Define AFLCustomMutator hook that can be implemented by implemented by external libraries and provided to AFL
@@ -304,6 +304,9 @@ static u32 a_extras_cnt; /* Total number of tokens available */
static u8* (*post_handler)(u8* buf, u32* len);
+/* A hook for the custom mutator function */
+extern size_t AFLCustomMutator(uint8_t *data, size_t size, size_t max_size, unsigned int seed) __attribute__((weak));
+
/* Interesting values, as per config.h */
static s8 interesting_8[] = { INTERESTING_8 };
@@ -330,7 +333,8 @@ enum {
/* 14 */ STAGE_EXTRAS_AO,
/* 15 */ STAGE_HAVOC,
/* 16 */ STAGE_SPLICE,
- /* 17 */ STAGE_PYTHON
+ /* 17 */ STAGE_PYTHON,
+ /* 18 */ STAGE_CUSTOM_MUTATOR
};
/* Stage value types */
@@ -4577,9 +4581,14 @@ static void show_stats(void) {
strcat(tmp, tmp2);
}
-
+ if (AFLCustomMutator) {
+ sprintf(tmp, "%s/%s", DI(stage_finds[STAGE_CUSTOM_MUTATOR]), DI(stage_cycles[STAGE_CUSTOM_MUTATOR]));
+ SAYF(bV bSTOP " custom mut. : " cRST "%-37s " bSTG bVR bH20 bH2 bH2 bRB "\n"
+ bLB bH30 bH20 bH2 bH bRB bSTOP cRST RESET_G1, tmp);
+ } else {
SAYF(bV bSTOP " trim : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n"
bLB bH30 bH20 bH2 bRB bSTOP cRST RESET_G1, tmp);
+ }
/* Provide some CPU utilization stats. */
@@ -5500,7 +5509,7 @@ static u8 fuzz_one(char** argv) {
* TRIMMING *
************/
- if (!dumb_mode && !queue_cur->trim_done) {
+ if (!dumb_mode && !queue_cur->trim_done && !AFLCustomMutator) {
u8 res = trim_case(argv, queue_cur, in_buf);
@@ -5530,6 +5539,29 @@ static u8 fuzz_one(char** argv) {
if (perf_score == 0) goto abandon_entry;
+ if (AFLCustomMutator) {
+ stage_short = "custom";
+ stage_name = "custom mutator";
+ stage_max = 1 << 16;
+ stage_val_type = STAGE_VAL_NONE;
+
+ orig_hit_cnt = queued_paths + unique_crashes;
+
+ for (stage_cur = 0 ; stage_cur < stage_max ; stage_cur++) {
+ size_t orig_size = (size_t) len;
+ size_t mutated_size = AFLCustomMutator(out_buf, orig_size, orig_size + 10000, UR(UINT32_MAX));
+ if (common_fuzz_stuff(argv, out_buf, (u32)mutated_size)) {
+ goto abandon_entry;
+ }
+ }
+ new_hit_cnt = queued_paths + unique_crashes;
+
+ stage_finds[STAGE_CUSTOM_MUTATOR] += new_hit_cnt - orig_hit_cnt;
+ stage_cycles[STAGE_CUSTOM_MUTATOR] += stage_max;
+ goto abandon_entry;
+ }
+
+
/* Skip right away if -d is given, if it has not been chosen sufficiently
often to warrant the expensive deterministic stage (fuzz_level), or
if it has gone through deterministic testing in earlier, resumed runs
