phq7r92sf
/
google_AFL
1
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity

添加了afl-gcc.c注释以及afl-fuzz.c部分注释

Browse Source 
添加了afl-gcc.c注释以及afl-fuzz.c部分注释
pull/5/head
pjzuvftbk 9 months ago
parent bd3bc5d1aa 3d48adf43c
commit ce6d9c1ce5
3 changed files with 206 additions and 137 deletions
Show Stats Download Patch File Download Diff File

9
src/.vscode/settings.json vendored
Unescape View File

@ -0,0 +1,9 @@
{
"files.associations": {
"*.vue": "vue",
"*.wpy": "vue",
"*.wxml": "html",
"*.wxss": "css",
"string.h": "c"
}
}

3
src/afl-fuzz.c
Unescape View File

@ -7795,15 +7795,18 @@ int main(int argc, char** argv) {
gettimeofday(&tv, &tz);
srandom(tv.tv_sec ^ tv.tv_usec ^ getpid());
// argv 处理
while ((opt = getopt(argc, argv, "+i:o:f:m:b:t:T:dnCB:S:M:x:QV")) > 0)
switch (opt) {
case 'i': /* input dir */
// 初始 corpus 目录
if (in_dir) FATAL("Multiple -i options not supported");
in_dir = optarg;
// 若使用 "-i -"，则表示 in-place resume
if (!strcmp(in_dir, "-")) in_place_resume = 1;
break;

331
src/afl-gcc.c
Unescape View File

@ -1,42 +1,38 @@
/*
Copyright 2013 Google LLC All rights reserved.
Copyright 2013 Google LLC 版权所有，保留所有权利。
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at:
根据 Apache 许可证，版本 2.0（以下简称 "许可证"）进行许可；
除非遵守该许可证，否则你不得使用此文件。
你可以在以下网址获取许可副本：
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
除非适用法律要求或书面同意，依据许可证分发的软件是按“原样”基础提供的，
不提供任何形式的担保和条件，无论是明示的还是隐性的。
请参阅许可证以获取有关权限和限制的具体规定。
*/
/*
american fuzzy lop - wrapper for GCC and clang
American Fuzzy Lop - GCC 和 Clang 的封装器
----------------------------------------------
Written and maintained by Michal Zalewski <lcamtuf@google.com>
作者及维护者：Michal Zalewski <lcamtuf@google.com>
This program is a drop-in replacement for GCC or clang. The most common way
of using it is to pass the path to afl-gcc or afl-clang via CC when invoking
./configure.
本程序是 GCC 或 Clang 的直接替代品。使用它的最常见方法
是在调用 ./configure 时通过 CC 传递 afl-gcc 或 afl-clang 的路径。
(Of course, use CXX and point it to afl-g++ / afl-clang++ for C++ code.)
（当然，使用 CXX 并将其指向 afl-g++ / afl-clang++ 用于 C++ 代码。）
The wrapper needs to know the path to afl-as (renamed to 'as'). The default
is /usr/local/lib/afl/. A convenient way to specify alternative directories
would be to set AFL_PATH.
封装器需要知道 afl-as 的路径（重命名为 'as'）。默认路径
是 /usr/local/lib/afl/。指定备用目录的一个方便方法
是设置 AFL_PATH。
If AFL_HARDEN is set, the wrapper will compile the target app with various
hardening options that may help detect memory management issues more
reliably. You can also specify AFL_USE_ASAN to enable ASAN.
If you want to call a non-default compiler as a next step of the chain,
specify its location via AFL_CC or AFL_CXX.
如果设置了 AFL_HARDEN，封装器将在目标应用程序中使用各种
加固选项进行编译，这可能有助于更可靠地检测内存管理问题。
你还可以指定 AFL_USE_ASAN 来启用 ASAN。
如果你想在链的下一步调用非默认编译器，
通过 AFL_CC 或 AFL_CXX 指定其位置。
*/
#define AFL_MAIN
@ -51,38 +47,40 @@
#include <stdlib.h>
#include <string.h>
static u8* as_path; /* Path to the AFL 'as' wrapper */
static u8** cc_params; /* Parameters passed to the real CC */
static u32 cc_par_cnt = 1; /* Param count, including argv0 */
static u8 be_quiet, /* Quiet mode */
clang_mode; /* Invoked as afl-clang*? */
static u8 *as_path; /*AFL“as”包装器的路径*/
static u8 **cc_params; /*传递给真实CC的参数*/
static u32 cc_par_cnt = 1; /*参数计数，包括argv0*/
static u8 be_quiet, /*静音模式*/
clang_mode; /*被称为afl clang模式**/
/* Try to find our "fake" GNU assembler in AFL_PATH or at the location derived
from argv[0]. If that fails, abort. */
/* 尝试在 AFL_PATH 或从 argv[0] 派生的位置找到我们的“假”GNU 汇编器。
如果失败，则中止。 */
static void find_as(u8* argv0) {
static void find_as(u8 *argv0)
{
u8 *afl_path = getenv("AFL_PATH");
u8 *slash, *tmp;
if (afl_path) {
if (afl_path)
{
tmp = alloc_printf("%s/as", afl_path);
if (!access(tmp, X_OK)) {
if (!access(tmp, X_OK))
{
as_path = afl_path;
ck_free(tmp);
return;
}
ck_free(tmp);
}
slash = strrchr(argv0, '/');
if (slash) {
if (slash)
{
u8 *dir;
@ -92,7 +90,8 @@ static void find_as(u8* argv0) {
tmp = alloc_printf("%s/afl-as", dir);
if (!access(tmp, X_OK)) {
if (!access(tmp, X_OK))
{
as_path = dir;
ck_free(tmp);
return;
@ -100,22 +99,21 @@ static void find_as(u8* argv0) {
ck_free(tmp);
ck_free(dir);
}
if (!access(AFL_PATH "/as", X_OK)) {
if (!access(AFL_PATH "/as", X_OK))
{
as_path = AFL_PATH;
return;
}
FATAL("Unable to find AFL wrapper binary for 'as'. Please set AFL_PATH");
}
/*将argv复制到cc_params，进行必要的编辑*/
/* Copy argv to cc_params, making the necessary edits. */
static void edit_params(u32 argc, char** argv) {
static void edit_params(u32 argc, char **argv)
{
u8 fortify_set = 0, asan_set = 0;
u8 *name;
@ -124,40 +122,57 @@ static void edit_params(u32 argc, char** argv) {
u8 m32_set = 0;
#endif
cc_params = ck_alloc((argc + 128) * sizeof(u8*));
name = strrchr(argv[0], '/');
if (!name) name = argv[0]; else name++;
if (!strncmp(name, "afl-clang", 9)) {
clang_mode = 1;
setenv(CLANG_ENV_VAR, "1", 1);
if (!strcmp(name, "afl-clang++")) {
u8* alt_cxx = getenv("AFL_CXX");
cc_params[0] = alt_cxx ? alt_cxx : (u8*)"clang++";
} else {
u8* alt_cc = getenv("AFL_CC");
cc_params[0] = alt_cc ? alt_cc : (u8*)"clang";
/********************************************************************************
* 该段代码负责配置编译器参数，判断使用的编译器以及设置环境变量。
* 如果使用的是 afl-clang，则根据环境变量确定使用的 C 或 C++ 编译器。
********************************************************************************/
cc_params = ck_alloc((argc + 128) * sizeof(u8 *));
name = strrchr(argv[0], '/');
if (!name)
name = argv[0];
else
name++;
if (!strncmp(name, "afl-clang", 9))
{
clang_mode = 1;
setenv(CLANG_ENV_VAR, "1", 1);
if (!strcmp(name, "afl-clang++"))
{
u8 *alt_cxx = getenv("AFL_CXX");
cc_params[0] = alt_cxx ? alt_cxx : (u8 *)"clang++";
}
else
{
u8 *alt_cc = getenv("AFL_CC");
cc_params[0] = alt_cc ? alt_cc : (u8 *)"clang";
}
}
else
{
} else {
/* With GCJ and Eclipse installed, you can actually compile Java! The
instrumentation will work (amazingly). Alas, unhandled exceptions do
not call abort(), so afl-fuzz would need to be modified to equate
non-zero exit codes with crash conditions when working with Java
binaries. Meh. */
/*安装了GCJ和Eclipse后，您实际上可以编译Java！这个
仪器将工作（令人惊讶）。唉，未处理的异常确实如此
不调用abort（），因此需要修改afl-fuzz以使其相等
使用Java时具有崩溃条件的非零退出代码
二进制文件。嗯*/
#ifdef __APPLE__
if (!strcmp(name, "afl-g++")) cc_params[0] = getenv("AFL_CXX");
else if (!strcmp(name, "afl-gcj")) cc_params[0] = getenv("AFL_GCJ");
else cc_params[0] = getenv("AFL_CC");
if (!strcmp(name, "afl-g++"))
cc_params[0] = getenv("AFL_CXX");
else if (!strcmp(name, "afl-gcj"))
cc_params[0] = getenv("AFL_GCJ");
else
cc_params[0] = getenv("AFL_CC");
if (!cc_params[0]) {
if (!cc_params[0])
{
SAYF("\n" cLRD "[-] " cRST
"On Apple systems, 'gcc' is usually just a wrapper for clang. Please use the\n"
@ -165,53 +180,77 @@ static void edit_params(u32 argc, char** argv) {
" set AFL_CC or AFL_CXX to specify the correct path to that compiler.\n");
FATAL("AFL_CC or AFL_CXX required on MacOS X");
}
#else
if (!strcmp(name, "afl-g++")) {
u8* alt_cxx = getenv("AFL_CXX");
cc_params[0] = alt_cxx ? alt_cxx : (u8*)"g++";
} else if (!strcmp(name, "afl-gcj")) {
u8* alt_cc = getenv("AFL_GCJ");
cc_params[0] = alt_cc ? alt_cc : (u8*)"gcj";
} else {
u8* alt_cc = getenv("AFL_CC");
cc_params[0] = alt_cc ? alt_cc : (u8*)"gcc";
if (!strcmp(name, "afl-g++"))
{
u8 *alt_cxx = getenv("AFL_CXX");
cc_params[0] = alt_cxx ? alt_cxx : (u8 *)"g++";
}
else if (!strcmp(name, "afl-gcj"))
{
u8 *alt_cc = getenv("AFL_GCJ");
cc_params[0] = alt_cc ? alt_cc : (u8 *)"gcj";
}
else
{
u8 *alt_cc = getenv("AFL_CC");
cc_params[0] = alt_cc ? alt_cc : (u8 *)"gcc";
}
#endif /* __APPLE__ */
}
while (--argc) {
u8* cur = *(++argv);
if (!strncmp(cur, "-B", 2)) {
if (!be_quiet) WARNF("-B is already set, overriding");
if (!cur[2] && argc > 1) { argc--; argv++; }
// 处理命令行参数的循环
while (--argc)
{
u8 *cur = *(++argv);
// 检查是否设置了-B选项
if (!strncmp(cur, "-B", 2))
{
// 如果未静默，发出警告
if (!be_quiet)
WARNF("-B is already set, overriding");
// 如果-B后面没有参数且还有剩余参数，则跳过当前参数
if (!cur[2] && argc > 1)
{
argc--;
argv++;
}
continue;
}
if (!strcmp(cur, "-integrated-as")) continue;
// 忽略-included-as选项
if (!strcmp(cur, "-integrated-as"))
continue;
if (!strcmp(cur, "-pipe")) continue;
// 忽略-pipe选项
if (!strcmp(cur, "-pipe"))
continue;
/ *
* 该段代码用于处理编译器参数设置，包括支持地址和内存消毒功能的相关配置。
* 根据环境变量和输入参数，启用或禁用特定的功能选项。
* 代码还处理与FORTIFY_SOURCE和ASAN/MSAN的互斥关系。
* /
#if defined(__FreeBSD__) && defined(__x86_64__)
if (!strcmp(cur, "-m32")) m32_set = 1;
if (!strcmp(cur, "-m32"))
m32_set = 1;
#endif
if (!strcmp(cur, "-fsanitize=address") ||
!strcmp(cur, "-fsanitize=memory")) asan_set = 1;
!strcmp(cur, "-fsanitize=memory"))
asan_set = 1;
if (strstr(cur, "FORTIFY_SOURCE")) fortify_set = 1;
if (strstr(cur, "FORTIFY_SOURCE"))
fortify_set = 1;
cc_params[cc_par_cnt++] = cur;
}
cc_params[cc_par_cnt++] = "-B";
@ -220,22 +259,24 @@ static void edit_params(u32 argc, char** argv) {
if (clang_mode)
cc_params[cc_par_cnt++] = "-no-integrated-as";
if (getenv("AFL_HARDEN")) {
if (getenv("AFL_HARDEN"))
{
cc_params[cc_par_cnt++] = "-fstack-protector-all";
if (!fortify_set)
cc_params[cc_par_cnt++] = "-D_FORTIFY_SOURCE=2";
}
if (asan_set) {
if (asan_set)
{
/* Pass this on to afl-as to adjust map density. */
/*将此传递给afl以调整贴图密度*/
setenv("AFL_USE_ASAN", "1", 1);
} else if (getenv("AFL_USE_ASAN")) {
}
else if (getenv("AFL_USE_ASAN"))
{
if (getenv("AFL_USE_MSAN"))
FATAL("ASAN and MSAN are mutually exclusive");
@ -245,8 +286,9 @@ static void edit_params(u32 argc, char** argv) {
cc_params[cc_par_cnt++] = "-U_FORTIFY_SOURCE";
cc_params[cc_par_cnt++] = "-fsanitize=address";
} else if (getenv("AFL_USE_MSAN")) {
}
else if (getenv("AFL_USE_MSAN"))
{
if (getenv("AFL_USE_ASAN"))
FATAL("ASAN and MSAN are mutually exclusive");
@ -256,24 +298,29 @@ static void edit_params(u32 argc, char** argv) {
cc_params[cc_par_cnt++] = "-U_FORTIFY_SOURCE";
cc_params[cc_par_cnt++] = "-fsanitize=memory";
}
/********************************************************************************
* 该代码段用于配置编译器选项，特别是在非优化模式下。
* 主要用于模糊测试工具AFL的编译设置。
*
* 文件名: d:\code\google_AFL\src\afl-gcc.c
********************************************************************************/
if (!getenv("AFL_DONT_OPTIMIZE")) {
if (!getenv("AFL_DONT_OPTIMIZE"))
{
#if defined(__FreeBSD__) && defined(__x86_64__)
/* On 64-bit FreeBSD systems, clang -g -m32 is broken, but -m32 itself
works OK. This has nothing to do with us, but let's avoid triggering
that bug. */
/*在64位FreeBSD系统上，clang-g-m32已损坏，但-m32本身
工作正常。这与我们无关，但让我们避免触发
这个bug*/
if (!clang_mode || !m32_set)
cc_params[cc_par_cnt++] = "-g";
#else
cc_params[cc_par_cnt++] = "-g";
cc_params[cc_par_cnt++] = "-g";
#endif
@ -285,37 +332,45 @@ static void edit_params(u32 argc, char** argv) {
cc_params[cc_par_cnt++] = "-D__AFL_COMPILER=1";
cc_params[cc_par_cnt++] = "-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1";
}
if (getenv("AFL_NO_BUILTIN")) {
cc_params[cc_par_cnt++] = "-fno-builtin-strcmp";
cc_params[cc_par_cnt++] = "-fno-builtin-strncmp";
cc_params[cc_par_cnt++] = "-fno-builtin-strcasecmp";
cc_params[cc_par_cnt++] = "-fno-builtin-strncasecmp";
cc_params[cc_par_cnt++] = "-fno-builtin-memcmp";
cc_params[cc_par_cnt++] = "-fno-builtin-strstr";
cc_params[cc_par_cnt++] = "-fno-builtin-strcasestr";
}
/***********************************************
* 函数：根据环境变量设置编译器参数
* 功能：如果环境变量"AFL_NO_BUILTIN"存在，
* 添加禁用内置字符串和内存比较函数的编译器参数。
***********************************************/
if (getenv("AFL_NO_BUILTIN"))
{
cc_params[cc_par_cnt++] = "-fno-builtin-strcmp";
cc_params[cc_par_cnt++] = "-fno-builtin-strncmp";
cc_params[cc_par_cnt++] = "-fno-builtin-strcasecmp";
cc_params[cc_par_cnt++] = "-fno-builtin-strncasecmp";
cc_params[cc_par_cnt++] = "-fno-builtin-memcmp";
cc_params[cc_par_cnt++] = "-fno-builtin-strstr";
cc_params[cc_par_cnt++] = "-fno-builtin-strcasestr";
} cc_params[cc_par_cnt++] = "-fno-builtin-strncasecmp";
cc_params[cc_par_cnt++] = "-fno-builtin-memcmp";
cc_params[cc_par_cnt] = NULL;
}
/* Main entry point */
int main(int argc, char** argv) {
// 主函数，程序的入口点
int main(int argc, char **argv)
{
if (isatty(2) && !getenv("AFL_QUIET")) {
// 检查标准错误输出是否为终端，以及环境变量是否开启安静模式
if (isatty(2) && !getenv("AFL_QUIET"))
{
SAYF(cCYA "afl-cc " cBRI VERSION cRST " by <lcamtuf@google.com>\n");
}
else
be_quiet = 1;
} else be_quiet = 1;
if (argc < 2) {
// 检查传入的参数数量是否少于2
if (argc < 2)
{
SAYF("\n"
"This is a helper application for afl-fuzz. It serves as a drop-in replacement\n"
@ -330,17 +385,19 @@ int main(int argc, char** argv) {
BIN_PATH, BIN_PATH);
exit(1);
}
// 查找汇编器
find_as(argv[0]);
// 编辑参数
edit_params(argc, argv);
execvp(cc_params[0], (char**)cc_params);
// 执行编译器，并传递参数
execvp(cc_params[0], (char **)cc_params);
// 如果执行失败，输出错误信息
FATAL("Oops, failed to execute '%s' - check your PATH", cc_params[0]);
return 0;
}

Write Preview
Loading…
Cancel
Save