diff --git a/afl/src/events/mod.rs b/afl/src/events/mod.rs index f292bafdc7..8453339073 100644 --- a/afl/src/events/mod.rs +++ b/afl/src/events/mod.rs @@ -12,7 +12,7 @@ use serde::{Deserialize, Serialize}; //pub mod shmem_translated; #[cfg(feature = "std")] -use std::io::Write; +use std::{io::Write, time::Duration}; use crate::corpus::Corpus; use crate::executors::Executor; @@ -24,6 +24,8 @@ use crate::utils::Rand; use crate::AflError; use crate::{engines::State, utils}; +use self::llmp::LlmpMsg; + /// Indicate if an event worked or not pub enum BrokerEventResult { /// The broker haneled this. No need to pass it on. @@ -476,6 +478,73 @@ where phantom: PhantomData<(C, E, OT, FT, I, R)>, } +impl LlmpEventManager +where + C: Corpus, + E: Executor, + OT: ObserversTuple, + FT: FeedbacksTuple, + I: Input, + R: Rand, + W: Write, +{ + /// Create llmp on a port + /// If the port is not yet bound, it will act as broker + /// Else, it will act as client. + pub fn new_on_port(port: u16, writer: W) -> Result { + let mgr = Self { + llmp: llmp::LlmpConnection::on_port(port)?, + start_time: utils::current_time(), + corpus_size: 0, + phantom: PhantomData, + client_stats: vec![], + writer, + }; + Ok(mgr) + } + + /// Returns if we are the broker + pub fn is_broker(&self) -> bool { + match self.llmp { + llmp::LlmpConnection::IsBroker { + broker: _, + listener_thread: _, + } => true, + _ => false, + } + } + + /// Run forever in the broker + pub fn broker_loop(&mut self) -> Result<(), AflError> { + match &mut self.llmp { + llmp::LlmpConnection::IsBroker { + broker, + listener_thread: _, + } => { + // TODO: Clean up that api by.. a lot! + /* + broker.add_message_hook(|client_id: u32, msg: *mut LlmpMsg| { + unsafe { + if (*msg).tag == _LLMP_TAG_EVENT_TO_BOTH { + let event = postcard::from_bytes((*msg).as_slice_unsafe())?; + match self.handle_in_broker(event)? { + BrokerEventResult::Forward => llmp::LlmpMsgHookResult::ForwardToClients, + BrokerEventResult::Handled => llmp::LlmpMsgHookResult::Handled, + } + } else { + llmp::LlmpMsgHookResult::ForwardToClients + } + } + });*/ + broker.loop_forever(Some(Duration::from_millis(5))) + }, + _ => Err(AflError::IllegalState( + "Called broker loop in the client".into(), + )), + } + } +} + #[cfg(feature = "std")] impl EventManager for LlmpEventManager diff --git a/fuzzers/libfuzzer/src/lib.rs b/fuzzers/libfuzzer/src/lib.rs index b241ee618e..8b21280f1e 100644 --- a/fuzzers/libfuzzer/src/lib.rs +++ b/fuzzers/libfuzzer/src/lib.rs @@ -10,7 +10,7 @@ use afl::engines::Engine; use afl::engines::Fuzzer; use afl::engines::State; use afl::engines::StdFuzzer; -use afl::events::LoggerEventManager; +use afl::events::LlmpEventManager; use afl::executors::inmemory::InMemoryExecutor; use afl::executors::{Executor, ExitKind}; use afl::feedbacks::MaxMapFeedback; @@ -22,8 +22,6 @@ use afl::stages::mutational::StdMutationalStage; use afl::tuples::tuple_list; use afl::utils::StdRand; -const MAP_SIZE: usize = 65536; - #[no_mangle] extern "C" { /// int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) @@ -52,7 +50,13 @@ pub extern "C" fn afl_libfuzzer_main() { // TODO: No_std event manager #[cfg(feature = "std")] - let mut events = LoggerEventManager::new(stderr()); + //let mut events = LoggerEventManager::new(stderr()); + let mut mgr = LlmpEventManager::new_on_port(1337, stderr()).unwrap(); + if mgr.is_broker() { + println!("Doing broker things."); + mgr.broker_loop().unwrap(); + } + println!("We're a client, let's fuzz :)"); let edges_observer = StdMapObserver::new_from_ptr(&NAME_COV_MAP, unsafe { __lafl_edges_map }, unsafe { @@ -71,7 +75,7 @@ pub extern "C" fn afl_libfuzzer_main() { &mut corpus, &mut generator, &mut engine, - &mut events, + &mut mgr, 4, ) .expect("Failed to load initial inputs"); @@ -83,7 +87,7 @@ pub extern "C" fn afl_libfuzzer_main() { let mut fuzzer = StdFuzzer::new(tuple_list!(stage)); fuzzer - .fuzz_loop(&mut rand, &mut state, &mut corpus, &mut engine, &mut events) + .fuzz_loop(&mut rand, &mut state, &mut corpus, &mut engine, &mut mgr) .expect("Fuzzer fatal error"); #[cfg(feature = "std")] println!("OK");