| OLD | NEW |
| 1 /* | 1 /* |
| 2 american fuzzy lop - injectable parts | 2 american fuzzy lop - injectable parts |
| 3 ------------------------------------- | 3 ------------------------------------- |
| 4 | 4 |
| 5 Written and maintained by Michal Zalewski <lcamtuf@google.com> | 5 Written and maintained by Michal Zalewski <lcamtuf@google.com> |
| 6 | 6 |
| 7 Forkserver design by Jann Horn <jannhorn@googlemail.com> | 7 Forkserver design by Jann Horn <jannhorn@googlemail.com> |
| 8 | 8 |
| 9 Copyright 2013, 2014, 2015 Google Inc. All rights reserved. | 9 Copyright 2013, 2014, 2015 Google Inc. All rights reserved. |
| 10 | 10 |
| (...skipping 80 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 91 work; simple relocations between .bss and .text won't work on most 64-bit | 91 work; simple relocations between .bss and .text won't work on most 64-bit |
| 92 platforms in such a case. | 92 platforms in such a case. |
| 93 | 93 |
| 94 (Fun fact: on Apple systems, .lcomm can segfault the linker.) | 94 (Fun fact: on Apple systems, .lcomm can segfault the linker.) |
| 95 | 95 |
| 96 The side effect is that state transitions are measured in a somewhat | 96 The side effect is that state transitions are measured in a somewhat |
| 97 different way, with previous tuple being recorded separately within the scope | 97 different way, with previous tuple being recorded separately within the scope |
| 98 of every .c file. This should have no impact in any practical sense. | 98 of every .c file. This should have no impact in any practical sense. |
| 99 | 99 |
| 100 Another side effect of this design is that getenv() will be called once per | 100 Another side effect of this design is that getenv() will be called once per |
| 101 every .o file when running in non-instrumented mode; an since getenv() tends | 101 every .o file when running in non-instrumented mode; and since getenv() tends |
| 102 to be optimized in funny ways, we need to be very careful to save every | 102 to be optimized in funny ways, we need to be very careful to save every |
| 103 oddball register it may touch. | 103 oddball register it may touch. |
| 104 | 104 |
| 105 */ | 105 */ |
| 106 | 106 |
| 107 static const u8* trampoline_fmt_32 = | 107 static const u8* trampoline_fmt_32 = |
| 108 | 108 |
| 109 "\n" | 109 "\n" |
| 110 "/* --- AFL TRAMPOLINE (32-BIT) --- */\n" | 110 "/* --- AFL TRAMPOLINE (32-BIT) --- */\n" |
| 111 "\n" | 111 "\n" |
| (...skipping 62 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 174 "\n" | 174 "\n" |
| 175 " /* Calculate and store hit for the code location specified in ecx. There\n" | 175 " /* Calculate and store hit for the code location specified in ecx. There\n" |
| 176 " is a double-XOR way of doing this without tainting another register,\n" | 176 " is a double-XOR way of doing this without tainting another register,\n" |
| 177 " and we use it on 64-bit systems; but it's slower for 32-bit ones. */\n" | 177 " and we use it on 64-bit systems; but it's slower for 32-bit ones. */\n" |
| 178 "\n" | 178 "\n" |
| 179 #ifndef COVERAGE_ONLY | 179 #ifndef COVERAGE_ONLY |
| 180 " movl __afl_prev_loc, %edi\n" | 180 " movl __afl_prev_loc, %edi\n" |
| 181 " xorl %ecx, %edi\n" | 181 " xorl %ecx, %edi\n" |
| 182 " shrl $1, %ecx\n" | 182 " shrl $1, %ecx\n" |
| 183 " movl %ecx, __afl_prev_loc\n" | 183 " movl %ecx, __afl_prev_loc\n" |
| 184 #endif /* !COVERAGE_ONLY */ | 184 #else |
| 185 " movl %ecx, %edi\n" |
| 186 #endif /* ^!COVERAGE_ONLY */ |
| 185 "\n" | 187 "\n" |
| 186 #ifdef SKIP_COUNTS | 188 #ifdef SKIP_COUNTS |
| 187 " orb $1, (%edx, %edi, 1)\n" | 189 " orb $1, (%edx, %edi, 1)\n" |
| 188 #else | 190 #else |
| 189 " incb (%edx, %edi, 1)\n" | 191 " incb (%edx, %edi, 1)\n" |
| 190 #endif /* ^SKIP_COUNTS */ | 192 #endif /* ^SKIP_COUNTS */ |
| 191 "\n" | 193 "\n" |
| 192 "__afl_return:\n" | 194 "__afl_return:\n" |
| 193 "\n" | 195 "\n" |
| 194 " addb $127, %al\n" | 196 " addb $127, %al\n" |
| (...skipping 513 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 708 | 710 |
| 709 " .comm __afl_global_area_ptr, 8, 8\n" | 711 " .comm __afl_global_area_ptr, 8, 8\n" |
| 710 "\n" | 712 "\n" |
| 711 ".AFL_SHM_ENV:\n" | 713 ".AFL_SHM_ENV:\n" |
| 712 " .asciz \"" SHM_ENV_VAR "\"\n" | 714 " .asciz \"" SHM_ENV_VAR "\"\n" |
| 713 "\n" | 715 "\n" |
| 714 "/* --- END --- */\n" | 716 "/* --- END --- */\n" |
| 715 "\n"; | 717 "\n"; |
| 716 | 718 |
| 717 #endif /* !_HAVE_AFL_AS_H */ | 719 #endif /* !_HAVE_AFL_AS_H */ |
| OLD | NEW |