|
|
|
@ -1,92 +1,94 @@
|
|
|
|
/*
|
|
|
|
/*
|
|
|
|
Copyright 2015 Google LLC All rights reserved.
|
|
|
|
Copyright 2015 Google LLC All rights reserved. // 版权声明，2015年谷歌公司所有权利保留
|
|
|
|
|
|
|
|
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License"); // 根据Apache许可证第2.0版授权
|
|
|
|
you may not use this file except in compliance with the License.
|
|
|
|
you may not use this file except in compliance with the License. // 除非遵守许可证，否则不得使用此文件
|
|
|
|
You may obtain a copy of the License at:
|
|
|
|
You may obtain a copy of the License at: // 可以通过以下网址获得许可证副本
|
|
|
|
|
|
|
|
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0 // 许可证的链接
|
|
|
|
|
|
|
|
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
|
|
Unless required by applicable law or agreed to in writing, software // 除非相关法律要求或书面协议，软件
|
|
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
distributed under the License is distributed on an "AS IS" BASIS, // 在“按原样”基础上分发
|
|
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // 不提供任何形式的明示或暗示的保证或条件
|
|
|
|
See the License for the specific language governing permissions and
|
|
|
|
See the License for the specific language governing permissions and // 请参阅许可证以获取约束和限制的具体语言
|
|
|
|
limitations under the License.
|
|
|
|
limitations under the License. // 在许可证下的限制条款
|
|
|
|
*/
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
/*
|
|
|
|
american fuzzy lop - high-performance binary-only instrumentation
|
|
|
|
american fuzzy lop - high-performance binary-only instrumentation // American Fuzzy Lop - 高性能二进制插桩
|
|
|
|
-----------------------------------------------------------------
|
|
|
|
-----------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
|
|
Written by Andrew Griffiths <agriffiths@google.com> and
|
|
|
|
Written by Andrew Griffiths <agriffiths@google.com> and // 由Andrew Griffiths和
|
|
|
|
Michal Zalewski <lcamtuf@google.com>
|
|
|
|
Michal Zalewski <lcamtuf@google.com> // Michal Zalewski编写
|
|
|
|
|
|
|
|
|
|
|
|
Idea & design very much by Andrew Griffiths.
|
|
|
|
Idea & design very much by Andrew Griffiths. // 概念和设计主要由Andrew Griffiths提出。
|
|
|
|
|
|
|
|
|
|
|
|
This code is a shim patched into the separately-distributed source
|
|
|
|
This code is a shim patched into the separately-distributed source // 此代码是补丁，插入到单独分发的源代码中
|
|
|
|
code of QEMU 2.10.0. It leverages the built-in QEMU tracing functionality
|
|
|
|
code of QEMU 2.10.0. It leverages the built-in QEMU tracing functionality // QEMU 2.10.0的源代码中。 该代码利用了内置的QEMU跟踪功能
|
|
|
|
to implement AFL-style instrumentation and to take care of the remaining
|
|
|
|
to implement AFL-style instrumentation and to take care of the remaining // 实现AFL风格的插桩，并处理剩余
|
|
|
|
parts of the AFL fork server logic.
|
|
|
|
parts of the AFL fork server logic. // AFL fork服务器逻辑的部分内容。
|
|
|
|
|
|
|
|
|
|
|
|
The resulting QEMU binary is essentially a standalone instrumentation
|
|
|
|
The resulting QEMU binary is essentially a standalone instrumentation // 生成的QEMU二进制文件基本上是一个独立的插桩工具
|
|
|
|
tool; for an example of how to leverage it for other purposes, you can
|
|
|
|
tool; for an example of how to leverage it for other purposes, you can // 用于其他目的的示例可以参考
|
|
|
|
have a look at afl-showmap.c.
|
|
|
|
have a look at afl-showmap.c. // afl-showmap.c
|
|
|
|
*/
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
#include <sys/shm.h>
|
|
|
|
#include <sys/shm.h> // 包含共享内存的头文件
|
|
|
|
#include "../../config.h"
|
|
|
|
#include "../../config.h" // 包含项目配置的头文件
|
|
|
|
|
|
|
|
|
|
|
|
/***************************
|
|
|
|
/***************************
|
|
|
|
* VARIOUS AUXILIARY STUFF *
|
|
|
|
* VARIOUS AUXILIARY STUFF *
|
|
|
|
***************************/
|
|
|
|
***************************/
|
|
|
|
|
|
|
|
|
|
|
|
/* A snippet patched into tb_find_slow to inform the parent process that
|
|
|
|
/* A snippet patched into tb_find_slow to inform the parent process that // 一段插入到tb_find_slow中的代码，用于通知父进程
|
|
|
|
we have hit a new block that hasn't been translated yet, and to tell
|
|
|
|
we have hit a new block that hasn't been translated yet, and to tell // 我们已经遇到了一个尚未翻译的新块，并告诉父进程
|
|
|
|
it to translate within its own context, too (this avoids translation
|
|
|
|
it to translate within its own context, too (this avoids translation // 也在其自己的上下文中翻译（这避免了在下一个
|
|
|
|
overhead in the next forked-off copy). */
|
|
|
|
overhead in the next forked-off copy). // 被fork的副本中出现翻译开销）。
|
|
|
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
#define AFL_QEMU_CPU_SNIPPET1 do { \
|
|
|
|
#define AFL_QEMU_CPU_SNIPPET1 do { \
|
|
|
|
afl_request_tsl(pc, cs_base, flags); \
|
|
|
|
afl_request_tsl(pc, cs_base, flags); \ // 调用afl_request_tsl函数，传入参数
|
|
|
|
} while (0)
|
|
|
|
} while (0) // 循环体
|
|
|
|
|
|
|
|
|
|
|
|
/* This snippet kicks in when the instruction pointer is positioned at
|
|
|
|
/* This snippet kicks in when the instruction pointer is positioned at // 当指令指针位于_start位置时，此代码段生效
|
|
|
|
_start and does the usual forkserver stuff, not very different from
|
|
|
|
_start and does the usual forkserver stuff, not very different from // 并执行常规的forkserver逻辑，与通过afl-as.h注入的逻辑没有太大区别
|
|
|
|
regular instrumentation injected via afl-as.h. */
|
|
|
|
regular instrumentation injected via afl-as.h. */
|
|
|
|
|
|
|
|
|
|
|
|
#define AFL_QEMU_CPU_SNIPPET2 do { \
|
|
|
|
#define AFL_QEMU_CPU_SNIPPET2 do { \
|
|
|
|
if(itb->pc == afl_entry_point) { \
|
|
|
|
if(itb->pc == afl_entry_point) { \ // 如果当前程序计数器等于入口点
|
|
|
|
afl_setup(); \
|
|
|
|
afl_setup(); \ // 设置插桩环境
|
|
|
|
afl_forkserver(cpu); \
|
|
|
|
afl_forkserver(cpu); \ // 启动fork服务器
|
|
|
|
} \
|
|
|
|
} \
|
|
|
|
afl_maybe_log(itb->pc); \
|
|
|
|
afl_maybe_log(itb->pc); \ // 可能记录当前地址
|
|
|
|
} while (0)
|
|
|
|
} while (0) // 循环体
|
|
|
|
|
|
|
|
|
|
|
|
/* We use one additional file descriptor to relay "needs translation"
|
|
|
|
/* We use one additional file descriptor to relay "needs translation" // 我们使用一个附加文件描述符来传递“需要翻译”的信息
|
|
|
|
messages between the child and the fork server. */
|
|
|
|
messages between the child and the fork server. */
|
|
|
|
|
|
|
|
|
|
|
|
#define TSL_FD (FORKSRV_FD - 1)
|
|
|
|
#define TSL_FD (FORKSRV_FD - 1) // 定义一个文件描述符，用于传递翻译请求
|
|
|
|
|
|
|
|
|
|
|
|
/* This is equivalent to afl-as.h: */
|
|
|
|
/* This is equivalent to afl-as.h: */
|
|
|
|
|
|
|
|
|
|
|
|
static unsigned char *afl_area_ptr;
|
|
|
|
static unsigned char *afl_area_ptr; // 定义指向AFL区域的指针
|
|
|
|
|
|
|
|
|
|
|
|
/* Exported variables populated by the code patched into elfload.c: */
|
|
|
|
/* Exported variables populated by the code patched into elfload.c: */
|
|
|
|
|
|
|
|
|
|
|
|
abi_ulong afl_entry_point, /* ELF entry point (_start) */
|
|
|
|
abi_ulong afl_entry_point, /* ELF entry point (_start) */ // ELF入口点
|
|
|
|
afl_start_code, /* .text start pointer */
|
|
|
|
afl_start_code, /* .text start pointer */ // .text段起始指针
|
|
|
|
afl_end_code; /* .text end pointer */
|
|
|
|
afl_end_code; /* .text end pointer */ // .text段结束指针
|
|
|
|
|
|
|
|
|
|
|
|
/* Set in the child process in forkserver mode: */
|
|
|
|
/* Set in the child process in forkserver mode: */
|
|
|
|
|
|
|
|
|
|
|
|
static unsigned char afl_fork_child;
|
|
|
|
static unsigned char afl_fork_child; // 用于标记是否在fork子进程中
|
|
|
|
unsigned int afl_forksrv_pid;
|
|
|
|
unsigned int afl_forksrv_pid; // fork服务器进程的PID
|
|
|
|
|
|
|
|
|
|
|
|
/* Instrumentation ratio: */
|
|
|
|
/* Instrumentation ratio: */
|
|
|
|
|
|
|
|
|
|
|
|
static unsigned int afl_inst_rms = MAP_SIZE;
|
|
|
|
static unsigned int afl_inst_rms = MAP_SIZE; // 插桩比例
|
|
|
|
|
|
|
|
|
|
|
|
/* Function declarations. */
|
|
|
|
/* Function declarations. */
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// 函数声明
|
|
|
|
static void afl_setup(void);
|
|
|
|
static void afl_setup(void);
|
|
|
|
static void afl_forkserver(CPUState*);
|
|
|
|
static void afl_forkserver(CPUState*);
|
|
|
|
static inline void afl_maybe_log(abi_ulong);
|
|
|
|
static inline void afl_maybe_log(abi_ulong);
|
|
|
|
@ -96,16 +98,16 @@ static void afl_request_tsl(target_ulong, target_ulong, uint64_t);
|
|
|
|
|
|
|
|
|
|
|
|
/* Data structure passed around by the translate handlers: */
|
|
|
|
/* Data structure passed around by the translate handlers: */
|
|
|
|
|
|
|
|
|
|
|
|
struct afl_tsl {
|
|
|
|
struct afl_tsl { // 传递给翻译处理程序的数据结构
|
|
|
|
target_ulong pc;
|
|
|
|
target_ulong pc; // 当前程序计数器
|
|
|
|
target_ulong cs_base;
|
|
|
|
target_ulong cs_base; // 段基址
|
|
|
|
uint64_t flags;
|
|
|
|
uint64_t flags; // 标志
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
/* Some forward decls: */
|
|
|
|
/* Some forward decls: */
|
|
|
|
|
|
|
|
|
|
|
|
TranslationBlock *tb_htable_lookup(CPUState*, target_ulong, target_ulong, uint32_t);
|
|
|
|
TranslationBlock *tb_htable_lookup(CPUState*, target_ulong, target_ulong, uint32_t); // 查找翻译块的函数
|
|
|
|
static inline TranslationBlock *tb_find(CPUState*, TranslationBlock*, int);
|
|
|
|
static inline TranslationBlock *tb_find(CPUState*, TranslationBlock*, int); // 查找翻译块的内联函数
|
|
|
|
|
|
|
|
|
|
|
|
/*************************
|
|
|
|
/*************************
|
|
|
|
* ACTUAL IMPLEMENTATION *
|
|
|
|
* ACTUAL IMPLEMENTATION *
|
|
|
|
@ -113,201 +115,194 @@ static inline TranslationBlock *tb_find(CPUState*, TranslationBlock*, int);
|
|
|
|
|
|
|
|
|
|
|
|
/* Set up SHM region and initialize other stuff. */
|
|
|
|
/* Set up SHM region and initialize other stuff. */
|
|
|
|
|
|
|
|
|
|
|
|
static void afl_setup(void) {
|
|
|
|
static void afl_setup(void) { // 设置共享内存区域并初始化其他内容
|
|
|
|
|
|
|
|
|
|
|
|
char *id_str = getenv(SHM_ENV_VAR),
|
|
|
|
char *id_str = getenv(SHM_ENV_VAR), // 获取共享内存环境变量
|
|
|
|
*inst_r = getenv("AFL_INST_RATIO");
|
|
|
|
*inst_r = getenv("AFL_INST_RATIO"); // 获取插桩比例环境变量
|
|
|
|
|
|
|
|
|
|
|
|
int shm_id;
|
|
|
|
int shm_id; // 共享内存标识符
|
|
|
|
|
|
|
|
|
|
|
|
if (inst_r) {
|
|
|
|
if (inst_r) { // 如果设置了插桩比例
|
|
|
|
|
|
|
|
|
|
|
|
unsigned int r;
|
|
|
|
unsigned int r; // 声明插桩比例变量
|
|
|
|
|
|
|
|
|
|
|
|
r = atoi(inst_r);
|
|
|
|
r = atoi(inst_r); // 将环境变量转为整数
|
|
|
|
|
|
|
|
|
|
|
|
if (r > 100) r = 100;
|
|
|
|
if (r > 100) r = 100; // 最大为100
|
|
|
|
if (!r) r = 1;
|
|
|
|
if (!r) r = 1; // 如果为0则设置为1
|
|
|
|
|
|
|
|
|
|
|
|
afl_inst_rms = MAP_SIZE * r / 100;
|
|
|
|
afl_inst_rms = MAP_SIZE * r / 100; // 计算实际插桩比例
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if (id_str) {
|
|
|
|
if (id_str) { // 如果设定了共享内存ID
|
|
|
|
|
|
|
|
|
|
|
|
shm_id = atoi(id_str);
|
|
|
|
|
|
|
|
afl_area_ptr = shmat(shm_id, NULL, 0);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (afl_area_ptr == (void*)-1) exit(1);
|
|
|
|
shm_id = atoi(id_str); // 将ID转为整数
|
|
|
|
|
|
|
|
afl_area_ptr = shmat(shm_id, NULL, 0); // 附加共享内存
|
|
|
|
|
|
|
|
|
|
|
|
/* With AFL_INST_RATIO set to a low value, we want to touch the bitmap
|
|
|
|
if (afl_area_ptr == (void*)-1) exit(1); // 失败则退出
|
|
|
|
so that the parent doesn't give up on us. */
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (inst_r) afl_area_ptr[0] = 1;
|
|
|
|
/* With AFL_INST_RATIO set to a low value, we want to touch the bitmap //
|
|
|
|
|
|
|
|
so that the parent doesn't give up on us. */ // 当插桩比例设置为较低值时，访问位图防止父进程放弃我们
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (inst_r) afl_area_ptr[0] = 1; // 访问位图的第一个字节
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if (getenv("AFL_INST_LIBS")) {
|
|
|
|
if (getenv("AFL_INST_LIBS")) { // 如果设置了AFL_INST_LIBS环境变量
|
|
|
|
|
|
|
|
afl_start_code = 0; // 设置代码段起始位置
|
|
|
|
afl_start_code = 0;
|
|
|
|
afl_end_code = (abi_ulong)-1; // 设置代码段结束位置
|
|
|
|
afl_end_code = (abi_ulong)-1;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* pthread_atfork() seems somewhat broken in util/rcu.c, and I'm
|
|
|
|
/* pthread_atfork() seems somewhat broken in util/rcu.c, and I'm //
|
|
|
|
not entirely sure what is the cause. This disables that
|
|
|
|
not entirely sure what is the cause. This disables that //
|
|
|
|
behaviour, and seems to work alright? */
|
|
|
|
behaviour, and seems to work alright? */ // pthread_atfork()在util/rcu.c中似乎存在问题，这禁用此行为，并且有效
|
|
|
|
|
|
|
|
|
|
|
|
rcu_disable_atfork();
|
|
|
|
rcu_disable_atfork(); // 禁用atfork功能
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* Fork server logic, invoked once we hit _start. */
|
|
|
|
/* Fork server logic, invoked once we hit _start. */
|
|
|
|
|
|
|
|
|
|
|
|
static void afl_forkserver(CPUState *cpu) {
|
|
|
|
static void afl_forkserver(CPUState *cpu) { // fork服务器逻辑，在_start时调用
|
|
|
|
|
|
|
|
|
|
|
|
static unsigned char tmp[4];
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (!afl_area_ptr) return;
|
|
|
|
static unsigned char tmp[4]; // 临时缓冲区
|
|
|
|
|
|
|
|
|
|
|
|
/* Tell the parent that we're alive. If the parent doesn't want
|
|
|
|
if (!afl_area_ptr) return; // 如果指针为空则返回
|
|
|
|
to talk, assume that we're not running in forkserver mode. */
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
|
|
|
|
/* Tell the parent that we're alive. If the parent doesn't want //
|
|
|
|
|
|
|
|
to talk, assume that we're not running in forkserver mode. */ // 告诉父进程我们已经活着，如果父进程不响应，则认为不在fork服务器模式
|
|
|
|
|
|
|
|
|
|
|
|
afl_forksrv_pid = getpid();
|
|
|
|
if (write(FORKSRV_FD + 1, tmp, 4) != 4) return; // 写入父进程
|
|
|
|
|
|
|
|
|
|
|
|
/* All right, let's await orders... */
|
|
|
|
afl_forksrv_pid = getpid(); // 获取当前进程ID
|
|
|
|
|
|
|
|
|
|
|
|
while (1) {
|
|
|
|
/* All right, let's await orders... */ // 好的，让我们等待命令…
|
|
|
|
|
|
|
|
|
|
|
|
pid_t child_pid;
|
|
|
|
while (1) { // 进入无限循环
|
|
|
|
int status, t_fd[2];
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* Whoops, parent dead? */
|
|
|
|
pid_t child_pid; // 子进程ID
|
|
|
|
|
|
|
|
int status, t_fd[2]; // 状态和文件描述符数组
|
|
|
|
|
|
|
|
|
|
|
|
if (read(FORKSRV_FD, tmp, 4) != 4) exit(2);
|
|
|
|
/* Whoops, parent dead? */ // 哎呀，父进程死了？
|
|
|
|
|
|
|
|
|
|
|
|
/* Establish a channel with child to grab translation commands. We'll
|
|
|
|
if (read(FORKSRV_FD, tmp, 4) != 4) exit(2); // 读取父进程信息失败则退出
|
|
|
|
read from t_fd[0], child will write to TSL_FD. */
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (pipe(t_fd) || dup2(t_fd[1], TSL_FD) < 0) exit(3);
|
|
|
|
/* Establish a channel with child to grab translation commands. We'll //
|
|
|
|
close(t_fd[1]);
|
|
|
|
read from t_fd[0], child will write to TSL_FD. */ // 建立与子进程的通道获取翻译命令。我们从t_fd[0]读取，子进程写入TSL_FD。
|
|
|
|
|
|
|
|
|
|
|
|
child_pid = fork();
|
|
|
|
if (pipe(t_fd) || dup2(t_fd[1], TSL_FD) < 0) exit(3); // 创建管道，复制描述符
|
|
|
|
if (child_pid < 0) exit(4);
|
|
|
|
close(t_fd[1]); // 关闭写入端
|
|
|
|
|
|
|
|
|
|
|
|
if (!child_pid) {
|
|
|
|
child_pid = fork(); // 创建子进程
|
|
|
|
|
|
|
|
if (child_pid < 0) exit(4); // 创建失败则退出
|
|
|
|
|
|
|
|
|
|
|
|
/* Child process. Close descriptors and run free. */
|
|
|
|
if (!child_pid) { // 如果是子进程
|
|
|
|
|
|
|
|
|
|
|
|
afl_fork_child = 1;
|
|
|
|
/* Child process. Close descriptors and run free. */ // 子进程。关闭描述符，进入自由运行。
|
|
|
|
close(FORKSRV_FD);
|
|
|
|
|
|
|
|
close(FORKSRV_FD + 1);
|
|
|
|
|
|
|
|
close(t_fd[0]);
|
|
|
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
afl_fork_child = 1; // 标记为子进程
|
|
|
|
|
|
|
|
close(FORKSRV_FD); // 关闭fork服务器文件描述符
|
|
|
|
|
|
|
|
close(FORKSRV_FD + 1); // 关闭fork服务器文件描述符的另一个副本
|
|
|
|
|
|
|
|
close(t_fd[0]); // 关闭读取端
|
|
|
|
|
|
|
|
return; // 返回
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* Parent. */
|
|
|
|
/* Parent. */ // 父进程。
|
|
|
|
|
|
|
|
|
|
|
|
close(TSL_FD);
|
|
|
|
close(TSL_FD); // 关闭TSL文件描述符
|
|
|
|
|
|
|
|
|
|
|
|
if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) exit(5);
|
|
|
|
if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) exit(5); // 向父进程写入子进程ID，失败则退出。
|
|
|
|
|
|
|
|
|
|
|
|
/* Collect translation requests until child dies and closes the pipe. */
|
|
|
|
/* Collect translation requests until child dies and closes the pipe. */ // 收集翻译请求，直到子进程结束并关闭管道。
|
|
|
|
|
|
|
|
|
|
|
|
afl_wait_tsl(cpu, t_fd[0]);
|
|
|
|
afl_wait_tsl(cpu, t_fd[0]); // 等待翻译请求
|
|
|
|
|
|
|
|
|
|
|
|
/* Get and relay exit status to parent. */
|
|
|
|
/* Get and relay exit status to parent. */ // 获取子进程退出状态并传递给父进程。
|
|
|
|
|
|
|
|
|
|
|
|
if (waitpid(child_pid, &status, 0) < 0) exit(6);
|
|
|
|
if (waitpid(child_pid, &status, 0) < 0) exit(6); // 等待子进程结束，失败则退出
|
|
|
|
if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(7);
|
|
|
|
if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(7); // 向父进程写入状态，失败则退出
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* The equivalent of the tuple logging routine from afl-as.h. */
|
|
|
|
/* The equivalent of the tuple logging routine from afl-as.h. */
|
|
|
|
|
|
|
|
|
|
|
|
static inline void afl_maybe_log(abi_ulong cur_loc) {
|
|
|
|
static inline void afl_maybe_log(abi_ulong cur_loc) { // 记录当前地址的内联函数
|
|
|
|
|
|
|
|
|
|
|
|
static __thread abi_ulong prev_loc;
|
|
|
|
static __thread abi_ulong prev_loc; // 上一个地址
|
|
|
|
|
|
|
|
|
|
|
|
/* Optimize for cur_loc > afl_end_code, which is the most likely case on
|
|
|
|
/* Optimize for cur_loc > afl_end_code, which is the most likely case on //
|
|
|
|
Linux systems. */
|
|
|
|
Linux systems. */ // 优化条件，常见于Linux系统
|
|
|
|
|
|
|
|
|
|
|
|
if (cur_loc > afl_end_code || cur_loc < afl_start_code || !afl_area_ptr)
|
|
|
|
if (cur_loc > afl_end_code || cur_loc < afl_start_code || !afl_area_ptr) // 如果当前地址不在有效范围
|
|
|
|
return;
|
|
|
|
return; // 返回
|
|
|
|
|
|
|
|
|
|
|
|
/* Looks like QEMU always maps to fixed locations, so ASAN is not a
|
|
|
|
/* Looks like QEMU always maps to fixed locations, so ASAN is not a //
|
|
|
|
concern. Phew. But instruction addresses may be aligned. Let's mangle
|
|
|
|
concern. Phew. But instruction addresses may be aligned. Let's mangle //
|
|
|
|
the value to get something quasi-uniform. */
|
|
|
|
the value to get something quasi-uniform. */ // QEMU似乎总是映射到固定位置，因此不需要担心ASAN。但指令地址可能会对齐。通过一些操作来获取统一值。
|
|
|
|
|
|
|
|
|
|
|
|
cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
|
|
|
|
cur_loc = (cur_loc >> 4) ^ (cur_loc << 8); // 按位操作获取新值
|
|
|
|
cur_loc &= MAP_SIZE - 1;
|
|
|
|
cur_loc &= MAP_SIZE - 1; // 避免越界
|
|
|
|
|
|
|
|
|
|
|
|
/* Implement probabilistic instrumentation by looking at scrambled block
|
|
|
|
/* Implement probabilistic instrumentation by looking at scrambled block //
|
|
|
|
address. This keeps the instrumented locations stable across runs. */
|
|
|
|
address. This keeps the instrumented locations stable across runs. */ // 通过查看混乱的块地址实现概率性插桩，这样可以在多次运行中保持插桩位置的稳定性。
|
|
|
|
|
|
|
|
|
|
|
|
if (cur_loc >= afl_inst_rms) return;
|
|
|
|
if (cur_loc >= afl_inst_rms) return; // 如果当前地址超过插桩比率，返回
|
|
|
|
|
|
|
|
|
|
|
|
afl_area_ptr[cur_loc ^ prev_loc]++;
|
|
|
|
afl_area_ptr[cur_loc ^ prev_loc]++; // 增加对应计数
|
|
|
|
prev_loc = cur_loc >> 1;
|
|
|
|
prev_loc = cur_loc >> 1; // 更新上一个位置
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* This code is invoked whenever QEMU decides that it doesn't have a //
|
|
|
|
|
|
|
|
translation of a particular block and needs to compute it. When this happens, //
|
|
|
|
|
|
|
|
we tell the parent to mirror the operation, so that the next fork() has a //
|
|
|
|
|
|
|
|
cached copy. */ // 每当QEMU决定没有特定块的翻译并需要计算时，会调用此代码。当发生这种情况时，我们告诉父进程镜像操作，以便下一个fork()具有缓存副本。
|
|
|
|
|
|
|
|
|
|
|
|
/* This code is invoked whenever QEMU decides that it doesn't have a
|
|
|
|
static void afl_request_tsl(target_ulong pc, target_ulong cb, uint64_t flags) { // 请求翻译
|
|
|
|
translation of a particular block and needs to compute it. When this happens,
|
|
|
|
|
|
|
|
we tell the parent to mirror the operation, so that the next fork() has a
|
|
|
|
|
|
|
|
cached copy. */
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static void afl_request_tsl(target_ulong pc, target_ulong cb, uint64_t flags) {
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
struct afl_tsl t;
|
|
|
|
struct afl_tsl t; // 创建AFI_TSL结构体
|
|
|
|
|
|
|
|
|
|
|
|
if (!afl_fork_child) return;
|
|
|
|
if (!afl_fork_child) return; // 如果不是子进程，返回
|
|
|
|
|
|
|
|
|
|
|
|
t.pc = pc;
|
|
|
|
t.pc = pc; // 设置程序计数器
|
|
|
|
t.cs_base = cb;
|
|
|
|
t.cs_base = cb; // 设置基址
|
|
|
|
t.flags = flags;
|
|
|
|
t.flags = flags; // 设置标志
|
|
|
|
|
|
|
|
|
|
|
|
if (write(TSL_FD, &t, sizeof(struct afl_tsl)) != sizeof(struct afl_tsl))
|
|
|
|
if (write(TSL_FD, &t, sizeof(struct afl_tsl)) != sizeof(struct afl_tsl)) // 写入数据请求
|
|
|
|
return;
|
|
|
|
return; // 返回
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* This is the other side of the same channel. Since timeouts are handled by
|
|
|
|
/* This is the other side of the same channel. Since timeouts are handled by //
|
|
|
|
afl-fuzz simply killing the child, we can just wait until the pipe breaks. */
|
|
|
|
afl-fuzz simply killing the child, we can just wait until the pipe breaks. */ // 这是同一通道的另一侧。由于超时通过afl-fuzz简单地终止子进程来处理，我们只需等待管道断开即可。
|
|
|
|
|
|
|
|
|
|
|
|
static void afl_wait_tsl(CPUState *cpu, int fd) {
|
|
|
|
static void afl_wait_tsl(CPUState *cpu, int fd) { // 等待翻译请求
|
|
|
|
|
|
|
|
|
|
|
|
struct afl_tsl t;
|
|
|
|
struct afl_tsl t; // 请求结构体
|
|
|
|
TranslationBlock *tb;
|
|
|
|
TranslationBlock *tb; // 翻译块
|
|
|
|
|
|
|
|
|
|
|
|
while (1) {
|
|
|
|
while (1) { // 无限循环
|
|
|
|
|
|
|
|
|
|
|
|
/* Broken pipe means it's time to return to the fork server routine. */
|
|
|
|
/* Broken pipe means it's time to return to the fork server routine. */ // 异常管道表示可以返回fork服务器例程
|
|
|
|
|
|
|
|
|
|
|
|
if (read(fd, &t, sizeof(struct afl_tsl)) != sizeof(struct afl_tsl))
|
|
|
|
if (read(fd, &t, sizeof(struct afl_tsl)) != sizeof(struct afl_tsl)) // 读取请求数据
|
|
|
|
break;
|
|
|
|
break; // 读取失败，退出循环
|
|
|
|
|
|
|
|
|
|
|
|
tb = tb_htable_lookup(cpu, t.pc, t.cs_base, t.flags);
|
|
|
|
tb = tb_htable_lookup(cpu, t.pc, t.cs_base, t.flags); // 查找翻译块
|
|
|
|
|
|
|
|
|
|
|
|
if(!tb) {
|
|
|
|
if(!tb) { // 如果没有找到翻译块
|
|
|
|
mmap_lock();
|
|
|
|
mmap_lock(); // 锁定内存映射
|
|
|
|
tb_lock();
|
|
|
|
tb_lock(); // 锁定翻译块
|
|
|
|
tb_gen_code(cpu, t.pc, t.cs_base, t.flags, 0);
|
|
|
|
tb_gen_code(cpu, t.pc, t.cs_base, t.flags, 0); // 生成新的翻译块
|
|
|
|
mmap_unlock();
|
|
|
|
mmap_unlock(); // 解锁内存映射
|
|
|
|
tb_unlock();
|
|
|
|
tb_unlock(); // 解锁翻译块
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
close(fd);
|
|
|
|
close(fd); // 关闭文件描述符
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
