replay mode support by quarta-qti · Pull Request #1965 · AFLplusplus/AFLplusplus

quarta-qti · 2024-01-23T18:42:31Z

Hi! This pull request introduces functionality to replay records stored by using AFL_PERSISTENT_RECORD.
It includes the following changes:

store AFL_PERSISTENT_RECORD crashes, and hangs in the respective folders
adds the AFL_PERSISTENT_REPLAY define that includes in compiler-rt lib support for replaying records
includes a self-contained persistent_replay.h header file that consists of function required by the replay functionality, and when included after defining AFL_COMPAT (see persistent mode util) works as a compatibility layer to allow using compilers without afl-cc and include the replay functionality (or a simple persistent loop for what is worth).

To use the persistent replay functionality, the record number must be specified via the AFL_PERSISTENT_REPLAY env var (i.e., RECORD:XXXXX -> AFL_PERSISTENT_REPLAY=XXXXX) and the directory can be specified via AFL_PERSISTENT_DIR, otherwise the default will be considered the current directory ("./").

domenukk · 2024-01-23T22:58:32Z

Looks super useful!
I think this needs a make code-format

vanhauser-thc · 2024-01-24T08:56:37Z

yes this looks great! please do the make code-format :)

vanhauser-thc · 2024-02-01T14:53:52Z

@quarta-qti can you please check?

quarta-qti · 2024-02-05T09:38:09Z

Hi! Sorry for the late reply, I was on vacation without my laptop with me and couldn't reply! :) On it!

…ode formatting

quarta-qti · 2024-02-05T17:27:30Z

Done. I also added relevant documentation in README.persistent_mode.md, added error handling for when a non-existing record directory is passed, and added another define "AFL_PERSISTENT_REPLAY_ARGPARSE" to selectively enable support for @@-style harnesses to increase compatibility since -afaik- not all platforms allow passing command line arguments to constructors.

vanhauser-thc · 2024-02-06T08:42:58Z

   Note that every crash will be written, not only unique ones! */

-// #define AFL_PERSISTENT_RECORD
+#define AFL_PERSISTENT_RECORD


this has a fuzzing overhead, so I would not want to enable it by default

Ack! This slipped in inadvertently because of the final testing round, gonna comment it.

vanhauser-thc · 2024-02-06T08:45:43Z

-  #define __AFL_INIT() sync()
-
+  #define AFL_COMPAT
+  #include "persistent_replay.h"


this includes then a lot more that does into belong to the demo - why?

I used the demo to test and showcase the self-contained replay functionality, I'm guessing that it was not the right place to do it, and it's better to keep it as it was originally.

I think it would make sense to either:

move the self-contained replay demo into a new persistent_demo_replay.c,

add back the original defines and wrap the two blocks into a conditional block like #ifdef AFL_PERSISTENT_REPLAY

Although not directly, I hope this answers your question. 😛

yes just put that into persistent_demo_replay.c please :)

vanhauser-thc · 2024-02-06T08:48:18Z

+#define AFL_PERSISTENT_RECORD
+
+/* Adds support in compiler-rt to replay persistent records */
+#define AFL_PERSISTENT_REPLAY


also this should not by default on I think. but I a second define? persistent recording only makes sense if also replay is added? so why not removing this one and just use afl_persistent_record?

I thought persistent replay functionality might introduce some overhead in the persistent loop, and preferred to let the user choose if they want to keep a non-"replay" compiler-rt while still being able to use the record functionality in afl-fuzz.
Tbh, I did not measure if there's significant overhead added, will do and report back the results.

If persistent replay adds significant overhead I would rather add another ifdef block to define AFL_PERSISTENT_RECORD if not defined when AFL_PERSISTENT_REPLAY is defined.

#ifdef AFL_PERSISTENT_REPLAY #ifndef AFL_PERSISTENT_RECORD #define AFL_PERSISTENT_RECORD #endif #endif

On a second thought:

Overhead on persistent loop should be extremely minimal. It's pretty much just one more if.

Initialization should not be a problem, and can also be skipped with manual forkserver initialization.

I'll just use unlikely on the replay mode check, and then use only one define.

sounds good!

vanhauser-thc · 2024-02-06T08:48:57Z

@quarta-qti looks good, I left some comments for discussion :)

…eep area ptr and loc logic intact in record replay mode, move replay record example to own dir in utils, update docs, move record compat layer to separate header file

quarta-qti · 2024-02-06T17:24:19Z

All done. Cleaned up a bit the persistent loop to keep the area ptr/loc logic intact to allow reusing afl tools with the only difference from the regular persistent loop being it won't raise a STOP signal.
Also moved the compatibility functionality to a new header (afl-record-compat.h) so there's no need for the additional AFL_COMPAT define, and moved the record replay example to it's own dir in utils to keep things neat.

vanhauser-thc · 2024-02-06T18:08:34Z

  }

-#ifdef AFL_PERSISTENT_RECORD
+#ifdef AFL_eERSISTENT_RECORD


you introduced a typo here

vanhauser-thc · 2024-02-06T18:11:15Z

@@ -1811,48 +1823,58 @@ afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
          (fsrv->uses_crash_exitcode &&
           WEXITSTATUS(fsrv->child_status) == fsrv->crash_exitcode))) {



from here below to the end of the file the changes seem to change logic/behaviour of non AFL_PERSISTENT_RECORD - can you please have a look?

Silly mistake here, it just needed wrapping the persistent record logic in a conditional statement checking if the mode is active. Same goes for the hangs logic before here. Fixed! Thanks for spotting this out!

vanhauser-thc · 2024-02-06T18:12:06Z

@@ -0,0 +1,8 @@
+all:


This directory needs a short README.md what it actually does, even if it just points the the README.persistent_mode.md file.

vanhauser-thc · 2024-02-06T18:12:32Z

we are getting close to merging :)

…ng of hang/crash

vanhauser-thc · 2024-02-08T09:29:29Z

looks good now, thanks a lot!

quarta-qti · 2024-02-08T13:13:10Z

Thank you! 😊

replay mode support

8fedf49

better replay mode error handling, added replay mode documentation, c…

023fc19

…ode formatting

vanhauser-thc reviewed Feb 6, 2024

View reviewed changes

quarta-qti added 3 commits February 6, 2024 14:00

revert persistent_demo_new.c to b99bbf6

58aa181

add replay_record binaries to .gitignore

49d4fa4

reuse first_pass aux var in persistent loop for record replay mode, k…

e405e72

…eep area ptr and loc logic intact in record replay mode, move replay record example to own dir in utils, update docs, move record compat layer to separate header file

vanhauser-thc reviewed Feb 6, 2024

View reviewed changes

quarta-qti added 4 commits February 6, 2024 21:25

fix typo

a7fd84e

added README.md to utils/replay_record

8e4bd03

add conditional check for persistent record mode on forkserver handli…

ea0ea88

…ng of hang/crash

updated readme

956fa95

vanhauser-thc merged commit 42c663e into AFLplusplus:dev Feb 8, 2024

quarta-qti deleted the stateful branch February 8, 2024 13:13

		@@ -1811,48 +1823,58 @@ afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
		(fsrv->uses_crash_exitcode &&
		WEXITSTATUS(fsrv->child_status) == fsrv->crash_exitcode))) {

Uh oh!

Conversation

quarta-qti commented Jan 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

domenukk commented Jan 23, 2024

Uh oh!

vanhauser-thc commented Jan 24, 2024

Uh oh!

vanhauser-thc commented Feb 1, 2024

Uh oh!

quarta-qti commented Feb 5, 2024

Uh oh!

quarta-qti commented Feb 5, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

quarta-qti Feb 6, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vanhauser-thc commented Feb 6, 2024

Uh oh!

quarta-qti commented Feb 6, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vanhauser-thc commented Feb 6, 2024

Uh oh!

vanhauser-thc commented Feb 8, 2024

Uh oh!

quarta-qti commented Feb 8, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

quarta-qti commented Jan 23, 2024 •

edited

Loading

quarta-qti Feb 6, 2024 •

edited

Loading

quarta-qti commented Feb 6, 2024 •

edited

Loading