|
|
|
@ -21,6 +21,8 @@
|
|
|
|
|
its structure by observing how changes to it affect the execution path.
|
|
|
|
|
|
|
|
|
|
If the output scrolls past the edge of the screen, pipe it to 'less -r'.
|
|
|
|
|
|
|
|
|
|
shashaqingkuangwoq
|
|
|
|
|
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
@ -96,9 +98,7 @@ static afl_forkserver_t fsrv = {0}; /* The forkserver */
|
|
|
|
|
/* Classify tuple counts. This is a slow & naive version, but good enough here.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
//将模糊测试的错误数进行归并,在不造成太大影响的情况下减少运算、提升性能
|
|
|
|
|
//分类计数,并通过不同的范围将输入映射到特定的值上。
|
|
|
|
|
static u8 count_class_lookup[256] = {
|
|
|
|
|
|
|
|
|
|
[0] = 0,
|
|
|
|
@ -113,11 +113,11 @@ static u8 count_class_lookup[256] = {
|
|
|
|
|
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
//结束子进程
|
|
|
|
|
//终止一个子进程
|
|
|
|
|
static void kill_child() {
|
|
|
|
|
|
|
|
|
|
// 判断fsrv结构体中的child_pid是否大于0(即是否有有效的子进程ID)
|
|
|
|
|
if (fsrv.child_pid > 0) {
|
|
|
|
|
|
|
|
|
|
// 使用kill函数向子进程发送终止信号,信号类型为fsrv.child_kill_signal
|
|
|
|
|
kill(fsrv.child_pid, fsrv.child_kill_signal);
|
|
|
|
|
fsrv.child_pid = -1;
|
|
|
|
|
|
|
|
|
@ -125,6 +125,7 @@ static void kill_child() {
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
//对给定内存块中的数据进行分类处理。根据模糊测试的模式,决定是将非零值设置为1,还是根据count_class_lookup数组对每个字节进行分类映射。
|
|
|
|
|
static void classify_counts(u8 *mem, u32 mem_size) {
|
|
|
|
|
|
|
|
|
|
u32 i = mem_size;
|
|
|
|
@ -132,7 +133,7 @@ static void classify_counts(u8 *mem, u32 mem_size) {
|
|
|
|
|
if (edges_only) {
|
|
|
|
|
|
|
|
|
|
while (i--) {
|
|
|
|
|
|
|
|
|
|
// 如果当前指针所指向的值非零,则将其设置为1
|
|
|
|
|
if (*mem) { *mem = 1; }
|
|
|
|
|
mem++;
|
|
|
|
|
|
|
|
|
@ -141,7 +142,7 @@ static void classify_counts(u8 *mem, u32 mem_size) {
|
|
|
|
|
} else {
|
|
|
|
|
|
|
|
|
|
while (i--) {
|
|
|
|
|
|
|
|
|
|
// 根据count_class_lookup数组,将当前指针所指向的值进行分类替换
|
|
|
|
|
*mem = count_class_lookup[*mem];
|
|
|
|
|
mem++;
|
|
|
|
|
|
|
|
|
@ -152,9 +153,9 @@ static void classify_counts(u8 *mem, u32 mem_size) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* See if any bytes are set in the bitmap. */
|
|
|
|
|
|
|
|
|
|
// 检查bitmap中是否存在零值
|
|
|
|
|
static inline u8 anything_set(void) {
|
|
|
|
|
|
|
|
|
|
// 将 fsrv.trace_bits 转换为指向 u32 类型的指针
|
|
|
|
|
u32 *ptr = (u32 *)fsrv.trace_bits;
|
|
|
|
|
u32 i = (map_size >> 2);
|
|
|
|
|
|
|
|
|
@ -163,7 +164,7 @@ static inline u8 anything_set(void) {
|
|
|
|
|
if (*(ptr++)) { return 1; }
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 如果所有值均为零,返回 0
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
@ -171,22 +172,22 @@ static inline u8 anything_set(void) {
|
|
|
|
|
/* Get rid of temp files (atexit handler). */
|
|
|
|
|
|
|
|
|
|
static void at_exit_handler(void) {
|
|
|
|
|
|
|
|
|
|
//退出
|
|
|
|
|
unlink(fsrv.out_file); /* Ignore errors */
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Read initial file. */
|
|
|
|
|
|
|
|
|
|
// 读取初始文件并进行检查
|
|
|
|
|
static void read_initial_file(void) {
|
|
|
|
|
|
|
|
|
|
struct stat st;
|
|
|
|
|
s32 fd = open(in_file, O_RDONLY);
|
|
|
|
|
|
|
|
|
|
// 检查文件打开是否成功,若失败则打印错误信息并终止程序
|
|
|
|
|
if (fd < 0) { PFATAL("Unable to open '%s'", in_file); }
|
|
|
|
|
|
|
|
|
|
// 获取文件状态信息,并检查文件大小,若获取失败或文件大小为零,则终止程序
|
|
|
|
|
if (fstat(fd, &st) || !st.st_size) { FATAL("Zero-sized input file."); }
|
|
|
|
|
|
|
|
|
|
// 检查文件大小是否超过最大限制 TMIN_MAX_FILE,若超过则终止程序
|
|
|
|
|
if (st.st_size >= TMIN_MAX_FILE) {
|
|
|
|
|
|
|
|
|
|
FATAL("Input file is too large (%ld MB max)", TMIN_MAX_FILE / 1024 / 1024);
|
|
|
|
@ -194,43 +195,45 @@ static void read_initial_file(void) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
in_len = st.st_size;
|
|
|
|
|
// 分配内存以存储文件内容,并确保内存初始化为零
|
|
|
|
|
in_data = ck_alloc_nozero(in_len);
|
|
|
|
|
|
|
|
|
|
ck_read(fd, in_data, in_len, in_file);
|
|
|
|
|
|
|
|
|
|
close(fd);
|
|
|
|
|
|
|
|
|
|
// 打印读取成功的信息,包括读取的字节数
|
|
|
|
|
OKF("Read %u byte%s from '%s'.", in_len, in_len == 1 ? "" : "s", in_file);
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Execute target application. Returns exec checksum, or 0 if program
|
|
|
|
|
times out. */
|
|
|
|
|
|
|
|
|
|
// 分析目标程序的运行结果
|
|
|
|
|
static u64 analyze_run_target(u8 *mem, u32 len, u8 first_run) {
|
|
|
|
|
|
|
|
|
|
// 将输入数据写入测试用例
|
|
|
|
|
afl_fsrv_write_to_testcase(&fsrv, mem, len);
|
|
|
|
|
// 运行目标程序并获取运行结果
|
|
|
|
|
fsrv_run_result_t ret = afl_fsrv_run_target(&fsrv, exec_tmout, &stop_soon);
|
|
|
|
|
|
|
|
|
|
if (ret == FSRV_RUN_ERROR) {
|
|
|
|
|
|
|
|
|
|
// forkserver 错误
|
|
|
|
|
FATAL("Error in forkserver");
|
|
|
|
|
|
|
|
|
|
} else if (ret == FSRV_RUN_NOINST) {
|
|
|
|
|
|
|
|
|
|
// 目标未被插桩
|
|
|
|
|
FATAL("Target not instrumented");
|
|
|
|
|
|
|
|
|
|
} else if (ret == FSRV_RUN_NOBITS) {
|
|
|
|
|
|
|
|
|
|
// 运行目标失败
|
|
|
|
|
FATAL("Failed to run target");
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 根据跟踪位图分类计数
|
|
|
|
|
classify_counts(fsrv.trace_bits, fsrv.map_size);
|
|
|
|
|
total_execs++;
|
|
|
|
|
|
|
|
|
|
if (stop_soon) {
|
|
|
|
|
|
|
|
|
|
// 检查用户是否中止了分析
|
|
|
|
|
SAYF(cRST cLRD "\n+++ Analysis aborted by user +++\n" cRST);
|
|
|
|
|
exit(1);
|
|
|
|
|
|
|
|
|
@ -239,7 +242,7 @@ static u64 analyze_run_target(u8 *mem, u32 len, u8 first_run) {
|
|
|
|
|
/* Always discard inputs that time out. */
|
|
|
|
|
|
|
|
|
|
if (fsrv.last_run_timed_out) {
|
|
|
|
|
|
|
|
|
|
// 统计超时次数
|
|
|
|
|
exec_hangs++;
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
@ -248,14 +251,14 @@ static u64 analyze_run_target(u8 *mem, u32 len, u8 first_run) {
|
|
|
|
|
u64 cksum = hash64(fsrv.trace_bits, fsrv.map_size, HASH_CONST);
|
|
|
|
|
|
|
|
|
|
if (ret == FSRV_RUN_CRASH) {
|
|
|
|
|
|
|
|
|
|
// 如果目标程序崩溃,修改哈希值
|
|
|
|
|
/* We don't actually care if the target is crashing or not,
|
|
|
|
|
except that when it does, the checksum should be different. */
|
|
|
|
|
|
|
|
|
|
cksum ^= 0xffffffff;
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 如果是第一次运行,将原始哈希值保存
|
|
|
|
|
if (first_run) { orig_cksum = cksum; }
|
|
|
|
|
|
|
|
|
|
return cksum;
|
|
|
|
@ -263,7 +266,7 @@ static u64 analyze_run_target(u8 *mem, u32 len, u8 first_run) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#ifdef USE_COLOR
|
|
|
|
|
|
|
|
|
|
//如果给出颜色,规范化表达
|
|
|
|
|
/* Helper function to display a human-readable character. */
|
|
|
|
|
|
|
|
|
|
static void show_char(u8 val) {
|
|
|
|
@ -302,7 +305,7 @@ static void show_legend(void) {
|
|
|
|
|
#endif /* USE_COLOR */
|
|
|
|
|
|
|
|
|
|
/* Interpret and report a pattern in the input file. */
|
|
|
|
|
|
|
|
|
|
// 以十六进制格式转储二进制数据并进行分类
|
|
|
|
|
static void dump_hex(u32 len, u8 *b_data) {
|
|
|
|
|
|
|
|
|
|
u32 i;
|
|
|
|
@ -314,13 +317,13 @@ static void dump_hex(u32 len, u8 *b_data) {
|
|
|
|
|
#else
|
|
|
|
|
u32 rlen = 1;
|
|
|
|
|
#endif /* ^USE_COLOR */
|
|
|
|
|
|
|
|
|
|
// 获取当前字节的类型,提取低 4 位
|
|
|
|
|
u8 rtype = b_data[i] & 0x0f;
|
|
|
|
|
|
|
|
|
|
/* Look ahead to determine the length of run. */
|
|
|
|
|
|
|
|
|
|
//向前查看以确定当前字节的运行长度
|
|
|
|
|
while (i + rlen < len && (b_data[i] >> 7) == (b_data[i + rlen] >> 7)) {
|
|
|
|
|
|
|
|
|
|
// 更新当前运行的类型
|
|
|
|
|
if (rtype < (b_data[i + rlen] & 0x0f)) {
|
|
|
|
|
|
|
|
|
|
rtype = b_data[i + rlen] & 0x0f;
|
|
|
|
@ -332,7 +335,7 @@ static void dump_hex(u32 len, u8 *b_data) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Try to do some further classification based on length & value. */
|
|
|
|
|
|
|
|
|
|
//根据长度和类型进行进一步分类
|
|
|
|
|
if (rtype == RESP_FIXED) {
|
|
|
|
|
|
|
|
|
|
switch (rlen) {
|
|
|
|
@ -344,7 +347,7 @@ static void dump_hex(u32 len, u8 *b_data) {
|
|
|
|
|
/* Small integers may be length fields. */
|
|
|
|
|
|
|
|
|
|
if (val && (val <= in_len || SWAP16(val) <= in_len)) {
|
|
|
|
|
|
|
|
|
|
// 将类型更改为长度字段
|
|
|
|
|
rtype = RESP_LEN;
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
@ -353,7 +356,7 @@ static void dump_hex(u32 len, u8 *b_data) {
|
|
|
|
|
/* Uniform integers may be checksums. */
|
|
|
|
|
|
|
|
|
|
if (val && abs(in_data[i] - in_data[i + 1]) > 32) {
|
|
|
|
|
|
|
|
|
|
// 将类型更改为校验和
|
|
|
|
|
rtype = RESP_CKSUM;
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
@ -370,7 +373,7 @@ static void dump_hex(u32 len, u8 *b_data) {
|
|
|
|
|
/* Small integers may be length fields. */
|
|
|
|
|
|
|
|
|
|
if (val && (val <= in_len || SWAP32(val) <= in_len)) {
|
|
|
|
|
|
|
|
|
|
// 将类型更改为长度字段
|
|
|
|
|
rtype = RESP_LEN;
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
@ -381,7 +384,7 @@ static void dump_hex(u32 len, u8 *b_data) {
|
|
|
|
|
if (val && (in_data[i] >> 7 != in_data[i + 1] >> 7 ||
|
|
|
|
|
in_data[i] >> 7 != in_data[i + 2] >> 7 ||
|
|
|
|
|
in_data[i] >> 7 != in_data[i + 3] >> 7)) {
|
|
|
|
|
|
|
|
|
|
// 将类型更改为校验和
|
|
|
|
|
rtype = RESP_CKSUM;
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
@ -390,7 +393,7 @@ static void dump_hex(u32 len, u8 *b_data) {
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 对于 1, 3, 5 到 MAX_AUTO_EXTRA - 1 的情况,不做处理
|
|
|
|
|
case 1:
|
|
|
|
|
case 3:
|
|
|
|
|
case 5 ... MAX_AUTO_EXTRA - 1:
|
|
|
|
@ -404,7 +407,7 @@ static void dump_hex(u32 len, u8 *b_data) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Print out the entire run. */
|
|
|
|
|
|
|
|
|
|
//如果使用颜色模板,下面代码会规范化输出
|
|
|
|
|
#ifdef USE_COLOR
|
|
|
|
|
|
|
|
|
|
for (off = 0; off < rlen; off++) {
|
|
|
|
@ -513,17 +516,17 @@ static void dump_hex(u32 len, u8 *b_data) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Actually analyze! */
|
|
|
|
|
|
|
|
|
|
// 分析输入文件
|
|
|
|
|
static void analyze() {
|
|
|
|
|
|
|
|
|
|
// 定义变量
|
|
|
|
|
u32 i;
|
|
|
|
|
u32 boring_len = 0, prev_xff = 0, prev_x01 = 0, prev_s10 = 0, prev_a10 = 0;
|
|
|
|
|
|
|
|
|
|
// 动态分配内存,用于存储分析结果
|
|
|
|
|
u8 *b_data = ck_alloc(in_len + 1);
|
|
|
|
|
u8 seq_byte = 0;
|
|
|
|
|
|
|
|
|
|
// 在末尾添加一个故意的终止符
|
|
|
|
|
b_data[in_len] = 0xff; /* Intentional terminator. */
|
|
|
|
|
|
|
|
|
|
// 输出分析开始的信息
|
|
|
|
|
ACTF("Analyzing input file (this may take a while)...\n");
|
|
|
|
|
|
|
|
|
|
#ifdef USE_COLOR
|
|
|
|
@ -531,50 +534,54 @@ static void analyze() {
|
|
|
|
|
#endif /* USE_COLOR */
|
|
|
|
|
|
|
|
|
|
for (i = 0; i < in_len; i++) {
|
|
|
|
|
|
|
|
|
|
// 定义变量用于存储不同操作的结果
|
|
|
|
|
u64 xor_ff, xor_01, sub_10, add_10;
|
|
|
|
|
// 定义变量用于存储原始校验和比较结果
|
|
|
|
|
u8 xff_orig, x01_orig, s10_orig, a10_orig;
|
|
|
|
|
|
|
|
|
|
/* Perform walking byte adjustments across the file. We perform four
|
|
|
|
|
operations designed to elicit some response from the underlying
|
|
|
|
|
code. */
|
|
|
|
|
|
|
|
|
|
// 对文件中的每一个字节进行四种操作以引发响应
|
|
|
|
|
// 对当前字节进行异或操作
|
|
|
|
|
in_data[i] ^= 0xff;
|
|
|
|
|
// 运行目标分析并获取结果
|
|
|
|
|
xor_ff = analyze_run_target(in_data, in_len, 0);
|
|
|
|
|
|
|
|
|
|
// 进行另一种异或操作
|
|
|
|
|
in_data[i] ^= 0xfe;
|
|
|
|
|
xor_01 = analyze_run_target(in_data, in_len, 0);
|
|
|
|
|
|
|
|
|
|
// 进行减法和异或操作
|
|
|
|
|
in_data[i] = (in_data[i] ^ 0x01) - 0x10;
|
|
|
|
|
sub_10 = analyze_run_target(in_data, in_len, 0);
|
|
|
|
|
|
|
|
|
|
// 进行加法操作
|
|
|
|
|
in_data[i] += 0x20;
|
|
|
|
|
add_10 = analyze_run_target(in_data, in_len, 0);
|
|
|
|
|
// 恢复当前字节的值
|
|
|
|
|
in_data[i] -= 0x10;
|
|
|
|
|
|
|
|
|
|
/* Classify current behavior. */
|
|
|
|
|
|
|
|
|
|
// 根据不同操作的结果分类当前字节的行为
|
|
|
|
|
xff_orig = (xor_ff == orig_cksum);
|
|
|
|
|
x01_orig = (xor_01 == orig_cksum);
|
|
|
|
|
s10_orig = (sub_10 == orig_cksum);
|
|
|
|
|
a10_orig = (add_10 == orig_cksum);
|
|
|
|
|
|
|
|
|
|
if (xff_orig && x01_orig && s10_orig && a10_orig) {
|
|
|
|
|
|
|
|
|
|
// 如果所有操作的结果均与原始校验和相同,则将当前字节的行为设置为 RESP_NONE
|
|
|
|
|
b_data[i] = RESP_NONE;
|
|
|
|
|
boring_len++;
|
|
|
|
|
|
|
|
|
|
} else if (xff_orig || x01_orig || s10_orig || a10_orig) {
|
|
|
|
|
|
|
|
|
|
// 如果有一个操作的结果与原始校验和相同,则将当前字节的行为设置为 RESP_MINOR
|
|
|
|
|
b_data[i] = RESP_MINOR;
|
|
|
|
|
boring_len++;
|
|
|
|
|
|
|
|
|
|
} else if (xor_ff == xor_01 && xor_ff == sub_10 && xor_ff == add_10) {
|
|
|
|
|
|
|
|
|
|
// 如果所有操作的结果均相同,则将当前字节的行为设置为 RESP_FIXED
|
|
|
|
|
b_data[i] = RESP_FIXED;
|
|
|
|
|
|
|
|
|
|
} else {
|
|
|
|
|
|
|
|
|
|
// 否则将当前字节的行为设置为 RESP_VARIABLE
|
|
|
|
|
b_data[i] = RESP_VARIABLE;
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
@ -583,24 +590,24 @@ static void analyze() {
|
|
|
|
|
|
|
|
|
|
if (prev_xff != xor_ff && prev_x01 != xor_01 && prev_s10 != sub_10 &&
|
|
|
|
|
prev_a10 != add_10) {
|
|
|
|
|
|
|
|
|
|
// 当所有校验和都发生变化时,将 b_data 的最高位翻转
|
|
|
|
|
seq_byte ^= 0x80;
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 将当前字节的行为与序列字节进行合并
|
|
|
|
|
b_data[i] |= seq_byte;
|
|
|
|
|
|
|
|
|
|
// 更新序列字节
|
|
|
|
|
prev_xff = xor_ff;
|
|
|
|
|
prev_x01 = xor_01;
|
|
|
|
|
prev_s10 = sub_10;
|
|
|
|
|
prev_a10 = add_10;
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 输出分析结果
|
|
|
|
|
dump_hex(in_len, b_data);
|
|
|
|
|
|
|
|
|
|
// 输出分析结束信息
|
|
|
|
|
SAYF("\n");
|
|
|
|
|
|
|
|
|
|
// 输出分析完成的信息,包括异常数据的百分比
|
|
|
|
|
OKF("Analysis complete. Interesting bits: %0.02f%% of the input file.",
|
|
|
|
|
100.0 - ((double)boring_len * 100) / in_len);
|
|
|
|
|
|
|
|
|
@ -610,7 +617,7 @@ static void analyze() {
|
|
|
|
|
exec_hangs);
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 释放分配的内存
|
|
|
|
|
ck_free(b_data);
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
@ -618,7 +625,7 @@ static void analyze() {
|
|
|
|
|
/* Handle Ctrl-C and the like. */
|
|
|
|
|
|
|
|
|
|
static void handle_stop_sig(int sig) {
|
|
|
|
|
|
|
|
|
|
//处理用户退出事件即 Ctrl-C 事件
|
|
|
|
|
(void)sig;
|
|
|
|
|
stop_soon = 1;
|
|
|
|
|
|
|
|
|
@ -627,39 +634,41 @@ static void handle_stop_sig(int sig) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Do basic preparations - persistent fds, filenames, etc. */
|
|
|
|
|
|
|
|
|
|
//设置环境,打开必要的系统文件,设置临时输出文件,处理和配置与内存分析、QEMU 和 Frida 相关的环境变量
|
|
|
|
|
static void set_up_environment(char **argv) {
|
|
|
|
|
|
|
|
|
|
u8 *x;
|
|
|
|
|
char *afl_preload;
|
|
|
|
|
char *frida_afl_preload = NULL;
|
|
|
|
|
|
|
|
|
|
// 尝试打开 /dev/null,获取文件描述符
|
|
|
|
|
fsrv.dev_null_fd = open("/dev/null", O_RDWR);
|
|
|
|
|
// 如果打开失败,则打印错误信息并终止程序
|
|
|
|
|
if (fsrv.dev_null_fd < 0) { PFATAL("Unable to open /dev/null"); }
|
|
|
|
|
|
|
|
|
|
// 如果输出文件未设置,默认使用当前目录
|
|
|
|
|
if (!fsrv.out_file) {
|
|
|
|
|
|
|
|
|
|
u8 *use_dir = ".";
|
|
|
|
|
|
|
|
|
|
// 检查当前目录是否可读、可写和可执行,若不可读、可写和可执行,则使用 /tmp 目录
|
|
|
|
|
if (access(use_dir, R_OK | W_OK | X_OK)) {
|
|
|
|
|
|
|
|
|
|
use_dir = get_afl_env("TMPDIR");
|
|
|
|
|
if (!use_dir) { use_dir = "/tmp"; }
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 分配临时输出文件名
|
|
|
|
|
fsrv.out_file =
|
|
|
|
|
alloc_printf("%s/.afl-analyze-temp-%u", use_dir, (u32)getpid());
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 删除已存在的临时输出文件
|
|
|
|
|
unlink(fsrv.out_file);
|
|
|
|
|
fsrv.out_fd =
|
|
|
|
|
open(fsrv.out_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
|
|
|
|
|
|
|
|
|
|
// 如果打开失败,则打印错误信息并终止程序
|
|
|
|
|
if (fsrv.out_fd < 0) { PFATAL("Unable to create '%s'", fsrv.out_file); }
|
|
|
|
|
|
|
|
|
|
/* Set sane defaults... */
|
|
|
|
|
// 获取 MSAN_OPTIONS 环境变量,并检查是否包含 exitcode=MSAN_ERROR
|
|
|
|
|
x = get_afl_env("MSAN_OPTIONS");
|
|
|
|
|
|
|
|
|
|
if (x) {
|
|
|
|
@ -672,9 +681,9 @@ static void set_up_environment(char **argv) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 设置默认的清理工具
|
|
|
|
|
set_sanitizer_defaults();
|
|
|
|
|
|
|
|
|
|
// 检查 AFL_PRELOAD 环境变量
|
|
|
|
|
if (get_afl_env("AFL_PRELOAD")) {
|
|
|
|
|
|
|
|
|
|
if (qemu_mode) {
|
|
|
|
@ -682,9 +691,11 @@ static void set_up_environment(char **argv) {
|
|
|
|
|
/* afl-qemu-trace takes care of converting AFL_PRELOAD. */
|
|
|
|
|
|
|
|
|
|
} else if (frida_mode) {
|
|
|
|
|
|
|
|
|
|
// 从环境变量获取 AFL_PRELOAD
|
|
|
|
|
afl_preload = getenv("AFL_PRELOAD");
|
|
|
|
|
// 查找 frida 二进制文件
|
|
|
|
|
u8 *frida_binary = find_afl_binary(argv[0], "afl-frida-trace.so");
|
|
|
|
|
// 根据 AFL_PRELOAD 是否设置,构建 frida_afl_preload
|
|
|
|
|
if (afl_preload) {
|
|
|
|
|
|
|
|
|
|
frida_afl_preload = alloc_printf("%s:%s", afl_preload, frida_binary);
|
|
|
|
@ -694,9 +705,9 @@ static void set_up_environment(char **argv) {
|
|
|
|
|
frida_afl_preload = alloc_printf("%s", frida_binary);
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 释放 frida_binary 的内存
|
|
|
|
|
ck_free(frida_binary);
|
|
|
|
|
|
|
|
|
|
// 设置 LD_PRELOAD 和 DYLD_INSERT_LIBRARIES 环境变量
|
|
|
|
|
setenv("LD_PRELOAD", frida_afl_preload, 1);
|
|
|
|
|
setenv("DYLD_INSERT_LIBRARIES", frida_afl_preload, 1);
|
|
|
|
|
|
|
|
|
@ -708,22 +719,23 @@ static void set_up_environment(char **argv) {
|
|
|
|
|
setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 如果没有设置 AFL_PRELOAD,但处于 frida 模式
|
|
|
|
|
} else if (frida_mode) {
|
|
|
|
|
|
|
|
|
|
u8 *frida_binary = find_afl_binary(argv[0], "afl-frida-trace.so");
|
|
|
|
|
setenv("LD_PRELOAD", frida_binary, 1);
|
|
|
|
|
setenv("DYLD_INSERT_LIBRARIES", frida_binary, 1);
|
|
|
|
|
ck_free(frida_binary);
|
|
|
|
|
// 释放 frida_binary 的内存
|
|
|
|
|
ck_free(frida_binary);
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 如果 frida_afl_preload 被分配了,释放其内存
|
|
|
|
|
if (frida_afl_preload) { ck_free(frida_afl_preload); }
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Setup signal handlers, duh. */
|
|
|
|
|
|
|
|
|
|
//设置程序的信号处理机制,通过设置 sa.sa_mask 和 sa.sa_flags,确保程序行为符合预期。
|
|
|
|
|
static void setup_signal_handlers(void) {
|
|
|
|
|
|
|
|
|
|
struct sigaction sa;
|
|
|
|
@ -748,7 +760,7 @@ static void setup_signal_handlers(void) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Display usage hints. */
|
|
|
|
|
|
|
|
|
|
//用户指引手册
|
|
|
|
|
static void usage(u8 *argv0) {
|
|
|
|
|
|
|
|
|
|
SAYF(
|
|
|
|
@ -812,33 +824,35 @@ int main(int argc, char **argv_orig, char **envp) {
|
|
|
|
|
u8 mem_limit_given = 0, timeout_given = 0, unicorn_mode = 0, use_wine = 0;
|
|
|
|
|
char **use_argv;
|
|
|
|
|
char **argv = argv_cpy_dup(argc, argv_orig);
|
|
|
|
|
|
|
|
|
|
// 检查文档路径是否存在,如果不存在,使用默认的文档路径
|
|
|
|
|
doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH;
|
|
|
|
|
|
|
|
|
|
// 输出程序的基本信息
|
|
|
|
|
SAYF(cCYA "afl-analyze" VERSION cRST " by Michal Zalewski\n");
|
|
|
|
|
|
|
|
|
|
// 初始化文件服务
|
|
|
|
|
afl_fsrv_init(&fsrv);
|
|
|
|
|
|
|
|
|
|
// 解析命令行参数
|
|
|
|
|
while ((opt = getopt(argc, argv, "+i:f:m:t:eAOQUWXYh")) > 0) {
|
|
|
|
|
|
|
|
|
|
switch (opt) {
|
|
|
|
|
|
|
|
|
|
case 'i':
|
|
|
|
|
|
|
|
|
|
// 检查是否重复指定
|
|
|
|
|
if (in_file) { FATAL("Multiple -i options not supported"); }
|
|
|
|
|
in_file = optarg;
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case 'f':
|
|
|
|
|
|
|
|
|
|
// 检查是否重复指定
|
|
|
|
|
if (fsrv.out_file) { FATAL("Multiple -f options not supported"); }
|
|
|
|
|
// 不使用标准输入
|
|
|
|
|
fsrv.use_stdin = 0;
|
|
|
|
|
fsrv.out_file = ck_strdup(optarg);
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
// 仅边缘分析
|
|
|
|
|
case 'e':
|
|
|
|
|
|
|
|
|
|
if (edges_only) { FATAL("Multiple -e options not supported"); }
|
|
|
|
|
// 启用仅边缘分析
|
|
|
|
|
edges_only = 1;
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
@ -847,25 +861,26 @@ int main(int argc, char **argv_orig, char **envp) {
|
|
|
|
|
u8 suffix = 'M';
|
|
|
|
|
|
|
|
|
|
if (mem_limit_given) { FATAL("Multiple -m options not supported"); }
|
|
|
|
|
// 设置标志表示已给定内存限制
|
|
|
|
|
mem_limit_given = 1;
|
|
|
|
|
|
|
|
|
|
// 检查参数有效性
|
|
|
|
|
if (!optarg) { FATAL("Wrong usage of -m"); }
|
|
|
|
|
|
|
|
|
|
if (!strcmp(optarg, "none")) {
|
|
|
|
|
|
|
|
|
|
// 如果指定为 none,设定内存限制为 0
|
|
|
|
|
mem_limit = 0;
|
|
|
|
|
fsrv.mem_limit = 0;
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 读取内存限制值
|
|
|
|
|
if (sscanf(optarg, "%llu%c", &mem_limit, &suffix) < 1 ||
|
|
|
|
|
optarg[0] == '-') {
|
|
|
|
|
|
|
|
|
|
FATAL("Bad syntax used for -m");
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 判定单位并转换为字节
|
|
|
|
|
switch (suffix) {
|
|
|
|
|
|
|
|
|
|
case 'T':
|
|
|
|
@ -884,15 +899,15 @@ int main(int argc, char **argv_orig, char **envp) {
|
|
|
|
|
FATAL("Unsupported suffix or bad syntax for -m");
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 防止设置过低的限制
|
|
|
|
|
if (mem_limit < 5) { FATAL("Dangerously low value of -m"); }
|
|
|
|
|
|
|
|
|
|
if (sizeof(rlim_t) == 4 && mem_limit > 2000) {
|
|
|
|
|
|
|
|
|
|
// 针对 32 位系统的范围检查
|
|
|
|
|
FATAL("Value of -m out of range on 32-bit systems");
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 设置文件服务的内存限制
|
|
|
|
|
fsrv.mem_limit = mem_limit;
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
@ -999,27 +1014,30 @@ int main(int argc, char **argv_orig, char **envp) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 检查是否提供了有效的输入文件
|
|
|
|
|
if (optind == argc || !in_file) { usage(argv[0]); }
|
|
|
|
|
|
|
|
|
|
// 获取映射大小并更新文件服务结构
|
|
|
|
|
map_size = get_map_size();
|
|
|
|
|
fsrv.map_size = map_size;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
use_hex_offsets = !!get_afl_env("AFL_ANALYZE_HEX");
|
|
|
|
|
|
|
|
|
|
// 检查环境变量
|
|
|
|
|
check_environment_vars(envp);
|
|
|
|
|
|
|
|
|
|
// 初始化共享内存结构
|
|
|
|
|
sharedmem_t shm = {0};
|
|
|
|
|
|
|
|
|
|
/* initialize cmplog_mode */
|
|
|
|
|
// 初始化 cmplog_mode
|
|
|
|
|
shm.cmplog_mode = 0;
|
|
|
|
|
|
|
|
|
|
// 注册退出处理函数
|
|
|
|
|
atexit(at_exit_handler);
|
|
|
|
|
// 设置信号处理函数
|
|
|
|
|
setup_signal_handlers();
|
|
|
|
|
|
|
|
|
|
// 设置环境
|
|
|
|
|
set_up_environment(argv);
|
|
|
|
|
|
|
|
|
|
#ifdef __linux__
|
|
|
|
|
// 根据模式查找目标路径
|
|
|
|
|
if (!fsrv.nyx_mode) {
|
|
|
|
|
|
|
|
|
|
fsrv.target_path = find_binary(argv[optind]);
|
|
|
|
@ -1033,11 +1051,13 @@ int main(int argc, char **argv_orig, char **envp) {
|
|
|
|
|
#else
|
|
|
|
|
fsrv.target_path = find_binary(argv[optind]);
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
// 初始化共享内存和跟踪位图
|
|
|
|
|
fsrv.trace_bits = afl_shm_init(&shm, map_size, 0);
|
|
|
|
|
// 检测后续文件参数
|
|
|
|
|
detect_file_args(argv + optind, fsrv.out_file, &use_stdin);
|
|
|
|
|
// 设置超时信号的处理
|
|
|
|
|
signal(SIGALRM, kill_child);
|
|
|
|
|
|
|
|
|
|
// 根据所选模式准备命令行参数
|
|
|
|
|
if (qemu_mode) {
|
|
|
|
|
|
|
|
|
|
if (use_wine) {
|
|
|
|
@ -1063,14 +1083,16 @@ int main(int argc, char **argv_orig, char **envp) {
|
|
|
|
|
fsrv.nyx_id = 0;
|
|
|
|
|
|
|
|
|
|
u8 *libnyx_binary = find_afl_binary(argv[0], "libnyx.so");
|
|
|
|
|
// 加载插件
|
|
|
|
|
fsrv.nyx_handlers = afl_load_libnyx_plugin(libnyx_binary);
|
|
|
|
|
if (fsrv.nyx_handlers == NULL) {
|
|
|
|
|
|
|
|
|
|
FATAL("failed to initialize libnyx.so...");
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 使用临时工作目录
|
|
|
|
|
fsrv.nyx_use_tmp_workdir = true;
|
|
|
|
|
// 绑定 CPU ID
|
|
|
|
|
fsrv.nyx_bind_cpu_id = 0;
|
|
|
|
|
|
|
|
|
|
use_argv = argv + optind;
|
|
|
|
@ -1081,27 +1103,28 @@ int main(int argc, char **argv_orig, char **envp) {
|
|
|
|
|
use_argv = argv + optind;
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 输出干运行的相关信息
|
|
|
|
|
SAYF("\n");
|
|
|
|
|
|
|
|
|
|
if (getenv("AFL_FORKSRV_INIT_TMOUT")) {
|
|
|
|
|
|
|
|
|
|
s32 forksrv_init_tmout = atoi(getenv("AFL_FORKSRV_INIT_TMOUT"));
|
|
|
|
|
if (forksrv_init_tmout < 1) {
|
|
|
|
|
|
|
|
|
|
// 检查初始化超时配置
|
|
|
|
|
FATAL("Bad value specified for AFL_FORKSRV_INIT_TMOUT");
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 设置初始化超时
|
|
|
|
|
fsrv.init_tmout = (u32)forksrv_init_tmout;
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 配置终止信号
|
|
|
|
|
configure_afl_kill_signals(
|
|
|
|
|
&fsrv, NULL, NULL, (fsrv.qemu_mode || unicorn_mode) ? SIGKILL : SIGTERM);
|
|
|
|
|
|
|
|
|
|
// 读取初始文件
|
|
|
|
|
read_initial_file();
|
|
|
|
|
#ifdef __linux__
|
|
|
|
|
// 检查二进制签名
|
|
|
|
|
if (!fsrv.nyx_mode) { (void)check_binary_signatures(fsrv.target_path); }
|
|
|
|
|
#else
|
|
|
|
|
(void)check_binary_signatures(fsrv.target_path);
|
|
|
|
@ -1109,29 +1132,33 @@ int main(int argc, char **argv_orig, char **envp) {
|
|
|
|
|
|
|
|
|
|
ACTF("Performing dry run (mem limit = %llu MB, timeout = %u ms%s)...",
|
|
|
|
|
mem_limit, exec_tmout, edges_only ? ", edges only" : "");
|
|
|
|
|
|
|
|
|
|
// 启动文件服务
|
|
|
|
|
afl_fsrv_start(&fsrv, use_argv, &stop_soon, false);
|
|
|
|
|
// 分析目标
|
|
|
|
|
analyze_run_target(in_data, in_len, 1);
|
|
|
|
|
|
|
|
|
|
if (fsrv.last_run_timed_out) {
|
|
|
|
|
|
|
|
|
|
// 检查执行超时
|
|
|
|
|
FATAL("Target binary times out (adjusting -t may help).");
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 检查是否进行过检测
|
|
|
|
|
if (get_afl_env("AFL_SKIP_BIN_CHECK") == NULL && !anything_set()) {
|
|
|
|
|
|
|
|
|
|
FATAL("No instrumentation detected.");
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 调用分析函数(主要功能接口
|
|
|
|
|
analyze();
|
|
|
|
|
|
|
|
|
|
OKF("We're done here. Have a nice day!\n");
|
|
|
|
|
|
|
|
|
|
// 释放共享内存
|
|
|
|
|
afl_shm_deinit(&shm);
|
|
|
|
|
// 释放文件服务
|
|
|
|
|
afl_fsrv_deinit(&fsrv);
|
|
|
|
|
// 释放目标路径
|
|
|
|
|
if (fsrv.target_path) { ck_free(fsrv.target_path); }
|
|
|
|
|
// 释放输入数据
|
|
|
|
|
if (in_data) { ck_free(in_data); }
|
|
|
|
|
|
|
|
|
|
exit(0);
|
|
|
|
|