1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156 |
- /*
- american fuzzy lop - test case minimizer
- ----------------------------------------
- Written and maintained by Michal Zalewski <lcamtuf@google.com>
- Copyright 2015, 2016, 2017 Google Inc. All rights reserved.
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at:
- http://www.apache.org/licenses/LICENSE-2.0
- A simple test case minimizer that takes an input file and tries to remove
- as much data as possible while keeping the binary in a crashing state
- *or* producing consistent instrumentation output (the mode is auto-selected
- based on the initially observed behavior).
- */
- #define AFL_MAIN
- #include "config.h"
- #include "types.h"
- #include "debug.h"
- #include "alloc-inl.h"
- #include "hash.h"
- #include <stdio.h>
- #include <unistd.h>
- #include <stdlib.h>
- #include <string.h>
- #include <time.h>
- #include <errno.h>
- #include <signal.h>
- #include <dirent.h>
- #include <fcntl.h>
- #include <sys/wait.h>
- #include <sys/time.h>
- #include <sys/shm.h>
- #include <sys/stat.h>
- #include <sys/types.h>
- #include <sys/resource.h>
- static s32 child_pid; /* PID of the tested program */
- static u8 *trace_bits, /* SHM with instrumentation bitmap */
- *mask_bitmap; /* Mask for trace bits (-B) */
- static u8 *in_file, /* Minimizer input test case */
- *out_file, /* Minimizer output file */
- *prog_in, /* Targeted program input file */
- *target_path, /* Path to target binary */
- *doc_path; /* Path to docs */
- static u8* in_data; /* Input data for trimming */
- static u32 in_len, /* Input data length */
- orig_cksum, /* Original checksum */
- total_execs, /* Total number of execs */
- missed_hangs, /* Misses due to hangs */
- missed_crashes, /* Misses due to crashes */
- missed_paths, /* Misses due to exec path diffs */
- exec_tmout = EXEC_TIMEOUT; /* Exec timeout (ms) */
- static u64 mem_limit = MEM_LIMIT; /* Memory limit (MB) */
- static s32 shm_id, /* ID of the SHM region */
- dev_null_fd = -1; /* FD to /dev/null */
- static u8 crash_mode, /* Crash-centric mode? */
- exit_crash, /* Treat non-zero exit as crash? */
- edges_only, /* Ignore hit counts? */
- exact_mode, /* Require path match for crashes? */
- use_stdin = 1; /* Use stdin for program input? */
- static volatile u8
- stop_soon, /* Ctrl-C pressed? */
- child_timed_out; /* Child timed out? */
- /* Classify tuple counts. This is a slow & naive version, but good enough here. */
- static const u8 count_class_lookup[256] = {
- [0] = 0,
- [1] = 1,
- [2] = 2,
- [3] = 4,
- [4 ... 7] = 8,
- [8 ... 15] = 16,
- [16 ... 31] = 32,
- [32 ... 127] = 64,
- [128 ... 255] = 128
- };
- static void classify_counts(u8* mem) {
- u32 i = MAP_SIZE;
- if (edges_only) {
- while (i--) {
- if (*mem) *mem = 1;
- mem++;
- }
- } else {
- while (i--) {
- *mem = count_class_lookup[*mem];
- mem++;
- }
- }
- }
- /* Apply mask to classified bitmap (if set). */
- static void apply_mask(u32* mem, u32* mask) {
- u32 i = (MAP_SIZE >> 2);
- if (!mask) return;
- while (i--) {
- *mem &= ~*mask;
- mem++;
- mask++;
- }
- }
- /* See if any bytes are set in the bitmap. */
- static inline u8 anything_set(void) {
- u32* ptr = (u32*)trace_bits;
- u32 i = (MAP_SIZE >> 2);
- while (i--) if (*(ptr++)) return 1;
- return 0;
- }
- /* Get rid of shared memory and temp files (atexit handler). */
- static void remove_shm(void) {
- if (prog_in) unlink(prog_in); /* Ignore errors */
- shmctl(shm_id, IPC_RMID, NULL);
- }
- /* Configure shared memory. */
- static void setup_shm(void) {
- u8* shm_str;
- shm_id = shmget(IPC_PRIVATE, MAP_SIZE, IPC_CREAT | IPC_EXCL | 0600);
- if (shm_id < 0) PFATAL("shmget() failed");
- atexit(remove_shm);
- shm_str = alloc_printf("%d", shm_id);
- setenv(SHM_ENV_VAR, shm_str, 1);
- ck_free(shm_str);
- trace_bits = shmat(shm_id, NULL, 0);
-
- if (!trace_bits) PFATAL("shmat() failed");
- }
- /* Read initial file. */
- static void read_initial_file(void) {
- struct stat st;
- s32 fd = open(in_file, O_RDONLY);
- if (fd < 0) PFATAL("Unable to open '%s'", in_file);
- if (fstat(fd, &st) || !st.st_size)
- FATAL("Zero-sized input file.");
- if (st.st_size >= TMIN_MAX_FILE)
- FATAL("Input file is too large (%u MB max)", TMIN_MAX_FILE / 1024 / 1024);
- in_len = st.st_size;
- in_data = ck_alloc_nozero(in_len);
- ck_read(fd, in_data, in_len, in_file);
- close(fd);
- OKF("Read %u byte%s from '%s'.", in_len, in_len == 1 ? "" : "s", in_file);
- }
- /* Write output file. */
- static s32 write_to_file(u8* path, u8* mem, u32 len) {
- s32 ret;
- unlink(path); /* Ignore errors */
- ret = open(path, O_RDWR | O_CREAT | O_EXCL, 0600);
- if (ret < 0) PFATAL("Unable to create '%s'", path);
- ck_write(ret, mem, len, path);
- lseek(ret, 0, SEEK_SET);
- return ret;
- }
- /* Handle timeout signal. */
- static void handle_timeout(int sig) {
- child_timed_out = 1;
- if (child_pid > 0) kill(child_pid, SIGKILL);
- }
- /* Execute target application. Returns 0 if the changes are a dud, or
- 1 if they should be kept. */
- static u8 run_target(char** argv, u8* mem, u32 len, u8 first_run) {
- static struct itimerval it;
- int status = 0;
- s32 prog_in_fd;
- u32 cksum;
- memset(trace_bits, 0, MAP_SIZE);
- MEM_BARRIER();
- prog_in_fd = write_to_file(prog_in, mem, len);
- child_pid = fork();
- if (child_pid < 0) PFATAL("fork() failed");
- if (!child_pid) {
- struct rlimit r;
- if (dup2(use_stdin ? prog_in_fd : dev_null_fd, 0) < 0 ||
- dup2(dev_null_fd, 1) < 0 ||
- dup2(dev_null_fd, 2) < 0) {
- *(u32*)trace_bits = EXEC_FAIL_SIG;
- PFATAL("dup2() failed");
- }
- close(dev_null_fd);
- close(prog_in_fd);
- setsid();
- if (mem_limit) {
- r.rlim_max = r.rlim_cur = ((rlim_t)mem_limit) << 20;
- #ifdef RLIMIT_AS
- setrlimit(RLIMIT_AS, &r); /* Ignore errors */
- #else
- setrlimit(RLIMIT_DATA, &r); /* Ignore errors */
- #endif /* ^RLIMIT_AS */
- }
- r.rlim_max = r.rlim_cur = 0;
- setrlimit(RLIMIT_CORE, &r); /* Ignore errors */
- execv(target_path, argv);
- *(u32*)trace_bits = EXEC_FAIL_SIG;
- exit(0);
- }
- close(prog_in_fd);
- /* Configure timeout, wait for child, cancel timeout. */
- child_timed_out = 0;
- it.it_value.tv_sec = (exec_tmout / 1000);
- it.it_value.tv_usec = (exec_tmout % 1000) * 1000;
- setitimer(ITIMER_REAL, &it, NULL);
- if (waitpid(child_pid, &status, 0) <= 0) FATAL("waitpid() failed");
- child_pid = 0;
- it.it_value.tv_sec = 0;
- it.it_value.tv_usec = 0;
- setitimer(ITIMER_REAL, &it, NULL);
- MEM_BARRIER();
- /* Clean up bitmap, analyze exit condition, etc. */
- if (*(u32*)trace_bits == EXEC_FAIL_SIG)
- FATAL("Unable to execute '%s'", argv[0]);
- classify_counts(trace_bits);
- apply_mask((u32*)trace_bits, (u32*)mask_bitmap);
- total_execs++;
- if (stop_soon) {
- SAYF(cRST cLRD "\n+++ Minimization aborted by user +++\n" cRST);
- close(write_to_file(out_file, in_data, in_len));
- exit(1);
- }
- /* Always discard inputs that time out. */
- if (child_timed_out) {
- missed_hangs++;
- return 0;
- }
- /* Handle crashing inputs depending on current mode. */
- if (WIFSIGNALED(status) ||
- (WIFEXITED(status) && WEXITSTATUS(status) == MSAN_ERROR) ||
- (WIFEXITED(status) && WEXITSTATUS(status) && exit_crash)) {
- if (first_run) crash_mode = 1;
- if (crash_mode) {
- if (!exact_mode) return 1;
- } else {
- missed_crashes++;
- return 0;
- }
- } else
- /* Handle non-crashing inputs appropriately. */
- if (crash_mode) {
- missed_paths++;
- return 0;
- }
- cksum = hash32(trace_bits, MAP_SIZE, HASH_CONST);
- if (first_run) orig_cksum = cksum;
- if (orig_cksum == cksum) return 1;
-
- missed_paths++;
- return 0;
- }
- /* Find first power of two greater or equal to val. */
- static u32 next_p2(u32 val) {
- u32 ret = 1;
- while (val > ret) ret <<= 1;
- return ret;
- }
- /* Actually minimize! */
- static void minimize(char** argv) {
- static u32 alpha_map[256];
- u8* tmp_buf = ck_alloc_nozero(in_len);
- u32 orig_len = in_len, stage_o_len;
- u32 del_len, set_len, del_pos, set_pos, i, alpha_size, cur_pass = 0;
- u32 syms_removed, alpha_del0 = 0, alpha_del1, alpha_del2, alpha_d_total = 0;
- u8 changed_any, prev_del;
- /***********************
- * BLOCK NORMALIZATION *
- ***********************/
- set_len = next_p2(in_len / TMIN_SET_STEPS);
- set_pos = 0;
- if (set_len < TMIN_SET_MIN_SIZE) set_len = TMIN_SET_MIN_SIZE;
- ACTF(cBRI "Stage #0: " cRST "One-time block normalization...");
- while (set_pos < in_len) {
- u8 res;
- u32 use_len = MIN(set_len, in_len - set_pos);
- for (i = 0; i < use_len; i++)
- if (in_data[set_pos + i] != '0') break;
- if (i != use_len) {
- memcpy(tmp_buf, in_data, in_len);
- memset(tmp_buf + set_pos, '0', use_len);
-
- res = run_target(argv, tmp_buf, in_len, 0);
- if (res) {
- memset(in_data + set_pos, '0', use_len);
- changed_any = 1;
- alpha_del0 += use_len;
- }
- }
- set_pos += set_len;
- }
- alpha_d_total += alpha_del0;
- OKF("Block normalization complete, %u byte%s replaced.", alpha_del0,
- alpha_del0 == 1 ? "" : "s");
- next_pass:
- ACTF(cYEL "--- " cBRI "Pass #%u " cYEL "---", ++cur_pass);
- changed_any = 0;
- /******************
- * BLOCK DELETION *
- ******************/
- del_len = next_p2(in_len / TRIM_START_STEPS);
- stage_o_len = in_len;
- ACTF(cBRI "Stage #1: " cRST "Removing blocks of data...");
- next_del_blksize:
- if (!del_len) del_len = 1;
- del_pos = 0;
- prev_del = 1;
- SAYF(cGRA " Block length = %u, remaining size = %u\n" cRST,
- del_len, in_len);
- while (del_pos < in_len) {
- u8 res;
- s32 tail_len;
- tail_len = in_len - del_pos - del_len;
- if (tail_len < 0) tail_len = 0;
- /* If we have processed at least one full block (initially, prev_del == 1),
- and we did so without deleting the previous one, and we aren't at the
- very end of the buffer (tail_len > 0), and the current block is the same
- as the previous one... skip this step as a no-op. */
- if (!prev_del && tail_len && !memcmp(in_data + del_pos - del_len,
- in_data + del_pos, del_len)) {
- del_pos += del_len;
- continue;
- }
- prev_del = 0;
- /* Head */
- memcpy(tmp_buf, in_data, del_pos);
- /* Tail */
- memcpy(tmp_buf + del_pos, in_data + del_pos + del_len, tail_len);
- res = run_target(argv, tmp_buf, del_pos + tail_len, 0);
- if (res) {
- memcpy(in_data, tmp_buf, del_pos + tail_len);
- prev_del = 1;
- in_len = del_pos + tail_len;
- changed_any = 1;
- } else del_pos += del_len;
- }
- if (del_len > 1 && in_len >= 1) {
- del_len /= 2;
- goto next_del_blksize;
- }
- OKF("Block removal complete, %u bytes deleted.", stage_o_len - in_len);
- if (!in_len && changed_any)
- WARNF(cLRD "Down to zero bytes - check the command line and mem limit!" cRST);
- if (cur_pass > 1 && !changed_any) goto finalize_all;
- /*************************
- * ALPHABET MINIMIZATION *
- *************************/
- alpha_size = 0;
- alpha_del1 = 0;
- syms_removed = 0;
- memset(alpha_map, 0, 256 * sizeof(u32));
- for (i = 0; i < in_len; i++) {
- if (!alpha_map[in_data[i]]) alpha_size++;
- alpha_map[in_data[i]]++;
- }
- ACTF(cBRI "Stage #2: " cRST "Minimizing symbols (%u code point%s)...",
- alpha_size, alpha_size == 1 ? "" : "s");
- for (i = 0; i < 256; i++) {
- u32 r;
- u8 res;
- if (i == '0' || !alpha_map[i]) continue;
- memcpy(tmp_buf, in_data, in_len);
- for (r = 0; r < in_len; r++)
- if (tmp_buf[r] == i) tmp_buf[r] = '0';
- res = run_target(argv, tmp_buf, in_len, 0);
- if (res) {
- memcpy(in_data, tmp_buf, in_len);
- syms_removed++;
- alpha_del1 += alpha_map[i];
- changed_any = 1;
- }
- }
- alpha_d_total += alpha_del1;
- OKF("Symbol minimization finished, %u symbol%s (%u byte%s) replaced.",
- syms_removed, syms_removed == 1 ? "" : "s",
- alpha_del1, alpha_del1 == 1 ? "" : "s");
- /**************************
- * CHARACTER MINIMIZATION *
- **************************/
- alpha_del2 = 0;
- ACTF(cBRI "Stage #3: " cRST "Character minimization...");
- memcpy(tmp_buf, in_data, in_len);
- for (i = 0; i < in_len; i++) {
- u8 res, orig = tmp_buf[i];
- if (orig == '0') continue;
- tmp_buf[i] = '0';
- res = run_target(argv, tmp_buf, in_len, 0);
- if (res) {
- in_data[i] = '0';
- alpha_del2++;
- changed_any = 1;
- } else tmp_buf[i] = orig;
- }
- alpha_d_total += alpha_del2;
- OKF("Character minimization done, %u byte%s replaced.",
- alpha_del2, alpha_del2 == 1 ? "" : "s");
- if (changed_any) goto next_pass;
- finalize_all:
- SAYF("\n"
- cGRA " File size reduced by : " cRST "%0.02f%% (to %u byte%s)\n"
- cGRA " Characters simplified : " cRST "%0.02f%%\n"
- cGRA " Number of execs done : " cRST "%u\n"
- cGRA " Fruitless execs : " cRST "path=%u crash=%u hang=%s%u\n\n",
- 100 - ((double)in_len) * 100 / orig_len, in_len, in_len == 1 ? "" : "s",
- ((double)(alpha_d_total)) * 100 / (in_len ? in_len : 1),
- total_execs, missed_paths, missed_crashes, missed_hangs ? cLRD : "",
- missed_hangs);
- if (total_execs > 50 && missed_hangs * 10 > total_execs)
- WARNF(cLRD "Frequent timeouts - results may be skewed." cRST);
- }
- /* Handle Ctrl-C and the like. */
- static void handle_stop_sig(int sig) {
- stop_soon = 1;
- if (child_pid > 0) kill(child_pid, SIGKILL);
- }
- /* Do basic preparations - persistent fds, filenames, etc. */
- static void set_up_environment(void) {
- u8* x;
- dev_null_fd = open("/dev/null", O_RDWR);
- if (dev_null_fd < 0) PFATAL("Unable to open /dev/null");
- if (!prog_in) {
- u8* use_dir = ".";
- if (access(use_dir, R_OK | W_OK | X_OK)) {
- use_dir = getenv("TMPDIR");
- if (!use_dir) use_dir = "/tmp";
- }
- prog_in = alloc_printf("%s/.afl-tmin-temp-%u", use_dir, getpid());
- }
- /* Set sane defaults... */
- x = getenv("ASAN_OPTIONS");
- if (x) {
- if (!strstr(x, "abort_on_error=1"))
- FATAL("Custom ASAN_OPTIONS set without abort_on_error=1 - please fix!");
- if (!strstr(x, "symbolize=0"))
- FATAL("Custom ASAN_OPTIONS set without symbolize=0 - please fix!");
- }
- x = getenv("MSAN_OPTIONS");
- if (x) {
- if (!strstr(x, "exit_code=" STRINGIFY(MSAN_ERROR)))
- FATAL("Custom MSAN_OPTIONS set without exit_code="
- STRINGIFY(MSAN_ERROR) " - please fix!");
- if (!strstr(x, "symbolize=0"))
- FATAL("Custom MSAN_OPTIONS set without symbolize=0 - please fix!");
- }
- setenv("ASAN_OPTIONS", "abort_on_error=1:"
- "detect_leaks=0:"
- "symbolize=0:"
- "allocator_may_return_null=1", 0);
- setenv("MSAN_OPTIONS", "exit_code=" STRINGIFY(MSAN_ERROR) ":"
- "symbolize=0:"
- "abort_on_error=1:"
- "allocator_may_return_null=1:"
- "msan_track_origins=0", 0);
- if (getenv("AFL_PRELOAD")) {
- setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
- setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
- }
- }
- /* Setup signal handlers, duh. */
- static void setup_signal_handlers(void) {
- struct sigaction sa;
- sa.sa_handler = NULL;
- sa.sa_flags = SA_RESTART;
- sa.sa_sigaction = NULL;
- sigemptyset(&sa.sa_mask);
- /* Various ways of saying "stop". */
- sa.sa_handler = handle_stop_sig;
- sigaction(SIGHUP, &sa, NULL);
- sigaction(SIGINT, &sa, NULL);
- sigaction(SIGTERM, &sa, NULL);
- /* Exec timeout notifications. */
- sa.sa_handler = handle_timeout;
- sigaction(SIGALRM, &sa, NULL);
- }
- /* Detect @@ in args. */
- static void detect_file_args(char** argv) {
- u32 i = 0;
- u8* cwd = getcwd(NULL, 0);
- if (!cwd) PFATAL("getcwd() failed");
- while (argv[i]) {
- u8* aa_loc = strstr(argv[i], "@@");
- if (aa_loc) {
- u8 *aa_subst, *n_arg;
- /* Be sure that we're always using fully-qualified paths. */
- if (prog_in[0] == '/') aa_subst = prog_in;
- else aa_subst = alloc_printf("%s/%s", cwd, prog_in);
- /* Construct a replacement argv value. */
- *aa_loc = 0;
- n_arg = alloc_printf("%s%s%s", argv[i], aa_subst, aa_loc + 2);
- argv[i] = n_arg;
- *aa_loc = '@';
- if (prog_in[0] != '/') ck_free(aa_subst);
- }
- i++;
- }
- free(cwd); /* not tracked */
- }
- /* Display usage hints. */
- static void usage(u8* argv0) {
- SAYF("\n%s [ options ] -- /path/to/target_app [ ... ]\n\n"
- "Required parameters:\n\n"
- " -i file - input test case to be shrunk by the tool\n"
- " -o file - final output location for the minimized data\n\n"
- "Execution control settings:\n\n"
- " -f file - input file read by the tested program (stdin)\n"
- " -t msec - timeout for each run (%u ms)\n"
- " -m megs - memory limit for child process (%u MB)\n"
- " -Q - use binary-only instrumentation (QEMU mode)\n\n"
- "Minimization settings:\n\n"
- " -e - solve for edge coverage only, ignore hit counts\n"
- " -x - treat non-zero exit codes as crashes\n\n"
- "For additional tips, please consult %s/README.\n\n",
- argv0, EXEC_TIMEOUT, MEM_LIMIT, doc_path);
- exit(1);
- }
- /* Find binary. */
- static void find_binary(u8* fname) {
- u8* env_path = 0;
- struct stat st;
- if (strchr(fname, '/') || !(env_path = getenv("PATH"))) {
- target_path = ck_strdup(fname);
- if (stat(target_path, &st) || !S_ISREG(st.st_mode) ||
- !(st.st_mode & 0111) || st.st_size < 4)
- FATAL("Program '%s' not found or not executable", fname);
- } else {
- while (env_path) {
- u8 *cur_elem, *delim = strchr(env_path, ':');
- if (delim) {
- cur_elem = ck_alloc(delim - env_path + 1);
- memcpy(cur_elem, env_path, delim - env_path);
- delim++;
- } else cur_elem = ck_strdup(env_path);
- env_path = delim;
- if (cur_elem[0])
- target_path = alloc_printf("%s/%s", cur_elem, fname);
- else
- target_path = ck_strdup(fname);
- ck_free(cur_elem);
- if (!stat(target_path, &st) && S_ISREG(st.st_mode) &&
- (st.st_mode & 0111) && st.st_size >= 4) break;
- ck_free(target_path);
- target_path = 0;
- }
- if (!target_path) FATAL("Program '%s' not found or not executable", fname);
- }
- }
- /* Fix up argv for QEMU. */
- static char** get_qemu_argv(u8* own_loc, char** argv, int argc) {
- char** new_argv = ck_alloc(sizeof(char*) * (argc + 4));
- u8 *tmp, *cp, *rsl, *own_copy;
- /* Workaround for a QEMU stability glitch. */
- setenv("QEMU_LOG", "nochain", 1);
- memcpy(new_argv + 3, argv + 1, sizeof(char*) * argc);
- /* Now we need to actually find qemu for argv[0]. */
- new_argv[2] = target_path;
- new_argv[1] = "--";
- tmp = getenv("AFL_PATH");
- if (tmp) {
- cp = alloc_printf("%s/afl-qemu-trace", tmp);
- if (access(cp, X_OK))
- FATAL("Unable to find '%s'", tmp);
- target_path = new_argv[0] = cp;
- return new_argv;
- }
- own_copy = ck_strdup(own_loc);
- rsl = strrchr(own_copy, '/');
- if (rsl) {
- *rsl = 0;
- cp = alloc_printf("%s/afl-qemu-trace", own_copy);
- ck_free(own_copy);
- if (!access(cp, X_OK)) {
- target_path = new_argv[0] = cp;
- return new_argv;
- }
- } else ck_free(own_copy);
- if (!access(BIN_PATH "/afl-qemu-trace", X_OK)) {
- target_path = new_argv[0] = BIN_PATH "/afl-qemu-trace";
- return new_argv;
- }
- FATAL("Unable to find 'afl-qemu-trace'.");
- }
- /* Read mask bitmap from file. This is for the -B option. */
- static void read_bitmap(u8* fname) {
- s32 fd = open(fname, O_RDONLY);
- if (fd < 0) PFATAL("Unable to open '%s'", fname);
- ck_read(fd, mask_bitmap, MAP_SIZE, fname);
- close(fd);
- }
- /* Main entry point */
- int main(int argc, char** argv) {
- s32 opt;
- u8 mem_limit_given = 0, timeout_given = 0, qemu_mode = 0;
- char** use_argv;
- doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH;
- SAYF(cCYA "afl-tmin " cBRI VERSION cRST " by <lcamtuf@google.com>\n");
- while ((opt = getopt(argc,argv,"+i:o:f:m:t:B:xeQ")) > 0)
- switch (opt) {
- case 'i':
- if (in_file) FATAL("Multiple -i options not supported");
- in_file = optarg;
- break;
- case 'o':
- if (out_file) FATAL("Multiple -o options not supported");
- out_file = optarg;
- break;
- case 'f':
- if (prog_in) FATAL("Multiple -f options not supported");
- use_stdin = 0;
- prog_in = optarg;
- break;
- case 'e':
- if (edges_only) FATAL("Multiple -e options not supported");
- edges_only = 1;
- break;
- case 'x':
- if (exit_crash) FATAL("Multiple -x options not supported");
- exit_crash = 1;
- break;
- case 'm': {
- u8 suffix = 'M';
- if (mem_limit_given) FATAL("Multiple -m options not supported");
- mem_limit_given = 1;
- if (!strcmp(optarg, "none")) {
- mem_limit = 0;
- break;
- }
- if (sscanf(optarg, "%llu%c", &mem_limit, &suffix) < 1 ||
- optarg[0] == '-') FATAL("Bad syntax used for -m");
- switch (suffix) {
- case 'T': mem_limit *= 1024 * 1024; break;
- case 'G': mem_limit *= 1024; break;
- case 'k': mem_limit /= 1024; break;
- case 'M': break;
- default: FATAL("Unsupported suffix or bad syntax for -m");
- }
- if (mem_limit < 5) FATAL("Dangerously low value of -m");
- if (sizeof(rlim_t) == 4 && mem_limit > 2000)
- FATAL("Value of -m out of range on 32-bit systems");
- }
- break;
- case 't':
- if (timeout_given) FATAL("Multiple -t options not supported");
- timeout_given = 1;
- exec_tmout = atoi(optarg);
- if (exec_tmout < 10 || optarg[0] == '-')
- FATAL("Dangerously low value of -t");
- break;
- case 'Q':
- if (qemu_mode) FATAL("Multiple -Q options not supported");
- if (!mem_limit_given) mem_limit = MEM_LIMIT_QEMU;
- qemu_mode = 1;
- break;
- case 'B': /* load bitmap */
- /* This is a secret undocumented option! It is speculated to be useful
- if you have a baseline "boring" input file and another "interesting"
- file you want to minimize.
- You can dump a binary bitmap for the boring file using
- afl-showmap -b, and then load it into afl-tmin via -B. The minimizer
- will then minimize to preserve only the edges that are unique to
- the interesting input file, but ignoring everything from the
- original map.
- The option may be extended and made more official if it proves
- to be useful. */
- if (mask_bitmap) FATAL("Multiple -B options not supported");
- mask_bitmap = ck_alloc(MAP_SIZE);
- read_bitmap(optarg);
- break;
- default:
- usage(argv[0]);
- }
- if (optind == argc || !in_file || !out_file) usage(argv[0]);
- setup_shm();
- setup_signal_handlers();
- set_up_environment();
- find_binary(argv[optind]);
- detect_file_args(argv + optind);
- if (qemu_mode)
- use_argv = get_qemu_argv(argv[0], argv + optind, argc - optind);
- else
- use_argv = argv + optind;
- exact_mode = !!getenv("AFL_TMIN_EXACT");
- SAYF("\n");
- read_initial_file();
- ACTF("Performing dry run (mem limit = %llu MB, timeout = %u ms%s)...",
- mem_limit, exec_tmout, edges_only ? ", edges only" : "");
- run_target(use_argv, in_data, in_len, 1);
- if (child_timed_out)
- FATAL("Target binary times out (adjusting -t may help).");
- if (!crash_mode) {
- OKF("Program terminates normally, minimizing in "
- cCYA "instrumented" cRST " mode.");
- if (!anything_set()) FATAL("No instrumentation detected.");
- } else {
- OKF("Program exits with a signal, minimizing in " cMGN "%scrash" cRST
- " mode.", exact_mode ? "EXACT " : "");
- }
- minimize(use_argv);
- ACTF("Writing output to '%s'...", out_file);
- unlink(prog_in);
- prog_in = NULL;
- close(write_to_file(out_file, in_data, in_len));
- OKF("We're done here. Have a nice day!\n");
- exit(0);
- }
|