|
|
|
|
@ -89,7 +89,7 @@
|
|
|
|
|
|
|
|
|
|
/* Lots of globals, but mostly for the status UI and other things where it
|
|
|
|
|
really makes no sense to haul them around as function parameters. */
|
|
|
|
|
|
|
|
|
|
//全局变量声明 - 配置相关
|
|
|
|
|
|
|
|
|
|
EXP_ST u8 *in_dir, /* Input directory with test cases */
|
|
|
|
|
*out_file, /* File to fuzz, if any */
|
|
|
|
|
@ -102,15 +102,15 @@ EXP_ST u8 *in_dir, /* Input directory with test cases */
|
|
|
|
|
*target_path, /* Path to target binary */
|
|
|
|
|
*orig_cmdline; /* Original command line */
|
|
|
|
|
|
|
|
|
|
EXP_ST u32 exec_tmout = EXEC_TIMEOUT; /* Configurable exec timeout (ms) */
|
|
|
|
|
static u32 hang_tmout = EXEC_TIMEOUT; /* Timeout used for hang det (ms) */
|
|
|
|
|
EXP_ST u32 exec_tmout = EXEC_TIMEOUT; /* 子进程内存限制(MB) */
|
|
|
|
|
static u32 hang_tmout = EXEC_TIMEOUT; /* 用于挂起检测的超时时间(ms) */
|
|
|
|
|
|
|
|
|
|
EXP_ST u64 mem_limit = MEM_LIMIT; /* Memory cap for child (MB) */
|
|
|
|
|
|
|
|
|
|
EXP_ST u32 cpu_to_bind = 0; /* id of free CPU core to bind */
|
|
|
|
|
|
|
|
|
|
static u32 stats_update_freq = 1; /* Stats update frequency (execs) */
|
|
|
|
|
|
|
|
|
|
/* 152-200: 全局变量声明 - 状态相关 */
|
|
|
|
|
EXP_ST u8 skip_deterministic, /* Skip deterministic stages? */
|
|
|
|
|
force_deterministic, /* Force deterministic stages? */
|
|
|
|
|
use_splicing, /* Recombine input files? */
|
|
|
|
|
@ -198,7 +198,7 @@ EXP_ST u64 total_crashes, /* Total number of crashes */
|
|
|
|
|
bytes_trim_out, /* Bytes coming outa the trimmer */
|
|
|
|
|
blocks_eff_total, /* Blocks subject to effector maps */
|
|
|
|
|
blocks_eff_select; /* Blocks selected as fuzzable */
|
|
|
|
|
|
|
|
|
|
/* 202-250: 全局变量声明 - 统计相关 */
|
|
|
|
|
static u32 subseq_tmouts; /* Number of timeouts in a row */
|
|
|
|
|
|
|
|
|
|
static u8 *stage_name = "init", /* Name of the current fuzz stage */
|
|
|
|
|
@ -237,7 +237,7 @@ static s32 cpu_aff = -1; /* Selected CPU core */
|
|
|
|
|
#endif /* HAVE_AFFINITY */
|
|
|
|
|
|
|
|
|
|
static FILE* plot_file; /* Gnuplot output file */
|
|
|
|
|
|
|
|
|
|
/* 252-300: 结构体定义 */
|
|
|
|
|
struct queue_entry {
|
|
|
|
|
|
|
|
|
|
u8* fname; /* File name for the test case */
|
|
|
|
|
@ -296,7 +296,7 @@ static s16 interesting_16[] = { INTERESTING_8, INTERESTING_16 };
|
|
|
|
|
static s32 interesting_32[] = { INTERESTING_8, INTERESTING_16, INTERESTING_32 };
|
|
|
|
|
|
|
|
|
|
/* Fuzzing stages */
|
|
|
|
|
|
|
|
|
|
/* 302-350: 辅助函数 */
|
|
|
|
|
enum {
|
|
|
|
|
/* 00 */ STAGE_FLIP1,
|
|
|
|
|
/* 01 */ STAGE_FLIP2,
|
|
|
|
|
@ -337,7 +337,7 @@ enum {
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* Get unix time in milliseconds */
|
|
|
|
|
/* 352-400: 随机数生成相关函数 */
|
|
|
|
|
|
|
|
|
|
static u64 get_cur_time(void) {
|
|
|
|
|
|
|
|
|
|
@ -403,7 +403,7 @@ static void shuffle_ptrs(void** ptrs, u32 cnt) {
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* 402-450: CPU绑定相关函数 */
|
|
|
|
|
#ifdef HAVE_AFFINITY
|
|
|
|
|
|
|
|
|
|
/* Build a list of processes bound to specific cores. Returns -1 if nothing
|
|
|
|
|
@ -537,7 +537,7 @@ static void bind_to_free_cpu(void) {
|
|
|
|
|
|
|
|
|
|
/* Helper function to compare buffers; returns first and last differing offset. We
|
|
|
|
|
use this to find reasonable locations for splicing two files. */
|
|
|
|
|
|
|
|
|
|
/* 452-500: 文件差异定位函数 */
|
|
|
|
|
static void locate_diffs(u8* ptr1, u8* ptr2, u32 len, s32* first, s32* last) {
|
|
|
|
|
|
|
|
|
|
s32 f_loc = -1;
|
|
|
|
|
@ -625,7 +625,7 @@ static u8* DI(u64 val) {
|
|
|
|
|
|
|
|
|
|
/* Describe float. Similar to the above, except with a single
|
|
|
|
|
static buffer. */
|
|
|
|
|
|
|
|
|
|
// 将浮点数转换为人类可读的字符串
|
|
|
|
|
static u8* DF(double val) {
|
|
|
|
|
|
|
|
|
|
static u8 tmp[16];
|
|
|
|
|
@ -1173,7 +1173,8 @@ EXP_ST void init_count_class16(void) {
|
|
|
|
|
#ifdef WORD_SIZE_64
|
|
|
|
|
//分类执行跟踪信息，处理执行跟踪数据，以便更高效地存储和比较。
|
|
|
|
|
static inline void classify_counts(u64* mem) {
|
|
|
|
|
|
|
|
|
|
// 对执行路径中的计数进行分类
|
|
|
|
|
// 用于识别不同的执行行为模式
|
|
|
|
|
u32 i = MAP_SIZE >> 3;
|
|
|
|
|
|
|
|
|
|
while (i--) {
|
|
|
|
|
@ -2506,7 +2507,7 @@ static u8 run_target(char** argv, u32 timeout) {
|
|
|
|
|
truncated. */
|
|
|
|
|
//将修改后的数据写入测试用例文件。如果指定了输出文件，则会创建一个新文件；否则，会重置并截断现有的输出文件描述符。
|
|
|
|
|
static void write_to_testcase(void* mem, u32 len) {
|
|
|
|
|
|
|
|
|
|
// 将测试数据写入测试用例文件
|
|
|
|
|
s32 fd = out_fd;
|
|
|
|
|
|
|
|
|
|
if (out_file) {
|
|
|
|
|
@ -9630,7 +9631,8 @@ static void setup_post(void) {
|
|
|
|
|
Called at startup. */
|
|
|
|
|
|
|
|
|
|
static void read_testcases(void) {
|
|
|
|
|
|
|
|
|
|
// 从测试用例文件读取数据
|
|
|
|
|
// 处理各种读取错误情况
|
|
|
|
|
struct dirent **nl;
|
|
|
|
|
s32 nl_cnt;
|
|
|
|
|
u32 i;
|
|
|
|
|
@ -10771,7 +10773,7 @@ static void show_stats(void);
|
|
|
|
|
//start_us, stop_us;
|
|
|
|
|
|
|
|
|
|
//保存了一些旧的状态值，以便在函数执行完毕后恢复。
|
|
|
|
|
|
|
|
|
|
/*变异策略函数 */
|
|
|
|
|
static u8 calibrate_case(char** argv, struct queue_entry* q, u8* use_mem,
|
|
|
|
|
u32 handicap, u8 from_queue) {
|
|
|
|
|
|
|
|
|
|
@ -14728,7 +14730,8 @@ splicing_with = -1;
|
|
|
|
|
|
|
|
|
|
// 这个函数用于在分布式模糊测试环境中，从其他模糊测试器中同步测试用例。
|
|
|
|
|
static void sync_fuzzers(char** argv) {
|
|
|
|
|
|
|
|
|
|
// 同步多个fuzzer实例之间的测试用例
|
|
|
|
|
// 导入其他fuzzer发现的新路径
|
|
|
|
|
DIR* sd; // 指向同步目录的目录流
|
|
|
|
|
struct dirent* sd_ent; // 目录流中的当前条目
|
|
|
|
|
u32 sync_cnt = 0; // 同步的模糊测试器数量
|
|
|
|
|
|
