"
-echo
-
-if [ ! "$#" = "2" ]; then
-
- cat 1>&2 <<_EOF_
-This program generates gnuplot images from afl-fuzz output data. Usage:
-
-$0 afl_state_dir graph_output_dir
-
-The afl_state_dir parameter should point to an existing state directory for any
-active or stopped instance of afl-fuzz; while graph_output_dir should point to
-an empty directory where this tool can write the resulting plots to.
-
-The program will put index.html and three PNG images in the output directory;
-you should be able to view it with any web browser of your choice.
-
-_EOF_
-
- exit 1
-
-fi
-
-if [ "$AFL_ALLOW_TMP" = "" ]; then
-
- echo "$1" | grep -qE '^(/var)?/tmp/'
- T1="$?"
-
- echo "$2" | grep -qE '^(/var)?/tmp/'
- T2="$?"
-
- if [ "$T1" = "0" -o "$T2" = "0" ]; then
-
- echo "[-] Error: this script shouldn't be used with shared /tmp directories." 1>&2
- exit 1
-
- fi
-
-fi
-
-if [ ! -f "$1/plot_data" ]; then
-
- echo "[-] Error: input directory is not valid (missing 'plot_data')." 1>&2
- exit 1
-
-fi
-
-BANNER="`cat "$1/fuzzer_stats" | grep '^afl_banner ' | cut -d: -f2- | cut -b2-`"
-
-test "$BANNER" = "" && BANNER="(none)"
-
-GNUPLOT=`which gnuplot 2>/dev/null`
-
-if [ "$GNUPLOT" = "" ]; then
-
- echo "[-] Error: can't find 'gnuplot' in your \$PATH." 1>&2
- exit 1
-
-fi
-
-mkdir "$2" 2>/dev/null
-
-if [ ! -d "$2" ]; then
-
- echo "[-] Error: unable to create the output directory - pick another location." 1>&2
- exit 1
-
-fi
-
-rm -f "$2/high_freq.png" "$2/low_freq.png" "$2/exec_speed.png"
-mv -f "$2/index.html" "$2/index.html.orig" 2>/dev/null
-
-echo "[*] Generating plots..."
-
-(
-
-cat <<_EOF_
-set terminal png truecolor enhanced size 1000,300 butt
-
-set output '$2/high_freq.png'
-
-set xdata time
-set timefmt '%s'
-set format x "%b %d\n%H:%M"
-set tics font 'small'
-unset mxtics
-unset mytics
-
-set grid xtics linetype 0 linecolor rgb '#e0e0e0'
-set grid ytics linetype 0 linecolor rgb '#e0e0e0'
-set border linecolor rgb '#50c0f0'
-set tics textcolor rgb '#000000'
-set key outside
-
-set autoscale xfixmin
-set autoscale xfixmax
-
-plot '$1/plot_data' using 1:4 with filledcurve x1 title 'total paths' linecolor rgb '#000000' fillstyle transparent solid 0.2 noborder, \\
- '' using 1:3 with filledcurve x1 title 'current path' linecolor rgb '#f0f0f0' fillstyle transparent solid 0.5 noborder, \\
- '' using 1:5 with lines title 'pending paths' linecolor rgb '#0090ff' linewidth 3, \\
- '' using 1:6 with lines title 'pending favs' linecolor rgb '#c00080' linewidth 3, \\
- '' using 1:2 with lines title 'cycles done' linecolor rgb '#c000f0' linewidth 3
-
-set terminal png truecolor enhanced size 1000,200 butt
-set output '$2/low_freq.png'
-
-plot '$1/plot_data' using 1:8 with filledcurve x1 title '' linecolor rgb '#c00080' fillstyle transparent solid 0.2 noborder, \\
- '' using 1:8 with lines title ' uniq crashes' linecolor rgb '#c00080' linewidth 3, \\
- '' using 1:9 with lines title 'uniq hangs' linecolor rgb '#c000f0' linewidth 3, \\
- '' using 1:10 with lines title 'levels' linecolor rgb '#0090ff' linewidth 3
-
-set terminal png truecolor enhanced size 1000,200 butt
-set output '$2/exec_speed.png'
-
-plot '$1/plot_data' using 1:11 with filledcurve x1 title '' linecolor rgb '#0090ff' fillstyle transparent solid 0.2 noborder, \\
- '$1/plot_data' using 1:11 with lines title ' execs/sec' linecolor rgb '#0090ff' linewidth 3 smooth bezier;
-
-_EOF_
-
-) | gnuplot
-
-if [ ! -s "$2/exec_speed.png" ]; then
-
- echo "[-] Error: something went wrong! Perhaps you have an ancient version of gnuplot?" 1>&2
- exit 1
-
-fi
-
-echo "[*] Generating index.html..."
-
-cat >"$2/index.html" <<_EOF_
-
-| Banner: | $BANNER |
-| Directory: | $1 |
-| Generated on: | `date` |
-
-
-
-
-
-
-_EOF_
-
-# Make it easy to remotely view results when outputting directly to a directory
-# served by Apache or other HTTP daemon. Since the plots aren't horribly
-# sensitive, this seems like a reasonable trade-off.
-
-chmod 755 "$2"
-chmod 644 "$2/high_freq.png" "$2/low_freq.png" "$2/exec_speed.png" "$2/index.html"
-
-echo "[+] All done - enjoy your charts!"
-
-exit 0
+#!/bin/sh
+#
+# american fuzzy lop - Advanced Persistent Graphing
+# -------------------------------------------------
+#
+# Written and maintained by Michal Zalewski
+# Based on a design & prototype by Michael Rash.
+#
+# Copyright 2014, 2015 Google LLC All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+
+echo "progress plotting utility for afl-fuzz by "
+echo
+
+if [ ! "$#" = "2" ]; then
+
+ cat 1>&2 <<_EOF_
+This program generates gnuplot images from afl-fuzz output data. Usage:
+
+$0 afl_state_dir graph_output_dir
+
+The afl_state_dir parameter should point to an existing state directory for any
+active or stopped instance of afl-fuzz; while graph_output_dir should point to
+an empty directory where this tool can write the resulting plots to.
+
+The program will put index.html and three PNG images in the output directory;
+you should be able to view it with any web browser of your choice.
+
+_EOF_
+
+ exit 1
+
+fi
+
+if [ "$AFL_ALLOW_TMP" = "" ]; then
+
+ echo "$1" | grep -qE '^(/var)?/tmp/'
+ T1="$?"
+
+ echo "$2" | grep -qE '^(/var)?/tmp/'
+ T2="$?"
+
+ if [ "$T1" = "0" -o "$T2" = "0" ]; then
+
+ echo "[-] Error: this script shouldn't be used with shared /tmp directories." 1>&2
+ exit 1
+
+ fi
+
+fi
+
+if [ ! -f "$1/plot_data" ]; then
+
+ echo "[-] Error: input directory is not valid (missing 'plot_data')." 1>&2
+ exit 1
+
+fi
+
+BANNER="`cat "$1/fuzzer_stats" | grep '^afl_banner ' | cut -d: -f2- | cut -b2-`"
+
+test "$BANNER" = "" && BANNER="(none)"
+
+GNUPLOT=`which gnuplot 2>/dev/null`
+
+if [ "$GNUPLOT" = "" ]; then
+
+ echo "[-] Error: can't find 'gnuplot' in your \$PATH." 1>&2
+ exit 1
+
+fi
+
+mkdir "$2" 2>/dev/null
+
+if [ ! -d "$2" ]; then
+
+ echo "[-] Error: unable to create the output directory - pick another location." 1>&2
+ exit 1
+
+fi
+
+rm -f "$2/high_freq.png" "$2/low_freq.png" "$2/exec_speed.png"
+mv -f "$2/index.html" "$2/index.html.orig" 2>/dev/null
+
+echo "[*] Generating plots..."
+
+(
+
+cat <<_EOF_
+set terminal png truecolor enhanced size 1000,300 butt
+
+set output '$2/high_freq.png'
+
+set xdata time
+set timefmt '%s'
+set format x "%b %d\n%H:%M"
+set tics font 'small'
+unset mxtics
+unset mytics
+
+set grid xtics linetype 0 linecolor rgb '#e0e0e0'
+set grid ytics linetype 0 linecolor rgb '#e0e0e0'
+set border linecolor rgb '#50c0f0'
+set tics textcolor rgb '#000000'
+set key outside
+
+set autoscale xfixmin
+set autoscale xfixmax
+
+plot '$1/plot_data' using 1:4 with filledcurve x1 title 'total paths' linecolor rgb '#000000' fillstyle transparent solid 0.2 noborder, \\
+ '' using 1:3 with filledcurve x1 title 'current path' linecolor rgb '#f0f0f0' fillstyle transparent solid 0.5 noborder, \\
+ '' using 1:5 with lines title 'pending paths' linecolor rgb '#0090ff' linewidth 3, \\
+ '' using 1:6 with lines title 'pending favs' linecolor rgb '#c00080' linewidth 3, \\
+ '' using 1:2 with lines title 'cycles done' linecolor rgb '#c000f0' linewidth 3
+
+set terminal png truecolor enhanced size 1000,200 butt
+set output '$2/low_freq.png'
+
+plot '$1/plot_data' using 1:8 with filledcurve x1 title '' linecolor rgb '#c00080' fillstyle transparent solid 0.2 noborder, \\
+ '' using 1:8 with lines title ' uniq crashes' linecolor rgb '#c00080' linewidth 3, \\
+ '' using 1:9 with lines title 'uniq hangs' linecolor rgb '#c000f0' linewidth 3, \\
+ '' using 1:10 with lines title 'levels' linecolor rgb '#0090ff' linewidth 3
+
+set terminal png truecolor enhanced size 1000,200 butt
+set output '$2/exec_speed.png'
+
+plot '$1/plot_data' using 1:11 with filledcurve x1 title '' linecolor rgb '#0090ff' fillstyle transparent solid 0.2 noborder, \\
+ '$1/plot_data' using 1:11 with lines title ' execs/sec' linecolor rgb '#0090ff' linewidth 3 smooth bezier;
+
+_EOF_
+
+) | gnuplot
+
+if [ ! -s "$2/exec_speed.png" ]; then
+
+ echo "[-] Error: something went wrong! Perhaps you have an ancient version of gnuplot?" 1>&2
+ exit 1
+
+fi
+
+echo "[*] Generating index.html..."
+
+cat >"$2/index.html" <<_EOF_
+
+| Banner: | $BANNER |
+| Directory: | $1 |
+| Generated on: | `date` |
+
+
+
+
+
+
+_EOF_
+
+# Make it easy to remotely view results when outputting directly to a directory
+# served by Apache or other HTTP daemon. Since the plots aren't horribly
+# sensitive, this seems like a reasonable trade-off.
+
+chmod 755 "$2"
+chmod 644 "$2/high_freq.png" "$2/low_freq.png" "$2/exec_speed.png" "$2/index.html"
+
+echo "[+] All done - enjoy your charts!"
+
+exit 0
diff --git a/afl-showmap.c b/afl-showmap.c
index 66dfbc5..4af6518 100644
--- a/afl-showmap.c
+++ b/afl-showmap.c
@@ -1,795 +1,795 @@
-/*
- Copyright 2013 Google LLC All rights reserved.
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at:
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
-*/
-
-/*
- american fuzzy lop - map display utility
- ----------------------------------------
-
- Written and maintained by Michal Zalewski
-
- A very simple tool that runs the targeted binary and displays
- the contents of the trace bitmap in a human-readable form. Useful in
- scripts to eliminate redundant inputs and perform other checks.
-
- Exit code is 2 if the target program crashes; 1 if it times out or
- there is a problem executing it; or 0 if execution is successful.
-*/
-
-#define AFL_MAIN
-#include "android-ashmem.h"
-
-#include "config.h"
-#include "types.h"
-#include "debug.h"
-#include "alloc-inl.h"
-#include "hash.h"
-
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-
-#include
-#include
-#include
-#include
-#include
-#include
-
-static s32 child_pid; /* PID of the tested program */
-
-static u8* trace_bits; /* SHM with instrumentation bitmap */
-
-static u8 *out_file, /* Trace output file */
- *doc_path, /* Path to docs */
- *target_path, /* Path to target binary */
- *at_file; /* Substitution string for @@ */
-
-static u32 exec_tmout; /* Exec timeout (ms) */
-
-static u64 mem_limit = MEM_LIMIT; /* Memory limit (MB) */
-
-static s32 shm_id; /* ID of the SHM region */
-
-static u8 quiet_mode, /* Hide non-essential messages? */
- edges_only, /* Ignore hit counts? */
- cmin_mode, /* Generate output in afl-cmin mode? */
- binary_mode, /* Write output as a binary map */
- keep_cores; /* Allow coredumps? */
-
-static volatile u8
- stop_soon, /* Ctrl-C pressed? */
- child_timed_out, /* Child timed out? */
- child_crashed; /* Child crashed? */
-
-/* Classify tuple counts. Instead of mapping to individual bits, as in
- afl-fuzz.c, we map to more user-friendly numbers between 1 and 8. */
-
-static const u8 count_class_human[256] = {
-
- [0] = 0,
- [1] = 1,
- [2] = 2,
- [3] = 3,
- [4 ... 7] = 4,
- [8 ... 15] = 5,
- [16 ... 31] = 6,
- [32 ... 127] = 7,
- [128 ... 255] = 8
-
-};
-
-static const u8 count_class_binary[256] = {
-
- [0] = 0,
- [1] = 1,
- [2] = 2,
- [3] = 4,
- [4 ... 7] = 8,
- [8 ... 15] = 16,
- [16 ... 31] = 32,
- [32 ... 127] = 64,
- [128 ... 255] = 128
-
-};
-
-static void classify_counts(u8* mem, const u8* map) {
-
- u32 i = MAP_SIZE;
-
- if (edges_only) {
-
- while (i--) {
- if (*mem) *mem = 1;
- mem++;
- }
-
- } else {
-
- while (i--) {
- *mem = map[*mem];
- mem++;
- }
-
- }
-
-}
-
-
-/* Get rid of shared memory (atexit handler). */
-
-static void remove_shm(void) {
-
- shmctl(shm_id, IPC_RMID, NULL);
-
-}
-
-
-/* Configure shared memory. */
-
-static void setup_shm(void) {
-
- u8* shm_str;
-
- shm_id = shmget(IPC_PRIVATE, MAP_SIZE, IPC_CREAT | IPC_EXCL | 0600);
-
- if (shm_id < 0) PFATAL("shmget() failed");
-
- atexit(remove_shm);
-
- shm_str = alloc_printf("%d", shm_id);
-
- setenv(SHM_ENV_VAR, shm_str, 1);
-
- ck_free(shm_str);
-
- trace_bits = shmat(shm_id, NULL, 0);
-
- if (trace_bits == (void *)-1) PFATAL("shmat() failed");
-
-}
-
-/* Write results. */
-
-static u32 write_results(void) {
-
- s32 fd;
- u32 i, ret = 0;
-
- u8 cco = !!getenv("AFL_CMIN_CRASHES_ONLY"),
- caa = !!getenv("AFL_CMIN_ALLOW_ANY");
-
- if (!strncmp(out_file, "/dev/", 5)) {
-
- fd = open(out_file, O_WRONLY, 0600);
- if (fd < 0) PFATAL("Unable to open '%s'", out_file);
-
- } else if (!strcmp(out_file, "-")) {
-
- fd = dup(1);
- if (fd < 0) PFATAL("Unable to open stdout");
-
- } else {
-
- unlink(out_file); /* Ignore errors */
- fd = open(out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
- if (fd < 0) PFATAL("Unable to create '%s'", out_file);
-
- }
-
-
- if (binary_mode) {
-
- for (i = 0; i < MAP_SIZE; i++)
- if (trace_bits[i]) ret++;
-
- ck_write(fd, trace_bits, MAP_SIZE, out_file);
- close(fd);
-
- } else {
-
- FILE* f = fdopen(fd, "w");
-
- if (!f) PFATAL("fdopen() failed");
-
- for (i = 0; i < MAP_SIZE; i++) {
-
- if (!trace_bits[i]) continue;
- ret++;
-
- if (cmin_mode) {
-
- if (child_timed_out) break;
- if (!caa && child_crashed != cco) break;
-
- fprintf(f, "%u%u\n", trace_bits[i], i);
-
- } else fprintf(f, "%06u:%u\n", i, trace_bits[i]);
-
- }
-
- fclose(f);
-
- }
-
- return ret;
-
-}
-
-
-/* Handle timeout signal. */
-
-static void handle_timeout(int sig) {
-
- child_timed_out = 1;
- if (child_pid > 0) kill(child_pid, SIGKILL);
-
-}
-
-
-/* Execute target application. */
-
-static void run_target(char** argv) {
-
- static struct itimerval it;
- int status = 0;
-
- if (!quiet_mode)
- SAYF("-- Program output begins --\n" cRST);
-
- MEM_BARRIER();
-
- child_pid = fork();
-
- if (child_pid < 0) PFATAL("fork() failed");
-
- if (!child_pid) {
-
- struct rlimit r;
-
- if (quiet_mode) {
-
- s32 fd = open("/dev/null", O_RDWR);
-
- if (fd < 0 || dup2(fd, 1) < 0 || dup2(fd, 2) < 0) {
- *(u32*)trace_bits = EXEC_FAIL_SIG;
- PFATAL("Descriptor initialization failed");
- }
-
- close(fd);
-
- }
-
- if (mem_limit) {
-
- r.rlim_max = r.rlim_cur = ((rlim_t)mem_limit) << 20;
-
-#ifdef RLIMIT_AS
-
- setrlimit(RLIMIT_AS, &r); /* Ignore errors */
-
-#else
-
- setrlimit(RLIMIT_DATA, &r); /* Ignore errors */
-
-#endif /* ^RLIMIT_AS */
-
- }
-
- if (!keep_cores) r.rlim_max = r.rlim_cur = 0;
- else r.rlim_max = r.rlim_cur = RLIM_INFINITY;
-
- setrlimit(RLIMIT_CORE, &r); /* Ignore errors */
-
- if (!getenv("LD_BIND_LAZY")) setenv("LD_BIND_NOW", "1", 0);
-
- setsid();
-
- execv(target_path, argv);
-
- *(u32*)trace_bits = EXEC_FAIL_SIG;
- exit(0);
-
- }
-
- /* Configure timeout, wait for child, cancel timeout. */
-
- if (exec_tmout) {
-
- child_timed_out = 0;
- it.it_value.tv_sec = (exec_tmout / 1000);
- it.it_value.tv_usec = (exec_tmout % 1000) * 1000;
-
- }
-
- setitimer(ITIMER_REAL, &it, NULL);
-
- if (waitpid(child_pid, &status, 0) <= 0) FATAL("waitpid() failed");
-
- child_pid = 0;
- it.it_value.tv_sec = 0;
- it.it_value.tv_usec = 0;
- setitimer(ITIMER_REAL, &it, NULL);
-
- MEM_BARRIER();
-
- /* Clean up bitmap, analyze exit condition, etc. */
-
- if (*(u32*)trace_bits == EXEC_FAIL_SIG)
- FATAL("Unable to execute '%s'", argv[0]);
-
- classify_counts(trace_bits, binary_mode ?
- count_class_binary : count_class_human);
-
- if (!quiet_mode)
- SAYF(cRST "-- Program output ends --\n");
-
- if (!child_timed_out && !stop_soon && WIFSIGNALED(status))
- child_crashed = 1;
-
- if (!quiet_mode) {
-
- if (child_timed_out)
- SAYF(cLRD "\n+++ Program timed off +++\n" cRST);
- else if (stop_soon)
- SAYF(cLRD "\n+++ Program aborted by user +++\n" cRST);
- else if (child_crashed)
- SAYF(cLRD "\n+++ Program killed by signal %u +++\n" cRST, WTERMSIG(status));
-
- }
-
-
-}
-
-
-/* Handle Ctrl-C and the like. */
-
-static void handle_stop_sig(int sig) {
-
- stop_soon = 1;
-
- if (child_pid > 0) kill(child_pid, SIGKILL);
-
-}
-
-
-/* Do basic preparations - persistent fds, filenames, etc. */
-
-static void set_up_environment(void) {
-
- setenv("ASAN_OPTIONS", "abort_on_error=1:"
- "detect_leaks=0:"
- "symbolize=0:"
- "allocator_may_return_null=1", 0);
-
- setenv("MSAN_OPTIONS", "exit_code=" STRINGIFY(MSAN_ERROR) ":"
- "symbolize=0:"
- "abort_on_error=1:"
- "allocator_may_return_null=1:"
- "msan_track_origins=0", 0);
-
- if (getenv("AFL_PRELOAD")) {
- setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
- setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
- }
-
-}
-
-
-/* Setup signal handlers, duh. */
-
-static void setup_signal_handlers(void) {
-
- struct sigaction sa;
-
- sa.sa_handler = NULL;
- sa.sa_flags = SA_RESTART;
- sa.sa_sigaction = NULL;
-
- sigemptyset(&sa.sa_mask);
-
- /* Various ways of saying "stop". */
-
- sa.sa_handler = handle_stop_sig;
- sigaction(SIGHUP, &sa, NULL);
- sigaction(SIGINT, &sa, NULL);
- sigaction(SIGTERM, &sa, NULL);
-
- /* Exec timeout notifications. */
-
- sa.sa_handler = handle_timeout;
- sigaction(SIGALRM, &sa, NULL);
-
-}
-
-
-/* Detect @@ in args. */
-
-static void detect_file_args(char** argv) {
-
- u32 i = 0;
- u8* cwd = getcwd(NULL, 0);
-
- if (!cwd) PFATAL("getcwd() failed");
-
- while (argv[i]) {
-
- u8* aa_loc = strstr(argv[i], "@@");
-
- if (aa_loc) {
-
- u8 *aa_subst, *n_arg;
-
- if (!at_file) FATAL("@@ syntax is not supported by this tool.");
-
- /* Be sure that we're always using fully-qualified paths. */
-
- if (at_file[0] == '/') aa_subst = at_file;
- else aa_subst = alloc_printf("%s/%s", cwd, at_file);
-
- /* Construct a replacement argv value. */
-
- *aa_loc = 0;
- n_arg = alloc_printf("%s%s%s", argv[i], aa_subst, aa_loc + 2);
- argv[i] = n_arg;
- *aa_loc = '@';
-
- if (at_file[0] != '/') ck_free(aa_subst);
-
- }
-
- i++;
-
- }
-
- free(cwd); /* not tracked */
-
-}
-
-
-/* Show banner. */
-
-static void show_banner(void) {
-
- SAYF(cCYA "afl-showmap " cBRI VERSION cRST " by \n");
-
-}
-
-/* Display usage hints. */
-
-static void usage(u8* argv0) {
-
- show_banner();
-
- SAYF("\n%s [ options ] -- /path/to/target_app [ ... ]\n\n"
-
- "Required parameters:\n\n"
-
- " -o file - file to write the trace data to\n\n"
-
- "Execution control settings:\n\n"
-
- " -t msec - timeout for each run (none)\n"
- " -m megs - memory limit for child process (%u MB)\n"
- " -Q - use binary-only instrumentation (QEMU mode)\n\n"
-
- "Other settings:\n\n"
-
- " -q - sink program's output and don't show messages\n"
- " -e - show edge coverage only, ignore hit counts\n"
- " -c - allow core dumps\n"
- " -V - show version number and exit\n\n"
-
- "This tool displays raw tuple data captured by AFL instrumentation.\n"
- "For additional help, consult %s/README.\n\n" cRST,
-
- argv0, MEM_LIMIT, doc_path);
-
- exit(1);
-
-}
-
-
-/* Find binary. */
-
-static void find_binary(u8* fname) {
-
- u8* env_path = 0;
- struct stat st;
-
- if (strchr(fname, '/') || !(env_path = getenv("PATH"))) {
-
- target_path = ck_strdup(fname);
-
- if (stat(target_path, &st) || !S_ISREG(st.st_mode) ||
- !(st.st_mode & 0111) || st.st_size < 4)
- FATAL("Program '%s' not found or not executable", fname);
-
- } else {
-
- while (env_path) {
-
- u8 *cur_elem, *delim = strchr(env_path, ':');
-
- if (delim) {
-
- cur_elem = ck_alloc(delim - env_path + 1);
- memcpy(cur_elem, env_path, delim - env_path);
- delim++;
-
- } else cur_elem = ck_strdup(env_path);
-
- env_path = delim;
-
- if (cur_elem[0])
- target_path = alloc_printf("%s/%s", cur_elem, fname);
- else
- target_path = ck_strdup(fname);
-
- ck_free(cur_elem);
-
- if (!stat(target_path, &st) && S_ISREG(st.st_mode) &&
- (st.st_mode & 0111) && st.st_size >= 4) break;
-
- ck_free(target_path);
- target_path = 0;
-
- }
-
- if (!target_path) FATAL("Program '%s' not found or not executable", fname);
-
- }
-
-}
-
-
-/* Fix up argv for QEMU. */
-
-static char** get_qemu_argv(u8* own_loc, char** argv, int argc) {
-
- char** new_argv = ck_alloc(sizeof(char*) * (argc + 4));
- u8 *tmp, *cp, *rsl, *own_copy;
-
- /* Workaround for a QEMU stability glitch. */
-
- setenv("QEMU_LOG", "nochain", 1);
-
- memcpy(new_argv + 3, argv + 1, sizeof(char*) * argc);
-
- new_argv[2] = target_path;
- new_argv[1] = "--";
-
- /* Now we need to actually find qemu for argv[0]. */
-
- tmp = getenv("AFL_PATH");
-
- if (tmp) {
-
- cp = alloc_printf("%s/afl-qemu-trace", tmp);
-
- if (access(cp, X_OK))
- FATAL("Unable to find '%s'", tmp);
-
- target_path = new_argv[0] = cp;
- return new_argv;
-
- }
-
- own_copy = ck_strdup(own_loc);
- rsl = strrchr(own_copy, '/');
-
- if (rsl) {
-
- *rsl = 0;
-
- cp = alloc_printf("%s/afl-qemu-trace", own_copy);
- ck_free(own_copy);
-
- if (!access(cp, X_OK)) {
-
- target_path = new_argv[0] = cp;
- return new_argv;
-
- }
-
- } else ck_free(own_copy);
-
- if (!access(BIN_PATH "/afl-qemu-trace", X_OK)) {
-
- target_path = new_argv[0] = BIN_PATH "/afl-qemu-trace";
- return new_argv;
-
- }
-
- FATAL("Unable to find 'afl-qemu-trace'.");
-
-}
-
-
-/* Main entry point */
-
-int main(int argc, char** argv) {
-
- s32 opt;
- u8 mem_limit_given = 0, timeout_given = 0, qemu_mode = 0;
- u32 tcnt;
- char** use_argv;
-
- doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH;
-
- while ((opt = getopt(argc,argv,"+o:m:t:A:eqZQbcV")) > 0)
-
- switch (opt) {
-
- case 'o':
-
- if (out_file) FATAL("Multiple -o options not supported");
- out_file = optarg;
- break;
-
- case 'm': {
-
- u8 suffix = 'M';
-
- if (mem_limit_given) FATAL("Multiple -m options not supported");
- mem_limit_given = 1;
-
- if (!strcmp(optarg, "none")) {
-
- mem_limit = 0;
- break;
-
- }
-
- if (sscanf(optarg, "%llu%c", &mem_limit, &suffix) < 1 ||
- optarg[0] == '-') FATAL("Bad syntax used for -m");
-
- switch (suffix) {
-
- case 'T': mem_limit *= 1024 * 1024; break;
- case 'G': mem_limit *= 1024; break;
- case 'k': mem_limit /= 1024; break;
- case 'M': break;
-
- default: FATAL("Unsupported suffix or bad syntax for -m");
-
- }
-
- if (mem_limit < 5) FATAL("Dangerously low value of -m");
-
- if (sizeof(rlim_t) == 4 && mem_limit > 2000)
- FATAL("Value of -m out of range on 32-bit systems");
-
- }
-
- break;
-
- case 't':
-
- if (timeout_given) FATAL("Multiple -t options not supported");
- timeout_given = 1;
-
- if (strcmp(optarg, "none")) {
- exec_tmout = atoi(optarg);
-
- if (exec_tmout < 20 || optarg[0] == '-')
- FATAL("Dangerously low value of -t");
-
- }
-
- break;
-
- case 'e':
-
- if (edges_only) FATAL("Multiple -e options not supported");
- edges_only = 1;
- break;
-
- case 'q':
-
- if (quiet_mode) FATAL("Multiple -q options not supported");
- quiet_mode = 1;
- break;
-
- case 'Z':
-
- /* This is an undocumented option to write data in the syntax expected
- by afl-cmin. Nobody else should have any use for this. */
-
- cmin_mode = 1;
- quiet_mode = 1;
- break;
-
- case 'A':
-
- /* Another afl-cmin specific feature. */
- at_file = optarg;
- break;
-
- case 'Q':
-
- if (qemu_mode) FATAL("Multiple -Q options not supported");
- if (!mem_limit_given) mem_limit = MEM_LIMIT_QEMU;
-
- qemu_mode = 1;
- break;
-
- case 'b':
-
- /* Secret undocumented mode. Writes output in raw binary format
- similar to that dumped by afl-fuzz in
+
+ A very simple tool that runs the targeted binary and displays
+ the contents of the trace bitmap in a human-readable form. Useful in
+ scripts to eliminate redundant inputs and perform other checks.
+
+ Exit code is 2 if the target program crashes; 1 if it times out or
+ there is a problem executing it; or 0 if execution is successful.
+*/
+
+#define AFL_MAIN
+#include "android-ashmem.h"
+
+#include "config.h"
+#include "types.h"
+#include "debug.h"
+#include "alloc-inl.h"
+#include "hash.h"
+
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+
+#include
+#include
+#include
+#include
+#include
+#include
+
+static s32 child_pid; /* PID of the tested program */
+
+static u8* trace_bits; /* SHM with instrumentation bitmap */
+
+static u8 *out_file, /* Trace output file */
+ *doc_path, /* Path to docs */
+ *target_path, /* Path to target binary */
+ *at_file; /* Substitution string for @@ */
+
+static u32 exec_tmout; /* Exec timeout (ms) */
+
+static u64 mem_limit = MEM_LIMIT; /* Memory limit (MB) */
+
+static s32 shm_id; /* ID of the SHM region */
+
+static u8 quiet_mode, /* Hide non-essential messages? */
+ edges_only, /* Ignore hit counts? */
+ cmin_mode, /* Generate output in afl-cmin mode? */
+ binary_mode, /* Write output as a binary map */
+ keep_cores; /* Allow coredumps? */
+
+static volatile u8
+ stop_soon, /* Ctrl-C pressed? */
+ child_timed_out, /* Child timed out? */
+ child_crashed; /* Child crashed? */
+
+/* Classify tuple counts. Instead of mapping to individual bits, as in
+ afl-fuzz.c, we map to more user-friendly numbers between 1 and 8. */
+
+static const u8 count_class_human[256] = {
+
+ [0] = 0,
+ [1] = 1,
+ [2] = 2,
+ [3] = 3,
+ [4 ... 7] = 4,
+ [8 ... 15] = 5,
+ [16 ... 31] = 6,
+ [32 ... 127] = 7,
+ [128 ... 255] = 8
+
+};
+
+static const u8 count_class_binary[256] = {
+
+ [0] = 0,
+ [1] = 1,
+ [2] = 2,
+ [3] = 4,
+ [4 ... 7] = 8,
+ [8 ... 15] = 16,
+ [16 ... 31] = 32,
+ [32 ... 127] = 64,
+ [128 ... 255] = 128
+
+};
+
+static void classify_counts(u8* mem, const u8* map) {
+
+ u32 i = MAP_SIZE;
+
+ if (edges_only) {
+
+ while (i--) {
+ if (*mem) *mem = 1;
+ mem++;
+ }
+
+ } else {
+
+ while (i--) {
+ *mem = map[*mem];
+ mem++;
+ }
+
+ }
+
+}
+
+
+/* Get rid of shared memory (atexit handler). */
+
+static void remove_shm(void) {
+
+ shmctl(shm_id, IPC_RMID, NULL);
+
+}
+
+
+/* Configure shared memory. */
+
+static void setup_shm(void) {
+
+ u8* shm_str;
+
+ shm_id = shmget(IPC_PRIVATE, MAP_SIZE, IPC_CREAT | IPC_EXCL | 0600);
+
+ if (shm_id < 0) PFATAL("shmget() failed");
+
+ atexit(remove_shm);
+
+ shm_str = alloc_printf("%d", shm_id);
+
+ setenv(SHM_ENV_VAR, shm_str, 1);
+
+ ck_free(shm_str);
+
+ trace_bits = shmat(shm_id, NULL, 0);
+
+ if (trace_bits == (void *)-1) PFATAL("shmat() failed");
+
+}
+
+/* Write results. */
+
+static u32 write_results(void) {
+
+ s32 fd;
+ u32 i, ret = 0;
+
+ u8 cco = !!getenv("AFL_CMIN_CRASHES_ONLY"),
+ caa = !!getenv("AFL_CMIN_ALLOW_ANY");
+
+ if (!strncmp(out_file, "/dev/", 5)) {
+
+ fd = open(out_file, O_WRONLY, 0600);
+ if (fd < 0) PFATAL("Unable to open '%s'", out_file);
+
+ } else if (!strcmp(out_file, "-")) {
+
+ fd = dup(1);
+ if (fd < 0) PFATAL("Unable to open stdout");
+
+ } else {
+
+ unlink(out_file); /* Ignore errors */
+ fd = open(out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
+ if (fd < 0) PFATAL("Unable to create '%s'", out_file);
+
+ }
+
+
+ if (binary_mode) {
+
+ for (i = 0; i < MAP_SIZE; i++)
+ if (trace_bits[i]) ret++;
+
+ ck_write(fd, trace_bits, MAP_SIZE, out_file);
+ close(fd);
+
+ } else {
+
+ FILE* f = fdopen(fd, "w");
+
+ if (!f) PFATAL("fdopen() failed");
+
+ for (i = 0; i < MAP_SIZE; i++) {
+
+ if (!trace_bits[i]) continue;
+ ret++;
+
+ if (cmin_mode) {
+
+ if (child_timed_out) break;
+ if (!caa && child_crashed != cco) break;
+
+ fprintf(f, "%u%u\n", trace_bits[i], i);
+
+ } else fprintf(f, "%06u:%u\n", i, trace_bits[i]);
+
+ }
+
+ fclose(f);
+
+ }
+
+ return ret;
+
+}
+
+
+/* Handle timeout signal. */
+
+static void handle_timeout(int sig) {
+
+ child_timed_out = 1;
+ if (child_pid > 0) kill(child_pid, SIGKILL);
+
+}
+
+
+/* Execute target application. */
+
+static void run_target(char** argv) {
+
+ static struct itimerval it;
+ int status = 0;
+
+ if (!quiet_mode)
+ SAYF("-- Program output begins --\n" cRST);
+
+ MEM_BARRIER();
+
+ child_pid = fork();
+
+ if (child_pid < 0) PFATAL("fork() failed");
+
+ if (!child_pid) {
+
+ struct rlimit r;
+
+ if (quiet_mode) {
+
+ s32 fd = open("/dev/null", O_RDWR);
+
+ if (fd < 0 || dup2(fd, 1) < 0 || dup2(fd, 2) < 0) {
+ *(u32*)trace_bits = EXEC_FAIL_SIG;
+ PFATAL("Descriptor initialization failed");
+ }
+
+ close(fd);
+
+ }
+
+ if (mem_limit) {
+
+ r.rlim_max = r.rlim_cur = ((rlim_t)mem_limit) << 20;
+
+#ifdef RLIMIT_AS
+
+ setrlimit(RLIMIT_AS, &r); /* Ignore errors */
+
+#else
+
+ setrlimit(RLIMIT_DATA, &r); /* Ignore errors */
+
+#endif /* ^RLIMIT_AS */
+
+ }
+
+ if (!keep_cores) r.rlim_max = r.rlim_cur = 0;
+ else r.rlim_max = r.rlim_cur = RLIM_INFINITY;
+
+ setrlimit(RLIMIT_CORE, &r); /* Ignore errors */
+
+ if (!getenv("LD_BIND_LAZY")) setenv("LD_BIND_NOW", "1", 0);
+
+ setsid();
+
+ execv(target_path, argv);
+
+ *(u32*)trace_bits = EXEC_FAIL_SIG;
+ exit(0);
+
+ }
+
+ /* Configure timeout, wait for child, cancel timeout. */
+
+ if (exec_tmout) {
+
+ child_timed_out = 0;
+ it.it_value.tv_sec = (exec_tmout / 1000);
+ it.it_value.tv_usec = (exec_tmout % 1000) * 1000;
+
+ }
+
+ setitimer(ITIMER_REAL, &it, NULL);
+
+ if (waitpid(child_pid, &status, 0) <= 0) FATAL("waitpid() failed");
+
+ child_pid = 0;
+ it.it_value.tv_sec = 0;
+ it.it_value.tv_usec = 0;
+ setitimer(ITIMER_REAL, &it, NULL);
+
+ MEM_BARRIER();
+
+ /* Clean up bitmap, analyze exit condition, etc. */
+
+ if (*(u32*)trace_bits == EXEC_FAIL_SIG)
+ FATAL("Unable to execute '%s'", argv[0]);
+
+ classify_counts(trace_bits, binary_mode ?
+ count_class_binary : count_class_human);
+
+ if (!quiet_mode)
+ SAYF(cRST "-- Program output ends --\n");
+
+ if (!child_timed_out && !stop_soon && WIFSIGNALED(status))
+ child_crashed = 1;
+
+ if (!quiet_mode) {
+
+ if (child_timed_out)
+ SAYF(cLRD "\n+++ Program timed off +++\n" cRST);
+ else if (stop_soon)
+ SAYF(cLRD "\n+++ Program aborted by user +++\n" cRST);
+ else if (child_crashed)
+ SAYF(cLRD "\n+++ Program killed by signal %u +++\n" cRST, WTERMSIG(status));
+
+ }
+
+
+}
+
+
+/* Handle Ctrl-C and the like. */
+
+static void handle_stop_sig(int sig) {
+
+ stop_soon = 1;
+
+ if (child_pid > 0) kill(child_pid, SIGKILL);
+
+}
+
+
+/* Do basic preparations - persistent fds, filenames, etc. */
+
+static void set_up_environment(void) {
+
+ setenv("ASAN_OPTIONS", "abort_on_error=1:"
+ "detect_leaks=0:"
+ "symbolize=0:"
+ "allocator_may_return_null=1", 0);
+
+ setenv("MSAN_OPTIONS", "exit_code=" STRINGIFY(MSAN_ERROR) ":"
+ "symbolize=0:"
+ "abort_on_error=1:"
+ "allocator_may_return_null=1:"
+ "msan_track_origins=0", 0);
+
+ if (getenv("AFL_PRELOAD")) {
+ setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
+ setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
+ }
+
+}
+
+
+/* Setup signal handlers, duh. */
+
+static void setup_signal_handlers(void) {
+
+ struct sigaction sa;
+
+ sa.sa_handler = NULL;
+ sa.sa_flags = SA_RESTART;
+ sa.sa_sigaction = NULL;
+
+ sigemptyset(&sa.sa_mask);
+
+ /* Various ways of saying "stop". */
+
+ sa.sa_handler = handle_stop_sig;
+ sigaction(SIGHUP, &sa, NULL);
+ sigaction(SIGINT, &sa, NULL);
+ sigaction(SIGTERM, &sa, NULL);
+
+ /* Exec timeout notifications. */
+
+ sa.sa_handler = handle_timeout;
+ sigaction(SIGALRM, &sa, NULL);
+
+}
+
+
+/* Detect @@ in args. */
+
+static void detect_file_args(char** argv) {
+
+ u32 i = 0;
+ u8* cwd = getcwd(NULL, 0);
+
+ if (!cwd) PFATAL("getcwd() failed");
+
+ while (argv[i]) {
+
+ u8* aa_loc = strstr(argv[i], "@@");
+
+ if (aa_loc) {
+
+ u8 *aa_subst, *n_arg;
+
+ if (!at_file) FATAL("@@ syntax is not supported by this tool.");
+
+ /* Be sure that we're always using fully-qualified paths. */
+
+ if (at_file[0] == '/') aa_subst = at_file;
+ else aa_subst = alloc_printf("%s/%s", cwd, at_file);
+
+ /* Construct a replacement argv value. */
+
+ *aa_loc = 0;
+ n_arg = alloc_printf("%s%s%s", argv[i], aa_subst, aa_loc + 2);
+ argv[i] = n_arg;
+ *aa_loc = '@';
+
+ if (at_file[0] != '/') ck_free(aa_subst);
+
+ }
+
+ i++;
+
+ }
+
+ free(cwd); /* not tracked */
+
+}
+
+
+/* Show banner. */
+
+static void show_banner(void) {
+
+ SAYF(cCYA "afl-showmap " cBRI VERSION cRST " by \n");
+
+}
+
+/* Display usage hints. */
+
+static void usage(u8* argv0) {
+
+ show_banner();
+
+ SAYF("\n%s [ options ] -- /path/to/target_app [ ... ]\n\n"
+
+ "Required parameters:\n\n"
+
+ " -o file - file to write the trace data to\n\n"
+
+ "Execution control settings:\n\n"
+
+ " -t msec - timeout for each run (none)\n"
+ " -m megs - memory limit for child process (%u MB)\n"
+ " -Q - use binary-only instrumentation (QEMU mode)\n\n"
+
+ "Other settings:\n\n"
+
+ " -q - sink program's output and don't show messages\n"
+ " -e - show edge coverage only, ignore hit counts\n"
+ " -c - allow core dumps\n"
+ " -V - show version number and exit\n\n"
+
+ "This tool displays raw tuple data captured by AFL instrumentation.\n"
+ "For additional help, consult %s/README.\n\n" cRST,
+
+ argv0, MEM_LIMIT, doc_path);
+
+ exit(1);
+
+}
+
+
+/* Find binary. */
+
+static void find_binary(u8* fname) {
+
+ u8* env_path = 0;
+ struct stat st;
+
+ if (strchr(fname, '/') || !(env_path = getenv("PATH"))) {
+
+ target_path = ck_strdup(fname);
+
+ if (stat(target_path, &st) || !S_ISREG(st.st_mode) ||
+ !(st.st_mode & 0111) || st.st_size < 4)
+ FATAL("Program '%s' not found or not executable", fname);
+
+ } else {
+
+ while (env_path) {
+
+ u8 *cur_elem, *delim = strchr(env_path, ':');
+
+ if (delim) {
+
+ cur_elem = ck_alloc(delim - env_path + 1);
+ memcpy(cur_elem, env_path, delim - env_path);
+ delim++;
+
+ } else cur_elem = ck_strdup(env_path);
+
+ env_path = delim;
+
+ if (cur_elem[0])
+ target_path = alloc_printf("%s/%s", cur_elem, fname);
+ else
+ target_path = ck_strdup(fname);
+
+ ck_free(cur_elem);
+
+ if (!stat(target_path, &st) && S_ISREG(st.st_mode) &&
+ (st.st_mode & 0111) && st.st_size >= 4) break;
+
+ ck_free(target_path);
+ target_path = 0;
+
+ }
+
+ if (!target_path) FATAL("Program '%s' not found or not executable", fname);
+
+ }
+
+}
+
+
+/* Fix up argv for QEMU. */
+
+static char** get_qemu_argv(u8* own_loc, char** argv, int argc) {
+
+ char** new_argv = ck_alloc(sizeof(char*) * (argc + 4));
+ u8 *tmp, *cp, *rsl, *own_copy;
+
+ /* Workaround for a QEMU stability glitch. */
+
+ setenv("QEMU_LOG", "nochain", 1);
+
+ memcpy(new_argv + 3, argv + 1, sizeof(char*) * argc);
+
+ new_argv[2] = target_path;
+ new_argv[1] = "--";
+
+ /* Now we need to actually find qemu for argv[0]. */
+
+ tmp = getenv("AFL_PATH");
+
+ if (tmp) {
+
+ cp = alloc_printf("%s/afl-qemu-trace", tmp);
+
+ if (access(cp, X_OK))
+ FATAL("Unable to find '%s'", tmp);
+
+ target_path = new_argv[0] = cp;
+ return new_argv;
+
+ }
+
+ own_copy = ck_strdup(own_loc);
+ rsl = strrchr(own_copy, '/');
+
+ if (rsl) {
+
+ *rsl = 0;
+
+ cp = alloc_printf("%s/afl-qemu-trace", own_copy);
+ ck_free(own_copy);
+
+ if (!access(cp, X_OK)) {
+
+ target_path = new_argv[0] = cp;
+ return new_argv;
+
+ }
+
+ } else ck_free(own_copy);
+
+ if (!access(BIN_PATH "/afl-qemu-trace", X_OK)) {
+
+ target_path = new_argv[0] = BIN_PATH "/afl-qemu-trace";
+ return new_argv;
+
+ }
+
+ FATAL("Unable to find 'afl-qemu-trace'.");
+
+}
+
+
+/* Main entry point */
+
+int main(int argc, char** argv) {
+
+ s32 opt;
+ u8 mem_limit_given = 0, timeout_given = 0, qemu_mode = 0;
+ u32 tcnt;
+ char** use_argv;
+
+ doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH;
+
+ while ((opt = getopt(argc,argv,"+o:m:t:A:eqZQbcV")) > 0)
+
+ switch (opt) {
+
+ case 'o':
+
+ if (out_file) FATAL("Multiple -o options not supported");
+ out_file = optarg;
+ break;
+
+ case 'm': {
+
+ u8 suffix = 'M';
+
+ if (mem_limit_given) FATAL("Multiple -m options not supported");
+ mem_limit_given = 1;
+
+ if (!strcmp(optarg, "none")) {
+
+ mem_limit = 0;
+ break;
+
+ }
+
+ if (sscanf(optarg, "%llu%c", &mem_limit, &suffix) < 1 ||
+ optarg[0] == '-') FATAL("Bad syntax used for -m");
+
+ switch (suffix) {
+
+ case 'T': mem_limit *= 1024 * 1024; break;
+ case 'G': mem_limit *= 1024; break;
+ case 'k': mem_limit /= 1024; break;
+ case 'M': break;
+
+ default: FATAL("Unsupported suffix or bad syntax for -m");
+
+ }
+
+ if (mem_limit < 5) FATAL("Dangerously low value of -m");
+
+ if (sizeof(rlim_t) == 4 && mem_limit > 2000)
+ FATAL("Value of -m out of range on 32-bit systems");
+
+ }
+
+ break;
+
+ case 't':
+
+ if (timeout_given) FATAL("Multiple -t options not supported");
+ timeout_given = 1;
+
+ if (strcmp(optarg, "none")) {
+ exec_tmout = atoi(optarg);
+
+ if (exec_tmout < 20 || optarg[0] == '-')
+ FATAL("Dangerously low value of -t");
+
+ }
+
+ break;
+
+ case 'e':
+
+ if (edges_only) FATAL("Multiple -e options not supported");
+ edges_only = 1;
+ break;
+
+ case 'q':
+
+ if (quiet_mode) FATAL("Multiple -q options not supported");
+ quiet_mode = 1;
+ break;
+
+ case 'Z':
+
+ /* This is an undocumented option to write data in the syntax expected
+ by afl-cmin. Nobody else should have any use for this. */
+
+ cmin_mode = 1;
+ quiet_mode = 1;
+ break;
+
+ case 'A':
+
+ /* Another afl-cmin specific feature. */
+ at_file = optarg;
+ break;
+
+ case 'Q':
+
+ if (qemu_mode) FATAL("Multiple -Q options not supported");
+ if (!mem_limit_given) mem_limit = MEM_LIMIT_QEMU;
+
+ qemu_mode = 1;
+ break;
+
+ case 'b':
+
+ /* Secret undocumented mode. Writes output in raw binary format
+ similar to that dumped by afl-fuzz in
-
- A simple test case minimizer that takes an input file and tries to remove
- as much data as possible while keeping the binary in a crashing state
- *or* producing consistent instrumentation output (the mode is auto-selected
- based on the initially observed behavior).
-*/
-
-#define AFL_MAIN
-#include "android-ashmem.h"
-
-#include "config.h"
-#include "types.h"
-#include "debug.h"
-#include "alloc-inl.h"
-#include "hash.h"
-
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-
-#include
-#include
-#include
-#include
-#include
-#include
-
-static s32 child_pid; /* PID of the tested program */
-
-static u8 *trace_bits, /* SHM with instrumentation bitmap */
- *mask_bitmap; /* Mask for trace bits (-B) */
-
-static u8 *in_file, /* Minimizer input test case */
- *out_file, /* Minimizer output file */
- *prog_in, /* Targeted program input file */
- *target_path, /* Path to target binary */
- *doc_path; /* Path to docs */
-
-static u8* in_data; /* Input data for trimming */
-
-static u32 in_len, /* Input data length */
- orig_cksum, /* Original checksum */
- total_execs, /* Total number of execs */
- missed_hangs, /* Misses due to hangs */
- missed_crashes, /* Misses due to crashes */
- missed_paths, /* Misses due to exec path diffs */
- exec_tmout = EXEC_TIMEOUT; /* Exec timeout (ms) */
-
-static u64 mem_limit = MEM_LIMIT; /* Memory limit (MB) */
-
-static s32 shm_id, /* ID of the SHM region */
- dev_null_fd = -1; /* FD to /dev/null */
-
-static u8 crash_mode, /* Crash-centric mode? */
- exit_crash, /* Treat non-zero exit as crash? */
- edges_only, /* Ignore hit counts? */
- exact_mode, /* Require path match for crashes? */
- use_stdin = 1; /* Use stdin for program input? */
-
-static volatile u8
- stop_soon, /* Ctrl-C pressed? */
- child_timed_out; /* Child timed out? */
-
-
-/* Classify tuple counts. This is a slow & naive version, but good enough here. */
-
-static const u8 count_class_lookup[256] = {
-
- [0] = 0,
- [1] = 1,
- [2] = 2,
- [3] = 4,
- [4 ... 7] = 8,
- [8 ... 15] = 16,
- [16 ... 31] = 32,
- [32 ... 127] = 64,
- [128 ... 255] = 128
-
-};
-
-static void classify_counts(u8* mem) {
-
- u32 i = MAP_SIZE;
-
- if (edges_only) {
-
- while (i--) {
- if (*mem) *mem = 1;
- mem++;
- }
-
- } else {
-
- while (i--) {
- *mem = count_class_lookup[*mem];
- mem++;
- }
-
- }
-
-}
-
-
-/* Apply mask to classified bitmap (if set). */
-
-static void apply_mask(u32* mem, u32* mask) {
-
- u32 i = (MAP_SIZE >> 2);
-
- if (!mask) return;
-
- while (i--) {
-
- *mem &= ~*mask;
- mem++;
- mask++;
-
- }
-
-}
-
-
-/* See if any bytes are set in the bitmap. */
-
-static inline u8 anything_set(void) {
-
- u32* ptr = (u32*)trace_bits;
- u32 i = (MAP_SIZE >> 2);
-
- while (i--) if (*(ptr++)) return 1;
-
- return 0;
-
-}
-
-
-
-/* Get rid of shared memory and temp files (atexit handler). */
-
-static void remove_shm(void) {
-
- if (prog_in) unlink(prog_in); /* Ignore errors */
- shmctl(shm_id, IPC_RMID, NULL);
-
-}
-
-
-/* Configure shared memory. */
-
-static void setup_shm(void) {
-
- u8* shm_str;
-
- shm_id = shmget(IPC_PRIVATE, MAP_SIZE, IPC_CREAT | IPC_EXCL | 0600);
-
- if (shm_id < 0) PFATAL("shmget() failed");
-
- atexit(remove_shm);
-
- shm_str = alloc_printf("%d", shm_id);
-
- setenv(SHM_ENV_VAR, shm_str, 1);
-
- ck_free(shm_str);
-
- trace_bits = shmat(shm_id, NULL, 0);
-
- if (trace_bits == (void *)-1) PFATAL("shmat() failed");
-
-}
-
-
-/* Read initial file. */
-
-static void read_initial_file(void) {
-
- struct stat st;
- s32 fd = open(in_file, O_RDONLY);
-
- if (fd < 0) PFATAL("Unable to open '%s'", in_file);
-
- if (fstat(fd, &st) || !st.st_size)
- FATAL("Zero-sized input file.");
-
- if (st.st_size >= TMIN_MAX_FILE)
- FATAL("Input file is too large (%u MB max)", TMIN_MAX_FILE / 1024 / 1024);
-
- in_len = st.st_size;
- in_data = ck_alloc_nozero(in_len);
-
- ck_read(fd, in_data, in_len, in_file);
-
- close(fd);
-
- OKF("Read %u byte%s from '%s'.", in_len, in_len == 1 ? "" : "s", in_file);
-
-}
-
-
-/* Write output file. */
-
-static s32 write_to_file(u8* path, u8* mem, u32 len) {
-
- s32 ret;
-
- unlink(path); /* Ignore errors */
-
- ret = open(path, O_RDWR | O_CREAT | O_EXCL, 0600);
-
- if (ret < 0) PFATAL("Unable to create '%s'", path);
-
- ck_write(ret, mem, len, path);
-
- lseek(ret, 0, SEEK_SET);
-
- return ret;
-
-}
-
-
-/* Handle timeout signal. */
-
-static void handle_timeout(int sig) {
-
- child_timed_out = 1;
- if (child_pid > 0) kill(child_pid, SIGKILL);
-
-}
-
-
-/* Execute target application. Returns 0 if the changes are a dud, or
- 1 if they should be kept. */
-
-static u8 run_target(char** argv, u8* mem, u32 len, u8 first_run) {
-
- static struct itimerval it;
- int status = 0;
-
- s32 prog_in_fd;
- u32 cksum;
-
- memset(trace_bits, 0, MAP_SIZE);
- MEM_BARRIER();
-
- prog_in_fd = write_to_file(prog_in, mem, len);
-
- child_pid = fork();
-
- if (child_pid < 0) PFATAL("fork() failed");
-
- if (!child_pid) {
-
- struct rlimit r;
-
- if (dup2(use_stdin ? prog_in_fd : dev_null_fd, 0) < 0 ||
- dup2(dev_null_fd, 1) < 0 ||
- dup2(dev_null_fd, 2) < 0) {
-
- *(u32*)trace_bits = EXEC_FAIL_SIG;
- PFATAL("dup2() failed");
-
- }
-
- close(dev_null_fd);
- close(prog_in_fd);
-
- setsid();
-
- if (mem_limit) {
-
- r.rlim_max = r.rlim_cur = ((rlim_t)mem_limit) << 20;
-
-#ifdef RLIMIT_AS
-
- setrlimit(RLIMIT_AS, &r); /* Ignore errors */
-
-#else
-
- setrlimit(RLIMIT_DATA, &r); /* Ignore errors */
-
-#endif /* ^RLIMIT_AS */
-
- }
-
- r.rlim_max = r.rlim_cur = 0;
- setrlimit(RLIMIT_CORE, &r); /* Ignore errors */
-
- execv(target_path, argv);
-
- *(u32*)trace_bits = EXEC_FAIL_SIG;
- exit(0);
-
- }
-
- close(prog_in_fd);
-
- /* Configure timeout, wait for child, cancel timeout. */
-
- child_timed_out = 0;
- it.it_value.tv_sec = (exec_tmout / 1000);
- it.it_value.tv_usec = (exec_tmout % 1000) * 1000;
-
- setitimer(ITIMER_REAL, &it, NULL);
-
- if (waitpid(child_pid, &status, 0) <= 0) FATAL("waitpid() failed");
-
- child_pid = 0;
- it.it_value.tv_sec = 0;
- it.it_value.tv_usec = 0;
-
- setitimer(ITIMER_REAL, &it, NULL);
-
- MEM_BARRIER();
-
- /* Clean up bitmap, analyze exit condition, etc. */
-
- if (*(u32*)trace_bits == EXEC_FAIL_SIG)
- FATAL("Unable to execute '%s'", argv[0]);
-
- classify_counts(trace_bits);
- apply_mask((u32*)trace_bits, (u32*)mask_bitmap);
- total_execs++;
-
- if (stop_soon) {
-
- SAYF(cRST cLRD "\n+++ Minimization aborted by user +++\n" cRST);
- close(write_to_file(out_file, in_data, in_len));
- exit(1);
-
- }
-
- /* Always discard inputs that time out. */
-
- if (child_timed_out) {
-
- missed_hangs++;
- return 0;
-
- }
-
- /* Handle crashing inputs depending on current mode. */
-
- if (WIFSIGNALED(status) ||
- (WIFEXITED(status) && WEXITSTATUS(status) == MSAN_ERROR) ||
- (WIFEXITED(status) && WEXITSTATUS(status) && exit_crash)) {
-
- if (first_run) crash_mode = 1;
-
- if (crash_mode) {
-
- if (!exact_mode) return 1;
-
- } else {
-
- missed_crashes++;
- return 0;
-
- }
-
- } else
-
- /* Handle non-crashing inputs appropriately. */
-
- if (crash_mode) {
-
- missed_paths++;
- return 0;
-
- }
-
- cksum = hash32(trace_bits, MAP_SIZE, HASH_CONST);
-
- if (first_run) orig_cksum = cksum;
-
- if (orig_cksum == cksum) return 1;
-
- missed_paths++;
- return 0;
-
-}
-
-
-/* Find first power of two greater or equal to val. */
-
-static u32 next_p2(u32 val) {
-
- u32 ret = 1;
- while (val > ret) ret <<= 1;
- return ret;
-
-}
-
-
-/* Actually minimize! */
-
-static void minimize(char** argv) {
-
- static u32 alpha_map[256];
-
- u8* tmp_buf = ck_alloc_nozero(in_len);
- u32 orig_len = in_len, stage_o_len;
-
- u32 del_len, set_len, del_pos, set_pos, i, alpha_size, cur_pass = 0;
- u32 syms_removed, alpha_del0 = 0, alpha_del1, alpha_del2, alpha_d_total = 0;
- u8 changed_any, prev_del;
-
- /***********************
- * BLOCK NORMALIZATION *
- ***********************/
-
- set_len = next_p2(in_len / TMIN_SET_STEPS);
- set_pos = 0;
-
- if (set_len < TMIN_SET_MIN_SIZE) set_len = TMIN_SET_MIN_SIZE;
-
- ACTF(cBRI "Stage #0: " cRST "One-time block normalization...");
-
- while (set_pos < in_len) {
-
- u8 res;
- u32 use_len = MIN(set_len, in_len - set_pos);
-
- for (i = 0; i < use_len; i++)
- if (in_data[set_pos + i] != '0') break;
-
- if (i != use_len) {
-
- memcpy(tmp_buf, in_data, in_len);
- memset(tmp_buf + set_pos, '0', use_len);
-
- res = run_target(argv, tmp_buf, in_len, 0);
-
- if (res) {
-
- memset(in_data + set_pos, '0', use_len);
- changed_any = 1;
- alpha_del0 += use_len;
-
- }
-
- }
-
- set_pos += set_len;
-
- }
-
- alpha_d_total += alpha_del0;
-
- OKF("Block normalization complete, %u byte%s replaced.", alpha_del0,
- alpha_del0 == 1 ? "" : "s");
-
-next_pass:
-
- ACTF(cYEL "--- " cBRI "Pass #%u " cYEL "---", ++cur_pass);
- changed_any = 0;
-
- /******************
- * BLOCK DELETION *
- ******************/
-
- del_len = next_p2(in_len / TRIM_START_STEPS);
- stage_o_len = in_len;
-
- ACTF(cBRI "Stage #1: " cRST "Removing blocks of data...");
-
-next_del_blksize:
-
- if (!del_len) del_len = 1;
- del_pos = 0;
- prev_del = 1;
-
- SAYF(cGRA " Block length = %u, remaining size = %u\n" cRST,
- del_len, in_len);
-
- while (del_pos < in_len) {
-
- u8 res;
- s32 tail_len;
-
- tail_len = in_len - del_pos - del_len;
- if (tail_len < 0) tail_len = 0;
-
- /* If we have processed at least one full block (initially, prev_del == 1),
- and we did so without deleting the previous one, and we aren't at the
- very end of the buffer (tail_len > 0), and the current block is the same
- as the previous one... skip this step as a no-op. */
-
- if (!prev_del && tail_len && !memcmp(in_data + del_pos - del_len,
- in_data + del_pos, del_len)) {
-
- del_pos += del_len;
- continue;
-
- }
-
- prev_del = 0;
-
- /* Head */
- memcpy(tmp_buf, in_data, del_pos);
-
- /* Tail */
- memcpy(tmp_buf + del_pos, in_data + del_pos + del_len, tail_len);
-
- res = run_target(argv, tmp_buf, del_pos + tail_len, 0);
-
- if (res) {
-
- memcpy(in_data, tmp_buf, del_pos + tail_len);
- prev_del = 1;
- in_len = del_pos + tail_len;
-
- changed_any = 1;
-
- } else del_pos += del_len;
-
- }
-
- if (del_len > 1 && in_len >= 1) {
-
- del_len /= 2;
- goto next_del_blksize;
-
- }
-
- OKF("Block removal complete, %u bytes deleted.", stage_o_len - in_len);
-
- if (!in_len && changed_any)
- WARNF(cLRD "Down to zero bytes - check the command line and mem limit!" cRST);
-
- if (cur_pass > 1 && !changed_any) goto finalize_all;
-
- /*************************
- * ALPHABET MINIMIZATION *
- *************************/
-
- alpha_size = 0;
- alpha_del1 = 0;
- syms_removed = 0;
-
- memset(alpha_map, 0, 256 * sizeof(u32));
-
- for (i = 0; i < in_len; i++) {
- if (!alpha_map[in_data[i]]) alpha_size++;
- alpha_map[in_data[i]]++;
- }
-
- ACTF(cBRI "Stage #2: " cRST "Minimizing symbols (%u code point%s)...",
- alpha_size, alpha_size == 1 ? "" : "s");
-
- for (i = 0; i < 256; i++) {
-
- u32 r;
- u8 res;
-
- if (i == '0' || !alpha_map[i]) continue;
-
- memcpy(tmp_buf, in_data, in_len);
-
- for (r = 0; r < in_len; r++)
- if (tmp_buf[r] == i) tmp_buf[r] = '0';
-
- res = run_target(argv, tmp_buf, in_len, 0);
-
- if (res) {
-
- memcpy(in_data, tmp_buf, in_len);
- syms_removed++;
- alpha_del1 += alpha_map[i];
- changed_any = 1;
-
- }
-
- }
-
- alpha_d_total += alpha_del1;
-
- OKF("Symbol minimization finished, %u symbol%s (%u byte%s) replaced.",
- syms_removed, syms_removed == 1 ? "" : "s",
- alpha_del1, alpha_del1 == 1 ? "" : "s");
-
- /**************************
- * CHARACTER MINIMIZATION *
- **************************/
-
- alpha_del2 = 0;
-
- ACTF(cBRI "Stage #3: " cRST "Character minimization...");
-
- memcpy(tmp_buf, in_data, in_len);
-
- for (i = 0; i < in_len; i++) {
-
- u8 res, orig = tmp_buf[i];
-
- if (orig == '0') continue;
- tmp_buf[i] = '0';
-
- res = run_target(argv, tmp_buf, in_len, 0);
-
- if (res) {
-
- in_data[i] = '0';
- alpha_del2++;
- changed_any = 1;
-
- } else tmp_buf[i] = orig;
-
- }
-
- alpha_d_total += alpha_del2;
-
- OKF("Character minimization done, %u byte%s replaced.",
- alpha_del2, alpha_del2 == 1 ? "" : "s");
-
- if (changed_any) goto next_pass;
-
-finalize_all:
-
- SAYF("\n"
- cGRA " File size reduced by : " cRST "%0.02f%% (to %u byte%s)\n"
- cGRA " Characters simplified : " cRST "%0.02f%%\n"
- cGRA " Number of execs done : " cRST "%u\n"
- cGRA " Fruitless execs : " cRST "path=%u crash=%u hang=%s%u\n\n",
- 100 - ((double)in_len) * 100 / orig_len, in_len, in_len == 1 ? "" : "s",
- ((double)(alpha_d_total)) * 100 / (in_len ? in_len : 1),
- total_execs, missed_paths, missed_crashes, missed_hangs ? cLRD : "",
- missed_hangs);
-
- if (total_execs > 50 && missed_hangs * 10 > total_execs)
- WARNF(cLRD "Frequent timeouts - results may be skewed." cRST);
-
-}
-
-
-
-/* Handle Ctrl-C and the like. */
-
-static void handle_stop_sig(int sig) {
-
- stop_soon = 1;
-
- if (child_pid > 0) kill(child_pid, SIGKILL);
-
-}
-
-
-/* Do basic preparations - persistent fds, filenames, etc. */
-
-static void set_up_environment(void) {
-
- u8* x;
-
- dev_null_fd = open("/dev/null", O_RDWR);
- if (dev_null_fd < 0) PFATAL("Unable to open /dev/null");
-
- if (!prog_in) {
-
- u8* use_dir = ".";
-
- if (access(use_dir, R_OK | W_OK | X_OK)) {
-
- use_dir = getenv("TMPDIR");
- if (!use_dir) use_dir = "/tmp";
-
- }
-
- prog_in = alloc_printf("%s/.afl-tmin-temp-%u", use_dir, getpid());
-
- }
-
- /* Set sane defaults... */
-
- x = getenv("ASAN_OPTIONS");
-
- if (x) {
-
- if (!strstr(x, "abort_on_error=1"))
- FATAL("Custom ASAN_OPTIONS set without abort_on_error=1 - please fix!");
-
- if (!strstr(x, "symbolize=0"))
- FATAL("Custom ASAN_OPTIONS set without symbolize=0 - please fix!");
-
- }
-
- x = getenv("MSAN_OPTIONS");
-
- if (x) {
-
- if (!strstr(x, "exit_code=" STRINGIFY(MSAN_ERROR)))
- FATAL("Custom MSAN_OPTIONS set without exit_code="
- STRINGIFY(MSAN_ERROR) " - please fix!");
-
- if (!strstr(x, "symbolize=0"))
- FATAL("Custom MSAN_OPTIONS set without symbolize=0 - please fix!");
-
- }
-
- setenv("ASAN_OPTIONS", "abort_on_error=1:"
- "detect_leaks=0:"
- "symbolize=0:"
- "allocator_may_return_null=1", 0);
-
- setenv("MSAN_OPTIONS", "exit_code=" STRINGIFY(MSAN_ERROR) ":"
- "symbolize=0:"
- "abort_on_error=1:"
- "allocator_may_return_null=1:"
- "msan_track_origins=0", 0);
-
- if (getenv("AFL_PRELOAD")) {
- setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
- setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
- }
-
-}
-
-
-/* Setup signal handlers, duh. */
-
-static void setup_signal_handlers(void) {
-
- struct sigaction sa;
-
- sa.sa_handler = NULL;
- sa.sa_flags = SA_RESTART;
- sa.sa_sigaction = NULL;
-
- sigemptyset(&sa.sa_mask);
-
- /* Various ways of saying "stop". */
-
- sa.sa_handler = handle_stop_sig;
- sigaction(SIGHUP, &sa, NULL);
- sigaction(SIGINT, &sa, NULL);
- sigaction(SIGTERM, &sa, NULL);
-
- /* Exec timeout notifications. */
-
- sa.sa_handler = handle_timeout;
- sigaction(SIGALRM, &sa, NULL);
-
-}
-
-
-/* Detect @@ in args. */
-
-static void detect_file_args(char** argv) {
-
- u32 i = 0;
- u8* cwd = getcwd(NULL, 0);
-
- if (!cwd) PFATAL("getcwd() failed");
-
- while (argv[i]) {
-
- u8* aa_loc = strstr(argv[i], "@@");
-
- if (aa_loc) {
-
- u8 *aa_subst, *n_arg;
-
- /* Be sure that we're always using fully-qualified paths. */
-
- if (prog_in[0] == '/') aa_subst = prog_in;
- else aa_subst = alloc_printf("%s/%s", cwd, prog_in);
-
- /* Construct a replacement argv value. */
-
- *aa_loc = 0;
- n_arg = alloc_printf("%s%s%s", argv[i], aa_subst, aa_loc + 2);
- argv[i] = n_arg;
- *aa_loc = '@';
-
- if (prog_in[0] != '/') ck_free(aa_subst);
-
- }
-
- i++;
-
- }
-
- free(cwd); /* not tracked */
-
-}
-
-
-/* Display usage hints. */
-
-static void usage(u8* argv0) {
-
- SAYF("\n%s [ options ] -- /path/to/target_app [ ... ]\n\n"
-
- "Required parameters:\n\n"
-
- " -i file - input test case to be shrunk by the tool\n"
- " -o file - final output location for the minimized data\n\n"
-
- "Execution control settings:\n\n"
-
- " -f file - input file read by the tested program (stdin)\n"
- " -t msec - timeout for each run (%u ms)\n"
- " -m megs - memory limit for child process (%u MB)\n"
- " -Q - use binary-only instrumentation (QEMU mode)\n\n"
-
- "Minimization settings:\n\n"
-
- " -e - solve for edge coverage only, ignore hit counts\n"
- " -x - treat non-zero exit codes as crashes\n\n"
-
- "Other stuff:\n\n"
-
- " -V - show version number and exit\n\n"
-
- "For additional tips, please consult %s/README.\n\n",
-
- argv0, EXEC_TIMEOUT, MEM_LIMIT, doc_path);
-
- exit(1);
-
-}
-
-
-/* Find binary. */
-
-static void find_binary(u8* fname) {
-
- u8* env_path = 0;
- struct stat st;
-
- if (strchr(fname, '/') || !(env_path = getenv("PATH"))) {
-
- target_path = ck_strdup(fname);
-
- if (stat(target_path, &st) || !S_ISREG(st.st_mode) ||
- !(st.st_mode & 0111) || st.st_size < 4)
- FATAL("Program '%s' not found or not executable", fname);
-
- } else {
-
- while (env_path) {
-
- u8 *cur_elem, *delim = strchr(env_path, ':');
-
- if (delim) {
-
- cur_elem = ck_alloc(delim - env_path + 1);
- memcpy(cur_elem, env_path, delim - env_path);
- delim++;
-
- } else cur_elem = ck_strdup(env_path);
-
- env_path = delim;
-
- if (cur_elem[0])
- target_path = alloc_printf("%s/%s", cur_elem, fname);
- else
- target_path = ck_strdup(fname);
-
- ck_free(cur_elem);
-
- if (!stat(target_path, &st) && S_ISREG(st.st_mode) &&
- (st.st_mode & 0111) && st.st_size >= 4) break;
-
- ck_free(target_path);
- target_path = 0;
-
- }
-
- if (!target_path) FATAL("Program '%s' not found or not executable", fname);
-
- }
-
-}
-
-
-/* Fix up argv for QEMU. */
-
-static char** get_qemu_argv(u8* own_loc, char** argv, int argc) {
-
- char** new_argv = ck_alloc(sizeof(char*) * (argc + 4));
- u8 *tmp, *cp, *rsl, *own_copy;
-
- /* Workaround for a QEMU stability glitch. */
-
- setenv("QEMU_LOG", "nochain", 1);
-
- memcpy(new_argv + 3, argv + 1, sizeof(char*) * argc);
-
- /* Now we need to actually find qemu for argv[0]. */
-
- new_argv[2] = target_path;
- new_argv[1] = "--";
-
- tmp = getenv("AFL_PATH");
-
- if (tmp) {
-
- cp = alloc_printf("%s/afl-qemu-trace", tmp);
-
- if (access(cp, X_OK))
- FATAL("Unable to find '%s'", tmp);
-
- target_path = new_argv[0] = cp;
- return new_argv;
-
- }
-
- own_copy = ck_strdup(own_loc);
- rsl = strrchr(own_copy, '/');
-
- if (rsl) {
-
- *rsl = 0;
-
- cp = alloc_printf("%s/afl-qemu-trace", own_copy);
- ck_free(own_copy);
-
- if (!access(cp, X_OK)) {
-
- target_path = new_argv[0] = cp;
- return new_argv;
-
- }
-
- } else ck_free(own_copy);
-
- if (!access(BIN_PATH "/afl-qemu-trace", X_OK)) {
-
- target_path = new_argv[0] = BIN_PATH "/afl-qemu-trace";
- return new_argv;
-
- }
-
- FATAL("Unable to find 'afl-qemu-trace'.");
-
-}
-
-
-/* Read mask bitmap from file. This is for the -B option. */
-
-static void read_bitmap(u8* fname) {
-
- s32 fd = open(fname, O_RDONLY);
-
- if (fd < 0) PFATAL("Unable to open '%s'", fname);
-
- ck_read(fd, mask_bitmap, MAP_SIZE, fname);
-
- close(fd);
-
-}
-
-
-
-/* Main entry point */
-
-int main(int argc, char** argv) {
-
- s32 opt;
- u8 mem_limit_given = 0, timeout_given = 0, qemu_mode = 0;
- char** use_argv;
-
- doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH;
-
- SAYF(cCYA "afl-tmin " cBRI VERSION cRST " by