m5cn9itjr
/
AFL
1
0
Fork 0
Code Issues Pull Requests 2 Packages Projects Releases 1 Wiki Activity

config android

Browse Source 
Signed-off-by: GodKingBS <283805320@qq.com>
main
GodKingBS 4 months ago
parent 946e85b964
commit bf0e5c1714
2 changed files with 175 additions and 234 deletions
Show Stats Download Patch File Download Diff File

92
src/android-ashmem.h
Unescape View File

@ -1,81 +1,87 @@
// 如果是Android平台，且尚未定义_ANDROID_ASHMEM_H，则定义它
#ifdef __ANDROID__ #ifdef __ANDROID__
#ifndef _ANDROID_ASHMEM_H #ifndef _ANDROID_ASHMEM_H
#define _ANDROID_ASHMEM_H #define _ANDROID_ASHMEM_H
// 包含所需的头文件
#include <fcntl.h> #include <fcntl.h>
#include <linux/ashmem.h> #include <linux/ashmem.h> // 包含ashmem相关的ioctl操作
#include <linux/shm.h> #include <linux/shm.h>
#include <sys/ioctl.h> #include <sys/ioctl.h>
#include <sys/mman.h> #include <sys/mman.h> // 包含内存映射函数
// 如果Android API级别大于或等于26（Android 8.0），则使用Bionic的shm*函数
#if __ANDROID_API__ >= 26 #if __ANDROID_API__ >= 26
#define shmat bionic_shmat #define shmat bionic_shmat
#define shmctl bionic_shmctl #define shmctl bionic_shmctl
#define shmdt bionic_shmdt #define shmdt bionic_shmdt
#define shmget bionic_shmget #define shmget bionic_shmget
#endif #endif
#include <sys/shm.h> #include <sys/shm.h> // 包含标准的共享内存函数
#undef shmat #undef shmat
#undef shmctl #undef shmctl
#undef shmdt #undef shmdt
#undef shmget #undef shmget // 取消对Bionic函数的重定义
#include <stdio.h> #include <stdio.h>
// 定义ashmem设备的路径
#define ASHMEM_DEVICE "/dev/ashmem" #define ASHMEM_DEVICE "/dev/ashmem"
static inline int shmctl(int __shmid, int __cmd, struct shmid_ds *__buf) { // 定义shmctl函数的封装，用于删除共享内存
int ret = 0; static inline int shmctl(int __shmid, int __cmd, struct shmid_ds* __buf) {
if (__cmd == IPC_RMID) { int ret = 0;
int length = ioctl(__shmid, ASHMEM_GET_SIZE, NULL); if (__cmd == IPC_RMID) {
struct ashmem_pin pin = {0, length}; int length = ioctl(__shmid, ASHMEM_GET_SIZE, NULL);
ret = ioctl(__shmid, ASHMEM_UNPIN, &pin); struct ashmem_pin pin = { 0, length };
close(__shmid); ret = ioctl(__shmid, ASHMEM_UNPIN, &pin);
} close(__shmid);
}
return ret; return ret;
} }
// 定义shmget函数的封装，用于创建共享内存
static inline int shmget(key_t __key, size_t __size, int __shmflg) { static inline int shmget(key_t __key, size_t __size, int __shmflg) {
(void) __shmflg; (void)__shmflg;
int fd, ret; int fd, ret;
char ourkey[11]; char ourkey[11];
fd = open(ASHMEM_DEVICE, O_RDWR); fd = open(ASHMEM_DEVICE, O_RDWR);
if (fd < 0) if (fd < 0)
return fd; return fd;
sprintf(ourkey, "%d", __key); sprintf(ourkey, "%d", __key);
ret = ioctl(fd, ASHMEM_SET_NAME, ourkey); ret = ioctl(fd, ASHMEM_SET_NAME, ourkey);
if (ret < 0) if (ret < 0)
goto error; goto error;
ret = ioctl(fd, ASHMEM_SET_SIZE, __size); ret = ioctl(fd, ASHMEM_SET_SIZE, __size);
if (ret < 0) if (ret < 0)
goto error; goto error;
return fd; return fd;
error: error:
close(fd); close(fd);
return ret; return ret;
} }
static inline void *shmat(int __shmid, const void *__shmaddr, int __shmflg) { // 定义shmat函数的封装，用于将共享内存附加到进程地址空间
(void) __shmflg; static inline void* shmat(int __shmid, const void* __shmaddr, int __shmflg) {
int size; (void)__shmflg;
void *ptr; int size;
void* ptr;
size = ioctl(__shmid, ASHMEM_GET_SIZE, NULL); size = ioctl(__shmid, ASHMEM_GET_SIZE, NULL);
if (size < 0) { if (size < 0) {
return NULL; return NULL;
} }
ptr = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, __shmid, 0); ptr = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, __shmid, 0);
if (ptr == MAP_FAILED) { if (ptr == MAP_FAILED) {
return NULL; return NULL;
} }
return ptr; return ptr;
} }
#endif /* !_ANDROID_ASHMEM_H */ #endif /* !_ANDROID_ASHMEM_H */

311
src/config.h
Unescape View File

@ -27,8 +27,7 @@
#include "types.h" #include "types.h"
/* Version string: */ /* Version string: */
#define VERSION "2.57b" // 定义版本号字符串
#define VERSION "2.57b"
/****************************************************** /******************************************************
* * * *
@ -36,69 +35,57 @@
* * * *
******************************************************/ ******************************************************/
/* Comment out to disable terminal colors (note that this makes afl-analyze /* Comment out to disable terminal colors (note that this makes afl-analyze
a lot less nice): */ a lot less nice): */
#define USE_COLOR // 启用终端颜色
#define USE_COLOR
/* Comment out to disable fancy ANSI boxes and use poor man's 7-bit UI: */ /* Comment out to disable fancy ANSI boxes and use poor man's 7-bit UI: */
#define FANCY_BOXES // 启用ANSI框绘制
#define FANCY_BOXES
/* Default timeout for fuzzed code (milliseconds). This is the upper bound, /* Default timeout for fuzzed code (milliseconds). This is the upper bound,
also used for detecting hangs; the actual value is auto-scaled: */ also used for detecting hangs; the actual value is auto-scaled: */
#define EXEC_TIMEOUT 1000 // 默认超时时间（毫秒）
#define EXEC_TIMEOUT 1000 /* Timeout rounding factor when auto-scaling (milliseconds): */
#define EXEC_TM_ROUND 20 // 自动缩放时的超时舍入因子（毫秒）
/* Timeout rounding factor when auto-scaling (milliseconds): */
#define EXEC_TM_ROUND 20
/* 64bit arch MACRO */ /* 64bit arch MACRO */
#if (defined (__x86_64__) || defined (__arm64__) || defined (__aarch64__)) #if (defined (__x86_64__) || defined (__arm64__) || defined (__aarch64__))
#define WORD_SIZE_64 1 #define WORD_SIZE_64 1 // 定义64位架构宏
#endif #endif
/* Default memory limit for child process (MB): */ /* Default memory limit for child process (MB): */
#ifndef WORD_SIZE_64 #ifndef WORD_SIZE_64
# define MEM_LIMIT 25 # define MEM_LIMIT 25 // 非64位架构的默认内存限制（MB）
#else #else
# define MEM_LIMIT 50 # define MEM_LIMIT 50 // 64位架构的默认内存限制（MB）
#endif /* ^!WORD_SIZE_64 */ #endif /* ^!WORD_SIZE_64 */
/* Default memory limit when running in QEMU mode (MB): */ /* Default memory limit when running in QEMU mode (MB): */
#define MEM_LIMIT_QEMU 200 // QEMU模式下的默认内存限制（MB）
#define MEM_LIMIT_QEMU 200
/* Number of calibration cycles per every new test case (and for test /* Number of calibration cycles per every new test case (and for test
cases that show variable behavior): */ cases that show variable behavior): */
#define CAL_CYCLES 8 // 每个新测试用例的校准周期数
#define CAL_CYCLES_LONG 40 // 长校准周期数
#define CAL_CYCLES 8 /* Number of subsequent timeouts before abandoning an input file: */
#define CAL_CYCLES_LONG 40 #define TMOUT_LIMIT 250 // 超时次数限制
/* Number of subsequent timeouts before abandoning an input file: */
#define TMOUT_LIMIT 250
/* Maximum number of unique hangs or crashes to record: */ /* Maximum number of unique hangs or crashes to record: */
#define KEEP_UNIQUE_HANG 500 // 最大记录的唯一挂起数
#define KEEP_UNIQUE_HANG 500 #define KEEP_UNIQUE_CRASH 5000 // 最大记录的唯一崩溃数
#define KEEP_UNIQUE_CRASH 5000
/* Baseline number of random tweaks during a single 'havoc' stage: */ /* Baseline number of random tweaks during a single 'havoc' stage: */
#define HAVOC_CYCLES 256 // 'havoc'阶段的随机调整基数
#define HAVOC_CYCLES 256 #define HAVOC_CYCLES_INIT 1024 // 'havoc'阶段的初始随机调整数
#define HAVOC_CYCLES_INIT 1024
/* Maximum multiplier for the above (should be a power of two, beware /* Maximum multiplier for the above (should be a power of two, beware
of 32-bit int overflows): */ of 32-bit int overflows): */
#define HAVOC_MAX_MULT 16 // 'havoc'阶段的最大乘数
#define HAVOC_MAX_MULT 16 /* Absolute minimum number of havoc cycles (after all adjustments): */
#define HAVOC_MIN 16 // 'havoc'阶段的绝对最小周期数
/* Absolute minimum number of havoc cycles (after all adjustments): */
#define HAVOC_MIN 16
/* Maximum stacking for havoc-stage tweaks. The actual value is calculated /* Maximum stacking for havoc-stage tweaks. The actual value is calculated
like this: like this:
@ -108,156 +95,136 @@
In other words, the default (n = 7) produces 2, 4, 8, 16, 32, 64, or In other words, the default (n = 7) produces 2, 4, 8, 16, 32, 64, or
128 stacked tweaks: */ 128 stacked tweaks: */
#define HAVOC_STACK_POW2 7 // 'havoc'阶段的最大堆叠指数
#define HAVOC_STACK_POW2 7 /* Caps on block sizes for cloning and deletion operations. Each of these
ranges has a 33% probability of getting picked, except for the first
/* Caps on block sizes for cloning and deletion operations. Each of these two cycles where smaller blocks are favored: */
ranges has a 33% probability of getting picked, except for the first #define HAVOC_BLK_SMALL 32 // 小块大小限制
two cycles where smaller blocks are favored: */ #define HAVOC_BLK_MEDIUM 128 // 中块大小限制
#define HAVOC_BLK_LARGE 1500 // 大块大小限制
#define HAVOC_BLK_SMALL 32
#define HAVOC_BLK_MEDIUM 128
#define HAVOC_BLK_LARGE 1500
/* Extra-large blocks, selected very rarely (<5% of the time): */ /* Extra-large blocks, selected very rarely (<5% of the time): */
#define HAVOC_BLK_XL 32768 // 特大块大小限制
#define HAVOC_BLK_XL 32768
/* Probabilities of skipping non-favored entries in the queue, expressed as /* Probabilities of skipping non-favored entries in the queue, expressed as
percentages: */ percentages: */
#define SKIP_TO_NEW_PROB 99 // 跳过非优先队列项的概率（有新的待处理优先项）
#define SKIP_NFAV_OLD_PROB 95 // 跳过非优先队列项的概率（没有新的优先项，当前项已测试）
#define SKIP_NFAV_NEW_PROB 75 // 跳过非优先队列项的概率（没有新的优先项，当前项未测试）
#define SKIP_TO_NEW_PROB 99 /* ...when there are new, pending favorites */ /* Splicing cycle count: */
#define SKIP_NFAV_OLD_PROB 95 /* ...no new favs, cur entry already fuzzed */ #define SPLICE_CYCLES 15 // 拼接周期数
#define SKIP_NFAV_NEW_PROB 75 /* ...no new favs, cur entry not fuzzed yet */
/* Splicing cycle count: */
#define SPLICE_CYCLES 15
/* Nominal per-splice havoc cycle length: */ /* Nominal per-splice havoc cycle length: */
#define SPLICE_HAVOC 32 // 每次拼接的'havoc'周期长度
#define SPLICE_HAVOC 32
/* Maximum offset for integer addition / subtraction stages: */ /* Maximum offset for integer addition / subtraction stages: */
#define ARITH_MAX 35 // 整数加减阶段的最大偏移量
#define ARITH_MAX 35
/* Limits for the test case trimmer. The absolute minimum chunk size; and /* Limits for the test case trimmer. The absolute minimum chunk size; and
the starting and ending divisors for chopping up the input file: */ the starting and ending divisors for chopping up the input file: */
#define TRIM_MIN_BYTES 4 // 测试用例修剪器的最小块大小
#define TRIM_START_STEPS 16 // 测试用例修剪器的起始除数
#define TRIM_END_STEPS 1024 // 测试用例修剪器的结束除数
#define TRIM_MIN_BYTES 4 /* Maximum size of input file, in bytes (keep under 100MB): */
#define TRIM_START_STEPS 16 #define MAX_FILE (1 * 1024 * 1024) // 输入文件的最大大小（字节）
#define TRIM_END_STEPS 1024
/* Maximum size of input file, in bytes (keep under 100MB): */
#define MAX_FILE (1 * 1024 * 1024)
/* The same, for the test case minimizer: */ /* The same, for the test case minimizer: */
#define TMIN_MAX_FILE (10 * 1024 * 1024) // 测试用例最小化器的最大文件大小
#define TMIN_MAX_FILE (10 * 1024 * 1024)
/* Block normalization steps for afl-tmin: */ /* Block normalization steps for afl-tmin: */
#define TMIN_SET_MIN_SIZE 4 // afl-tmin的块归一化最小大小
#define TMIN_SET_MIN_SIZE 4 #define TMIN_SET_STEPS 128 // afl-tmin的块归一化步数
#define TMIN_SET_STEPS 128
/* Maximum dictionary token size (-x), in bytes: */ /* Maximum dictionary token size (-x), in bytes: */
#define MAX_DICT_FILE 128 // 最大字典令牌大小（字节）
#define MAX_DICT_FILE 128
/* Length limits for auto-detected dictionary tokens: */ /* Length limits for auto-detected dictionary tokens: */
#define MIN_AUTO_EXTRA 3 // 自动检测的字典令牌的最小长度
#define MIN_AUTO_EXTRA 3 #define MAX_AUTO_EXTRA 32 // 自动检测的字典令牌的最大长度
#define MAX_AUTO_EXTRA 32
/* Maximum number of user-specified dictionary tokens to use in deterministic /* Maximum number of user-specified dictionary tokens to use in deterministic
steps; past this point, the "extras/user" step will be still carried out, steps; past this point, the "extras/user" step will be still carried out,
but with proportionally lower odds: */ but with proportionally lower odds: */
#define MAX_DET_EXTRAS 200 // 最大用户指定字典令牌数
#define MAX_DET_EXTRAS 200 /* Maximum number of auto-extracted dictionary tokens to actually use in fuzzing
(first value), and to keep in memory as candidates. The latter should be much
/* Maximum number of auto-extracted dictionary tokens to actually use in fuzzing higher than the former. */
(first value), and to keep in memory as candidates. The latter should be much #define USE_AUTO_EXTRAS 50 // 实际用于模糊测试的自动提取字典令牌数
higher than the former. */ #define MAX_AUTO_EXTRAS (USE_AUTO_EXTRAS * 10) // 内存中候选的自动提取字典令牌数
#define USE_AUTO_EXTRAS 50
#define MAX_AUTO_EXTRAS (USE_AUTO_EXTRAS * 10)
/* Scaling factor for the effector map used to skip some of the more
expensive deterministic steps. The actual divisor is set to
2^EFF_MAP_SCALE2 bytes: */
#define EFF_MAP_SCALE2 3 /* Scaling factor for the effector map used to skip some of the more
expensive deterministic steps. The actual divisor is set to
2^EFF_MAP_SCALE2 bytes: */
#define EFF_MAP_SCALE2 3 // 效应器映射的缩放因子
/* Minimum input file length at which the effector logic kicks in: */ /* Minimum input file length at which the effector logic kicks in: */
#define EFF_MIN_LEN 128 // 效应器逻辑触发的最小输入文件长度
#define EFF_MIN_LEN 128
/* Maximum effector density past which everything is just fuzzed /* Maximum effector density past which everything is just fuzzed
unconditionally (%): */ unconditionally (%): */
#define EFF_MAX_PERC 90 // 最大效应器密度（%）
#define EFF_MAX_PERC 90 /* UI refresh frequency (Hz): */
#define UI_TARGET_HZ 5 // UI刷新频率（Hz）
/* UI refresh frequency (Hz): */
#define UI_TARGET_HZ 5
/* Fuzzer stats file and plot update intervals (sec): */ /* Fuzzer stats file and plot update intervals (sec): */
#define STATS_UPDATE_SEC 60 // 模糊统计文件更新间隔（秒）
#define STATS_UPDATE_SEC 60 #define PLOT_UPDATE_SEC 5 // 模糊统计图表更新间隔（秒）
#define PLOT_UPDATE_SEC 5
/* Smoothing divisor for CPU load and exec speed stats (1 - no smoothing). */ /* Smoothing divisor for CPU load and exec speed stats (1 - no smoothing). */
#define AVG_SMOOTHING 16 // CPU负载和执行速度统计的平滑除数
#define AVG_SMOOTHING 16
/* Sync interval (every n havoc cycles): */ /* Sync interval (every n havoc cycles): */
#define SYNC_INTERVAL 5 // 同步间隔（每n个havoc周期）
#define SYNC_INTERVAL 5
/* Output directory reuse grace period (minutes): */ /* Output directory reuse grace period (minutes): */
#define OUTPUT_GRACE 25 // 输出目录重用宽限期（分钟）
#define OUTPUT_GRACE 25
/* Uncomment to use simple file names (id_NNNNNN): */ /* Uncomment to use simple file names (id_NNNNNN): */
// #define SIMPLE_FILES // 取消注释以使用简单文件名
// #define SIMPLE_FILES
/* List of interesting values to use in fuzzing. */ /* List of interesting values to use in fuzzing. */
// 定义一系列有趣的值，用于模糊测试
/* 定义一组有趣的8位值，用于模糊测试，包括边界值和常见缓冲区大小 */
#define INTERESTING_8 \ #define INTERESTING_8 \
-128, /* Overflow signed 8-bit when decremented */ \ -128, /* 减1时溢出的有符号8位值 */ \
-1, /* */ \ -1, /* 通用的有趣值 */ \
0, /* */ \ 0, /* 零值，常用于测试 */ \
1, /* */ \ 1, /* 通用的有趣值 */ \
16, /* One-off with common buffer size */ \ 16, /* 常用缓冲区大小的偏移量 */ \
32, /* One-off with common buffer size */ \ 32, /* 常用缓冲区大小的偏移量 */ \
64, /* One-off with common buffer size */ \ 64, /* 常用缓冲区大小的偏移量 */ \
100, /* One-off with common buffer size */ \ 100, /* 常用缓冲区大小的偏移量 */ \
127 /* Overflow signed 8-bit when incremented */ 127 /* 加1时溢出的有符号8位值 */
/* 定义一组有趣的16位值，用于模糊测试，包括边界值和常见缓冲区大小 */
#define INTERESTING_16 \ #define INTERESTING_16 \
-32768, /* Overflow signed 16-bit when decremented */ \ -32768, /* 减1时溢出的有符号16位值 */ \
-129, /* Overflow signed 8-bit */ \ -129, /* 溢出的有符号8位值 */ \
128, /* Overflow signed 8-bit */ \ 128, /* 溢出的有符号8位值 */ \
255, /* Overflow unsig 8-bit when incremented */ \ 255, /* 增1时溢出的无符号8位值 */ \
256, /* Overflow unsig 8-bit */ \ 256, /* 溢出的无符号8位值 */ \
512, /* One-off with common buffer size */ \ 512, /* 常用缓冲区大小的偏移量 */ \
1000, /* One-off with common buffer size */ \ 1000, /* 常用缓冲区大小的偏移量 */ \
1024, /* One-off with common buffer size */ \ 1024, /* 常用缓冲区大小的偏移量 */ \
4096, /* One-off with common buffer size */ \ 4096, /* 常用缓冲区大小的偏移量 */ \
32767 /* Overflow signed 16-bit when incremented */ 32767 /* 加1时溢出的有符号16位值 */
/* 定义一组有趣的32位值，用于模糊测试，包括边界值和大数值 */
#define INTERESTING_32 \ #define INTERESTING_32 \
-2147483648LL, /* Overflow signed 32-bit when decremented */ \ -2147483648LL, /* 减1时溢出的有符号32位值 */ \
-100663046, /* Large negative number (endian-agnostic) */ \ -100663046, /* 大的负数（与字节序无关） */ \
-32769, /* Overflow signed 16-bit */ \ -32769, /* 溢出的有符号16位值 */ \
32768, /* Overflow signed 16-bit */ \ 32768, /* 溢出的有符号16位值 */ \
65535, /* Overflow unsig 16-bit when incremented */ \ 65535, /* 增1时溢出的无符号16位值 */ \
65536, /* Overflow unsig 16 bit */ \ 65536, /* 溢出的无符号16位值 */ \
100663045, /* Large positive number (endian-agnostic) */ \ 100663045, /* 大的正数（与字节序无关） */ \
2147483647 /* Overflow signed 32-bit when incremented */ 2147483647 /* 加1时溢出的有符号32位值 */
/*********************************************************** /***********************************************************
* * * *
@ -265,98 +232,66 @@
* * * *
***********************************************************/ ***********************************************************/
/* Call count interval between reseeding the libc PRNG from /dev/urandom: */ /* 定义 libc 伪随机数生成器重新播种的调用计数间隔 */
#define RESEED_RNG 10000 #define RESEED_RNG 10000
/* Maximum line length passed from GCC to 'as' and used for parsing /* 定义从 GCC 传递给 'as' 的最大行长度，并用于解析配置文件 */
configuration files: */
#define MAX_LINE 8192 #define MAX_LINE 8192
/* Environment variable used to pass SHM ID to the called program. */ /* 定义用于传递共享内存ID给被调用程序的环境变量 */
#define SHM_ENV_VAR "__AFL_SHM_ID" #define SHM_ENV_VAR "__AFL_SHM_ID"
/* Other less interesting, internal-only variables. */ /* 定义其他不太有趣，仅内部使用的变量 */
#define CLANG_ENV_VAR "__AFL_CLANG_MODE" #define CLANG_ENV_VAR "__AFL_CLANG_MODE"
#define AS_LOOP_ENV_VAR "__AFL_AS_LOOPCHECK" #define AS_LOOP_ENV_VAR "__AFL_AS_LOOPCHECK"
#define PERSIST_ENV_VAR "__AFL_PERSISTENT" #define PERSIST_ENV_VAR "__AFL_PERSISTENT"
#define DEFER_ENV_VAR "__AFL_DEFER_FORKSRV" #define DEFER_ENV_VAR "__AFL_DEFER_FORKSRV"
/* In-code signatures for deferred and persistent mode. */ /* 定义代码中用于延迟和持久模式的签名 */
#define PERSIST_SIG "##SIG_AFL_PERSISTENT##" #define PERSIST_SIG "##SIG_AFL_PERSISTENT##"
#define DEFER_SIG "##SIG_AFL_DEFER_FORKSRV##" #define DEFER_SIG "##SIG_AFL_DEFER_FORKSRV##"
/* Distinctive bitmap signature used to indicate failed execution: */ /* 定义用于表示执行失败的独特位图签名 */
#define EXEC_FAIL_SIG 0xfee1dead #define EXEC_FAIL_SIG 0xfee1dead
/* Distinctive exit code used to indicate MSAN trip condition: */ /* 定义用于表示MSAN（内存sanitizer）触发条件的独特退出代码 */
#define MSAN_ERROR 86 #define MSAN_ERROR 86
/* Designated file descriptors for forkserver commands (the application will /* 定义用于fork服务器命令的指定文件描述符 */
use FORKSRV_FD and FORKSRV_FD + 1): */
#define FORKSRV_FD 198 #define FORKSRV_FD 198
/* Fork server init timeout multiplier: we'll wait the user-selected /* 定义fork服务器初始化超时乘数 */
timeout plus this much for the fork server to spin up. */
#define FORK_WAIT_MULT 10 #define FORK_WAIT_MULT 10
/* Calibration timeout adjustments, to be a bit more generous when resuming /* 定义校准超时调整，恢复模糊测试会话或校准已添加的内部发现时更加宽松 */
fuzzing sessions or trying to calibrate already-added internal finds.
The first value is a percentage, the other is in milliseconds: */
#define CAL_TMOUT_PERC 125 #define CAL_TMOUT_PERC 125
#define CAL_TMOUT_ADD 50 #define CAL_TMOUT_ADD 50
/* Number of chances to calibrate a case before giving up: */ /* 定义校准一个案例前放弃的机会数 */
#define CAL_CHANCES 3 #define CAL_CHANCES 3
/* Map size for the traced binary (2^MAP_SIZE_POW2). Must be greater than /* 定义跟踪二进制文件的映射大小 */
2; you probably want to keep it under 18 or so for performance reasons
(adjusting AFL_INST_RATIO when compiling is probably a better way to solve
problems with complex programs). You need to recompile the target binary
after changing this - otherwise, SEGVs may ensue. */
#define MAP_SIZE_POW2 16 #define MAP_SIZE_POW2 16
#define MAP_SIZE (1 << MAP_SIZE_POW2) #define MAP_SIZE (1 << MAP_SIZE_POW2)
/* Maximum allocator request size (keep well under INT_MAX): */ /* 定义最大分配请求大小 */
#define MAX_ALLOC 0x40000000 #define MAX_ALLOC 0x40000000
/* A made-up hashing seed: */ /* 定义一个虚构的哈希种子 */
#define HASH_CONST 0xa5b35705 #define HASH_CONST 0xa5b35705
/* Constants for afl-gotcpu to control busy loop timing: */ /* 定义 afl-gotcpu 控制忙循环计时的常量 */
#define CTEST_TARGET_MS 5000 #define CTEST_TARGET_MS 5000
#define CTEST_CORE_TRG_MS 1000 #define CTEST_CORE_TRG_MS 1000
#define CTEST_BUSY_CYCLES (10 * 1000 * 1000) #define CTEST_BUSY_CYCLES (10 * 1000 * 1000)
/* Uncomment this to use inferior block-coverage-based instrumentation. Note /* 如果需要使用基于块覆盖的仪器，取消注释此宏 */
that you need to recompile the target binary for this to have any effect: */
// #define COVERAGE_ONLY // #define COVERAGE_ONLY
/* Uncomment this to ignore hit counts and output just one bit per tuple. /* 如果需要忽略命中计数并且每个元组只输出一个位，取消注释此宏 */
As with the previous setting, you will need to recompile the target
binary: */
// #define SKIP_COUNTS // #define SKIP_COUNTS
/* Uncomment this to use instrumentation data to record newly discovered paths, /* 如果需要使用仪器数据记录新发现的路径，但不使用它们作为模糊测试的种子，取消注释此宏 */
but do not use them as seeds for fuzzing. This is useful for conveniently
measuring coverage that could be attained by a "dumb" fuzzing algorithm: */
// #define IGNORE_FINDS // #define IGNORE_FINDS
#endif /* ! _HAVE_CONFIG_H */ #endif /* ! _HAVE_CONFIG_H */
Write Preview
Loading…
Cancel
Save