/* american fuzzy lop++ - misc stuffs from Mordor ---------------------------------------------- Originally written by Michal Zalewski Now maintained by by Marc Heuse , Heiko Eißfeldt and Andrea Fioraldi Copyright 2016, 2017 Google Inc. All rights reserved. Copyright 2019 AFLplusplus Project. All rights reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at: http://www.apache.org/licenses/LICENSE-2.0 This is the real deal: the program takes an instrumented binary and attempts a variety of basic fuzzing tricks, paying close attention to how they affect the execution path. */ #include "afl-fuzz.h" /* Describe integer. Uses 12 cyclic static buffers for return values. The value returned should be five characters or less for all the integers we reasonably expect to see. */ u8* DI(u64 val) { static u8 tmp[12][16]; static u8 cur; cur = (cur + 1) % 12; #define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \ do { \ \ if (val < (_divisor) * (_limit_mult)) { \ \ sprintf(tmp[cur], _fmt, ((_cast)val) / (_divisor)); \ return tmp[cur]; \ \ } \ \ } while (0) /* 0-9999 */ CHK_FORMAT(1, 10000, "%llu", u64); /* 10.0k - 99.9k */ CHK_FORMAT(1000, 99.95, "%0.01fk", double); /* 100k - 999k */ CHK_FORMAT(1000, 1000, "%lluk", u64); /* 1.00M - 9.99M */ CHK_FORMAT(1000 * 1000, 9.995, "%0.02fM", double); /* 10.0M - 99.9M */ CHK_FORMAT(1000 * 1000, 99.95, "%0.01fM", double); /* 100M - 999M */ CHK_FORMAT(1000 * 1000, 1000, "%lluM", u64); /* 1.00G - 9.99G */ CHK_FORMAT(1000LL * 1000 * 1000, 9.995, "%0.02fG", double); /* 10.0G - 99.9G */ CHK_FORMAT(1000LL * 1000 * 1000, 99.95, "%0.01fG", double); /* 100G - 999G */ CHK_FORMAT(1000LL * 1000 * 1000, 1000, "%lluG", u64); /* 1.00T - 9.99G */ CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 9.995, "%0.02fT", double); /* 10.0T - 99.9T */ CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 99.95, "%0.01fT", double); /* 100T+ */ strcpy(tmp[cur], "infty"); return tmp[cur]; } /* Describe float. Similar to the above, except with a single static buffer. */ u8* DF(double val) { static u8 tmp[16]; if (val < 99.995) { sprintf(tmp, "%0.02f", val); return tmp; } if (val < 999.95) { sprintf(tmp, "%0.01f", val); return tmp; } return DI((u64)val); } /* Describe integer as memory size. */ u8* DMS(u64 val) { static u8 tmp[12][16]; static u8 cur; cur = (cur + 1) % 12; /* 0-9999 */ CHK_FORMAT(1, 10000, "%llu B", u64); /* 10.0k - 99.9k */ CHK_FORMAT(1024, 99.95, "%0.01f kB", double); /* 100k - 999k */ CHK_FORMAT(1024, 1000, "%llu kB", u64); /* 1.00M - 9.99M */ CHK_FORMAT(1024 * 1024, 9.995, "%0.02f MB", double); /* 10.0M - 99.9M */ CHK_FORMAT(1024 * 1024, 99.95, "%0.01f MB", double); /* 100M - 999M */ CHK_FORMAT(1024 * 1024, 1000, "%llu MB", u64); /* 1.00G - 9.99G */ CHK_FORMAT(1024LL * 1024 * 1024, 9.995, "%0.02f GB", double); /* 10.0G - 99.9G */ CHK_FORMAT(1024LL * 1024 * 1024, 99.95, "%0.01f GB", double); /* 100G - 999G */ CHK_FORMAT(1024LL * 1024 * 1024, 1000, "%llu GB", u64); /* 1.00T - 9.99G */ CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 9.995, "%0.02f TB", double); /* 10.0T - 99.9T */ CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 99.95, "%0.01f TB", double); #undef CHK_FORMAT /* 100T+ */ strcpy(tmp[cur], "infty"); return tmp[cur]; } /* Describe time delta. Returns one static buffer, 34 chars of less. */ u8* DTD(u64 cur_ms, u64 event_ms) { static u8 tmp[64]; u64 delta; s32 t_d, t_h, t_m, t_s; if (!event_ms) return "none seen yet"; delta = cur_ms - event_ms; t_d = delta / 1000 / 60 / 60 / 24; t_h = (delta / 1000 / 60 / 60) % 24; t_m = (delta / 1000 / 60) % 60; t_s = (delta / 1000) % 60; sprintf(tmp, "%s days, %d hrs, %d min, %d sec", DI(t_d), t_h, t_m, t_s); return tmp; }