OLD | NEW |
1 /* | 1 /* |
2 american fuzzy lop - injectable parts | 2 american fuzzy lop - injectable parts |
3 ------------------------------------- | 3 ------------------------------------- |
4 | 4 |
5 Written and maintained by Michal Zalewski <lcamtuf@google.com> | 5 Written and maintained by Michal Zalewski <lcamtuf@google.com> |
6 | 6 |
7 Forkserver design by Jann Horn <jannhorn@googlemail.com> | 7 Forkserver design by Jann Horn <jannhorn@googlemail.com> |
8 | 8 |
9 Copyright 2013, 2014, 2015 Google Inc. All rights reserved. | 9 Copyright 2013, 2014, 2015 Google Inc. All rights reserved. |
10 | 10 |
(...skipping 80 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
91 work; simple relocations between .bss and .text won't work on most 64-bit | 91 work; simple relocations between .bss and .text won't work on most 64-bit |
92 platforms in such a case. | 92 platforms in such a case. |
93 | 93 |
94 (Fun fact: on Apple systems, .lcomm can segfault the linker.) | 94 (Fun fact: on Apple systems, .lcomm can segfault the linker.) |
95 | 95 |
96 The side effect is that state transitions are measured in a somewhat | 96 The side effect is that state transitions are measured in a somewhat |
97 different way, with previous tuple being recorded separately within the scope | 97 different way, with previous tuple being recorded separately within the scope |
98 of every .c file. This should have no impact in any practical sense. | 98 of every .c file. This should have no impact in any practical sense. |
99 | 99 |
100 Another side effect of this design is that getenv() will be called once per | 100 Another side effect of this design is that getenv() will be called once per |
101 every .o file when running in non-instrumented mode; an since getenv() tends | 101 every .o file when running in non-instrumented mode; and since getenv() tends |
102 to be optimized in funny ways, we need to be very careful to save every | 102 to be optimized in funny ways, we need to be very careful to save every |
103 oddball register it may touch. | 103 oddball register it may touch. |
104 | 104 |
105 */ | 105 */ |
106 | 106 |
107 static const u8* trampoline_fmt_32 = | 107 static const u8* trampoline_fmt_32 = |
108 | 108 |
109 "\n" | 109 "\n" |
110 "/* --- AFL TRAMPOLINE (32-BIT) --- */\n" | 110 "/* --- AFL TRAMPOLINE (32-BIT) --- */\n" |
111 "\n" | 111 "\n" |
(...skipping 62 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
174 "\n" | 174 "\n" |
175 " /* Calculate and store hit for the code location specified in ecx. There\n" | 175 " /* Calculate and store hit for the code location specified in ecx. There\n" |
176 " is a double-XOR way of doing this without tainting another register,\n" | 176 " is a double-XOR way of doing this without tainting another register,\n" |
177 " and we use it on 64-bit systems; but it's slower for 32-bit ones. */\n" | 177 " and we use it on 64-bit systems; but it's slower for 32-bit ones. */\n" |
178 "\n" | 178 "\n" |
179 #ifndef COVERAGE_ONLY | 179 #ifndef COVERAGE_ONLY |
180 " movl __afl_prev_loc, %edi\n" | 180 " movl __afl_prev_loc, %edi\n" |
181 " xorl %ecx, %edi\n" | 181 " xorl %ecx, %edi\n" |
182 " shrl $1, %ecx\n" | 182 " shrl $1, %ecx\n" |
183 " movl %ecx, __afl_prev_loc\n" | 183 " movl %ecx, __afl_prev_loc\n" |
184 #endif /* !COVERAGE_ONLY */ | 184 #else |
| 185 " movl %ecx, %edi\n" |
| 186 #endif /* ^!COVERAGE_ONLY */ |
185 "\n" | 187 "\n" |
186 #ifdef SKIP_COUNTS | 188 #ifdef SKIP_COUNTS |
187 " orb $1, (%edx, %edi, 1)\n" | 189 " orb $1, (%edx, %edi, 1)\n" |
188 #else | 190 #else |
189 " incb (%edx, %edi, 1)\n" | 191 " incb (%edx, %edi, 1)\n" |
190 #endif /* ^SKIP_COUNTS */ | 192 #endif /* ^SKIP_COUNTS */ |
191 "\n" | 193 "\n" |
192 "__afl_return:\n" | 194 "__afl_return:\n" |
193 "\n" | 195 "\n" |
194 " addb $127, %al\n" | 196 " addb $127, %al\n" |
(...skipping 513 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
708 | 710 |
709 " .comm __afl_global_area_ptr, 8, 8\n" | 711 " .comm __afl_global_area_ptr, 8, 8\n" |
710 "\n" | 712 "\n" |
711 ".AFL_SHM_ENV:\n" | 713 ".AFL_SHM_ENV:\n" |
712 " .asciz \"" SHM_ENV_VAR "\"\n" | 714 " .asciz \"" SHM_ENV_VAR "\"\n" |
713 "\n" | 715 "\n" |
714 "/* --- END --- */\n" | 716 "/* --- END --- */\n" |
715 "\n"; | 717 "\n"; |
716 | 718 |
717 #endif /* !_HAVE_AFL_AS_H */ | 719 #endif /* !_HAVE_AFL_AS_H */ |
OLD | NEW |