aboutsummaryrefslogtreecommitdiff
path: root/custom_mutators/symqemu/symqemu.c
diff options
context:
space:
mode:
Diffstat (limited to 'custom_mutators/symqemu/symqemu.c')
-rw-r--r--custom_mutators/symqemu/symqemu.c424
1 files changed, 424 insertions, 0 deletions
diff --git a/custom_mutators/symqemu/symqemu.c b/custom_mutators/symqemu/symqemu.c
new file mode 100644
index 00000000..73a1640a
--- /dev/null
+++ b/custom_mutators/symqemu/symqemu.c
@@ -0,0 +1,424 @@
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <ctype.h>
+#include "config.h"
+#include "debug.h"
+#include "afl-fuzz.h"
+#include "common.h"
+
+afl_state_t *afl_struct;
+static u32 debug = 0;
+static u32 found_items = 0;
+
+#define SYMQEMU_LOCATION "symqemu"
+
+#define DBG(x...) \
+ if (debug) { fprintf(stderr, x); }
+
+typedef struct my_mutator {
+
+ afl_state_t *afl;
+ u32 all;
+ u32 late;
+ u8 *mutator_buf;
+ u8 *out_dir;
+ u8 *target;
+ u8 *symqemu;
+ u8 *input_file;
+ u32 counter;
+ u32 seed;
+ u32 argc;
+ u8 **argv;
+
+} my_mutator_t;
+
+my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
+
+ if (getenv("AFL_DEBUG")) debug = 1;
+
+ my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
+ if (!data) {
+
+ perror("afl_custom_init alloc");
+ return NULL;
+
+ }
+
+ char *path = getenv("PATH");
+ char *exec_name = "symqemu-x86_64";
+ char *token = strtok(path, ":");
+ char exec_path[4096];
+
+ while (token != NULL && data->symqemu == NULL) {
+
+ snprintf(exec_path, sizeof(exec_path), "%s/%s", token, exec_name);
+ if (access(exec_path, X_OK) == 0) {
+
+ data->symqemu = (u8 *)strdup(exec_path);
+ break;
+
+ }
+
+ token = strtok(NULL, ":");
+
+ }
+
+ if (!data->symqemu) FATAL("symqemu binary %s not found", exec_name);
+ DBG("Found %s\n", data->symqemu);
+
+ if (getenv("AFL_CUSTOM_MUTATOR_ONLY")) {
+
+ WARNF(
+ "the symqemu module is not very effective with "
+ "AFL_CUSTOM_MUTATOR_ONLY.");
+
+ }
+
+ if ((data->mutator_buf = malloc(MAX_FILE)) == NULL) {
+
+ free(data);
+ perror("mutator_buf alloc");
+ return NULL;
+
+ }
+
+ data->target = getenv("AFL_CUSTOM_INFO_PROGRAM");
+
+ u8 *path_tmp = getenv("AFL_CUSTOM_INFO_OUT");
+ u32 len = strlen(path_tmp) + 32;
+ u8 *symqemu_path = malloc(len);
+ data->out_dir = malloc(len);
+ snprintf(symqemu_path, len, "%s/%s", path_tmp, SYMQEMU_LOCATION);
+ snprintf(data->out_dir, len, "%s/out", symqemu_path, path_tmp);
+
+ (void)mkdir(symqemu_path, 0755);
+ (void)mkdir(data->out_dir, 0755);
+
+ setenv("SYMCC_OUTPUT_DIR", data->out_dir, 1);
+
+ data->input_file = getenv("AFL_CUSTOM_INFO_PROGRAM_INPUT");
+
+ u8 *tmp = NULL;
+ if ((tmp = getenv("AFL_CUSTOM_INFO_PROGRAM_ARGV")) && *tmp) {
+
+ int argc = 0, index = 2;
+ for (u32 i = 0; i < strlen(tmp); ++i)
+ if (isspace(tmp[i])) ++argc;
+
+ data->argv = (u8 **)malloc((argc + 4) * sizeof(u8 **));
+ u8 *p = strdup(tmp);
+
+ do {
+
+ data->argv[index] = p;
+ while (*p && !isspace(*p))
+ ++p;
+ if (*p) {
+
+ *p++ = 0;
+ while (isspace(*p))
+ ++p;
+
+ }
+
+ if (strcmp(data->argv[index], "@@") == 0) {
+
+ if (!data->input_file) {
+
+ u32 ilen = strlen(symqemu_path) + 32;
+ data->input_file = malloc(ilen);
+ snprintf(data->input_file, ilen, "%s/.input", symqemu_path);
+
+ }
+
+ data->argv[index] = data->input_file;
+
+ }
+
+ DBG("%d: %s\n", index, data->argv[index]);
+ index++;
+
+ } while (*p);
+
+ data->argv[index] = NULL;
+ data->argc = index;
+
+ } else {
+
+ data->argv = (u8 **)malloc(8 * sizeof(u8 **));
+ data->argc = 2;
+ data->argv[2] = NULL;
+
+ }
+
+ data->argv[0] = data->symqemu;
+ data->argv[1] = data->target;
+ data->afl = afl;
+ data->seed = seed;
+ afl_struct = afl;
+
+ if (getenv("SYMQEMU_ALL")) { data->all = 1; }
+ if (getenv("SYMQEMU_LATE")) { data->late = 1; }
+ if (data->input_file) { setenv("SYMCC_INPUT_FILE", data->input_file, 1); }
+
+ DBG("out_dir=%s, target=%s, input_file=%s, argc=%u\n", data->out_dir,
+ data->target,
+ data->input_file ? (char *)data->input_file : (char *)"<stdin>",
+ data->argc);
+
+ if (debug) {
+
+ fprintf(stderr, "[");
+ for (u32 i = 0; i <= data->argc; ++i)
+ fprintf(stderr, " \"%s\"",
+ data->argv[i] ? (char *)data->argv[i] : "<NULL>");
+ fprintf(stderr, " ]\n");
+
+ }
+
+ return data;
+
+}
+
+/* No need to receive a splicing item */
+void afl_custom_splice_optout(void *data) {
+
+ (void)(data);
+
+}
+
+/* Get unix time in milliseconds */
+
+inline u64 get_cur_time(void) {
+
+ struct timeval tv;
+ struct timezone tz;
+
+ gettimeofday(&tv, &tz);
+
+ return (tv.tv_sec * 1000ULL) + (tv.tv_usec / 1000);
+
+}
+
+u32 afl_custom_fuzz_count(my_mutator_t *data, const u8 *buf, size_t buf_size) {
+
+ if (likely((!afl_struct->queue_cur->favored && !data->all) ||
+ afl_struct->queue_cur->was_fuzzed)) {
+
+ return 0;
+
+ }
+
+ if (likely(data->late)) {
+
+ if (unlikely(get_cur_time() - afl_struct->last_find_time <=
+ 10 * 60 * 1000)) {
+
+ return 0;
+
+ }
+
+ }
+
+ int pipefd[2];
+ struct stat st;
+
+ if (afl_struct->afl_env.afl_no_ui) {
+
+ ACTF("Sending to symqemu: %s", afl_struct->queue_cur->fname);
+
+ }
+
+ if (!(stat(afl_struct->queue_cur->fname, &st) == 0 && S_ISREG(st.st_mode) &&
+ st.st_size)) {
+
+ PFATAL("Couldn't find enqueued file: %s", afl_struct->queue_cur->fname);
+
+ }
+
+ if (afl_struct->fsrv.use_stdin) {
+
+ if (pipe(pipefd) == -1) {
+
+ PFATAL(
+ "Couldn't create a pipe for interacting with symqemu child process");
+
+ }
+
+ }
+
+ if (data->input_file) {
+
+ int fd = open(data->input_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
+ ssize_t s = write(fd, buf, buf_size);
+ close(fd);
+ DBG("wrote %zd/%zd to %s\n", s, buf_size, data->input_file);
+
+ }
+
+ int pid = fork();
+
+ if (pid == -1) return 0;
+
+ if (likely(pid)) {
+
+ if (!data->input_file || afl_struct->fsrv.use_stdin) {
+
+ close(pipefd[0]);
+
+ if (fcntl(pipefd[1], F_GETPIPE_SZ)) {
+
+ fcntl(pipefd[1], F_SETPIPE_SZ, MAX_FILE);
+
+ }
+
+ ck_write(pipefd[1], buf, buf_size, data->input_file);
+
+ close(pipefd[1]);
+
+ }
+
+ pid = waitpid(pid, NULL, 0);
+ DBG("symqemu finished executing!\n");
+
+ } else /* (pid == 0) */ { // child
+
+ if (afl_struct->fsrv.use_stdin) {
+
+ close(pipefd[1]);
+ dup2(pipefd[0], 0);
+
+ }
+
+ DBG("exec=%s\n", data->target);
+ if (!debug) {
+
+ close(1);
+ close(2);
+ dup2(afl_struct->fsrv.dev_null_fd, 1);
+ dup2(afl_struct->fsrv.dev_null_fd, 2);
+
+ }
+
+ execvp((char *)data->argv[0], (char **)data->argv);
+ fprintf(stderr, "Executing: [");
+ for (u32 i = 0; i <= data->argc; ++i)
+ fprintf(stderr, " \"%s\"",
+ data->argv[i] ? (char *)data->argv[i] : "<NULL>");
+ fprintf(stderr, " ]\n");
+ FATAL("Failed to execute %s %s\n", data->argv[0], data->argv[1]);
+ exit(-1);
+
+ }
+
+ /* back in mother process */
+
+ struct dirent **nl;
+ s32 i, items = scandir(data->out_dir, &nl, NULL, NULL);
+ found_items = 0;
+ char source_name[4096];
+
+ if (items > 0) {
+
+ for (i = 0; i < (u32)items; ++i) {
+
+ // symqemu output files start with a digit
+ if (!isdigit(nl[i]->d_name[0])) continue;
+
+ struct stat st;
+ snprintf(source_name, sizeof(source_name), "%s/%s", data->out_dir,
+ nl[i]->d_name);
+ DBG("file=%s\n", source_name);
+
+ if (stat(source_name, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
+
+ ++found_items;
+
+ }
+
+ free(nl[i]);
+
+ }
+
+ free(nl);
+
+ }
+
+ DBG("Done, found %u items!\n", found_items);
+
+ return found_items;
+
+}
+
+size_t afl_custom_fuzz(my_mutator_t *data, u8 *buf, size_t buf_size,
+ u8 **out_buf, u8 *add_buf, size_t add_buf_size,
+ size_t max_size) {
+
+ struct dirent **nl;
+ s32 done = 0, i, items = scandir(data->out_dir, &nl, NULL, NULL);
+ char source_name[4096];
+
+ if (items > 0) {
+
+ for (i = 0; i < (u32)items; ++i) {
+
+ // symqemu output files start with a digit
+ if (!isdigit(nl[i]->d_name[0])) continue;
+
+ struct stat st;
+ snprintf(source_name, sizeof(source_name), "%s/%s", data->out_dir,
+ nl[i]->d_name);
+ DBG("file=%s\n", source_name);
+
+ if (stat(source_name, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) {
+
+ int fd = open(source_name, O_RDONLY);
+ if (fd < 0) { goto got_an_issue; }
+
+ ssize_t r = read(fd, data->mutator_buf, MAX_FILE);
+ close(fd);
+
+ DBG("fn=%s, fd=%d, size=%ld\n", source_name, fd, r);
+
+ if (r < 1) { goto got_an_issue; }
+
+ done = 1;
+ --found_items;
+ unlink(source_name);
+
+ *out_buf = data->mutator_buf;
+ return (u32)r;
+
+ }
+
+ free(nl[i]);
+
+ }
+
+ free(nl);
+
+ }
+
+got_an_issue:
+ *out_buf = NULL;
+ return 0;
+
+}
+
+/**
+ * Deinitialize everything
+ *
+ * @param data The data ptr from afl_custom_init
+ */
+void afl_custom_deinit(my_mutator_t *data) {
+
+ free(data->mutator_buf);
+ free(data);
+
+}
+
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-26 20:35:50 +0000