fuzz_one

/* Take the current entry from the queue, fuzz it for a while. Thisfunction is a tad too long... returns 0 if fuzzed successfully, 1 ifskipped or bailed out. *//*从队列中取出当前条目，将其模糊一段时间。此函数有点太长…如果成功模糊，则返回0；如果跳过或退出，则返回1*/static u8 fuzz_one(char** argv) {s32 len, fd, temp_len, i, j;u8  *in_buf, *out_buf, *orig_in, *ex_tmp, *eff_map = 0;u64 havoc_queued,  orig_hit_cnt, new_hit_cnt;u32 splice_cycle = 0, perf_score = 100, orig_perf, prev_cksum, eff_cnt = 1;u8  ret_val = 1, doing_det = 0;u8  a_collect[MAX_AUTO_EXTRA];u32 a_len = 0;#ifdef IGNORE_FINDS/* In IGNORE_FINDS mode, skip any entries that weren't in theinitial data set. *//*在IGNORE_FINDS模式下，跳过初始数据集中不存在的任何条目*/if (queue_cur->depth > 1) return 1;#elseif (pending_favored) {如果pending_favored不为0/* If we have any favored, non-fuzzed new arrivals in the queue,possibly skip to them at the expense of already-fuzzed or non-favoredcases. *//*如果队列中有任何受欢迎的、不模糊的新到达者，可能会以已经模糊或不受青睐的案例为代价跳过它们*/if ((queue_cur->was_fuzzed || !queue_cur->favored) &&UR(100) < SKIP_TO_NEW_PROB) return 1;对于queue_cur被fuzz过或者不是favored的，有99%的几率直接返回1。} else if (!dumb_mode && !queue_cur->favored && queued_paths > 10) {如果pending_favored为0且queued_paths(即queue里的case总数)大于10/* Otherwise, still possibly skip non-favored cases, albeit less often.The odds of skipping stuff are higher for already-fuzzed inputs andlower for never-fuzzed entries. *//*否则，仍有可能跳过不受欢迎的案例，尽管频率较低。对于已经模糊的输入，跳过内容的概率较高，而对于从未模糊的输入则较低*/if (queue_cycle > 1 && !queue_cur->was_fuzzed) {如果queue_cycle（队列被完全变异次数）大于1且queue_cur没有被fuzz过if (UR(100) < SKIP_NFAV_NEW_PROB) return 1;有75%的概率直接返回1} else {如果queue_cur被fuzz过，否则有95%的概率直接返回1if (UR(100) < SKIP_NFAV_OLD_PROB) return 1;}}#endif /* ^IGNORE_FINDS */if (not_on_tty) {ACTF("Fuzzing test case #%u (%u total, %llu uniq crashes found)...",current_entry, queued_paths, unique_crashes);fflush(stdout);}/* Map the test case into memory. */将测试用例映射到内存中fd = open(queue_cur->fname, O_RDONLY);用只读的方式打开queue_cur->fnameif (fd < 0) PFATAL("Unable to open '%s'", queue_cur->fname);len = queue_cur->len;设置len为queue_cur->lenorig_in = in_buf = mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);打开该case对应的文件，并通过mmap映射到内存里，地址赋值给in_buf和orig_inif (orig_in == MAP_FAILED) PFATAL("Unable to mmap '%s'", queue_cur->fname);close(fd);关闭fd文件/* We could mmap() out_buf as MAP_PRIVATE, but we end up clobbering everysingle byte anyway, so it wouldn't give us any performance or memory usagebenefits. *//*我们可以将mmap（）out_buf作为MAP_PRIVATE，但我们最终还是会对每个字节进行筛选，因此它不会给我们带来任何性能或内存使用方面的好处*/out_buf = ck_alloc_nozero(len);分配len大小的内存，并初始化为全0，然后将地址赋值给out_bufsubseq_tmouts = 0;cur_depth = queue_cur->depth;/******************************************** CALIBRATION (only if failed earlier on) *CALIBRATION阶段*******************************************/if (queue_cur->cal_failed) {u8 res = FAULT_TMOUT;if (queue_cur->cal_failed < CAL_CHANCES) {/* Reset exec_cksum to tell calibrate_case to re-execute the testcaseavoiding the usage of an invalid trace_bits.For more info: https://github.com/AFLplusplus/AFLplusplus/pull/425 */重置exec_cksum以告知calibrate_case重新执行测试用例，避免使用无效trace_bits(共享内存)。queue_cur->exec_cksum = 0;假如当前项有校准错误，并且校准错误次数小于3次，那么就用calibrate_case再次校准。res = calibrate_case(argv, queue_cur, in_buf, queue_cycle - 1, 0);if (res == FAULT_ERROR)FATAL("Unable to execute target application");}if (stop_soon || res != crash_mode) {cur_skipped_paths++;goto abandon_entry;}}/************* TRIMMING *修建阶段************/if (!dumb_mode && !queue_cur->trim_done) {如果该case没有trim过u8 res = trim_case(argv, queue_cur, in_buf);调用函数对其进行（trim）修建if (res == FAULT_ERROR)FATAL("Unable to execute target application");无法执行目标应用程序if (stop_soon) {如果设置了stop_sooncur_skipped_paths++;cur_skipped_paths计数加一goto abandon_entry;跳转到 abandon_entry}/* Don't retry trimming, even if it failed. */queue_cur->trim_done = 1;设置当前queue_cur为已经trim过。if (len != queue_cur->len)如果len不等于queue_cur->len（队列长度）len = queue_cur->len;令len = queue_cur->len。}memcpy(out_buf, in_buf, len);将in_buf中的内容拷贝len到out_buf/********************** PERFORMANCE SCORE *绩效分数阶段*********************/orig_perf = perf_score = calculate_score(queue_cur);计算queue_cur的score/* Skip right away if -d is given, if we have done deterministic fuzzing onthis entry ourselves (was_fuzzed), or if it has gone through deterministictesting in earlier, resumed runs (passed_det). */if (skip_deterministic || queue_cur->was_fuzzed || queue_cur->passed_det)如果设置了skip_deterministic或者queue被fuzz过了或者queue_cur->passed_det=1goto havoc_stage;直接跳转到havoc_stage/* Skip deterministic fuzzing if exec path checksum puts this out of scopefor this master instance. *//*如果执行路径校验和使其超出此主实例的范围，则跳过确定性模糊*/if (master_max && (queue_cur->exec_cksum % master_max) != master_id - 1)如果当前的queue_cur->exec_cksum % master_max不等于master_id - 1，goto havoc_stage;直接跳转到havoc_stagedoing_det = 1;设置doing_det为1/********************************************** SIMPLE BITFLIP (+dictionary construction) *简单位翻转（+字典构造）*********************************************/#define FLIP_BIT(_ar, _b) do { \u8* _arf = (u8*)(_ar); \u32 _bf = (_b); \_arf[(_bf) >> 3] ^= (128 >> ((_bf) & 7)); \} while (0)
(_bf) & 7)相当于模8，产生了（0、1、2、3、4、5、6、7）
128的二进制为10000000
等式的右边相当于将128右移动0-7个单位
(_bf) >> 3相当于_bf/8
stage_cur最大为stage_max相当于len << 3
所以对于FLIP_BIT(_ar, _b)来说，_bf最大为(len << 3)>>3还是len
也就是说，对于这个循环来说，每运行8次循环_arf[i]（大小为一个字节）的下标i就会加一，i最大为len
同时在每8次为一组的循环中，128分别右移0、1、2、3、4、5、6、7位，将右移后产生的数字与_arf[i]进行异或翻转，而_arf[i]大小为一个字节，等价于对这个字节的每一位都做一次翻转异或/* Single walking bit. */定义一些变量stage_short = "flip1";stage_max   = len << 3;定义stage_max为len << 3stage_name  = "bitflip 1/1";在进行bitflip 1/1变异时，对于每个byte的最低位(least significant bit)翻转还进行了额外的处理：如果连续多个bytes的最低位被翻转后，程序的执行路径都未变化，而且与原始执行路径不一致，那么就把这一段连续的bytes判断是一条token。
比如对于SQL的SELECT *，如果SELECT被破坏，则肯定和正确的路径不一致，而被破坏之后的路径却肯定是一样的，比如AELECT和SBLECT，显然都是无意义的，而只有不破坏token，才有可能出现和原始执行路径一样的结果，所以AFL在这里就是在猜解关键字token。stage_val_type = STAGE_VAL_NONE;orig_hit_cnt = queued_paths + unique_crashes;prev_cksum = queue_cur->exec_cksum;for (stage_cur = 0; stage_cur < stage_max; stage_cur++) {stage_cur_byte = stage_cur >> 3;FLIP_BIT(out_buf, stage_cur);调用了FLIP_BIT(out_buf, stage_cur)if (common_fuzz_stuff(argv, out_buf, len))当这一位被异或完毕后，调用common_fuzz_stuff(argv, out_buf, len)进行fuzz。如果返回一goto abandon_entry;直接跳转到abandon_entryFLIP_BIT(out_buf, stage_cur);再调用一次将异或翻转过来这一部分代码中给出了注释进行解释：
比如说对于一串二进制：
xxxxxxxxIHDRxxxxxxxx
当我们改变IHDR中的任意一个都会导致路径的改变or破坏， "IHDR"就像在二进制串中的一整体的具有原子性的可检查的特殊值，afl希望能找到这些值。if (!dumb_mode && (stage_cur & 7) == 7) {如果不是dumb_mode且stage_cur & 7不等于7u32 cksum = hash32(trace_bits, MAP_SIZE, HASH_CONST);计算当前共享内存（trace_bits）的hash32为校验和if (stage_cur == stage_max - 1 && cksum == prev_cksum) {如果当前到达最后一轮循环并且cksum == prev_cksum/* If at end of file and we are still collecting a string, grab thefinal character and force output. */if (a_len < MAX_AUTO_EXTRA)如果a_len小于MAX_AUTO_EXTRAa_collect[a_len] = out_buf[stage_cur >> 3];a_len++;if (a_len >= MIN_AUTO_EXTRA && a_len <= MAX_AUTO_EXTRA)如果a_len 在MIN_AUTO_EXTRA与MAX_AUTO_EXTRA之间maybe_add_auto(a_collect, a_len);将发现的新token加入a_extra[]} else if (cksum != prev_cksum) {如果cksum != prev_cksum/* Otherwise, if the checksum has changed, see if we have somethingworthwhile queued up, and collect that if the answer is yes. */if (a_len >= MIN_AUTO_EXTRA && a_len <= MAX_AUTO_EXTRA)maybe_add_auto(a_collect, a_len);a_len = 0;a_len归零prev_cksum = cksum;令prev_cksum = cksum}/* Continue collecting string, but only if the bit flip actually madeany difference - we don't want no-op tokens. *//*继续收集字符串，但前提是位翻转确实起到了任何作用-我们不希望没有op标记*/if (cksum != queue_cur->exec_cksum) {if (a_len < MAX_AUTO_EXTRA) a_collect[a_len] = out_buf[stage_cur >> 3];        a_len++;}}}new_hit_cnt = queued_paths + unique_crashes;更新new_hit_cnt为queued_paths + unique_crashesstage_finds[STAGE_FLIP1]  += new_hit_cnt - orig_hit_cnt;stage_finds[STAGE_FLIP1]的值加上在整个FLIP_BIT中新发现的路径和Crash总和stage_cycles[STAGE_FLIP1] += stage_max;stage_cycles[STAGE_FLIP1]的值加上在整个FLIP_BIT中执行的target次数stage_max/* Two walking bits. */连续翻转相邻的两位stage_name  = "bitflip 2/1";stage_name为bitflip 2/1原理和之前一样，只是这次是连续翻转相邻的两位。stage_max = (len << 3) - 1;
for (stage_cur = 0; stage_cur < stage_max; stage_cur++)
{FLIP_BIT(out_buf, stage_cur);FLIP_BIT(out_buf, stage_cur + 1);if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;FLIP_BIT(out_buf, stage_cur);FLIP_BIT(out_buf, stage_cur + 1);
}stage_short = "flip2";stage_max   = (len << 3) - 1;orig_hit_cnt = new_hit_cnt;保存当前new_hit_cnt到orig_hit_cntfor (stage_cur = 0; stage_cur < stage_max; stage_cur++) {stage_cur_byte = stage_cur >> 3;FLIP_BIT(out_buf, stage_cur);FLIP_BIT(out_buf, stage_cur + 1);if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;FLIP_BIT(out_buf, stage_cur);FLIP_BIT(out_buf, stage_cur + 1);}new_hit_cnt = queued_paths + unique_crashes;翻转结束后更新new_hit_cnt然后保存结果到stage_finds[STAGE_FLIP2]和stage_cycles[STAGE_FLIP2]里stage_finds[STAGE_FLIP2]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_FLIP2] += stage_max;/* Four walking bits. */接下来同样的进入bitflip 4/1，连续翻转4次stage_name  = "bitflip 4/1";stage_short = "flip4";stage_max   = (len << 3) - 3;orig_hit_cnt = new_hit_cnt;for (stage_cur = 0; stage_cur < stage_max; stage_cur++) {stage_cur_byte = stage_cur >> 3;FLIP_BIT(out_buf, stage_cur);FLIP_BIT(out_buf, stage_cur + 1);FLIP_BIT(out_buf, stage_cur + 2);FLIP_BIT(out_buf, stage_cur + 3);if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;FLIP_BIT(out_buf, stage_cur);FLIP_BIT(out_buf, stage_cur + 1);FLIP_BIT(out_buf, stage_cur + 2);FLIP_BIT(out_buf, stage_cur + 3);}new_hit_cnt = queued_paths + unique_crashes;stage_finds[STAGE_FLIP4]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_FLIP4] += stage_max;/*效应器图设置。这些宏计算：EFF_APOS-地图中特定文件偏移的位置。EFF_ALEN-具有特定字节数的映射的长度。EFF_SPAN_ALEN-映射字节序列的跨度。*/#define EFF_APOS(_p)          ((_p) >> EFF_MAP_SCALE2)
#define EFF_REM(_x)           ((_x) & ((1 << EFF_MAP_SCALE2) - 1))
#define EFF_ALEN(_l)          (EFF_APOS(_l) + !!EFF_REM(_l))
#define EFF_SPAN_ALEN(_p, _l) (EFF_APOS((_p) + (_l) - 1) - EFF_APOS(_p) + 1)/* Initialize effector map for the next step (see comments below). Alwaysflag first and last byte as doing something. */eff_map    = ck_alloc(EFF_ALEN(len));首先分配len大小的空间eff_mapeff_map[0] = 1;将eff_map[0]初始化为1；if (EFF_APOS(len - 1) != 0) {eff_map[EFF_APOS(len - 1)] = 1;eff_cnt++;}/* Walking byte. */在进行bitflip 8/8变异时，AFL还生成了一个非常重要的信息：effector map。这个effector map几乎贯穿了整个deterministic fuzzing的始终。在对每个byte进行翻转时，如果其造成执行路径与原始路径不一致，就将该byte在effector map中标记为1，即“有效”的，否则标记为0，即“无效”的
这样做的逻辑是：如果一个byte完全翻转，都无法带来执行路径的变化，那么这个byte很有可能是属于”data”，而非”metadata”（例如size, flag等），对整个fuzzing的意义不大。所以，在随后的一些变异中，会参考effector map，跳过那些“无效”的byte，从而节省了执行资源。
由此，通过极小的开销（没有增加额外的执行次数），AFL又一次对文件格式进行了启发式的判断。看到这里，不得不叹服于AFL实现上的精妙。
不过，在某些情况下并不会检测有效字符。第一种情况就是dumb mode或者从fuzzer，此时文件所有的字符都有可能被变异。第二、第三种情况与文件本身有关：设置stage_name为bitflip 8/8，以字节为单位，其不是通过FILP宏来做翻转直接通过和0xff亦或运算去翻转整个字节的位，然后执行一次，并记录。stage_name  = "bitflip 8/8";stage_short = "flip8";stage_max   = len;orig_hit_cnt = new_hit_cnt;for (stage_cur = 0; stage_cur < stage_max; stage_cur++) {stage_cur_byte = stage_cur;out_buf[stage_cur] ^= 0xFF;直接通过对于out_buf的每一个字节中的每一个bit做异或翻转if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;//运行对应的test case（翻转后）if (!eff_map[EFF_APOS(stage_cur)]) {//如果eff_map[stage_cur>>3]为0的话//EFF_APOS宏也起到了一个将stage_cur>>3的效果u32 cksum;/* If in dumb mode or if the file is very short, just flag everythingwithout wasting time on checksums. */if (!dumb_mode && len >= EFF_MIN_LEN)cksum = hash32(trace_bits, MAP_SIZE, HASH_CONST);elsecksum = ~queue_cur->exec_cksum;if (cksum != queue_cur->exec_cksum) {eff_map[EFF_APOS(stage_cur)] = 1;//产生新的路径，发生了变化，此时直接将对应的eff_map中的项标记为1eff_cnt++;}}out_buf[stage_cur] ^= 0xFF;重新异或回来}/*如果效应器贴图比EFF_MAX_PERC密集，只需将整个事情标记为值得模糊，因为我们无论如何都不会节省太多时间*/if (eff_cnt != EFF_ALEN(len) &&eff_cnt * 100 / EFF_ALEN(len) > EFF_MAX_PERC) {memset(eff_map, 1, EFF_ALEN(len));blocks_eff_select += EFF_ALEN(len);} else {blocks_eff_select += eff_cnt;}blocks_eff_total += EFF_ALEN(len);更新new_hit_cnt、stage_finds[STAGE_FLIP8]、stage_cycles[STAGE_FLIP8]new_hit_cnt = queued_paths + unique_crashes;stage_finds[STAGE_FLIP8]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_FLIP8] += stage_max;/* Two walking bytes. */if (len < 2) goto skip_bitflip;如果len<2，直接跳到skip_bitflipstage_name  = "bitflip 16/8";进入"bitflip 16/8"stage_short = "flip16";stage_cur   = 0;stage_max   = len - 1;设置stage_max为len - 1，以字为单位和0xffff进行亦或运算，去翻转相邻的两个字节(即一个字的)的位orig_hit_cnt = new_hit_cnt;for (i = 0; i < len - 1; i++) {/* Let's consult the effector map... */if (!eff_map[EFF_APOS(i)] && !eff_map[EFF_APOS(i + 1)]) {唯一不同的是，在异或变异之前先检查了对应的eff_map的对应两个字节是否为0stage_max--;如果是0，stage_max计数减1.然后continue跳过continue;否则进行异或翻转后运行。}stage_cur_byte = i;*(u16*)(out_buf + i) ^= 0xFFFF;if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;*(u16*)(out_buf + i) ^= 0xFFFF;}更新这些变量new_hit_cnt = queued_paths + unique_crashes;stage_finds[STAGE_FLIP16]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_FLIP16] += stage_max;if (len < 4) goto skip_bitflip;如果len<4，跳转到skip_bitflip/* Four walking bytes. */"bitflip 32/8"，与上述基本相同。stage_name  = "bitflip 32/8";stage_short = "flip32";stage_cur   = 0;stage_max   = len - 3;orig_hit_cnt = new_hit_cnt;for (i = 0; i < len - 3; i++) {/* Let's consult the effector map... */if (!eff_map[EFF_APOS(i)] && !eff_map[EFF_APOS(i + 1)] &&!eff_map[EFF_APOS(i + 2)] && !eff_map[EFF_APOS(i + 3)]) {stage_max--;continue;}stage_cur_byte = i;*(u32*)(out_buf + i) ^= 0xFFFFFFFF;if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;*(u32*)(out_buf + i) ^= 0xFFFFFFFF;}new_hit_cnt = queued_paths + unique_crashes;stage_finds[STAGE_FLIP32]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_FLIP32] += stage_max;skip_bitflip:if (no_arith) goto skip_arith;/*********************** ARITHMETIC INC/DEC ***********************/
在bitflip变异全部进行完成后，便进入下一个阶段：arithmetic。与bitflip类似的是，arithmetic根据目标大小的不同，也分为了多个子阶段：/* 8-bit arithmetics. */八位算数
arith 8/8，每次对8个bit进行加减运算，按照每8个bit的步长从头开始，即对文件的每个byte进行整数加减变异stage_name  = "arith 8/8";stage_short = "arith8";stage_cur   = 0;stage_max   = 2 * len * ARITH_MAX;stage_val_type = STAGE_VAL_LE;orig_hit_cnt = new_hit_cnt;for (i = 0; i < len; i++) {u8 orig = out_buf[i];首先扫描out_buf，（此时一个orig是一个字节，此阶段是按字节扫描）if (!eff_map[EFF_APOS(i)]) {如果对应的eff_map中的项为0，则stage_max减去2倍的ARITH_MAX，然后continue跳过此次变异stage_max -= 2 * ARITH_MAX;continue;}stage_cur_byte = i;在config.h中的宏ARITH_MAX定义，默认为35.所以，对目标整数会进行+1, +2, …, +35, -1, -2, …, -35的变异。特别地，由于整数存在大端序和小端序两种表示方式，AFL会贴心地对这两种整数表示方式都进行变异。for (j = 1; j <= ARITH_MAX; j++) {//依次扫描orig到orig+35u8 r = orig ^ (orig + j); //将orig与orig+j（j最大为35）进行异或翻转/* Do arithmetic operations only if the result couldn't be a productof a bitflip. */if (!could_be_bitflip(r)) {//判断是否为可以通过上一阶段bitfilp得到的（这一步是为了防止相同的冗余变异，节省时间）stage_cur_val = j;out_buf[i] = orig + j;//将out_buf[i]本身加j变异if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;进行fuzzstage_cur++;} else stage_max--;//否则stage_max减1r =  orig ^ (orig - j); //将orig与orig-j（j最大为35）进行异或翻转if (!could_be_bitflip(r)) {//如果判断为可以bitfilpstage_cur_val = -j;out_buf[i] = orig - j;//将out_buf[i]本身减j变异if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;进行fuzzstage_cur++;} else stage_max--;//将out_buf[i]本身加j变异out_buf[i] = orig;}}new_hit_cnt = queued_paths + unique_crashes;stage_finds[STAGE_ARITH8]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_ARITH8] += stage_max;/* 16-bit arithmetics, both endians. */
arith 16/8，每次对16个bit进行加减运算，按照每8个bit的步长从头开始，即对文件的每个word进行整数加减变异if (len < 2) goto skip_arith;stage_name  = "arith 16/8";stage_short = "arith16";stage_cur   = 0;stage_max   = 4 * (len - 1) * ARITH_MAX;orig_hit_cnt = new_hit_cnt;for (i = 0; i < len - 1; i++) {u16 orig = *(u16*)(out_buf + i);/* Let's consult the effector map... */if (!eff_map[EFF_APOS(i)] && !eff_map[EFF_APOS(i + 1)]) {stage_max -= 4 * ARITH_MAX;continue;}stage_cur_byte = i;for (j = 1; j <= ARITH_MAX; j++) {u16 r1 = orig ^ (orig + j),r2 = orig ^ (orig - j),r3 = orig ^ SWAP16(SWAP16(orig) + j),r4 = orig ^ SWAP16(SWAP16(orig) - j);/* Try little endian addition and subtraction first. Do it onlyif the operation would affect more than one byte (hence the & 0xff overflow checks) and if it couldn't be a product ofa bitflip. */stage_val_type = STAGE_VAL_LE; if ((orig & 0xff) + j > 0xff && !could_be_bitflip(r1)) {stage_cur_val = j;*(u16*)(out_buf + i) = orig + j;if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;} else stage_max--;if ((orig & 0xff) < j && !could_be_bitflip(r2)) {stage_cur_val = -j;*(u16*)(out_buf + i) = orig - j;if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;} else stage_max--;/* Big endian comes next. Same deal. */stage_val_type = STAGE_VAL_BE;if ((orig >> 8) + j > 0xff && !could_be_bitflip(r3)) {stage_cur_val = j;*(u16*)(out_buf + i) = SWAP16(SWAP16(orig) + j);if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;} else stage_max--;if ((orig >> 8) < j && !could_be_bitflip(r4)) {stage_cur_val = -j;*(u16*)(out_buf + i) = SWAP16(SWAP16(orig) - j);if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;} else stage_max--;*(u16*)(out_buf + i) = orig;}}new_hit_cnt = queued_paths + unique_crashes;stage_finds[STAGE_ARITH16]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_ARITH16] += stage_max;/* 32-bit arithmetics, both endians. */
arith 32/8，每次对32个bit进行加减运算，按照每8个bit的步长从头开始，即对文件的每个dword进行整数加减变异if (len < 4) goto skip_arith;stage_name  = "arith 32/8";stage_short = "arith32";stage_cur   = 0;stage_max   = 4 * (len - 3) * ARITH_MAX;orig_hit_cnt = new_hit_cnt;for (i = 0; i < len - 3; i++) {u32 orig = *(u32*)(out_buf + i);/* Let's consult the effector map... */if (!eff_map[EFF_APOS(i)] && !eff_map[EFF_APOS(i + 1)] &&!eff_map[EFF_APOS(i + 2)] && !eff_map[EFF_APOS(i + 3)]) {stage_max -= 4 * ARITH_MAX;continue;}stage_cur_byte = i;for (j = 1; j <= ARITH_MAX; j++) {u32 r1 = orig ^ (orig + j),r2 = orig ^ (orig - j),r3 = orig ^ SWAP32(SWAP32(orig) + j),r4 = orig ^ SWAP32(SWAP32(orig) - j);/* Little endian first. Same deal as with 16-bit: we only want totry if the operation would have effect on more than two bytes. */stage_val_type = STAGE_VAL_LE;if ((orig & 0xffff) + j > 0xffff && !could_be_bitflip(r1)) {stage_cur_val = j;*(u32*)(out_buf + i) = orig + j;if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;} else stage_max--;if ((orig & 0xffff) < j && !could_be_bitflip(r2)) {stage_cur_val = -j;*(u32*)(out_buf + i) = orig - j;if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;} else stage_max--;/* Big endian next. */stage_val_type = STAGE_VAL_BE;if ((SWAP32(orig) & 0xffff) + j > 0xffff && !could_be_bitflip(r3)) {stage_cur_val = j;*(u32*)(out_buf + i) = SWAP32(SWAP32(orig) + j);if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;} else stage_max--;if ((SWAP32(orig) & 0xffff) < j && !could_be_bitflip(r4)) {stage_cur_val = -j;*(u32*)(out_buf + i) = SWAP32(SWAP32(orig) - j);if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;} else stage_max--;*(u32*)(out_buf + i) = orig;}}new_hit_cnt = queued_paths + unique_crashes;stage_finds[STAGE_ARITH32]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_ARITH32] += stage_max;skip_arith:/*********************** INTERESTING VALUES *用于替换的”interesting values”，是AFL预设的一些比较特殊的数,这些数的定义在config.h文件中**********************/
interest 8/8，每次对8个bit进替换，按照每8个bit的步长从头开始，即对文件的每个byte进行替换变异stage_name  = "interest 8/8";stage_short = "int8";stage_cur   = 0;stage_max   = len * sizeof(interesting_8);stage_val_type = STAGE_VAL_LE;orig_hit_cnt = new_hit_cnt;/* Setting 8-bit integers. */for (i = 0; i < len; i++) {u8 orig = out_buf[i];/* Let's consult the effector map... */if (!eff_map[EFF_APOS(i)]) {stage_max -= sizeof(interesting_8);continue;}stage_cur_byte = i;for (j = 0; j < sizeof(interesting_8); j++) {/* Skip if the value could be a product of bitflips or arithmetics. */if (could_be_bitflip(orig ^ (u8)interesting_8[j]) ||could_be_arith(orig, (u8)interesting_8[j], 1)) {保证替换不会由前面的异或和加减变异阶段得到（本质是在防止冗余变换，减小开销）stage_max--;continue;}stage_cur_val = interesting_8[j];out_buf[i] = interesting_8[j];然后通过out_buf[i] = interesting_8[j]进行一个字节的替换。if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;调用common_fuzz_stuff(argv, out_buf, len)进行fuzzout_buf[i] = orig;stage_cur++;}}new_hit_cnt = queued_paths + unique_crashes;stage_finds[STAGE_INTEREST8]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_INTEREST8] += stage_max;/* Setting 16-bit integers, both endians. */if (no_arith || len < 2) goto skip_interest;
"interest 16/8"阶段，以两个字节为单位进行替换变异，并且去除异或、加减、与单字节变异阶段的冗余，同时考虑大小端序stage_name  = "interest 16/8";stage_short = "int16";stage_cur   = 0;stage_max   = 2 * (len - 1) * (sizeof(interesting_16) >> 1);orig_hit_cnt = new_hit_cnt;for (i = 0; i < len - 1; i++) {u16 orig = *(u16*)(out_buf + i);/* Let's consult the effector map... */if (!eff_map[EFF_APOS(i)] && !eff_map[EFF_APOS(i + 1)]) {stage_max -= sizeof(interesting_16);continue;}stage_cur_byte = i;for (j = 0; j < sizeof(interesting_16) / 2; j++) {stage_cur_val = interesting_16[j];/* Skip if this could be a product of a bitflip, arithmetics,or single-byte interesting value insertion. */if (!could_be_bitflip(orig ^ (u16)interesting_16[j]) &&!could_be_arith(orig, (u16)interesting_16[j], 2) &&!could_be_interest(orig, (u16)interesting_16[j], 2, 0)) {stage_val_type = STAGE_VAL_LE;*(u16*)(out_buf + i) = interesting_16[j];if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;} else stage_max--;if ((u16)interesting_16[j] != SWAP16(interesting_16[j]) &&!could_be_bitflip(orig ^ SWAP16(interesting_16[j])) &&!could_be_arith(orig, SWAP16(interesting_16[j]), 2) &&!could_be_interest(orig, SWAP16(interesting_16[j]), 2, 1)) {stage_val_type = STAGE_VAL_BE;*(u16*)(out_buf + i) = SWAP16(interesting_16[j]);if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;} else stage_max--;}*(u16*)(out_buf + i) = orig;}new_hit_cnt = queued_paths + unique_crashes;stage_finds[STAGE_INTEREST16]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_INTEREST16] += stage_max;if (len < 4) goto skip_interest;/* Setting 32-bit integers, both endians. */
interest 32/8，每次对32个bit进替换，按照每8个bit的步长从头开始，即对文件的每个dword进行替换stage_name  = "interest 32/8";stage_short = "int32";stage_cur   = 0;stage_max   = 2 * (len - 3) * (sizeof(interesting_32) >> 2);orig_hit_cnt = new_hit_cnt;for (i = 0; i < len - 3; i++) {u32 orig = *(u32*)(out_buf + i);/* Let's consult the effector map... */if (!eff_map[EFF_APOS(i)] && !eff_map[EFF_APOS(i + 1)] &&!eff_map[EFF_APOS(i + 2)] && !eff_map[EFF_APOS(i + 3)]) {stage_max -= sizeof(interesting_32) >> 1;continue;}stage_cur_byte = i;for (j = 0; j < sizeof(interesting_32) / 4; j++) {stage_cur_val = interesting_32[j];/* Skip if this could be a product of a bitflip, arithmetics,or word interesting value insertion. */if (!could_be_bitflip(orig ^ (u32)interesting_32[j]) &&!could_be_arith(orig, interesting_32[j], 4) &&!could_be_interest(orig, interesting_32[j], 4, 0)) {stage_val_type = STAGE_VAL_LE;*(u32*)(out_buf + i) = interesting_32[j];if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;} else stage_max--;if ((u32)interesting_32[j] != SWAP32(interesting_32[j]) &&!could_be_bitflip(orig ^ SWAP32(interesting_32[j])) &&!could_be_arith(orig, SWAP32(interesting_32[j]), 4) &&!could_be_interest(orig, SWAP32(interesting_32[j]), 4, 1)) {stage_val_type = STAGE_VAL_BE;*(u32*)(out_buf + i) = SWAP32(interesting_32[j]);if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;} else stage_max--;}*(u32*)(out_buf + i) = orig;}new_hit_cnt = queued_paths + unique_crashes;stage_finds[STAGE_INTEREST32]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_INTEREST32] += stage_max;skip_interest:/********************* DICTIONARY STUFF *字典之类的********************/if (!extras_cnt) goto skip_user_extras;/* Overwrite with user-supplied extras. */用用户提供的附加内容覆盖
进入到这个阶段，就接近deterministic fuzzing的尾声了
本阶段主要基于用户提供的extra来进行一定的变异stage_name  = "user extras (over)";user extras(over),从头开始,将用户提供的tokens依次替换到原文件中,stage_max为extras_cnt * lenstage_short = "ext_UO";stage_cur   = 0;stage_max   = extras_cnt * len;stage_val_type = STAGE_VAL_NONE;orig_hit_cnt = new_hit_cnt;for (i = 0; i < len; i++) {u32 last_len = 0;stage_cur_byte = i;for (j = 0; j < extras_cnt; j++) {/*如果extras_cnt>MAX_DET_extras，则按概率跳过extras。如果没有空间插入有效负载，如果令牌是冗余的，或者如果其整个跨度在效应器映射中没有设置字节，也可以跳过它们*/if ((extras_cnt > MAX_DET_EXTRAS && UR(extras_cnt) >= MAX_DET_EXTRAS) ||extras[j].len > len - i ||!memcmp(extras[j].data, out_buf + i, extras[j].len) ||!memchr(eff_map + EFF_APOS(i), 1, EFF_SPAN_ALEN(i, extras[j].len))) {stage_max--;continue;}last_len = extras[j].len;在满足一定大小的条件下（同时有一定随机性），将用户的extra token以memcpy的方式替换/覆写（over）进去，然后进行fuzzmemcpy(out_buf + i, extras[j].data, last_len);if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;}/* Restore all the clobbered memory. */memcpy(out_buf + i, in_buf + i, last_len);}new_hit_cnt = queued_paths + unique_crashes;stage_finds[STAGE_EXTRAS_UO]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_EXTRAS_UO] += stage_max;/* Insertion of user-supplied extras. */
user extras(insert),从头开始,将用户提供的tokens依次插入到原文件中,stage_max为extras_cnt * lenstage_name  = "user extras (insert)";stage_short = "ext_UI";stage_cur   = 0;stage_max   = extras_cnt * (len + 1);orig_hit_cnt = new_hit_cnt;ex_tmp = ck_alloc(len + MAX_DICT_FILE);for (i = 0; i <= len; i++) {stage_cur_byte = i;for (j = 0; j < extras_cnt; j++) {if (len + extras[j].len > MAX_FILE) {stage_max--; continue;}/* Insert token */memcpy(ex_tmp + i, extras[j].data, extras[j].len);/* Copy tail */memcpy(ex_tmp + i + extras[j].len, out_buf + i, len - i);插入（insert）用户的extras[j]，然后产生一个新的ex_tmp，对于这个ex_tmp进行fuzz。if (common_fuzz_stuff(argv, ex_tmp, len + extras[j].len)) {ck_free(ex_tmp);goto abandon_entry;}stage_cur++;}/* Copy head */ex_tmp[i] = out_buf[i];}ck_free(ex_tmp);new_hit_cnt = queued_paths + unique_crashes;stage_finds[STAGE_EXTRAS_UI]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_EXTRAS_UI] += stage_max;skip_user_extras:if (!a_extras_cnt) goto skip_extras;auto extras(over),从头开始,将自动检测的tokens依次替换到原文件中,stage_max为MIN(a_extras_cnt, USE_AUTO_EXTRAS) * len本阶段类似于over，只不过用于替换的变成了a_extras[j]而非extras[j]stage_name  = "auto extras (over)";stage_short = "ext_AO";stage_cur   = 0;stage_max   = MIN(a_extras_cnt, USE_AUTO_EXTRAS) * len;stage_val_type = STAGE_VAL_NONE;orig_hit_cnt = new_hit_cnt;for (i = 0; i < len; i++) {u32 last_len = 0;stage_cur_byte = i;for (j = 0; j < MIN(a_extras_cnt, USE_AUTO_EXTRAS); j++) {/* See the comment in the earlier code; extras are sorted by size. */if (a_extras[j].len > len - i ||!memcmp(a_extras[j].data, out_buf + i, a_extras[j].len) ||!memchr(eff_map + EFF_APOS(i), 1, EFF_SPAN_ALEN(i, a_extras[j].len))) {stage_max--;continue;}last_len = a_extras[j].len;memcpy(out_buf + i, a_extras[j].data, last_len);if (common_fuzz_stuff(argv, out_buf, len)) goto abandon_entry;stage_cur++;}/* Restore all the clobbered memory. */memcpy(out_buf + i, in_buf + i, last_len);}new_hit_cnt = queued_paths + unique_crashes;stage_finds[STAGE_EXTRAS_AO]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_EXTRAS_AO] += stage_max;skip_extras:如果我们在不跳至havoc_stage或abandon_entry的情况下来到这里，说明我们已经正确的完成了确定的fuzz（deterministic steps）步骤，我们可以对其进行标记如 .state/ 目录if (!queue_cur->passed_det)如果没有设置queue_cur->passed_detmark_as_det_done(queue_cur);调用mark_as_det_done(queue_cur)进行标记。/***************** RANDOM HAVOC *随机毁灭阶段；本阶段做大范围的随即变异****************/
对于非dumb mode的主fuzzer来说，完成了上述deterministic fuzzing后，便进入了充满随机性的这一阶段；对于dumb mode或者从fuzzer来说，则是直接从这一阶段开始havoc_stage:stage_cur_byte = -1;/*拼接文件时也会调用毁灭阶段突变代码；如果设置了splice_cycle变量，则生成不同的描述等*/if (!splice_cycle) {如果没有设置splice_cyclestage_name  = "havoc";那么标记此阶段为“havoc”stage_short = "havoc";stage_max   = (doing_det ? HAVOC_CYCLES_INIT : HAVOC_CYCLES) *perf_score / havoc_div / 100;} else {static u8 tmp[32];perf_score = orig_perf;sprintf(tmp, "splice %u", splice_cycle);stage_name  = tmp;stage_short = "splice";否则此阶段为“splice”stage_max   = SPLICE_HAVOC * perf_score / havoc_div / 100;}if (stage_max < HAVOC_MIN) stage_max = HAVOC_MIN;temp_len = len;orig_hit_cnt = queued_paths + unique_crashes;havoc_queued = queued_paths;/*我们基本上只需要运行几千次（取决于perf_score），然后获取输入文件并进行随机叠加调整*/for (stage_cur = 0; stage_cur < stage_max; stage_cur++) {u32 use_stacking = 1 << (1 + UR(HAVOC_STACK_POW2));在每一轮stage中首先产生随机数use_stackingstage_cur_val = use_stacking;根据产生的use_stacking做相应次数的变换。相当于每一轮stage中具体的变换由多次小变化叠加产生。for (i = 0; i < use_stacking; i++) {switch (UR(15 + ((extras_cnt + a_extras_cnt) ? 2 : 0))) {每次变换具体的内容也由一个随机数决定。case 0:/* Flip a single bit somewhere. Spooky! */FLIP_BIT(out_buf, UR(temp_len << 3));break;case 1: /* Set byte to interesting value. */out_buf[UR(temp_len)] = interesting_8[UR(sizeof(interesting_8))];随机替换一个interesting_8[]中的byte进来break;case 2:/* Set word to interesting value, randomly choosing endian. */if (temp_len < 2) break;if (UR(2)) {*(u16*)(out_buf + UR(temp_len - 1)) =interesting_16[UR(sizeof(interesting_16) >> 1)];随机替换interesting_16[]中的某个word进来（大小端序随机选择）} else {*(u16*)(out_buf + UR(temp_len - 1)) = SWAP16(interesting_16[UR(sizeof(interesting_16) >> 1)]);}break;case 3:/* Set dword to interesting value, randomly choosing endian. */if (temp_len < 4) break;if (UR(2)) {*(u32*)(out_buf + UR(temp_len - 3)) =interesting_32[UR(sizeof(interesting_32) >> 2)];随机替换interesting_32[]中的某个dword进来（大小端序随机选择）} else {*(u32*)(out_buf + UR(temp_len - 3)) = SWAP32(interesting_32[UR(sizeof(interesting_32) >> 2)]);}break;case 4:/* Randomly subtract from byte. */out_buf[UR(temp_len)] -= 1 + UR(ARITH_MAX);随机选取out_buf[]中某个byte进行减变异（减随机数）break;case 5:/* Randomly add to byte. */out_buf[UR(temp_len)] += 1 + UR(ARITH_MAX);随机选取out_buf[]中某个byte进行加变异（加随机数）break;case 6:/* Randomly subtract from word, random endian. */if (temp_len < 2) break;if (UR(2)) {u32 pos = UR(temp_len - 1);*(u16*)(out_buf + pos) -= 1 + UR(ARITH_MAX);随机选取out_buf[]中某个word进行减变异（减随机数，大小端序随机选择）} else {u32 pos = UR(temp_len - 1);u16 num = 1 + UR(ARITH_MAX);*(u16*)(out_buf + pos) =SWAP16(SWAP16(*(u16*)(out_buf + pos)) - num);}break;case 7:/* Randomly add to word, random endian. */if (temp_len < 2) break;if (UR(2)) {u32 pos = UR(temp_len - 1);*(u16*)(out_buf + pos) += 1 + UR(ARITH_MAX);随机选取out_buf[]中某个word进行加变异（加随机数，大小端序随机选择）} else {u32 pos = UR(temp_len - 1);u16 num = 1 + UR(ARITH_MAX);*(u16*)(out_buf + pos) =SWAP16(SWAP16(*(u16*)(out_buf + pos)) + num);}break;case 8:/* Randomly subtract from dword, random endian. */if (temp_len < 4) break;if (UR(2)) {u32 pos = UR(temp_len - 3);*(u32*)(out_buf + pos) -= 1 + UR(ARITH_MAX);随机选取out_buf[]中某个dword进行减变异（减随机数，大小端序随机选择）} else {u32 pos = UR(temp_len - 3);u32 num = 1 + UR(ARITH_MAX);*(u32*)(out_buf + pos) =SWAP32(SWAP32(*(u32*)(out_buf + pos)) - num);}break;case 9:/* Randomly add to dword, random endian. */if (temp_len < 4) break;if (UR(2)) {u32 pos = UR(temp_len - 3);*(u32*)(out_buf + pos) += 1 + UR(ARITH_MAX);随机选取out_buf[]中某个dword进行加变异（加随机数，大小端序随机选择）} else {u32 pos = UR(temp_len - 3);u32 num = 1 + UR(ARITH_MAX);*(u32*)(out_buf + pos) =SWAP32(SWAP32(*(u32*)(out_buf + pos)) + num);}break;case 10:/* Just set a random byte to a random value. Because,why not. We use XOR with 1-255 to eliminate thepossibility of a no-op. */out_buf[UR(temp_len)] ^= 1 + UR(255);随机选取out_buf[]中某个byte进行异或翻转变异break;case 11 ... 12: {/* Delete bytes. We're making this a bit more likelythan insertion (the next option) in hopes of keepingfiles reasonably small. */u32 del_from, del_len;if (temp_len < 2) break;/* Don't delete too much. */del_len = choose_block_len(temp_len - 1);del_from = UR(temp_len - del_len + 1);memmove(out_buf + del_from, out_buf + del_from + del_len,temp_len - del_from - del_len);随机选取out_buf[]中某个byte进行删除temp_len -= del_len;break;}case 13:随机选取out_buf[]中某个位置插入一段随机长度clone_to = UR(temp_len)的内容。这段内容有75%的概率是原来out_buf[]中的内容；有25%的概率是一段相同的随机选取的数字。（这串随机选取的数字有50%的几率随机生成，有50%的几率从out_buf中选一个字节）if (temp_len + HAVOC_BLK_XL < MAX_FILE) {/* Clone bytes (75%) or insert a block of constant bytes (25%). */u8  actually_clone = UR(4);u32 clone_from, clone_to, clone_len;u8* new_buf;if (actually_clone) {clone_len  = choose_block_len(temp_len);clone_from = UR(temp_len - clone_len + 1);} else {clone_len = choose_block_len(HAVOC_BLK_XL);clone_from = 0;}clone_to   = UR(temp_len);new_buf = ck_alloc_nozero(temp_len + clone_len);/* Head */memcpy(new_buf, out_buf, clone_to);/* Inserted part */if (actually_clone)memcpy(new_buf + clone_to, out_buf + clone_from, clone_len);elsememset(new_buf + clone_to,UR(2) ? UR(256) : out_buf[UR(temp_len)], clone_len);/* Tail */memcpy(new_buf + clone_to + clone_len, out_buf + clone_to,temp_len - clone_to);ck_free(out_buf);out_buf = new_buf;temp_len += clone_len;}break;case 14: {/* Overwrite bytes with a randomly selected chunk (75%) or fixedbytes (25%). */
随机选取out_buf[]中某个位置覆写一段随机长度的内容。这段内容有75%的概率是原来out_buf[]中的内容；有25%的概率是一段相同的随机选取的数字。（这串随机选取的数字有50%的几率随机生成，有50%的几率从out_buf中选一个字节）u32 copy_from, copy_to, copy_len;if (temp_len < 2) break;copy_len  = choose_block_len(temp_len - 1);copy_from = UR(temp_len - copy_len + 1);copy_to   = UR(temp_len - copy_len + 1);if (UR(4)) {if (copy_from != copy_to)memmove(out_buf + copy_to, out_buf + copy_from, copy_len);} else memset(out_buf + copy_to,UR(2) ? UR(256) : out_buf[UR(temp_len)], copy_len);break;}/* Values 15 and 16 can be selected only if there are any extraspresent in the dictionaries. */case 15: {随机选取一段内容覆写成extra tokena_extras[use_extra].data或者extras[use_extra].data/* Overwrite bytes with an extra. */if (!extras_cnt || (a_extras_cnt && UR(2))) {/* No user-specified extras or odds in our favor. Let's use anauto-detected one. */u32 use_extra = UR(a_extras_cnt);u32 extra_len = a_extras[use_extra].len;u32 insert_at;if (extra_len > temp_len) break;insert_at = UR(temp_len - extra_len + 1);memcpy(out_buf + insert_at, a_extras[use_extra].data, extra_len);} else {/* No auto extras or odds in our favor. Use the dictionary. */u32 use_extra = UR(extras_cnt);u32 extra_len = extras[use_extra].len;u32 insert_at;if (extra_len > temp_len) break;insert_at = UR(temp_len - extra_len + 1);memcpy(out_buf + insert_at, extras[use_extra].data, extra_len);}break;}case 16: {随机选取一段内容插入extra tokena_extras[use_extra].data或者extras[use_extra].datau32 use_extra, extra_len, insert_at = UR(temp_len + 1);u8* new_buf;/* Insert an extra. Do the same dice-rolling stuff as for theprevious case. */if (!extras_cnt || (a_extras_cnt && UR(2))) {use_extra = UR(a_extras_cnt);extra_len = a_extras[use_extra].len;if (temp_len + extra_len >= MAX_FILE) break;new_buf = ck_alloc_nozero(temp_len + extra_len);/* Head */memcpy(new_buf, out_buf, insert_at);/* Inserted part */memcpy(new_buf + insert_at, a_extras[use_extra].data, extra_len);} else {use_extra = UR(extras_cnt);extra_len = extras[use_extra].len;if (temp_len + extra_len >= MAX_FILE) break;new_buf = ck_alloc_nozero(temp_len + extra_len);/* Head */memcpy(new_buf, out_buf, insert_at);/* Inserted part */memcpy(new_buf + insert_at, extras[use_extra].data, extra_len);}/* Tail */memcpy(new_buf + insert_at + extra_len, out_buf + insert_at,temp_len - insert_at);ck_free(out_buf);out_buf   = new_buf;temp_len += extra_len;break;}}}至此，叠加变化结束，调用common_fuzz_stuff(argv, out_buf, temp_len)对进行这些随机大变换后的进行fuzz。if (common_fuzz_stuff(argv, out_buf, temp_len))goto abandon_entry;/* out_buf might have been mangled a bit, so let's restore it to itsoriginal size and shape. */if (temp_len < len) out_buf = ck_realloc(out_buf, len);temp_len = len;memcpy(out_buf, in_buf, len);/* If we're finding new stuff, let's run for a bit longer, limitspermitting. */如果fuzz后的queued_paths与havoc_queued不一样了，说明发现了新路径，更新stage_max、perf_score、havoc_queuedif (queued_paths != havoc_queued) {if (perf_score <= HAVOC_MAX_MULT * 100) {stage_max  *= 2;perf_score *= 2;}havoc_queued = queued_paths;}}new_hit_cnt = queued_paths + unique_crashes;if (!splice_cycle) {stage_finds[STAGE_HAVOC]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_HAVOC] += stage_max;} else {stage_finds[STAGE_SPLICE]  += new_hit_cnt - orig_hit_cnt;stage_cycles[STAGE_SPLICE] += stage_max;}#ifndef IGNORE_FINDS/************* SPLICING *************/
当没有define IGNORE_FINDS时。如果我们经过了一整轮什么都没有发现，那么afl会进入retry_splicing:这里进一步的对于输入样本进行变换，通过拼接另一个输入样本来完成此变换，最后又跳回havoc_stage上一阶段进行大范围的随机变换。/*这是一个最后的策略，由一轮没有结果的投票触发。它获取当前输入文件，随机选择另一个输入，并在某个偏移量处将它们拼接在一起，然后依赖毁灭代码来变异该blob*/retry_splicing:if (use_splicing && splice_cycle++ < SPLICE_CYCLES &&queued_paths > 1 && queue_cur->len > 1) {struct queue_entry* target;u32 tid, split_at;u8* new_buf;s32 f_diff, l_diff;/* First of all, if we've modified in_buf for havoc, let's clean thatup... */if (in_buf != orig_in) {ck_free(in_buf);in_buf = orig_in;len = queue_cur->len;}/* Pick a random queue entry and seek to it. Don't splice with yourself. */do { tid = UR(queued_paths); } while (tid == current_entry);splicing_with = tid;target = queue;while (tid >= 100) { target = target->next_100; tid -= 100; }while (tid--) target = target->next;/* Make sure that the target has a reasonable length. */while (target && (target->len < 2 || target == queue_cur)) {target = target->next;splicing_with++;}if (!target) goto retry_splicing;/* Read the testcase into a new buffer. */fd = open(target->fname, O_RDONLY);if (fd < 0) PFATAL("Unable to open '%s'", target->fname);new_buf = ck_alloc_nozero(target->len);ck_read(fd, new_buf, target->len, target->fname);close(fd);/* Find a suitable splicing location, somewhere between the first andthe last differing byte. Bail out if the difference is just a singlebyte or so. */locate_diffs(in_buf, new_buf, MIN(len, target->len), &f_diff, &l_diff);if (f_diff < 0 || l_diff < 2 || f_diff == l_diff) {ck_free(new_buf);goto retry_splicing;}/* Split somewhere between the first and last differing byte. */split_at = f_diff + UR(l_diff - f_diff);/* Do the thing. */len = target->len;memcpy(new_buf, in_buf, split_at);in_buf = new_buf;ck_free(out_buf);out_buf = ck_alloc_nozero(len);memcpy(out_buf, in_buf, len);goto havoc_stage;}#endif /* !IGNORE_FINDS */ret_val = 0;否则设置ret_val = 0abandon_entry:到达abandon_entry:splicing_with = -1;/* Update pending_not_fuzzed count if we made it through the calibrationcycle and have not seen this entry before. */对于队列当前项信息更新。if (!stop_soon && !queue_cur->cal_failed && !queue_cur->was_fuzzed) {如果未设置stop_soon且queue_cur->cal_failed为0，queue_cur->was_fuzzed未被标记已经fuzz过queue_cur->was_fuzzed = 1;标记queue_cur->was_fuzzed为已经fuzz过了pending_not_fuzzed--;pending_not_fuzzed计数减1if (queue_cur->favored) pending_favored--;如果当前对象是favored，那么pending_favored计数也减1}munmap(orig_in, queue_cur->len);if (in_buf != orig_in) ck_free(in_buf);ck_free(out_buf);ck_free(eff_map);return ret_val;#undef FLIP_BIT}
FUZZ执行中fuzz_one相关推荐

如何查看JVM内存中的对象和执行中的方法
本机debugger就好了,远程的可以远程debugger, 在tomcat的catalina.sh里增加一行CATALINA_OPTS="-Xdebug -Xrunjdwp:transpo ...
想抛就抛：Application_Error中统一处理ajax请求执行中抛出的异常
想抛就抛:Application_Error中统一处理ajax请求执行中抛出的异常参考文章: (1)想抛就抛:Application_Error中统一处理ajax请求执行中抛出的异常 (2)http ...
软件测试测试用例执行多少条,软件测试用例执行中有效的策略
软件测试用例执行中有效的策略发表于:2010-09-02来源:作者:点击数: 软件测试用例执行中有效的策略软件测试对于大型项目,软件测试的执行,除了需要很好的测试范围分析. 测试计划制定和 ...
[项目管理]项目经理应该做什么——全程建模绩效管理办法执行中出现的偏差之二
这里对项目经理的职责说的并不是很详细,只是从一个角度来说了两句,看到的朋友不要苛刻的挑剔,呵呵.但是,这也能排除掉一些人对项目经理的误解. 本文是某公司的全程建模绩效管理办法执行中出现的偏差的第二篇, ...
php 命令执行中 PHPSESSID 妙用
php 命令执行中 PHPSESSID 妙用前言题目地址查看源码使用PHPSESSID绕过限制使用反引号绕过限制前言之前刷CTF的时候,遇到一个命令执行的题,看大佬的WP是通过PHPSE ...
AI在管理临床试验设计和执行中，人和机器还在学习曲线上？
人工智能(AI)最早描述于1955年,是制造智能计算机程序的科学和工程.AI可以被描述为 "一个实体(或一组合作实体的集体),能够从环境中接收输入,从这些输入中解释和学习,并表现出相关的和灵 ...
解决QueryTask执行中的网络请求错误
前两天有人提到在Flex API中执行QueryTask,参数给定的情况下,excute()方法时而跳入onResult,时而跳入onFault方法中. 代码和服务环境均没有变化,通过监听HTTP请求 ...
它们的定义app.config中间section节点和在执行中使用
如果现在我们需要在app.config一个节点的在下面的例子中,定义,我们需要如何进行操作? <configSections><section name="integrat ...
linux top 命令可视化_Linux top命令使用详解：显示或管理执行中的程序
top命令可以实时动态地查看系统的整体运行情况,是一个综合了多方信息监测系统性能和运行信息的实用工具.通过top命令所提供的互动式界面,用热键可以管理. 语法 top(选项) 选项 -b:以批处理模式 ...
FUZZ执行中fuzz_one

fuzz_one

FUZZ执行中fuzz_one相关推荐

最新文章

热门文章
