AFL 源码阅读——part 2 afl-tmin、afl-showmap 和 afl-analyze

  if (optind == argc || !in_file || !out_file) usage(argv[0]);

  setup_shm();
  setup_signal_handlers();

  set_up_environment();

  find_binary(argv[optind]);
  detect_file_args(argv + optind);

  use_argv = argv + optind;

  exact_mode = !!getenv("AFL_TMIN_EXACT");

  read_initial_file();

  run_target(use_argv, in_data, in_len, 1);

  if (child_timed_out)
    FATAL("Target binary times out (adjusting -t may help).");

  minimize(use_argv);

  unlink(prog_in);
  prog_in = NULL;

  close(write_to_file(out_file, in_data, in_len));

static u8 run_target(char** argv, u8* mem, u32 len, u8 first_run) {

  // ... 运行前的准备 ...

  child_pid = fork();

  if (child_pid < 0) PFATAL("fork() failed");

  if (!child_pid) {
    // ... 子进程干活 ...
  }

  // ... 等待子进程结束或超时 ...
  if (waitpid(child_pid, &status, 0) <= 0) FATAL("waitpid() failed");

  // ... 分析 trace_bits ...
  cksum = hash32(trace_bits, MAP_SIZE, HASH_CONST);
}

void minimize(char** argv) {
    // 阶段 1: 块归一化
    while (set_pos < in_len) {
        if (run_target(argv, tmp_buf, in_len, 0)) {
            // 替换块并记录更改
        }
        set_pos += set_len;
    }

    // 阶段 2: 块删除
    while (del_len > 0) {
        while (del_pos < in_len) {
            if (run_target(argv, tmp_buf, del_pos + tail_len, 0)) {
                // 删除块并更新输入
            } else {
                del_pos += del_len;
            }
        }
        del_len /= 2; // 减小块大小
    }

    // 阶段 3: 字符集最小化
    for (i = 0; i < 256; i++) {
        if (run_target(argv, tmp_buf, in_len, 0)) {
            // 替换字符并记录更改
        }
    }

    // 阶段 4: 字符最小化
    for (i = 0; i < in_len; i++) {
        if (run_target(argv, tmp_buf, in_len, 0)) {
            // 替换字符并记录更改
        }
    }
}

set_len = next_p2(in_len / TMIN_SET_STEPS); // 计算初始块大小
if (set_len < TMIN_SET_MIN_SIZE) set_len = TMIN_SET_MIN_SIZE;

while (set_pos < in_len) {
    memcpy(tmp_buf, in_data, in_len);               // 复制原始数据
    memset(tmp_buf + set_pos, '0', use_len);        // 将当前块归一化为 '0'
    if (run_target(argv, tmp_buf, in_len, 0)) {     // 测试归一化后的输入
        memset(in_data + set_pos, '0', use_len);    // 如果有效，更新原始数据
        alpha_del0 += use_len;                      // 记录替换的字节数
    }
    set_pos += set_len;                             // 移动到下一个块
}

del_len = next_p2(in_len / TRIM_START_STEPS); // 初始化块大小
while (del_len > 0) {
    del_pos = 0;
    while (del_pos < in_len) {
        tail_len = in_len - del_pos - del_len;
        if (tail_len < 0) tail_len = 0;

        // 如果当前块与前一个块相同，跳过
        if (!prev_del && tail_len && !memcmp(in_data + del_pos - del_len, in_data + del_pos, del_len)) {
            del_pos += del_len;
            continue;
        }

        // 复制头部和尾部，删除当前块
        memcpy(tmp_buf, in_data, del_pos);
        memcpy(tmp_buf + del_pos, in_data + del_pos + del_len, tail_len);

        if (run_target(argv, tmp_buf, del_pos + tail_len, 0)) {
            // 如果删除有效，更新输入数据
            memcpy(in_data, tmp_buf, del_pos + tail_len);
            in_len = del_pos + tail_len;
            prev_del = 1;
        } else {
            del_pos += del_len; // 否则跳到下一个块
        }
    }
    del_len /= 2; // 减小块大小
}

// 初始化符号统计
memset(alpha_map, 0, 256 * sizeof(u32));
for (i = 0; i < in_len; i++) {
    if (!alpha_map[in_data[i]]) alpha_size++;
    alpha_map[in_data[i]]++;
}

// 遍历每个符号，尝试替换为 '0'
for (i = 0; i < 256; i++) {
    if (i == '0' || !alpha_map[i]) continue;

    memcpy(tmp_buf, in_data, in_len);
    for (r = 0; r < in_len; r++) {
        if (tmp_buf[r] == i) tmp_buf[r] = '0';
    }

    if (run_target(argv, tmp_buf, in_len, 0)) {
        memcpy(in_data, tmp_buf, in_len);
        syms_removed++;
        alpha_del1 += alpha_map[i];
        changed_any = 1;
    }
}

for (i = 0; i < in_len; i++) {
    u8 orig = tmp_buf[i];
    if (orig == '0') continue; // 跳过已归一化的字符

    tmp_buf[i] = '0'; // 尝试将字符替换为 '0'

    if (run_target(argv, tmp_buf, in_len, 0)) {
        in_data[i] = '0'; // 替换成功，更新原始数据
        alpha_del2++;
        changed_any = 1;
    } else {
        tmp_buf[i] = orig; // 替换失败，恢复原始字符
    }
}

>./afl-showmap -o trace -- ./try < in
	afl-showmap 2.57b by <lcamtuf@google.com>
	[*] Executing './try'...
	-- Program output begins --
	-- Program output ends --
	[+] Captured 5 tuples in 'trace'.
> cat trace
	011842:1
	017641:1
	041039:4
	050976:1
	057857:1

static const u8 count_class_human[256] = {

  [0]           = 0,
  [1]           = 1,
  [2]           = 2,
  [3]           = 3,
  [4 ... 7]     = 4,
  [8 ... 15]    = 5,
  [16 ... 31]   = 6,
  [32 ... 127]  = 7,
  [128 ... 255] = 8

};

    in_data[i] ^= 0xff;
    xor_ff = run_target(argv, in_data, in_len, 0);

    in_data[i] ^= 0xfe;
    xor_01 = run_target(argv, in_data, in_len, 0);

    in_data[i] = (in_data[i] ^ 0x01) - 0x10;
    sub_10 = run_target(argv, in_data, in_len, 0);

    in_data[i] += 0x20;
    add_10 = run_target(argv, in_data, in_len, 0);
    in_data[i] -= 0x10;

    if (xff_orig && x01_orig && s10_orig && a10_orig) {

      b_data[i] = RESP_NONE;
      boring_len++;

    } else if (xff_orig || x01_orig || s10_orig || a10_orig) {

      b_data[i] = RESP_MINOR;
      boring_len++;

    } else if (xor_ff == xor_01 && xor_ff == sub_10 && xor_ff == add_10) {

      b_data[i] = RESP_FIXED;

    } else b_data[i] = RESP_VARIABLE;

        case 2: {

            u16 val = *(u16*)(in_data + i);

            /* Small integers may be length fields. */
			// 小的整数可能是 len
            if (val && (val <= in_len || SWAP16(val) <= in_len)) {
              rtype = RESP_LEN;
              break;
            }

            /* Uniform integers may be checksums. */
			// 当前字节和下一个字节之间的差值大于 32 可能是 checksum
            if (val && abs(in_data[i] - in_data[i + 1]) > 32) {
              rtype = RESP_CKSUM;
              break;
            }

            break;

          }
    // 其余都是 RESP_SUSPECT