From 36fa1e52ee97fd93c45e3fa2428fef167852124a Mon Sep 17 00:00:00 2001 From: Louis Date: Wed, 26 Apr 2023 13:47:55 +0200 Subject: [PATCH 1/7] Add trace-compares and trace-divs flags --- src/bin/cargo-afl.rs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/bin/cargo-afl.rs b/src/bin/cargo-afl.rs index 96842a4ca..adfc264f4 100644 --- a/src/bin/cargo-afl.rs +++ b/src/bin/cargo-afl.rs @@ -370,6 +370,8 @@ where -C llvm-args=-sanitizer-coverage-level=3 \ -C llvm-args=-sanitizer-coverage-trace-pc-guard \ -C llvm-args=-sanitizer-coverage-prune-blocks=0 \ + -C llvm-args=-sanitizer-coverage-trace-compares \ + -C llvm-args=-sanitizer-coverage-trace-divs \ -C opt-level=3 \ -C target-cpu=native " ); From bd8e165808ad4117572a5bf741499e61e95d9530 Mon Sep 17 00:00:00 2001 From: Louis Date: Thu, 4 May 2023 17:44:33 +0200 Subject: [PATCH 2/7] Add CmpLog example --- examples/cmplog.rs | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 examples/cmplog.rs diff --git a/examples/cmplog.rs b/examples/cmplog.rs new file mode 100644 index 000000000..159954833 --- /dev/null +++ b/examples/cmplog.rs @@ -0,0 +1,31 @@ +fn main() { + // This fuzz harness demonstrates the capabilities of CmpLog. + // Simply run the fuzzer with the `-c 0` flag and it should find the crash immediately. + afl::fuzz!(|data: &[u8]| { + if data.len() != 16 { + return; + } + if data[0] != b'A' { + return; + } + if data[1] != b'B' { + return; + } + if data[2] != b'C' { + return; + } + if data[3] != b'D' { + return; + } + + if data[4..8] != 0x69694141_i32.to_le_bytes() { + return; + }; + + if data[8..12] != *b"1234" || data[12..16] != *b"EFGH" { + return; + }; + + panic!("BOOM"); + }); +} From 4a607566bbf5306412f370646f610fc83062a576 Mon Sep 17 00:00:00 2001 From: Louis Merlin Date: Fri, 5 May 2023 10:02:41 +0200 Subject: [PATCH 3/7] Add automatic cmplog flag --- src/bin/cargo-afl.rs | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/src/bin/cargo-afl.rs b/src/bin/cargo-afl.rs index adfc264f4..6eec435c4 100644 --- a/src/bin/cargo-afl.rs +++ b/src/bin/cargo-afl.rs @@ -40,9 +40,22 @@ fn main() { run_afl(args, "afl-cmin", None); } Some(("fuzz", sub_matches)) => { - let args = sub_matches + let mut args = sub_matches .get_many::("afl-fuzz args") .unwrap_or_default(); + // We use next recursively on the args iterator, until we hit "--". + // We are then able to append `-c0` to the AFL++ arguments. + let mut front_args = vec![]; + let separator = OsString::from("--"); + let cmplog_flag = OsString::from("-c0"); + for next_value in args.by_ref() { + if *next_value == separator { + front_args.push(&cmplog_flag); + break; + } + front_args.push(next_value); + } + let args = front_args.into_iter().chain(args); let timeout = sub_matches.get_one::("max_total_time").copied(); if timeout.is_some() { eprintln!( From e1c2f2eb5c4ffe91cff144589d186f972fde2b7b Mon Sep 17 00:00:00 2001 From: Louis Merlin Date: Fri, 5 May 2023 14:54:13 +0200 Subject: [PATCH 4/7] Simplify CmpLog argument insert --- src/bin/cargo-afl.rs | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-) diff --git a/src/bin/cargo-afl.rs b/src/bin/cargo-afl.rs index 6eec435c4..e57095252 100644 --- a/src/bin/cargo-afl.rs +++ b/src/bin/cargo-afl.rs @@ -40,22 +40,12 @@ fn main() { run_afl(args, "afl-cmin", None); } Some(("fuzz", sub_matches)) => { - let mut args = sub_matches + let args = sub_matches .get_many::("afl-fuzz args") .unwrap_or_default(); - // We use next recursively on the args iterator, until we hit "--". - // We are then able to append `-c0` to the AFL++ arguments. - let mut front_args = vec![]; - let separator = OsString::from("--"); - let cmplog_flag = OsString::from("-c0"); - for next_value in args.by_ref() { - if *next_value == separator { - front_args.push(&cmplog_flag); - break; - } - front_args.push(next_value); - } - let args = front_args.into_iter().chain(args); + // We prepend -c0 to the AFL++ arguments + let cmplog_flag = vec![OsString::from("-c0")]; + let args = cmplog_flag.iter().chain(args); let timeout = sub_matches.get_one::("max_total_time").copied(); if timeout.is_some() { eprintln!( From b37a9345853956e76f265cba55dc8b9c1b090f98 Mon Sep 17 00:00:00 2001 From: Louis Date: Tue, 9 May 2023 11:56:20 +0200 Subject: [PATCH 5/7] Remove CmpLog trace-divs flag --- src/bin/cargo-afl.rs | 1 - 1 file changed, 1 deletion(-) diff --git a/src/bin/cargo-afl.rs b/src/bin/cargo-afl.rs index e57095252..98cc3c4d9 100644 --- a/src/bin/cargo-afl.rs +++ b/src/bin/cargo-afl.rs @@ -374,7 +374,6 @@ where -C llvm-args=-sanitizer-coverage-trace-pc-guard \ -C llvm-args=-sanitizer-coverage-prune-blocks=0 \ -C llvm-args=-sanitizer-coverage-trace-compares \ - -C llvm-args=-sanitizer-coverage-trace-divs \ -C opt-level=3 \ -C target-cpu=native " ); From e333222c746088455c54dc256c3635ac7d23907a Mon Sep 17 00:00:00 2001 From: Louis Date: Tue, 9 May 2023 11:56:46 +0200 Subject: [PATCH 6/7] Remove mention of -c flag in example code comment --- examples/cmplog.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/cmplog.rs b/examples/cmplog.rs index 159954833..0320e149c 100644 --- a/examples/cmplog.rs +++ b/examples/cmplog.rs @@ -1,6 +1,6 @@ fn main() { // This fuzz harness demonstrates the capabilities of CmpLog. - // Simply run the fuzzer with the `-c 0` flag and it should find the crash immediately. + // Simply run the fuzzer and it should find the crash immediately. afl::fuzz!(|data: &[u8]| { if data.len() != 16 { return; From f185584445712de997733cb62ba44b551ed1918c Mon Sep 17 00:00:00 2001 From: Louis Merlin Date: Tue, 9 May 2023 19:39:30 +0200 Subject: [PATCH 7/7] Fix clippy warning --- examples/cmplog.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/cmplog.rs b/examples/cmplog.rs index 0320e149c..285d63390 100644 --- a/examples/cmplog.rs +++ b/examples/cmplog.rs @@ -18,7 +18,7 @@ fn main() { return; } - if data[4..8] != 0x69694141_i32.to_le_bytes() { + if data[4..8] != 0x6969_4141_i32.to_le_bytes() { return; };