From f137a78db7f8302c49fdf693e8e38e78b523d389 Mon Sep 17 00:00:00 2001 From: Emmanuel Fleury Date: Mon, 3 Dec 2018 15:12:14 +0100 Subject: [PATCH] Added a 'quit mode' for programs that don't quit by themselves The point of this 'quit mode' is to consider the timeout as a normal behavior of the program. This way, all the programs that expect user to close it can be fuzzed easily with this mode. --- afl-fuzz.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/afl-fuzz.c b/afl-fuzz.c index 46d1002..b7c411b 100644 --- a/afl-fuzz.c +++ b/afl-fuzz.c @@ -102,6 +102,7 @@ static u8 skip_deterministic, /* Skip deterministic stages? */ no_var_check, /* Don't detect variable behavior */ bitmap_changed = 1, /* Time to update bitmap? */ qemu_mode, /* Running in QEMU mode? */ + quit_mode, /* Running in 'force quit' mode? */ skip_requested, /* Skip request, via SIGUSR1 */ run_over10m; /* Run time over 10 minutes? */ @@ -3098,6 +3099,9 @@ static void perform_dry_run(char** argv) { case FAULT_HANG: + if (quit_mode) + break; + if (timeout_given) { /* The -t nn+ syntax in the command line sets timeout_given to '2' and @@ -7308,6 +7312,7 @@ static void usage(u8* argv0) { " -d - quick & dirty mode (skips deterministic steps)\n" " -n - fuzz without instrumentation (dumb mode)\n" + " -q - fuzz programs that do not quit by themselves (quit mode)\n" " -x dir - optional fuzzer dictionary (see README)\n\n" "Other stuff:\n\n" @@ -7933,7 +7938,7 @@ int main(int argc, char** argv) { doc_path = access(DOC_PATH, F_OK) ? "docs" : DOC_PATH; - while ((opt = getopt(argc, argv, "+i:o:f:m:t:T:dnCB:S:M:x:QN:D:L")) > 0) { + while ((opt = getopt(argc, argv, "+i:o:f:m:t:T:dnCB:S:M:x:qQN:D:L")) > 0) { switch (opt) { @@ -8074,6 +8079,12 @@ int main(int argc, char** argv) { use_banner = optarg; break; + case 'q': /* force quit mode */ + + quit_mode = 1; + + break; + case 'Q': if (qemu_mode) FATAL("Multiple -Q options not supported");