Add cmplog #37
Add cmplog #37
Conversation
| @@ -265,6 +287,22 @@ where | |||
| } | |||
| } | |||
|
|
|||
| /// Policy to deal with CMP and SUB instructions | |||
| pub enum CmpPolicy { | |||
There was a problem hiding this comment.
This doesn't sound correct to me. Cmplog and Cmpcov can be used together, though might be not too effective. It should be bitflags in my opinion.
There was a problem hiding this comment.
It's what the C-version of unicornafl does🤔
Line 587 in a8f96da
There was a problem hiding this comment.
And qemuafl also makes it exclusive: https://github.com/AFLplusplus/qemuafl/blob/c43dd6e0369cd5d2a2458f3bd7f4f58c8de53300/qemuafl/cpu-translate.h#L79
There was a problem hiding this comment.
Okay, then let us also do this way since using cmplog with cmpcov indeed doesn't have some interesting usages and cause slowdown.
A side question: can we even disable pc instrumentation when cmplog is detected? I forget a bit about cmplog details so correct me if that won't work.
There was a problem hiding this comment.
I agree. I'll check the implementation later.
There was a problem hiding this comment.
I have pushed a new commit, which disables PC instrumentation for CMPLOG mode :)
There was a problem hiding this comment.
No please don’t. When compiling for cmplog some users compile only once and don’t mind the speed impact. And with this it would fail
There was a problem hiding this comment.
But I need to update the docs to recommend doing this
There was a problem hiding this comment.
Okay, make sense. I was going to refer to https://github.com/AFLplusplus/AFLplusplus/blob/stable/docs/fuzzing_in_depth.md
| warn!("I'll turn off CMPCOV."); | ||
| } | ||
| unsafe { | ||
| CMPLOG_ENABLED = 1; |
There was a problem hiding this comment.
(not in the scope of this PR)
I do think we should avoid these global variables in libafl_targets
There was a problem hiding this comment.
A practical way is do like what libafl_qemu's module system does. The map pointer is retrieved from passed-in map observers, but this only hide the global vars under the hood. Anyway, to real handle this problem, a lot of work in LibAFL still needs to be done (mostly in API design since the previous global var is parameter now)
|
Thanks! |
Thanks to LibAFL, the hardest part is already implemented. :)