├── as ├── README ├── afl-clang ├── afl-clang++ ├── afl-g++ ├── QuickStartGuide.txt ├── testcases ├── others │ ├── text │ │ └── hello_world.txt │ ├── js │ │ └── small_script.js │ ├── xml │ │ └── small_document.xml │ ├── rtf │ │ └── small_document.rtf │ ├── elf │ │ └── small_exec.elf │ ├── sql │ │ └── simple_queries.sql │ ├── pcap │ │ └── small_capture.pcap │ └── pdf │ │ └── small.pdf ├── images │ ├── bmp │ │ └── not_kitty.bmp │ ├── gif │ │ └── not_kitty.gif │ ├── ico │ │ └── not_kitty.ico │ ├── jp2 │ │ └── not_kitty.jp2 │ ├── jxr │ │ └── not_kitty.jxr │ ├── png │ │ ├── not_kitty.png │ │ ├── not_kitty_icc.png │ │ ├── not_kitty_alpha.png │ │ └── not_kitty_gamma.png │ ├── jpeg │ │ └── not_kitty.jpg │ ├── tiff │ │ └── not_kitty.tiff │ └── webp │ │ └── not_kitty.webp ├── multimedia │ └── h264 │ │ └── small_movie.mp4 ├── archives │ ├── common │ │ ├── xz │ │ │ └── small_archive.xz │ │ ├── bzip2 │ │ │ └── small_archive.bz2 │ │ ├── cab │ │ │ └── small_archive.cab │ │ ├── cpio │ │ │ └── small_archive.cpio │ │ ├── gzip │ │ │ └── small_archive.gz │ │ ├── lzo │ │ │ └── small_archive.lzo │ │ ├── rar │ │ │ └── small_archive.rar │ │ ├── zip │ │ │ └── small_archive.zip │ │ ├── compress │ │ │ └── small_archive.Z │ │ ├── ar │ │ │ └── small_archive.a │ │ └── tar │ │ │ └── small_archive.tar │ └── exotic │ │ ├── arj │ │ └── small_archive.arj │ │ ├── lha │ │ └── small_archive.lha │ │ ├── lrzip │ │ └── small_archive.lrz │ │ ├── lzip │ │ └── small_archive.lz │ │ ├── lzma │ │ └── small_archive.lzma │ │ ├── rzip │ │ └── small_archive.rz │ │ └── zoo │ │ └── small_archive.zoo └── README.testcases ├── afl-as ├── docs ├── vuln_samples │ ├── bash-cmd-exec.var │ ├── sqlite-null-ptr4.sql │ ├── bash-uninit-mem.var │ ├── sqlite-null-ptr10.sql │ ├── sqlite-null-ptr11.sql │ ├── sqlite-null-ptr3.sql │ ├── sqlite-null-ptr5.sql │ ├── sqlite-null-ptr2.sql │ ├── sqlite-null-ptr7.sql │ ├── sqlite-bad-ptr.sql │ ├── sqlite-null-ptr8.sql │ ├── sqlite-stack-exhaustion.sql │ ├── sqlite-null-ptr1.sql │ ├── sqlite-null-ptr12.sql │ ├── sqlite-null-ptr13.sql │ ├── sqlite-unint-mem.sql │ ├── jxrlib-crash.jxr │ ├── libxml2-bad-read.xml │ ├── jxrlib-crash2.jxr │ ├── jxrlib-crash3.jxr │ ├── jxrlib-crash4.jxr │ ├── msie-dht-leak.jpg │ ├── msie-zlib-dos.png │ ├── firefox-bmp-leak.bmp │ ├── firefox-gif-leak.gif │ ├── firefox-gif-leak2.gif │ ├── libjpeg-sos-leak.jpg │ ├── libtiff-bad-write.tif │ ├── msie-jxr-mem-leak.jxr │ ├── msie-png-mem-leak.png │ ├── openssl-null-ptr.der │ ├── openssl-null-ptr2.der │ ├── sqlite-null-ptr6.sql │ ├── sqlite-null-ptr9.sql │ ├── sqlite-oob-read.sql │ ├── file-fpu-exception.elf │ ├── firefox-chrome-leak.jpg │ ├── libtiff-uninit-mem.tif │ ├── libtiff-uninit-mem2.tif │ ├── libtiff-uninit-mem3.tif │ ├── libtiff-uninit-mem4.tif │ ├── msie-tiff-mem-leak.tif │ ├── photoshop-mem-leak.jpg │ ├── sqlite-bad-free.sql │ ├── strings-bfd-badptr.elf │ ├── strings-bfd-badptr2.elf │ ├── strings-stack-overflow │ ├── tcpdump-arp-crash.pcap │ ├── tcpdump-ppp-crash.pcap │ ├── ffmpeg-h264-bad-read.mp4 │ ├── libjpeg-turbo-dht-leak.jpg │ ├── strings-unchecked-ctr.elf │ ├── unrtf-arbitrary-read.rtf │ ├── unzip-t-mem-corruption.zip │ ├── ffmpeg-h264-bad-ptr-800m.mp4 │ ├── lesspipe-cpio-bad-write.cpio │ ├── ffmpeg-h264-call-stack-overflow.mp4 │ ├── sqlite-bad-ptr2.sql │ ├── sqlite-stack-buf-overflow.sql │ ├── sqlite-null-ptr15.sql │ ├── sqlite-bad-ptr3.sql │ ├── sqlite-heap-overflow.sql │ ├── sqlite-use-after-free.sql │ ├── sqlite-oob-write.sql │ ├── sqlite-null-ptr14.sql │ ├── sqlite-negative-memset.sql │ └── sqlite-heap-overwrite.sql ├── visualization │ └── afl_gzip.png ├── QuickStartGuide.txt ├── life_pro_tips.txt ├── notes_for_asan.txt ├── INSTALL └── historical_notes.txt ├── afl-fuzz ├── afl-gcc ├── afl-tmin ├── afl-analyze ├── afl-gotcpu ├── afl-showmap ├── img ├── f1.png ├── beta.png ├── gamma.png ├── paths.png ├── pcre2.png ├── branches.png ├── crashes.png ├── beta_pcre2.png ├── e_component.png ├── gamma_pcre2.png └── seed_generation.png ├── seed_generation ├── install ├── src │ ├── debug-args │ ├── date-configure │ ├── date-prepare │ ├── lib-dyn │ ├── date-build │ ├── lib-sym │ ├── date-link │ ├── date-fuzz │ ├── lib-common │ └── date-test-gen └── README.md ├── dictionaries ├── gif.dict ├── webp.dict ├── jpeg.dict ├── json.dict ├── png.dict ├── tiff.dict ├── xml.dict ├── README.dictionaries ├── js.dict └── html_tags.dict ├── experimental ├── libpng_no_checksum │ └── libpng-nocrc.patch ├── README.experiments ├── clang_asm_normalize │ └── as ├── bash_shellshock │ └── shellshock-fuzz.diff ├── argv_fuzzing │ └── argv-fuzz-inl.h ├── crash_triage │ └── triage_crashes.sh ├── distributed_fuzzing │ └── sync_script.sh ├── persistent_demo │ └── persistent_demo.c ├── post_library │ ├── post_library_png.so.c │ └── post_library.so.c ├── canvas_harness │ └── canvas_harness.html └── asan_cgroups │ └── limit_memory.sh ├── qemu_mode ├── patches │ ├── translate-all.diff │ ├── syscall.diff │ ├── cpu-exec.diff │ ├── elfload.diff │ └── afl-qemu-cpu-inl.h ├── build_qemu_support.sh └── README.qemu ├── libtokencap ├── Makefile ├── README.tokencap └── libtokencap.so.c ├── libdislocator ├── Makefile ├── README.dislocator └── libdislocator.so.c ├── README.md ├── afl-whatsup ├── llvm_mode ├── Makefile ├── afl-llvm-pass.so.cc └── afl-llvm-rt.o.c └── afl-plot /as: -------------------------------------------------------------------------------- 1 | afl-as -------------------------------------------------------------------------------- /README: -------------------------------------------------------------------------------- 1 | docs/README -------------------------------------------------------------------------------- /afl-clang: -------------------------------------------------------------------------------- 1 | afl-gcc -------------------------------------------------------------------------------- /afl-clang++: -------------------------------------------------------------------------------- 1 | afl-gcc -------------------------------------------------------------------------------- /afl-g++: -------------------------------------------------------------------------------- 1 | afl-gcc -------------------------------------------------------------------------------- /QuickStartGuide.txt: -------------------------------------------------------------------------------- 1 | docs/QuickStartGuide.txt -------------------------------------------------------------------------------- /testcases/others/text/hello_world.txt: -------------------------------------------------------------------------------- 1 | hello 2 | -------------------------------------------------------------------------------- /testcases/others/js/small_script.js: -------------------------------------------------------------------------------- 1 | if (1==1) eval('1'); -------------------------------------------------------------------------------- /testcases/others/xml/small_document.xml: -------------------------------------------------------------------------------- 1 | d 2 | -------------------------------------------------------------------------------- /afl-as: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/afl-as -------------------------------------------------------------------------------- /docs/vuln_samples/bash-cmd-exec.var: -------------------------------------------------------------------------------- 1 | () { _; } >_[$($())] { id; } -------------------------------------------------------------------------------- /docs/vuln_samples/sqlite-null-ptr4.sql: -------------------------------------------------------------------------------- 1 | select n()AND+#00; 2 | -------------------------------------------------------------------------------- /testcases/others/rtf/small_document.rtf: -------------------------------------------------------------------------------- 1 | {\rtf1\pard Test\par} -------------------------------------------------------------------------------- /afl-fuzz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/afl-fuzz -------------------------------------------------------------------------------- /afl-gcc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/afl-gcc -------------------------------------------------------------------------------- /afl-tmin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/afl-tmin -------------------------------------------------------------------------------- /afl-analyze: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/afl-analyze -------------------------------------------------------------------------------- /afl-gotcpu: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/afl-gotcpu -------------------------------------------------------------------------------- /afl-showmap: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/afl-showmap -------------------------------------------------------------------------------- /docs/vuln_samples/bash-uninit-mem.var: -------------------------------------------------------------------------------- 1 | () { x() { _; }; x() { _; } <O));insert into t0 2 | select randomblob(0)-trim(0); 3 | -------------------------------------------------------------------------------- /docs/vuln_samples/strings-bfd-badptr.elf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/docs/vuln_samples/strings-bfd-badptr.elf -------------------------------------------------------------------------------- /docs/vuln_samples/strings-bfd-badptr2.elf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/docs/vuln_samples/strings-bfd-badptr2.elf -------------------------------------------------------------------------------- /docs/vuln_samples/strings-stack-overflow: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/docs/vuln_samples/strings-stack-overflow -------------------------------------------------------------------------------- /docs/vuln_samples/tcpdump-arp-crash.pcap: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/docs/vuln_samples/tcpdump-arp-crash.pcap -------------------------------------------------------------------------------- /docs/vuln_samples/tcpdump-ppp-crash.pcap: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/docs/vuln_samples/tcpdump-ppp-crash.pcap -------------------------------------------------------------------------------- /testcases/images/png/not_kitty_alpha.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/images/png/not_kitty_alpha.png -------------------------------------------------------------------------------- /testcases/images/png/not_kitty_gamma.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/images/png/not_kitty_gamma.png -------------------------------------------------------------------------------- /testcases/multimedia/h264/small_movie.mp4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/multimedia/h264/small_movie.mp4 -------------------------------------------------------------------------------- /testcases/others/pcap/small_capture.pcap: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/others/pcap/small_capture.pcap -------------------------------------------------------------------------------- /docs/vuln_samples/ffmpeg-h264-bad-read.mp4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/docs/vuln_samples/ffmpeg-h264-bad-read.mp4 -------------------------------------------------------------------------------- /docs/vuln_samples/libjpeg-turbo-dht-leak.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/docs/vuln_samples/libjpeg-turbo-dht-leak.jpg -------------------------------------------------------------------------------- /docs/vuln_samples/strings-unchecked-ctr.elf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/docs/vuln_samples/strings-unchecked-ctr.elf -------------------------------------------------------------------------------- /docs/vuln_samples/unrtf-arbitrary-read.rtf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/docs/vuln_samples/unrtf-arbitrary-read.rtf -------------------------------------------------------------------------------- /docs/vuln_samples/unzip-t-mem-corruption.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/docs/vuln_samples/unzip-t-mem-corruption.zip -------------------------------------------------------------------------------- /seed_generation/src/debug-args: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | n=1 4 | for i in "$@"; do 5 | echo "#$n: $i" 6 | n=`expr $n + 1` 7 | done 8 | -------------------------------------------------------------------------------- /docs/vuln_samples/ffmpeg-h264-bad-ptr-800m.mp4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/docs/vuln_samples/ffmpeg-h264-bad-ptr-800m.mp4 -------------------------------------------------------------------------------- /docs/vuln_samples/lesspipe-cpio-bad-write.cpio: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/docs/vuln_samples/lesspipe-cpio-bad-write.cpio -------------------------------------------------------------------------------- /testcases/archives/common/xz/small_archive.xz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/common/xz/small_archive.xz -------------------------------------------------------------------------------- /testcases/archives/common/bzip2/small_archive.bz2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/common/bzip2/small_archive.bz2 -------------------------------------------------------------------------------- /testcases/archives/common/cab/small_archive.cab: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/common/cab/small_archive.cab -------------------------------------------------------------------------------- /testcases/archives/common/cpio/small_archive.cpio: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/common/cpio/small_archive.cpio -------------------------------------------------------------------------------- /testcases/archives/common/gzip/small_archive.gz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/common/gzip/small_archive.gz -------------------------------------------------------------------------------- /testcases/archives/common/lzo/small_archive.lzo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/common/lzo/small_archive.lzo -------------------------------------------------------------------------------- /testcases/archives/common/rar/small_archive.rar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/common/rar/small_archive.rar -------------------------------------------------------------------------------- /testcases/archives/common/zip/small_archive.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/common/zip/small_archive.zip -------------------------------------------------------------------------------- /testcases/archives/exotic/arj/small_archive.arj: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/exotic/arj/small_archive.arj -------------------------------------------------------------------------------- /testcases/archives/exotic/lha/small_archive.lha: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/exotic/lha/small_archive.lha -------------------------------------------------------------------------------- /testcases/archives/exotic/lrzip/small_archive.lrz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/exotic/lrzip/small_archive.lrz -------------------------------------------------------------------------------- /testcases/archives/exotic/lzip/small_archive.lz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/exotic/lzip/small_archive.lz -------------------------------------------------------------------------------- /testcases/archives/exotic/lzma/small_archive.lzma: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/exotic/lzma/small_archive.lzma -------------------------------------------------------------------------------- /testcases/archives/exotic/rzip/small_archive.rz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/exotic/rzip/small_archive.rz -------------------------------------------------------------------------------- /testcases/archives/exotic/zoo/small_archive.zoo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/exotic/zoo/small_archive.zoo -------------------------------------------------------------------------------- /testcases/archives/common/compress/small_archive.Z: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/testcases/archives/common/compress/small_archive.Z -------------------------------------------------------------------------------- /docs/vuln_samples/ffmpeg-h264-call-stack-overflow.mp4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Ljiee/deepfuzz/HEAD/docs/vuln_samples/ffmpeg-h264-call-stack-overflow.mp4 -------------------------------------------------------------------------------- /docs/vuln_samples/sqlite-bad-ptr2.sql: -------------------------------------------------------------------------------- 1 | PRAGMA foreign_keys=1;CREATE TABLE t1("""0"PRIMARY KEy REFERENCES t1 ON DELETE SET NULL);REPLACE INTO t1 SELECT(0); 2 | -------------------------------------------------------------------------------- /docs/vuln_samples/sqlite-stack-buf-overflow.sql: -------------------------------------------------------------------------------- 1 | SELECT printf('%*.*f',90000||006000000&6600000000,00000000000000000909000000000000.0000000000000000)""WHERE"">""; 2 | -------------------------------------------------------------------------------- /testcases/others/pdf/small.pdf: -------------------------------------------------------------------------------- 1 | %PDF-1.0 2 | 1 0 obj<>endobj 2 0 obj<>endobj 3 0 obj<>endobj trailer<> -------------------------------------------------------------------------------- /docs/vuln_samples/sqlite-null-ptr15.sql: -------------------------------------------------------------------------------- 1 | CREATE VIRTUAL TABLE t4 USING fts4(0,b,c,notindexed=0);INSERT INTO t4 VALUES('','','0');BEGIN;INSERT INTO t4 VALUES('','','0');INSERT INTO t4(t4)VALUES('integrity-check'); 2 | -------------------------------------------------------------------------------- /docs/vuln_samples/sqlite-bad-ptr3.sql: -------------------------------------------------------------------------------- 1 | create table t(l);PRAGMA writable_schema=ON; 2 | UPDATE sqlite_master SET sql='00000000000000000000000000000000000000000000000000000000000000000000000000000000[%S';PRAGMA t;SAVEPOINT x;ROLLBACK;VACUUM; 3 | -------------------------------------------------------------------------------- /docs/vuln_samples/sqlite-heap-overflow.sql: -------------------------------------------------------------------------------- 1 | DROP TABLE IF EXISTS t;CREATE VIRTUAL TABLE t0 USING fts4();insert into t0 select zeroblob(0);SAVEPOINT O;insert into t0 2 | select(0);SAVEPOINT E;insert into t0 SELECT 0 UNION SELECT 0'x'ORDER BY x; 3 | -------------------------------------------------------------------------------- /docs/vuln_samples/sqlite-use-after-free.sql: -------------------------------------------------------------------------------- 1 | create table t(s);PRAGMA writable_schema=ON;UPDATE sqlite_master SET sql='ANALYZE;CREATE VIRTUAL TABLE t USING fts3;DROP TABLE t;DROP TABLE EXISTS t';PRAGMA r;SAVEPOINT T;ANALYZE;ROLLBACK;SAVEPOINT E;DROP TABLE IF EXISTS t; 2 | -------------------------------------------------------------------------------- /docs/vuln_samples/sqlite-oob-write.sql: -------------------------------------------------------------------------------- 1 | CREATE VIRTUAL TABLE t0 USING fts4(x,order=DESC); 2 | INSERT INTO t0(docid,x)VALUES(-1E0,'0(o'); 3 | INSERT INTO t0 VALUES(''); 4 | INSERT INTO t0 VALUES(''); 5 | INSeRT INTO t0 VALUES('o'); 6 | SELECT docid FROM t0 WHERE t0 MATCH'"0*o"'; 7 | -------------------------------------------------------------------------------- /docs/vuln_samples/sqlite-null-ptr14.sql: -------------------------------------------------------------------------------- 1 | CREATE VIRTUAL TABLE x USING fts4();VALUES(0,0),(0,0),(0,0),(0,0);PRAGMA writable_schema=ON;UPDATE sqlite_master SET sql=''WHERE name='';UPDATE sqlite_master SET sql='CREATE table t(d CHECK(T(#0)';SAVEPOINT K;SAVEPOINT T;SAVEPOINT T;ANALYZE;ROLLBACK;SAVEPOINT E;DROP TABLE IF EXISTS t; 2 | -------------------------------------------------------------------------------- /testcases/archives/common/ar/small_archive.a: -------------------------------------------------------------------------------- 1 | ! 2 | limerick/ 1415337776 500 500 100640 191 ` 3 | There was a young man from Japan 4 | Whose limericks never would scan. 5 | When asked why that was, 6 | He replied "It's because 7 | I always try to cram as many words into the last line as I possibly can." 8 | 9 | -------------------------------------------------------------------------------- /dictionaries/gif.dict: -------------------------------------------------------------------------------- 1 | # 2 | # AFL dictionary for GIF images 3 | # ----------------------------- 4 | # 5 | # Created by Michal Zalewski 6 | # 7 | 8 | header_87a="87a" 9 | header_89a="89a" 10 | header_gif="GIF" 11 | 12 | marker_2c="," 13 | marker_3b=";" 14 | 15 | section_2101="!\x01\x12" 16 | section_21f9="!\xf9\x04" 17 | section_21fe="!\xfe" 18 | section_21ff="!\xff\x11" 19 | -------------------------------------------------------------------------------- /dictionaries/webp.dict: -------------------------------------------------------------------------------- 1 | # 2 | # AFL dictionary for WebP images 3 | # ------------------------------ 4 | # 5 | # Created by Michal Zalewski 6 | # 7 | 8 | header_RIFF="RIFF" 9 | header_WEBP="WEBP" 10 | 11 | section_ALPH="ALPH" 12 | section_ANIM="ANIM" 13 | section_ANMF="ANMF" 14 | section_EXIF="EXIF" 15 | section_FRGM="FRGM" 16 | section_ICCP="ICCP" 17 | section_VP8="VP8 " 18 | section_VP8L="VP8L" 19 | section_VP8X="VP8X" 20 | section_XMP="XMP " 21 | -------------------------------------------------------------------------------- /seed_generation/src/date-configure: -------------------------------------------------------------------------------- 1 | #!/opt/tsmart-date/tbash 2 | . $(dirname "$0")/lib-common 3 | 4 | [[ "$#" == 0 ]] && log-error "No configure command" && exit 5 | 6 | load-config 7 | if [[ "$MODE" == sym ]]; then 8 | . $(dirname "$0")/lib-sym 9 | setup-kllvm 10 | setup-sym-flags 11 | inject-flags 12 | inject-compilers 13 | else 14 | . $(dirname "$0")/lib-dyn 15 | setup-allvm 16 | setup-dyn-flags 17 | inject-flags 18 | inject-compilers 19 | fi 20 | 21 | run-program "$@" 22 | -------------------------------------------------------------------------------- /experimental/libpng_no_checksum/libpng-nocrc.patch: -------------------------------------------------------------------------------- 1 | --- pngrutil.c.orig 2014-06-12 03:35:16.000000000 +0200 2 | +++ pngrutil.c 2014-07-01 05:08:31.000000000 +0200 3 | @@ -268,7 +268,11 @@ 4 | if (need_crc != 0) 5 | { 6 | crc = png_get_uint_32(crc_bytes); 7 | - return ((int)(crc != png_ptr->crc)); 8 | + 9 | + if (crc != png_ptr->crc) 10 | + fprintf(stderr, "NOTE: CRC in the file is 0x%08x, change to 0x%08x\n", crc, png_ptr->crc); 11 | + 12 | + return ((int)(1 != 1)); 13 | } 14 | 15 | else 16 | -------------------------------------------------------------------------------- /docs/vuln_samples/sqlite-negative-memset.sql: -------------------------------------------------------------------------------- 1 | SELECT*from(select"",zeroblob(0),zeroblob(1E9),zeroblob(0),zeroblob(150000000),zeroblob(0),zeroblob(0),zeroblob(0),zeroblob(0),zeroblob(1E9),zeroblob(0),zeroblob(0),zeroblob(0),zeroblob(0),zeroblob(0)),(select"",zeroblob(1E9),zeroblob(0),zeroblob(0),zeroblob(0),zeroblob(0),zeroblob(0),zeroblob(0),zeroblob(1E9),(0),zeroblob(150000000),(0),zeroblob(0),(0)EXCEPT select zeroblob(0),zeroblob(0),zeroblob(0),zeroblob(0),zeroblob(0),zeroblob(0),(0),zeroblob(0),zeroblob(0),zeroblob(0),zeroblob(0),zeroblob(0),zeroblob(0),zeroblob(0)); 2 | -------------------------------------------------------------------------------- /dictionaries/jpeg.dict: -------------------------------------------------------------------------------- 1 | # 2 | # AFL dictionary for JPEG images 3 | # ------------------------------ 4 | # 5 | # Created by Michal Zalewski 6 | # 7 | 8 | header_jfif="JFIF\x00" 9 | header_jfxx="JFXX\x00" 10 | 11 | section_ffc0="\xff\xc0" 12 | section_ffc2="\xff\xc2" 13 | section_ffc4="\xff\xc4" 14 | section_ffd0="\xff\xd0" 15 | section_ffd8="\xff\xd8" 16 | section_ffd9="\xff\xd9" 17 | section_ffda="\xff\xda" 18 | section_ffdb="\xff\xdb" 19 | section_ffdd="\xff\xdd" 20 | section_ffe0="\xff\xe0" 21 | section_ffe1="\xff\xe1" 22 | section_fffe="\xff\xfe" 23 | -------------------------------------------------------------------------------- /dictionaries/json.dict: -------------------------------------------------------------------------------- 1 | # 2 | # AFL dictionary for JSON 3 | # ----------------------- 4 | # 5 | # Just the very basics. 6 | # 7 | # Inspired by a dictionary by Jakub Wilk 8 | # 9 | 10 | "0" 11 | ",0" 12 | ":0" 13 | "0:" 14 | "-1.2e+3" 15 | 16 | "true" 17 | "false" 18 | "null" 19 | 20 | "\"\"" 21 | ",\"\"" 22 | ":\"\"" 23 | "\"\":" 24 | 25 | "{}" 26 | ",{}" 27 | ":{}" 28 | "{\"\":0}" 29 | "{{}}" 30 | 31 | "[]" 32 | ",[]" 33 | ":[]" 34 | "[0]" 35 | "[[]]" 36 | 37 | "''" 38 | "\\" 39 | "\\b" 40 | "\\f" 41 | "\\n" 42 | "\\r" 43 | "\\t" 44 | "\\u0000" 45 | "\\x00" 46 | "\\0" 47 | "\\uD800\\uDC00" 48 | "\\uDBFF\\uDFFF" 49 | 50 | "\"\":0" 51 | "//" 52 | "/**/" 53 | -------------------------------------------------------------------------------- /qemu_mode/patches/translate-all.diff: -------------------------------------------------------------------------------- 1 | --- qemu-2.3.0/translate-all.c.orig 2014-12-09 14:45:46.000000000 +0000 2 | +++ qemu-2.3.0/translate-all.c 2015-01-28 22:37:42.383000000 +0000 3 | @@ -393,8 +393,13 @@ 4 | /* We can't use g_malloc because it may recurse into a locked mutex. */ 5 | # define ALLOC(P, SIZE) \ 6 | do { \ 7 | - P = mmap(NULL, SIZE, PROT_READ | PROT_WRITE, \ 8 | - MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); \ 9 | + void* _tmp = mmap(NULL, SIZE, PROT_READ | PROT_WRITE, \ 10 | + MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); \ 11 | + if (_tmp == (void*)-1) { \ 12 | + qemu_log(">>> Out of memory for stack, bailing out. <<<\n"); \ 13 | + exit(1); \ 14 | + } \ 15 | + (P) = _tmp; \ 16 | } while (0) 17 | #else 18 | # define ALLOC(P, SIZE) \ 19 | -------------------------------------------------------------------------------- /seed_generation/src/date-prepare: -------------------------------------------------------------------------------- 1 | #!/opt/tsmart-date/tbash 2 | . $(dirname "$0")/lib-common 3 | # PATH="$( cd "$( dirname "$_" )" && pwd ):$PATH" 4 | 5 | usage() { 6 | local PROG="$(basename "$0")" 7 | log-error "Usage\n" \ 8 | " $PROG sym SYM_SIZE -- symbolic mode\n" \ 9 | " $PROG dyn -- dynamic mode" 10 | } 11 | 12 | [[ "$#" == 0 ]] && usage 13 | 14 | setup-toolchain 15 | 16 | case "$1" in 17 | 'sym') 18 | [[ "$2" =~ ^[0-9]*$ ]] || log-error "symbolic argument size not a number" 19 | [[ "$2" -ge 1 && "$2" -le 4095 ]] || log-error "Symbolic argument size too big or small" 20 | log-info "Saving configuration (symbolic, size is $2)" 21 | save-config "$1" "$2" 22 | ;; 23 | 'dyn') 24 | log-info "Saving configuration (dynamic)" 25 | save-config "$1" "" 26 | ;; 27 | *) 28 | usage 29 | ;; 30 | esac 31 | -------------------------------------------------------------------------------- /testcases/README.testcases: -------------------------------------------------------------------------------- 1 | ======================= 2 | AFL starting test cases 3 | ======================= 4 | 5 | (See ../docs/README for the general instruction manual.) 6 | 7 | The archives/, images/, multimedia/, and others/ subdirectories contain small, 8 | standalone files that can be used to seed afl-fuzz when testing parsers for a 9 | variety of common data formats. 10 | 11 | There is probably not much to be said about these files, except that they were 12 | optimized for size and stripped of any non-essential fluff. Some directories 13 | contain several examples that exercise various features of the underlying format. 14 | For example, there is a PNG file with and without a color profile. 15 | 16 | Additional test cases are always welcome. 17 | 18 | In addition to well-chosen starting files, many fuzzing jobs benefit from a 19 | small and concise dictionary. See ../dictionaries/README.dictionaries for more. 20 | -------------------------------------------------------------------------------- /dictionaries/png.dict: -------------------------------------------------------------------------------- 1 | # 2 | # AFL dictionary for PNG images 3 | # ----------------------------- 4 | # 5 | # Just the basic, standard-originating sections; does not include vendor 6 | # extensions. 7 | # 8 | # Created by Michal Zalewski 9 | # 10 | 11 | header_png="\x89PNG\x0d\x0a\x1a\x0a" 12 | 13 | section_IDAT="IDAT" 14 | section_IEND="IEND" 15 | section_IHDR="IHDR" 16 | section_PLTE="PLTE" 17 | section_bKGD="bKGD" 18 | section_cHRM="cHRM" 19 | section_fRAc="fRAc" 20 | section_gAMA="gAMA" 21 | section_gIFg="gIFg" 22 | section_gIFt="gIFt" 23 | section_gIFx="gIFx" 24 | section_hIST="hIST" 25 | section_iCCP="iCCP" 26 | section_iTXt="iTXt" 27 | section_oFFs="oFFs" 28 | section_pCAL="pCAL" 29 | section_pHYs="pHYs" 30 | section_sBIT="sBIT" 31 | section_sCAL="sCAL" 32 | section_sPLT="sPLT" 33 | section_sRGB="sRGB" 34 | section_sTER="sTER" 35 | section_tEXt="tEXt" 36 | section_tIME="tIME" 37 | section_tRNS="tRNS" 38 | section_zTXt="zTXt" 39 | -------------------------------------------------------------------------------- /seed_generation/src/lib-dyn: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . $(dirname "$0")/lib-common 3 | 4 | AFL_PREFIX=/opt/afl 5 | 6 | # Quiet by default 7 | export AFL_QUIET="${AFL_QUIET:-1}" 8 | [[ "$AFL_QUIET" == "0" ]] && unset AFL_QUIET 9 | 10 | setup-dyn-flags() { 11 | local opts=( 12 | "-fno-omit-frame-pointer" 13 | "-g" 14 | "-fsanitize=address") 15 | ARR_CFLAGS=("${opts[@]}") 16 | ARR_CXXFLAGS=("${opts[@]}") 17 | ARR_LDFLAGS=("${opts[@]}") 18 | } 19 | 20 | setup-allvm() { 21 | log-info "Setting up AFL toolchain" 22 | log-debug "AFL LLVM is at $AFL_PREFIX" 23 | 24 | setup-toolchain 25 | ln -s "$AFL_PREFIX"/bin/afl-clang-fast "$CC" 26 | ln -s "$AFL_PREFIX"/bin/afl-clang-fast++ "$CXX" 27 | ln -s "$AS_PREFIX"/bin/as "$AS" 28 | 29 | export AFL_CXX="$SLLVM_PREFIX/bin/clang++" \ 30 | AFL_CC="$SLLVM_PREFIX/bin/clang" \ 31 | AFL_AS="$AS_PREFIX/bin/as" \ 32 | AFL_PATH="$AFL_PREFIX/bin" 33 | } 34 | -------------------------------------------------------------------------------- /seed_generation/src/date-build: -------------------------------------------------------------------------------- 1 | #!/opt/tsmart-date/tbash 2 | . $(dirname "$0")/lib-common 3 | 4 | [[ "$#" == 0 ]] && log-error "No build command" && exit 5 | 6 | load-config 7 | if [[ "$MODE" == sym ]]; then 8 | . $(dirname "$0")/lib-sym 9 | setup-wllvm 10 | setup-sym-flags 11 | else 12 | . $(dirname "$0")/lib-dyn 13 | setup-allvm 14 | setup-dyn-flags 15 | fi 16 | 17 | case "$1" in 18 | 'gcc') 19 | ;& 20 | 'clang') 21 | log-info "C compiler intercepted" 22 | run-cc "${@:2}" 23 | ;; 24 | 'g++') 25 | ;& 26 | 'clang++') 27 | log-info "C++ compiler intercepted" 28 | run-cxx "${@:2}" 29 | ;; 30 | 'make') 31 | log-info "Make intercepted" 32 | inject-flags 33 | inject-compilers 34 | run-program "$@" 35 | ;; 36 | *) 37 | log-info "Custom build comand, ignoring" 38 | inject-flags 39 | run-program "$@" 40 | ;; 41 | esac 42 | -------------------------------------------------------------------------------- /qemu_mode/patches/syscall.diff: -------------------------------------------------------------------------------- 1 | --- qemu-2.3.0/linux-user/syscall.c.orig 2014-12-09 14:45:43.000000000 +0000 2 | +++ qemu-2.3.0/linux-user/syscall.c 2015-03-27 06:33:00.736000000 +0000 3 | @@ -227,7 +227,21 @@ 4 | _syscall3(int,sys_rt_sigqueueinfo,int,pid,int,sig,siginfo_t *,uinfo) 5 | _syscall3(int,sys_syslog,int,type,char*,bufp,int,len) 6 | #if defined(TARGET_NR_tgkill) && defined(__NR_tgkill) 7 | -_syscall3(int,sys_tgkill,int,tgid,int,pid,int,sig) 8 | + 9 | +extern unsigned int afl_forksrv_pid; 10 | + 11 | +static int sys_tgkill(int tgid, int pid, int sig) { 12 | + 13 | + /* Workaround for -lpthread to make abort() work properly, without 14 | + killing the forkserver due to a prematurely cached PID. */ 15 | + 16 | + if (afl_forksrv_pid && afl_forksrv_pid == pid && sig == SIGABRT) 17 | + pid = tgid = getpid(); 18 | + 19 | + return syscall(__NR_sys_tgkill, pid, tgid, sig); 20 | + 21 | +} 22 | + 23 | #endif 24 | #if defined(TARGET_NR_tkill) && defined(__NR_tkill) 25 | _syscall2(int,sys_tkill,int,tid,int,sig) 26 | -------------------------------------------------------------------------------- /seed_generation/src/lib-sym: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . $(dirname "$0")/lib-common 3 | 4 | KLLVM_PREFIX=/opt/llvm 5 | WLLVM_PREFIX=/opt/wllvm 6 | 7 | KLEE_PREFIX=/opt/klee 8 | KLEE="$KLEE_PREFIX"/bin/klee 9 | 10 | setup-sym-flags() { 11 | ARR_CXXFLAGS=("-stdlib=libc++" "-I$KLLVM_PREFIX/include/c++/v1" "-Qunused-arguments") 12 | ARR_LDFLAGS=("-L$KLLVM_PREFIX/lib" "-Wl,-rpath,$KLLVM_PREFIX/lib") 13 | } 14 | 15 | setup-kllvm() { 16 | log-info "Setting up bitcode toolchain (unfiltered)" 17 | log-debug "LLVM is at $KLLVM_PREFIX" 18 | 19 | setup-toolchain 20 | ln -s "$KLLVM_PREFIX"/bin/clang "$CC" 21 | ln -s "$KLLVM_PREFIX"/bin/clang++ "$CXX" 22 | ln -s "$AS_PREFIX"/bin/as "$AS" 23 | } 24 | 25 | setup-wllvm() { 26 | log-info "Setting up bitcode toolchain" 27 | log-debug "WLLVM is at $WLLVM_PREFIX" 28 | 29 | setup-toolchain 30 | ln -s "$WLLVM_PREFIX"/bin/wllvm "$CC" 31 | ln -s "$WLLVM_PREFIX"/bin/wllvm++ "$CXX" 32 | ln -s "$AS_PREFIX"/bin/wllvm-as "$AS" 33 | 34 | export LLVM_COMPILER=clang LLVM_COMPILER_PATH="$KLLVM_PREFIX"/bin 35 | } 36 | -------------------------------------------------------------------------------- /qemu_mode/patches/cpu-exec.diff: -------------------------------------------------------------------------------- 1 | --- qemu-2.3.0/cpu-exec.c.orig 2014-12-09 14:45:40.000000000 +0000 2 | +++ qemu-2.3.0/cpu-exec.c 2015-02-20 22:07:02.966000000 +0000 3 | @@ -28,6 +28,8 @@ 4 | #include "exec/memory-internal.h" 5 | #include "qemu/rcu.h" 6 | 7 | +#include "../patches/afl-qemu-cpu-inl.h" 8 | + 9 | /* -icount align implementation. */ 10 | 11 | typedef struct SyncClocks { 12 | @@ -296,8 +298,11 @@ 13 | } 14 | not_found: 15 | /* if no translated code available, then translate it now */ 16 | + 17 | tb = tb_gen_code(cpu, pc, cs_base, flags, 0); 18 | 19 | + AFL_QEMU_CPU_SNIPPET1; 20 | + 21 | found: 22 | /* Move the last found TB to the head of the list */ 23 | if (likely(*ptb1)) { 24 | @@ -492,6 +497,9 @@ 25 | next_tb = 0; 26 | tcg_ctx.tb_ctx.tb_invalidated_flag = 0; 27 | } 28 | + 29 | + AFL_QEMU_CPU_SNIPPET2; 30 | + 31 | if (qemu_loglevel_mask(CPU_LOG_EXEC)) { 32 | qemu_log("Trace %p [" TARGET_FMT_lx "] %s\n", 33 | tb->tc_ptr, tb->pc, lookup_symbol(tb->pc)); 34 | -------------------------------------------------------------------------------- /libtokencap/Makefile: -------------------------------------------------------------------------------- 1 | # 2 | # american fuzzy lop - libtokencap 3 | # -------------------------------- 4 | # 5 | # Written by Michal Zalewski 6 | # 7 | # Copyright 2016 Google Inc. All rights reserved. 8 | # 9 | # Licensed under the Apache License, Version 2.0 (the "License"); 10 | # you may not use this file except in compliance with the License. 11 | # You may obtain a copy of the License at: 12 | # 13 | # http://www.apache.org/licenses/LICENSE-2.0 14 | # 15 | 16 | PREFIX ?= /usr/local 17 | HELPER_PATH = $(PREFIX)/lib/afl 18 | 19 | VERSION = $(shell grep '^\#define VERSION ' ../config.h | cut -d '"' -f2) 20 | 21 | CFLAGS ?= -O3 -funroll-loops 22 | CFLAGS += -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign 23 | 24 | all: libtokencap.so 25 | 26 | libtokencap.so: libtokencap.so.c ../config.h 27 | $(CC) $(CFLAGS) -shared -fPIC $< -o $@ $(LDFLAGS) 28 | 29 | .NOTPARALLEL: clean 30 | 31 | clean: 32 | rm -f *.o *.so *~ a.out core core.[1-9][0-9]* 33 | rm -f libtokencap.so 34 | 35 | install: all 36 | install -m 755 libtokencap.so $${DESTDIR}$(HELPER_PATH) 37 | install -m 644 README.tokencap $${DESTDIR}$(HELPER_PATH) 38 | 39 | -------------------------------------------------------------------------------- /libdislocator/Makefile: -------------------------------------------------------------------------------- 1 | # 2 | # american fuzzy lop - libdislocator 3 | # ---------------------------------- 4 | # 5 | # Written by Michal Zalewski 6 | # 7 | # Copyright 2016 Google Inc. All rights reserved. 8 | # 9 | # Licensed under the Apache License, Version 2.0 (the "License"); 10 | # you may not use this file except in compliance with the License. 11 | # You may obtain a copy of the License at: 12 | # 13 | # http://www.apache.org/licenses/LICENSE-2.0 14 | # 15 | 16 | PREFIX ?= /usr/local 17 | HELPER_PATH = $(PREFIX)/lib/afl 18 | 19 | VERSION = $(shell grep '^\#define VERSION ' ../config.h | cut -d '"' -f2) 20 | 21 | CFLAGS ?= -O3 -funroll-loops 22 | CFLAGS += -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign 23 | 24 | all: libdislocator.so 25 | 26 | libdislocator.so: libdislocator.so.c ../config.h 27 | $(CC) $(CFLAGS) -shared -fPIC $< -o $@ $(LDFLAGS) 28 | 29 | .NOTPARALLEL: clean 30 | 31 | clean: 32 | rm -f *.o *.so *~ a.out core core.[1-9][0-9]* 33 | rm -f libdislocator.so 34 | 35 | install: all 36 | install -m 755 libdislocator.so $${DESTDIR}$(HELPER_PATH) 37 | install -m 644 README.dislocator $${DESTDIR}$(HELPER_PATH) 38 | 39 | -------------------------------------------------------------------------------- /qemu_mode/patches/elfload.diff: -------------------------------------------------------------------------------- 1 | --- qemu-2.3.0/linux-user/elfload.c.orig 2014-12-09 14:45:42.000000000 +0000 2 | +++ qemu-2.3.0/linux-user/elfload.c 2015-01-28 02:51:23.719000000 +0000 3 | @@ -28,6 +28,8 @@ 4 | 5 | #define ELF_OSABI ELFOSABI_SYSV 6 | 7 | +extern abi_ulong afl_entry_point, afl_start_code, afl_end_code; 8 | + 9 | /* from personality.h */ 10 | 11 | /* 12 | @@ -1889,6 +1891,8 @@ 13 | info->brk = 0; 14 | info->elf_flags = ehdr->e_flags; 15 | 16 | + if (!afl_entry_point) afl_entry_point = info->entry; 17 | + 18 | for (i = 0; i < ehdr->e_phnum; i++) { 19 | struct elf_phdr *eppnt = phdr + i; 20 | if (eppnt->p_type == PT_LOAD) { 21 | @@ -1922,9 +1926,11 @@ 22 | if (elf_prot & PROT_EXEC) { 23 | if (vaddr < info->start_code) { 24 | info->start_code = vaddr; 25 | + if (!afl_start_code) afl_start_code = vaddr; 26 | } 27 | if (vaddr_ef > info->end_code) { 28 | info->end_code = vaddr_ef; 29 | + if (!afl_end_code) afl_end_code = vaddr_ef; 30 | } 31 | } 32 | if (elf_prot & PROT_WRITE) { 33 | -------------------------------------------------------------------------------- /dictionaries/tiff.dict: -------------------------------------------------------------------------------- 1 | # 2 | # AFL dictionary for TIFF images 3 | # ------------------------------ 4 | # 5 | # Just the basic, standard-originating sections; does not include vendor 6 | # extensions. 7 | # 8 | # Created by Michal Zalewski 9 | # 10 | 11 | header_ii="II*\x00" 12 | header_mm="MM\x00*" 13 | 14 | section_100="\x00\x01" 15 | section_101="\x01\x01" 16 | section_102="\x02\x01" 17 | section_103="\x03\x01" 18 | section_106="\x06\x01" 19 | section_107="\x07\x01" 20 | section_10D="\x0d\x01" 21 | section_10E="\x0e\x01" 22 | section_10F="\x0f\x01" 23 | section_110="\x10\x01" 24 | section_111="\x11\x01" 25 | section_112="\x12\x01" 26 | section_115="\x15\x01" 27 | section_116="\x16\x01" 28 | section_117="\x17\x01" 29 | section_11A="\x1a\x01" 30 | section_11B="\x1b\x01" 31 | section_11C="\x1c\x01" 32 | section_11D="\x1d\x01" 33 | section_11E="\x1e\x01" 34 | section_11F="\x1f\x01" 35 | section_122="\"\x01" 36 | section_123="#\x01" 37 | section_124="$\x01" 38 | section_125="%\x01" 39 | section_128="(\x01" 40 | section_129=")\x01" 41 | section_12D="-\x01" 42 | section_131="1\x01" 43 | section_132="2\x01" 44 | section_13B=";\x01" 45 | section_13C="<\x01" 46 | section_13D="=\x01" 47 | section_13E=">\x01" 48 | section_13F="?\x01" 49 | section_140="@\x01" 50 | section_FE="\xfe\x00" 51 | section_FF="\xff\x00" 52 | -------------------------------------------------------------------------------- /seed_generation/src/date-link: -------------------------------------------------------------------------------- 1 | #!/opt/tsmart-date/tbash 2 | set -eu 3 | . $(dirname "$0")/lib-common 4 | 5 | usage() { 6 | local prog="$(basename "$0")" 7 | log-error "Usage\n" \ 8 | " $prog obj-file [...]\n" 9 | } 10 | 11 | generate-sym-driver() { 12 | local src_path="$TOOLCHAIN_PREFIX/driver.c" 13 | log-info "Generating driver, symbolic argument size = $SYM_ARG_SIZE" 14 | 15 | cat > "$src_path" < 17 | #include 18 | 19 | int LLVMFuzzerTestOneInput(const char *Data, size_t Size); 20 | 21 | int main(int argc, char **argv) { 22 | LLVMFuzzerTestOneInput(argv[1], $SYM_ARG_SIZE); 23 | } 24 | EOF 25 | run-cc -xc -c -o "$OBJ_PATH" "$src_path" 26 | } 27 | 28 | link-objects() { 29 | log-info "Linking objects" 30 | args=("$@" -o app) 31 | run-cxx "${ARR_LDFLAGS[@]}" "${args[@]}" 32 | } 33 | 34 | extract-bitcode() { 35 | log-info "Extracting bitcode" 36 | "$WLLVM_PREFIX/bin/extract-bc" -v app 37 | } 38 | 39 | [[ "$#" == 0 ]] && usage 40 | 41 | load-config 42 | if [[ "$MODE" == sym ]]; then 43 | . $(dirname "$0")/lib-sym 44 | setup-wllvm 45 | setup-sym-flags 46 | OBJ_PATH="$TOOLCHAIN_PREFIX/driver.o" 47 | generate-sym-driver "$OBJ_PATH" 48 | link-objects "$OBJ_PATH" "$@" 49 | extract-bitcode 50 | else 51 | . $(dirname "$0")/lib-dyn 52 | setup-allvm 53 | setup-dyn-flags 54 | OBJ_PATH="$AFL_PREFIX/bin/afl-driver-64.o" 55 | link-objects "$OBJ_PATH" "$@" 56 | fi 57 | -------------------------------------------------------------------------------- /dictionaries/xml.dict: -------------------------------------------------------------------------------- 1 | # 2 | # AFL dictionary for XML 3 | # ---------------------- 4 | # 5 | # Several basic syntax elements and attributes, modeled on libxml2. 6 | # 7 | # Created by Michal Zalewski 8 | # 9 | 10 | attr_encoding=" encoding=\"1\"" 11 | attr_generic=" a=\"1\"" 12 | attr_href=" href=\"1\"" 13 | attr_standalone=" standalone=\"no\"" 14 | attr_version=" version=\"1\"" 15 | attr_xml_base=" xml:base=\"1\"" 16 | attr_xml_id=" xml:id=\"1\"" 17 | attr_xml_lang=" xml:lang=\"1\"" 18 | attr_xml_space=" xml:space=\"1\"" 19 | attr_xmlns=" xmlns=\"1\"" 20 | 21 | entity_builtin="<" 22 | entity_decimal="" 23 | entity_external="&a;" 24 | entity_hex="" 25 | 26 | string_any="ANY" 27 | string_brackets="[]" 28 | string_cdata="CDATA" 29 | string_col_fallback=":fallback" 30 | string_col_generic=":a" 31 | string_col_include=":include" 32 | string_dashes="--" 33 | string_empty="EMPTY" 34 | string_empty_dblquotes="\"\"" 35 | string_empty_quotes="''" 36 | string_entities="ENTITIES" 37 | string_entity="ENTITY" 38 | string_fixed="#FIXED" 39 | string_id="ID" 40 | string_idref="IDREF" 41 | string_idrefs="IDREFS" 42 | string_implied="#IMPLIED" 43 | string_nmtoken="NMTOKEN" 44 | string_nmtokens="NMTOKENS" 45 | string_notation="NOTATION" 46 | string_parentheses="()" 47 | string_pcdata="#PCDATA" 48 | string_percent="%a" 49 | string_public="PUBLIC" 50 | string_required="#REQUIRED" 51 | string_schema=":schema" 52 | string_system="SYSTEM" 53 | string_ucs4="UCS-4" 54 | string_utf16="UTF-16" 55 | string_utf8="UTF-8" 56 | string_xmlns="xmlns:" 57 | 58 | tag_attlist="" 61 | tag_doctype="" 68 | tag_open_close="" 69 | tag_open_exclamation="" 72 | tag_xml_q="" 73 | -------------------------------------------------------------------------------- /experimental/README.experiments: -------------------------------------------------------------------------------- 1 | Here's a quick overview of the stuff you can find in this directory: 2 | 3 | - argv_fuzzing - a simple wrapper to allow cmdline to be fuzzed 4 | (e.g., to test setuid programs). 5 | 6 | - asan_cgroups - a contributed script to simplify fuzzing ASAN 7 | binaries with robust memory limits on Linux. 8 | 9 | - bash_shellshock - a simple hack used to find a bunch of 10 | post-Shellshock bugs in bash. 11 | 12 | - canvas_harness - a test harness used to find browser bugs with a 13 | corpus generated using simple image parsing 14 | binaries & afl-fuzz. 15 | 16 | - clang_asm_normalize - a script that makes it easy to instrument 17 | hand-written assembly, provided that you have clang. 18 | 19 | - crash_triage - a very rudimentary example of how to annotate crashes 20 | with additional gdb metadata. 21 | 22 | - distributed_fuzzing - a sample script for synchronizing fuzzer instances 23 | across multiple machines (see parallel_fuzzing.txt). 24 | 25 | - libpng_no_checksum - a sample patch for removing CRC checks in libpng. 26 | 27 | - persistent_demo - an example of how to use the LLVM persistent process 28 | mode to speed up certain fuzzing jobs. 29 | 30 | - post_library - an example of how to build postprocessors for AFL. 31 | 32 | Note that the minimize_corpus.sh tool has graduated from the experimental/ 33 | directory and is now available as ../afl-cmin. The LLVM mode has likewise 34 | graduated to ../llvm_mode/*. 35 | 36 | Most of the tools in this directory are meant chiefly as examples that need to 37 | be tweaked for your specific needs. They come with some basic documentation, 38 | but are not necessarily production-grade. 39 | -------------------------------------------------------------------------------- /experimental/clang_asm_normalize/as: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # american fuzzy lop - clang assembly normalizer 4 | # ---------------------------------------------- 5 | # 6 | # Written and maintained by Michal Zalewski 7 | # The idea for this wrapper comes from Ryan Govostes. 8 | # 9 | # Copyright 2013, 2014 Google Inc. All rights reserved. 10 | # 11 | # Licensed under the Apache License, Version 2.0 (the "License"); 12 | # you may not use this file except in compliance with the License. 13 | # You may obtain a copy of the License at: 14 | # 15 | # http://www.apache.org/licenses/LICENSE-2.0 16 | # 17 | # This 'as' wrapper should allow you to instrument unruly, hand-written 18 | # assembly with afl-as. 19 | # 20 | # Usage: 21 | # 22 | # export AFL_REAL_PATH=/path/to/directory/with/afl-as/ 23 | # AFL_PATH=/path/to/this/directory/ make clean all 24 | 25 | if [ "$#" -lt "2" ]; then 26 | echo "[-] Error: this utility can't be called directly." 1>&2 27 | exit 1 28 | fi 29 | 30 | if [ "$AFL_REAL_PATH" = "" ]; then 31 | echo "[-] Error: AFL_REAL_PATH not set!" 1>&2 32 | exit 1 33 | fi 34 | 35 | if [ ! -x "$AFL_REAL_PATH/afl-as" ]; then 36 | echo "[-] Error: AFL_REAL_PATH does not contain the 'afl-as' binary." 1>&2 37 | exit 1 38 | fi 39 | 40 | unset __AFL_AS_CMDLINE __AFL_FNAME 41 | 42 | while [ ! "$#" = "0" ]; do 43 | 44 | if [ "$#" = "1" ]; then 45 | __AFL_FNAME="$1" 46 | else 47 | __AFL_AS_CMDLINE="${__AFL_AS_CMDLINE} $1" 48 | fi 49 | 50 | shift 51 | 52 | done 53 | 54 | test "$TMPDIR" = "" && TMPDIR=/tmp 55 | 56 | TMPFILE=`mktemp $TMPDIR/.afl-XXXXXXXXXX.s` 57 | 58 | test "$TMPFILE" = "" && exit 1 59 | 60 | clang -cc1as -filetype asm -output-asm-variant 0 "${__AFL_FNAME}" >"$TMPFILE" 61 | 62 | ERR="$?" 63 | 64 | if [ ! "$ERR" = "0" ]; then 65 | rm -f "$TMPFILE" 66 | exit $ERR 67 | fi 68 | 69 | "$AFL_REAL_PATH/afl-as" ${__AFL_AS_CMDLINE} "$TMPFILE" 70 | 71 | ERR="$?" 72 | 73 | rm -f "$TMPFILE" 74 | 75 | exit "$ERR" 76 | -------------------------------------------------------------------------------- /dictionaries/README.dictionaries: -------------------------------------------------------------------------------- 1 | ================ 2 | AFL dictionaries 3 | ================ 4 | 5 | (See ../docs/README for the general instruction manual.) 6 | 7 | This subdirectory contains a set of dictionaries that can be used in 8 | conjunction with the -x option to allow the fuzzer to effortlessly explore the 9 | grammar of some of the more verbose data formats or languages. The basic 10 | principle behind the operation of fuzzer dictionaries is outlined in section 9 11 | of the "main" README for the project. 12 | 13 | Custom dictionaries can be added at will. They should consist of a 14 | reasonably-sized set of rudimentary syntax units that the fuzzer will then try 15 | to clobber together in various ways. Snippets between 2 and 16 bytes are usually 16 | the sweet spot. 17 | 18 | Custom dictionaries can be created in two ways: 19 | 20 | - By creating a new directory and placing each token in a separate file, in 21 | which case, there is no need to escape or otherwise format the data. 22 | 23 | - By creating a flat text file where tokens are listed one per line in the 24 | format of name="value". The alphanumeric name is ignored and can be omitted, 25 | although it is a convenient way to document the meaning of a particular 26 | token. The value must appear in quotes, with hex escaping (\xNN) applied to 27 | all non-printable, high-bit, or otherwise problematic characters (\\ and \" 28 | shorthands are recognized, too). 29 | 30 | The fuzzer auto-selects the appropriate mode depending on whether the -x 31 | parameter is a file or a directory. 32 | 33 | In the file mode, every name field can be optionally followed by @, e.g.: 34 | 35 | keyword_foo@1 = "foo" 36 | 37 | Such entries will be loaded only if the requested dictionary level is equal or 38 | higher than this number. The default level is zero; a higher value can be set 39 | by appending @ to the dictionary file name, like so: 40 | 41 | -x path/to/dictionary.dct@2 42 | 43 | Good examples of dictionaries can be found in xml.dict and png.dict. 44 | -------------------------------------------------------------------------------- /testcases/archives/common/tar/small_archive.tar: -------------------------------------------------------------------------------- 1 | limerick0000640000076400007640000000027712427053460012465 0ustar lcamtuflcamtufThere was a young man from Japan 2 | Whose limericks never would scan. 3 | When asked why that was, 4 | He replied "It's because 5 | I always try to cram as many words into the last line as I possibly can." 6 | -------------------------------------------------------------------------------- /experimental/bash_shellshock/shellshock-fuzz.diff: -------------------------------------------------------------------------------- 1 | This patch shows a very simple way to find post-Shellshock bugs in bash, as 2 | discussed here: 3 | 4 | http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html 5 | 6 | In essence, it shows a way to fuzz environmental variables. Instructions: 7 | 8 | 1) Download bash 4.3, apply this patch, compile with: 9 | 10 | CC=/path/to/afl-gcc ./configure 11 | make clean all 12 | 13 | Note that the harness puts the fuzzed output in $TEST_VARIABLE. With 14 | Florian's Shellshock patch (bash43-028), this is no longer passed down 15 | to the parser. 16 | 17 | 2) Create and cd to an empty directory, put the compiled bash binary in 18 | there, and run these commands: 19 | 20 | mkdir in_dir 21 | echo -n '() { a() { a; }; : >b; }' >in_dir/script.txt 22 | 23 | 3) Run the fuzzer with: 24 | 25 | /path/to/afl-fuzz -d -i in_dir -o out_dir ./bash -c : 26 | 27 | The -d parameter is advisable only if the tested shell is fairly slow 28 | or if you are in a hurry; will cover more ground faster, but 29 | less systematically. 30 | 31 | 4) Watch for crashes in out_dir/crashes/. Also watch for any new files 32 | created in cwd if you're interested in non-crash RCEs (files will be 33 | created whenever the shell executes "foo>bar" or something like 34 | that). You can correlate their creation date with new entries in 35 | out_dir/queue/. 36 | 37 | You can also modify the bash binary to directly check for more subtle 38 | fault conditions, or use the synthesized entries in out_dir/queue/ 39 | as a seed for other, possibly slower or more involved testing regimes. 40 | 41 | Expect several hours to get decent coverage. 42 | 43 | --- bash-4.3/shell.c.orig 2014-01-14 14:04:32.000000000 +0100 44 | +++ bash-4.3/shell.c 2015-04-30 05:56:46.000000000 +0200 45 | @@ -371,6 +371,14 @@ 46 | env = environ; 47 | #endif /* __OPENNT */ 48 | 49 | + { 50 | + 51 | + static char val[1024 * 16]; 52 | + read(0, val, sizeof(val) - 1); 53 | + setenv("TEST_VARIABLE", val, 1); 54 | + 55 | + } 56 | + 57 | USE_VAR(argc); 58 | USE_VAR(argv); 59 | USE_VAR(env); 60 | -------------------------------------------------------------------------------- /docs/QuickStartGuide.txt: -------------------------------------------------------------------------------- 1 | ===================== 2 | AFL quick start guide 3 | ===================== 4 | 5 | You should read docs/README. It's pretty short. If you really can't, here's 6 | how to hit the ground running: 7 | 8 | 1) Compile AFL with 'make'. If build fails, see docs/INSTALL for tips. 9 | 10 | 2) Find or write a reasonably fast and simple program that takes data from 11 | a file or stdin, processes it in a test-worthy way, then exits cleanly. 12 | If testing a network service, modify it to run in the foreground and read 13 | from stdin. When fuzzing a format that uses checksums, comment out the 14 | checksum verification code, too. 15 | 16 | The program must crash properly when a fault is encountered. Watch out for 17 | custom SIGSEGV or SIGABRT handlers and background processes. For tips on 18 | detecting non-crashing flaws, see section 11 in docs/README. 19 | 20 | 3) Compile the program / library to be fuzzed using afl-gcc. A common way to 21 | do this would be: 22 | 23 | CC=/path/to/afl-gcc CXX=/path/to/afl-g++ ./configure --disable-shared 24 | make clean all 25 | 26 | If program build fails, ping . 27 | 28 | 4) Get a small but valid input file that makes sense to the program. When 29 | fuzzing verbose syntax (SQL, HTTP, etc), create a dictionary as described in 30 | dictionaries/README.dictionaries, too. 31 | 32 | 5) If the program reads from stdin, run 'afl-fuzz' like so: 33 | 34 | ./afl-fuzz -i testcase_dir -o findings_dir -- \ 35 | /path/to/tested/program [...program's cmdline...] 36 | 37 | If the program takes input from a file, you can put @@ in the program's 38 | command line; AFL will put an auto-generated file name in there for you. 39 | 40 | 6) Investigate anything shown in red in the fuzzer UI by promptly consulting 41 | docs/status_screen.txt. 42 | 43 | That's it. Sit back, relax, and - time permitting - try to skim through the 44 | following files: 45 | 46 | - docs/README - A general introduction to AFL, 47 | - docs/perf_tips.txt - Simple tips on how to fuzz more quickly, 48 | - docs/status_screen.txt - An explanation of the tidbits shown in the UI, 49 | - docs/parallel_fuzzing.txt - Advice on running AFL on multiple cores. 50 | -------------------------------------------------------------------------------- /experimental/argv_fuzzing/argv-fuzz-inl.h: -------------------------------------------------------------------------------- 1 | /* 2 | american fuzzy lop - sample argv fuzzing wrapper 3 | ------------------------------------------------ 4 | 5 | Written by Michal Zalewski 6 | 7 | Copyright 2015 Google Inc. All rights reserved. 8 | 9 | Licensed under the Apache License, Version 2.0 (the "License"); 10 | you may not use this file except in compliance with the License. 11 | You may obtain a copy of the License at: 12 | 13 | http://www.apache.org/licenses/LICENSE-2.0 14 | 15 | This file shows a simple way to fuzz command-line parameters with stock 16 | afl-fuzz. To use, add: 17 | 18 | #include "/path/to/argv-fuzz-inl.h" 19 | 20 | ...to the file containing main(), ideally placing it after all the 21 | standard includes. Next, put AFL_INIT_ARGV(); near the very beginning of 22 | main(). 23 | 24 | This will cause the program to read NUL-delimited input from stdin and 25 | put it in argv[]. Two subsequent NULs terminate the array. Empty 26 | params are encoded as a lone 0x02. Lone 0x02 can't be generated, but 27 | that shouldn't matter in real life. 28 | 29 | If you would like to always preserve argv[0], use this instead: 30 | AFL_INIT_SET0("prog_name"); 31 | 32 | */ 33 | 34 | #ifndef _HAVE_ARGV_FUZZ_INL 35 | #define _HAVE_ARGV_FUZZ_INL 36 | 37 | #include 38 | 39 | #define AFL_INIT_ARGV() do { argv = afl_init_argv(&argc); } while (0) 40 | 41 | #define AFL_INIT_SET0(_p) do { \ 42 | argv = afl_init_argv(&argc); \ 43 | argv[0] = (_p); \ 44 | if (!argc) argc = 1; \ 45 | } while (0) 46 | 47 | #define MAX_CMDLINE_LEN 100000 48 | #define MAX_CMDLINE_PAR 1000 49 | 50 | static char** afl_init_argv(int* argc) { 51 | 52 | static char in_buf[MAX_CMDLINE_LEN]; 53 | static char* ret[MAX_CMDLINE_PAR]; 54 | 55 | char* ptr = in_buf; 56 | int rc = 0; 57 | 58 | if (read(0, in_buf, MAX_CMDLINE_LEN - 2) < 0); 59 | 60 | while (*ptr) { 61 | 62 | ret[rc] = ptr; 63 | if (ret[rc][0] == 0x02 && !ret[rc][1]) ret[rc]++; 64 | rc++; 65 | 66 | while (*ptr) ptr++; 67 | ptr++; 68 | 69 | } 70 | 71 | *argc = rc; 72 | 73 | return ret; 74 | 75 | } 76 | 77 | #undef MAX_CMDLINE_LEN 78 | #undef MAX_CMDLINE_PAR 79 | 80 | #endif /* !_HAVE_ARGV_FUZZ_INL */ 81 | -------------------------------------------------------------------------------- /seed_generation/src/date-fuzz: -------------------------------------------------------------------------------- 1 | #!/opt/tsmart-date/tbash 2 | set -eu 3 | . $(dirname "$0")/lib-common 4 | 5 | sym-fuzz() { 6 | local klee_args=( 7 | "-only-output-states-covering-new" 8 | "-libc=uclibc" 9 | "-posix-runtime" 10 | "-simplify-sym-indices" 11 | ) 12 | 13 | local arg_max_memory="${MAX_MEM:-2000}" 14 | local arg_max_time="${MAX_TIME:-1200}" 15 | local app_bc_path="$1" 16 | 17 | log-debug "Symbolic argument size = $SYM_ARG_SIZE" 18 | log-debug "Application is at $app_bc_path" 19 | 20 | log-info "Starting symbolic execution" 21 | klee_args+=( 22 | "-max-instruction-time=30" 23 | "-max-memory=$arg_max_memory" 24 | "-max-time=$arg_max_time" 25 | "-max-sym-array-size=4096" 26 | ) 27 | 28 | local args=("$KLEE" "${klee_args[@]}" "$app_bc_path" -sym-arg "$SYM_ARG_SIZE") 29 | print-args "KLEE cmdline:" "${args[@]}" 30 | "${args[@]}" 31 | } 32 | 33 | dyn-fuzz() { 34 | if [[ "$1" != "-afl_mode" ]]; then 35 | # local args=("$AFL_PREFIX/bin/afl-fuzz" "-m 20981520 -t 1000" "$@") 36 | # print-args "AFL cmdline:" "${args[@]}" 37 | # "${args[@]}" 38 | tmux new -s deep_fuzzer -d 39 | 40 | tmux send -t "deep_fuzzer" "$AFL_PREFIX/bin/afl-fuzz -i ../sym/seed -o out -m 20981520 -t 1000 -M master $@" Enter 41 | 42 | tmux split-window -h -t "deep_fuzzer" 43 | tmux send -t "deep_fuzzer" "$AFL_PREFIX/bin/afl-fuzz -i ../sym/seed -o out -m 20981520 -t 1000 -S fuzzer1 $@" Enter 44 | # 默认上下分屏 45 | tmux split-window -t "deep_fuzzer" 46 | tmux select-pane -L 47 | tmux split-window -t "deep_fuzzer" 48 | tmux send -t "deep_fuzzer" "$AFL_PREFIX/bin/afl-fuzz -i ../sym/seed -o out -m 20981520 -t 1000 -S fuzzer2 $@" Enter 49 | tmux select-pane -R 50 | tmux send -t "deep_fuzzer" "$AFL_PREFIX/bin/afl-fuzz -i ../sym/seed -o out -m 20981520 -t 1000 -S fuzzer3 $@" Enter 51 | 52 | tmux attach -t deep_fuzzer 53 | 54 | else 55 | local args=("$AFL_PREFIX/bin/afl-fuzz" "-m 20981520" "${@:2}") 56 | print-args "AFL cmdline:" "${args[@]}" 57 | "${args[@]}" 58 | fi 59 | 60 | } 61 | 62 | usage() { 63 | local prog="$(basename "$0")" 64 | log-error "Usage\n" \ 65 | " $prog app\n" 66 | } 67 | 68 | [[ "$#" == 0 ]] && usage 69 | 70 | load-config 71 | if [[ "$MODE" == sym ]]; then 72 | . $(dirname "$0")/lib-sym 73 | sym-fuzz "$1.bc" 74 | else 75 | . $(dirname "$0")/lib-dyn 76 | dyn-fuzz "$@" 77 | fi 78 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | 2 | 3 | # DeepFuzzer 4 | 5 | ## Summary 6 | 7 | DeepFuzzer is a fuzzer which combines qualified seed generation, balanced seed selection, hybrid seed mutation and automatic fuzzing environment configuration. 8 | 9 | DeepFuzzer is an extension of AFL which is written and maintained by Michal Zalewski <[lcamtuf@google.com](mailto:lcamtuf@google.com)>, so its basic usage is like AFL, which can be found in http://lcamtuf.coredump.cx/afl/. 10 | 11 | To generate high-quality seeds, please use the tool in seed_generation directory. Besides that, if you want to open the balanced seed selection, please add the -F option. And you can also use –D option to open the hybrid seed mutation. We also supply the –P option to open power schedule, this is another optimization for AFL to calculate the mutation times of a seed. These functions are closed in default, and you can combine them as you like. We believe that in most cases, opening all of them is the best option. 12 | 13 | 14 | 15 | ## Some intermediate results 16 | 17 | **Number of seeds generated over time and the corresponding number of paths executed for fuzzing pcre2.** 18 | 19 | ![1575944719701](img/seed_generation.png) 20 | 21 | Let xi be the hit count of the rarest branch for the seed si, n be the number of branches. gamma is a constant, which diminishes the skip probability equally to increase efficiency. The optimized fair skip probability for seed si is: 22 | 23 | ![1575946689963](img/gamma_pcre2.png) 24 | 25 | **The number of paths and branches for fuzzing pcre2 when gamma is assigned different values.** 26 | 27 | ![1575944923285](img/gamma.png) 28 | 29 | Let s denote the selected seed that needs to be mutated next, p(s) denote the energy of s , and p AFL (s) denote the original energy calculated by AFL. Given the number of times c(s) which s has previously been chosen from the queue S and the hit number h(s) of the rarest branch covered by s , DeepFuzzer computes p(s) as 30 | 31 | ![1575946735925](img/beta_pcre2.png) 32 | 33 | **The number of paths and branches for fuzzing pcre2 when beta is assigned different values.** 34 | 35 | ![1575945038726](img/beta.png) 36 | 37 | **Influence of each component** 38 | 39 | ![1575946935987](img/e_component.png) 40 | 41 | **Evaluation on ten programs of Google fuzzer-test-suite for 24 hours with one core** 42 | 43 | ![1575944393258](img/paths.png) 44 | 45 | ![1575944420346](img/branches.png) 46 | 47 | ![1575944447180](img/crashes.png) 48 | 49 | **Performance for different fuzzers on fuzzing pcre2 24 hours with one core** 50 | 51 | ![1575944566536](img/pcre2.png) -------------------------------------------------------------------------------- /seed_generation/src/lib-common: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | set -eu 3 | export LD_LIBRARY_PATH=/opt/lib 4 | 5 | # =========== Configuration =========== 6 | 7 | TOOLCHAIN_PREFIX=/tmp/toolchain 8 | CONFIG_PATH="$TOOLCHAIN_PREFIX/config" 9 | AS_PREFIX=/usr 10 | SLLVM_PREFIX=/opt/llvm5 11 | 12 | # =========== Constants =========== 13 | 14 | AS="$TOOLCHAIN_PREFIX/as" 15 | CC="$TOOLCHAIN_PREFIX/clang" 16 | CXX="$TOOLCHAIN_PREFIX/clang++" 17 | 18 | # =========== Variables =========== 19 | 20 | declare -a ARR_CFLAGS=() 21 | declare -a ARR_CXXFLAGS=() 22 | declare -a ARR_LDFLAGS=() 23 | declare -a ARR_EXT_ARGS=() 24 | 25 | # =========== Loggers =========== 26 | 27 | log-debug() { 28 | echo -e "\e[94m[*]\e[0m $*" 29 | } 30 | 31 | log-info() { 32 | echo -e "\e[92m[+]\e[0m $*" 33 | } 34 | 35 | log-error() { 36 | echo -e "\e[91m[!]\e[0m $*" 37 | exit 1 38 | } 39 | 40 | print-args() { 41 | [[ "$#" -le 2 ]] && return 42 | log-debug "$1" 43 | for arg in "${@:2}"; do 44 | log-debug "\t$arg" 45 | done 46 | } 47 | 48 | # =========== Setup =========== 49 | 50 | inject-flags() { 51 | local opts=("CXXFLAGS=${ARR_CXXFLAGS[*]} ${CXXFLAGS:-}" 52 | "CFLAGS=${ARR_CFLAGS[*]} ${CFLAGS:-}" 53 | "LDFLAGS=${ARR_LDFLAGS[*]} ${LDFLAGS:-}") 54 | export "${opts[@]}" 55 | } 56 | 57 | inject-compilers() { 58 | local opts=("CC=$CC" "CXX=$CXX" "AS=$AS") 59 | export "${opts[@]}" 60 | } 61 | 62 | setup-toolchain() { 63 | log-debug "Toolchain is at $TOOLCHAIN_PREFIX" 64 | mkdir -p "$TOOLCHAIN_PREFIX" 65 | rm -f "$AS" "$CXX" "$CC" 66 | } 67 | 68 | # Config 69 | 70 | save-config() { 71 | cat > "$TOOLCHAIN_PREFIX/config" < 7 | # 8 | # Copyright 2013, 2014 Google Inc. All rights reserved. 9 | # 10 | # Licensed under the Apache License, Version 2.0 (the "License"); 11 | # you may not use this file except in compliance with the License. 12 | # You may obtain a copy of the License at: 13 | # 14 | # http://www.apache.org/licenses/LICENSE-2.0 15 | # 16 | # Note that this assumes that the targeted application reads from stdin 17 | # and requires no other cmdline parameters. Modify as needed if this is 18 | # not the case. 19 | # 20 | # Note that on OpenBSD, you may need to install a newer version of gdb 21 | # (e.g., from ports). You can set GDB=/some/path to point to it if 22 | # necessary. 23 | # 24 | 25 | echo "crash triage utility for afl-fuzz by " 26 | echo 27 | 28 | ulimit -v 100000 2>/dev/null 29 | ulimit -d 100000 2>/dev/null 30 | 31 | if [ ! "$#" = "2" ]; then 32 | echo "Usage: $0 /path/to/afl_output_dir /path/to/tested_binary" 1>&2 33 | echo 1>&2 34 | echo "Note: the tested binary must accept input on stdin and require no additional" 1>&2 35 | echo "parameters. For more complex use cases, you need to edit this script." 1>&2 36 | echo 1>&2 37 | exit 1 38 | fi 39 | 40 | DIR="$1" 41 | BIN="$2" 42 | 43 | 44 | if [ "$AFL_ALLOW_TMP" = "" ]; then 45 | 46 | echo "$DIR" | grep -qE '^(/var)?/tmp/' 47 | T1="$?" 48 | 49 | echo "$BIN" | grep -qE '^(/var)?/tmp/' 50 | T2="$?" 51 | 52 | if [ "$T1" = "0" -o "$T2" = "0" ]; then 53 | echo "[-] Error: do not use shared /tmp or /var/tmp directories with this script." 1>&2 54 | exit 1 55 | fi 56 | 57 | fi 58 | 59 | if 60 | [ "$GDB" = "" ]; then 61 | GDB=gdb 62 | fi 63 | 64 | if [ ! -f "$BIN" -o ! -x "$BIN" ]; then 65 | echo "[-] Error: binary '$2' not found or is not executable." 1>&2 66 | exit 1 67 | fi 68 | 69 | if [ ! -d "$DIR/queue" ]; then 70 | echo "[-] Error: directory '$1' not found or not created by afl-fuzz." 1>&2 71 | exit 1 72 | fi 73 | 74 | CCOUNT=$((`ls -- "$DIR/crashes" 2>/dev/null | wc -l`)) 75 | 76 | if [ "$CCOUNT" = "0" ]; then 77 | echo "No crashes recorded in the target directory - nothing to be done." 78 | exit 0 79 | fi 80 | 81 | echo 82 | 83 | for crash in $DIR/crashes/id:*; do 84 | 85 | id=`basename -- "$crash" | cut -d, -f1 | cut -d: -f2` 86 | sig=`basename -- "$crash" | cut -d, -f2 | cut -d: -f2` 87 | 88 | echo "+++ ID $id, SIGNAL $sig +++" 89 | echo 90 | 91 | $GDB --batch -q --ex "r <$crash" --ex 'back' --ex 'disass $pc, $pc+16' --ex 'info reg' --ex 'quit' "$BIN" 0 7 | # 8 | # Copyright 2014 Google Inc. All rights reserved. 9 | # 10 | # Licensed under the Apache License, Version 2.0 (the "License"); 11 | # you may not use this file except in compliance with the License. 12 | # You may obtain a copy of the License at: 13 | # 14 | # http://www.apache.org/licenses/LICENSE-2.0 15 | # 16 | # To make this script work: 17 | # 18 | # - Edit FUZZ_HOSTS, FUZZ_DOMAIN, FUZZ_USER, and SYNC_DIR to reflect your 19 | # environment. 20 | # 21 | # - Make sure that the system you are running this on can log into FUZZ_HOSTS 22 | # without a password (authorized_keys or otherwise). 23 | # 24 | # - Make sure that every fuzzer is running with -o pointing to SYNC_DIR and -S 25 | # that consists of its local host name, followed by an underscore, and then 26 | # by some host-local fuzzer ID. 27 | # 28 | 29 | # Hosts to synchronize the data across. 30 | FUZZ_HOSTS='host1 host2 host3 host4' 31 | 32 | # Domain for all hosts 33 | FUZZ_DOMAIN='example.com' 34 | 35 | # Remote user for SSH 36 | FUZZ_USER=bob 37 | 38 | # Directory to synchronize 39 | SYNC_DIR='/home/bob/sync_dir' 40 | 41 | # Interval (seconds) between sync attempts 42 | SYNC_INTERVAL=$((30 * 60)) 43 | 44 | if [ "$AFL_ALLOW_TMP" = "" ]; then 45 | 46 | if [ "$PWD" = "/tmp" -o "$PWD" = "/var/tmp" ]; then 47 | echo "[-] Error: do not use shared /tmp or /var/tmp directories with this script." 1>&2 48 | exit 1 49 | fi 50 | 51 | fi 52 | 53 | rm -rf .sync_tmp 2>/dev/null 54 | mkdir .sync_tmp || exit 1 55 | 56 | while :; do 57 | 58 | # Pull data in... 59 | 60 | for host in $FUZZ_HOSTS; do 61 | 62 | echo "[*] Retrieving data from ${host}.${FUZZ_DOMAIN}..." 63 | 64 | ssh -o 'passwordauthentication no' ${FUZZ_USER}@${host}.$FUZZ_DOMAIN \ 65 | "cd '$SYNC_DIR' && tar -czf - ${host}_*/[qf]*" >".sync_tmp/${host}.tgz" 66 | 67 | done 68 | 69 | # Distribute data. For large fleets, see tips in the docs/ directory. 70 | 71 | for dst_host in $FUZZ_HOSTS; do 72 | 73 | echo "[*] Distributing data to ${dst_host}.${FUZZ_DOMAIN}..." 74 | 75 | for src_host in $FUZZ_HOSTS; do 76 | 77 | test "$src_host" = "$dst_host" && continue 78 | 79 | echo " Sending fuzzer data from ${src_host}.${FUZZ_DOMAIN}..." 80 | 81 | ssh -o 'passwordauthentication no' ${FUZZ_USER}@$dst_host \ 82 | "cd '$SYNC_DIR' && tar -xkzf -" <".sync_tmp/${src_host}.tgz" 83 | 84 | done 85 | 86 | done 87 | 88 | echo "[+] Done. Sleeping for $SYNC_INTERVAL seconds (Ctrl-C to quit)." 89 | 90 | sleep $SYNC_INTERVAL 91 | 92 | done 93 | 94 | -------------------------------------------------------------------------------- /dictionaries/js.dict: -------------------------------------------------------------------------------- 1 | # 2 | # AFL dictionary for JavaScript 3 | # ----------------------------- 4 | # 5 | # Contains basic reserved keywords and syntax building blocks. 6 | # 7 | # Created by Michal Zalewski 8 | # 9 | 10 | keyword_arguments="arguments" 11 | keyword_break="break" 12 | keyword_case="case" 13 | keyword_catch="catch" 14 | keyword_const="const" 15 | keyword_continue="continue" 16 | keyword_debugger="debugger" 17 | keyword_decodeURI="decodeURI" 18 | keyword_default="default" 19 | keyword_delete="delete" 20 | keyword_do="do" 21 | keyword_else="else" 22 | keyword_escape="escape" 23 | keyword_eval="eval" 24 | keyword_export="export" 25 | keyword_finally="finally" 26 | keyword_for="for (a=0;a<2;a++)" 27 | keyword_function="function" 28 | keyword_if="if" 29 | keyword_in="in" 30 | keyword_instanceof="instanceof" 31 | keyword_isNaN="isNaN" 32 | keyword_let="let" 33 | keyword_new="new" 34 | keyword_parseInt="parseInt" 35 | keyword_return="return" 36 | keyword_switch="switch" 37 | keyword_this="this" 38 | keyword_throw="throw" 39 | keyword_try="try" 40 | keyword_typeof="typeof" 41 | keyword_var="var" 42 | keyword_void="void" 43 | keyword_while="while" 44 | keyword_with="with" 45 | 46 | misc_1=" 1" 47 | misc_a="a" 48 | misc_array=" [1]" 49 | misc_assign=" a=1" 50 | misc_code_block=" {1}" 51 | misc_colon_num=" 1:" 52 | misc_colon_string=" 'a':" 53 | misc_comma=" ," 54 | misc_comment_block=" /* */" 55 | misc_comment_line=" //" 56 | misc_cond=" 1?2:3" 57 | misc_dec=" --" 58 | misc_div=" /" 59 | misc_equals=" =" 60 | misc_fn=" a()" 61 | misc_identical=" ===" 62 | misc_inc=" ++" 63 | misc_minus=" -" 64 | misc_modulo=" %" 65 | misc_parentheses=" ()" 66 | misc_parentheses_1=" (1)" 67 | misc_parentheses_1x4=" (1,1,1,1)" 68 | misc_parentheses_a=" (a)" 69 | misc_period="." 70 | misc_plus=" +" 71 | misc_plus_assign=" +=" 72 | misc_regex=" /a/g" 73 | misc_rol=" <<<" 74 | misc_semicolon=" ;" 75 | misc_serialized_object=" {'a': 1}" 76 | misc_string=" 'a'" 77 | misc_unicode=" '\\u0001'" 78 | 79 | object_Array=" Array" 80 | object_Boolean=" Boolean" 81 | object_Date=" Date" 82 | object_Function=" Function" 83 | object_Infinity=" Infinity" 84 | object_Int8Array=" Int8Array" 85 | object_Math=" Math" 86 | object_NaN=" NaN" 87 | object_Number=" Number" 88 | object_Object=" Object" 89 | object_RegExp=" RegExp" 90 | object_String=" String" 91 | object_Symbol=" Symbol" 92 | object_false=" false" 93 | object_null=" null" 94 | object_true=" true" 95 | 96 | prop_charAt=".charAt" 97 | prop_concat=".concat" 98 | prop_constructor=".constructor" 99 | prop_destructor=".destructor" 100 | prop_length=".length" 101 | prop_match=".match" 102 | prop_proto=".__proto__" 103 | prop_prototype=".prototype" 104 | prop_slice=".slice" 105 | prop_toCode=".toCode" 106 | prop_toString=".toString" 107 | prop_valueOf=".valueOf" 108 | -------------------------------------------------------------------------------- /libdislocator/README.dislocator: -------------------------------------------------------------------------------- 1 | =================================== 2 | libdislocator, an abusive allocator 3 | =================================== 4 | 5 | (See ../docs/README for the general instruction manual.) 6 | 7 | This is a companion library that can be used as a drop-in replacement for the 8 | libc allocator in the fuzzed binaries. It improves the odds of bumping into 9 | heap-related security bugs in several ways: 10 | 11 | - It allocates all buffers so that they are immediately adjacent to a 12 | subsequent PROT_NONE page, causing most off-by-one reads and writes to 13 | immediately segfault, 14 | 15 | - It adds a canary immediately below the allocated buffer, to catch writes 16 | to negative offsets (won't catch reads, though), 17 | 18 | - It sets the memory returned by malloc() to garbage values, improving the 19 | odds of crashing when the target accesses uninitialized data, 20 | 21 | - It sets freed memory to PROT_NONE and does not actually reuse it, causing 22 | most use-after-free bugs to segfault right away, 23 | 24 | - It forces all realloc() calls to return a new address - and sets 25 | PROT_NONE on the original block. This catches use-after-realloc bugs, 26 | 27 | - It checks for calloc() overflows and can cause soft or hard failures 28 | of alloc requests past a configurable memory limit (AFL_LD_LIMIT_MB, 29 | AFL_LD_HARD_FAIL). 30 | 31 | Basically, it is inspired by some of the non-default options available for the 32 | OpenBSD allocator - see malloc.conf(5) on that platform for reference. It is 33 | also somewhat similar to several other debugging libraries, such as gmalloc 34 | and DUMA - but is simple, plug-and-play, and designed specifically for fuzzing 35 | jobs. 36 | 37 | Note that it does nothing for stack-based memory handling errors. The 38 | -fstack-protector-all setting for GCC / clang, enabled when using AFL_HARDEN, 39 | can catch some subset of that. 40 | 41 | The allocator is slow and memory-intensive (even the tiniest allocation uses up 42 | 4 kB of physical memory and 8 kB of virtual mem), making it completely unsuitable 43 | for "production" uses; but it can be faster and more hassle-free than ASAN / MSAN 44 | when fuzzing small, self-contained binaries. 45 | 46 | To use this library, run AFL like so: 47 | 48 | AFL_PRELOAD=/path/to/libdislocator.so ./afl-fuzz [...other params...] 49 | 50 | You *have* to specify path, even if it's just ./libdislocator.so or 51 | $PWD/libdislocator.so. 52 | 53 | Similarly to afl-tmin, the library is not "proprietary" and can be used with 54 | other fuzzers or testing tools without the need for any code tweaks. It does not 55 | require AFL-instrumented binaries to work. 56 | 57 | Note that the AFL_PRELOAD approach (which AFL internally maps to LD_PRELOAD or 58 | DYLD_INSERT_LIBRARIES, depending on the OS) works only if the target binary is 59 | dynamically linked. Otherwise, attempting to use the library will have no 60 | effect. 61 | -------------------------------------------------------------------------------- /experimental/persistent_demo/persistent_demo.c: -------------------------------------------------------------------------------- 1 | /* 2 | american fuzzy lop - persistent mode example 3 | -------------------------------------------- 4 | 5 | Written and maintained by Michal Zalewski 6 | 7 | Copyright 2015 Google Inc. All rights reserved. 8 | 9 | Licensed under the Apache License, Version 2.0 (the "License"); 10 | you may not use this file except in compliance with the License. 11 | You may obtain a copy of the License at: 12 | 13 | http://www.apache.org/licenses/LICENSE-2.0 14 | 15 | This file demonstrates the high-performance "persistent mode" that may be 16 | suitable for fuzzing certain fast and well-behaved libraries, provided that 17 | they are stateless or that their internal state can be easily reset 18 | across runs. 19 | 20 | To make this work, the library and this shim need to be compiled in LLVM 21 | mode using afl-clang-fast (other compiler wrappers will *not* work). 22 | 23 | */ 24 | 25 | #include 26 | #include 27 | #include 28 | #include 29 | #include 30 | 31 | 32 | /* Main entry point. */ 33 | 34 | int main(int argc, char** argv) { 35 | 36 | char buf[100]; /* Example-only buffer, you'd replace it with other global or 37 | local variables appropriate for your use case. */ 38 | 39 | /* The number passed to __AFL_LOOP() controls the maximum number of 40 | iterations before the loop exits and the program is allowed to 41 | terminate normally. This limits the impact of accidental memory leaks 42 | and similar hiccups. */ 43 | 44 | while (__AFL_LOOP(1000)) { 45 | 46 | /*** PLACEHOLDER CODE ***/ 47 | 48 | /* STEP 1: Fully re-initialize all critical variables. In our example, this 49 | involves zeroing buf[], our input buffer. */ 50 | 51 | memset(buf, 0, 100); 52 | 53 | /* STEP 2: Read input data. When reading from stdin, no special preparation 54 | is required. When reading from a named file, you need to close 55 | the old descriptor and reopen the file first! 56 | 57 | Beware of reading from buffered FILE* objects such as stdin. Use 58 | raw file descriptors or call fopen() / fdopen() in every pass. */ 59 | 60 | read(0, buf, 100); 61 | 62 | /* STEP 3: This is where we'd call the tested library on the read data. 63 | We just have some trivial inline code that faults on 'foo!'. */ 64 | 65 | if (buf[0] == 'f') { 66 | printf("one\n"); 67 | if (buf[1] == 'o') { 68 | printf("two\n"); 69 | if (buf[2] == 'o') { 70 | printf("three\n"); 71 | if (buf[3] == '!') { 72 | printf("four\n"); 73 | abort(); 74 | } 75 | } 76 | } 77 | } 78 | 79 | /*** END PLACEHOLDER CODE ***/ 80 | 81 | } 82 | 83 | /* Once the loop is exited, terminate normally - AFL will restart the process 84 | when this happens, with a clean slate when it comes to allocated memory, 85 | leftover file descriptors, etc. */ 86 | 87 | return 0; 88 | 89 | } 90 | -------------------------------------------------------------------------------- /libtokencap/README.tokencap: -------------------------------------------------------------------------------- 1 | ========================================= 2 | strcmp() / memcmp() token capture library 3 | ========================================= 4 | 5 | (See ../docs/README for the general instruction manual.) 6 | 7 | This Linux-only companion library allows you to instrument strcmp(), memcmp(), 8 | and related functions to automatically extract syntax tokens passed to any of 9 | these libcalls. The resulting list of tokens may be then given as a starting 10 | dictionary to afl-fuzz (the -x option) to improve coverage on subsequent 11 | fuzzing runs. 12 | 13 | This may help improving coverage in some targets, and do precisely nothing in 14 | others. In some cases, it may even make things worse: if libtokencap picks up 15 | syntax tokens that are not used to process the input data, but that are a part 16 | of - say - parsing a config file... well, you're going to end up wasting a lot 17 | of CPU time on trying them out in the input stream. In other words, use this 18 | feature with care. Manually screening the resulting dictionary is almost 19 | always a necessity. 20 | 21 | As for the actual operation: the library stores tokens, without any deduping, 22 | by appending them to a file specified via AFL_TOKEN_FILE. If the variable is not 23 | set, the tool uses stderr (which is probably not what you want). 24 | 25 | Similarly to afl-tmin, the library is not "proprietary" and can be used with 26 | other fuzzers or testing tools without the need for any code tweaks. It does not 27 | require AFL-instrumented binaries to work. 28 | 29 | To use the library, you *need* to make sure that your fuzzing target is compiled 30 | with -fno-builtin and is linked dynamically. If you wish to automate the first 31 | part without mucking with CFLAGS in Makefiles, you can set AFL_NO_BUILTIN=1 32 | when using afl-gcc. This setting specifically adds the following flags: 33 | 34 | -fno-builtin-strcmp -fno-builtin-strncmp -fno-builtin-strcasecmp 35 | -fno-builtin-strcasencmp -fno-builtin-memcmp -fno-builtin-strstr 36 | -fno-builtin-strcasestr 37 | 38 | The next step is simply loading this library via LD_PRELOAD. The optimal usage 39 | pattern is to allow afl-fuzz to fuzz normally for a while and build up a corpus, 40 | and then fire off the target binary, with libtokencap.so loaded, on every file 41 | found by AFL in that earlier run. This demonstrates the basic principle: 42 | 43 | export AFL_TOKEN_FILE=$PWD/temp_output.txt 44 | 45 | for i in /queue/id*; do 46 | LD_PRELOAD=/path/to/libtokencap.so \ 47 | /path/to/target/program [...params, including $i...] 48 | done 49 | 50 | sort -u temp_output.txt >afl_dictionary.txt 51 | 52 | If you don't get any results, the target library is probably not using strcmp() 53 | and memcmp() to parse input; or you haven't compiled it with -fno-builtin; or 54 | the whole thing isn't dynamically linked, and LD_PRELOAD is having no effect. 55 | 56 | PS. The library is Linux-only because there is probably no particularly portable 57 | and non-invasive way to distinguish between read-only and read-write memory 58 | mappings. The __tokencap_load_mappings() function is the only thing that would 59 | need to be changed for other OSes. Porting to platforms with /proc//maps 60 | (e.g., FreeBSD) should be trivial. 61 | 62 | -------------------------------------------------------------------------------- /experimental/post_library/post_library_png.so.c: -------------------------------------------------------------------------------- 1 | /* 2 | american fuzzy lop - postprocessor for PNG 3 | ------------------------------------------ 4 | 5 | Written and maintained by Michal Zalewski 6 | 7 | Copyright 2015 Google Inc. All rights reserved. 8 | 9 | Licensed under the Apache License, Version 2.0 (the "License"); 10 | you may not use this file except in compliance with the License. 11 | You may obtain a copy of the License at: 12 | 13 | http://www.apache.org/licenses/LICENSE-2.0 14 | 15 | See post_library.so.c for a general discussion of how to implement 16 | postprocessors. This specific postprocessor attempts to fix up PNG 17 | checksums, providing a slightly more complicated example than found 18 | in post_library.so.c. 19 | 20 | Compile with: 21 | 22 | gcc -shared -Wall -O3 post_library_png.so.c -o post_library_png.so -lz 23 | 24 | */ 25 | 26 | #include 27 | #include 28 | #include 29 | #include 30 | #include 31 | 32 | #include 33 | 34 | /* A macro to round an integer up to 4 kB. */ 35 | 36 | #define UP4K(_i) ((((_i) >> 12) + 1) << 12) 37 | 38 | const unsigned char* afl_postprocess(const unsigned char* in_buf, 39 | unsigned int* len) { 40 | 41 | static unsigned char* saved_buf; 42 | static unsigned int saved_len; 43 | 44 | unsigned char* new_buf = (unsigned char*)in_buf; 45 | unsigned int pos = 8; 46 | 47 | /* Don't do anything if there's not enough room for the PNG header 48 | (8 bytes). */ 49 | 50 | if (*len < 8) return in_buf; 51 | 52 | /* Minimum size of a zero-length PNG chunk is 12 bytes; if we 53 | don't have that, we can bail out. */ 54 | 55 | while (pos + 12 <= *len) { 56 | 57 | unsigned int chunk_len, real_cksum, file_cksum; 58 | 59 | /* Chunk length is the first big-endian dword in the chunk. */ 60 | 61 | chunk_len = ntohl(*(uint32_t*)(in_buf + pos)); 62 | 63 | /* Bail out if chunk size is too big or goes past EOF. */ 64 | 65 | if (chunk_len > 1024 * 1024 || pos + 12 + chunk_len > *len) break; 66 | 67 | /* Chunk checksum is calculated for chunk ID (dword) and the actual 68 | payload. */ 69 | 70 | real_cksum = htonl(crc32(0, in_buf + pos + 4, chunk_len + 4)); 71 | 72 | /* The in-file checksum is the last dword past the chunk data. */ 73 | 74 | file_cksum = *(uint32_t*)(in_buf + pos + 8 + chunk_len); 75 | 76 | /* If the checksums do not match, we need to fix the file. */ 77 | 78 | if (real_cksum != file_cksum) { 79 | 80 | /* First modification? Make a copy of the input buffer. Round size 81 | up to 4 kB to minimize the number of reallocs needed. */ 82 | 83 | if (new_buf == in_buf) { 84 | 85 | if (*len <= saved_len) { 86 | 87 | new_buf = saved_buf; 88 | 89 | } else { 90 | 91 | new_buf = realloc(saved_buf, UP4K(*len)); 92 | if (!new_buf) return in_buf; 93 | saved_buf = new_buf; 94 | saved_len = UP4K(*len); 95 | memcpy(new_buf, in_buf, *len); 96 | 97 | } 98 | 99 | } 100 | 101 | *(uint32_t*)(new_buf + pos + 8 + chunk_len) = real_cksum; 102 | 103 | } 104 | 105 | /* Skip the entire chunk and move to the next one. */ 106 | 107 | pos += 12 + chunk_len; 108 | 109 | } 110 | 111 | return new_buf; 112 | 113 | } 114 | -------------------------------------------------------------------------------- /seed_generation/src/date-test-gen: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | 3 | import os 4 | import struct 5 | import sys 6 | 7 | version_no=3 8 | 9 | class KTestError(Exception): 10 | pass 11 | 12 | class KTest: 13 | @staticmethod 14 | def fromfile(path): 15 | if not os.path.exists(path): 16 | print("ERROR: file %s not found" % (path)) 17 | sys.exit(1) 18 | 19 | f = open(path,'rb') 20 | hdr = f.read(5) 21 | if len(hdr)!=5 or (hdr!=b'KTEST' and hdr != b"BOUT\n"): 22 | raise KTestError('unrecognized file') 23 | version, = struct.unpack('>i', f.read(4)) 24 | if version > version_no: 25 | raise KTestError('unrecognized version') 26 | numArgs, = struct.unpack('>i', f.read(4)) 27 | args = [] 28 | for i in range(numArgs): 29 | size, = struct.unpack('>i', f.read(4)) 30 | args.append(str(f.read(size).decode(encoding='ascii'))) 31 | 32 | if version >= 2: 33 | symArgvs, = struct.unpack('>i', f.read(4)) 34 | symArgvLen, = struct.unpack('>i', f.read(4)) 35 | else: 36 | symArgvs = 0 37 | symArgvLen = 0 38 | 39 | numObjects, = struct.unpack('>i', f.read(4)) 40 | objects = [] 41 | for i in range(numObjects): 42 | size, = struct.unpack('>i', f.read(4)) 43 | name = f.read(size) 44 | size, = struct.unpack('>i', f.read(4)) 45 | bytes = f.read(size) 46 | objects.append( (name,bytes) ) 47 | 48 | # Create an instance 49 | b = KTest(version, args, symArgvs, symArgvLen, objects) 50 | # Augment with extra filename field 51 | b.filename = path 52 | return b 53 | 54 | def __init__(self, version, args, symArgvs, symArgvLen, objects): 55 | self.version = version 56 | self.symArgvs = symArgvs 57 | self.symArgvLen = symArgvLen 58 | self.args = args 59 | self.objects = objects 60 | 61 | # add a field that represents the name of the program used to 62 | # generate this .ktest file: 63 | program_full_path = self.args[0] 64 | program_name = os.path.basename(program_full_path) 65 | # sometimes program names end in .bc, so strip them 66 | if program_name.endswith('.bc'): 67 | program_name = program_name[:-3] 68 | self.programName = program_name 69 | 70 | def trimZeros(str): 71 | for i in range(len(str))[::-1]: 72 | if str[i] != '\x00': 73 | return str[:i+1] 74 | return '' 75 | 76 | def main(args): 77 | import argparse 78 | parser = argparse.ArgumentParser(description='Testcase generator') 79 | parser.add_argument('inputs', metavar='input-file', nargs='+', 80 | help='ktest files extract testcase') 81 | parser.add_argument('--output', metavar='output-dir', required=True, 82 | help='output directory of AFL to store seeds') 83 | args = parser.parse_args() 84 | 85 | for input_path in args.inputs: 86 | case = KTest.fromfile(input_path) 87 | output_path = os.path.basename(input_path) 88 | output_path = os.path.splitext(output_path)[0] 89 | output_path = os.path.join(args.output, output_path) + '.symseed' 90 | for name, data in case.objects: 91 | if name == b'arg0': 92 | open(output_path, 'wb').write(data) 93 | 94 | 95 | if __name__=='__main__': 96 | main(sys.argv) 97 | -------------------------------------------------------------------------------- /dictionaries/html_tags.dict: -------------------------------------------------------------------------------- 1 | # 2 | # AFL dictionary for HTML parsers (tags only) 3 | # ------------------------------------------- 4 | # 5 | # A basic collection of HTML tags likely to matter to HTML parsers. Does *not* 6 | # include any attributes or attribute values. 7 | # 8 | # Created by Michal Zalewski 9 | # 10 | 11 | tag_a="" 12 | tag_abbr="" 13 | tag_acronym="" 14 | tag_address="
" 15 | tag_annotation_xml="" 16 | tag_applet="" 17 | tag_area="" 18 | tag_article="
" 19 | tag_aside="