1#!/bin/sh 2 3. ./test-pre.sh 4 5OS=$(uname -s) 6 7$ECHO "$BLUE[*] Testing: llvm_mode, afl-showmap, afl-fuzz, afl-cmin and afl-tmin" 8test -e ../afl-clang-fast -a -e ../split-switches-pass.so && { 9 ../afl-clang-fast -o test-instr.plain ../test-instr.c > /dev/null 2>&1 10 AFL_HARDEN=1 ../afl-clang-fast -o test-compcov.harden test-compcov.c > /dev/null 2>&1 11 test -e test-instr.plain && { 12 $ECHO "$GREEN[+] llvm_mode compilation succeeded" 13 echo 0 | AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 14 AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 15 test -e test-instr.plain.0 -a -e test-instr.plain.1 && { 16 diff test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { 17 $ECHO "$RED[!] llvm_mode instrumentation should be different on different input but is not" 18 CODE=1 19 } || { 20 $ECHO "$GREEN[+] llvm_mode instrumentation present and working correctly" 21 TUPLES=`echo 0|AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'` 22 test "$TUPLES" -gt 2 -a "$TUPLES" -lt 8 && { 23 $ECHO "$GREEN[+] llvm_mode run reported $TUPLES instrumented locations which is fine" 24 } || { 25 $ECHO "$RED[!] llvm_mode instrumentation produces weird numbers: $TUPLES" 26 CODE=1 27 } 28 test "$TUPLES" -lt 3 && SKIP=1 29 true 30 } 31 } || { 32 $ECHO "$RED[!] llvm_mode instrumentation failed" 33 CODE=1 34 } 35 rm -f test-instr.plain.0 test-instr.plain.1 36 } || { 37 $ECHO "$RED[!] llvm_mode failed" 38 CODE=1 39 } 40 AFL_LLVM_INSTRUMENT=CLASSIC AFL_LLVM_THREADSAFE_INST=1 ../afl-clang-fast -o test-instr.ts ../test-instr.c > /dev/null 2>&1 41 test -e test-instr.ts && { 42 $ECHO "$GREEN[+] llvm_mode threadsafe compilation succeeded" 43 echo 0 | AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.ts.0 -r -- ./test-instr.ts > /dev/null 2>&1 44 AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.ts.1 -r -- ./test-instr.ts < /dev/null > /dev/null 2>&1 45 test -e test-instr.ts.0 -a -e test-instr.ts.1 && { 46 diff test-instr.ts.0 test-instr.ts.1 > /dev/null 2>&1 && { 47 $ECHO "$RED[!] llvm_mode threadsafe instrumentation should be different on different input but is not" 48 CODE=1 49 } || { 50 $ECHO "$GREEN[+] llvm_mode threadsafe instrumentation present and working correctly" 51 TUPLES=`echo 0|AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.ts 2>&1 | grep Captur | awk '{print$3}'` 52 test "$TUPLES" -gt 2 -a "$TUPLES" -lt 8 && { 53 $ECHO "$GREEN[+] llvm_mode run reported $TUPLES threadsafe instrumented locations which is fine" 54 } || { 55 $ECHO "$RED[!] llvm_mode threadsafe instrumentation produces weird numbers: $TUPLES" 56 CODE=1 57 } 58 test "$TUPLES" -lt 3 && SKIP=1 59 true 60 } 61 } || { 62 $ECHO "$RED[!] llvm_mode threadsafe instrumentation failed" 63 CODE=1 64 } 65 rm -f test-instr.ts.0 test-instr.ts.1 66 } || { 67 $ECHO "$RED[!] llvm_mode (threadsafe) failed" 68 CODE=1 69 } 70 ../afl-clang-fast -DTEST_SHARED_OBJECT=1 -z defs -fPIC -shared -o test-instr.so ../test-instr.c > /dev/null 2>&1 71 test -e test-instr.so && { 72 $ECHO "$GREEN[+] llvm_mode shared object with -z defs compilation succeeded" 73 test `uname -s` = 'Linux' && LIBS=-ldl 74 ../afl-clang-fast -o test-dlopen.plain test-dlopen.c ${LIBS} > /dev/null 2>&1 75 test -e test-dlopen.plain && { 76 $ECHO "$GREEN[+] llvm_mode test-dlopen compilation succeeded" 77 echo 0 | DYLD_INSERT_LIBRARIES=./test-instr.so LD_PRELOAD=./test-instr.so TEST_DLOPEN_TARGET=./test-instr.so AFL_QUIET=1 ./test-dlopen.plain > /dev/null 2>&1 78 if [ $? -ne 0 ]; then 79 $ECHO "$RED[!] llvm_mode test-dlopen exits with an error" 80 CODE=1 81 fi 82 echo 0 | AFL_PRELOAD=./test-instr.so TEST_DLOPEN_TARGET=./test-instr.so AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-dlopen.plain.0 -r -- ./test-dlopen.plain > /dev/null 2>&1 83 AFL_PRELOAD=./test-instr.so TEST_DLOPEN_TARGET=./test-instr.so AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-dlopen.plain.1 -r -- ./test-dlopen.plain < /dev/null > /dev/null 2>&1 84 test -e test-dlopen.plain.0 -a -e test-dlopen.plain.1 && { 85 diff test-dlopen.plain.0 test-dlopen.plain.1 > /dev/null 2>&1 && { 86 $ECHO "$RED[!] llvm_mode test-dlopen instrumentation should be different on different input but is not" 87 CODE=1 88 } || { 89 $ECHO "$GREEN[+] llvm_mode test-dlopen instrumentation present and working correctly" 90 TUPLES=`echo 0|AFL_PRELOAD=./test-instr.so TEST_DLOPEN_TARGET=./test-instr.so AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-dlopen.plain 2>&1 | grep Captur | awk '{print$3}'` 91 test "$TUPLES" -gt 3 -a "$TUPLES" -lt 12 && { 92 $ECHO "$GREEN[+] llvm_mode test-dlopen run reported $TUPLES instrumented locations which is fine" 93 } || { 94 $ECHO "$RED[!] llvm_mode test-dlopen instrumentation produces weird numbers: $TUPLES" 95 CODE=1 96 } 97 test "$TUPLES" -lt 3 && SKIP=1 98 true 99 } 100 } || { 101 $ECHO "$RED[!] llvm_mode test-dlopen instrumentation failed" 102 CODE=1 103 } 104 } || { 105 $ECHO "$RED[!] llvm_mode test-dlopen compilation failed" 106 CODE=1 107 } 108 rm -f test-dlopen.plain test-dlopen.plain.0 test-dlopen.plain.1 test-instr.so 109 unset LIBS 110 } || { 111 $ECHO "$RED[!] llvm_mode shared object with -z defs compilation failed" 112 CODE=1 113 } 114 test -e test-compcov.harden && test_compcov_binary_functionality ./test-compcov.harden && { 115 nm test-compcov.harden | grep -Eq 'stack_chk_fail|fstack-protector-all|fortified' > /dev/null 2>&1 && { 116 $ECHO "$GREEN[+] llvm_mode hardened mode succeeded and is working" 117 } || { 118 $ECHO "$RED[!] llvm_mode hardened mode is not hardened" 119 CODE=1 120 } 121 rm -f test-compcov.harden 122 } || { 123 $ECHO "$RED[!] llvm_mode hardened mode compilation failed" 124 CODE=1 125 } 126 # now we want to be sure that afl-fuzz is working 127 # make sure crash reporter is disabled on Mac OS X 128 (test "$OS" = "Darwin" && test $(launchctl list 2>/dev/null | grep -q '\.ReportCrash$') && { 129 $ECHO "$RED[!] we cannot run afl-fuzz with enabled crash reporter. Run 'sudo sh afl-system-config'.$RESET" 130 CODE=1 131 true 132 }) || { 133 mkdir -p in 134 echo 0 > in/in 135 test -z "$SKIP" && { 136 $ECHO "$GREY[*] running afl-fuzz for llvm_mode, this will take approx 10 seconds" 137 { 138 ../afl-fuzz -V07 -m ${MEM_LIMIT} -i in -o out -- ./test-instr.plain >>errors 2>&1 139 } >>errors 2>&1 140 test -n "$( ls out/default/queue/id:000002* 2>/dev/null )" && { 141 $ECHO "$GREEN[+] afl-fuzz is working correctly with llvm_mode" 142 } || { 143 echo CUT------------------------------------------------------------------CUT 144 cat errors 145 echo CUT------------------------------------------------------------------CUT 146 $ECHO "$RED[!] afl-fuzz is not working correctly with llvm_mode" 147 CODE=1 148 } 149 } 150 test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc" || { 151 mkdir -p in2 152 echo 000000000000000000000000 > in/in2 153 echo 111 > in/in3 154 test "$OS" = "Darwin" && { 155 $ECHO "$GREY[*] afl-cmin not available on macOS, cannot test afl-cmin" 156 } || { 157 ../afl-cmin -m ${MEM_LIMIT} -i in -o in2 -- ./test-instr.plain >/dev/null 2>&1 # why is afl-forkserver writing to stderr? 158 CNT=`ls in2/* 2>/dev/null | wc -l` 159 case "$CNT" in 160 *2) $ECHO "$GREEN[+] afl-cmin correctly minimized the number of testcases" ;; 161 *) $ECHO "$RED[!] afl-cmin did not correctly minimize the number of testcases ($CNT)" 162 CODE=1 163 ;; 164 esac 165 rm -f in2/in* 166 } 167 export AFL_QUIET=1 168 if type bash >/dev/null ; then { 169 ../afl-cmin.bash -m ${MEM_LIMIT} -i in -o in2 -- ./test-instr.plain >/dev/null 170 CNT=`ls in2/* 2>/dev/null | wc -l` 171 case "$CNT" in 172 *2) $ECHO "$GREEN[+] afl-cmin.bash correctly minimized the number of testcases" ;; 173 *) $ECHO "$RED[!] afl-cmin.bash did not correctly minimize the number of testcases ($CNT)" 174 CODE=1 175 ;; 176 esac 177 } else { 178 $ECHO "$YELLOW[-] no bash available, cannot test afl-cmin.bash" 179 INCOMPLETE=1 180 } 181 fi 182 ../afl-tmin -m ${MEM_LIMIT} -i in/in2 -o in2/in2 -- ./test-instr.plain > /dev/null 2>&1 183 SIZE=`ls -l in2/in2 2>/dev/null | awk '{print$5}'` 184 test "$SIZE" = 1 && $ECHO "$GREEN[+] afl-tmin correctly minimized the testcase" 185 test "$SIZE" = 1 || { 186 $ECHO "$RED[!] afl-tmin did incorrectly minimize the testcase to $SIZE" 187 CODE=1 188 } 189 rm -rf in2 190 } 191 rm -rf in out errors 192 } 193 rm -f test-instr.plain 194 195 $ECHO "$GREY[*] llvm_mode laf-intel/compcov testing splitting integer types (this might take some time)" 196 for testcase in ./test-int_cases.c ./test-uint_cases.c; do 197 for I in char short int long "long long"; do 198 for BITS in 8 16 32 64; do 199 bin="$testcase-split-$I-$BITS.compcov" 200 AFL_LLVM_INSTRUMENT=AFL AFL_DEBUG=1 AFL_LLVM_LAF_SPLIT_COMPARES_BITW=$BITS AFL_LLVM_LAF_SPLIT_COMPARES=1 ../afl-clang-fast -fsigned-char -DINT_TYPE="$I" -o "$bin" "$testcase" > test.out 2>&1; 201 if ! test -e "$bin"; then 202 cat test.out 203 $ECHO "$RED[!] llvm_mode laf-intel/compcov integer splitting failed! ($testcase with type $I split to $BITS)!"; 204 CODE=1 205 break 206 fi 207 if ! "$bin"; then 208 $ECHO "$RED[!] llvm_mode laf-intel/compcov integer splitting resulted in miscompilation (type $I split to $BITS)!"; 209 CODE=1 210 break 211 fi 212 rm -f "$bin" test.out || true 213 done 214 done 215 done 216 rm -f test-int-split*.compcov test.out 217 218 AFL_LLVM_INSTRUMENT=AFL AFL_DEBUG=1 AFL_LLVM_LAF_SPLIT_SWITCHES=1 AFL_LLVM_LAF_TRANSFORM_COMPARES=1 AFL_LLVM_LAF_SPLIT_COMPARES=1 ../afl-clang-fast -o test-compcov.compcov test-compcov.c > test.out 2>&1 219 test -e test-compcov.compcov && test_compcov_binary_functionality ./test-compcov.compcov && { 220 grep --binary-files=text -Eq " [ 123][0-9][0-9] location| [3-9][0-9] location" test.out && { 221 $ECHO "$GREEN[+] llvm_mode laf-intel/compcov feature works correctly" 222 } || { 223 $ECHO "$RED[!] llvm_mode laf-intel/compcov feature failed" 224 CODE=1 225 } 226 } || { 227 $ECHO "$RED[!] llvm_mode laf-intel/compcov feature compilation failed" 228 CODE=1 229 } 230 rm -f test-compcov.compcov test.out 231 AFL_LLVM_INSTRUMENT=AFL AFL_LLVM_LAF_SPLIT_FLOATS=1 ../afl-clang-fast -o test-floatingpoint test-floatingpoint.c >errors 2>&1 232 test -e test-floatingpoint && { 233 mkdir -p in 234 echo ZZZZ > in/in 235 $ECHO "$GREY[*] running afl-fuzz with floating point splitting, this will take max. 45 seconds" 236 { 237 AFL_BENCH_UNTIL_CRASH=1 AFL_NO_UI=1 ../afl-fuzz -Z -s 123 -V15 -m ${MEM_LIMIT} -i in -o out -- ./test-floatingpoint >>errors 2>&1 238 } >>errors 2>&1 239 test -n "$( ls out/default/crashes/id:* 2>/dev/null )" && { 240 $ECHO "$GREEN[+] llvm_mode laf-intel floatingpoint splitting feature works correctly" 241 } || { 242 cat errors 243 $ECHO "$RED[!] llvm_mode laf-intel floatingpoint splitting feature failed" 244 CODE=1 245 } 246 } || { 247 $ECHO "$RED[!] llvm_mode laf-intel floatingpoint splitting feature compilation failed" 248 CODE=1 249 } 250 rm -f test-floatingpoint test.out in/in errors core.* 251 echo foobar.c > instrumentlist.txt 252 AFL_DEBUG=1 AFL_LLVM_INSTRUMENT_FILE=instrumentlist.txt ../afl-clang-fast -o test-compcov test-compcov.c > test.out 2>&1 253 test -e test-compcov && test_compcov_binary_functionality ./test-compcov && { 254 grep -q "No instrumentation targets found" test.out && { 255 $ECHO "$GREEN[+] llvm_mode instrumentlist feature works correctly" 256 } || { 257 $ECHO "$RED[!] llvm_mode instrumentlist feature failed" 258 CODE=1 259 } 260 } || { 261 $ECHO "$RED[!] llvm_mode instrumentlist feature compilation failed" 262 CODE=1 263 } 264 rm -f test-compcov test.out instrumentlist.txt 265 AFL_LLVM_CMPLOG=1 ../afl-clang-fast -o test-cmplog test-cmplog.c > /dev/null 2>&1 266 ../afl-clang-fast -O0 -o test-c test-cmplog.c > /dev/null 2>&1 267 test -e test-cmplog && { 268 $ECHO "$GREY[*] running afl-fuzz for llvm_mode cmplog, this will take approx 10 seconds" 269 { 270 mkdir -p in 271 echo 00000000000000000000000000000000 > in/in 272 AFL_BENCH_UNTIL_CRASH=1 ../afl-fuzz -l 3 -m none -V30 -i in -o out -c ./test-cmplog -- ./test-c >>errors 2>&1 273 } >>errors 2>&1 274 test -n "$( ls out/default/crashes/id:000000* out/default/hangs/id:000000* 2>/dev/null )" && { 275 $ECHO "$GREEN[+] afl-fuzz is working correctly with llvm_mode cmplog" 276 } || { 277 echo CUT------------------------------------------------------------------CUT 278 cat errors 279 echo CUT------------------------------------------------------------------CUT 280 $ECHO "$RED[!] afl-fuzz is not working correctly with llvm_mode cmplog" 281 CODE=1 282 } 283 } || { 284 $ECHO "$YELLOW[-] we cannot test llvm_mode cmplog because it is not present" 285 INCOMPLETE=1 286 } 287 rm -rf errors test-cmplog test-c in core.* 288 ../afl-clang-fast -o test-persistent ../utils/persistent_mode/persistent_demo.c > /dev/null 2>&1 289 test -e test-persistent && { 290 echo foo | AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -q -r ./test-persistent && { 291 $ECHO "$GREEN[+] llvm_mode persistent mode feature works correctly" 292 } || { 293 $ECHO "$RED[!] llvm_mode persistent mode feature failed to work" 294 CODE=1 295 } 296 } || { 297 $ECHO "$RED[!] llvm_mode persistent mode feature compilation failed" 298 CODE=1 299 } 300 rm -f test-persistent 301} || { 302 $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test" 303 INCOMPLETE=1 304} 305 306. ./test-post.sh 307