Open
Description
RetroWrite generates labels with the format as .L%x
in
Line 190 in 243db58
and
Line 191 in 9e2e633
However, for the afl-gcc
compilers of AFL-family fuzzers such as AFL++, they only instrument the label start with .L%d
if ((isdigit(line[2]) ||
(clang_mode && !strncmp(line + 1, "LBB", 3))) &&
R(100) < (long)inst_ratio) {
Taking the nm in binutils as an example, the .L9ffea
basic block is instrumented while .La0047
and .La0058
are not instrumented.
After the fix, the number of instrumentation increase from 39511 to 47795.
.L9ffea:
.LC9ffea:
/* --- AFL TRAMPOLINE (64-BIT) --- */
.align 4
leaq -(128+24)(%rsp), %rsp
movq %rdx, 0(%rsp)
movq %rcx, 8(%rsp)
movq %rax, 16(%rsp)
movq $0x00006e12, %rcx
call __afl_maybe_log
movq 16(%rsp), %rax
movq 8(%rsp), %rcx
movq 0(%rsp), %rdx
leaq (128+24)(%rsp), %rsp
/* --- END --- */
movq -0x48(%rbp), %rax
.LC9ffee:
movq -0x58(%rbp), %rcx
.LC9fff2:
movq %rax, 8(%rcx)
.LC9fff6:
movq -0x58(%rbp), %rax
.LC9fffa:
movl $0xffffffff, 0x60(%rax)
.LCa0001:
movq -0x58(%rbp), %rax
.LCa0005:
movl $1, 0x64(%rax)
.LCa000c:
movl $1, -0x64(%rbp)
.LCa0013:
movq -0x20(%rbp), %rax
.LCa0017:
movq (%rax), %rax
.LCa001a:
cmpq $0, 0x100(%rax)
.LCa0022:
je .La0047
/* --- AFL TRAMPOLINE (64-BIT) --- */
.align 4
leaq -(128+24)(%rsp), %rsp
movq %rdx, 0(%rsp)
movq %rcx, 8(%rsp)
movq %rax, 16(%rsp)
movq $0x0000740b, %rcx
call __afl_maybe_log
movq 16(%rsp), %rax
movq 8(%rsp), %rcx
movq 0(%rsp), %rdx
leaq (128+24)(%rsp), %rsp
/* --- END --- */
.LCa0028:
movq -0x20(%rbp), %rax
.LCa002c:
movq (%rax), %rax
.LCa002f:
movq 0x100(%rax), %rax
.LCa0036:
cmpl $0, 0x10(%rax)
.LCa003a:
jne .La0047
/* --- AFL TRAMPOLINE (64-BIT) --- */
.align 4
leaq -(128+24)(%rsp), %rsp
movq %rdx, 0(%rsp)
movq %rcx, 8(%rsp)
movq %rax, 16(%rsp)
movq $0x000050f3, %rcx
call __afl_maybe_log
movq 16(%rsp), %rax
movq 8(%rsp), %rcx
movq 0(%rsp), %rdx
leaq (128+24)(%rsp), %rsp
/* --- END --- */
.LCa0040:
movl $0, -0x64(%rbp)
.La0047:
.LCa0047:
movq -0x20(%rbp), %rax
.LCa004b:
movq (%rax), %rax
.LCa004e:
addq $0x100, %rax
.LCa0054:
movq %rax, -0x60(%rbp)
.La0058:
.LCa0058:
movq -0x60(%rbp), %rax
.LCa005c:
cmpq $0, (%rax)
.LCa0060:
je .La007f
I think RetroWrite could output the label with format .L%d
(see #27), or modify the code in afl-as.c
to
if (((isdigit(line[2]) || (line[2] >= 'a' && line[2] <= 'f')) ||
(clang_mode && !strncmp(line + 1, "LBB", 3))) &&
R(100) < (long)inst_ratio) {
The assembly code files are attached here.