Skip to content

Port random fuzzing parameters to AFLplusplus #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jiradeto wants to merge 8 commits into
base: stable
Choose a base branch
from
Open

Port random fuzzing parameters to AFLplusplus #1

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
4f1f4e3
port random fuzzing parameters into afl++
jiradeto Aug 26, 2021
b960042
adjust default parameter
jiradeto Sep 18, 2021
0a2111b
initialize fuzzing params
jiradeto Sep 23, 2021
3d9cf95
initialize fuzzing params using function
jiradeto Sep 23, 2021
7eb9fb0
remove struct that stores potential favored inputs
jiradeto Oct 1, 2021
2910361
skip mini map elimination
jiradeto Oct 1, 2021
65ce02b
fix typo
jiradeto Oct 4, 2021
986d6b5
address PR feedbacks
jiradeto Oct 4, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 2 additions & 10 deletions include/afl-fuzz.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,10 +149,6 @@ struct tainted {

};

struct potential_favored_input {
struct queue_entry *queue;
struct potential_favored_input *next;
};
struct queue_entry {

u8 *fname; /* File name for the test case */
Expand Down Expand Up @@ -198,7 +194,7 @@ struct queue_entry {
u8 * cmplog_colorinput; /* the result buf of colorization */
struct tainted *taint; /* Taint information from CmpLog */

struct queue_entry *mother; /* queue entry this based on */
struct queue_entry *mother; /* queue entry this based on */

};

Expand All @@ -210,8 +206,6 @@ struct extra_data {

};



struct auto_extra_data {

u8 data[MAX_AUTO_EXTRA]; /* Dictionary token data */
Expand Down Expand Up @@ -645,7 +639,7 @@ typedef struct afl_state {
struct extra_data *extras; /* Extra tokens to fuzz with */
u32 extras_cnt; /* Total number of tokens read */

struct potential_favored_input* potential_favored_list[MAP_SIZE];
struct queue_entry* edge_to_minimum_entry[MAP_SIZE];

struct auto_extra_data
a_extras[MAX_AUTO_EXTRAS]; /* Automatically selected extras */
Expand Down Expand Up @@ -787,8 +781,6 @@ typedef struct afl_state {

} afl_state_t;



struct custom_mutator {

const char *name;
Expand Down
58 changes: 20 additions & 38 deletions src/afl-fuzz-queue.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -525,23 +525,6 @@ void update_bitmap_score(afl_state_t *afl, struct queue_entry *q) {
u64 fav_factor;
u64 fuzz_p2;

// this overides how afl tracks score for favorite input selection
if (!afl->disable_random_favorites) {
for (i = 0; i < MAP_SIZE; i++) {
if (afl->fsrv.trace_bits[i]) {

// insert a new element of input into a linked list for current edge id
struct potential_favored_input* new_potential = ck_alloc(sizeof(struct potential_favored_input));
new_potential->queue = q;
new_potential->next = afl->potential_favored_list[i];

afl->potential_favored_list[i] = new_potential;
afl->score_changed = 1;
}
}
return;
}

if (unlikely(afl->schedule >= FAST && afl->schedule < RARE))
fuzz_p2 = 0; // Skip the fuzz_p2 comparison
else if (unlikely(afl->schedule == RARE))
Expand Down Expand Up @@ -656,7 +639,7 @@ void cull_queue(afl_state_t *afl) {
if (likely(!afl->score_changed || afl->non_instrumented_mode)) { return; }

u32 len = (afl->fsrv.map_size >> 3);
u32 i;
u32 i, j;
u8 *temp_v = afl->map_tmp_buf;

afl->score_changed = 0;
Expand Down Expand Up @@ -758,34 +741,33 @@ void cull_queue(afl_state_t *afl) {
afl->queue_buf[i]->rand = rid;
}

for (i = 0; i < MAP_SIZE; i++) {
if (afl->potential_favored_list[i]) {
struct potential_favored_input* potential_input = afl->potential_favored_list[i];
struct queue_entry* new_top_rated;
int minimum_random_number = INT_MAX;

while (potential_input) {
// if the random is the new minimum, the seed is favored
if (potential_input->queue->rand < minimum_random_number) {
minimum_random_number = potential_input->queue->rand;
new_top_rated = potential_input->queue;
}
potential_input = potential_input->next;
}
// reset findings from the previous cycle
memset(afl->edge_to_minimum_entry, 0, afl->fsrv.map_size * sizeof(struct queue_entry));
Comment thread
wuestholz marked this conversation as resolved.
Outdated

if (new_top_rated && !new_top_rated->favored) {
new_top_rated->favored = 1;
afl->queued_favored++;
if (!new_top_rated->was_fuzzed)
afl->pending_favored++;
// going through all entries, iteratvely check for covered edges and compare against the corresponding minimum entry
Comment thread
wuestholz marked this conversation as resolved.
Outdated
for (i = 0; i < afl->queued_paths; i++) {
Comment thread
jiradeto marked this conversation as resolved.
Outdated
if (afl->queue_buf[i]->trace_mini) {
for (j = 0; j < afl->fsrv.map_size; j++) {
if (afl->queue_buf[i]->trace_mini[j >> 3] & (1 <<(j & 7))) {
if (!afl->edge_to_minimum_entry[j] || afl->queue_buf[i]->rand < afl->edge_to_minimum_entry[j]->rand) {
Comment thread
jiradeto marked this conversation as resolved.
Outdated
afl->edge_to_minimum_entry[j] = afl->queue_buf[i];
}
}
}
}
}

for (i = 0; i < afl->fsrv.map_size; i++) {
if (afl->edge_to_minimum_entry[i] && !afl->edge_to_minimum_entry[i]->favored) {
Comment thread
jiradeto marked this conversation as resolved.
Outdated
afl->edge_to_minimum_entry[i]->favored = 1;
afl->queued_favored++;
if (!afl->edge_to_minimum_entry[i]->was_fuzzed)
afl->pending_favored++;
}
}
}

for (i = 0; i < afl->queued_paths; i++) {

if (likely(!afl->queue_buf[i]->disabled)) {

mark_as_redundant(afl, afl->queue_buf[i], !afl->queue_buf[i]->favored);
Expand Down