Skip to content

Commit 8ea8209

Browse files
Evian-ZhangEvian-Zhang
authored
Make cmplog implementation consistent with AFL++ (#3299)
* Make cmplog implementation consistent with AFL++ * Make all API consistent
1 parent 70d5eca commit 8ea8209

File tree

3 files changed

+43
-35
lines changed

3 files changed

+43
-35
lines changed

‎libafl_targets/src/cmplog.c

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -97,15 +97,15 @@ static inline long area_is_valid(const void *ptr, size_t len) {
9797
}
9898

9999
// Very generic cmplog instructions callback
100-
void __libafl_targets_cmplog_instructions(uintptr_t k, uint8_t shape,
100+
void __libafl_targets_cmplog_instructions(uintptr_t k, uint8_t size,
101101
uint64_t arg1, uint64_t arg2) {
102-
cmplog_instructions_checked(k, shape, arg1, arg2, 0);
102+
cmplog_instructions_checked(k, size, arg1, arg2, 0);
103103
}
104104

105105
// Very generic afl++ style cmplog instructions callback
106-
void __libafl_targets_cmplog_instructions_extended(uintptr_t k, uint8_t shape,
106+
void __libafl_targets_cmplog_instructions_extended(uintptr_t k, uint8_t size,
107107
uint64_t arg1, uint64_t arg2) {
108-
cmplog_instructions_checked_extended(k, shape, arg1, arg2, 0);
108+
cmplog_instructions_checked_extended(k, size, arg1, arg2, 0);
109109
}
110110

111111
// Very generic cmplog routines callback
@@ -179,7 +179,7 @@ void __cmplog_ins_hook1_extended(uint8_t arg1, uint8_t arg2, uint8_t attr) {
179179
k = (k >> 4) ^ (k << 8);
180180
k &= CMPLOG_MAP_W - 1;
181181

182-
cmplog_instructions_checked_extended(k, 0, arg1, arg2, attr);
182+
cmplog_instructions_checked_extended(k, 1, arg1, arg2, attr);
183183
}
184184
void __cmplog_ins_hook1(uint8_t arg1, uint8_t arg2) {
185185
uintptr_t k = RETADDR;
@@ -194,7 +194,7 @@ void __cmplog_ins_hook2_extended(uint16_t arg1, uint16_t arg2, uint8_t attr) {
194194
k = (k >> 4) ^ (k << 8);
195195
k &= CMPLOG_MAP_W - 1;
196196

197-
cmplog_instructions_checked_extended(k, 1, arg1, arg2, attr);
197+
cmplog_instructions_checked_extended(k, 2, arg1, arg2, attr);
198198
}
199199
void __cmplog_ins_hook2(uint16_t arg1, uint16_t arg2) {
200200
uintptr_t k = RETADDR;
@@ -209,7 +209,7 @@ void __cmplog_ins_hook4_extended(uint32_t arg1, uint32_t arg2, uint8_t attr) {
209209
k = (k >> 4) ^ (k << 8);
210210
k &= CMPLOG_MAP_W - 1;
211211

212-
cmplog_instructions_checked_extended(k, 3, arg1, arg2, attr);
212+
cmplog_instructions_checked_extended(k, 4, arg1, arg2, attr);
213213
}
214214
void __cmplog_ins_hook4(uint32_t arg1, uint32_t arg2) {
215215
uintptr_t k = RETADDR;
@@ -224,7 +224,7 @@ void __cmplog_ins_hook8_extended(uint64_t arg1, uint64_t arg2, uint8_t attr) {
224224
k = (k >> 4) ^ (k << 8);
225225
k &= CMPLOG_MAP_W - 1;
226226

227-
cmplog_instructions_checked_extended(k, 7, arg1, arg2, attr);
227+
cmplog_instructions_checked_extended(k, 8, arg1, arg2, attr);
228228
}
229229
void __cmplog_ins_hook8(uint64_t arg1, uint64_t arg2) {
230230
uintptr_t k = RETADDR;
@@ -241,7 +241,7 @@ void __cmplog_ins_hook16_extended(uint128_t arg1, uint128_t arg2,
241241
k = (k >> 4) ^ (k << 8);
242242
k &= CMPLOG_MAP_W - 1;
243243

244-
cmplog_instructions_checked_extended(k, 15, arg1, arg2, attr);
244+
cmplog_instructions_checked_extended(k, 16, arg1, arg2, attr);
245245
}
246246
void __cmplog_ins_hook16(uint128_t arg1, uint128_t arg2) {
247247
uintptr_t k = RETADDR;
@@ -257,7 +257,7 @@ void __cmplog_ins_hookN_extended(uint128_t arg1, uint128_t arg2, uint8_t attr,
257257
k = (k >> 4) ^ (k << 8);
258258
k &= CMPLOG_MAP_W - 1;
259259

260-
cmplog_instructions_checked_extended(k, size - 1, arg1, arg2, attr);
260+
cmplog_instructions_checked_extended(k, size, arg1, arg2, attr);
261261
}
262262
void __cmplog_ins_hookN(uint128_t arg1, uint128_t arg2, uint8_t size) {
263263
uintptr_t k = RETADDR;

‎libafl_targets/src/cmplog.h

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -106,12 +106,15 @@ extern uint8_t libafl_cmplog_enabled;
106106
// cmplog_routines_checked,
107107
// cmplog_routines_checked_extended
108108

109-
static inline void cmplog_instructions_checked(uintptr_t k, uint8_t shape,
109+
// size is the operand size of instruction, which should be greater than 0
110+
static inline void cmplog_instructions_checked(uintptr_t k, uint8_t size,
110111
uint64_t arg1, uint64_t arg2,
111112
uint8_t arg1_is_const) {
112113
if (!libafl_cmplog_enabled) { return; }
113114
libafl_cmplog_enabled = false;
114115

116+
if (size == 0) { return; }
117+
uint8_t shape = size - 1;
115118
uint16_t hits;
116119
if (libafl_cmplog_map_ptr->headers[k].kind != CMPLOG_KIND_INS) {
117120
libafl_cmplog_map_ptr->headers[k].kind = CMPLOG_KIND_INS;
@@ -132,12 +135,16 @@ static inline void cmplog_instructions_checked(uintptr_t k, uint8_t shape,
132135
libafl_cmplog_enabled = true;
133136
}
134137

138+
// size is the operand size of instruction, which should be greater than 0
135139
static inline void cmplog_instructions_checked_extended(
136-
uintptr_t k, uint8_t shape, uint64_t arg1, uint64_t arg2, uint8_t attr) {
140+
uintptr_t k, uint8_t size, uint64_t arg1, uint64_t arg2, uint8_t attr) {
137141
#ifdef CMPLOG_EXTENDED
138142
if (!libafl_cmplog_enabled) { return; }
139143
libafl_cmplog_enabled = false;
140144

145+
if (size == 0) { return; }
146+
uint8_t shape = size - 1;
147+
141148
// printf("%ld %ld %ld\n", k, arg1, arg2);
142149
uint16_t hits;
143150
if (libafl_cmplog_map_extended_ptr->headers[k].type != CMPLOG_KIND_INS) {
@@ -160,7 +167,7 @@ static inline void cmplog_instructions_checked_extended(
160167
#else
161168
// just do nothing
162169
(void)k;
163-
(void)shape;
170+
(void)size;
164171
(void)arg1;
165172
(void)arg2;
166173
(void)attr;
@@ -176,13 +183,12 @@ static inline void cmplog_routines_checked(uintptr_t k, const uint8_t *ptr1,
176183
if (libafl_cmplog_map_ptr->headers[k].kind != CMPLOG_KIND_RTN) {
177184
libafl_cmplog_map_ptr->headers[k].kind = CMPLOG_KIND_RTN;
178185
libafl_cmplog_map_ptr->headers[k].hits = 1;
179-
libafl_cmplog_map_ptr->headers[k].shape = len;
186+
libafl_cmplog_map_ptr->headers[k].shape = len - 1;
180187
hits = 0;
181188
} else {
182189
hits = libafl_cmplog_map_ptr->headers[k].hits++;
183190
if (libafl_cmplog_map_ptr->headers[k].shape < len) {
184-
libafl_cmplog_map_ptr->headers[k].shape =
185-
len; // TODO; adjust len for AFL++'s cmplog protocol
191+
libafl_cmplog_map_ptr->headers[k].shape = len - 1;
186192
}
187193
}
188194

@@ -204,19 +210,18 @@ static inline void cmplog_routines_checked_extended(uintptr_t k,
204210
if (libafl_cmplog_map_extended_ptr->headers[k].type != CMPLOG_KIND_RTN) {
205211
libafl_cmplog_map_extended_ptr->headers[k].type = CMPLOG_KIND_RTN;
206212
libafl_cmplog_map_extended_ptr->headers[k].hits = 1;
207-
libafl_cmplog_map_extended_ptr->headers[k].shape = len;
213+
libafl_cmplog_map_extended_ptr->headers[k].shape = len - 1;
208214
hits = 0;
209215
} else {
210216
hits = libafl_cmplog_map_extended_ptr->headers[k].hits++;
211217
if (libafl_cmplog_map_extended_ptr->headers[k].shape < len) {
212-
libafl_cmplog_map_extended_ptr->headers[k].shape =
213-
len; // TODO; adjust len for AFL++'s cmplog protocol
218+
libafl_cmplog_map_extended_ptr->headers[k].shape = len - 1;
214219
}
215220
}
216221

217222
hits &= CMPLOG_MAP_RTN_H - 1;
218-
libafl_cmplog_map_extended_ptr->vals.routines[k][hits].v0_len = len;
219-
libafl_cmplog_map_extended_ptr->vals.routines[k][hits].v1_len = len;
223+
libafl_cmplog_map_extended_ptr->vals.routines[k][hits].v0_len = 0x80 + len;
224+
libafl_cmplog_map_extended_ptr->vals.routines[k][hits].v1_len = 0x80 + len;
220225
MEMCPY(libafl_cmplog_map_extended_ptr->vals.routines[k][hits].v0, ptr1, len);
221226
MEMCPY(libafl_cmplog_map_extended_ptr->vals.routines[k][hits].v1, ptr2, len);
222227
libafl_cmplog_enabled = true;

‎libafl_targets/src/cmps/mod.rs

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,13 @@ pub const CMPLOG_KIND_RTN: u8 = 1;
4646
// EXTERNS, GLOBALS
4747

4848
#[cfg(any(feature = "cmplog", feature = "sancov_cmplog", feature = "sancov_value_profile"))]
49-
// void __libafl_targets_cmplog_instructions(uintptr_t k, uint8_t shape, uint64_t arg1, uint64_t arg2)
49+
// void __libafl_targets_cmplog_instructions(uintptr_t k, uint8_t size, uint64_t arg1, uint64_t arg2)
5050
unsafe extern "C" {
5151
/// Logs an instruction for feedback during fuzzing
52-
pub fn __libafl_targets_cmplog_instructions(k: usize, shape: u8, arg1: u64, arg2: u64);
52+
pub fn __libafl_targets_cmplog_instructions(k: usize, size: u8, arg1: u64, arg2: u64);
5353

5454
/// Logs an AFL++ style instruction for feedback during fuzzing
55-
pub fn __libafl_targets_cmplog_instructions_extended(k: usize, shape: u8, arg1: u64, arg2: u64);
55+
pub fn __libafl_targets_cmplog_instructions_extended(k: usize, size: u8, arg1: u64, arg2: u64);
5656

5757
/// Logs a routine for feedback during fuzzing
5858
pub fn __libafl_targets_cmplog_routines(k: usize, ptr1: *const u8, ptr2: *const u8);
@@ -387,30 +387,32 @@ impl CmpMap for CmpLogMap {
387387

388388
fn values_of(&self, idx: usize, execution: usize) -> Option<CmpValues> {
389389
if self.headers[idx].kind == CMPLOG_KIND_INS {
390+
let shape = self.headers[idx].shape;
390391
unsafe {
391-
match self.headers[idx].shape {
392-
1 => Some(CmpValues::U8((
392+
match shape {
393+
0 => Some(CmpValues::U8((
393394
self.vals.operands[idx][execution].0 as u8,
394395
self.vals.operands[idx][execution].1 as u8,
395396
self.vals.operands[idx][execution].2 == 1,
396397
))),
397-
2 => Some(CmpValues::U16((
398+
1 => Some(CmpValues::U16((
398399
self.vals.operands[idx][execution].0 as u16,
399400
self.vals.operands[idx][execution].1 as u16,
400401
self.vals.operands[idx][execution].2 == 1,
401402
))),
402-
4 => Some(CmpValues::U32((
403+
3 => Some(CmpValues::U32((
403404
self.vals.operands[idx][execution].0 as u32,
404405
self.vals.operands[idx][execution].1 as u32,
405406
self.vals.operands[idx][execution].2 == 1,
406407
))),
407-
8 => Some(CmpValues::U64((
408+
7 => Some(CmpValues::U64((
408409
self.vals.operands[idx][execution].0,
409410
self.vals.operands[idx][execution].1,
410411
self.vals.operands[idx][execution].2 == 1,
411412
))),
412-
// other => panic!("Invalid CmpLog shape {}", other),
413-
_ => None,
413+
// TODO handle 128 bits & 256 bits & 512 bits cmps
414+
15 | 31 | 63 => None,
415+
_ => panic!("Invalid CmpLog shape {shape}"),
414416
}
415417
}
416418
} else {
@@ -579,8 +581,9 @@ impl CmpMap for AflppCmpLogMap {
579581
fn values_of(&self, idx: usize, execution: usize) -> Option<CmpValues> {
580582
let header = self.headers[idx];
581583
if header.type_().value() == CMPLOG_KIND_INS {
584+
let shape = self.headers[idx].shape().value();
582585
unsafe {
583-
match self.headers[idx].shape().value() {
586+
match shape {
584587
0 => Some(CmpValues::U8((
585588
self.vals.operands[idx][execution].v0 as u8,
586589
self.vals.operands[idx][execution].v1 as u8,
@@ -601,9 +604,9 @@ impl CmpMap for AflppCmpLogMap {
601604
self.vals.operands[idx][execution].v1,
602605
false,
603606
))),
604-
// TODO handle 128 bits & 256 bits cmps
605-
// other => panic!("Invalid CmpLog shape {}", other),
606-
_ => None,
607+
// TODO handle 128 bits & 256 bits & 512 bits cmps
608+
15 | 31 | 63 => None,
609+
_ => panic!("Invalid CmpLog shape {shape}"),
607610
}
608611
}
609612
} else {

0 commit comments

Comments
 (0)