OLD | NEW |
1 /* | 1 /* |
2 american fuzzy lop - postprocessor library example | 2 american fuzzy lop - postprocessor library example |
3 -------------------------------------------------- | 3 -------------------------------------------------- |
4 | 4 |
5 Written and maintained by Michal Zalewski <lcamtuf@google.com> | 5 Written and maintained by Michal Zalewski <lcamtuf@google.com> |
6 | 6 |
7 Copyright 2015 Google Inc. All rights reserved. | 7 Copyright 2015 Google Inc. All rights reserved. |
8 | 8 |
9 Licensed under the Apache License, Version 2.0 (the "License"); | 9 Licensed under the Apache License, Version 2.0 (the "License"); |
10 you may not use this file except in compliance with the License. | 10 you may not use this file except in compliance with the License. |
11 You may obtain a copy of the License at: | 11 You may obtain a copy of the License at: |
12 | 12 |
13 http://www.apache.org/licenses/LICENSE-2.0 | 13 http://www.apache.org/licenses/LICENSE-2.0 |
14 | 14 |
15 Postprocessor libraries can be passed to afl-fuzz to perform final cleanup | 15 Postprocessor libraries can be passed to afl-fuzz to perform final cleanup |
16 of any mutated test cases - for example, to fix up checksums in PNG files. | 16 of any mutated test cases - for example, to fix up checksums in PNG files. |
17 | 17 |
18 Please heed the following warnings: | 18 Please heed the following warnings: |
19 | 19 |
20 1) In almost all cases, it is more productive to comment out checksum logic | 20 1) In almost all cases, it is more productive to comment out checksum logic |
21 in the targeted binary (as shown in ../libpng_no_checksum/). One possible | 21 in the targeted binary (as shown in ../libpng_no_checksum/). One possible |
22 exception is the process of fuzzing binary-only software in QEMU mode. | 22 exception is the process of fuzzing binary-only software in QEMU mode. |
23 | 23 |
24 2) Use of postprocessors for anything other than checksums is questionable | 24 2) The use of postprocessors for anything other than checksums is questionabl
e |
25 and may cause more harm than good. AFL is normally pretty good about | 25 and may cause more harm than good. AFL is normally pretty good about |
26 dealing with length fields, magic values, etc. | 26 dealing with length fields, magic values, etc. |
27 | 27 |
28 3) Post-processors that do anything non-trivial must be extremely robust to | 28 3) Postprocessors that do anything non-trivial must be extremely robust to |
29 gracefully handle malformed data and other error conditions - otherwise, | 29 gracefully handle malformed data and other error conditions - otherwise, |
30 they will crash and take afl-fuzz down with them. Be wary of reading past | 30 they will crash and take afl-fuzz down with them. Be wary of reading past |
31 *len and of integer overflows when calculating file offsets. | 31 *len and of integer overflows when calculating file offsets. |
32 | 32 |
33 In other words, THIS IS PROBABLY NOT WHAT YOU WANT - unless you really, | 33 In other words, THIS IS PROBABLY NOT WHAT YOU WANT - unless you really, |
34 honestly know what you're doing =) | 34 honestly know what you're doing =) |
35 | 35 |
36 With that out of the way: the postprocessor library is passed to afl-fuzz | 36 With that out of the way: the postprocessor library is passed to afl-fuzz |
37 via AFL_POST_LIBRARY. The library must be compiled with: | 37 via AFL_POST_LIBRARY. The library must be compiled with: |
38 | 38 |
(...skipping 71 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
110 /* Insert the new header. */ | 110 /* Insert the new header. */ |
111 | 111 |
112 memcpy(new_buf, HEADER, strlen(HEADER)); | 112 memcpy(new_buf, HEADER, strlen(HEADER)); |
113 | 113 |
114 /* Return modified buffer. No need to update *len in this particular case, | 114 /* Return modified buffer. No need to update *len in this particular case, |
115 as we're not changing it. */ | 115 as we're not changing it. */ |
116 | 116 |
117 return new_buf; | 117 return new_buf; |
118 | 118 |
119 } | 119 } |
OLD | NEW |