From da6a0c544ce138703f214536505d439ce9fb3f0a Mon Sep 17 00:00:00 2001 From: Quang Nguyen Date: Tue, 21 Aug 2018 15:16:39 +0700 Subject: [PATCH] implement setup_post on Windows --- afl-fuzz.c | 21 ++++++- afl_post_library/CMakeLists.txt | 15 +++++ afl_post_library/post_library.c | 106 ++++++++++++++++++++++++++++++++ 3 files changed, 141 insertions(+), 1 deletion(-) create mode 100644 afl_post_library/CMakeLists.txt create mode 100644 afl_post_library/post_library.c diff --git a/afl-fuzz.c b/afl-fuzz.c index 5f71b4dd..c42f25a8 100755 --- a/afl-fuzz.c +++ b/afl-fuzz.c @@ -1454,10 +1454,29 @@ static void setup_shm(void) { } +char* dlerror(){ + static char msg[1024] = {0}; + DWORD errCode = GetLastError(); + FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM, NULL, errCode, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPSTR) msg, sizeof(msg)/sizeof(msg[0]), NULL); + return msg; +} /* Load postprocessor, if available. */ static void setup_post(void) { - //not implemented on Windows + HMODULE dh; + u8* fn = getenv("AFL_POST_LIBRARY"); + u32 tlen = 6; + + if (!fn) return; + ACTF("Loading postprocessor from '%s'...", fn); + dh = LoadLibraryA(fn); + if (!dh) FATAL("%s", dlerror()); + post_handler = (u8* (*)(u8*,u32*))GetProcAddress(dh, "afl_postprocess"); + if (!post_handler) FATAL("Symbol 'afl_postprocess' not found."); + + /* Do a quick test. It's better to segfault now than later =) */ + post_handler("hello", &tlen); + OKF("Postprocessor installed successfully."); } int compare_filename(const void *a, const void *b) { diff --git a/afl_post_library/CMakeLists.txt b/afl_post_library/CMakeLists.txt new file mode 100644 index 00000000..c76423d1 --- /dev/null +++ b/afl_post_library/CMakeLists.txt @@ -0,0 +1,15 @@ +cmake_minimum_required(VERSION 2.6) + +project(post_library) + +set(CMAKE_CXX_FLAGS_RELEASE "/MT") +set(CMAKE_CXX_FLAGS_DEBUG "/MTd") + +set(CMAKE_C_FLAGS_RELEASE "/MT") +set(CMAKE_C_FLAGS_DEBUG "/MTd") + +add_library(post_library SHARED + post_library.c + ) + + diff --git a/afl_post_library/post_library.c b/afl_post_library/post_library.c new file mode 100644 index 00000000..27598215 --- /dev/null +++ b/afl_post_library/post_library.c @@ -0,0 +1,106 @@ +/* + american fuzzy lop - postprocessor library example + -------------------------------------------------- + Written and maintained by Michal Zalewski + Copyright 2015 Google Inc. All rights reserved. + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at: + http://www.apache.org/licenses/LICENSE-2.0 + Postprocessor libraries can be passed to afl-fuzz to perform final cleanup + of any mutated test cases - for example, to fix up checksums in PNG files. + Please heed the following warnings: + 1) In almost all cases, it is more productive to comment out checksum logic + in the targeted binary (as shown in ../libpng_no_checksum/). One possible + exception is the process of fuzzing binary-only software in QEMU mode. + 2) The use of postprocessors for anything other than checksums is questionable + and may cause more harm than good. AFL is normally pretty good about + dealing with length fields, magic values, etc. + 3) Postprocessors that do anything non-trivial must be extremely robust to + gracefully handle malformed data and other error conditions - otherwise, + they will crash and take afl-fuzz down with them. Be wary of reading past + *len and of integer overflows when calculating file offsets. + In other words, THIS IS PROBABLY NOT WHAT YOU WANT - unless you really, + honestly know what you're doing =) + With that out of the way: the postprocessor library is passed to afl-fuzz + via AFL_POST_LIBRARY. The library must be compiled with: + gcc -shared -Wall -O3 post_library.so.c -o post_library.so + AFL will call the afl_postprocess() function for every mutated output buffer. + From there, you have three choices: + 1) If you don't want to modify the test case, simply return the original + buffer pointer ('in_buf'). + 2) If you want to skip this test case altogether and have AFL generate a + new one, return NULL. Use this sparingly - it's faster than running + the target program with patently useless inputs, but still wastes CPU + time. + 3) If you want to modify the test case, allocate an appropriately-sized + buffer, move the data into that buffer, make the necessary changes, and + then return the new pointer. You can update *len if necessary, too. + Note that the buffer will *not* be freed for you. To avoid memory leaks, + you need to free it or reuse it on subsequent calls (as shown below). + *** DO NOT MODIFY THE ORIGINAL 'in_buf' BUFFER. *** + Aight. The example below shows a simple postprocessor that tries to make + sure that all input files start with "GIF89a". + PS. If you don't like C, you can try out the unix-based wrapper from + Ben Nagy instead: https://github.com/bnagy/aflfix + */ + +#include +#include +#include + +/* Header that must be present at the beginning of every test case: */ + +#define HEADER "GIF89a" + +/* The actual postprocessor routine called by afl-fuzz: */ +#ifdef __cplusplus +extern "C" { +#endif +#ifdef _MSC_VER + __declspec(dllexport) +#endif + const unsigned char* afl_postprocess(const unsigned char* in_buf, + unsigned int* len) { + + static unsigned char* saved_buf; + unsigned char* new_buf; + + /* Skip execution altogether for buffers shorter than 6 bytes (just to + show how it's done). We can trust *len to be sane. */ + + if (*len < strlen(HEADER)) return NULL; + + /* Do nothing for buffers that already start with the expected header. */ + + if (!memcmp(in_buf, HEADER, strlen(HEADER))) return in_buf; + + /* Allocate memory for new buffer, reusing previous allocation if + possible. */ + + new_buf = realloc(saved_buf, *len); + + /* If we're out of memory, the most graceful thing to do is to return the + original buffer and give up on modifying it. Let AFL handle OOM on its + own later on. */ + + if (!new_buf) return in_buf; + saved_buf = new_buf; + + /* Copy the original data to the new location. */ + + memcpy(new_buf, in_buf, *len); + + /* Insert the new header. */ + + memcpy(new_buf, HEADER, strlen(HEADER)); + + /* Return modified buffer. No need to update *len in this particular case, + as we're not changing it. */ + + return new_buf; + + } +#ifdef __cplusplus +} +#endif \ No newline at end of file