src/afl-tmin.c

@@ -88,7 +88,6 @@ static volatile u8
            stop_soon,                 /* Ctrl-C pressed?                   */
            child_timed_out;           /* Child timed out?                  */
 
-
 /* Classify tuple counts. This is a slow & naive version, but good enough here. */
 
 static const u8 count_class_lookup[256] = {
@@ -105,6 +104,8 @@ static const u8 count_class_lookup[256] = {
 
 };
 
+/* 根据分类查找表对位图中的计数值进行分类 */
+
 static void classify_counts(u8* mem) {
 
   u32 i = MAP_SIZE;
@@ -127,8 +128,7 @@ static void classify_counts(u8* mem) {
 
 }
 
-
+/* 如果设置了掩码，则对分类后的位图应用掩码 */
-/* Apply mask to classified bitmap (if set). */
 
 static void apply_mask(u32* mem, u32* mask) {
 
@@ -146,8 +146,7 @@ static void apply_mask(u32* mem, u32* mask) {
 
 }
 
-
+/* 检查位图中是否有任何字节被设置 */
-/* See if any bytes are set in the bitmap. */
 
 static inline u8 anything_set(void) {
 
@@ -160,9 +159,7 @@ static inline u8 anything_set(void) {
 
 }
 
-
+/* 清理共享内存和临时文件（atexit处理程序） */
-
-/* Get rid of shared memory and temp files (atexit handler). */
 
 static void remove_shm(void) {
 
@@ -171,8 +168,7 @@ static void remove_shm(void) {
 
 }
 
-
+/* 配置共享内存 */
-/* Configure shared memory. */
 
 static void setup_shm(void) {
 
@@ -196,8 +192,7 @@ static void setup_shm(void) {
 
 }
 
-
+/* 读取初始文件 */
-/* Read initial file. */
 
 static void read_initial_file(void) {
 
@@ -223,8 +218,7 @@ static void read_initial_file(void) {
 
 }
 
-
+/* 将数据写入文件 */
-/* Write output file. */
 
 static s32 write_to_file(u8* path, u8* mem, u32 len) {
 
@@ -244,8 +238,7 @@ static s32 write_to_file(u8* path, u8* mem, u32 len) {
 
 }
 
-
+/* 处理超时信号 */
-/* Handle timeout signal. */
 
 static void handle_timeout(int sig) {
 
@@ -254,9 +247,7 @@ static void handle_timeout(int sig) {
 
 }
 
-
+/* 执行目标应用程序。如果更改无效返回0，否则返回1 */
-/* Execute target application. Returns 0 if the changes are a dud, or
-   1 if they should be kept. */
 
 static u8 run_target(char** argv, u8* mem, u32 len, u8 first_run) {
 
@@ -321,7 +312,7 @@ static u8 run_target(char** argv, u8* mem, u32 len, u8 first_run) {
 
   close(prog_in_fd);
 
-  /* Configure timeout, wait for child, cancel timeout. */
+  /* 配置超时，等待子进程，取消超时 */
 
   child_timed_out = 0;
   it.it_value.tv_sec = (exec_tmout / 1000);
@@ -339,7 +330,7 @@ static u8 run_target(char** argv, u8* mem, u32 len, u8 first_run) {
 
   MEM_BARRIER();
 
-  /* Clean up bitmap, analyze exit condition, etc. */
+  /* 清理位图，分析退出条件等 */
 
   if (*(u32*)trace_bits == EXEC_FAIL_SIG)
     FATAL("Unable to execute '%s'", argv[0]);
@@ -356,7 +347,7 @@ static u8 run_target(char** argv, u8* mem, u32 len, u8 first_run) {
 
   }
 
-  /* Always discard inputs that time out. */
+  /* 始终丢弃超时的输入 */
 
   if (child_timed_out) {
 
@@ -365,7 +356,7 @@ static u8 run_target(char** argv, u8* mem, u32 len, u8 first_run) {
 
   }
 
-  /* Handle crashing inputs depending on current mode. */
+  /* 根据当前模式处理崩溃的输入 */
 
   if (WIFSIGNALED(status) ||
       (WIFEXITED(status) && WEXITSTATUS(status) == MSAN_ERROR) ||
@@ -386,7 +377,7 @@ static u8 run_target(char** argv, u8* mem, u32 len, u8 first_run) {
 
   } else
 
-  /* Handle non-crashing inputs appropriately. */
+  /* 根据当前模式处理非崩溃的输入 */
 
   if (crash_mode) {
 
@@ -406,8 +397,7 @@ static u8 run_target(char** argv, u8* mem, u32 len, u8 first_run) {
 
 }
 
-
+/* 找到大于或等于val的第一个2的幂 */
-/* Find first power of two greater or equal to val. */
 
 static u32 next_p2(u32 val) {
 
@@ -417,8 +407,7 @@ static u32 next_p2(u32 val) {
 
 }
 
-
+/* 实际地进行最小化 */
-/* Actually minimize! */
 
 static void minimize(char** argv) {
 
@@ -507,10 +496,9 @@ next_del_blksize:
     tail_len = in_len - del_pos - del_len;
     if (tail_len < 0) tail_len = 0;
 
-    /* If we have processed at least one full block (initially, prev_del == 1),
+    /* 如果我们已经处理了一个完整的块（最初，prev_del == 1），
-       and we did so without deleting the previous one, and we aren't at the
+       并且没有删除前一个块，且我们不在缓冲区的末尾（tail_len > 0），
-       very end of the buffer (tail_len > 0), and the current block is the same
+       并且当前块与前一个块相同... 则跳过此步骤作为无操作 */
-       as the previous one... skip this step as a no-op. */
 
     if (!prev_del && tail_len && !memcmp(in_data + del_pos - del_len,
         in_data + del_pos, del_len)) {
@@ -522,10 +510,10 @@ next_del_blksize:
 
     prev_del = 0;
 
-    /* Head */
+    /* 头部 */
     memcpy(tmp_buf, in_data, del_pos);
 
-    /* Tail */
+    /* 尾部 */
     memcpy(tmp_buf + del_pos, in_data + del_pos + del_len, tail_len);
 
     res = run_target(argv, tmp_buf, del_pos + tail_len, 0);
@@ -658,9 +646,7 @@ finalize_all:
 
 }
 
-
+/* 处理Ctrl-C等信号 */
-
-/* Handle Ctrl-C and the like. */
 
 static void handle_stop_sig(int sig) {
 
@@ -670,8 +656,7 @@ static void handle_stop_sig(int sig) {
 
 }
 
-
+/* 进行基本的准备工作 - 持久性文件描述符，文件名等 */
-/* Do basic preparations - persistent fds, filenames, etc. */
 
 static void set_up_environment(void) {
 
@@ -695,7 +680,7 @@ static void set_up_environment(void) {
 
   }
 
-  /* Set sane defaults... */
+  /* 设置合理的默认值... */
 
   x = getenv("ASAN_OPTIONS");
 
@@ -714,8 +699,7 @@ static void set_up_environment(void) {
   if (x) {
 
     if (!strstr(x, "exit_code=" STRINGIFY(MSAN_ERROR)))
-      FATAL("Custom MSAN_OPTIONS set without exit_code="
+      FATAL("Custom MSAN_OPTIONS set without exit_code=" STRINGIFY(MSAN_ERROR) " - please fix!");
-            STRINGIFY(MSAN_ERROR) " - please fix!");
 
     if (!strstr(x, "symbolize=0"))
       FATAL("Custom MSAN_OPTIONS set without symbolize=0 - please fix!");
@@ -740,8 +724,7 @@ static void set_up_environment(void) {
 
 }
 
-
+/* 设置信号处理程序 */
-/* Setup signal handlers, duh. */
 
 static void setup_signal_handlers(void) {
 
@@ -753,22 +736,21 @@ static void setup_signal_handlers(void) {
 
   sigemptyset(&sa.sa_mask);
 
-  /* Various ways of saying "stop". */
+  /* 各种方式表示“停止”。 */
 
   sa.sa_handler = handle_stop_sig;
   sigaction(SIGHUP, &sa, NULL);
   sigaction(SIGINT, &sa, NULL);
   sigaction(SIGTERM, &sa, NULL);
 
-  /* Exec timeout notifications. */
+  /* 执行超时通知。 */
 
   sa.sa_handler = handle_timeout;
   sigaction(SIGALRM, &sa, NULL);
 
 }
 
-
+/* 检测参数中的@@ */
-/* Detect @@ in args. */
 
 static void detect_file_args(char** argv) {
 
@@ -785,12 +767,12 @@ static void detect_file_args(char** argv) {
 
       u8 *aa_subst, *n_arg;
 
-      /* Be sure that we're always using fully-qualified paths. */
+      /* 确保总是使用全路径。 */
 
       if (prog_in[0] == '/') aa_subst = prog_in;
       else aa_subst = alloc_printf("%s/%s", cwd, prog_in);
 
-      /* Construct a replacement argv value. */
+      /* 构造替换的argv值 */
 
       *aa_loc = 0;
       n_arg = alloc_printf("%s%s%s", argv[i], aa_subst, aa_loc + 2);
@@ -809,8 +791,7 @@ static void detect_file_args(char** argv) {
 
 }
 
-
+/* 显示使用提示 */
-/* Display usage hints. */
 
 static void usage(u8* argv0) {
 
@@ -845,8 +826,7 @@ static void usage(u8* argv0) {
 
 }
 
-
+/* 查找二进制文件 */
-/* Find binary. */
 
 static void find_binary(u8* fname) {
 
@@ -898,21 +878,20 @@ static void find_binary(u8* fname) {
 
 }
 
-
+/* 为QEMU修复argv */
-/* Fix up argv for QEMU. */
 
 static char** get_qemu_argv(u8* own_loc, char** argv, int argc) {
 
   char** new_argv = ck_alloc(sizeof(char*) * (argc + 4));
   u8 *tmp, *cp, *rsl, *own_copy;
 
-  /* Workaround for a QEMU stability glitch. */
+  /* 为QEMU稳定性问题的解决提供了一个临时的解决方案。 */
 
   setenv("QEMU_LOG", "nochain", 1);
 
   memcpy(new_argv + 3, argv + 1, sizeof(char*) * argc);
 
-  /* Now we need to actually find qemu for argv[0]. */
+  /* 现在我们需要实际地找到qemu来运行argv[0] */
 
   new_argv[2] = target_path;
   new_argv[1] = "--";
@@ -961,8 +940,7 @@ static char** get_qemu_argv(u8* own_loc, char** argv, int argc) {
 
 }
 
-
+/* 从文件读取掩码位图。这是为-B选项服务的 */
-/* Read mask bitmap from file. This is for the -B option. */
 
 static void read_bitmap(u8* fname) {
 
@@ -976,9 +954,7 @@ static void read_bitmap(u8* fname) {
 
 }
 
-
+/* 主入口点 */
-
-/* Main entry point */
 
 int main(int argc, char** argv) {
 
@@ -1084,18 +1060,14 @@ int main(int argc, char** argv) {
 
       case 'B': /* load bitmap */
 
-        /* This is a secret undocumented option! It is speculated to be useful
+        /* 这是一个秘密的未公开选项！如果有一个基线“无聊”的输入文件和另一个“有趣”的文件你想最小化，
-           if you have a baseline "boring" input file and another "interesting"
+           这个选项可能是有用的。
-           file you want to minimize.
 
-           You can dump a binary bitmap for the boring file using
+           你可以使用afl-showmap -b来为无聊的文件转储二进制位图，
-           afl-showmap -b, and then load it into afl-tmin via -B. The minimizer
+           然后通过-B加载到afl-tmin中。最小化器将只保留有趣输入文件中独特的边，
-           will then minimize to preserve only the edges that are unique to
+           但忽略来自原始映射的所有内容。
-           the interesting input file, but ignoring everything from the
-           original map.
 
-           The option may be extended and made more official if it proves
+           如果这个选项被证明是有用的，可能会被扩展并正式记录。 */
-           to be useful. */
 
         if (mask_bitmap) FATAL("Multiple -B options not supported");
         mask_bitmap = ck_alloc(MAP_SIZE);
@@ -1104,7 +1076,7 @@ int main(int argc, char** argv) {
 
       case 'V': /* Show version number */
 
-        /* Version number has been printed already, just quit. */
+        /* 版本号已经打印过了，直接退出 */
         exit(0);
 
       default:
@@ -1169,5 +1141,4 @@ int main(int argc, char** argv) {
 
   exit(0);
 
-}
+}
-