|
|
|
|
@ -1,557 +1,519 @@
|
|
|
|
|
/*
|
|
|
|
|
Copyright 2013 Google LLC All rights reserved.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
|
you may not use this file except in compliance with the License.
|
|
|
|
|
You may obtain a copy of the License at:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
|
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
|
See the License for the specific language governing permissions and
|
|
|
|
|
limitations under the License.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
american fuzzy lop - wrapper for GNU as
|
|
|
|
|
---------------------------------------
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Written and maintained by Michal Zalewski <lcamtuf@google.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The sole purpose of this wrapper is to preprocess assembly files generated
|
|
|
|
|
by GCC / clang and inject the instrumentation bits included from afl-as.h. It
|
|
|
|
|
is automatically invoked by the toolchain when compiling programs using
|
|
|
|
|
afl-gcc / afl-clang.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Note that it's an explicit non-goal to instrument hand-written assembly,
|
|
|
|
|
be it in separate .s files or in __asm__ blocks. The only aspiration this
|
|
|
|
|
utility has right now is to be able to skip them gracefully and allow the
|
|
|
|
|
compilation process to continue.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
That said, see experimental/clang_asm_normalize/ for a solution that may
|
|
|
|
|
allow clang users to make things work even with hand-crafted assembly. Just
|
|
|
|
|
note that there is no equivalent for GCC.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#define AFL_MAIN
|
|
|
|
|
|
|
|
|
|
#include "config.h"
|
|
|
|
|
#include "types.h"
|
|
|
|
|
#include "debug.h"
|
|
|
|
|
#include "alloc-inl.h"
|
|
|
|
|
|
|
|
|
|
#include "afl-as.h"
|
|
|
|
|
|
|
|
|
|
#include <stdio.h>
|
|
|
|
|
#include <unistd.h>
|
|
|
|
|
#include <stdlib.h>
|
|
|
|
|
#include <string.h>
|
|
|
|
|
#include <time.h>
|
|
|
|
|
#include <ctype.h>
|
|
|
|
|
#include <fcntl.h>
|
|
|
|
|
|
|
|
|
|
#include <sys/wait.h>
|
|
|
|
|
#include <sys/time.h>
|
|
|
|
|
|
|
|
|
|
static u8** as_params; /* Parameters passed to the real 'as' */
|
|
|
|
|
|
|
|
|
|
static u8* input_file; /* Originally specified input file */
|
|
|
|
|
static u8* modified_file; /* Instrumented file for the real 'as' */
|
|
|
|
|
|
|
|
|
|
static u8 be_quiet, /* Quiet mode (no stderr output) */
|
|
|
|
|
clang_mode, /* Running in clang mode? */
|
|
|
|
|
pass_thru, /* Just pass data through? */
|
|
|
|
|
just_version, /* Just show version? */
|
|
|
|
|
sanitizer; /* Using ASAN / MSAN */
|
|
|
|
|
|
|
|
|
|
static u32 inst_ratio = 100, /* Instrumentation probability (%) */
|
|
|
|
|
as_par_cnt = 1; /* Number of params to 'as' */
|
|
|
|
|
|
|
|
|
|
/* If we don't find --32 or --64 in the command line, default to
|
|
|
|
|
instrumentation for whichever mode we were compiled with. This is not
|
|
|
|
|
perfect, but should do the trick for almost all use cases. */
|
|
|
|
|
|
|
|
|
|
#ifdef WORD_SIZE_64
|
|
|
|
|
|
|
|
|
|
static u8 use_64bit = 1;
|
|
|
|
|
|
|
|
|
|
#else
|
|
|
|
|
|
|
|
|
|
static u8 use_64bit = 0;
|
|
|
|
|
|
|
|
|
|
#ifdef __APPLE__
|
|
|
|
|
# error "Sorry, 32-bit Apple platforms are not supported."
|
|
|
|
|
|
|
|
|
|
#define AFL_MAIN // 定义主程序宏
|
|
|
|
|
|
|
|
|
|
#include "config.h" // 包含配置文件
|
|
|
|
|
#include "types.h" // 包含类型定义
|
|
|
|
|
#include "debug.h" // 包含调试工具
|
|
|
|
|
#include "alloc-inl.h" // 包含内存分配工具
|
|
|
|
|
|
|
|
|
|
#include "afl-as.h" // 包含AFL汇编插桩头文件
|
|
|
|
|
|
|
|
|
|
#include <stdio.h> // 标准输入输出
|
|
|
|
|
#include <unistd.h> // POSIX标准库
|
|
|
|
|
#include <stdlib.h> // 标准库
|
|
|
|
|
#include <string.h> // 字符串处理
|
|
|
|
|
#include <time.h> // 时间处理
|
|
|
|
|
#include <ctype.h> // 字符处理
|
|
|
|
|
#include <fcntl.h> // 文件控制
|
|
|
|
|
|
|
|
|
|
#include <sys/wait.h> // 进程等待
|
|
|
|
|
#include <sys/time.h> // 时间处理
|
|
|
|
|
|
|
|
|
|
static u8** as_params; // 传递给真实 'as' 的参数
|
|
|
|
|
|
|
|
|
|
static u8* input_file; // 原始输入文件
|
|
|
|
|
static u8* modified_file; // 插桩后的文件
|
|
|
|
|
|
|
|
|
|
static u8 be_quiet, // 静默模式（不输出错误信息）
|
|
|
|
|
clang_mode, // 是否在clang模式下运行
|
|
|
|
|
pass_thru, // 是否直接传递数据
|
|
|
|
|
just_version, // 是否只显示版本
|
|
|
|
|
sanitizer; // 是否使用ASAN / MSAN
|
|
|
|
|
|
|
|
|
|
static u32 inst_ratio = 100, // 插桩概率（%）
|
|
|
|
|
as_par_cnt = 1; // 传递给 'as' 的参数数量
|
|
|
|
|
|
|
|
|
|
// 如果命令行中没有找到 --32 或 --64 参数，则默认对编译该工具时使用的模式进行插桩。
|
|
|
|
|
// 这不是完美的，但对于大多数使用场景来说已经足够了。
|
|
|
|
|
|
|
|
|
|
#ifdef WORD_SIZE_64 // 如果是64位系统
|
|
|
|
|
|
|
|
|
|
static u8 use_64bit = 1; // 使用64位模式
|
|
|
|
|
|
|
|
|
|
#else // 否则
|
|
|
|
|
|
|
|
|
|
static u8 use_64bit = 0; // 使用32位模式
|
|
|
|
|
|
|
|
|
|
#ifdef __APPLE__ // 如果是苹果系统
|
|
|
|
|
# error "Sorry, 32-bit Apple platforms are not supported." // 不支持32位苹果平台
|
|
|
|
|
#endif /* __APPLE__ */
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#endif /* ^WORD_SIZE_64 */
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* Examine and modify parameters to pass to 'as'. Note that the file name
|
|
|
|
|
is always the last parameter passed by GCC, so we exploit this property
|
|
|
|
|
to keep the code simple. */
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// 检查并修改传递给 'as' 的参数。注意 GCC 总是将文件名作为最后一个参数传递给 'as'，
|
|
|
|
|
// 因此我们利用这一特性来简化代码。
|
|
|
|
|
|
|
|
|
|
static void edit_params(int argc, char** argv) {
|
|
|
|
|
|
|
|
|
|
u8 *tmp_dir = getenv("TMPDIR"), *afl_as = getenv("AFL_AS");
|
|
|
|
|
u32 i;
|
|
|
|
|
|
|
|
|
|
#ifdef __APPLE__
|
|
|
|
|
|
|
|
|
|
u8 use_clang_as = 0;
|
|
|
|
|
|
|
|
|
|
/* On MacOS X, the Xcode cctool 'as' driver is a bit stale and does not work
|
|
|
|
|
with the code generated by newer versions of clang that are hand-built
|
|
|
|
|
by the user. See the thread here: http://goo.gl/HBWDtn.
|
|
|
|
|
|
|
|
|
|
To work around this, when using clang and running without AFL_AS
|
|
|
|
|
specified, we will actually call 'clang -c' instead of 'as -q' to
|
|
|
|
|
compile the assembly file.
|
|
|
|
|
|
|
|
|
|
The tools aren't cmdline-compatible, but at least for now, we can
|
|
|
|
|
seemingly get away with this by making only very minor tweaks. Thanks
|
|
|
|
|
to Nico Weber for the idea. */
|
|
|
|
|
|
|
|
|
|
if (clang_mode && !afl_as) {
|
|
|
|
|
|
|
|
|
|
use_clang_as = 1;
|
|
|
|
|
|
|
|
|
|
afl_as = getenv("AFL_CC");
|
|
|
|
|
if (!afl_as) afl_as = getenv("AFL_CXX");
|
|
|
|
|
if (!afl_as) afl_as = "clang";
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
u8 *tmp_dir = getenv("TMPDIR"), *afl_as = getenv("AFL_AS"); // 获取临时目录和AFL_AS环境变量
|
|
|
|
|
u32 i; // 循环变量
|
|
|
|
|
|
|
|
|
|
#ifdef __APPLE__ // 如果是苹果系统
|
|
|
|
|
|
|
|
|
|
u8 use_clang_as = 0; // 是否使用clang作为汇编器
|
|
|
|
|
|
|
|
|
|
// 在 MacOS X 上，Xcode cctool 'as' 驱动程序有点过时，无法处理由用户自己编译的较新版本的 clang
|
|
|
|
|
// 生成的代码。详见此线程：http://goo.gl/HBWDtn.
|
|
|
|
|
|
|
|
|
|
// 为了绕过这一问题，当使用 clang 且未指定 AFL_AS 时，我们将实际调用 'clang -c' 而不是 'as -q'
|
|
|
|
|
// 来编译汇编文件.
|
|
|
|
|
|
|
|
|
|
// 虽然这两个工具不是命令行兼容的，但我们可以通过进行一些小的修改来让它们在某些情况下似乎可以很好地协同工作。
|
|
|
|
|
// 感谢 Nico Weber 提出这一思路。
|
|
|
|
|
|
|
|
|
|
if (clang_mode && !afl_as) { // 如果是clang模式且没有指定AFL_AS
|
|
|
|
|
|
|
|
|
|
use_clang_as = 1; // 使用clang作为汇编器
|
|
|
|
|
|
|
|
|
|
afl_as = getenv("AFL_CC"); // 获取AFL_CC环境变量
|
|
|
|
|
if (!afl_as) afl_as = getenv("AFL_CXX"); // 如果没有AFL_CC，则获取AFL_CXX
|
|
|
|
|
if (!afl_as) afl_as = "clang"; // 如果都没有，则默认使用clang
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#endif /* __APPLE__ */
|
|
|
|
|
|
|
|
|
|
/* Although this is not documented, GCC also uses TEMP and TMP when TMPDIR
|
|
|
|
|
is not set. We need to check these non-standard variables to properly
|
|
|
|
|
handle the pass_thru logic later on. */
|
|
|
|
|
|
|
|
|
|
if (!tmp_dir) tmp_dir = getenv("TEMP");
|
|
|
|
|
if (!tmp_dir) tmp_dir = getenv("TMP");
|
|
|
|
|
if (!tmp_dir) tmp_dir = "/tmp";
|
|
|
|
|
|
|
|
|
|
as_params = ck_alloc((argc + 32) * sizeof(u8*));
|
|
|
|
|
|
|
|
|
|
as_params[0] = afl_as ? afl_as : (u8*)"as";
|
|
|
|
|
|
|
|
|
|
as_params[argc] = 0;
|
|
|
|
|
|
|
|
|
|
for (i = 1; i < argc - 1; i++) {
|
|
|
|
|
|
|
|
|
|
if (!strcmp(argv[i], "--64")) use_64bit = 1;
|
|
|
|
|
else if (!strcmp(argv[i], "--32")) use_64bit = 0;
|
|
|
|
|
|
|
|
|
|
#ifdef __APPLE__
|
|
|
|
|
|
|
|
|
|
/* The Apple case is a bit different... */
|
|
|
|
|
|
|
|
|
|
if (!strcmp(argv[i], "-arch") && i + 1 < argc) {
|
|
|
|
|
|
|
|
|
|
if (!strcmp(argv[i + 1], "x86_64")) use_64bit = 1;
|
|
|
|
|
else if (!strcmp(argv[i + 1], "i386"))
|
|
|
|
|
FATAL("Sorry, 32-bit Apple platforms are not supported.");
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// 虽然这在文档中没有提及，但 GCC 实际上也使用 TEMP 和 TMP（当 TMPDIR 未设置时）。
|
|
|
|
|
// 我们需要检查这些非常规变量以正确处理 pass_thru 逻辑。
|
|
|
|
|
|
|
|
|
|
if (!tmp_dir) tmp_dir = getenv("TEMP"); // 如果没有TMPDIR，则获取TEMP
|
|
|
|
|
if (!tmp_dir) tmp_dir = getenv("TMP"); // 如果没有TEMP，则获取TMP
|
|
|
|
|
if (!tmp_dir) tmp_dir = "/tmp"; // 如果都没有，则默认使用/tmp
|
|
|
|
|
|
|
|
|
|
as_params = ck_alloc((argc + 32) * sizeof(u8*)); // 分配参数数组内存
|
|
|
|
|
|
|
|
|
|
as_params[0] = afl_as ? afl_as : (u8*)"as"; // 设置第一个参数为AFL_AS或默认的as
|
|
|
|
|
|
|
|
|
|
as_params[argc] = 0; // 设置最后一个参数为NULL
|
|
|
|
|
|
|
|
|
|
for (i = 1; i < argc - 1; i++) { // 遍历参数
|
|
|
|
|
|
|
|
|
|
if (!strcmp(argv[i], "--64")) use_64bit = 1; // 如果参数是--64，则使用64位模式
|
|
|
|
|
else if (!strcmp(argv[i], "--32")) use_64bit = 0; // 如果参数是--32，则使用32位模式
|
|
|
|
|
|
|
|
|
|
#ifdef __APPLE__ // 如果是苹果系统
|
|
|
|
|
|
|
|
|
|
// MacOS X 的情况有点不同...
|
|
|
|
|
|
|
|
|
|
if (!strcmp(argv[i], "-arch") && i + 1 < argc) { // 如果参数是-arch
|
|
|
|
|
|
|
|
|
|
if (!strcmp(argv[i + 1], "x86_64")) use_64bit = 1; // 如果架构是x86_64，则使用64位模式
|
|
|
|
|
else if (!strcmp(argv[i + 1], "i386")) // 如果架构是i386
|
|
|
|
|
FATAL("Sorry, 32-bit Apple platforms are not supported."); // 不支持32位苹果平台
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Strip options that set the preference for a particular upstream
|
|
|
|
|
assembler in Xcode. */
|
|
|
|
|
|
|
|
|
|
if (clang_mode && (!strcmp(argv[i], "-q") || !strcmp(argv[i], "-Q")))
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// 移除 Xcode 中设置特定上游汇编器的选项
|
|
|
|
|
|
|
|
|
|
if (clang_mode && (!strcmp(argv[i], "-q") || !strcmp(argv[i], "-Q"))) // 如果是clang模式且参数是-q或-Q
|
|
|
|
|
continue; // 跳过这些参数
|
|
|
|
|
|
|
|
|
|
#endif /* __APPLE__ */
|
|
|
|
|
|
|
|
|
|
as_params[as_par_cnt++] = argv[i];
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
as_params[as_par_cnt++] = argv[i]; // 将参数添加到as_params数组中
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#ifdef __APPLE__
|
|
|
|
|
|
|
|
|
|
/* When calling clang as the upstream assembler, append -c -x assembler
|
|
|
|
|
and hope for the best. */
|
|
|
|
|
|
|
|
|
|
if (use_clang_as) {
|
|
|
|
|
|
|
|
|
|
as_params[as_par_cnt++] = "-c";
|
|
|
|
|
as_params[as_par_cnt++] = "-x";
|
|
|
|
|
as_params[as_par_cnt++] = "assembler";
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#ifdef __APPLE__ // 如果是苹果系统
|
|
|
|
|
|
|
|
|
|
// 当调用 clang 作为上游汇编器时，追加 -c -x assembler 选项并希望一切顺利。
|
|
|
|
|
|
|
|
|
|
if (use_clang_as) { // 如果使用clang作为汇编器
|
|
|
|
|
|
|
|
|
|
as_params[as_par_cnt++] = "-c"; // 添加-c参数
|
|
|
|
|
as_params[as_par_cnt++] = "-x"; // 添加-x参数
|
|
|
|
|
as_params[as_par_cnt++] = "assembler"; // 添加assembler参数
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#endif /* __APPLE__ */
|
|
|
|
|
|
|
|
|
|
input_file = argv[argc - 1];
|
|
|
|
|
|
|
|
|
|
if (input_file[0] == '-') {
|
|
|
|
|
|
|
|
|
|
if (!strcmp(input_file + 1, "-version")) {
|
|
|
|
|
just_version = 1;
|
|
|
|
|
modified_file = input_file;
|
|
|
|
|
goto wrap_things_up;
|
|
|
|
|
|
|
|
|
|
input_file = argv[argc - 1]; // 获取输入文件
|
|
|
|
|
|
|
|
|
|
if (input_file[0] == '-') { // 如果输入文件是标准输入
|
|
|
|
|
|
|
|
|
|
if (!strcmp(input_file + 1, "-version")) { // 如果参数是-version
|
|
|
|
|
just_version = 1; // 设置只显示版本
|
|
|
|
|
modified_file = input_file; // 设置修改后的文件为输入文件
|
|
|
|
|
goto wrap_things_up; // 跳转到结束处理
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (input_file[1]) FATAL("Incorrect use (not called through afl-gcc?)");
|
|
|
|
|
else input_file = NULL;
|
|
|
|
|
|
|
|
|
|
} else {
|
|
|
|
|
|
|
|
|
|
/* Check if this looks like a standard invocation as a part of an attempt
|
|
|
|
|
to compile a program, rather than using gcc on an ad-hoc .s file in
|
|
|
|
|
a format we may not understand. This works around an issue compiling
|
|
|
|
|
NSS. */
|
|
|
|
|
|
|
|
|
|
if (strncmp(input_file, tmp_dir, strlen(tmp_dir)) &&
|
|
|
|
|
strncmp(input_file, "/var/tmp/", 9) &&
|
|
|
|
|
strncmp(input_file, "/tmp/", 5)) pass_thru = 1;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (input_file[1]) FATAL("Incorrect use (not called through afl-gcc?)"); // 如果输入文件不是标准输入
|
|
|
|
|
else input_file = NULL; // 否则设置为NULL
|
|
|
|
|
|
|
|
|
|
} else { // 如果输入文件不是标准输入
|
|
|
|
|
|
|
|
|
|
// 检查是否为标准调用，作为编译程序的一部分，而不是使用 gcc 对一个独立的 .s 文件进行编译。
|
|
|
|
|
// 这解决了在编译 NSS 时遇到的问题。
|
|
|
|
|
|
|
|
|
|
if (strncmp(input_file, tmp_dir, strlen(tmp_dir)) && // 如果输入文件不在临时目录
|
|
|
|
|
strncmp(input_file, "/var/tmp/", 9) && // 且不在/var/tmp/
|
|
|
|
|
strncmp(input_file, "/tmp/", 5)) pass_thru = 1; // 且不在/tmp/，则设置为pass_thru模式
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
modified_file = alloc_printf("%s/.afl-%u-%u.s", tmp_dir, getpid(),
|
|
|
|
|
|
|
|
|
|
modified_file = alloc_printf("%s/.afl-%u-%u.s", tmp_dir, getpid(), // 生成修改后的文件名
|
|
|
|
|
(u32)time(NULL));
|
|
|
|
|
|
|
|
|
|
wrap_things_up:
|
|
|
|
|
|
|
|
|
|
as_params[as_par_cnt++] = modified_file;
|
|
|
|
|
as_params[as_par_cnt] = NULL;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
wrap_things_up: // 结束处理
|
|
|
|
|
|
|
|
|
|
as_params[as_par_cnt++] = modified_file; // 将修改后的文件添加到参数数组
|
|
|
|
|
as_params[as_par_cnt] = NULL; // 设置最后一个参数为NULL
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* Process input file, generate modified_file. Insert instrumentation in all
|
|
|
|
|
the appropriate places. */
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// 处理输入文件并生成 modified_file。在所有适当的位置插入插桩代码。
|
|
|
|
|
|
|
|
|
|
static void add_instrumentation(void) {
|
|
|
|
|
|
|
|
|
|
static u8 line[MAX_LINE];
|
|
|
|
|
|
|
|
|
|
FILE* inf;
|
|
|
|
|
FILE* outf;
|
|
|
|
|
s32 outfd;
|
|
|
|
|
u32 ins_lines = 0;
|
|
|
|
|
|
|
|
|
|
u8 instr_ok = 0, skip_csect = 0, skip_next_label = 0,
|
|
|
|
|
|
|
|
|
|
static u8 line[MAX_LINE]; // 读取文件的缓冲区
|
|
|
|
|
|
|
|
|
|
FILE* inf; // 输入文件指针
|
|
|
|
|
FILE* outf; // 输出文件指针
|
|
|
|
|
s32 outfd; // 输出文件描述符
|
|
|
|
|
u32 ins_lines = 0; // 插桩的行数
|
|
|
|
|
|
|
|
|
|
u8 instr_ok = 0, skip_csect = 0, skip_next_label = 0, // 插桩状态标志
|
|
|
|
|
skip_intel = 0, skip_app = 0, instrument_next = 0;
|
|
|
|
|
|
|
|
|
|
#ifdef __APPLE__
|
|
|
|
|
|
|
|
|
|
u8* colon_pos;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#ifdef __APPLE__ // 如果是苹果系统
|
|
|
|
|
|
|
|
|
|
u8* colon_pos; // 冒号位置
|
|
|
|
|
|
|
|
|
|
#endif /* __APPLE__ */
|
|
|
|
|
|
|
|
|
|
if (input_file) {
|
|
|
|
|
|
|
|
|
|
inf = fopen(input_file, "r");
|
|
|
|
|
if (!inf) PFATAL("Unable to read '%s'", input_file);
|
|
|
|
|
|
|
|
|
|
} else inf = stdin;
|
|
|
|
|
|
|
|
|
|
outfd = open(modified_file, O_WRONLY | O_EXCL | O_CREAT, 0600);
|
|
|
|
|
|
|
|
|
|
if (outfd < 0) PFATAL("Unable to write to '%s'", modified_file);
|
|
|
|
|
|
|
|
|
|
outf = fdopen(outfd, "w");
|
|
|
|
|
|
|
|
|
|
if (!outf) PFATAL("fdopen() failed");
|
|
|
|
|
|
|
|
|
|
while (fgets(line, MAX_LINE, inf)) {
|
|
|
|
|
|
|
|
|
|
/* In some cases, we want to defer writing the instrumentation trampoline
|
|
|
|
|
until after all the labels, macros, comments, etc. If we're in this
|
|
|
|
|
mode, and if the line starts with a tab followed by a character, dump
|
|
|
|
|
the trampoline now. */
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (input_file) { // 如果有输入文件
|
|
|
|
|
|
|
|
|
|
inf = fopen(input_file, "r"); // 打开输入文件
|
|
|
|
|
if (!inf) PFATAL("Unable to read '%s'", input_file); // 如果打开失败则报错
|
|
|
|
|
|
|
|
|
|
} else inf = stdin; // 否则使用标准输入
|
|
|
|
|
|
|
|
|
|
outfd = open(modified_file, O_WRONLY | O_EXCL | O_CREAT, 0600); // 打开输出文件
|
|
|
|
|
|
|
|
|
|
if (outfd < 0) PFATAL("Unable to write to '%s'", modified_file); // 如果打开失败则报错
|
|
|
|
|
|
|
|
|
|
outf = fdopen(outfd, "w"); // 将文件描述符转换为文件指针
|
|
|
|
|
|
|
|
|
|
if (!outf) PFATAL("fdopen() failed"); // 如果转换失败则报错
|
|
|
|
|
|
|
|
|
|
while (fgets(line, MAX_LINE, inf)) { // 逐行读取输入文件
|
|
|
|
|
|
|
|
|
|
// 在某些情况下，我们希望在所有标签、宏、注释等之后再插入插桩跳板代码。
|
|
|
|
|
// 如果处于这一模式，且行以制表符开头，后跟一个字母，则现在插入跳板代码。
|
|
|
|
|
|
|
|
|
|
if (!pass_thru && !skip_intel && !skip_app && !skip_csect && instr_ok &&
|
|
|
|
|
instrument_next && line[0] == '\t' && isalpha(line[1])) {
|
|
|
|
|
|
|
|
|
|
fprintf(outf, use_64bit ? trampoline_fmt_64 : trampoline_fmt_32,
|
|
|
|
|
instrument_next && line[0] == '\t' && isalpha(line[1])) { // 如果满足插桩条件
|
|
|
|
|
|
|
|
|
|
fprintf(outf, use_64bit ? trampoline_fmt_64 : trampoline_fmt_32, // 插入跳板代码
|
|
|
|
|
R(MAP_SIZE));
|
|
|
|
|
|
|
|
|
|
instrument_next = 0;
|
|
|
|
|
ins_lines++;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
instrument_next = 0; // 重置插桩标志
|
|
|
|
|
ins_lines++; // 增加插桩行数
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Output the actual line, call it a day in pass-thru mode. */
|
|
|
|
|
|
|
|
|
|
fputs(line, outf);
|
|
|
|
|
|
|
|
|
|
if (pass_thru) continue;
|
|
|
|
|
|
|
|
|
|
/* All right, this is where the actual fun begins. For one, we only want to
|
|
|
|
|
instrument the .text section. So, let's keep track of that in processed
|
|
|
|
|
files - and let's set instr_ok accordingly. */
|
|
|
|
|
|
|
|
|
|
if (line[0] == '\t' && line[1] == '.') {
|
|
|
|
|
|
|
|
|
|
/* OpenBSD puts jump tables directly inline with the code, which is
|
|
|
|
|
a bit annoying. They use a specific format of p2align directives
|
|
|
|
|
around them, so we use that as a signal. */
|
|
|
|
|
|
|
|
|
|
if (!clang_mode && instr_ok && !strncmp(line + 2, "p2align ", 8) &&
|
|
|
|
|
isdigit(line[10]) && line[11] == '\n') skip_next_label = 1;
|
|
|
|
|
|
|
|
|
|
if (!strncmp(line + 2, "text\n", 5) ||
|
|
|
|
|
!strncmp(line + 2, "section\t.text", 13) ||
|
|
|
|
|
!strncmp(line + 2, "section\t__TEXT,__text", 21) ||
|
|
|
|
|
!strncmp(line + 2, "section __TEXT,__text", 21)) {
|
|
|
|
|
instr_ok = 1;
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
// 输出实际的行，在 pass-thru 模式下结束操作。
|
|
|
|
|
|
|
|
|
|
fputs(line, outf); // 输出当前行
|
|
|
|
|
|
|
|
|
|
if (pass_thru) continue; // 如果是pass-thru模式则跳过
|
|
|
|
|
|
|
|
|
|
// 现在开始真正的插桩操作。首先，我们只希望插桩 .text 部分。
|
|
|
|
|
// 因此，我们需要跟踪处理的汇编文件中各部分的状态，并据此设置 instr_ok。
|
|
|
|
|
|
|
|
|
|
if (line[0] == '\t' && line[1] == '.') { // 如果行以制表符和点开头
|
|
|
|
|
|
|
|
|
|
// OpenBSD 在代码中直接放置跳转表，这稍微有点麻烦。
|
|
|
|
|
// 它们使用特定格式的 p2align 指令围绕它们，因此我们可以使用该格式作为信号。
|
|
|
|
|
|
|
|
|
|
if (!clang_mode && instr_ok && !strncmp(line + 2, "p2align ", 8) && // 如果是OpenBSD的p2align指令
|
|
|
|
|
isdigit(line[10]) && line[11] == '\n') skip_next_label = 1; // 设置跳过下一个标签
|
|
|
|
|
|
|
|
|
|
if (!strncmp(line + 2, "text\n", 5) || // 如果是.text部分
|
|
|
|
|
!strncmp(line + 2, "section\t.text", 13) || // 或者section .text
|
|
|
|
|
!strncmp(line + 2, "section\t__TEXT,__text", 21) || // 或者section __TEXT,__text
|
|
|
|
|
!strncmp(line + 2, "section __TEXT,__text", 21)) { // 或者section __TEXT,__text
|
|
|
|
|
instr_ok = 1; // 设置插桩标志
|
|
|
|
|
continue; // 继续
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!strncmp(line + 2, "section\t", 8) ||
|
|
|
|
|
!strncmp(line + 2, "section ", 8) ||
|
|
|
|
|
!strncmp(line + 2, "bss\n", 4) ||
|
|
|
|
|
!strncmp(line + 2, "data\n", 5)) {
|
|
|
|
|
instr_ok = 0;
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
if (!strncmp(line + 2, "section\t", 8) || // 如果是其他section
|
|
|
|
|
!strncmp(line + 2, "section ", 8) || // 或者其他section
|
|
|
|
|
!strncmp(line + 2, "bss\n", 4) || // 或者.bss部分
|
|
|
|
|
!strncmp(line + 2, "data\n", 5)) { // 或者.data部分
|
|
|
|
|
instr_ok = 0; // 重置插桩标志
|
|
|
|
|
continue; // 继续
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Detect off-flavor assembly (rare, happens in gdb). When this is
|
|
|
|
|
encountered, we set skip_csect until the opposite directive is
|
|
|
|
|
seen, and we do not instrument. */
|
|
|
|
|
|
|
|
|
|
if (strstr(line, ".code")) {
|
|
|
|
|
|
|
|
|
|
if (strstr(line, ".code32")) skip_csect = use_64bit;
|
|
|
|
|
if (strstr(line, ".code64")) skip_csect = !use_64bit;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// 检测非常规汇编（罕见，例如在 gdb 中）。当遇到这种汇编时，我们设置 skip_csect
|
|
|
|
|
// 直到遇到相反的指令，此时我们不进行插桩。
|
|
|
|
|
|
|
|
|
|
if (strstr(line, ".code")) { // 如果行包含.code
|
|
|
|
|
|
|
|
|
|
if (strstr(line, ".code32")) skip_csect = use_64bit; // 如果是.code32，则根据64位模式设置skip_csect
|
|
|
|
|
if (strstr(line, ".code64")) skip_csect = !use_64bit; // 如果是.code64，则根据64位模式设置skip_csect
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Detect syntax changes, as could happen with hand-written assembly.
|
|
|
|
|
Skip Intel blocks, resume instrumentation when back to AT&T. */
|
|
|
|
|
|
|
|
|
|
if (strstr(line, ".intel_syntax")) skip_intel = 1;
|
|
|
|
|
if (strstr(line, ".att_syntax")) skip_intel = 0;
|
|
|
|
|
|
|
|
|
|
/* Detect and skip ad-hoc __asm__ blocks, likewise skipping them. */
|
|
|
|
|
|
|
|
|
|
if (line[0] == '#' || line[1] == '#') {
|
|
|
|
|
|
|
|
|
|
if (strstr(line, "#APP")) skip_app = 1;
|
|
|
|
|
if (strstr(line, "#NO_APP")) skip_app = 0;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// 检测并跳过手写汇编块（__asm__），同样不进行插桩。
|
|
|
|
|
|
|
|
|
|
if (line[0] == '#' || line[1] == '#') { // 如果行以#开头
|
|
|
|
|
|
|
|
|
|
if (strstr(line, "#APP")) skip_app = 1; // 如果包含#APP，则设置skip_app
|
|
|
|
|
if (strstr(line, "#NO_APP")) skip_app = 0; // 如果包含#NO_APP，则重置skip_app
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* If we're in the right mood for instrumenting, check for function
|
|
|
|
|
names or conditional labels. This is a bit messy, but in essence,
|
|
|
|
|
we want to catch:
|
|
|
|
|
|
|
|
|
|
^main: - function entry point (always instrumented)
|
|
|
|
|
^.L0: - GCC branch label
|
|
|
|
|
^.LBB0_0: - clang branch label (but only in clang mode)
|
|
|
|
|
^\tjnz foo - conditional branches
|
|
|
|
|
|
|
|
|
|
...but not:
|
|
|
|
|
|
|
|
|
|
^# BB#0: - clang comments
|
|
|
|
|
^ # BB#0: - ditto
|
|
|
|
|
^.Ltmp0: - clang non-branch labels
|
|
|
|
|
^.LC0 - GCC non-branch labels
|
|
|
|
|
^.LBB0_0: - ditto (when in GCC mode)
|
|
|
|
|
^\tjmp foo - non-conditional jumps
|
|
|
|
|
|
|
|
|
|
Additionally, clang and GCC on MacOS X follow a different convention
|
|
|
|
|
with no leading dots on labels, hence the weird maze of #ifdefs
|
|
|
|
|
later on.
|
|
|
|
|
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
if (skip_intel || skip_app || skip_csect || !instr_ok ||
|
|
|
|
|
line[0] == '#' || line[0] == ' ') continue;
|
|
|
|
|
|
|
|
|
|
/* Conditional branch instruction (jnz, etc). We append the instrumentation
|
|
|
|
|
right after the branch (to instrument the not-taken path) and at the
|
|
|
|
|
branch destination label (handled later on). */
|
|
|
|
|
|
|
|
|
|
if (line[0] == '\t') {
|
|
|
|
|
|
|
|
|
|
if (line[1] == 'j' && line[2] != 'm' && R(100) < inst_ratio) {
|
|
|
|
|
|
|
|
|
|
fprintf(outf, use_64bit ? trampoline_fmt_64 : trampoline_fmt_32,
|
|
|
|
|
|
|
|
|
|
// 如果我们处于插桩模式，检查函数名或条件标签。这里逻辑有些复杂，但基本目标是捕获：
|
|
|
|
|
|
|
|
|
|
// ^main: - 函数入口点（总是插桩）
|
|
|
|
|
// ^.L0: - GCC 分支标签
|
|
|
|
|
// ^.LBB0_0: - clang 分支标签（但仅在 clang 模式下）
|
|
|
|
|
// ^\tjnz foo - 条件分支
|
|
|
|
|
|
|
|
|
|
// ...而不捕获：
|
|
|
|
|
|
|
|
|
|
// ^# BB#0: - clang 注释
|
|
|
|
|
// ^ # BB#0: - 同上
|
|
|
|
|
// ^.Ltmp0: - clang 非分支标签
|
|
|
|
|
// ^.LC0 - GCC 非分支标签
|
|
|
|
|
// ^.LBB0_0: - 同上（当处于 GCC 模式下）
|
|
|
|
|
// ^\tjmp foo - 非条件跳转
|
|
|
|
|
|
|
|
|
|
// 此外，MacOS X 上的 clang 和 GCC 使用不同的标签格式，没有前导点，因此我们根据这一情况处理。
|
|
|
|
|
|
|
|
|
|
if (skip_intel || skip_app || skip_csect || !instr_ok || // 如果跳过插桩
|
|
|
|
|
line[0] == '#' || line[0] == ' ') continue; // 或者行以#或空格开头，则跳过
|
|
|
|
|
|
|
|
|
|
// 条件分支指令（jnz 等）。我们会在分支之后插入插桩（以插桩不执行路径），
|
|
|
|
|
// 并在分支目标标签处插入（稍后处理）。
|
|
|
|
|
|
|
|
|
|
if (line[0] == '\t') { // 如果行以制表符开头
|
|
|
|
|
|
|
|
|
|
if (line[1] == 'j' && line[2] != 'm' && R(100) < inst_ratio) { // 如果是条件分支指令
|
|
|
|
|
|
|
|
|
|
fprintf(outf, use_64bit ? trampoline_fmt_64 : trampoline_fmt_32, // 插入跳板代码
|
|
|
|
|
R(MAP_SIZE));
|
|
|
|
|
|
|
|
|
|
ins_lines++;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ins_lines++; // 增加插桩行数
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
continue; // 继续
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Label of some sort. This may be a branch destination, but we need to
|
|
|
|
|
tread carefully and account for several different formatting
|
|
|
|
|
conventions. */
|
|
|
|
|
|
|
|
|
|
#ifdef __APPLE__
|
|
|
|
|
|
|
|
|
|
/* Apple: L<whatever><digit>: */
|
|
|
|
|
|
|
|
|
|
if ((colon_pos = strstr(line, ":"))) {
|
|
|
|
|
|
|
|
|
|
if (line[0] == 'L' && isdigit(*(colon_pos - 1))) {
|
|
|
|
|
|
|
|
|
|
#else
|
|
|
|
|
|
|
|
|
|
/* Everybody else: .L<whatever>: */
|
|
|
|
|
|
|
|
|
|
if (strstr(line, ":")) {
|
|
|
|
|
|
|
|
|
|
if (line[0] == '.') {
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// 某类标签。这可能是分支目标，但我们需要小心处理不同的格式约定。
|
|
|
|
|
|
|
|
|
|
#ifdef __APPLE__ // 如果是苹果系统
|
|
|
|
|
|
|
|
|
|
// MacOS X: L<whatever><digit>:
|
|
|
|
|
|
|
|
|
|
if ((colon_pos = strstr(line, ":"))) { // 如果行包含冒号
|
|
|
|
|
|
|
|
|
|
if (line[0] == 'L' && isdigit(*(colon_pos - 1))) { // 如果标签以L开头且冒号前是数字
|
|
|
|
|
|
|
|
|
|
#else // 否则
|
|
|
|
|
|
|
|
|
|
// 其他人：.L<whatever>:
|
|
|
|
|
|
|
|
|
|
if (strstr(line, ":")) { // 如果行包含冒号
|
|
|
|
|
|
|
|
|
|
if (line[0] == '.') { // 如果标签以点开头
|
|
|
|
|
|
|
|
|
|
#endif /* __APPLE__ */
|
|
|
|
|
|
|
|
|
|
/* .L0: or LBB0_0: style jump destination */
|
|
|
|
|
|
|
|
|
|
#ifdef __APPLE__
|
|
|
|
|
|
|
|
|
|
/* Apple: L<num> / LBB<num> */
|
|
|
|
|
|
|
|
|
|
if ((isdigit(line[1]) || (clang_mode && !strncmp(line, "LBB", 3)))
|
|
|
|
|
&& R(100) < inst_ratio) {
|
|
|
|
|
|
|
|
|
|
#else
|
|
|
|
|
|
|
|
|
|
/* Apple: .L<num> / .LBB<num> */
|
|
|
|
|
|
|
|
|
|
if ((isdigit(line[2]) || (clang_mode && !strncmp(line + 1, "LBB", 3)))
|
|
|
|
|
&& R(100) < inst_ratio) {
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// .L0: 或 LBB0_0: 风格的分支目标
|
|
|
|
|
|
|
|
|
|
#ifdef __APPLE__ // 如果是苹果系统
|
|
|
|
|
|
|
|
|
|
// MacOS X: L<num> / LBB<num>
|
|
|
|
|
|
|
|
|
|
if ((isdigit(line[1]) || (clang_mode && !strncmp(line, "LBB", 3))) // 如果标签是L<num>或LBB<num>
|
|
|
|
|
&& R(100) < inst_ratio) { // 并且随机数小于插桩概率
|
|
|
|
|
|
|
|
|
|
#else // 否则
|
|
|
|
|
|
|
|
|
|
// MacOS X: .L<num> / .LBB<num>
|
|
|
|
|
|
|
|
|
|
if ((isdigit(line[2]) || (clang_mode && !strncmp(line + 1, "LBB", 3))) // 如果标签是.L<num>或.LBB<num>
|
|
|
|
|
&& R(100) < inst_ratio) { // 并且随机数小于插桩概率
|
|
|
|
|
|
|
|
|
|
#endif /* __APPLE__ */
|
|
|
|
|
|
|
|
|
|
/* An optimization is possible here by adding the code only if the
|
|
|
|
|
label is mentioned in the code in contexts other than call / jmp.
|
|
|
|
|
That said, this complicates the code by requiring two-pass
|
|
|
|
|
processing (messy with stdin), and results in a speed gain
|
|
|
|
|
typically under 10%, because compilers are generally pretty good
|
|
|
|
|
about not generating spurious intra-function jumps.
|
|
|
|
|
|
|
|
|
|
We use deferred output chiefly to avoid disrupting
|
|
|
|
|
.Lfunc_begin0-style exception handling calculations (a problem on
|
|
|
|
|
MacOS X). */
|
|
|
|
|
|
|
|
|
|
if (!skip_next_label) instrument_next = 1; else skip_next_label = 0;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// 在仅需要在标签被引用时（非调用/跳转上下文）才添加代码的情况下可以进行优化。
|
|
|
|
|
// 这会引入两遍处理过程的复杂性（当使用 stdin 时尤其麻烦），并且通常只能带来不到 10% 的速度提升。
|
|
|
|
|
// 因为编译器通常不会生成不相关的函数内跳转。
|
|
|
|
|
|
|
|
|
|
// 我们使用延迟输出主要是为了避免干扰 MacOS X 上 .Lfunc_begin0 风格异常处理计算的问题。
|
|
|
|
|
|
|
|
|
|
if (!skip_next_label) instrument_next = 1; else skip_next_label = 0; // 设置插桩标志
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
} else {
|
|
|
|
|
|
|
|
|
|
/* Function label (always instrumented, deferred mode). */
|
|
|
|
|
|
|
|
|
|
instrument_next = 1;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
} else { // 否则
|
|
|
|
|
|
|
|
|
|
// 函数标签（总是插桩，延迟模式）。
|
|
|
|
|
|
|
|
|
|
instrument_next = 1; // 设置插桩标志
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (ins_lines)
|
|
|
|
|
fputs(use_64bit ? main_payload_64 : main_payload_32, outf);
|
|
|
|
|
|
|
|
|
|
if (input_file) fclose(inf);
|
|
|
|
|
fclose(outf);
|
|
|
|
|
|
|
|
|
|
if (!be_quiet) {
|
|
|
|
|
|
|
|
|
|
if (!ins_lines) WARNF("No instrumentation targets found%s.",
|
|
|
|
|
|
|
|
|
|
if (ins_lines) // 如果有插桩行
|
|
|
|
|
fputs(use_64bit ? main_payload_64 : main_payload_32, outf); // 插入主插桩代码
|
|
|
|
|
|
|
|
|
|
if (input_file) fclose(inf); // 关闭输入文件
|
|
|
|
|
fclose(outf); // 关闭输出文件
|
|
|
|
|
|
|
|
|
|
if (!be_quiet) { // 如果不是静默模式
|
|
|
|
|
|
|
|
|
|
if (!ins_lines) WARNF("No instrumentation targets found%s.", // 如果没有插桩目标
|
|
|
|
|
pass_thru ? " (pass-thru mode)" : "");
|
|
|
|
|
else OKF("Instrumented %u locations (%s-bit, %s mode, ratio %u%%).",
|
|
|
|
|
else OKF("Instrumented %u locations (%s-bit, %s mode, ratio %u%%).", // 输出插桩信息
|
|
|
|
|
ins_lines, use_64bit ? "64" : "32",
|
|
|
|
|
getenv("AFL_HARDEN") ? "hardened" :
|
|
|
|
|
(sanitizer ? "ASAN/MSAN" : "non-hardened"),
|
|
|
|
|
inst_ratio);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* Main entry point */
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// 程序主入口点
|
|
|
|
|
|
|
|
|
|
int main(int argc, char** argv) {
|
|
|
|
|
|
|
|
|
|
s32 pid;
|
|
|
|
|
u32 rand_seed;
|
|
|
|
|
int status;
|
|
|
|
|
u8* inst_ratio_str = getenv("AFL_INST_RATIO");
|
|
|
|
|
|
|
|
|
|
struct timeval tv;
|
|
|
|
|
struct timezone tz;
|
|
|
|
|
|
|
|
|
|
clang_mode = !!getenv(CLANG_ENV_VAR);
|
|
|
|
|
|
|
|
|
|
if (isatty(2) && !getenv("AFL_QUIET")) {
|
|
|
|
|
|
|
|
|
|
SAYF(cCYA "afl-as " cBRI VERSION cRST " by <lcamtuf@google.com>\n");
|
|
|
|
|
|
|
|
|
|
} else be_quiet = 1;
|
|
|
|
|
|
|
|
|
|
if (argc < 2) {
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
s32 pid; // 进程ID
|
|
|
|
|
u32 rand_seed; // 随机种子
|
|
|
|
|
int status; // 进程状态
|
|
|
|
|
u8* inst_ratio_str = getenv("AFL_INST_RATIO"); // 获取插桩概率环境变量
|
|
|
|
|
|
|
|
|
|
struct timeval tv; // 时间结构
|
|
|
|
|
struct timezone tz; // 时区结构
|
|
|
|
|
|
|
|
|
|
clang_mode = !!getenv(CLANG_ENV_VAR); // 设置clang模式
|
|
|
|
|
|
|
|
|
|
if (isatty(2) && !getenv("AFL_QUIET")) { // 如果是终端且没有设置AFL_QUIET
|
|
|
|
|
|
|
|
|
|
SAYF(cCYA "afl-as " cBRI VERSION cRST " by <lcamtuf@google.com>\n"); // 输出版本信息
|
|
|
|
|
|
|
|
|
|
} else be_quiet = 1; // 否则设置为静默模式
|
|
|
|
|
|
|
|
|
|
if (argc < 2) { // 如果参数少于2个
|
|
|
|
|
|
|
|
|
|
SAYF("\n"
|
|
|
|
|
"This is a helper application for afl-fuzz. It is a wrapper around GNU 'as',\n"
|
|
|
|
|
"executed by the toolchain whenever using afl-gcc or afl-clang. You probably\n"
|
|
|
|
|
"don't want to run this program directly.\n\n"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
"Rarely, when dealing with extremely complex projects, it may be advisable to\n"
|
|
|
|
|
"set AFL_INST_RATIO to a value less than 100 in order to reduce the odds of\n"
|
|
|
|
|
"instrumenting every discovered branch.\n\n");
|
|
|
|
|
|
|
|
|
|
exit(1);
|
|
|
|
|
|
|
|
|
|
"instrumenting every discovered branch.\n\n"); // 输出帮助信息
|
|
|
|
|
|
|
|
|
|
exit(1); // 退出
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
gettimeofday(&tv, &tz);
|
|
|
|
|
|
|
|
|
|
rand_seed = tv.tv_sec ^ tv.tv_usec ^ getpid();
|
|
|
|
|
|
|
|
|
|
srandom(rand_seed);
|
|
|
|
|
|
|
|
|
|
edit_params(argc, argv);
|
|
|
|
|
|
|
|
|
|
if (inst_ratio_str) {
|
|
|
|
|
|
|
|
|
|
if (sscanf(inst_ratio_str, "%u", &inst_ratio) != 1 || inst_ratio > 100)
|
|
|
|
|
FATAL("Bad value of AFL_INST_RATIO (must be between 0 and 100)");
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
gettimeofday(&tv, &tz); // 获取当前时间
|
|
|
|
|
|
|
|
|
|
rand_seed = tv.tv_sec ^ tv.tv_usec ^ getpid(); // 生成随机种子
|
|
|
|
|
|
|
|
|
|
srandom(rand_seed); // 设置随机种子
|
|
|
|
|
|
|
|
|
|
edit_params(argc, argv); // 编辑参数
|
|
|
|
|
|
|
|
|
|
if (inst_ratio_str) { // 如果有插桩概率环境变量
|
|
|
|
|
|
|
|
|
|
if (sscanf(inst_ratio_str, "%u", &inst_ratio) != 1 || inst_ratio > 100) // 如果解析失败或大于100
|
|
|
|
|
FATAL("Bad value of AFL_INST_RATIO (must be between 0 and 100)"); // 报错
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (getenv(AS_LOOP_ENV_VAR))
|
|
|
|
|
FATAL("Endless loop when calling 'as' (remove '.' from your PATH)");
|
|
|
|
|
|
|
|
|
|
setenv(AS_LOOP_ENV_VAR, "1", 1);
|
|
|
|
|
|
|
|
|
|
/* When compiling with ASAN, we don't have a particularly elegant way to skip
|
|
|
|
|
ASAN-specific branches. But we can probabilistically compensate for
|
|
|
|
|
that... */
|
|
|
|
|
|
|
|
|
|
if (getenv("AFL_USE_ASAN") || getenv("AFL_USE_MSAN")) {
|
|
|
|
|
sanitizer = 1;
|
|
|
|
|
inst_ratio /= 3;
|
|
|
|
|
|
|
|
|
|
if (getenv(AS_LOOP_ENV_VAR)) // 如果设置了AS_LOOP_ENV_VAR
|
|
|
|
|
FATAL("Endless loop when calling 'as' (remove '.' from your PATH)"); // 报错
|
|
|
|
|
|
|
|
|
|
setenv(AS_LOOP_ENV_VAR, "1", 1); // 设置AS_LOOP_ENV_VAR
|
|
|
|
|
|
|
|
|
|
// 使用 ASAN 时，我们没有特别优雅的方法来跳过 ASAN 特定的分支。
|
|
|
|
|
// 但可以通过按概率补偿来解决这个问题...
|
|
|
|
|
|
|
|
|
|
if (getenv("AFL_USE_ASAN") || getenv("AFL_USE_MSAN")) { // 如果使用ASAN或MSAN
|
|
|
|
|
sanitizer = 1; // 设置sanitizer标志
|
|
|
|
|
inst_ratio /= 3; // 降低插桩概率
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!just_version) add_instrumentation();
|
|
|
|
|
|
|
|
|
|
if (!(pid = fork())) {
|
|
|
|
|
|
|
|
|
|
execvp(as_params[0], (char**)as_params);
|
|
|
|
|
FATAL("Oops, failed to execute '%s' - check your PATH", as_params[0]);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (!just_version) add_instrumentation(); // 如果不是只显示版本，则进行插桩
|
|
|
|
|
|
|
|
|
|
if (!(pid = fork())) { // 创建子进程
|
|
|
|
|
|
|
|
|
|
execvp(as_params[0], (char**)as_params); // 执行as命令
|
|
|
|
|
FATAL("Oops, failed to execute '%s' - check your PATH", as_params[0]); // 如果执行失败则报错
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (pid < 0) PFATAL("fork() failed");
|
|
|
|
|
|
|
|
|
|
if (waitpid(pid, &status, 0) <= 0) PFATAL("waitpid() failed");
|
|
|
|
|
|
|
|
|
|
if (!getenv("AFL_KEEP_ASSEMBLY")) unlink(modified_file);
|
|
|
|
|
|
|
|
|
|
exit(WEXITSTATUS(status));
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (pid < 0) PFATAL("fork() failed"); // 如果fork失败则报错
|
|
|
|
|
|
|
|
|
|
if (waitpid(pid, &status, 0) <= 0) PFATAL("waitpid() failed"); // 等待子进程结束
|
|
|
|
|
|
|
|
|
|
if (!getenv("AFL_KEEP_ASSEMBLY")) unlink(modified_file); // 如果没有设置AFL_KEEP_ASSEMBLY，则删除修改后的文件
|
|
|
|
|
|
|
|
|
|
exit(WEXITSTATUS(status)); // 退出
|
|
|
|
|
|
|
|
|
|
}
|
