Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix cmplog implementation #2439

Merged
merged 8 commits into from
Jul 25, 2024
Merged

Fix cmplog implementation #2439

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
7db34b1
fix cmplog implementation
R9295 Jul 24, 2024
cd526ee
libafl-fuzz: fix minor CI
R9295 Jul 24, 2024
97475ca
add missing fields to AFLppCmpLogOperands
R9295 Jul 24, 2024
a094ac0
libafl-fuzz: pin CI AFL version to a commit
R9295 Jul 24, 2024
ef02a9b
libafl-fuzz: fix CI
R9295 Jul 24, 2024
c157273
this should not panic
R9295 Jul 25, 2024
bc6f364
aaa
tokatoka Jul 25, 2024
c097d71
libafl-fuzz: fix cmplog CI
R9295 Jul 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions fuzzers/others/libafl-fuzz/Makefile.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ PROFILE_DIR = {value = "release", condition = {env_not_set = ["PROFILE_DIR"] }}
FUZZER_NAME = 'libafl-fuzz'
FUZZER = '${CARGO_TARGET_DIR}/${PROFILE_DIR}/${FUZZER_NAME}'
LLVM_CONFIG = {value = "llvm-config-18", condition = {env_not_set = ["LLVM_CONFIG"] }}
AFL_VERSION = "4.21c"
AFL_VERSION = "stable"
R9295 marked this conversation as resolved.
Show resolved Hide resolved
AFL_DIR_NAME= {value = "./AFLplusplus-${AFL_VERSION}"}
AFL_CC_PATH= {value = "${AFL_DIR_NAME}/afl-clang-fast"}

Expand All @@ -18,8 +18,8 @@ if [ ! -d "$AFL_DIR_NAME" ]; then
if [ -f "v${AFL_VERSION}.zip" ]; then
rm v${AFL_VERSION}.zip
fi
wget https://github.com/AFLplusplus/AFLplusplus/archive/refs/tags/v${AFL_VERSION}.zip
unzip v${AFL_VERSION}.zip
wget https://github.com/AFLplusplus/AFLplusplus/archive/refs/heads/stable.zip
unzip ${AFL_VERSION}.zip
cd ${AFL_DIR_NAME}
LLVM_CONFIG=${LLVM_CONFIG} make
cd ..
Expand Down Expand Up @@ -61,8 +61,8 @@ test -d "./test/output/fuzzer_main/crashes" || {
# cmplog TODO: AFL_BENCH_UNTIL_CRASH=1 instead of timeout 15s
AFL_LLVM_CMPLOG=1 AFL_PATH=${AFL_DIR_NAME} ${AFL_CC_PATH} ./test/test-cmplog.c -o ./test/out-cmplog
AFL_CORES=1 timeout 15 ${FUZZER} -Z -l 3 -m 0 -V30 -i ./test/seeds_cmplog -o ./test/cmplog-output -c 0 ./test/out-cmplog >>errors 2>&1
test -n "$( ls ./test/cmplog-output/fuzzer_main/crashes/id:000000* ./test/cmplog-output/hangs/id:000000* 2>/dev/null )" || {
echo "no crashes found when running cmplog"
test -n "$( ls ./test/cmplog-output/fuzzer_main/crashes/id:00000* 2>/dev/null )" || {
echo "No crashes found"
exit 1
}
'''
Expand All @@ -77,7 +77,7 @@ windows_alias = "unsupported"
script_runner="@shell"
script='''
rm -rf AFLplusplus-${AFL_VERSION}
rm v${AFL_VERSION}.zip
rm ${AFL_VERSION}.zip
rm -rf ./test/out-instr
rm -rf ./test/output
'''
4 changes: 3 additions & 1 deletion libafl/src/corpus/inmemory_ondisk.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -413,7 +413,9 @@ where
file_name
};

*testcase.file_path_mut() = Some(self.dir_path.join(&file_name));
if testcase.file_path().is_none() {
*testcase.file_path_mut() = Some(self.dir_path.join(&file_name));
}
*testcase.filename_mut() = Some(file_name);

if self.meta_format.is_some() {
Expand Down
19 changes: 10 additions & 9 deletions libafl_targets/src/cmplog.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,12 +11,7 @@
#define CMPLOG_MAP_H 32
#endif

// difference between aflpp and libafl
#ifdef CMPLOG_EXTENDED
#define CMPLOG_RTN_LEN 31
#else
#define CMPLOG_RTN_LEN 32
#endif
#define CMPLOG_RTN_LEN 32

#define CMPLOG_MAP_RTN_H \
((CMPLOG_MAP_H * sizeof(CmpLogInstruction)) / sizeof(CmpLogRoutine))
Expand Down Expand Up @@ -57,10 +52,15 @@ typedef struct CmpLogInstruction {

typedef struct CmpLogInstructionExtended {
uint64_t v0;
uint64_t v1;
uint64_t v0_128;
uint64_t v0_256_0; // u256 is unsupported by any compiler for now, so future use
uint64_t v0_256_1;
uint64_t v1;
uint64_t v1_128;
} CmpLogInstructionExtended;
uint64_t v1_256_0;
uint64_t v1_256_1;
uint8_t unused[8];
} __attribute__((packed)) CmpLogInstructionExtended;

typedef struct CmpLogRoutine {
uint8_t v0[CMPLOG_RTN_LEN];
Expand All @@ -72,7 +72,8 @@ typedef struct CmpLogRoutineExtended {
uint8_t v0_len;
uint8_t v1[CMPLOG_RTN_LEN];
uint8_t v1_len;
} CmpLogRoutineExtended;
uint8_t unused[6];
} __attribute__((packed)) CmpLogRoutineExtended;

typedef struct CmpLogMap {
CmpLogHeader headers[CMPLOG_MAP_W];
Expand Down
42 changes: 30 additions & 12 deletions libafl_targets/src/cmps/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,9 +88,14 @@ pub struct CmpLogHeader {
/// comparison size is determined by the `hits` field of the associated `AFLppCmpLogHeader`.
pub struct AFLppCmpLogOperands {
v0: u64,
v1: u64,
v0_128: u64,
v0_256_0: u64,
v0_256_1: u64,
v1: u64,
v1_128: u64,
v1_256_0: u64,
v1_256_1: u64,
unused: [u8; 8],
}

impl AFLppCmpLogOperands {
Expand All @@ -99,9 +104,14 @@ impl AFLppCmpLogOperands {
pub fn new(v0: u64, v1: u64) -> Self {
Self {
v0,
v1,
v0_128: 0,
v0_256_0: 0,
v0_256_1: 0,
v1,
v1_128: 0,
v1_256_0: 0,
v1_256_1: 0,
unused: [0; 8],
}
}

Expand All @@ -115,9 +125,14 @@ impl AFLppCmpLogOperands {

Self {
v0,
v1,
v0_128,
v0_256_0: 0,
v0_256_1: 0,
v1,
v1_128,
v1_256_0: 0,
v1_256_1: 0,
unused: [0; 8],
}
}

Expand Down Expand Up @@ -414,10 +429,15 @@ pub static mut libafl_cmplog_map_extended: AFLppCmpLogMap = AFLppCmpLogMap {
headers: [AFLppCmpLogHeader { data: [0; 2] }; CMPLOG_MAP_W],
vals: AFLppCmpLogVals {
operands: [[AFLppCmpLogOperands {
v0: 0,
v1: 0,
v0_128: 0,
v1_128: 0,
v0:0,
v0_128:0,
v0_256_0: 0,
v0_256_1: 0,
v1:0,
v1_128,
v1_256_0: 0,
v1_256_1: 0,
unused: [0; 8],
}; CMPLOG_MAP_H]; CMPLOG_MAP_W],
},
};
Expand Down Expand Up @@ -535,18 +555,16 @@ impl CmpMap for AFLppCmpLogMap {
self.vals.operands[idx][execution].v0,
self.vals.operands[idx][execution].v1,
))),
// TODO handle 128 bits cmps
// TODO handle 128 bits & 256 bits cmps
// other => panic!("Invalid CmpLog shape {}", other),
_ => None,
}
}
} else {
unsafe {
let v0_len = self.vals.fn_operands[idx][execution].v0_len & (0x80 - 1);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why you don't look at len anymore?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From my understanding, this was only necessary due to the length of the v1/v0 array being 31 instead of 32 right?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm no.
sometimes each fn operands has its length (not necessarily 32). so you should keep the length

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, random question, could we get around the allocation here?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not possible.
the tokens have to be copied from the shared mem. else it'll be overwritten in the next round

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But they could be copied to a preexisting buffer

Copy link
Member

@tokatoka tokatoka Jul 25, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

but we don't know how many of them needs buffer so we can't decide its size.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's only up to 64 bytes, so we could just always have 64 bytes extra?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Like, just memcpy the existing struct and make a nice accessor around it that returns a slice

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See #2442

let v1_len = self.vals.fn_operands[idx][execution].v1_len & (0x80 - 1);
Some(CmpValues::Bytes((
self.vals.fn_operands[idx][execution].v0[..(v0_len as usize)].to_vec(),
self.vals.fn_operands[idx][execution].v1[..(v1_len as usize)].to_vec(),
self.vals.fn_operands[idx][execution].v0.to_vec(),
self.vals.fn_operands[idx][execution].v1.to_vec(),
)))
}
}
Expand Down
Loading