rewrite gcc plugin

When we started using AFL, it did not have an integrated GCC plugin.
There was one proposed by Austin Seipp, but for various reasons we
ended up using some of its infrastructure (runtime and wrapper), but
writing the GCC plugin proper from scratch.

With AFL++'s renewed interest in a GCC plugin, we rebased ours, with
some features that are or were missing in the one that was integrated:

* efficient, fully-functional inline and out-of-line instrumentation

Inline instrumentation was work in progress in the original plugin.
Controlled by AFL_GCC_OUT_OF_LINE.

* reproducible instrumentation

Obey -frandom-seed for pseudorandom number generation.

* licensing clarity and strict compliance

GPLv3+ for the plugin, that uses GCC internals; add a copy of the
license, as required.

* allow/deny list support

Copied and adjusted from the LLVM plugin implementation.

* neverZero support

Not as compact as the asm-wrapper version, but likely more efficient.
Both are quite thread-unsafe, with different caveats.
Controlled with AFL_GCC_SKIP_NEVERZERO.

1 files changed, 40 insertions, 3 deletions

diff --git a/test/test-performance.sh b/test/test-performance.sh
index cee46060..cd6eea64 100755
--- a/test/test-performance.sh
+++ b/test/test-performance.sh
@@ -117,6 +117,30 @@ test -e ../afl-clang-fast -a -e ../afl-fuzz && {
   } || $ECHO "$RED[!] llvm_mode instrumentation failed"
 } || $ECHO "$YELLOW[-] llvm_mode is not compiled, cannot test"
 
+$ECHO "$BLUE[*] Testing: gcc_plugin"
+GCCP=x
+test -e ../afl-gcc-fast -a -e ../afl-fuzz && {
+  ../afl-gcc-fast -o test-instr.gccp ../test-instr.c > /dev/null 2>&1
+  test -e test-instr.gccp && {
+    $ECHO "$GREEN[+] gcc_plugin compilation succeeded"
+    mkdir -p in
+    echo 0 > in/in
+    $ECHO "$GREY[*] running afl-fuzz for gcc_plugin for 30 seconds"
+    {
+      ../afl-fuzz -V 30 -s 123 -m ${MEM_LIMIT} -i in -o out-gccp -- ./test-instr.gccp
+    } >>errors 2>&1
+    test -n "$( ls out-gccp/queue/id:000002* 2> /dev/null )" && {
+      GCCP=`grep execs_done out-gccp/fuzzer_stats | awk '{print$3}'`
+    } || {
+        echo CUT----------------------------------------------------------------
+        cat errors
+        echo CUT----------------------------------------------------------------
+      $ECHO "$RED[!] afl-fuzz is not working correctly with gcc_plugin"
+    }
+    rm -rf in out-gccp errors test-instr.gccp
+  } || $ECHO "$RED[!] gcc_plugin instrumentation failed"
+} || $ECHO "$YELLOW[-] gcc_plugin is not compiled, cannot test"
+
 $ECHO "$BLUE[*] Testing: qemu_mode"
 QEMU=x
 test -e ../afl-qemu-trace -a -e ../afl-fuzz && {
@@ -147,6 +171,9 @@ LAST_GCC=
 LOW_LLVM=
 HIGH_LLVM=
 LAST_LLVM=
+LOW_GCCP=
+HIGH_GCCP=
+LAST_GCCP=
 LOW_QEMU=
 HIGH_QEMU=
 LAST_QEMU=
@@ -155,12 +182,15 @@ test -s $FILE && {
   while read LINE; do
     G=`echo $LINE | awk '{print$1}'`
     L=`echo $LINE | awk '{print$2}'`
-    Q=`echo $LINE | awk '{print$3}'`
+    P=`echo $LINE | awk '{print$3}'`
+    Q=`echo $LINE | awk '{print$4}'`
     test "$G" = x && G=
     test "$L" = x && L=
+    test "$P" = x && P=
     test "$Q" = x && Q=
     test -n "$G" && LAST_GCC=$G
     test -n "$L" && LAST_LLVM=$L
+    test -n "$P" && LAST_GCCP=$P
     test -n "$Q" && LAST_QEMU=$Q
     test -n "$G" -a -z "$LOW_GCC" && LOW_GCC=$G || {
       test -n "$G" -a "$G" -lt "$LOW_GCC" 2> /dev/null && LOW_GCC=$G
@@ -168,6 +198,9 @@ test -s $FILE && {
     test -n "$L" -a -z "$LOW_LLVM" && LOW_LLVM=$L || {
       test -n "$L" -a "$L" -lt "$LOW_LLVM" 2> /dev/null && LOW_LLVM=$L
     }
+    test -n "$P" -a -z "$LOW_GCCP" && LOW_GCCP=$P || {
+      test -n "$P" -a "$P" -lt "$LOW_GCCP" 2> /dev/null && LOW_GCCP=$P
+    }
     test -n "$Q" -a -z "$LOW_QEMU" && LOW_QEMU=$Q || {
       test -n "$Q" -a "$Q" -lt "$LOW_QEMU" 2> /dev/null && LOW_QEMU=$Q
     }   
@@ -177,6 +210,9 @@ test -s $FILE && {
     test -n "$L" -a -z "$HIGH_LLVM" && HIGH_LLVM=$L || {
       test -n "$L" -a "$L" -gt "$HIGH_LLVM" 2> /dev/null && HIGH_LLVM=$L
     }
+    test -n "$P" -a -z "$HIGH_GCCP" && HIGH_GCCP=$P || {
+      test -n "$P" -a "$P" -gt "$HIGH_GCCP" 2> /dev/null && HIGH_GCCP=$P
+    }
     test -n "$Q" -a -z "$HIGH_QEMU" && HIGH_QEMU=$Q || {
       test -n "$Q" -a "$Q" -gt "$HIGH_QEMU" 2> /dev/null && HIGH_QEMU=$Q
     }
@@ -184,11 +220,12 @@ test -s $FILE && {
   $ECHO "$YELLOW[!] Reading saved data from $FILE completed, please compare the results:"
   $ECHO "$BLUE[!] afl-cc: lowest=$LOW_GCC highest=$HIGH_GCC last=$LAST_GCC current=$GCC"
   $ECHO "$BLUE[!] llvm_mode: lowest=$LOW_LLVM highest=$HIGH_LLVM last=$LAST_LLVM current=$LLVM"
+  $ECHO "$BLUE[!] gcc_plugin: lowest=$LOW_GCCP highest=$HIGH_GCCP last=$LAST_GCCP current=$GCCP"
   $ECHO "$BLUE[!] qemu_mode: lowest=$LOW_QEMU highest=$HIGH_QEMU last=$LAST_QEMU current=$QEMU"
 } || {
   $ECHO "$YELLOW[!] First run, just saving data"
-  $ECHO "$BLUE[!] afl-gcc=$GCC  llvm_mode=$LLVM  qemu_mode=$QEMU"
+  $ECHO "$BLUE[!] afl-gcc=$GCC  llvm_mode=$LLVM  gcc_plugin=$GCCP  qemu_mode=$QEMU"
 }
-echo "$GCC $LLVM $QEMU" >> $FILE
+echo "$GCC $LLVM $GCCP $QEMU" >> $FILE
 $ECHO "$GREY[*] done."
 $ECHO "$RESET"