATAL("Multiple -c options not supported"); }
keep_cores = true;
break;
case 'r':
if (raw_instr_output) { FATAL("Multiple -r options not supported"); }
if (edges_only) { FATAL("-e and -r are mutually exclusive"); }
raw_instr_output = true;
break;
case 'h':
usage(argv[0]);
return -1;
break;
default:
usage(argv[0]);
}
}
if (optind == argc || !out_file) { usage(argv[0]); }
if (in_dir && in_filelist) { FATAL("you can only specify either -i or -I"); }
if (in_dir || in_filelist) {
if (!out_file && !collect_coverage)
FATAL("for -i/-I you need to specify either -C and/or -o");
}
if (fsrv->qemu_mode && !mem_limit_given) { fsrv->mem_limit = MEM_LIMIT_QEMU; }
if (unicorn_mode && !mem_limit_given) { fsrv->mem_limit = MEM_LIMIT_UNICORN; }
check_environment_vars(envp);
if (getenv("AFL_NO_FORKSRV")) { /* if set, use the fauxserver */
fsrv->use_fauxsrv = true;
}
if (getenv("AFL_DEBUG")) {
DEBUGF("");
for (i = 0; i < argc; i++)
SAYF(" %s", argv[i]);
SAYF("\n");
}
// if (afl->shmem_testcase_mode) { setup_testcase_shmem(afl); }
setenv("AFL_NO_AUTODICT", "1", 1);
/* initialize cmplog_mode */
shm.cmplog_mode = 0;
setup_signal_handlers();
set_up_environment(fsrv, argv);
#ifdef __linux__
if (!fsrv->nyx_mode) {
fsrv->target_path = find_binary(argv[optind]);
} else {
fsrv->target_path = ck_strdup(argv[optind]);
}
#else
fsrv->target_path = find_binary(argv[optind]);
#endif
fsrv->trace_bits = afl_shm_init(&shm, map_size, 0);
if (!quiet_mode) {
show_banner();
ACTF("Executing '%s'...", fsrv->target_path);
}
if (in_dir || in_filelist) {
/* If we don't have a file name chosen yet, use a safe default. */
u8 *use_dir = ".";
if (access(use_dir, R_OK | W_OK | X_OK)) {
use_dir = get_afl_env("TMPDIR");
if (!use_dir) { use_dir = "/tmp"; }
}
stdin_file = at_file ? strdup(at_file)
: (char *)alloc_printf("%s/.afl-showmap-temp-%u",
use_dir, (u32)getpid());
unlink(stdin_file);
// If @@ are in the target args, replace them and also set use_stdin=false.
detect_file_args(argv + optind, stdin_file, &fsrv->use_stdin);
fsrv->dev_null_fd = open("/dev/null", O_RDWR);
if (fsrv->dev_null_fd < 0) { PFATAL("Unable to open /dev/null"); }
fsrv->out_file = stdin_file;
fsrv->out_fd =
open(stdin_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
if (fsrv->out_fd < 0) { PFATAL("Unable to create '%s'", stdin_file); }
} else {
// If @@ are in the target args, replace them and also set use_stdin=false.
detect_file_args(argv + optind, at_file, &fsrv->use_stdin);
}
if (fsrv->qemu_mode) {
if (use_wine) {
use_argv = get_wine_argv(argv[0], &fsrv->target_path, argc - optind,
argv + optind);
} else {
use_argv = get_qemu_argv(argv[0], &fsrv->target_path, argc - optind,
argv + optind);
}
} else if (fsrv->cs_mode) {
use_argv =
get_cs_argv(argv[0], &fsrv->target_path, argc - optind, argv + optind);
#ifdef __linux__
} else if (fsrv->nyx_mode) {
use_argv = ck_alloc(sizeof(char *) * (1));
use_argv[0] = argv[0];
fsrv->nyx_id = 0;
u8 *libnyx_binary = find_afl_binary(use_argv[0], "libnyx.so");
fsrv->nyx_handlers = afl_load_libnyx_plugin(libnyx_binary);
if (fsrv->nyx_handlers == NULL) {
FATAL("failed to initialize libnyx.so...");
}
fsrv->nyx_use_tmp_workdir = true;
fsrv->nyx_bind_cpu_id = 0;
#endif
} else {
use_argv = argv + optind;
}
afl = calloc(1, sizeof(afl_state_t));
if (getenv("AFL_FORKSRV_INIT_TMOUT")) {
s32 forksrv_init_tmout = atoi(getenv("AFL_FORKSRV_INIT_TMOUT"));
if (forksrv_init_tmout < 1) {
FATAL("Bad value specified for AFL_FORKSRV_INIT_TMOUT");
}
fsrv->init_tmout = (u32)forksrv_init_tmout;
}
if (getenv("AFL_CRASH_EXITCODE")) {
long exitcode = strtol(getenv("AFL_CRASH_EXITCODE"), NULL, 10);
if ((!exitcode && (errno == EINVAL || errno == ERANGE)) ||
exitcode < -127 || exitcode > 128) {
FATAL("Invalid crash exitcode, expected -127 to 128, but got %s",
getenv("AFL_CRASH_EXITCODE"));
}
fsrv->uses_crash_exitcode = true;
// WEXITSTATUS is 8 bit unsigned
fsrv->crash_exitcode = (u8)exitcode;
}
#ifdef __linux__
if (!fsrv->nyx_mode && (in_dir || in_filelist)) {
(void)check_binary_signatures(fsrv->target_path);
}
#else
if (in_dir) { (void)check_binary_signatures(fsrv->target_path); }
#endif
shm_fuzz = ck_alloc(sizeof(sharedmem_t));
/* initialize cmplog_mode */
shm_fuzz->cmplog_mode = 0;
u8 *map = afl_shm_init(shm_fuzz, MAX_FILE + sizeof(u32), 1);
shm_fuzz->shmemfuzz_mode = true;
if (!map) { FATAL("BUG: Zero return from afl_shm_init."); }
#ifdef USEMMAP
setenv(SHM_FUZZ_ENV_VAR, shm_fuzz->g_shm_file_path, 1);
#else
u8 *shm_str = alloc_printf("%d", shm_fuzz->shm_id);
setenv(SHM_FUZZ_ENV_VAR, shm_str, 1);
ck_free(shm_str);
#endif
fsrv->support_shmem_fuzz = true;
fsrv->shmem_fuzz_len = (u32 *)map;
fsrv->shmem_fuzz = map + sizeof(u32);
configure_afl_kill_signals(fsrv, NULL, NULL,
(fsrv->qemu_mode || unicorn_mode
#ifdef __linux__
|| fsrv->nyx_mode
#endif
)
? SIGKILL
: SIGTERM);
if (!fsrv->cs_mode && !fsrv->qemu_mode && !unicorn_mode) {
u32 save_be_quiet = be_quiet;
be_quiet = !debug;
if (map_size > 4194304) {
fsrv->map_size = map_size;
} else {
fsrv->map_size = 4194304; // dummy temporary value
}
u32 new_map_size =
afl_fsrv_get_mapsize(fsrv, use_argv, &stop_soon,
(get_afl_env("AFL_DEBUG_CHILD") ||
get_afl_env("AFL_DEBUG_CHILD_OUTPUT"))
? 1
: 0);
be_quiet = save_be_quiet;
if (new_map_size) {
// only reinitialize when it makes sense
if (map_size < new_map_size ||
(new_map_size > map_size && new_map_size - map_size > MAP_SIZE)) {
if (!be_quiet)
ACTF("Acquired new map size for target: %u bytes\n", new_map_size);
afl_shm_deinit(&shm);
afl_fsrv_kill(fsrv);
fsrv->map_size = new_map_size;
fsrv->trace_bits = afl_shm_init(&shm, new_map_size, 0);
}
map_size = new_map_size;
}
fsrv->map_size = map_size;
} else {
afl_fsrv_start(fsrv, use_argv, &stop_soon,
(get_afl_env("AFL_DEBUG_CHILD") ||
get_afl_env("AFL_DEBUG_CHILD_OUTPUT"))
? 1
: 0);
}
if (in_dir || in_filelist) {
afl->fsrv.dev_urandom_fd = open("/dev/urandom", O_RDONLY);
if (afl->fsrv.dev_urandom_fd < 0) { PFATAL("Unable to open /dev/urandom"); }
afl->afl_env.afl_custom_mutator_library =
getenv("AFL_CUSTOM_MUTATOR_LIBRARY");
afl->afl_env.afl_python_module = getenv("AFL_PYTHON_MODULE");
setup_custom_mutators(afl);
} else {
if (getenv("AFL_CUSTOM_MUTATOR_LIBRARY") || getenv("AFL_PYTHON_MODULE")) {
WARNF(
"Custom mutator environment detected, this is only supported in "
"-i/-I mode!\n");
}
}
if (in_dir || in_filelist) {
DIR *dir_in, *dir_out = NULL;
u8 *dn = NULL;
if (getenv("AFL_DEBUG_GDB")) wait_for_gdb = true;
if (in_filelist) {
if (!be_quiet) ACTF("Reading from file list '%s'...", in_filelist);
} else {
// if a queue subdirectory exists switch to that
dn = alloc_printf("%s/queue", in_dir);
if ((dir_in = opendir(dn)) != NULL) {
closedir(dir_in);
in_dir = dn;
} else {
ck_free(dn);
}
if (!be_quiet) ACTF("Reading from directory '%s'...", in_dir);
}
if (!collect_coverage) {
if (!(dir_out = opendir(out_file))) {
if (mkdir(out_file, 0700)) {
PFATAL("cannot create output directory %s", out_file);
}
}
} else {
if ((coverage_map = (u8 *)malloc(map_size + 64)) == NULL)
FATAL("coult not grab memory");
edges_only = false;
raw_instr_output = true;
}
atexit(at_exit_handler);
if (get_afl_env("AFL_DEBUG")) {
int j = optind;
DEBUGF("%s:", fsrv->target_path);
while (argv[j] != NULL) {
SAYF(" \"%s\"", argv[j++]);
}
SAYF("\n");
}
map_size = fsrv->map_size;
if (fsrv->support_shmem_fuzz && !fsrv->use_shmem_fuzz)
shm_fuzz = deinit_shmem(fsrv, shm_fuzz);
if (in_dir) {
if (execute_testcases(in_dir) == 0) {
FATAL("could not read input testcases from %s", in_dir);
}
} else {
if (execute_testcases_filelist(in_filelist) == 0) {
FATAL("could not read input testcases from %s", in_filelist);
}
}
if (!quiet_mode) { OKF("Processed %llu input files.", fsrv->total_execs); }
if (dir_out) { closedir(dir_out); }
if (collect_coverage) {
memcpy(fsrv->trace_bits, coverage_map, map_size);
tcnt = write_results_to_file(fsrv, out_file);
}
} else {
if (fsrv->support_shmem_fuzz && !fsrv->use_shmem_fuzz)
shm_fuzz = deinit_shmem(fsrv, shm_fuzz);
#ifdef __linux__
if (!fsrv->nyx_mode) {
#endif
showmap_run_target(fsrv, use_argv);
#ifdef __linux__
} else {
showmap_run_target_nyx_mode(fsrv);
}
#endif
tcnt = write_results_to_file(fsrv, out_file);
if (!quiet_mode) {
OKF("Hash of coverage map: %llx",
hash64(fsrv->trace_bits, fsrv->map_size, HASH_CONST));
}
}
if (!quiet_mode || collect_coverage) {
if (!tcnt && !have_coverage) { FATAL("No instrumentation detected" cRST); }
OKF("Captured %u tuples (map size %u, highest value %u, total values %llu) "
"in '%s'." cRST,
tcnt, fsrv->real_map_size, highest, total, out_file);
if (collect_coverage)
OKF("A coverage of %u edges were achieved out of %u existing (%.02f%%) "
"with %llu input files.",
tcnt, map_size, ((float)tcnt * 100) / (float)map_size,
fsrv->total_execs);
}
if (stdin_file) {
unlink(stdin_file);
ck_free(stdin_file);
stdin_file = NULL;
}
remove_shm = 0;
afl_shm_deinit(&shm);
if (fsrv->use_shmem_fuzz) shm_fuzz = deinit_shmem(fsrv, shm_fuzz);
u32 ret;
if (cmin_mode && !!getenv("AFL_CMIN_CRASHES_ONLY")) {
ret = fsrv->last_run_timed_out;
} else {
ret = child_crashed * 2 + fsrv->last_run_timed_out;
}
if (fsrv->target_path) { ck_free(fsrv->target_path); }
afl_fsrv_deinit(fsrv);
if (stdin_file) { ck_free(stdin_file); }
if (collect_coverage) { free(coverage_map); }
argv_cpy_free(argv);
if (fsrv->qemu_mode) { free(use_argv[2]); }
exit(ret);
}